@bjornpagen/bumbledb 0.2.0 → 0.4.0

package/src/marshal.ts

@@ -13,10 +13,22 @@
  * the engine admitted IS a legal fact of its relation (the same trust
  * direction as Rust's typed readback). Shape mismatches here are genuine
  * failures and THROW typed; they are never domain data.
+ *
+ * THE CLOSED BIJECTION (0.4.0): a closed-referencing cell crosses this
+ * boundary as its handle NAME — the write side lowers name → u64 row id
+ * (declaration order = row ids, the sealed roster's own law, ≤ 256 rows),
+ * the read side lifts id → name, and both directions are total and static
+ * over the roster. An unknown name is a pointed THROW at the write seam —
+ * a deliberate UPGRADE over 0.3.0, where any bigint sailed through the
+ * marshal to a commit-time containment violation; the wrong spelling now
+ * dies here, before the engine ever sees the row. An out-of-roster id on
+ * the read side (reachable only in a store whose closed-typed column was
+ * never pinned by its containment law) is equally pointed — never a
+ * silent fallback, never `undefined`.
  */
 
 import * as errors from "@superbuilders/errors"
-import type { AnyField } from "#fields.ts"
+import type { AnyField, ClosedRoster } from "#fields.ts"
 import type { FactValue } from "#native.ts"
 import type { AnyRelation, Fact, FreshKeys, RelationData } from "#relation.ts"
 
@@ -80,14 +92,64 @@ function recordOf(fact: object): Record<string, unknown> {
 	return Object.fromEntries(Object.entries(fact))
 }
 
+/**
+ * The write half of the closed bijection: one handle NAME to its u64 row
+ * id (declaration order = row ids — the engine's own minting of the
+ * sealed extension). An unknown name is a pointed refusal naming the
+ * vocabulary and its roster — the 0.4.0 upgrade over any-bigint-compiles:
+ * the wrong spelling dies at the marshal, never as a commit-time
+ * violation. `indexOf` is the whole machine (the roster is ≤ 256 rows,
+ * engine law — no map is warranted).
+ */
+function closedCellOf(context: string, closed: ClosedRoster, name: string): FactValue {
+	const id = closed.handles.indexOf(name)
+	if (id === -1) {
+		throw errors.new(
+			`${context}: "${name}" is not a handle of ${closed.name} — the roster is ${closed.handles.join(", ")}`
+		)
+	}
+	return BigInt(id)
+}
+
+/**
+ * The read half of the closed bijection: one u64 row id back to its handle
+ * NAME (`Number(cell)` is safe — the sealed extension holds at most 256
+ * rows, engine law). An id outside the roster THROWS pointed, never a
+ * silent fallback and never `undefined`: the state is reachable only in a
+ * store whose closed-typed column was never pinned by its containment law,
+ * and the error names that missing piece.
+ */
+function handleOf(context: string, closed: ClosedRoster, cell: FactValue): string {
+	if (typeof cell !== "bigint") {
+		throw cellShapeError(context, `a ${closed.name} handle id (bigint)`, cell)
+	}
+	const handle = closed.handles[Number(cell)]
+	if (handle === undefined) {
+		throw errors.new(
+			`${context}: id ${cell} is outside the ${closed.name} roster (${closed.handles.join(", ")}) — the column types ${closed.name} but no law pins it — a containment statement is the missing piece`
+		)
+	}
+	return handle
+}
+
 /**
  * Marshals one host cell at its field position to the natural wire value,
  * schema-directed by the field descriptor's structural kind (never
- * guessed). Values are bare, so the runtime values ARE the wire's natural
- * JS values; widths and domain labels are the engine's own judgment at the
- * write boundary.
+ * guessed). A closed-referencing cell arrives as its handle NAME and
+ * lowers through {@link closedCellOf} — the arm precedes the switch
+ * because a closed reference is structurally a u64 descriptor plus the
+ * roster (the same precedence `Infer` pins at the type level). Everything
+ * else is bare, so the runtime values ARE the wire's natural JS values;
+ * widths and domain labels are the engine's own judgment at the write
+ * boundary.
  */
 function cellOf(context: string, field: AnyField, value: unknown): FactValue {
+	if ("closed" in field) {
+		if (typeof value !== "string") {
+			throw cellShapeError(context, `a ${field.closed.name} handle name (string)`, value)
+		}
+		return closedCellOf(context, field.closed, value)
+	}
 	switch (field.kind) {
 		case "bool": {
 			if (typeof value !== "boolean") {
@@ -210,7 +272,9 @@ function isMintedFresh<R extends AnyRelation>(
 /**
  * Unmarshals one positional row to the relation's named, frozen fact object
  * of bare structural values — the inverse of {@link rowOf},
- * ordinal-directed by the same declaration order.
+ * ordinal-directed by the same declaration order. Closed-referencing cells
+ * lift id → handle NAME through {@link handleOf} (the read half of the
+ * bijection), so every fact a user sees speaks the roster's vocabulary.
  */
 function factOf<R extends AnyRelation>(relation: R, row: readonly FactValue[]): Fact<R> {
 	const data = relation.data
@@ -225,7 +289,10 @@ function factOf<R extends AnyRelation>(relation: R, row: readonly FactValue[]):
 		if (cell === undefined) {
 			throw errors.new(`relation ${data.name}: row cell ${ordinal} (${declared.name}) is absent`)
 		}
-		decoded[declared.name] = cell
+		decoded[declared.name] =
+			"closed" in declared.field
+				? handleOf(`relation ${data.name} field ${declared.name}`, declared.field.closed, cell)
+				: cell
 	})
 	Object.freeze(decoded)
 	if (!isCompleteFact(relation, decoded)) {
@@ -235,4 +302,4 @@ function factOf<R extends AnyRelation>(relation: R, row: readonly FactValue[]):
 }
 
