@bjornpagen/bumbledb 0.10.0 → 0.12.0

package/COOKBOOK.md

@@ -18,7 +18,8 @@ recipes: each schema is constructed through the public surface, admitted
 on a real store (the engine's schema validation is the acceptance
 judgment), its fingerprint asserted stable across a reopen AND equal to
 the per-recipe cross-host golden the Rust cookbook suite also pins
-(`test/fixtures/cookbook-fingerprints.txt` — the two cookbooks teach one
+(`fixtures/cookbook-fingerprints.txt` at the repository root — the two
+cookbooks teach one
 theory per recipe number, provably), and every query snippet lowered
 through `db.prepare` (the engine's own IR validation).
 
@@ -37,12 +38,10 @@ import {
 	abandon,
 	allen,
 	bool,
-	by,
 	bytes,
 	capacity,
 	closed,
 	contained,
-	desc,
 	duration,
 	eq,
 	i64,
@@ -53,7 +52,6 @@ import {
 	not,
 	on,
 	pointIn,
-	program,
 	query,
 	ref,
 	relation,
@@ -179,7 +177,8 @@ const Grading = schema("Grading", { Kind, Task, DeterministicGrading, CustomOper
 	mirrors(on(Task.where({ kind: "CustomOperator" }), "id"), on(CustomOperatorGrading, "task"))
 	// Exclusivity is a theorem, not a statement: one id in two arms would
 	// force `kind` to equal two handles against the fresh key on id.
-	// The executor spends the same theorem again — recipe 22's free lunch.
+	// The executor spends the same theorem again as a diagnostic witness
+	// (recipe 22); multi-rule execution still keeps a spanning seen-set.
 ])
 
 // Host dispatch over the discriminator is native `switch` narrowing over
@@ -512,13 +511,32 @@ const playingAt = query(Playlists).rule((r) => {
 		.find({ track })
 })
 
-// Answers are SETS — the host sorts them, and the SDK ships the comparator:
-// sort keys as data, a bare name ascending, `desc(...)` the flip; intervals
-// order by (start, end). Limit is the language's own `.slice(0, n)`.
+// Answers are SETS — the host sorts them. Limit is the language's own
+// `.slice(0, n)`.
 const inPlayOrder = [
 	{ slot: { start: 1n, end: 2n }, track: "b" },
 	{ slot: { start: 0n, end: 1n }, track: "a" }
-].sort(by("slot", "track"))
+].sort(function bySlotThenTrack(left, right) {
+	if (left.slot.start < right.slot.start) {
+		return -1
+	}
+	if (left.slot.start > right.slot.start) {
+		return 1
+	}
+	if (left.slot.end < right.slot.end) {
+		return -1
+	}
+	if (left.slot.end > right.slot.end) {
+		return 1
+	}
+	if (left.track < right.track) {
+		return -1
+	}
+	if (left.track > right.track) {
+		return 1
+	}
+	return 0
+})
 ```
 
 Middle insert is honest about its cost: making room at position `k` shifts
@@ -928,8 +946,7 @@ const claimed = query(FreeTime).rule((r) => {
 })
 // Coalesced totals = the two-query composition (pack, then a host fold) —
 // aggregates never nest; free time (gaps) is the two-line host walk over
-// sorted packed answers (`rows.sort(by("person", "span"))` — the
-// keys-as-data comparator; limit is the language's own `.slice`) — both
+// sorted packed answers (host sorts by person then span start/end) — both
 // refusals recorded in the ledger.
 ```
 
@@ -982,14 +999,12 @@ discipline — snapshot-derived writes detect movement
 final-state point reads need no earlier witness.
 
 The generation witness: read the model, propose a delta, commit iff the model
-you read is still the model. In the SDK the whole loop is `db.writeWitnessed`
-— retry on movement is built in (every generation move is self-inflicted by
-the host's own interleaved writes), capped at 64 attempts: a callback that
-itself issues a plain `db.write` each try re-moves the generation it is about
-to witness, and past the cap that interleave hazard throws the typed
-`ErrWitnessedLivelock` instead of spinning forever. `abandon(payload)`
+you read is still the model. The SDK ships one-shot `writeFrom` (must run
+inside the read callback that owns the snapshot). Retry on
+`ErrGenerationMoved` is host policy — a short loop around `db.read` +
+`writeFrom` if the host wants it. `abandon(payload)`
 declines to commit without issuing anything — from `db.write` and
-`db.writeWitnessed` alike (the sentinel's contract is unconditional, and
+`db.writeFrom` alike (the sentinel's contract is unconditional, and
 the outcome arm is in the result type exactly when the callback can
 abandon).
 
