@bjornpagen/bumbledb 0.2.0 → 0.4.0

package/src/query/lower.ts

@@ -26,8 +26,9 @@
  */
 
 import * as errors from "@superbuilders/errors"
-import type { AnyField } from "#fields.ts"
+import type { AnyField, ClosedRoster } from "#fields.ts"
 import { assertDeclarationOrderKey } from "#fields.ts"
+import type { ClassRecordOf, SchemaClasses } from "#law.ts"
 import type {
 	AtomIr,
 	ComparisonIr,
@@ -56,6 +57,8 @@ import type {
 	CondData,
 	CondParamsShape,
 	MaskData,
+	MatchFields,
+	MatchOwner,
 	MatchShape,
 	ParamUse,
 	RecData,
@@ -66,7 +69,16 @@ import type {
 	TreeData
 } from "#query/atom.ts"
 import { allen, and, covers, eq, ge, gt, le, lt, ne, not, or, pointIn } from "#query/atom.ts"
-import type { EnvShape, Flatten, InferredOf, JoinOk, ParamEntry, ParamsRecord, Var } from "#query/scope.ts"
+import type {
+	ClassedField,
+	EnvShape,
+	Flatten,
+	InferredOf,
+	JoinOk,
+	ParamEntry,
+	ParamsRecord,
+	Var
+} from "#query/scope.ts"
 import {
 	fieldJoins,
 	inferred,
@@ -76,20 +88,27 @@ import {
 	makeParam,
 	makeSetParam,
 	makeVar,
+	makeVars,
 	renderFieldKind,
 	term
 } from "#query/scope.ts"
 import type { CheckNameSelect, CheckSelect, RowOfNameSelect, RowOfSelect, SelectEntry } from "#query/select.ts"
 import { argMax, argMin, count, countDistinct, max, min, pack, sum } from "#query/select.ts"
-import type { AnyRelation, FieldsShape, RelationFields } from "#relation.ts"
+import type { FieldsShape, RelationField } from "#relation.ts"
 import type { AnySchema, Schema, SchemaRelations } from "#schema.ts"
 
-/** The ordinary (matchable) relations of a schema's record — closed relations lack the relation shape entirely. */
-type QueryRelation<Rels extends SchemaRelations> = Extract<Rels[keyof Rels], AnyRelation>
+/**
+ * The matchable members of a schema's record — ordinary relations AND
+ * closed vocabularies (ψ query atoms: a closed atom is an ordinary EDB
+ * atom over the sealed extension; the ENGINE decides whether it folds to a
+ * plan-constant member set or joins the L1-resident virtual image — the
+ * SDK lowers pass-through and never knows which).
+ */
+type QueryRelation<Rels extends SchemaRelations> = Extract<Rels[keyof Rels], MatchOwner>
 
-/** The environment after one bindings record: the incoming env plus every var the record binds. */
-type EnvOfMatch<Env extends EnvShape, F extends FieldsShape, B> =
-	Flatten<Env & BindEnv<F, B>> extends infer E extends EnvShape ? E : never
+/** The environment after one bindings record: the incoming env plus every var the record binds (as classed slots). */
+type EnvOfMatch<Env extends EnvShape, F extends FieldsShape, CR, B> =
+	Flatten<Env & BindEnv<F, CR, B>> extends infer E extends EnvShape ? E : never
 
 /** Reads an inferred-params carrier off a rec reference or rule value. */
 type ParamsOf<T> = InferredOf<T> extends { readonly params: infer P extends ParamsRecord } ? P : Record<never, never>
@@ -98,12 +117,13 @@ type ParamsOf<T> = InferredOf<T> extends { readonly params: infer P extends Para
 type RowOf<T> = InferredOf<T> extends { readonly row: infer R } ? R : never
 
 /**
- * A recursive predicate's HEAD signature as field descriptors, position
- * for position — carried on the rec reference so an `idb` join can be
- * judged against it; `undefined` on values that carry no head (a plain
- * query rule, or an unthreaded rec handle before its first rule).
+ * A recursive predicate's HEAD signature as classed slots (descriptor +
+ * law-computed class), position for position — carried on the rec
+ * reference so an `idb` join can be judged against it; `undefined` on
+ * values that carry no head (a plain query rule, or an unthreaded rec
+ * handle before its first rule).
  */
-type HeadShape = readonly AnyField[] | undefined
+type HeadShape = readonly ClassedField[] | undefined
 
 /**
  * One finished rule as a plain value: the runtime data plus the inferred
@@ -125,7 +145,7 @@ type HeadFieldsOf<Env extends EnvShape, S extends readonly string[]> = {
 }
 
 /** Reads an inferred-head carrier off a rule value or rec reference. */
-type HeadOf<T> = InferredOf<T> extends { readonly head: infer H extends readonly AnyField[] } ? H : undefined
+type HeadOf<T> = InferredOf<T> extends { readonly head: infer H extends readonly ClassedField[] } ? H : undefined
 
 /**
  * A recursive predicate REFERENCE — the shape `idb()` targets carry: the
@@ -142,11 +162,11 @@ interface RecRef<Name extends string, P extends ParamsRecord, Head extends HeadS
 	readonly [inferred]?: { readonly params: P; readonly head: Head }
 }
 
-/** One `idb` position's judgment: the var must be bound by a relation atom, domain-equal to the head column when the head is carried. */
+/** One `idb` position's judgment: the var must be bound by a relation atom, class-equal to the head slot when the head is carried. */
 type IdbVarOk<Env extends EnvShape, T, F> =
 	T extends Var<infer N extends string>
 		? N extends keyof Env
-			? F extends AnyField
+			? F extends ClassedField
 				? JoinOk<Env[N], F>
 				: true
 			: false
@@ -156,12 +176,12 @@ type IdbVarOk<Env extends EnvShape, T, F> =
  * The validated `idb` variable tuple: every var must already be bound by a
  * relation atom of the rule; and when the target carries its head
  * signature (the threaded rec handle), the tuple must match the head's
- * arity and every position must be domain-equal to its head column — the
+ * arity and every position must be class-equal to its head slot — the
  * same wall `JoinOk` holds for EDB atoms. An unthreaded handle carries no
- * head; its joins stay boundness-checked here and arity/domain-judged at
+ * head; its joins stay boundness-checked here and arity/class-judged at
  * prepare (the engine's law stands behind both tiers).
  */
-type CheckIdbVars<Env extends EnvShape, V, Head extends HeadShape = undefined> = Head extends readonly AnyField[]
+type CheckIdbVars<Env extends EnvShape, V, Head extends HeadShape = undefined> = Head extends readonly ClassedField[]
 	? V extends readonly unknown[]
 		? V["length"] extends Head["length"]
 			? { readonly [I in keyof V]: IdbVarOk<Env, V[I], Head[I & keyof Head]> extends true ? V[I] : never }
@@ -178,6 +198,8 @@ type CheckIdbVars<Env extends EnvShape, V, Head extends HeadShape = undefined> =
 interface TermOps {
 	/** Declares/names one variable: typed by the field it first binds; reuse joins. */
 	readonly var: typeof makeVar
+	/** Mints several variables at once — `const { service, w } = r.vars("service", "w")`: each name typed exactly; duplicates refuse. */
+	readonly vars: typeof makeVars
 	/** Names one scalar parameter: typed by its use; the key of the execute params object. */
 	readonly param: typeof makeParam
 	/** Names one ∈-set parameter (the IR's `ParamSet`): bound to a readonly array at execution. */
@@ -208,51 +230,77 @@ interface TermOps {
 	readonly pack: typeof pack
 }
 
