@bjornpagen/bumbledb 0.2.0 → 0.4.0

package/dist/query/lower.js

@@ -27,11 +27,12 @@
 import * as errors from "@superbuilders/errors";
 import { assertDeclarationOrderKey } from "#fields.ts";
 import { allen, and, covers, eq, ge, gt, le, lt, ne, not, or, pointIn } from "#query/atom.ts";
-import { fieldJoins, inferred, isTerm, makeDuration, makeMaskParam, makeParam, makeSetParam, makeVar, renderFieldKind, term } from "#query/scope.ts";
+import { fieldJoins, inferred, isTerm, makeDuration, makeMaskParam, makeParam, makeSetParam, makeVar, makeVars, renderFieldKind, term } from "#query/scope.ts";
 import { argMax, argMin, count, countDistinct, max, min, pack, sum } from "#query/select.ts";
 /** The frozen constructor vocabulary every rule builder spreads. */
 const termOps = Object.freeze({
     var: makeVar,
+    vars: makeVars,
     param: makeParam,
     inSet: makeSetParam,
     maskParam: makeMaskParam,
@@ -64,41 +65,113 @@ const EMPTY_RULE = Object.freeze({
     paramUses: Object.freeze([])
 });
 /**
- * Resolves a bindings record against a relation's declared fields, in the
- * record's written order: terms classify by their runtime tag, everything
- * else is a bare literal (typed by the FIELD at lowering — the membership
- * typing rule included).
+ * The ordered matchable fields of an atom owner — the runtime twin of the
+ * type tier's `MatchFields`: a relation's declared fields; a closed
+ * relation's SEALED shape, the synthetic `id` (the value's own
+ * roster-carrying descriptor, by identity) at ordinal 0 and the declared
+ * payload columns at declared index + 1 (the sealed shift, mirroring
+ * `spec.rs`'s resolver — a `ClosedColumn` is structurally a
+ * {@link RelationField}). The lowering golden pins this mapping.
  */
-function resolveBindings(context, relation, bindings) {
+function matchFieldsOf(owner) {
+    if ("axioms" in owner) {
+        return [Object.freeze({ name: "id", field: owner.id }), ...owner.data.columns];
+    }
+    return owner.data.fields;
+}
+/**
+ * Judges one membership ARRAY at a binding position — legal exactly at a
+ * CLOSED-reference field (the owner ruling: ordinary u64/str membership is
+ * spelled through `r.inSet` params; literal arrays are the closed
+ * vocabulary's spelling), holding ≥ 2 DISTINCT handle names (the
+ * degenerate sets are refusals: empty selects nothing, one element is the
+ * bare literal respelled, and a duplicate member is the same respelling in
+ * disguise — write each member once). The returned name is
+ * CONTENT-ADDRESSED (vocabulary + the member SET — the key sorts a copy,
+ * so two spellings of one set, reordered or not, share one dense
+ * `ParamId`); the members are shape-checked strings here and
+ * roster-verified at the one verification point (`taggedHandleId`) when
+ * the SDK supplies the set at execute — the same moment a bound `r.inSet`
+ * param's members are judged.
+ */
+function membershipSet(context, field, value) {
+    if (!("closed" in field)) {
+        throw errors.new(`${context}: a membership array is the closed-reference spelling — ordinary field membership is a bound ∈-set param (r.inSet)`);
+    }
+    if (value.length === 0) {
+        throw errors.new(`${context}: an empty membership array selects nothing — write the query you mean`);
+    }
+    if (value.length === 1) {
+        throw errors.new(`${context}: a one-element membership array is the bare literal respelled — write the literal (the canonical-utterance law: one meaning, one spelling)`);
+    }
+    const seen = new Set();
+    const members = value.map(function memberName(member) {
+        if (typeof member !== "string") {
+            throw literalShapeError(context, `a ${field.closed.name} handle name (string)`, member);
+        }
+        if (seen.has(member)) {
+            throw errors.new(`${context}: the membership array spells ${member} twice — write it once (the canonical-utterance law: one meaning, one spelling)`);
+        }
+        seen.add(member);
+        return member;
+    });
+    const key = [...members].sort();
+    return { name: `∈ ${field.closed.name} ${JSON.stringify(key)}`, members: Object.freeze(members) };
+}
+/**
+ * Resolves a bindings record against an atom owner's matchable fields (a
+ * relation's declared fields; a closed relation's sealed id + columns), in
+ * the record's written order: terms classify by their runtime tag,
+ * everything else is a bare literal (typed by the FIELD at lowering — the
+ * membership typing rule included). Every bound field carries its
+ * law-computed class, read off the schema value's frozen class map — the
+ * runtime twin of the type tier's `SlotAt` lookups.