@@ -1015,22 +1030,25 @@ const stillQueued = query(Jobs).rule((r) => {
 const db = await Db.create("./jobs.db", Jobs)
 const prepared = db.prepare(stillQueued)
 
-// The witnessed loop: premise reads via `snap`, the delta via `tx`; on a
-// moved generation the WHOLE callback reruns on a fresh snapshot. The other
-// two idioms: insert-select is the same shape (query source answers, insert
-// the derived facts); key-shaped read-modify-write uses `tx.get`/`tx.contains`
-// — final-state point reads need no earlier witness.
-const outcome = db.writeWitnessed(function updateWhere(snap, tx) {
-	const queued = snap.execute(prepared, {})
-	if (queued.length === 0) {
-		return abandon("nothing queued")
-	}
-	for (const row of queued) {
-		tx.delete(Job, { id: row.id, state: "Queued", payload: row.payload })
-		tx.insert(Job, { id: row.id, state: "Running", payload: row.payload })
-		tx.insert(Lease, { job: row.id, worker: 7n, until: 60n })
-	}
-	return undefined
+// The witnessed write: premise reads via `snap`, the delta via `tx`. On a
+// moved generation `writeFrom` throws `ErrGenerationMoved` — retry is host
+// policy. The other two idioms: insert-select is the same shape (query
+// source answers, insert the derived facts); key-shaped read-modify-write
+// uses `tx.get`/`tx.contains` — final-state point reads need no earlier
+// witness.
+const outcome = db.read(function attempt(snap) {
+	return db.writeFrom(snap, function updateWhere(tx) {
+		const queued = snap.execute(prepared, {})
+		if (queued.length === 0) {
+			return abandon("nothing queued")
+		}
+		for (const row of queued) {
+			tx.delete(Job, { id: row.id, state: "Queued", payload: row.payload })
+			tx.insert(Job, { id: row.id, state: "Running", payload: row.payload })
+			tx.insert(Lease, { job: row.id, worker: 7n, until: 60n })
+		}
+		return undefined
+	})
 })
 ```
 
@@ -1074,8 +1092,10 @@ const deriving = query(Rollup).rule((r) => {
 
 Guarantee: Lean theorem + represented planner/runtime premise — rule union is
 set-idempotent (`lean/Bumbledb/Query/Denotation.lean: union_idempotent`);
-key-backed DU arms justify the disjointness optimization
-(`lean/Bumbledb/Exec/Dedup.lean: disjoint_witness_licence`).
+key-backed DU arms justify a disjointness *witness*
+(`lean/Bumbledb/Exec/Dedup.lean: disjoint_witness_licence`) spent diagnostically
+only — execution always keeps one spanning seen-set
+(`docs/architecture/40-execution.md` § set semantics).
 
 The whole-DU read is a set of rules: one head, one rule per arm — disjunction
 is data at the top, never an execution node.
@@ -1096,7 +1116,8 @@ const Payments = schema("Payments", { Kind, Payment, Card, Ach }, [
 
 // One query, two rules (set union). The exclusivity theorem (recipe 2) is
 // spent a third time here: rules selecting different `kind` handles are
-// provably disjoint, so the executor elides cross-rule dedup — the free lunch.
+// provably disjoint. Plan introspection retains the witness; execution still
+// probes one spanning seen-set — the measured refutation deleted the elision.
 const wholeDu = query(Payments)
 	.rule((r) => {
 		const { id } = v(Payment)
@@ -1157,14 +1178,15 @@ const Gravestones = schema("Gravestones", { Step, Score, ActiveRun, Usage, Event
 
 Guarantee: host discipline for the loop — the finite `seen` set proves
 termination for the host run; the engine-native form beside it executes
-whole under the fixpoint driver, budget-bounded
-(`lean/Bumbledb/Exec/Fixpoint.lean: program_eval_sound`).
+whole under the linear reach driver, budget-bounded
+(`lean/Bumbledb/Exec/Reach.lean: evalLinearReach_eq_lfp` /
+`evalQuery_sound`).
 
 Reachability, in two dialects. The host-loop idiom remains the depth-bounded
 answer: the loop runs depth-many rounds and each round is one ∈-set query —
 an `inSet` probe, microsecond-class. The frontier discipline below *is*
 semi-naive evaluation's Δ, spent where a loop is a loop: the host. The
-engine-native form is the same closure as one stratified `program()`.
+engine-native form is the same closure as one query with `.reach()`.
 