-/** The rule builder a `query(S).rule(...)` callback receives: the ops plus the first atom. */
-interface QueryRuleScope<Rels extends SchemaRelations> extends TermOps {
-	/** The first EDB atom of the rule: fields bind vars, params, ∈-sets, or bare literals; absence is the wildcard (same-named vars within the record join domain-equal). */
-	match<R extends QueryRelation<Rels>, const B extends MatchShape<RelationFields<R>>>(
+/** The rule builder a `query(S).rule(...)` callback receives: the ops plus the first atom (`Classes` — the schema type's class map, the join judge's authority). */
+interface QueryRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses = SchemaClasses> extends TermOps {
+	/** The first EDB atom of the rule: fields bind vars, params, ∈-sets, or bare literals; absence is the wildcard (same-named vars within the record join class-equal). */
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Record<never, never>, RelationFields<R>, B>
-	): QueryRuleChain<Rels, EnvOfMatch<Record<never, never>, RelationFields<R>, B>, BindParamsShape<RelationFields<R>, B>>
+		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): QueryRuleChain<
+		Rels,
+		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		BindParamsShape<MatchFields<R>, B>,
+		Classes
+	>
 }
 
 /** The chain of a plain query rule: more atoms, residual predicates, then the head. */
-interface QueryRuleChain<Rels extends SchemaRelations, Env extends EnvShape, P extends ParamsRecord> {
-	/** One more positive EDB atom — var reuse joins, domain-equal by the environment check. */
-	match<R extends QueryRelation<Rels>, const B extends MatchShape<RelationFields<R>>>(
+interface QueryRuleChain<
+	Rels extends SchemaRelations,
+	Env extends EnvShape,
+	P extends ParamsRecord,
+	Classes extends SchemaClasses = SchemaClasses
+> {
+	/** One more positive EDB atom — var reuse joins, class-equal by the environment check. */
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Env, RelationFields<R>, B>
-	): QueryRuleChain<Rels, EnvOfMatch<Env, RelationFields<R>, B>, Flatten<P & BindParamsShape<RelationFields<R>, B>>>
+		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): QueryRuleChain<
+		Rels,
+		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
+		Classes
+	>
 	/** One residual predicate: a comparison, an `and`/`or` tree, or a negated atom (`r.not`). */
 	where<const C extends AnyCond>(
-		cond: CheckCond<Env, C> & C
-	): QueryRuleChain<Rels, Env, Flatten<P & CondParamsShape<Env, C>>>
+		cond: CheckCond<Env, Classes, C> & C
+	): QueryRuleChain<Rels, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
 	/** The head projection: var names, the measure, and aggregates; written order = answer column order. */
 	select<const S extends readonly SelectEntry[]>(...entries: CheckSelect<Env, S> & S): RuleValue<RowOfSelect<Env, S>, P>
 }
 
 /** The rule builder an OUTPUT rule of a `program()` receives: a query rule plus finished-stratum `idb` atoms. */
-interface OutputRuleScope<Rels extends SchemaRelations> extends TermOps {
-	match<R extends QueryRelation<Rels>, const B extends MatchShape<RelationFields<R>>>(
+interface OutputRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses = SchemaClasses> extends TermOps {
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Record<never, never>, RelationFields<R>, B>
+		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
 	): OutputRuleChain<
 		Rels,
-		EnvOfMatch<Record<never, never>, RelationFields<R>, B>,
-		BindParamsShape<RelationFields<R>, B>
+		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		BindParamsShape<MatchFields<R>, B>,
+		Classes
 	>
 }
 
 /** The chain of an output rule: atoms, predicates, `idb` joins over the program's recs, then the head. */
-interface OutputRuleChain<Rels extends SchemaRelations, Env extends EnvShape, P extends ParamsRecord> {
-	match<R extends QueryRelation<Rels>, const B extends MatchShape<RelationFields<R>>>(
+interface OutputRuleChain<
+	Rels extends SchemaRelations,
+	Env extends EnvShape,
+	P extends ParamsRecord,
+	Classes extends SchemaClasses = SchemaClasses
+> {
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Env, RelationFields<R>, B>
-	): OutputRuleChain<Rels, EnvOfMatch<Env, RelationFields<R>, B>, Flatten<P & BindParamsShape<RelationFields<R>, B>>>
+		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): OutputRuleChain<
+		Rels,
+		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
+		Classes
+	>
 	where<const C extends AnyCond>(
-		cond: CheckCond<Env, C> & C
-	): OutputRuleChain<Rels, Env, Flatten<P & CondParamsShape<Env, C>>>
+		cond: CheckCond<Env, Classes, C> & C
+	): OutputRuleChain<Rels, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
 	/**
 	 * One `idb` atom over a FINISHED stratum (any rec of this program): a
 	 * positional join against the rec's head. An idb atom is a join
@@ -260,26 +308,28 @@ interface OutputRuleChain<Rels extends SchemaRelations, Env extends EnvShape, P
 	 * the rule (the theory's own domain relation; the rec's answers are
 	 * theory values, so the join is identity). Threading the rec value the
 	 * last `.rule(...)` returned carries its rules' params into `Params`
-	 * AND its head signature, so the join is arity- and domain-checked
+	 * AND its head signature, so the join is arity- and class-checked
 	 * against the head at compile time.
 	 */
 	idb<Target extends RecRef<string, ParamsRecord>, const V extends readonly Var<string>[]>(
 		target: Target,
 		...vars: CheckIdbVars<Env, V, HeadOf<Target>> & V
-	): OutputRuleChain<Rels, Env, Flatten<P & ParamsOf<Target>>>
+	): OutputRuleChain<Rels, Env, Flatten<P & ParamsOf<Target>>, Classes>
 	select<const S extends readonly SelectEntry[]>(...entries: CheckSelect<Env, S> & S): RuleValue<RowOfSelect<Env, S>, P>
 }
 
 /** The rule builder a RECURSIVE rule (`rec.rule(...)`) receives. */
-interface RecRuleScope<Rels extends SchemaRelations, Self extends string> extends TermOps {
-	match<R extends QueryRelation<Rels>, const B extends MatchShape<RelationFields<R>>>(
+interface RecRuleScope<Rels extends SchemaRelations, Self extends string, Classes extends SchemaClasses = SchemaClasses>
+	extends TermOps {
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Record<never, never>, RelationFields<R>, B>
+		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
 	): RecRuleChain<
 		Rels,
 		Self,
-		EnvOfMatch<Record<never, never>, RelationFields<R>, B>,
-		BindParamsShape<RelationFields<R>, B>
+		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		BindParamsShape<MatchFields<R>, B>,
+		Classes
 	>
 }
 
@@ -295,21 +345,28 @@ interface RecRuleChain<
 	Rels extends SchemaRelations,
 	Self extends string,
 	Env extends EnvShape,
-	P extends ParamsRecord
+	P extends ParamsRecord,
+	Classes extends SchemaClasses = SchemaClasses
 > {
-	match<R extends QueryRelation<Rels>, const B extends MatchShape<RelationFields<R>>>(
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Env, RelationFields<R>, B>
-	): RecRuleChain<Rels, Self, EnvOfMatch<Env, RelationFields<R>, B>, Flatten<P & BindParamsShape<RelationFields<R>, B>>>
+		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): RecRuleChain<
+		Rels,
+		Self,
+		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
+		Classes
+	>
 	where<const C extends AnyCond>(
-		cond: CheckCond<Env, C> & C
-	): RecRuleChain<Rels, Self, Env, Flatten<P & CondParamsShape<Env, C>>>
-	/** The self-recursive atom: `idb(self, ...boundVars)` — only this rec's own reference is accepted (threaded, its head arity- and domain-checks the join). */
+		cond: CheckCond<Env, Classes, C> & C
+	): RecRuleChain<Rels, Self, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
+	/** The self-recursive atom: `idb(self, ...boundVars)` — only this rec's own reference is accepted (threaded, its head arity- and class-checks the join). */
 	idb<Target extends RecRef<Self, ParamsRecord>, const V extends readonly Var<string>[]>(
 		target: Target,
 		...vars: CheckIdbVars<Env, V, HeadOf<Target>> & V
-	): RecRuleChain<Rels, Self, Env, P>
-	/** The recursive head: bound variable names only (the creation quarantine, restated for fixpoint topology); the value carries the head's field descriptors for `idb` pairing. */
+	): RecRuleChain<Rels, Self, Env, P, Classes>
+	/** The recursive head: bound variable names only (the creation quarantine, restated for fixpoint topology); the value carries the head's classed slots for `idb` pairing. */
 	select<const S extends readonly string[]>(
 		...names: CheckNameSelect<Env, S> & S
 	): RuleValue<RowOfNameSelect<Env, S>, P, HeadFieldsOf<Env, S>>
@@ -333,13 +390,18 @@ interface QueryData {
  * the rules use. Prepare with `db.prepare(q)`; nothing here touches an
  * engine.
  */
-interface Query<Rels extends SchemaRelations, Row, Params extends ParamsRecord> {
-	readonly schema: Schema<Rels>
+interface Query<
+	Rels extends SchemaRelations,
+	Row,
+	Params extends ParamsRecord,
+	Classes extends SchemaClasses = SchemaClasses
+> {
+	readonly schema: Schema<Rels, Classes>
 	readonly data: QueryData
 	/** One more rule — the query's answers are the SET UNION of its rules' answers; every rule derives the same head. */
 	rule<RV extends AnyRuleValue>(
-		build: (r: QueryRuleScope<Rels>) => RV
-	): Query<Rels, Row | RowOf<RV>, Flatten<Params & ParamsOf<RV>>>
+		build: (r: QueryRuleScope<Rels, Classes>) => RV
+	): Query<Rels, Row | RowOf<RV>, Flatten<Params & ParamsOf<RV>>, Classes>
 	readonly [inferred]?: { readonly row: Row; readonly params: Params }
 }
 