+ */
+function resolveBindings(context, relation, bindings, classes) {
     const entries = [];
     const vars = [];
     const uses = [];
+    const relationClasses = classes[relation.name];
+    const ordered = matchFieldsOf(relation);
     for (const [fieldName, value] of Object.entries(bindings)) {
         if (value === undefined) {
             continue;
         }
-        const declared = relation.data.fields.find(function byName(candidate) {
+        const declared = ordered.find(function byName(candidate) {
             return candidate.name === fieldName;
         });
         if (declared === undefined) {
             throw errors.new(`${context} has no field ${fieldName}`);
         }
+        const fieldClass = relationClasses?.[fieldName];
         let bound;
         if (isTerm(value)) {
             switch (value[term]) {
                 case "var": {
                     bound = Object.freeze({ kind: "var", name: value.name });
-                    vars.push(Object.freeze({ name: value.name, field: declared.field }));
+                    vars.push(Object.freeze({ name: value.name, slot: Object.freeze({ field: declared.field, class: fieldClass }) }));
                     break;
                 }
                 case "param": {
                     bound = Object.freeze({ kind: "param", name: value.name });
-                    uses.push(Object.freeze({ name: value.name, shape: "value", anchor: declared.field, op: "binding" }));
+                    uses.push(Object.freeze({
+                        name: value.name,
+                        shape: "value",
+                        anchor: declared.field,
+                        op: "binding",
+                        members: undefined
+                    }));
                     break;
                 }
                 case "setParam": {
                     bound = Object.freeze({ kind: "setParam", name: value.name });
-                    uses.push(Object.freeze({ name: value.name, shape: "set", anchor: declared.field, op: "binding" }));
+                    uses.push(Object.freeze({
+                        name: value.name,
+                        shape: "set",
+                        anchor: declared.field,
+                        op: "binding",
+                        members: undefined
+                    }));
                     break;
                 }
                 case "maskParam":
@@ -107,10 +180,21 @@ function resolveBindings(context, relation, bindings) {
                     throw errors.new(`${context}.${fieldName}: the measure is not a field-typed value — it lives in comparisons and select entries`);
             }
         }
+        else if (Array.isArray(value)) {
+            const set = membershipSet(`${context}.${fieldName}`, declared.field, value);
+            bound = Object.freeze({ kind: "literalSet", name: set.name, members: set.members });
+            uses.push(Object.freeze({
+                name: set.name,
+                shape: "set",
+                anchor: declared.field,
+                op: "binding",
+                members: set.members
+            }));
+        }
         else {
             bound = Object.freeze({ kind: "literal", value });
         }
-        entries.push(Object.freeze({ field: fieldName, data: declared.field, term: bound }));
+        entries.push(Object.freeze({ field: fieldName, data: declared.field, class: fieldClass, term: bound }));
     }
     return {
         atom: Object.freeze({ relation, bindings: Object.freeze(entries) }),
@@ -121,20 +205,20 @@ function resolveBindings(context, relation, bindings) {
 /**
  * Extends a rule state with one positive atom. Vars bind on first
  * occurrence; every LATER occurrence (a later atom's field or a same-record
- * sibling) is a join and must be domain-equal — the construction-time twin
- * of the type tier's `JoinOk`, so the domain wall holds for untyped
- * callers too.
+ * sibling) is a join and must be class-equal — the construction-time twin
+ * of the type tier's `JoinOk` (bare pairs only with bare), so the domain
+ * wall holds for untyped callers too.