 ```ts
 const Node = relation("Node", { id: u64.fresh, name: str })
@@ -1215,68 +1237,65 @@ for (;;) {
 Termination is the host's theorem: `seen` grows strictly or the loop breaks,
 inside a finite node set. When the idiom's costs bite — **unbounded or large
 depth**, or **closure composed into a larger plan** — write the engine-native
-form instead: `?root` seeds the predicate, and the output is the finished
-set's own identity projection (an `idb` atom is a positive occurrence, so it
+form instead: `?root` seeds the rec, and the main rule is the finished
+set's own identity projection (an interior atom is a positive occurrence, so it
 grounds its variables — no re-grounding join over a domain relation exists):
 
 ```ts
-const reach = program(Closure, (p) => {
-	const rec = p.rec("reach")
-	const seeded = rec
-		.rule((r) => {
-			const { id: c } = v(Node)
-			return r
-				.match(Node, { id: c })
-				.where(eq(c, r.param("root")))
-				.find({ c })
-		})
-		.rule((r) => {
-			const { child: c, parent } = v(Parent)
-			return r
-				.match(Parent, { child: c, parent })
-				.idb(rec, { c: parent })
-				.find({ c })
-		})
-	return p.output((r) => {
+const reach = query(Closure)
+	.reach("reach", {
+		base: [
+			(r) => {
+				const { id: c } = v(Node)
+				return r
+					.match(Node, { id: c })
+					.where(eq(c, r.param("root")))
+					.find({ c })
+			}
+		],
+		rec: [
+			(r) => {
+				const { child: c, parent } = v(Parent)
+				return r.match(Parent, { child: c, parent }).interior("reach", { c: parent }).find({ c })
+			}
+		]
+	})
+	.rule((r) => {
 		const { id: c } = v(Node)
-		return r.idb(seeded, { c }).find({ c })
+		return r.interior("reach", { c }).find({ c })
 	})
-})
 const reachPrepared = db.prepare(reach)
 ```
 
-The complement is one `r.not` away — negation **of** a finished stratum is
-engine-legal (the strata judge refuses only negation *through* a cycle), so
+The complement is one `r.not` away — negation **of** a finished rec is
+engine-legal (negation in rec is refused), so
 "every node the closure never reached" runs in-plan through the engine's
-anti-probe, never as a host-side set difference — the same program with the
-output rule:
+anti-probe, never as a host-side set difference — the same query with the
+main rule:
 
 ```ts
-const unreached = program(Closure, (p) => {
-	const rec = p.rec("reach")
-	const seeded = rec
-		.rule((r) => {
-			const { id: c } = v(Node)
-			return r
-				.match(Node, { id: c })
-				.where(eq(c, r.param("root")))
-				.find({ c })
-		})
-		.rule((r) => {
-			const { child: c, parent } = v(Parent)
-			return r
-				.match(Parent, { child: c, parent })
-				.idb(rec, { c: parent })
-				.find({ c })
-		})
-	return p.output((r) => {
+const unreached = query(Closure)
+	.reach("reach", {
+		base: [
+			(r) => {
+				const { id: c } = v(Node)
+				return r
+					.match(Node, { id: c })
+					.where(eq(c, r.param("root")))
+					.find({ c })
+			}
+		],
+		rec: [
+			(r) => {
+				const { child: c, parent } = v(Parent)
+				return r.match(Parent, { child: c, parent }).interior("reach", { c: parent }).find({ c })
+			}
+		]
+	})
+	.rule((r) => {
 		const { id: c } = v(Node)
-		return r
-			.match(Node, { id: c })
-			.where(r.not(seeded, { c }))
-			.find({ c })
+		return r.match(Node, { id: c }).where(r.not("reach", { c })).find({ c })
 	})
-})
 ```
 
 (the test drives both dialects and asserts the same reachable sets, root for
@@ -1289,16 +1308,16 @@ composition has no engine form.
 
 Guarantee: host discipline + runtime aggregate semantics — the host computes
 closure, then one checked `sum` (`lean/Bumbledb/Query/Aggregates.lean:
-checkedSum_sound`); the engine-native form folds over a *finished* lower
-stratum, the one aggregation shape the strata roster admits.
+checkedSum_sound`); the engine-native form folds over a finished rec,
+the one aggregation shape the rec roster admits.
 
