@bjornpagen/bumbledb 0.20.2 → 1.0.0

package/COOKBOOK.md

@@ -1,1729 +1,401 @@
-# The cookbook — modeling intuition as schemas, in TypeScript
+# The Bumbledb TypeScript cookbook
 
-The bumbledb engine's 32 cookbook recipes (`bumbledb/docs/cookbook.md`),
-translated to this SDK's structural API. **This document is illustrative,
-never normative**: the compiled tests are the authority — every block here
-is executed by the sync suites — and the SDK is the same theory in another
-skin.
+Worked recipes for the Effect-native surface: typed schema values,
+declared keys and laws, application-owned `Uuid` identity, one bounded
+native runtime, scoped resources, immutable final-state changes, `Option`
+reads, sealed complete results, and one-shot page streams.
 
-Every `ts` fence below compiles VERBATIM against the current SDK —
-`ts/test/cookbook-doc.test.ts` extracts each recipe's fences from this
-document mechanically at test time and type-checks them against
-`src/index.ts` (the TS twin of the Rust cookbook's doc-sync pin), so an
-edit here whose code stops compiling fails the build. The runtime half of
-the claim is `ts/test/cookbook.test.ts`'s, over compiled copies of the
-recipes: each schema is constructed through the public surface, admitted
-on a real store (the engine's schema validation is the acceptance
-judgment), its fingerprint asserted stable across a reopen AND equal to
-the per-recipe cross-host golden the Rust cookbook suite also pins
-(`fixtures/cookbook-fingerprints.txt` at the repository root — the two
-cookbooks teach one
-theory per recipe number, provably), and every query snippet lowered
-through `db.prepare` (the engine's own IR validation).
-
-Guarantee labels that name Lean results cite the checked spec in the engine
-repo's `lean/` by theorem name, exactly as the engine cookbook does
-(`scripts/spec-census.sh` verifies every citation resolves); the label always
-names any additional Rust premise.
-
-Everything below imports from the one package entry:
+Every `ts` fence below is extracted and type-checked against the real
+package surface by `test/cookbook-doc.test.ts`; the imports fence here is
+prepended to every recipe. The examples are lazy Effect programs — nothing
+below runs a database at import time, and measured policies are inputs.
 
 ```ts
+import { Effect, Option, Result, Stream } from "effect"
 import {
-	ALLEN,
-	Db,
-	type Infer,
-	abandon,
-	bool,
-	bytes,
 	capacity,
+	ChangeSet,
 	closed,
 	contained,
+	Db,
 	duration,
+	f64,
 	i64,
+	uuid,
+	Uuid,
 	interval,
 	key,
 	mirrors,
+	NativeRuntime,
 	on,
 	query,
 	ref,
 	relation,
+	Scalar,
 	schema,
+	span,
 	str,
 	u64,
 	v,
 	weigh,
 	within
 } from "@bjornpagen/bumbledb"
-```
-
-## The class laws — the statements type the columns
-
-Relation declarations are pure structure — `kind`, `width`, `element`,
-`fresh`, nothing else. Domains are never declared: `schema()` computes every
-field's equivalence class FROM the statement list, by union-find across every
-paired face (containment, `mirrors`, capacity targets, ψ-selected faces
-included). Three laws govern the classes:
-
-1. **A fresh field is a generator** and names its class by its declaration
-   coordinate (`"Attempt.id"`); a closed relation's id is a generator named
-   the same way (`"Kind.id"`).
-2. **A generator-less class** is named by its least member coordinate in
-   relation-declaration × field-declaration order (recipe 5's
-   `"Document.payload"`), deterministic and pinned forever.
-3. **A field in no law is bare, and bare pairs only with bare** in queries —
-   a deliberate sum-domain pointer stays legal because you simply write no
-   law over it.