  */
-function advanceMatch(state, relation, bindings) {
-    const resolved = resolveBindings(`relation ${relation.name}`, relation, bindings);
+function advanceMatch(state, relation, bindings, classes) {
+    const resolved = resolveBindings(`relation ${relation.name}`, relation, bindings, classes);
     const varFields = { ...state.varFields };
     for (const bound of resolved.vars) {
         const existing = varFields[bound.name];
         if (existing === undefined) {
-            varFields[bound.name] = bound.field;
+            varFields[bound.name] = bound.slot;
         }
-        else if (!fieldJoins(existing, bound.field)) {
-            throw errors.new(`relation ${relation.name}: the variable ${bound.name} joins domain-unequal fields — first bound at ${renderFieldKind(existing)}, reused at ${renderFieldKind(bound.field)} (a var joins only domain-equal fields)`);
+        else if (!fieldJoins(existing, bound.slot)) {
+            throw errors.new(`relation ${relation.name}: the variable ${bound.name} joins domain-unequal fields — first bound at ${renderFieldKind(existing)}, reused at ${renderFieldKind(bound.slot)} (a var joins only class-equal slots; bare pairs only with bare)`);
         }
     }
     return {
@@ -173,7 +257,7 @@ function sideUses(op, side, sibling, varFields, uses) {
     }
     let anchor;
     if (sibling.kind === "var") {
-        anchor = varFields[sibling.name];
+        anchor = varFields[sibling.name]?.field;
     }
     else if (sibling.kind === "measure") {
         anchor = "measure";
@@ -185,7 +269,8 @@ function sideUses(op, side, sibling, varFields, uses) {
         name: side.name,
         shape: side.kind === "param" ? "value" : "set",
         anchor,
-        op
+        op,
+        members: undefined
     }));
 }
 /** Lowers one condition VALUE to its runtime data, recording param uses. */
@@ -203,7 +288,13 @@ function condDataOf(cond, varFields, uses) {
             }
             else if (isTerm(maskValue) && maskValue[term] === "maskParam") {
                 mask = Object.freeze({ kind: "param", name: maskValue.name });
-                uses.push(Object.freeze({ name: maskValue.name, shape: "mask", anchor: undefined, op: "allen" }));
+                uses.push(Object.freeze({
+                    name: maskValue.name,
+                    shape: "mask",
+                    anchor: undefined,
+                    op: "allen",
+                    members: undefined
+                }));
             }
             else {
                 throw errors.new("allen: the mask position takes a 13-bit mask number or a maskParam");
@@ -222,7 +313,7 @@ function condDataOf(cond, varFields, uses) {
     throw errors.new("a negated atom is not a condition-tree node — pass not(...) to where() directly, never inside and()/or()");
 }
 /** Extends a rule state with one `.where` item (a condition or a negated atom). */
-function advanceWhere(state, cond) {
+function advanceWhere(state, cond, classes) {
     if (typeof cond !== "object" || cond === null || !("cond" in cond)) {
         throw errors.new("where() takes a comparison, an and()/or() tree, or a negated atom");
     }
@@ -231,7 +322,7 @@ function advanceWhere(state, cond) {
         const bindings = Object.fromEntries(Object.entries(cond.bindings ?? {}).filter(function defined([, value]) {
             return value !== undefined;
         }));
-        const resolved = resolveBindings(`negated relation ${relation.name}`, relation, bindings);
+        const resolved = resolveBindings(`negated relation ${relation.name}`, relation, bindings, classes);
         return {
             items: Object.freeze([...state.items, Object.freeze({ kind: "negated", atom: resolved.atom })]),
             varFields: state.varFields,
@@ -264,14 +355,27 @@ function advanceIdb(state, rec, vars) {
 function isAggregateEntry(value) {
     return typeof value === "object" && value !== null && "agg" in value;
 }
-/** Classifies one select entry into its named answer column. */
+/**
+ * Classifies one select entry into its named answer column. The `closed`
+ * slice is resolved LATER, at rule completion (`completeRule`), where the
+ * rule's `varFields` are in hand — until then every column is provisionally
+ * bare.