 The ledger workload's real recursion case, in the same two dialects: a
 hierarchical chart of accounts and a subtree rollup. The host composition —
 recipe 24's loop accumulates the subtree's ∈-set, then **one `sum` query over
 the accumulated set** folds the postings. The engine aggregates, the host
-composes (aggregates never nest). The engine-native form is one program:
-aggregation *through* a cycle is refused, but a fold over a recursive
-predicate from a **higher stratum** reads a finished set and is ordinary.
+composes (aggregates never nest). The engine-native form is one query:
+aggregation *through* a cycle is refused, but a fold over a finished rec
+from main reads a finished set and is ordinary.
 
 ```ts
 const Account = relation("Account", { id: u64.fresh, name: str })
@@ -1324,33 +1343,33 @@ const subtreeRollup = query(Accounts).rule((r) => {
 	const { id, minor } = v(Posting)
 	return r.match(Posting, { id, account: r.inSet("subtree"), minor }).find({ total: r.sum(minor) })
 })
-// The engine-native form: the closure stratum converges first, then the
-// output's fold runs once over the finished subtree.
-const nativeRollup = program(Accounts, (p) => {
-	const sub = p.rec("sub")
-	const seeded = sub
-		.rule((r) => {
-			const { id: a } = v(Account)
-			return r
-				.match(Account, { id: a })
-				.where(eq(a, r.param("root")))
-				.find({ a })
-		})
-		.rule((r) => {
-			const { child: a, parent } = v(AccountParent)
-			return r
-				.match(AccountParent, { child: a, parent })
-				.idb(sub, { a: parent })
-				.find({ a })
-		})
-	return p.output((r) => {
+// The engine-native form: the rec converges first, then the
+// main fold runs once over the finished subtree.
+const nativeRollup = query(Accounts)
+	.reach("sub", {
+		base: [
+			(r) => {
+				const { id: a } = v(Account)
+				return r
+					.match(Account, { id: a })
+					.where(eq(a, r.param("root")))
+					.find({ a })
+			}
+		],
+		rec: [
+			(r) => {
+				const { child: a, parent } = v(AccountParent)
+				return r.match(AccountParent, { child: a, parent }).interior("sub", { a: parent }).find({ a })
+			}
+		]
+	})
+	.rule((r) => {
 		const { id, account: a, minor } = v(Posting)
 		return r
 			.match(Posting, { id, account: a, minor })
-			.idb(seeded, { a })
+			.interior("sub", { a })
 			.find({ total: r.sum(minor) })
 	})
-})
 ```
 
 ## 26. Exact partition
@@ -1419,9 +1438,9 @@ const deriving = query(MaintainedRollup).rule((r) => {
 })
 ```
 
-The host loop is `db.writeWitnessed`: derive on the attempt's snapshot, diff,
-build the delta — recipe 20's third idiom. On a moved generation the SDK
-throws away the attempt and reruns the whole callback on a fresh snapshot; it
+The host loop is `db.read` + `writeFrom`: derive on the attempt's snapshot, diff,
+build the delta — recipe 20's third idiom. On a moved generation the host
+throws away the attempt and retries on a fresh snapshot; it
 never retries a stale diff. Dependencies prove every surviving stored span
 sound, while the witness proves which source state the derivation saw;
 neither mechanism proves completeness. The engine's compiled copy
@@ -1549,20 +1568,20 @@ keyed point read answers exactly that fact or nothing, on every scope
 `crates/bumbledb/tests/keyed_get.rs`).
 
 The key is a **law**, and the read surface is that law made callable. The
-schema says `key(Program, ["grp"])` — one program per group — so "the
-program of a group" is a well-posed question with at most one answer, and
+schema says `key(Course, ["grp"])` — one course per group — so "the
+course of a group" is a well-posed question with at most one answer, and
 the store already enforces that on every commit. Hold the statement VALUE:
 it is the read's selector below (statement identity is the membership rule).
 