-
-The wall: at most ONE generator per class — a statement list that unifies two
-fresh coordinates is a contradiction (two mints cannot share a carrier), a
-schema-level compile error with a construction-time runtime twin. The
-dividend is that the statements you already write ARE the typing: a query
-variable first bound in one class refuses to join a field of another (compile
-error, with the same refusal thrown at construction), and no label, link, or
-domain declaration exists anywhere on the surface. When a recipe below says a
-statement "types" a column, this machinery is what it means. Classes never
-touch the fingerprint — identity hashes canonical descriptor bytes, never the
-law-computed names.
-
-## Foundations
-
-## 1. The minimal interval schema
-
-Guarantee: Lean theorem + validator/runtime premise — the pointwise key
-enforces per-service disjointness (`lean/Bumbledb/Dependencies.lean:
-pointwise_key_disjoint`); checked intervals supply nonempty values
-(`lean/Bumbledb/Values.lean: interval_nonempty`).
-
-One fact per outage window; the pointwise key is the whole temporal design.
-
-```ts
-const Service = relation("Service", { id: u64.fresh, name: str })
-// The window is one value, not a (start, end) column pair: the denotation
-// (a set of points, half-open) is what the judgments below read through.
-// The containment below is what types `service` — the class laws.
-const Outage = relation("Outage", { service: u64, window: interval(i64) })
-
-const Uptime = schema("Uptime", { Service, Outage }, [
-	contained(on(Outage, "service"), on(Service, "id")),
-	// The pointwise key: per service, no two outages share a point — every
-	// pair satisfies DISJOINT. SQL:2011's WITHOUT OVERLAPS, as a theorem.
-	// `key(R, [...])` is the host flavor of the canonical arrow — this one
-	// renders `Outage(service, window) -> Outage`: the key projection
-	// determines the tuple, and the arrow closing over its own relation is
-	// what makes a key a key (the compile-pin asserts the render).
-	key(Outage, ["service", "window"])
-])
-
-// down at instant t — v(Outage) mints a fresh variable per column (typed by
-// that column's law-class); destructure what you bind, reuse to join:
-const downAt = query(Uptime).rule((r) => {
-	const { service, window } = v(Outage)
-	return r
-		.match(Outage, { service, window })
-		.where(r.pointIn(r.param("t"), window))
-		.find({ service })
-})
-// overlapping an incident window (one Allen mask, no operator zoo):
-const overlapping = query(Uptime).rule((r) => {
-	const { service, window } = v(Outage)
-	return r
-		.match(Outage, { service, window })
-		.where(r.allen(window, ALLEN.intersects, r.param("incident")))
-		.find({ service, window })
-})
-// total downtime per service is host arithmetic on the interval
-// endpoints every answer row already carries (`end − start`).
-```
-
-## 2. Discriminated unions
-
-Guarantee: Lean theorem + validator/runtime premises — key-backed equality
-gives unique source/target correspondence (`lean/Bumbledb/Dependencies.lean:
-keyed_eq_unique_correspondence`); both projections must resolve to declared keys.
-
-Sum-typed entities: a closed-relation discriminator plus per-arm child
-relations, glued by bidirectional conditional containments.
-
-```ts
-// The discriminator vocabulary is a closed relation: its ground axioms are
-// axioms, and a handle is its NAME — the string literal "Deterministic" is
-// the ONE spelling, on every surface (statements, inserts, queries, rows).
-const Kind = closed("Kind", ["Deterministic", "CustomOperator"])
-const Task = relation("Task", { id: u64.fresh, kind: Kind.id })
-const DeterministicGrading = relation("DeterministicGrading", { task: u64, tolerance: i64 })
-const CustomOperatorGrading = relation("CustomOperatorGrading", { task: u64, operator: str })
-
-const Grading = schema("Grading", { Kind, Task, DeterministicGrading, CustomOperatorGrading }, [
-	contained(on(Task, "kind"), on(Kind, "id")), // the discriminator resolves
-	key(DeterministicGrading, ["task"]), // one arm fact per parent
-	key(CustomOperatorGrading, ["task"]),
-	// Totality (==, left to right): a Deterministic task HAS its arm fact —
-	// same commit, always. Arm validity (right to left): an arm fact's parent
-	// exists WITH that kind — composite-FK-plus-CHECK, one statement. These
-	// mirrors are also what type `task` on both arms: each lands in the
-	// "Task.id" generator class.