+ */
 function selectColumnOf(entry) {
     if (typeof entry === "string") {
-        return Object.freeze({ name: entry, entry: Object.freeze({ kind: "var", over: entry }) });
+        return Object.freeze({
+            name: entry,
+            entry: Object.freeze({ kind: "var", over: entry }),
+            closed: undefined
+        });
     }
     if (isTerm(entry)) {
         if (entry[term] === "duration") {
-            return Object.freeze({ name: entry.name, entry: Object.freeze({ kind: "measure", over: entry.name }) });
+            return Object.freeze({
+                name: entry.name,
+                entry: Object.freeze({ kind: "measure", over: entry.name }),
+                closed: undefined
+            });
         }
         throw errors.new(`query select: a ${entry[term]} is not projectable — select takes variable names, duration(v), or aggregates`);
     }
@@ -283,7 +387,11 @@ function selectColumnOf(entry) {
 /** Classifies one aggregate select entry. */
 function aggregateColumnOf(entry) {
     function column(name, agg) {
-        return Object.freeze({ name, entry: Object.freeze({ kind: "aggregate", agg: Object.freeze(agg) }) });
+        return Object.freeze({
+            name,
+            entry: Object.freeze({ kind: "aggregate", agg: Object.freeze(agg) }),
+            closed: undefined
+        });
     }
     const over = entry.over;
     switch (entry.agg) {
@@ -323,32 +431,66 @@ function aggregateColumnOf(entry) {
             throw errors.new(`unknown aggregate ${entry.agg}`);
     }
 }
+/**
+ * The orderable ban's pointed refusal (`docs/architecture/10-data-model.md`
+ * § orderability): a closed reference is equality-and-membership only —
+ * its declaration-id order is an encoding accident, so every
+ * order-comparison and fold position refuses it. The construction-time
+ * twin of the type tier's `OrderVarOk` exclusion, so the wall holds for
+ * untyped callers too (the engine cannot backstop this one: the wire IR
+ * carries plain u64s, no rosters).
+ */
+function closedOrderError(context, position, vocabulary) {
+    return errors.new(`${context}: ${position} is a ${vocabulary} reference — declaration order is an accident, not semantics: vocabularies do not order (docs/architecture/10-data-model.md; equality, membership, and counting remain)`);
+}
+/** The comparison ops the orderable ban covers (order roster + point membership — every order-comparison position). */
+function isOrderOp(op) {
+    return op === "lt" || op === "le" || op === "gt" || op === "ge" || op === "pointIn";
+}
 /** Requires a var name to be bound by a relation atom of the rule. */
 function assertBound(context, varFields, name) {
-    const field = varFields[name];
-    if (field === undefined) {
+    const slot = varFields[name];
+    if (slot === undefined) {
         throw errors.new(`${context}: the variable ${name} is not bound by a relation atom of the rule`);
     }
-    return field;
+    return slot;
 }
 /** Requires a var name to be bound at an interval field (the measure's and pack's domain). */
 function assertIntervalBound(context, varFields, name) {
-    const field = assertBound(context, varFields, name);
-    if (field.kind !== "interval") {
+    const slot = assertBound(context, varFields, name);
+    if (slot.field.kind !== "interval") {
         throw errors.new(`${context}: ${name} is not interval-typed — the measure is defined over interval-typed variables only`);
     }
 }
-/** Validates one condition's variable references against the rule's bound names. */
+/**
+ * Validates one condition's variable references against the rule's bound
+ * names — and, for `eq`/`ne` over two variables, holds the class wall: the
+ * unification IS a join, so the two slots must be class-equal exactly as a
+ * match-reuse join must be (the construction-time twin of the type tier's
+ * `EqOk` → `JoinOk`; bare pairs only with bare). The engine cannot backstop
+ * this one — the query IR carries no domains — so the wall lives here for
+ * untyped callers too.
+ */
 function validateCond(context, varFields, cond) {
     if (cond.kind === "cmp") {
         for (const side of [cond.lhs, cond.rhs]) {
             if (side.kind === "var") {
-                assertBound(context, varFields, side.name);
+                const slot = assertBound(context, varFields, side.name);
+                if (isOrderOp(cond.op) && "closed" in slot.field) {
+                    throw closedOrderError(context, `the ${cond.op} side ${side.name}`, slot.field.closed.name);
+                }
             }
             if (side.kind === "measure") {
                 assertIntervalBound(context, varFields, side.name);
             }
         }
+        if ((cond.op === "eq" || cond.op === "ne") && cond.lhs.kind === "var" && cond.rhs.kind === "var") {
+            const lhs = assertBound(context, varFields, cond.lhs.name);
+            const rhs = assertBound(context, varFields, cond.rhs.name);