@@ -360,13 +422,16 @@ type QueryRow<Q extends AnyQuery> = RowOf<Q>
 type QueryParams<Q extends AnyQuery> = ParamsOf<Q>
 
 /** The entry value of `query(S)`: the first `.rule` mints the query. */
-interface QueryStart<Rels extends SchemaRelations> {
-	rule<RV extends AnyRuleValue>(build: (r: QueryRuleScope<Rels>) => RV): Query<Rels, RowOf<RV>, ParamsOf<RV>>
+interface QueryStart<Rels extends SchemaRelations, Classes extends SchemaClasses = SchemaClasses> {
+	rule<RV extends AnyRuleValue>(
+		build: (r: QueryRuleScope<Rels, Classes>) => RV
+	): Query<Rels, RowOf<RV>, ParamsOf<RV>, Classes>
 }
 
 /** The frozen constructor vocabulary every rule builder spreads. */
 const termOps: TermOps = Object.freeze({
 	var: makeVar,
+	vars: makeVars,
 	param: makeParam,
 	inSet: makeSetParam,
 	maskParam: makeMaskParam,
@@ -396,7 +461,7 @@ const termOps: TermOps = Object.freeze({
 /** One rule under construction: immutable — every chain step is a fresh state. */
 interface RuleBuildState {
 	readonly items: readonly RuleItem[]
-	readonly varFields: Readonly<Record<string, AnyField>>
+	readonly varFields: Readonly<Record<string, ClassedField>>
 	readonly paramUses: readonly ParamUse[]
 }
 
@@ -407,56 +472,143 @@ const EMPTY_RULE: RuleBuildState = Object.freeze({
 	paramUses: Object.freeze([])
 })
 
-/** One resolved bindings record: the atom entries, the vars it binds, and the params it uses. */
+/** One resolved bindings record: the atom entries, the vars it binds (as classed slots), and the params it uses. */
 interface ResolvedBindings {
 	readonly atom: AtomData
-	readonly vars: ReadonlyArray<{ readonly name: string; readonly field: AnyField }>
+	readonly vars: ReadonlyArray<{ readonly name: string; readonly slot: ClassedField }>
 	readonly uses: readonly ParamUse[]
 }
 