-	mirrors(on(Task.where({ kind: "Deterministic" }), "id"), on(DeterministicGrading, "task")),
-	mirrors(on(Task.where({ kind: "CustomOperator" }), "id"), on(CustomOperatorGrading, "task"))
-	// Exclusivity is a theorem, not a statement: one id in two arms would
-	// force `kind` to equal two handles against the fresh key on id.
-	// The executor spends the same theorem again as a diagnostic witness
-	// (recipe 22); multi-rule execution still keeps a spanning seen-set.
-])
-
-// Host dispatch over the discriminator is native `switch` narrowing over
-// the handle union (`Infer<typeof Kind.id>` = "Deterministic" |
-// "CustomOperator") — rows already arrive carrying the handle name, and
-// `satisfies never` makes the switch exhaustive: a missing arm is a
-// compile error.
-const gradedBy = (kind: Infer<typeof Kind.id>) => {
-	switch (kind) {
-		case "Deterministic":
-			return "tolerance"
-		case "CustomOperator":
-			return "operator"
-		default:
-			return kind satisfies never
-	}
-}
-```
-
-## 3. 0..1 optional attributes
-
-Guarantee: Lean theorem + validator/runtime premises — the child key proves at
-most one fact (`lean/Bumbledb/Dependencies.lean: functionality_unique_witness`)
-and containment requires its parent (`lean/Bumbledb/Dependencies.lean:
-contains_iff_view_subset`); absence remains legal.
-
-No nulls, anywhere. Optional data is an absent fact in a child relation; the
-child's key plus a one-way containment *is* "nullable column", done honestly.
-
-```ts
-const Business = relation("Business", { id: u64.fresh, name: str })
-const MailingAddress = relation("MailingAddress", { business: u64, line: str, city: str })
-
-const Optionality = schema("Optionality", { Business, MailingAddress }, [
-	key(MailingAddress, ["business"]), // at most one address...
-	contained(on(MailingAddress, "business"), on(Business, "id")) // ...and only for a real business
-	// One-way containment on purpose: absence is the fact that isn't. The
-	// all-or-nothing column group (line+city together or neither) is
-	// unstatable TO VIOLATE — the fact carries both fields or does not exist.
-])
-
-// Negation is plain anti-join (no null branch exists in any operator):
-const unaddressed = query(Optionality).rule((r) => {
-	const { id: b } = v(Business)
-	return r
-		.match(Business, { id: b })
-		.where(r.not(MailingAddress, { business: b }))
-		.find({ b })
-})
-```
-
-## 4. Money
-
-Guarantee: host discipline + validator premises — fixed-point scale and
-currency grouping live in host domains; containments only resolve references.
-
-Fixed-point i64 minor units. Floats are permanently refused (the ledger);
-proration and FX are host arithmetic. `minor` sits in no law — bare, and bare
-pairs only with bare (the class laws), so a stray join against some other
-i64 column refuses unless a statement puts them in one class. Scale and
-currency intent are host discipline; the closed `currency` reference is what
-the schema CAN say, and says.
-
-```ts
-const Currency = closed("Currency", ["Usd", "Eur", "Gbp"])
-const Account = relation("Account", { id: u64.fresh, name: str })
-const Posting = relation("Posting", {
-	id: u64.fresh,
-	account: u64,
-	currency: Currency.id,
-	minor: i64
-})
-
-const Money = schema("Money", { Currency, Account, Posting }, [
-	contained(on(Posting, "account"), on(Account, "id")),
-	contained(on(Posting, "currency"), on(Currency, "id"))
-])
+import type {
+	ApplyOutcome,
+	CompleteResult,
+	ExecutionPolicy,
+	Fact,
+	NativeRuntimeOptions,
+	QueryReader
+} from "@bjornpagen/bumbledb"
 
-// Multi-currency totals: currency is a group key, never summed across —
-// Sum folds wide with one final range check, so totals cannot wrap
-// silently. Bind the fresh id: set semantics would collapse two equal
-// (account, currency, minor) postings without it.