+            if (!fieldJoins(lhs, rhs)) {
+                throw errors.new(`${context}: ${cond.op}(${cond.lhs.name}, ${cond.rhs.name}) unifies domain-unequal fields — ${cond.lhs.name} bound at ${renderFieldKind(lhs)}, ${cond.rhs.name} at ${renderFieldKind(rhs)} (a var joins only class-equal slots; bare pairs only with bare)`);
+            }
+        }
         return;
     }
     for (const child of cond.children) {
@@ -375,21 +517,58 @@ function validateColumn(context, varFields, column) {
             return;
         case "fold": {
             if (typeof agg.over === "string") {
-                assertBound(`${context} select ${column.name}`, varFields, agg.over);
+                const slot = assertBound(`${context} select ${column.name}`, varFields, agg.over);
+                if ("closed" in slot.field) {
+                    throw closedOrderError(`${context} select ${column.name}`, `the ${agg.fold} input ${agg.over}`, slot.field.closed.name);
+                }
                 return;
             }
             assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over.duration);
             return;
         }
-        case "arg":
+        case "arg": {
             assertBound(`${context} select ${column.name}`, varFields, agg.over);
-            assertBound(`${context} select ${column.name}`, varFields, agg.key);
+            const key = assertBound(`${context} select ${column.name}`, varFields, agg.key);
+            if ("closed" in key.field) {
+                throw closedOrderError(`${context} select ${column.name}`, `the ${agg.direction} key ${agg.key}`, key.field.closed.name);
+            }
             return;
+        }
         case "pack":
             assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over);
             return;
     }
 }
+/**
+ * Resolves the roster one select column decodes through: a projected var,
+ * or an Arg-carried payload, bound at a closed-referencing field carries
+ * that field's roster (read off `varFields` — the same slot the domain
+ * machinery reads), and `decodeAnswers` lifts the column's row ids back to
+ * handle NAMES through it — the runtime twin of the row type's `Infer`
+ * claim. Every other entry decodes bare: counts are counts, the measure
+ * and `pack` are never closed, and a closed FOLD is banned outright
+ * ({@link closedOrderError}) before this resolution runs.
+ */
+function selectClosedOf(varFields, entry) {
+    let over;
+    if (entry.kind === "var") {
+        over = entry.over;
+    }
+    else if (entry.kind === "aggregate" && entry.agg.op === "arg") {
+        over = entry.agg.over;
+    }
+    else {
+        over = undefined;
+    }
+    if (over === undefined) {
+        return undefined;
+    }
+    const field = varFields[over]?.field;
+    if (field !== undefined && "closed" in field) {
+        return field.closed;
+    }
+    return undefined;
+}
 /**
  * Completes one rule: classifies the select record (written order = answer
  * column order, names must be declaration-order-safe keys), and validates
@@ -418,8 +597,9 @@ function completeRule(context, state, columns) {
                     if (bound === undefined) {
                         throw errors.new(`${context}: negated ${item.atom.relation.name} atom binds the variable ${binding.term.name} at position ${binding.field}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`);
                     }
-                    if (!fieldJoins(bound, binding.data)) {
-                        throw errors.new(`${context}: negated ${item.atom.relation.name} atom reuses the variable ${binding.term.name} at ${binding.field} (${renderFieldKind(binding.data)}), but the rule binds it at ${renderFieldKind(bound)} — a var joins only domain-equal fields`);
+                    const negatedSlot = { field: binding.data, class: binding.class };
+                    if (!fieldJoins(bound, negatedSlot)) {
+                        throw errors.new(`${context}: negated ${item.atom.relation.name} atom reuses the variable ${binding.term.name} at ${binding.field} (${renderFieldKind(negatedSlot)}), but the rule binds it at ${renderFieldKind(bound)} — a var joins only class-equal slots; bare pairs only with bare`);
                     }
                 }
             }
@@ -435,9 +615,9 @@ function completeRule(context, state, columns) {
                 if (column === undefined || column.entry.kind !== "var") {
                     return;
                 }
-                const headField = head?.varFields[column.entry.over];
-                if (headField !== undefined && !fieldJoins(headField, bound)) {
-                    throw errors.new(`${context}: idb ${item.rec.name} joins the variable ${name} (${renderFieldKind(bound)}) at head position ${position} (${column.name}: ${renderFieldKind(headField)}) — a var joins only domain-equal fields`);
+                const headSlot = head?.varFields[column.entry.over];
+                if (headSlot !== undefined && !fieldJoins(headSlot, bound)) {