 export type { KeyFact, Minted }
-export { cellOf, factOf, isFreshField, isMintedFresh, keyRowOf, recordOf, rowOf }
+export { cellOf, factOf, handleOf, isFreshField, isMintedFresh, keyRowOf, recordOf, rowOf }

package/src/native.ts

@@ -244,13 +244,17 @@ interface Violation {
  * `dbCreate`/`dbOpen`'s domain outcome. `schemaError` covers both spec
  * resolution (unresolvable names, banned spellings — every issue in one
  * message) and schema validation at the declaration boundary;
- * `fingerprintMismatch` is `dbOpen`'s stored-theory refusal.
+ * `newtypeMismatch` is the coherence wall's own kind — a spec whose
+ * statement pairs faces with disagreeing newtype labels (the engine twin
+ * of the schema-level class wall; unreachable through the typed builder,
+ * which computes every label from the laws, so only a raw spec can reach
+ * it); `fingerprintMismatch` is `dbOpen`'s stored-theory refusal.
  */
 type DbOpenResult =
 	| { readonly ok: true; readonly db: DbHandle }
 	| {
 			readonly ok: false
-			readonly kind: "schemaError" | "fingerprintMismatch"
+			readonly kind: "schemaError" | "newtypeMismatch" | "fingerprintMismatch"
 			readonly message: string
 	  }
 

package/src/query/atom.ts

@@ -4,6 +4,9 @@
  * (`bumbledb/crates/bumbledb/src/ir.rs`, the bijection target;
  * `docs/architecture/20-query-ir.md` normative). A `match` binding record
  * binds fields to vars, params, ∈-set params, or bare structural literals
+ * — a closed-reference field's literal is its handle NAME, and a plain
+ * ARRAY of names there is membership, folded into the program (closed-only
+ * by owner ruling; see {@link BindingInput})
  * (unmentioned fields ARE the wildcard — no wildcard value exists);
  * `not(Rel, {...})` is negation-as-position (anti-join); `eq`/`ne` and the
  * order roster, `pointIn`/`covers` (both spellings of `ir::CmpOp::PointIn`,
@@ -25,8 +28,11 @@
  */
 
 import * as errors from "@superbuilders/errors"
-import type { AnyField, Infer, IntervalValue } from "#fields.ts"
+import type { AnyClosed } from "#closed.ts"
+import type { AnyField, ClosedIdField, ClosedRoster, Infer, IntervalValue } from "#fields.ts"
+import type { ClassLookup, ClassRecordOf, SchemaClasses } from "#law.ts"
 import type {
+	ClassedField,
 	Duration,
 	EnvShape,
 	JoinOk,
@@ -38,25 +44,59 @@ import type {
 	Var
 } from "#query/scope.ts"
 import { isTerm } from "#query/scope.ts"
-import type { AnyRelation, FieldsShape, Relation } from "#relation.ts"
+import type { AnyRelation, FieldsShape, RelationFields } from "#relation.ts"
 