 ```ts
 const Grp = relation("Grp", { id: u64.fresh, label: str })
-const Program = relation("Program", { id: u64.fresh, grp: u64, title: str })
-// The law: one program per group — the callable key.
-const programGrpKey = key(Program, ["grp"])
+const Course = relation("Course", { id: u64.fresh, grp: u64, title: str })
+// The law: one course per group — the callable key.
+const courseGrpKey = key(Course, ["grp"])
 
-const KeyedRead = schema("KeyedRead", { Grp, Program }, [
-	contained(on(Program, "grp"), on(Grp, "id")),
-	programGrpKey
+const KeyedRead = schema("KeyedRead", { Grp, Course }, [
+	contained(on(Course, "grp"), on(Grp, "id")),
+	courseGrpKey
 ])
 ```
 
@@ -1576,38 +1595,38 @@ runtime shape check. The primary 2-arg form needs no statement: the fresh
 field IS the primary key.
 
 ```ts
-const db = await Db.create("./programs.db", KeyedRead)
+const db = await Db.create("./courses.db", KeyedRead)
 
 const minted: { grp?: bigint } = {}
 db.write((tx) => {
 	const g = tx.insert(Grp, { label: "algebra" })
-	tx.insert(Program, { grp: g.id, title: "linear equations" })
+	tx.insert(Course, { grp: g.id, title: "linear equations" })
 	minted.grp = g.id
 })
 const grp = minted.grp ?? 0n
 
 // db.get — the standalone keyed read through the declared law:
-const byGroup = db.get(Program, programGrpKey, { grp })
+const byGroup = db.get(Course, courseGrpKey, { grp })
 
 // snap.get — the same spelling inside a read scope:
-const viaSnap = db.read((snap) => snap.get(Program, programGrpKey, { grp }))
+const viaSnap = db.read((snap) => snap.get(Course, courseGrpKey, { grp }))
 
 // tx.get — key-shaped read-modify-write, final-state (recipe 20's third
 // idiom): per-fact premises need no earlier snapshot witness.
 db.write((tx) => {
-	const current = tx.get(Program, programGrpKey, { grp })
+	const current = tx.get(Course, courseGrpKey, { grp })
 	if (current !== undefined) {
-		tx.delete(Program, current)
-		tx.insert(Program, { id: current.id, grp: current.grp, title: "linear equations II" })
+		tx.delete(Course, current)
+		tx.insert(Course, { id: current.id, grp: current.grp, title: "linear equations II" })
 	}
 })
 