+                    throw errors.new(`${context}: idb ${item.rec.name} joins the variable ${name} (${renderFieldKind(bound)}) at head position ${position} (${column.name}: ${renderFieldKind(headSlot)}) — a var joins only class-equal slots; bare pairs only with bare`);
                 }
             });
         }
@@ -447,7 +627,13 @@ function completeRule(context, state, columns) {
     }
     return Object.freeze({
         items: state.items,
-        select: Object.freeze([...columns]),
+        select: Object.freeze(columns.map(function enrichColumn(column) {
+            return Object.freeze({
+                name: column.name,
+                entry: column.entry,
+                closed: selectClosedOf(state.varFields, column.entry)
+            });
+        })),
         varFields: state.varFields,
         paramUses: state.paramUses
     });
@@ -496,10 +682,10 @@ function selectColumns(context, entries) {
 function makeRawChain(context, state) {
     const chain = {
         match(relation, bindings) {
-            return makeRawChain(context, advanceMatch(state, relation, bindings));
+            return makeRawChain(context, advanceMatch(state, relation, bindings, context.classes));
         },
         where(cond) {
-            return makeRawChain(context, advanceWhere(state, cond));
+            return makeRawChain(context, advanceWhere(state, cond, context.classes));
         },
         idb(target, ...vars) {
             return makeRawChain(context, idbAdvance(context, state, target, vars));
@@ -516,7 +702,7 @@ function makeRawScope(context) {
     const scope = {
         ...termOps,
         match(relation, bindings) {
-            return makeRawChain(context, advanceMatch(EMPTY_RULE, relation, bindings));
+            return makeRawChain(context, advanceMatch(EMPTY_RULE, relation, bindings, context.classes));
         }
     };
     Object.freeze(scope);
@@ -535,8 +721,8 @@ function isTypedScope(scope) {
     return typeof scope.match === "function";
 }
 /** Builds one query-rule builder (the typed face of the raw builder). */
-function makeQueryRuleScope() {
-    const raw = makeRawScope({ kind: "query" });
+function makeQueryRuleScope(classes) {
+    const raw = makeRawScope({ kind: "query", classes });
     if (!isTypedScope(raw)) {
         throw errors.new("query rule builder construction incomplete");
     }
@@ -544,12 +730,16 @@ function makeQueryRuleScope() {
 }
 /** Builds one output-rule builder over a program's recs. */
 function makeOutputRuleScope(program) {
-    const raw = makeRawScope({ kind: "output", program });
+    const raw = makeRawScope({ kind: "output", program, classes: program.classes });
     if (!isTypedScope(raw)) {
         throw errors.new("program output rule builder construction incomplete");
     }
     return raw;
 }
+/** Renders one head column's closed slice for the rule-alignment check's diagnostics. */
+function renderClosedSlice(closed) {
+    return closed === undefined ? "a bare value" : `a ${closed.name} reference`;
+}
 /** Renders one head column's signature for the rule-alignment check. */
 function headSignature(column) {
     const entry = column.entry;
@@ -565,11 +755,36 @@ function headSignature(column) {
     }
     return `${column.name}:${agg.op}`;
 }
+/** The roster a param anchor carries: present exactly on a closed-reference field anchor. */
+function anchorRosterOf(anchor) {
+    if (anchor === undefined || anchor === "measure") {
+        return undefined;
+    }
+    if ("closed" in anchor) {
+        return anchor.closed;
+    }
+    return undefined;
+}
+/** Renders one param anchor's closedness for the registry's coherence diagnostics. */
+function renderParamAnchor(roster) {
+    return roster === undefined ? "a non-closed position" : `a ${roster.name} reference`;
+}
 /**
  * Folds every rule's param uses (recs in declaration order first, output
  * rules last — exactly the lowering walk) into the query's registry:
  * first use mints the dense `ParamId`, the first FIELD-ANCHORED use types
- * the wire, and one name must keep one shape.
+ * the wire, and one name must keep one shape AND one closedness — every
+ * anchored use of one name must agree on the roster (value identity), so a
+ * param anchored at a closed reference is GUARANTEED to ride the one
+ * roster-verification point (`taggedHandleId`) at execute; a name anchored
+ * both at a closed reference and at a non-closed position (or at two
+ * vocabularies) is refused here, because the wire would translate only the
+ * first anchor's reading (the type tier intersects the uses to `never`;
+ * this is its runtime twin for untyped callers). A param whose anchor is a
+ * CLOSED reference must never sit in an order-comparison position — the
+ * anchor types its value a handle name and the engine would order the
+ * translated row ids, so the pairing is refused here too (the registry is
+ * the one place a name's every use and its anchoring field meet).