 /**
- * Resolves a bindings record against a relation's declared fields, in the
- * record's written order: terms classify by their runtime tag, everything
- * else is a bare literal (typed by the FIELD at lowering — the membership
- * typing rule included).
+ * The ordered matchable fields of an atom owner — the runtime twin of the
+ * type tier's `MatchFields`: a relation's declared fields; a closed
+ * relation's SEALED shape, the synthetic `id` (the value's own
+ * roster-carrying descriptor, by identity) at ordinal 0 and the declared
+ * payload columns at declared index + 1 (the sealed shift, mirroring
+ * `spec.rs`'s resolver — a `ClosedColumn` is structurally a
+ * {@link RelationField}). The lowering golden pins this mapping.
+ */
+function matchFieldsOf(owner: MatchOwner): readonly RelationField[] {
+	if ("axioms" in owner) {
+		return [Object.freeze({ name: "id", field: owner.id }), ...owner.data.columns]
+	}
+	return owner.data.fields
+}
+
+/**
+ * Judges one membership ARRAY at a binding position — legal exactly at a
+ * CLOSED-reference field (the owner ruling: ordinary u64/str membership is
+ * spelled through `r.inSet` params; literal arrays are the closed
+ * vocabulary's spelling), holding ≥ 2 DISTINCT handle names (the
+ * degenerate sets are refusals: empty selects nothing, one element is the
+ * bare literal respelled, and a duplicate member is the same respelling in
+ * disguise — write each member once). The returned name is
+ * CONTENT-ADDRESSED (vocabulary + the member SET — the key sorts a copy,
+ * so two spellings of one set, reordered or not, share one dense
+ * `ParamId`); the members are shape-checked strings here and
+ * roster-verified at the one verification point (`taggedHandleId`) when
+ * the SDK supplies the set at execute — the same moment a bound `r.inSet`
+ * param's members are judged.
+ */
+function membershipSet(
+	context: string,
+	field: AnyField,
+	value: readonly unknown[]
+): { readonly name: string; readonly members: readonly string[] } {
+	if (!("closed" in field)) {
+		throw errors.new(
+			`${context}: a membership array is the closed-reference spelling — ordinary field membership is a bound ∈-set param (r.inSet)`
+		)
+	}
+	if (value.length === 0) {
+		throw errors.new(`${context}: an empty membership array selects nothing — write the query you mean`)
+	}
+	if (value.length === 1) {
+		throw errors.new(
+			`${context}: a one-element membership array is the bare literal respelled — write the literal (the canonical-utterance law: one meaning, one spelling)`
+		)
+	}
+	const seen = new Set<string>()
+	const members = value.map(function memberName(member) {
+		if (typeof member !== "string") {
+			throw literalShapeError(context, `a ${field.closed.name} handle name (string)`, member)
+		}
+		if (seen.has(member)) {
+			throw errors.new(
+				`${context}: the membership array spells ${member} twice — write it once (the canonical-utterance law: one meaning, one spelling)`
+			)
+		}
+		seen.add(member)
+		return member
+	})
+	const key = [...members].sort()
+	return { name: `∈ ${field.closed.name} ${JSON.stringify(key)}`, members: Object.freeze(members) }
+}
+
+/**
+ * Resolves a bindings record against an atom owner's matchable fields (a
+ * relation's declared fields; a closed relation's sealed id + columns), in
+ * the record's written order: terms classify by their runtime tag,
+ * everything else is a bare literal (typed by the FIELD at lowering — the
+ * membership typing rule included). Every bound field carries its
+ * law-computed class, read off the schema value's frozen class map — the
+ * runtime twin of the type tier's `SlotAt` lookups.
  */
 function resolveBindings(
 	context: string,
-	relation: AnyRelation,
-	bindings: Readonly<Record<string, unknown>>
+	relation: MatchOwner,
+	bindings: Readonly<Record<string, unknown>>,
+	classes: SchemaClasses
 ): ResolvedBindings {
 	const entries: BindingEntry[] = []
-	const vars: Array<{ readonly name: string; readonly field: AnyField }> = []
+	const vars: Array<{ readonly name: string; readonly slot: ClassedField }> = []
 	const uses: ParamUse[] = []
+	const relationClasses = classes[relation.name]
+	const ordered = matchFieldsOf(relation)
 	for (const [fieldName, value] of Object.entries(bindings)) {
 		if (value === undefined) {
 			continue
 		}
-		const declared = relation.data.fields.find(function byName(candidate) {
+		const declared = ordered.find(function byName(candidate) {
 			return candidate.name === fieldName
 		})
 		if (declared === undefined) {
 			throw errors.new(`${context} has no field ${fieldName}`)
 		}
+		const fieldClass = relationClasses?.[fieldName]
 		let bound: BindingEntry["term"]
 		if (isTerm(value)) {
 			switch (value[term]) {
 				case "var": {
 					bound = Object.freeze({ kind: "var" as const, name: value.name })
-					vars.push(Object.freeze({ name: value.name, field: declared.field }))
+					vars.push(
+						Object.freeze({ name: value.name, slot: Object.freeze({ field: declared.field, class: fieldClass }) })
+					)
 					break
 				}
 				case "param": {
 					bound = Object.freeze({ kind: "param" as const, name: value.name })
 					uses.push(
-						Object.freeze({ name: value.name, shape: "value" as const, anchor: declared.field, op: "binding" as const })
+						Object.freeze({
+							name: value.name,
+							shape: "value" as const,
+							anchor: declared.field,
+							op: "binding" as const,
+							members: undefined
+						})
 					)
 					break
 				}
 				case "setParam": {
 					bound = Object.freeze({ kind: "setParam" as const, name: value.name })
 					uses.push(
-						Object.freeze({ name: value.name, shape: "set" as const, anchor: declared.field, op: "binding" as const })
+						Object.freeze({
+							name: value.name,
+							shape: "set" as const,
+							anchor: declared.field,
+							op: "binding" as const,
+							members: undefined
+						})
 					)
 					break
 				}
@@ -469,10 +621,22 @@ function resolveBindings(
 						`${context}.${fieldName}: the measure is not a field-typed value — it lives in comparisons and select entries`
 					)
 			}
+		} else if (Array.isArray(value)) {
+			const set = membershipSet(`${context}.${fieldName}`, declared.field, value)
+			bound = Object.freeze({ kind: "literalSet" as const, name: set.name, members: set.members })
+			uses.push(
+				Object.freeze({
+					name: set.name,
+					shape: "set" as const,
+					anchor: declared.field,
+					op: "binding" as const,
+					members: set.members
+				})
+			)
 		} else {
 			bound = Object.freeze({ kind: "literal" as const, value })
 		}
-		entries.push(Object.freeze({ field: fieldName, data: declared.field, term: bound }))
+		entries.push(Object.freeze({ field: fieldName, data: declared.field, class: fieldClass, term: bound }))
 	}
 	return {
 		atom: Object.freeze({ relation, bindings: Object.freeze(entries) }),
@@ -484,24 +648,25 @@ function resolveBindings(
 /**
  * Extends a rule state with one positive atom. Vars bind on first
  * occurrence; every LATER occurrence (a later atom's field or a same-record
- * sibling) is a join and must be domain-equal — the construction-time twin
- * of the type tier's `JoinOk`, so the domain wall holds for untyped
- * callers too.
+ * sibling) is a join and must be class-equal — the construction-time twin
+ * of the type tier's `JoinOk` (bare pairs only with bare), so the domain
+ * wall holds for untyped callers too.
  */
 function advanceMatch(
 	state: RuleBuildState,
-	relation: AnyRelation,
-	bindings: Readonly<Record<string, unknown>>
+	relation: MatchOwner,
+	bindings: Readonly<Record<string, unknown>>,
+	classes: SchemaClasses
 ): RuleBuildState {
-	const resolved = resolveBindings(`relation ${relation.name}`, relation, bindings)
-	const varFields: Record<string, AnyField> = { ...state.varFields }
+	const resolved = resolveBindings(`relation ${relation.name}`, relation, bindings, classes)
+	const varFields: Record<string, ClassedField> = { ...state.varFields }
 	for (const bound of resolved.vars) {
 		const existing = varFields[bound.name]
 		if (existing === undefined) {
-			varFields[bound.name] = bound.field
-		} else if (!fieldJoins(existing, bound.field)) {
+			varFields[bound.name] = bound.slot
+		} else if (!fieldJoins(existing, bound.slot)) {
 			throw errors.new(
-				`relation ${relation.name}: the variable ${bound.name} joins domain-unequal fields — first bound at ${renderFieldKind(existing)}, reused at ${renderFieldKind(bound.field)} (a var joins only domain-equal fields)`
+				`relation ${relation.name}: the variable ${bound.name} joins domain-unequal fields — first bound at ${renderFieldKind(existing)}, reused at ${renderFieldKind(bound.slot)} (a var joins only class-equal slots; bare pairs only with bare)`
 			)
 		}
 	}
@@ -541,7 +706,7 @@ function sideUses(
 	op: CmpKind,
 	side: CmpTermData,
 	sibling: CmpTermData,
-	varFields: Readonly<Record<string, AnyField>>,
+	varFields: Readonly<Record<string, ClassedField>>,
 	uses: ParamUse[]
 ): void {
 	if (side.kind !== "param" && side.kind !== "setParam") {
@@ -549,7 +714,7 @@ function sideUses(
 	}
 	let anchor: AnyField | "measure" | undefined
 	if (sibling.kind === "var") {
-		anchor = varFields[sibling.name]
+		anchor = varFields[sibling.name]?.field
 	} else if (sibling.kind === "measure") {
 		anchor = "measure"
 	} else {
@@ -560,13 +725,14 @@ function sideUses(
 			name: side.name,
 			shape: side.kind === "param" ? ("value" as const) : ("set" as const),
 			anchor,
-			op
+			op,
+			members: undefined
 		})
 	)
 }
 
 /** Lowers one condition VALUE to its runtime data, recording param uses. */
-function condDataOf(cond: AnyCond, varFields: Readonly<Record<string, AnyField>>, uses: ParamUse[]): CondData {
+function condDataOf(cond: AnyCond, varFields: Readonly<Record<string, ClassedField>>, uses: ParamUse[]): CondData {
 	if (cond.cond === "cmp") {
 		const lhs = cmpTermDataOf(cond.op, cond.lhs)
 		const rhs = cmpTermDataOf(cond.op, cond.rhs)
@@ -580,7 +746,13 @@ function condDataOf(cond: AnyCond, varFields: Readonly<Record<string, AnyField>>
 			} else if (isTerm(maskValue) && maskValue[term] === "maskParam") {
 				mask = Object.freeze({ kind: "param" as const, name: maskValue.name })
 				uses.push(
-					Object.freeze({ name: maskValue.name, shape: "mask" as const, anchor: undefined, op: "allen" as const })
+					Object.freeze({
+						name: maskValue.name,
+						shape: "mask" as const,
+						anchor: undefined,
+						op: "allen" as const,
+						members: undefined
+					})
 				)
 			} else {
 				throw errors.new("allen: the mask position takes a 13-bit mask number or a maskParam")
@@ -602,18 +774,18 @@ function condDataOf(cond: AnyCond, varFields: Readonly<Record<string, AnyField>>
 }
 
 /** Extends a rule state with one `.where` item (a condition or a negated atom). */
-function advanceWhere(state: RuleBuildState, cond: AnyCond): RuleBuildState {
+function advanceWhere(state: RuleBuildState, cond: AnyCond, classes: SchemaClasses): RuleBuildState {
 	if (typeof cond !== "object" || cond === null || !("cond" in cond)) {
 		throw errors.new("where() takes a comparison, an and()/or() tree, or a negated atom")
 	}
 	if (cond.cond === "not") {
-		const relation: AnyRelation = cond.relation
+		const relation: MatchOwner = cond.relation
 		const bindings: Readonly<Record<string, unknown>> = Object.fromEntries(
 			Object.entries(cond.bindings ?? {}).filter(function defined([, value]) {
 				return value !== undefined
 			})
 		)
-		const resolved = resolveBindings(`negated relation ${relation.name}`, relation, bindings)
+		const resolved = resolveBindings(`negated relation ${relation.name}`, relation, bindings, classes)
 		return {
 			items: Object.freeze([...state.items, Object.freeze({ kind: "negated" as const, atom: resolved.atom })]),
 			varFields: state.varFields,
@@ -651,14 +823,27 @@ function isAggregateEntry(
 	return typeof value === "object" && value !== null && "agg" in value
 }
 