 // The primary 2-arg form — the fresh field is the primary key:
-const byId = byGroup === undefined ? undefined : db.get(Program, { id: byGroup.id })
+const byId = byGroup === undefined ? undefined : db.get(Course, { id: byGroup.id })
 ```
 
 The anti-pattern this recipe retires: a scan-and-find where a key law
-exists — `snap.scan(Program).find((row) => row.grp === grp)` — re-derives
+exists — `snap.scan(Course).find((row) => row.grp === grp)` — re-derives
 in the host what the store already enforces. The uniqueness the fold
 quietly assumes IS the declared key statement; spell the law and the point
 read comes with it.

package/README.md

@@ -2,7 +2,7 @@
 
 Type-theoretic TypeScript SDK for the [bumbledb](https://github.com/bjornpagen/bumbledb) embedded relational engine.
 
-bumbledb models data as relations judged by statements (functionality, containment, capacity) and queried with Datalog expressed as plain values — no SQL, no query-string parser. The SDK is a thin, fully typed surface over an in-process native engine (LMDB storage, MVCC snapshots, a single-writer witnessed write loop).
+bumbledb models data as relations judged by statements (functionality, containment, capacity) and queried as typed IR values — no SQL, no query-string parser. The SDK is a thin, fully typed surface over an in-process native engine (LMDB storage, MVCC snapshots, one-shot `write` / `writeFrom`).
 
 The surface is structural to the bone. Relation declarations are pure structure — kind, width, element, fresh, nothing else — and domains are never declared anywhere: **the laws type the columns**. `schema()` computes every field's equivalence class from the statement list itself, so the containments and mirrors you already write ARE the typing, at compile time and again at construction. Values stay bare (`bigint`, `string`, …); identity lives in the class the laws compute, not in a wrapper.
 
@@ -21,7 +21,7 @@ pnpm add @bjornpagen/bumbledb
 ## Quick start
 
 Declare relations as pure structure, let the statement list type every column,
-write facts through a transaction, and query with Datalog as values.
+write facts through a transaction, and query with the typed builder.
 Everything is typed end to end — bare structural values in law-computed
 classes, inferred query rows, and rejections that arrive as data rather than
 exceptions.
@@ -75,7 +75,7 @@ if (!result.ok) {
 	}
 }
 
-// Query: Datalog as values. v(R) mints a fresh variable per column, typed by
+// Query: v(R) mints a fresh variable per column, typed by
 // the column's law-class; reusing one by object reference IS the join, and
 // rows are typed from the find keys. Params are typed by use.
 // `gt` is one of the free comparison exports.
@@ -102,10 +102,6 @@ console.log(rows)
 	console.log(snap.generation, snap.execute(prepared, { floor: 15n }))
 }
 
-// explain(): the plan as data — what the engine did with the query, plan
-// sections and counters as plain values (a diagnostic surface, unfrozen).
-console.log(db.explain(prepared, { floor: 15n }).emits)
-
 // Host dispatch over the sealed roster is native `switch` narrowing over
 // the handle union ("DirectPass" | "JudgedPass" | "Failed") — exhaustive
 // via `satisfies never`; the sealed axioms read back typed.
@@ -132,8 +128,8 @@ The drizzle law governs this surface: the SDK's job at the host boundary is tran
 
 - The structural type kernel — fields as pure structure (`bool`, `bytes`, `i64`, `u64`, `str`, `interval`, `span`), `relation()`, and `closed()` sealed rosters with typed axiom payloads. A closed reference's value type IS the handle union (`Infer` speaks it); dispatch is native `switch` narrowing with `satisfies never` exhaustiveness. Domains are never declared: `schema()` computes every field's class from the statement list.
 - The statement algebra — `schema()`, `key`, `contained`, `mirrors`, `capacity`; faces via `on` (set membership is a plain array in `.where`); windows via `within` (`within(n)` exact, `within(lo, hi)` range, `within(lo, "*")` floor), measures via `weigh` (`weigh("f")` a u64 field, `weigh(duration("f"))` an interval's measure), dependent bounds via `ref`/`duration` read from the target row; ψ-selection via `.where` on relations and closed rosters.
-- The `Db` runtime — `Db.create`/`Db.open`, path-cached stores, transactions, typed violations, scoped snapshot reads (`db.read(fn)`, or `using snap = db.read()` — lifetimes are disposables, never `close()`), the write verbs with `abandon` (returning `abandon(payload)` from `write` or `writeWitnessed` rolls the transaction back; the outcome arm is in the result type), and `db.explain` — the prepared plan as data.
-- The query surface — Datalog as values, `query(S).rule(r => ...)`: `v(R)`-minted vars (identity is the object reference — reusing one across binding positions IS the join), `find({...})` named result heads (renames are real), params typed by use unchanged, negation, aggregates, and the free comparison/connective exports (`eq`, `ne`, `lt`, `le`, `gt`, `ge`, `and`, `or`, `not`, `allen`/`ALLEN`, `pointIn`); set membership at a closed field is a plain array in the match record (`r.match(Ticket, { priority: ["Normal", "Urgent"] })` — closed-only there: an ordinary field's membership is a bound `r.inSet` param); stratified recursion via `program()`; `db.prepare` as a plain value.
+- The `Db` runtime — `Db.create`/`Db.open` (exclusive-lock stores; a second open of the same path is `EnvironmentLocked`), transactions, typed violations, scoped snapshot reads (`db.read(fn)`, or `using snap = db.read()` — lifetimes are disposables, never `close()`), the write verbs with `abandon` (returning `abandon(payload)` from `write` or `writeFrom` rolls the transaction back; the outcome arm is in the result type).
+- The query surface — `query(S).rule(r => ...)`: `v(R)`-minted vars (identity is the object reference — reusing one across binding positions IS the join), `find({...})` named result heads (renames are real), params typed by use unchanged, negation, aggregates, and the free comparison/connective exports (`eq`, `ne`, `lt`, `le`, `gt`, `ge`, `and`, `or`, `not`, `allen`/`ALLEN`, `pointIn`); set membership at a closed field is a plain array in the match record (`r.match(Ticket, { priority: ["Normal", "Urgent"] })` — closed-only there: an ordinary field's membership is a bound `r.inSet` param); named interiors and one linear rec via `q.interior` / `q.reach`; `db.prepare` as a plain value.
 - The exhume surface — `Db.exhume`, the schema-independent read path: a store's self-described shapes and raw facts by name, with typed refusals (`ErrExhumeNoDescriptor`, `ErrExhumeFormatMismatch`, `ErrExhumeCorruption`). A disposable lifetime: `using exhumed = await Db.exhume(path)` releases the store's exclusive lock at scope exit.
 
 ## Cookbook