-/** One atom-binding position as runtime data. */
+/**
+ * What a query atom matches over: an ordinary relation or a CLOSED
+ * vocabulary (ψ query atoms — the engine folds a resolvable closed atom
+ * into a plan-constant member set at prepare, or joins the L1-resident
+ * virtual image when the shape does not fold; the SDK never pre-folds and
+ * never knows which — transparency is the contract).
+ */
+type MatchOwner = AnyRelation | AnyClosed
+
+/**
+ * The matchable field block of an atom owner: a relation's declared
+ * fields; a closed relation's SEALED shape — the synthetic `id` (the
+ * value's OWN roster-carrying descriptor, at its precise type: the handle
+ * union rides into ψ id bindings and joins exactly as it does on a
+ * referencing column) first, then the declared payload columns read
+ * through the typed `columns` carrier (the one source of payload typing —
+ * no parallel column table exists). The runtime twin is `matchFieldsOf` in
+ * `#query/lower.ts`; the id-first ordinal shift the two tiers share is
+ * pinned by the lowering golden.
+ */
+type MatchFields<R extends MatchOwner> = R extends AnyClosed
+	? { readonly id: R["id"] } & R["columns"]
+	: R extends AnyRelation
+		? RelationFields<R>
+		: never
+
+/**
+ * One atom-binding position as runtime data. `literalSet` is a membership
+ * ARRAY at a closed-reference field, folded into the program: `name` is
+ * the content-addressed registry key its dense `ParamId` is minted under
+ * (the lowering rides the existing param-set term; the SDK itself supplies
+ * the translated member set at every execute — never the host).
+ */
 type BindingTermData =
 	| { readonly kind: "var"; readonly name: string }
 	| { readonly kind: "param"; readonly name: string }
 	| { readonly kind: "setParam"; readonly name: string }
+	| { readonly kind: "literalSet"; readonly name: string; readonly members: readonly string[] }
 	| { readonly kind: "literal"; readonly value: unknown }
 
-/** One resolved binding: the field's name, its descriptor, and the term. */
+/** One resolved binding: the field's name, its descriptor, its law-computed class, and the term. */
 interface BindingEntry {
 	readonly field: string
 	readonly data: AnyField
+	readonly class: string | undefined
 	readonly term: BindingTermData
 }
 
-/** One EDB atom as runtime data (either polarity — polarity is the rule item's). */
+/** One EDB atom as runtime data (either polarity — polarity is the rule item's; a closed owner is a ψ atom). */
 interface AtomData {
-	readonly relation: AnyRelation
+	readonly relation: MatchOwner
 	readonly bindings: readonly BindingEntry[]
 }
 
@@ -107,10 +147,18 @@ type SelectEntryData =
 	| { readonly kind: "measure"; readonly over: string }
 	| { readonly kind: "aggregate"; readonly agg: AggData }
 
-/** One answer column: its name (the row object key) and its entry. */
+/**
+ * One answer column: its name (the row object key), its entry, and — when
+ * the column's value is a closed reference (a projected var or an
+ * Arg-carried payload bound at a closed-referencing field) — the roster the
+ * decode lifts row ids back to handle NAMES through (the read half of the
+ * marshal bijection; `undefined` on every bare column). The slice is
+ * SDK-side marshaling data only: the wire `ProgramIr` never carries it.
+ */
 interface SelectColumn {
 	readonly name: string
 	readonly entry: SelectEntryData
+	readonly closed: ClosedRoster | undefined
 }
 