-const totals = query(Money).rule((r) => {
-	const { id, account, currency, minor } = v(Posting)
-	return r.match(Posting, { id, account, currency, minor }).find({ account, currency, total: r.sum(minor) })
-})
+declare const work: ExecutionPolicy
+declare const runtimePolicy: NativeRuntimeOptions
+declare const localPath: string
 ```
 
-## 5. Content addressing
-
-Guarantee: validator/runtime premises + host discipline — the payload key and
-containments enforce identity/reference shape; hashing and blob durability stay external.
+## 1. One schema, typed twice — relations, declared keys, laws
 
-The decision rule for byte-shaped data: **intern what repeats (`str`); inline
-what identifies (`bytes(n)`)**.
+Identity fields are ordinary application-owned `Uuid` values: the database
+issues no identity and there is no `fresh` mint. Keys are declared
+statements; references and capacity are laws over the same fields. The same
+declarations, spelled in Rust's `schema!`, produce the same canonical schema
+identity.
 
 ```ts
-const Region = closed("Region", ["Us", "Eu"])
-const Document = relation("Document", {
-	id: u64.fresh,
-	name: str, // repeats: interned, id-equality
-	payload: bytes(32) // identifies: the blake3 of the external blob — inline, never interned
+const Student = relation("Student", { id: uuid, name: str, budget: u64 })
+const Attempt = relation("Attempt", {
+	id: uuid,
+	student: uuid,
+	score: f64,
+	units: u64,
+	active: interval(i64)
 })
-const Replica = relation("Replica", { payload: bytes(32), region: Region.id })
 
-const Content = schema("Content", { Region, Document, Replica }, [
-	key(Document, ["payload"]), // content-addressed: one doc per digest
-	// This containment is the digest columns' typing: neither is fresh, so
-	// the pair is a generator-less class named by its least member
-	// coordinate — "Document.payload" (the class laws' second rule).
-	contained(on(Replica, "payload"), on(Document, "payload")),
-	contained(on(Replica, "region"), on(Region, "id"))
-	// bytes(n) is identity-only (Eq/Ne, membership): a digest's lexicographic
-	// order is an encoding artifact, refused as semantics. Large objects:
-	// facts stay fixed-width; the payload lives in external storage,
-	// referenced by identity (the large-object refusal).
+const Learning = schema("Learning", { Student, Attempt }, [
+	key(Student, ["id"]),
+	key(Attempt, ["id"]),
+	contained(on(Attempt, "student"), on(Student, "id")),
+	capacity(on(Student, "id"), {
+		from: on(Attempt, "student"),
+		weight: weigh("units"),
+		within: within(0n, ref("budget"))
+	})
 ])
 
-// a bytes param self-encodes (Uint8Array by inference):
-const byDigest = query(Content).rule((r) => {
-	const { id } = v(Document)
-	return r.match(Document, { id, payload: r.param("digest") }).find({ id })
-})
+// Schema construction is pure metadata: the value is inert data, and typing
+// follows it — a Fact<typeof Attempt> is the inferred row object.
+declare const row: Fact<typeof Attempt>
+const scoreIsNumber: number = row.score
+const unitsAreExact: bigint = row.units
+void [Learning, scoreIsNumber, unitsAreExact]
 ```
 
-## Vocabularies
-
-## 6. The vocabulary
+## 2. One runtime layer; explicit create and open
 
-Guarantee: Lean theorem + validator/runtime premise — the sealed closed
-extension is constant at every instance (`lean/Bumbledb/Schema.lean:
-den_closed_constant`) and the compiled member-set containment admits only
-declared priority handles.