-/** Classifies one select entry into its named answer column. */
+/**
+ * Classifies one select entry into its named answer column. The `closed`
+ * slice is resolved LATER, at rule completion (`completeRule`), where the
+ * rule's `varFields` are in hand — until then every column is provisionally
+ * bare.
+ */
 function selectColumnOf(entry: unknown): SelectColumn {
 	if (typeof entry === "string") {
-		return Object.freeze({ name: entry, entry: Object.freeze({ kind: "var" as const, over: entry }) })
+		return Object.freeze({
+			name: entry,
+			entry: Object.freeze({ kind: "var" as const, over: entry }),
+			closed: undefined
+		})
 	}
 	if (isTerm(entry)) {
 		if (entry[term] === "duration") {
-			return Object.freeze({ name: entry.name, entry: Object.freeze({ kind: "measure" as const, over: entry.name }) })
+			return Object.freeze({
+				name: entry.name,
+				entry: Object.freeze({ kind: "measure" as const, over: entry.name }),
+				closed: undefined
+			})
 		}
 		throw errors.new(
 			`query select: a ${entry[term]} is not projectable — select takes variable names, duration(v), or aggregates`
@@ -677,7 +862,11 @@ function aggregateColumnOf(entry: {
 	readonly key: unknown
 }): SelectColumn {
 	function column(name: string, agg: AggData): SelectColumn {
-		return Object.freeze({ name, entry: Object.freeze({ kind: "aggregate" as const, agg: Object.freeze(agg) }) })
+		return Object.freeze({
+			name,
+			entry: Object.freeze({ kind: "aggregate" as const, agg: Object.freeze(agg) }),
+			closed: undefined
+		})
 	}
 	const over = entry.over
 	switch (entry.agg) {
@@ -718,36 +907,76 @@ function aggregateColumnOf(entry: {
 	}
 }
 
+/**
+ * The orderable ban's pointed refusal (`docs/architecture/10-data-model.md`
+ * § orderability): a closed reference is equality-and-membership only —
+ * its declaration-id order is an encoding accident, so every
+ * order-comparison and fold position refuses it. The construction-time
+ * twin of the type tier's `OrderVarOk` exclusion, so the wall holds for
+ * untyped callers too (the engine cannot backstop this one: the wire IR
+ * carries plain u64s, no rosters).
+ */
+function closedOrderError(context: string, position: string, vocabulary: string): Error {
+	return errors.new(
+		`${context}: ${position} is a ${vocabulary} reference — declaration order is an accident, not semantics: vocabularies do not order (docs/architecture/10-data-model.md; equality, membership, and counting remain)`
+	)
+}
+
+/** The comparison ops the orderable ban covers (order roster + point membership — every order-comparison position). */
+function isOrderOp(op: CmpKind | "binding"): op is "lt" | "le" | "gt" | "ge" | "pointIn" {
+	return op === "lt" || op === "le" || op === "gt" || op === "ge" || op === "pointIn"
+}
+
 /** Requires a var name to be bound by a relation atom of the rule. */
-function assertBound(context: string, varFields: Readonly<Record<string, AnyField>>, name: string): AnyField {
-	const field = varFields[name]
-	if (field === undefined) {
+function assertBound(context: string, varFields: Readonly<Record<string, ClassedField>>, name: string): ClassedField {
+	const slot = varFields[name]
+	if (slot === undefined) {
 		throw errors.new(`${context}: the variable ${name} is not bound by a relation atom of the rule`)
 	}
-	return field
+	return slot
 }
 
 /** Requires a var name to be bound at an interval field (the measure's and pack's domain). */
-function assertIntervalBound(context: string, varFields: Readonly<Record<string, AnyField>>, name: string): void {
-	const field = assertBound(context, varFields, name)
-	if (field.kind !== "interval") {
+function assertIntervalBound(context: string, varFields: Readonly<Record<string, ClassedField>>, name: string): void {
+	const slot = assertBound(context, varFields, name)
+	if (slot.field.kind !== "interval") {
 		throw errors.new(
 			`${context}: ${name} is not interval-typed — the measure is defined over interval-typed variables only`
 		)
 	}
 }
 
-/** Validates one condition's variable references against the rule's bound names. */
-function validateCond(context: string, varFields: Readonly<Record<string, AnyField>>, cond: CondData): void {
+/**
+ * Validates one condition's variable references against the rule's bound
+ * names — and, for `eq`/`ne` over two variables, holds the class wall: the
+ * unification IS a join, so the two slots must be class-equal exactly as a
+ * match-reuse join must be (the construction-time twin of the type tier's
+ * `EqOk` → `JoinOk`; bare pairs only with bare). The engine cannot backstop
+ * this one — the query IR carries no domains — so the wall lives here for
+ * untyped callers too.
+ */
+function validateCond(context: string, varFields: Readonly<Record<string, ClassedField>>, cond: CondData): void {
 	if (cond.kind === "cmp") {
 		for (const side of [cond.lhs, cond.rhs]) {
 			if (side.kind === "var") {
-				assertBound(context, varFields, side.name)
+				const slot = assertBound(context, varFields, side.name)
+				if (isOrderOp(cond.op) && "closed" in slot.field) {
+					throw closedOrderError(context, `the ${cond.op} side ${side.name}`, slot.field.closed.name)
+				}
 			}
 			if (side.kind === "measure") {
 				assertIntervalBound(context, varFields, side.name)
 			}
 		}
+		if ((cond.op === "eq" || cond.op === "ne") && cond.lhs.kind === "var" && cond.rhs.kind === "var") {
+			const lhs = assertBound(context, varFields, cond.lhs.name)
+			const rhs = assertBound(context, varFields, cond.rhs.name)
+			if (!fieldJoins(lhs, rhs)) {
+				throw errors.new(
+					`${context}: ${cond.op}(${cond.lhs.name}, ${cond.rhs.name}) unifies domain-unequal fields — ${cond.lhs.name} bound at ${renderFieldKind(lhs)}, ${cond.rhs.name} at ${renderFieldKind(rhs)} (a var joins only class-equal slots; bare pairs only with bare)`
+				)
+			}
+		}
 		return
 	}
 	for (const child of cond.children) {
@@ -756,7 +985,11 @@ function validateCond(context: string, varFields: Readonly<Record<string, AnyFie
 }
 
 /** Validates one select column's variable references. */
-function validateColumn(context: string, varFields: Readonly<Record<string, AnyField>>, column: SelectColumn): void {
+function validateColumn(
+	context: string,
+	varFields: Readonly<Record<string, ClassedField>>,
+	column: SelectColumn
+): void {
 	const entry = column.entry
 	if (entry.kind === "var") {
 		assertBound(`${context} select ${column.name}`, varFields, entry.over)
@@ -775,22 +1008,69 @@ function validateColumn(context: string, varFields: Readonly<Record<string, AnyF
 			return
 		case "fold": {
 			if (typeof agg.over === "string") {
-				assertBound(`${context} select ${column.name}`, varFields, agg.over)
+				const slot = assertBound(`${context} select ${column.name}`, varFields, agg.over)
+				if ("closed" in slot.field) {
+					throw closedOrderError(
+						`${context} select ${column.name}`,
+						`the ${agg.fold} input ${agg.over}`,
+						slot.field.closed.name
+					)
+				}
 				return
 			}
 			assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over.duration)
 			return
 		}
-		case "arg":
+		case "arg": {
 			assertBound(`${context} select ${column.name}`, varFields, agg.over)
-			assertBound(`${context} select ${column.name}`, varFields, agg.key)
+			const key = assertBound(`${context} select ${column.name}`, varFields, agg.key)
+			if ("closed" in key.field) {
+				throw closedOrderError(
+					`${context} select ${column.name}`,
+					`the ${agg.direction} key ${agg.key}`,
+					key.field.closed.name
+				)
+			}
 			return
+		}
 		case "pack":
 			assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over)
 			return
 	}
 }
 