 /** One body item of a rule, in written order. */
@@ -123,21 +171,25 @@ type RuleItem =
 /**
  * One use of a parameter inside a rule, in written order: the census the
  * query-level registry folds (first use mints the dense `ParamId`, first
- * FIELD-ANCHORED use types the wire).
+ * FIELD-ANCHORED use types the wire). `members` is present exactly on a
+ * membership-array use (a literal set folded into the program): the handle
+ * names the SDK itself translates and supplies at execute — the entry
+ * never appears in the host's params object.
  */
 interface ParamUse {
 	readonly name: string
 	readonly shape: "value" | "set" | "mask"
 	readonly anchor: AnyField | "measure" | undefined
 	readonly op: "binding" | CmpKind
+	readonly members: readonly string[] | undefined
 }
 
 /** One complete rule as runtime data. */
 interface RuleData {
 	readonly items: readonly RuleItem[]
 	readonly select: readonly SelectColumn[]
-	/** Variable name → the field descriptor its FIRST positive binding carries (the runtime env). */
-	readonly varFields: Readonly<Record<string, AnyField>>
+	/** Variable name → the classed slot its FIRST positive binding carries (the runtime env — descriptor + class). */
+	readonly varFields: Readonly<Record<string, ClassedField>>
 	readonly paramUses: readonly ParamUse[]
 }
 
@@ -156,10 +208,18 @@ interface RecData {
  * of the field's value type, a var/param/∈-set-param term — and, when the
  * field is interval-typed, a bare point literal (the IR's membership
  * typing rule: an element-typed term at an interval field is point
- * membership; an interval-typed term is value equality).
+ * membership; an interval-typed term is value equality). A
+ * CLOSED-reference field additionally takes a plain ARRAY of handle names
+ * read as membership — `kind: ["Practice", "Review"]` (the drizzle law:
+ * set membership is an array, never an operator). Arrays are CLOSED-ONLY
+ * in this packet by owner ruling: ordinary u64/str membership already has
+ * its spelling through `r.inSet` params; widening literal arrays to every
+ * literal-capable kind is a separate future taste call — deliberately not
+ * done here.
  */
 type BindingInput<F extends AnyField> =
 	| Infer<F>
+	| (F extends ClosedIdField ? readonly Infer<F>[] : never)
 	| (F extends { readonly kind: "interval" } ? bigint : never)
 	| Var<string>
 	| Param<string>
@@ -174,50 +234,61 @@ type MatchShape<F extends FieldsShape> = {
 	readonly [K in keyof F]?: BindingInput<F[K]>
 }
 
+/**
+ * One field position of a bindings record as a classed slot: the declared
+ * descriptor plus the slot's law-computed class, read off the relation's
+ * class record (`CR` — the schema class map's entry for the atom's
+ * relation). The one shape every join judgment compares.
+ */
+type SlotAt<F extends FieldsShape, CR, K> = {
+	readonly field: F[K & keyof F]
+	readonly class: ClassLookup<CR, K>
+}
+
 /**
  * The var binding's judgment against the incoming rule environment: a name
- * already bound must land on a domain-equal field.
+ * already bound must land on a class-equal slot (bare pairs only with bare).
  */
-type EnvJoinOk<Env extends EnvShape, F extends FieldsShape, K, N extends string> = N extends keyof Env
-	? JoinOk<Env[N], F[K & keyof F]>
+type EnvJoinOk<Env extends EnvShape, F extends FieldsShape, CR, K, N extends string> = N extends keyof Env
+	? JoinOk<Env[N], SlotAt<F, CR, K>>
 	: true
 
 /**
  * The var binding's judgment against its OWN record's siblings: two
  * bindings of one var name inside a single bindings record are the same
  * join the environment check judges across atoms, so every same-named
- * sibling must be domain-equal too. Without this arm two FIRST occurrences
+ * sibling must be class-equal too. Without this arm two FIRST occurrences
  * of one name (a record the environment has not seen yet) would meet no
- * check at all — the intra-atom join would silently cross domains.
+ * check at all — the intra-atom join would silently cross classes.
  */
-type SiblingJoinOk<F extends FieldsShape, B, K extends keyof B, N extends string> = false extends {
-	[K2 in Exclude<keyof B & keyof F, K>]: B[K2] extends Var<N> ? JoinOk<F[K2], F[K & keyof F]> : true
+type SiblingJoinOk<F extends FieldsShape, CR, B, K extends keyof B, N extends string> = false extends {
+	[K2 in Exclude<keyof B & keyof F, K>]: B[K2] extends Var<N> ? JoinOk<SlotAt<F, CR, K2>, SlotAt<F, CR, K>> : true
 }[Exclude<keyof B & keyof F, K>]
 	? false
 	: true
 