  */
 function paramRegistryOf(recs, rules) {
     const order = [];
@@ -579,16 +794,35 @@ function paramRegistryOf(recs, rules) {
             const existing = byName.get(use.name);
             if (existing === undefined) {
                 order.push(use.name);
-                byName.set(use.name, { shape: use.shape, anchor: use.anchor, op: use.op });
+                byName.set(use.name, {
+                    shape: use.shape,
+                    anchor: use.anchor,
+                    op: use.op,
+                    members: use.members,
+                    orderOp: isOrderOp(use.op) ? use.op : undefined
+                });
                 continue;
             }
+            if ((existing.members === undefined) !== (use.members === undefined)) {
+                throw errors.new(`query param ${use.name} collides with a membership array's registry entry — name the param differently`);
+            }
             if (existing.shape !== use.shape) {
                 throw errors.new(`query param ${use.name} is used both as a ${existing.shape} param and a ${use.shape} param — one name, one shape`);
             }
+            if (existing.anchor !== undefined && use.anchor !== undefined) {
+                const registered = anchorRosterOf(existing.anchor);
+                const anchored = anchorRosterOf(use.anchor);
+                if (registered !== anchored) {
+                    throw errors.new(`query param ${use.name} is anchored at ${renderParamAnchor(registered)} and at ${renderParamAnchor(anchored)} — a closed-anchored param translates handle names through ONE roster (one name, one domain); name the params differently`);
+                }
+            }
             if (existing.anchor === undefined && use.anchor !== undefined) {
                 existing.anchor = use.anchor;
                 existing.op = use.op;
             }
+            if (existing.orderOp === undefined && isOrderOp(use.op)) {
+                existing.orderOp = use.op;
+            }
         }
     }
     for (const rec of recs) {
@@ -604,7 +838,13 @@ function paramRegistryOf(recs, rules) {
         if (entry === undefined) {
             throw errors.new(`query param ${name} lost its registry entry`);
         }
-        return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op });
+        if (entry.orderOp !== undefined &&
+            entry.anchor !== undefined &&
+            entry.anchor !== "measure" &&
+            "closed" in entry.anchor) {
+            throw closedOrderError(`query param ${name}`, `its ${entry.orderOp} use's anchor`, entry.anchor.closed.name);
+        }
+        return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op, members: entry.members });
     }));
 }
 /**
@@ -624,6 +864,17 @@ function makeRawQuery(theory, recs, rules) {
         if (candidate !== signature) {
             throw errors.new(`every rule of a query derives the same head — rule 0 selects (${signature}), rule ${index} selects (${candidate})`);
         }
+        // The closed slice is part of the head too: one answer column decodes
+        // through one roster, so a union whose rules bind a column at
+        // different vocabularies (or one closed, one bare — the ids would
+        // mistranslate silently) is refused pointed. Vocabulary identity is
+        // value identity, the SDK's membership rule everywhere.
+        rule.select.forEach(function verifyClosedSlice(column, position) {
+            const lead = first.select[position];
+            if (lead !== undefined && column.closed !== lead.closed) {
+                throw errors.new(`every rule of a query derives the same head — the answer column ${lead.name} is ${renderClosedSlice(lead.closed)} in rule 0 but ${renderClosedSlice(column.closed)} in rule ${index} (one column decodes through one roster)`);
+            }
+        });
     });
     const data = Object.freeze({
         recs: Object.freeze([...recs]),
@@ -635,7 +886,7 @@ function makeRawQuery(theory, recs, rules) {
         schema: theory,
         data,
         rule(build) {
-            const built = build(makeRawScope({ kind: "query" }));
+            const built = build(makeRawScope({ kind: "query", classes: theory.classes }));
             return makeRawQuery(theory, recs, [...rules, built.rule]);
         }
     };
@@ -661,12 +912,14 @@ function makeQuery(theory, recs, rules) {
 /**
  * Opens a query over a schema: `query(S).rule(r => ...)`. Each `.rule`
  * adds one conjunctive rule; multiple rules are the set union (answers are
- * SETS — no order or limit exists anywhere; hosts sort).
+ * SETS — no order or limit exists anywhere; hosts sort). The schema's
+ * law-computed class map rides into every rule builder — the join walls
+ * compare class names off it, at the type level and at construction alike.
  */
 function query(theory) {
     const start = {
         rule(build) {
-            const built = build(makeQueryRuleScope());
+            const built = build(makeQueryRuleScope(theory.classes));
             return makeQuery(theory, [], [built.rule]);
         }
     };
@@ -687,19 +940,24 @@ function isIntervalShaped(value) {
         typeof value.end === "bigint");
 }
 /**
- * Tags one closed-reference literal: the bare handle id, verified against
- * the roster (the belt the type level cannot provide — structural values
- * make any bigint spellable here) and tagged u64 — queries cross ids,
- * never handle names.