+/**
+ * Resolves the roster one select column decodes through: a projected var,
+ * or an Arg-carried payload, bound at a closed-referencing field carries
+ * that field's roster (read off `varFields` — the same slot the domain
+ * machinery reads), and `decodeAnswers` lifts the column's row ids back to
+ * handle NAMES through it — the runtime twin of the row type's `Infer`
+ * claim. Every other entry decodes bare: counts are counts, the measure
+ * and `pack` are never closed, and a closed FOLD is banned outright
+ * ({@link closedOrderError}) before this resolution runs.
+ */
+function selectClosedOf(
+	varFields: Readonly<Record<string, ClassedField>>,
+	entry: SelectEntryData
+): ClosedRoster | undefined {
+	let over: string | undefined
+	if (entry.kind === "var") {
+		over = entry.over
+	} else if (entry.kind === "aggregate" && entry.agg.op === "arg") {
+		over = entry.agg.over
+	} else {
+		over = undefined
+	}
+	if (over === undefined) {
+		return undefined
+	}
+	const field = varFields[over]?.field
+	if (field !== undefined && "closed" in field) {
+		return field.closed
+	}
+	return undefined
+}
+
 /**
  * Completes one rule: classifies the select record (written order = answer
  * column order, names must be declaration-order-safe keys), and validates
@@ -821,9 +1101,10 @@ function completeRule(context: string, state: RuleBuildState, columns: readonly
 							`${context}: negated ${item.atom.relation.name} atom binds the variable ${binding.term.name} at position ${binding.field}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`
 						)
 					}
-					if (!fieldJoins(bound, binding.data)) {
+					const negatedSlot: ClassedField = { field: binding.data, class: binding.class }
+					if (!fieldJoins(bound, negatedSlot)) {
 						throw errors.new(
-							`${context}: negated ${item.atom.relation.name} atom reuses the variable ${binding.term.name} at ${binding.field} (${renderFieldKind(binding.data)}), but the rule binds it at ${renderFieldKind(bound)} — a var joins only domain-equal fields`
+							`${context}: negated ${item.atom.relation.name} atom reuses the variable ${binding.term.name} at ${binding.field} (${renderFieldKind(negatedSlot)}), but the rule binds it at ${renderFieldKind(bound)} — a var joins only class-equal slots; bare pairs only with bare`
 						)
 					}
 				}
@@ -842,10 +1123,10 @@ function completeRule(context: string, state: RuleBuildState, columns: readonly
 				if (column === undefined || column.entry.kind !== "var") {
 					return
 				}
-				const headField = head?.varFields[column.entry.over]
-				if (headField !== undefined && !fieldJoins(headField, bound)) {
+				const headSlot = head?.varFields[column.entry.over]
+				if (headSlot !== undefined && !fieldJoins(headSlot, bound)) {
 					throw errors.new(
-						`${context}: idb ${item.rec.name} joins the variable ${name} (${renderFieldKind(bound)}) at head position ${position} (${column.name}: ${renderFieldKind(headField)}) — a var joins only domain-equal fields`
+						`${context}: idb ${item.rec.name} joins the variable ${name} (${renderFieldKind(bound)}) at head position ${position} (${column.name}: ${renderFieldKind(headSlot)}) — a var joins only class-equal slots; bare pairs only with bare`
 					)
 				}
 			})
@@ -856,7 +1137,15 @@ function completeRule(context: string, state: RuleBuildState, columns: readonly
 	}
 	return Object.freeze({
 		items: state.items,
-		select: Object.freeze([...columns]),
+		select: Object.freeze(
+			columns.map(function enrichColumn(column): SelectColumn {
+				return Object.freeze({
+					name: column.name,
+					entry: column.entry,
+					closed: selectClosedOf(state.varFields, column.entry)
+				})
+			})
+		),
 		varFields: state.varFields,
 		paramUses: state.paramUses
 	})
@@ -877,7 +1166,7 @@ function makeRuleValue<Row, P extends ParamsRecord>(rule: RuleData): RuleValue<R
  * (bound variable names only — the creation quarantine).
  */
 interface RawChain {
-	match(relation: AnyRelation, bindings: Readonly<Record<string, unknown>>): RawChain
+	match(relation: MatchOwner, bindings: Readonly<Record<string, unknown>>): RawChain
 	where(cond: AnyCond): RawChain
 	idb(target: RecRef<string, ParamsRecord>, ...vars: readonly Var<string>[]): RawChain
 	select(...entries: readonly SelectEntry[]): RuleValue<never, never>
@@ -885,14 +1174,15 @@ interface RawChain {
 
 /** The runtime rule-builder shape beneath every typed scope. */
 interface RawScope extends TermOps {
-	match(relation: AnyRelation, bindings: Readonly<Record<string, unknown>>): RawChain
+	match(relation: MatchOwner, bindings: Readonly<Record<string, unknown>>): RawChain
 }
 
-/** Which rule family a chain builds — gates `idb` and the recursive select. */
-type ChainContext =
+/** Which rule family a chain builds — gates `idb` and the recursive select — plus the schema's runtime class map (the join judge's authority). */
+type ChainContext = { readonly classes: SchemaClasses } & (
 	| { readonly kind: "query" }
 	| { readonly kind: "rec"; readonly self: RecData }
 	| { readonly kind: "output"; readonly program: ProgramState }
+)
 
 /** The diagnostic label of a chain context. */
 function contextLabel(context: ChainContext): string {
@@ -948,10 +1238,10 @@ function selectColumns(context: ChainContext, entries: readonly SelectEntry[]):
 function makeRawChain(context: ChainContext, state: RuleBuildState): RawChain {
 	const chain: RawChain = {
 		match(relation, bindings) {
-			return makeRawChain(context, advanceMatch(state, relation, bindings))
+			return makeRawChain(context, advanceMatch(state, relation, bindings, context.classes))
 		},
 		where(cond) {
-			return makeRawChain(context, advanceWhere(state, cond))
+			return makeRawChain(context, advanceWhere(state, cond, context.classes))
 		},
 		idb(target, ...vars) {
 			return makeRawChain(context, idbAdvance(context, state, target, vars))
@@ -969,7 +1259,7 @@ function makeRawScope(context: ChainContext): RawScope {
 	const scope: RawScope = {
 		...termOps,
 		match(relation, bindings) {
-			return makeRawChain(context, advanceMatch(EMPTY_RULE, relation, bindings))
+			return makeRawChain(context, advanceMatch(EMPTY_RULE, relation, bindings, context.classes))
 		}
 	}
 	Object.freeze(scope)
@@ -990,29 +1280,39 @@ function isTypedScope<S>(scope: RawScope): scope is RawScope & S {
 }
 
 /** Builds one query-rule builder (the typed face of the raw builder). */
-function makeQueryRuleScope<Rels extends SchemaRelations>(): QueryRuleScope<Rels> {
-	const raw = makeRawScope({ kind: "query" })
-	if (!isTypedScope<QueryRuleScope<Rels>>(raw)) {
+function makeQueryRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses>(
+	classes: SchemaClasses
+): QueryRuleScope<Rels, Classes> {
+	const raw = makeRawScope({ kind: "query", classes })
+	if (!isTypedScope<QueryRuleScope<Rels, Classes>>(raw)) {
 		throw errors.new("query rule builder construction incomplete")
 	}
 	return raw
 }
 