 /**
  * The per-property join judgment of a bindings record: a var binding must
- * be domain-equal to the rule environment's binding of the name AND to
- * every same-named sibling of its own record (a cross-domain reuse maps
+ * be class-equal to the rule environment's binding of the name AND to
+ * every same-named sibling of its own record (a cross-class reuse maps
  * the property to `never` — the compile error the old value brand carried,
- * now structural).
+ * now law-born off the schema type's class map).
  */
-type BindingOk<Env extends EnvShape, F extends FieldsShape, B, K extends keyof B> =
+type BindingOk<Env extends EnvShape, F extends FieldsShape, CR, B, K extends keyof B> =
 	B[K] extends Var<infer N extends string>
-		? [EnvJoinOk<Env, F, K, N>, SiblingJoinOk<F, B, K, N>] extends [true, true]
+		? [EnvJoinOk<Env, F, CR, K, N>, SiblingJoinOk<F, CR, B, K, N>] extends [true, true]
 			? true
 			: false
 		: true
 
 /** The validated bindings record (intersect with the inferred `B` — errors land on the offending property). */
-type CheckBindings<Env extends EnvShape, F extends FieldsShape, B> = {
-	readonly [K in keyof B]: K extends keyof F ? (BindingOk<Env, F, B, K> extends true ? B[K] : never) : never
+type CheckBindings<Env extends EnvShape, F extends FieldsShape, CR, B> = {
+	readonly [K in keyof B]: K extends keyof F ? (BindingOk<Env, F, CR, B, K> extends true ? B[K] : never) : never
 }
 
-/** The environment a bindings record contributes: var name → the bound field's descriptor. */
-type BindEnv<F extends FieldsShape, B> = {
-	readonly [K in keyof B & keyof F as B[K] extends Var<infer N extends string> ? N : never]: F[K]
+/** The environment a bindings record contributes: var name → the bound slot (descriptor + class). */
+type BindEnv<F extends FieldsShape, CR, B> = {
+	readonly [K in keyof B & keyof F as B[K] extends Var<infer N extends string> ? N : never]: SlotAt<F, CR, K>
 }
 
 /** The params-object fragments a bindings record contributes (one union member per param use). */
@@ -257,9 +328,9 @@ interface Tree<Ch extends readonly AnyTreeChild[]> {
  * membership at `.where` IS the safety rule, a compile error before it is
  * the engine's refusal.
  */
-interface NotAtom<F extends FieldsShape, B> {
+interface NotAtom<R extends MatchOwner, B> {
 	readonly cond: "not"
-	readonly relation: Relation<string, F>
+	readonly relation: R
 	readonly bindings: B
 }
 
@@ -270,7 +341,7 @@ type AnyCmp = Cmp<CmpKind, unknown, unknown, unknown>
 type AnyTreeChild = AnyCmp | Tree<readonly AnyTreeChild[]>
 
 /** Any negated-atom value. */
-type AnyNotAtom = NotAtom<FieldsShape, unknown>
+type AnyNotAtom = NotAtom<MatchOwner, unknown>
 