+ * Tags one closed-reference literal: the handle NAME, verified against the
+ * roster (the belt the wide fallback type cannot provide — structural
+ * values make any string spellable here) and translated to its
+ * declaration-order row id, tagged u64 — queries cross ids, never handle
+ * names; the wire is untouched. THE single roster-verification point of
+ * the query surface: atom-binding literals, comparison literals,
+ * execute-time params, and membership-array members all reach it (never
+ * duplicate the check per call site).
  */
 function taggedHandleId(context, closed, value) {
-    if (typeof value !== "bigint") {
-        throw literalShapeError(context, `a ${closed.name} handle id (bigint)`, value);
+    if (typeof value !== "string") {
+        throw literalShapeError(context, `a ${closed.name} handle name (string)`, value);
     }
-    if (closed.handles[Number(value)] === undefined) {
-        throw errors.new(`${context}: closed relation ${closed.name} has no handle with id ${value} (roster holds ${closed.handles.length})`);
+    const id = closed.handles.indexOf(value);
+    if (id < 0) {
+        throw errors.new(`${context}: "${value}" is not a handle of ${closed.name} — the roster is ${closed.handles.join(", ")}`);
     }
-    return { kind: "u64", value };
+    return { kind: "u64", value: BigInt(id) };
 }
 /**
  * Tags one literal in an interval element domain: a bigint tags as the
@@ -822,7 +1080,13 @@ function paramIdOf(ctx, name) {
     }
     return id;
 }
-/** Lowers one EDB atom (either polarity). */
+/**
+ * Lowers one EDB atom (either polarity). A CLOSED owner lowers through the
+ * same edb source — its ordinal is its record-declaration slot exactly like
+ * an ordinary relation's — with field ordinals over the SEALED shape: `id`
+ * at 0, each payload column at its declared index + 1 (`matchFieldsOf`
+ * carries the shift; the lowering golden pins it).
+ */
 function lowerAtom(ctx, atom, ids) {
     const member = ctx.theory.relations[atom.relation.name];
     if (member !== atom.relation) {
@@ -832,8 +1096,9 @@ function lowerAtom(ctx, atom, ids) {
     if (relationId === undefined) {
         throw errors.new(`query lowering: relation ${atom.relation.name} has no ordinal`);
     }
+    const ordered = matchFieldsOf(atom.relation);
     const bindings = atom.bindings.map(function lowerBinding(binding) {
-        const ordinal = atom.relation.data.fields.findIndex(function byName(candidate) {
+        const ordinal = ordered.findIndex(function byName(candidate) {
             return candidate.name === binding.field;
         });
         if (ordinal < 0) {
@@ -843,7 +1108,12 @@ function lowerAtom(ctx, atom, ids) {
     });
     return { source: { kind: "edb", relation: relationId }, bindings };
 }
-/** Lowers one binding term. */
+/**
+ * Lowers one binding term. A membership ARRAY (`literalSet`) lowers to the
+ * existing param-set term over its content-addressed registry entry — the
+ * program IR is byte-identical to the same set spelled `r.inSet`; the SDK
+ * supplies the translated member set itself at execute (`wireParams`).
+ */
 function lowerBindingTerm(ctx, context, binding, ids) {
     const bound = binding.term;
     switch (bound.kind) {
@@ -853,6 +1123,8 @@ function lowerBindingTerm(ctx, context, binding, ids) {
             return { kind: "param", param: paramIdOf(ctx, bound.name) };
         case "setParam":
             return { kind: "paramSet", param: paramIdOf(ctx, bound.name) };
+        case "literalSet":
+            return { kind: "paramSet", param: paramIdOf(ctx, bound.name) };
         case "literal":
             return { kind: "literal", value: taggedLiteral(context, binding.data, bound.value) };
     }
@@ -895,7 +1167,7 @@ function lowerCmpTerm(ctx, rule, side, sibling, ids, op) {
 /** Resolves the anchor a comparison literal tags by: the sibling's field, the measure, or an anchored param. */
 function cmpAnchorOf(ctx, rule, sibling) {
     if (sibling.kind === "var") {
-        return rule.varFields[sibling.name];
+        return rule.varFields[sibling.name]?.field;
     }
     if (sibling.kind === "measure") {
         return "measure";