 /** Builds one output-rule builder over a program's recs. */
-function makeOutputRuleScope<Rels extends SchemaRelations>(program: ProgramState): OutputRuleScope<Rels> {
-	const raw = makeRawScope({ kind: "output", program })
-	if (!isTypedScope<OutputRuleScope<Rels>>(raw)) {
+function makeOutputRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses>(
+	program: ProgramState
+): OutputRuleScope<Rels, Classes> {
+	const raw = makeRawScope({ kind: "output", program, classes: program.classes })
+	if (!isTypedScope<OutputRuleScope<Rels, Classes>>(raw)) {
 		throw errors.new("program output rule builder construction incomplete")
 	}
 	return raw
 }
 
-/** One program's build-time registry: its recs in declaration order, sealed when the output is declared. */
+/** One program's build-time registry: its recs in declaration order (sealed when the output is declared) and the theory's class map. */
 interface ProgramState {
 	readonly recs: RecData[]
+	readonly classes: SchemaClasses
 	sealed: boolean
 }
 
+/** Renders one head column's closed slice for the rule-alignment check's diagnostics. */
+function renderClosedSlice(closed: ClosedRoster | undefined): string {
+	return closed === undefined ? "a bare value" : `a ${closed.name} reference`
+}
+
 /** Renders one head column's signature for the rule-alignment check. */
 function headSignature(column: SelectColumn): string {
 	const entry = column.entry
@@ -1029,32 +1329,91 @@ function headSignature(column: SelectColumn): string {
 	return `${column.name}:${agg.op}`
 }
 
+/** The roster a param anchor carries: present exactly on a closed-reference field anchor. */
+function anchorRosterOf(anchor: AnyField | "measure" | undefined): ClosedRoster | undefined {
+	if (anchor === undefined || anchor === "measure") {
+		return undefined
+	}
+	if ("closed" in anchor) {
+		return anchor.closed
+	}
+	return undefined
+}
+
+/** Renders one param anchor's closedness for the registry's coherence diagnostics. */
+function renderParamAnchor(roster: ClosedRoster | undefined): string {
+	return roster === undefined ? "a non-closed position" : `a ${roster.name} reference`
+}
+
 /**
  * Folds every rule's param uses (recs in declaration order first, output
  * rules last — exactly the lowering walk) into the query's registry:
  * first use mints the dense `ParamId`, the first FIELD-ANCHORED use types
- * the wire, and one name must keep one shape.
+ * the wire, and one name must keep one shape AND one closedness — every
+ * anchored use of one name must agree on the roster (value identity), so a
+ * param anchored at a closed reference is GUARANTEED to ride the one
+ * roster-verification point (`taggedHandleId`) at execute; a name anchored
+ * both at a closed reference and at a non-closed position (or at two
+ * vocabularies) is refused here, because the wire would translate only the
+ * first anchor's reading (the type tier intersects the uses to `never`;
+ * this is its runtime twin for untyped callers). A param whose anchor is a
+ * CLOSED reference must never sit in an order-comparison position — the
+ * anchor types its value a handle name and the engine would order the
+ * translated row ids, so the pairing is refused here too (the registry is
+ * the one place a name's every use and its anchoring field meet).
  */
 function paramRegistryOf(recs: readonly RecData[], rules: readonly RuleData[]): readonly ParamEntry[] {
 	const order: string[] = []
-	const byName = new Map<string, { shape: ParamEntry["shape"]; anchor: ParamEntry["anchor"]; op: ParamEntry["op"] }>()
+	const byName = new Map<
+		string,
+		{
+			shape: ParamEntry["shape"]
+			anchor: ParamEntry["anchor"]
+			op: ParamEntry["op"]
+			members: ParamEntry["members"]
+			orderOp: "lt" | "le" | "gt" | "ge" | "pointIn" | undefined
+		}
+	>()
 	function fold(uses: readonly ParamUse[]): void {
 		for (const use of uses) {
 			const existing = byName.get(use.name)
 			if (existing === undefined) {
 				order.push(use.name)
-				byName.set(use.name, { shape: use.shape, anchor: use.anchor, op: use.op })
+				byName.set(use.name, {
+					shape: use.shape,
+					anchor: use.anchor,
+					op: use.op,
+					members: use.members,
+					orderOp: isOrderOp(use.op) ? use.op : undefined
+				})
 				continue
 			}
+			if ((existing.members === undefined) !== (use.members === undefined)) {
+				throw errors.new(
+					`query param ${use.name} collides with a membership array's registry entry — name the param differently`
+				)
+			}
 			if (existing.shape !== use.shape) {
 				throw errors.new(
 					`query param ${use.name} is used both as a ${existing.shape} param and a ${use.shape} param — one name, one shape`
 				)
 			}
+			if (existing.anchor !== undefined && use.anchor !== undefined) {
+				const registered = anchorRosterOf(existing.anchor)
+				const anchored = anchorRosterOf(use.anchor)
+				if (registered !== anchored) {
+					throw errors.new(
+						`query param ${use.name} is anchored at ${renderParamAnchor(registered)} and at ${renderParamAnchor(anchored)} — a closed-anchored param translates handle names through ONE roster (one name, one domain); name the params differently`
+					)
+				}
+			}
 			if (existing.anchor === undefined && use.anchor !== undefined) {
 				existing.anchor = use.anchor
 				existing.op = use.op
 			}
+			if (existing.orderOp === undefined && isOrderOp(use.op)) {
+				existing.orderOp = use.op
+			}
 		}
 	}
 	for (const rec of recs) {
@@ -1071,7 +1430,15 @@ function paramRegistryOf(recs: readonly RecData[], rules: readonly RuleData[]):
 			if (entry === undefined) {
 				throw errors.new(`query param ${name} lost its registry entry`)
 			}
-			return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op })
+			if (
+				entry.orderOp !== undefined &&
+				entry.anchor !== undefined &&
+				entry.anchor !== "measure" &&
+				"closed" in entry.anchor
+			) {
+				throw closedOrderError(`query param ${name}`, `its ${entry.orderOp} use's anchor`, entry.anchor.closed.name)
+			}
+			return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op, members: entry.members })
 		})
 	)
 }
@@ -1102,6 +1469,19 @@ function makeRawQuery(theory: AnySchema, recs: readonly RecData[], rules: readon
 				`every rule of a query derives the same head — rule 0 selects (${signature}), rule ${index} selects (${candidate})`
 			)
 		}
+		// The closed slice is part of the head too: one answer column decodes
+		// through one roster, so a union whose rules bind a column at
+		// different vocabularies (or one closed, one bare — the ids would
+		// mistranslate silently) is refused pointed. Vocabulary identity is
+		// value identity, the SDK's membership rule everywhere.
+		rule.select.forEach(function verifyClosedSlice(column, position) {
+			const lead = first.select[position]
+			if (lead !== undefined && column.closed !== lead.closed) {
+				throw errors.new(
+					`every rule of a query derives the same head — the answer column ${lead.name} is ${renderClosedSlice(lead.closed)} in rule 0 but ${renderClosedSlice(column.closed)} in rule ${index} (one column decodes through one roster)`
+				)
+			}
+		})
 	})
 	const data: QueryData = Object.freeze({
 		recs: Object.freeze([...recs]),
@@ -1113,7 +1493,7 @@ function makeRawQuery(theory: AnySchema, recs: readonly RecData[], rules: readon
 		schema: theory,
 		data,
 		rule(build) {
-			const built = build(makeRawScope({ kind: "query" }))
+			const built = build(makeRawScope({ kind: "query", classes: theory.classes }))
 			return makeRawQuery(theory, recs, [...rules, built.rule])
 		}
 	}
@@ -1126,21 +1506,21 @@ function makeRawQuery(theory: AnySchema, recs: readonly RecData[], rules: readon
  * the checkable fact — the value was assembled over the identical theory —
  * is verified before the raw value is admitted at its typed face.
  */
-function isQueryValue<Rels extends SchemaRelations, Row, P extends ParamsRecord>(
-	theory: Schema<Rels>,
+function isQueryValue<Rels extends SchemaRelations, Row, P extends ParamsRecord, Classes extends SchemaClasses>(
+	theory: Schema<Rels, Classes>,
 	value: RawQuery
-): value is RawQuery & Query<Rels, Row, P> {
+): value is RawQuery & Query<Rels, Row, P, Classes> {
 	return value.schema === theory
 }
 