 /** Any `.where` input: a comparison, a condition tree, or a negated atom. */
 type AnyCond = AnyCmp | Tree<readonly AnyTreeChild[]> | AnyNotAtom
@@ -464,26 +535,40 @@ function or<const C extends readonly AnyTreeChild[]>(...children: C): Tree<C> {
  * rejects every binding some matching fact extends. A negated atom binds
  * nothing, only rejects: every variable it names must be positively bound
  * in the rule, which `.where`'s environment check makes a COMPILE error
- * (the engine's safety refusal stands behind it).
+ * (the engine's safety refusal stands behind it). A CLOSED owner is legal
+ * here too — the engine folds a resolvable negated closed atom to the
+ * COMPLEMENT of its member set (domain-witness guarded), and the SDK's
+ * negation rules apply to it unchanged.
  */
-function not<Name extends string, F extends FieldsShape, const B extends MatchShape<F>>(
-	relation: Relation<Name, F>,
+function not<R extends MatchOwner, const B extends MatchShape<MatchFields<R>>>(
+	relation: R,
 	bindings: B
-): NotAtom<F, B> {
-	const value: NotAtom<F, B> = { cond: "not", relation, bindings }
+): NotAtom<R, B> {
+	const value: NotAtom<R, B> = { cond: "not", relation, bindings }
 	return Object.freeze(value)
 }
 
-/** Whether a var name is bound in the environment at an orderable (u64/i64) field. */
+/**
+ * Whether a var name is bound in the environment at an orderable (u64/i64)
+ * field. A CLOSED reference is excluded even though its kind is `u64`: a
+ * vocabulary's declaration-id order is an accident, not semantics
+ * (`docs/architecture/10-data-model.md` § orderability — order on it is
+ * refused exactly as the enum's ordinal order was), so every
+ * order-comparison and fold position refuses closed-bound terms — this
+ * judgment is the one gate they all read, and the construction-time
+ * validations in `#query/lower.ts` are its runtime twin.
+ */
 type OrderVarOk<Env extends EnvShape, N extends string> = N extends keyof Env
-	? Env[N]["kind"] extends "u64" | "i64"
-		? true
-		: false
+	? Env[N]["field"] extends { readonly closed: ClosedRoster }
+		? false
+		: Env[N]["field"]["kind"] extends "u64" | "i64"
+			? true
+			: false
 	: false
 
 /** Whether a var name is bound at an interval field. */
 type IntervalVarOk<Env extends EnvShape, N extends string> = N extends keyof Env
-	? Env[N]["kind"] extends "interval"
+	? Env[N]["field"]["kind"] extends "interval"
 		? true
 		: false
 	: false
@@ -502,7 +587,7 @@ type PointSideOk<Env extends EnvShape, T> = T extends Var<infer N extends string
 /** One interval side's judgment. */
 type IntervalSideOk<Env extends EnvShape, T> = T extends Var<infer N extends string> ? IntervalVarOk<Env, N> : true
 
-/** The `eq`/`ne` judgment: left var bound; right joins it (domain-equal var, param, or an exact-type literal). */
+/** The `eq`/`ne` judgment: left var bound; right joins it (class-equal var, param, or an exact-type literal). */
 type EqOk<Env extends EnvShape, L, R> =
 	L extends Var<infer N extends string>
 		? N extends keyof Env
@@ -512,34 +597,36 @@ type EqOk<Env extends EnvShape, L, R> =
 					: false
 				: R extends Param<string> | SetParam<string>
 					? true
-					: [R] extends [Infer<Env[N]>]
+					: [R] extends [Infer<Env[N]["field"]>]
 						? true
 						: false
 			: false
 		: false
 
-/** One negated-atom binding's judgment: a var must be positively bound (safety) AND domain-equal. */
-type NotBindingOk<Env extends EnvShape, F extends AnyField, T> =
-	T extends Var<infer N extends string> ? (N extends keyof Env ? JoinOk<Env[N], F> : false) : true
+/** One negated-atom binding's judgment: a var must be positively bound (safety) AND class-equal. */
+type NotBindingOk<Env extends EnvShape, S extends ClassedField, T> =
+	T extends Var<infer N extends string> ? (N extends keyof Env ? JoinOk<Env[N], S> : false) : true
 
-/** The whole negated atom's judgment. */
-type NotOk<Env extends EnvShape, F extends FieldsShape, B> = false extends {
-	[K in keyof B]: NotBindingOk<Env, K extends keyof F ? F[K] : never, B[K]>
+/** The whole negated atom's judgment (`CR` — the negated relation's class record off the schema class map). */
+type NotOk<Env extends EnvShape, F extends FieldsShape, CR, B> = false extends {
+	[K in keyof B]: NotBindingOk<Env, SlotAt<F, CR, K>, B[K]>
 }[keyof B]
 	? false
 	: true
 