 /** Assembles one typed query value (rules already completed). */
-function makeQuery<Rels extends SchemaRelations, Row, P extends ParamsRecord>(
-	theory: Schema<Rels>,
+function makeQuery<Rels extends SchemaRelations, Row, P extends ParamsRecord, Classes extends SchemaClasses>(
+	theory: Schema<Rels, Classes>,
 	recs: readonly RecData[],
 	rules: readonly RuleData[]
-): Query<Rels, Row, P> {
+): Query<Rels, Row, P, Classes> {
 	const raw = makeRawQuery(theory, recs, rules)
-	if (!isQueryValue<Rels, Row, P>(theory, raw)) {
+	if (!isQueryValue<Rels, Row, P, Classes>(theory, raw)) {
 		throw errors.new("query value construction incomplete")
 	}
 	return raw
@@ -1149,13 +1529,19 @@ function makeQuery<Rels extends SchemaRelations, Row, P extends ParamsRecord>(
 /**
  * Opens a query over a schema: `query(S).rule(r => ...)`. Each `.rule`
  * adds one conjunctive rule; multiple rules are the set union (answers are
- * SETS — no order or limit exists anywhere; hosts sort).
+ * SETS — no order or limit exists anywhere; hosts sort). The schema's
+ * law-computed class map rides into every rule builder — the join walls
+ * compare class names off it, at the type level and at construction alike.
  */
-function query<Rels extends SchemaRelations>(theory: Schema<Rels>): QueryStart<Rels> {
-	const start: QueryStart<Rels> = {
-		rule<RV extends AnyRuleValue>(build: (r: QueryRuleScope<Rels>) => RV): Query<Rels, RowOf<RV>, ParamsOf<RV>> {
-			const built = build(makeQueryRuleScope<Rels>())
-			return makeQuery<Rels, RowOf<RV>, ParamsOf<RV>>(theory, [], [built.rule])
+function query<Rels extends SchemaRelations, Classes extends SchemaClasses>(
+	theory: Schema<Rels, Classes>
+): QueryStart<Rels, Classes> {
+	const start: QueryStart<Rels, Classes> = {
+		rule<RV extends AnyRuleValue>(
+			build: (r: QueryRuleScope<Rels, Classes>) => RV
+		): Query<Rels, RowOf<RV>, ParamsOf<RV>, Classes> {
+			const built = build(makeQueryRuleScope<Rels, Classes>(theory.classes))
+			return makeQuery<Rels, RowOf<RV>, ParamsOf<RV>, Classes>(theory, [], [built.rule])
 		}
 	}
 	Object.freeze(start)
@@ -1180,25 +1566,30 @@ function isIntervalShaped(value: unknown): value is { readonly start: bigint; re
 }
 
 /**
- * Tags one closed-reference literal: the bare handle id, verified against
- * the roster (the belt the type level cannot provide — structural values
- * make any bigint spellable here) and tagged u64 — queries cross ids,
- * never handle names.
+ * Tags one closed-reference literal: the handle NAME, verified against the
+ * roster (the belt the wide fallback type cannot provide — structural
+ * values make any string spellable here) and translated to its
+ * declaration-order row id, tagged u64 — queries cross ids, never handle
+ * names; the wire is untouched. THE single roster-verification point of
+ * the query surface: atom-binding literals, comparison literals,
+ * execute-time params, and membership-array members all reach it (never
+ * duplicate the check per call site).
  */
 function taggedHandleId(
 	context: string,
 	closed: { readonly name: string; readonly handles: readonly string[] },
 	value: unknown
 ): TaggedValue {
-	if (typeof value !== "bigint") {
-		throw literalShapeError(context, `a ${closed.name} handle id (bigint)`, value)
+	if (typeof value !== "string") {
+		throw literalShapeError(context, `a ${closed.name} handle name (string)`, value)
 	}
-	if (closed.handles[Number(value)] === undefined) {
+	const id = closed.handles.indexOf(value)
+	if (id < 0) {
 		throw errors.new(
-			`${context}: closed relation ${closed.name} has no handle with id ${value} (roster holds ${closed.handles.length})`
+			`${context}: "${value}" is not a handle of ${closed.name} — the roster is ${closed.handles.join(", ")}`
 		)
 	}
-	return { kind: "u64", value }
+	return { kind: "u64", value: BigInt(id) }
 }
 
 /**
@@ -1348,7 +1739,13 @@ function paramIdOf(ctx: LowerContext, name: string): number {
 	return id
 }
 
-/** Lowers one EDB atom (either polarity). */
+/**
+ * Lowers one EDB atom (either polarity). A CLOSED owner lowers through the
+ * same edb source — its ordinal is its record-declaration slot exactly like
+ * an ordinary relation's — with field ordinals over the SEALED shape: `id`
+ * at 0, each payload column at its declared index + 1 (`matchFieldsOf`
+ * carries the shift; the lowering golden pins it).
+ */
 function lowerAtom(ctx: LowerContext, atom: AtomData, ids: VarIds): AtomIr {
 	const member = ctx.theory.relations[atom.relation.name]
 	if (member !== atom.relation) {
@@ -1360,8 +1757,9 @@ function lowerAtom(ctx: LowerContext, atom: AtomData, ids: VarIds): AtomIr {
 	if (relationId === undefined) {
 		throw errors.new(`query lowering: relation ${atom.relation.name} has no ordinal`)
 	}
+	const ordered = matchFieldsOf(atom.relation)
 	const bindings: Array<readonly [number, TermIr]> = atom.bindings.map(function lowerBinding(binding) {
-		const ordinal = atom.relation.data.fields.findIndex(function byName(candidate) {
+		const ordinal = ordered.findIndex(function byName(candidate) {
 			return candidate.name === binding.field
 		})
 		if (ordinal < 0) {
@@ -1372,7 +1770,12 @@ function lowerAtom(ctx: LowerContext, atom: AtomData, ids: VarIds): AtomIr {
 	return { source: { kind: "edb", relation: relationId }, bindings }
 }
 
-/** Lowers one binding term. */
+/**
+ * Lowers one binding term. A membership ARRAY (`literalSet`) lowers to the
+ * existing param-set term over its content-addressed registry entry — the
+ * program IR is byte-identical to the same set spelled `r.inSet`; the SDK
+ * supplies the translated member set itself at execute (`wireParams`).
+ */
 function lowerBindingTerm(ctx: LowerContext, context: string, binding: BindingEntry, ids: VarIds): TermIr {
 	const bound = binding.term
 	switch (bound.kind) {
@@ -1382,6 +1785,8 @@ function lowerBindingTerm(ctx: LowerContext, context: string, binding: BindingEn
 			return { kind: "param", param: paramIdOf(ctx, bound.name) }
 		case "setParam":
 			return { kind: "paramSet", param: paramIdOf(ctx, bound.name) }
+		case "literalSet":
+			return { kind: "paramSet", param: paramIdOf(ctx, bound.name) }
 		case "literal":
 			return { kind: "literal", value: taggedLiteral(context, binding.data, bound.value) }
 	}
@@ -1436,7 +1841,7 @@ function lowerCmpTerm(
 /** Resolves the anchor a comparison literal tags by: the sibling's field, the measure, or an anchored param. */
 function cmpAnchorOf(ctx: LowerContext, rule: RuleData, sibling: CmpTermData): AnyField | "measure" | undefined {
 	if (sibling.kind === "var") {
-		return rule.varFields[sibling.name]
+		return rule.varFields[sibling.name]?.field
 	}
 	if (sibling.kind === "measure") {
 		return "measure"