 /**
  * One condition's judgment against the rule environment — the type-level
- * twin of the engine's comparison roster: domain-equal joins, orderable
- * order sides (an interval var under a non-`pointIn` op is exactly here
- * refused), kind-correct `pointIn`/`covers`/`allen` sides, and negated-atom
- * safety. The leading `[AnyTreeChild] extends [C]` arm is the recursion's
- * base case: at an UNRESOLVED constraint (the whole condition union — or a
- * tree's child union, which is the union itself) the judgment is vacuously
- * true — without it the constraint instantiation recurses into itself.
+ * twin of the engine's comparison roster: class-equal joins (off the
+ * schema type's class map), orderable order sides (an interval var under a
+ * non-`pointIn` op is exactly here refused), kind-correct
+ * `pointIn`/`covers`/`allen` sides, and negated-atom safety (the negated
+ * relation's class record is resolved through `Classes` by its name). The
+ * leading `[AnyTreeChild] extends [C]` arm is the recursion's base case:
+ * at an UNRESOLVED constraint (the whole condition union — or a tree's
+ * child union, which is the union itself) the judgment is vacuously true —
+ * without it the constraint instantiation recurses into itself.
  */
-type CondOkBool<Env extends EnvShape, C> = [AnyTreeChild] extends [C]
+type CondOkBool<Env extends EnvShape, Classes extends SchemaClasses, C> = [AnyTreeChild] extends [C]
 	? true
 	: C extends Cmp<infer Op, infer L, infer R, unknown>
 		? Op extends "eq" | "ne"
@@ -558,23 +645,24 @@ type CondOkBool<Env extends EnvShape, C> = [AnyTreeChild] extends [C]
 							: false
 						: false
 		: C extends Tree<infer Ch extends readonly AnyTreeChild[]>
-			? false extends CondOkBool<Env, Ch[number]>
+			? false extends CondOkBool<Env, Classes, Ch[number]>
 				? false
 				: true
-			: C extends NotAtom<infer F extends FieldsShape, infer B>
-				? NotOk<Env, F, B>
+			: C extends NotAtom<infer R extends MatchOwner, infer B>
+				? NotOk<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
 				: false
 
 /** The validated `.where` argument (intersect with the inferred condition type). */
-type CheckCond<Env extends EnvShape, C> = CondOkBool<Env, C> extends true ? C : never
+type CheckCond<Env extends EnvShape, Classes extends SchemaClasses, C> =
+	CondOkBool<Env, Classes, C> extends true ? C : never
 
 /** The `eq`/`ne` params contribution: the param typed by the left variable's field. */
 type EqParams<Env extends EnvShape, L, R> =
 	L extends Var<infer N extends string>
 		? R extends Param<infer P extends string>
-			? { readonly [Q in P]: Infer<Env[N & keyof Env]> }
+			? { readonly [Q in P]: Infer<Env[N & keyof Env]["field"]> }
 			: R extends SetParam<infer P extends string>
-				? { readonly [Q in P]: readonly Infer<Env[N & keyof Env]>[] }
+				? { readonly [Q in P]: readonly Infer<Env[N & keyof Env]["field"]>[] }
 				: never
 		: never
 
@@ -607,8 +695,8 @@ type CondParams<Env extends EnvShape, C> = [AnyTreeChild] extends [C]
 						: never
 		: C extends Tree<infer Ch extends readonly AnyTreeChild[]>
 			? CondParams<Env, Ch[number]>
-			: C extends NotAtom<infer F extends FieldsShape, infer B>
-				? BindParams<F, B>
+			: C extends NotAtom<infer R extends MatchOwner, infer B>
+				? BindParams<MatchFields<R>, B>
 				: never
 
 /** The flattened params record one bindings record contributes. */
@@ -643,6 +731,8 @@ export type {
 	IntervalSide,
 	IntervalVarOk,
 	MaskData,
+	MatchFields,
+	MatchOwner,
 	MatchShape,
 	NotAtom,
 	OrderSide,