-
-The enum idiom's replacement, first-class: a vocabulary is a **closed
-relation** — its ground axioms are declared in the schema, sealed at
-validate, frozen by the fingerprint, virtual in storage. The store holds zero
-vocabulary bytes, and handle names are the string literals on every surface.
+`NativeRuntime.layer(options)` acquires the single bounded native runtime
+with scope; reuse ONE layer value so Effect's memoization shares it.
+`Db.open` never creates a missing database; `Db.create` refuses existing
+authority. Both are scoped acquisitions.
 
 ```ts
-// Tier 1: handles only. At the host surface a handle is its NAME — a string
-// literal of the roster's union ("Low" | "Normal" | "Urgent"); the engine's
-// vocabulary stays relational (ids = declaration order) and the marshal
-// owns the bijection. Dispatch is native `switch` narrowing (recipe 2).
-const Priority = closed("Priority", ["Low", "Normal", "Urgent"])
-
-const Ticket = relation("Ticket", { id: u64.fresh, priority: Priority.id, opened_at: i64 })
-
-const Tickets = schema("Tickets", { Priority, Ticket }, [
-	// A closed reference is an ordinary u64 under one containment (which also
-	// types `priority` into the "Priority.id" generator class); the judgment
-	// compiles at validate to a member-set test — one AND, one bit test, no
-	// probe (30-dependencies.md).
-	contained(on(Ticket, "priority"), on(Priority, "id"))
-])
-
-// Handles are literals in queries exactly as in statements, and the
-// renderer prints them back — the round trip runs on names. The boundary
-// law: intrinsic meaning goes here (changing it is a new theory); policy
-// that drifts without a rebuild is an ordinary relation — a vocabulary is
-// never written, only declared.
-const urgent = query(Tickets).rule((r) => {
-	const { id: t } = v(Ticket)
-	return r.match(Ticket, { id: t, priority: "Urgent" }).find({ t })
-})
-
-// Set membership is a plain array — the drizzle law's spelling, closed-only
-// in query match records (an ordinary u64/str field's membership is a bound
-// ∈-set param, `r.inSet`); the array folds to the same wire set the param
-// spelling crosses. In `.where()` selections arrays work at EVERY field kind.
-const actionable = query(Tickets).rule((r) => {
-	const { id: t } = v(Ticket)
-	return r.match(Ticket, { id: t, priority: ["Normal", "Urgent"] }).find({ t })
-})
-```
-
-## 7. The classification
+const Doc = relation("Doc", { id: uuid, text: str })
+const Docs = schema("Docs", { Doc }, [key(Doc, ["id"])])
 
-Guarantee: validator/runtime premise — closed payload facts and the
-ψ-selected containment restrict certificates to the compiled
-mastered-handle set.
-
-The fused form: the vocabulary carries its intrinsic facts as **payload
-columns** — one ground axiom per handle, values sealed with the schema, read
-by ψ-selections. Axioms are declared, never written.
-
-```ts
-// Tier 2: payload columns state what each word MEANS, next to the word.
-// A rubric change is a new theory — exactly right for meaning.
-const Kind = closed(
-	"Kind",
-	["DirectPass", "JudgedPass", "Failed"],
-	{ mastered: bool, rank: u64 },
-	{
-		DirectPass: { mastered: true, rank: 30n },
-		JudgedPass: { mastered: true, rank: 20n },
-		Failed: { mastered: false, rank: 10n }
-	}
+const openExisting = Effect.scoped(
+	Effect.gen(function* () {
+		const db = yield* Db.open(localPath, Docs, work)
+		return db.schemaId
+	})
 )
-const Attempt = relation("Attempt", { id: u64.fresh, kind: Kind.id })
-const Certificate = relation("Certificate", { attempt: u64, kind: Kind.id })
-
-const Review = schema("Review", { Kind, Attempt, Certificate }, [
-	contained(on(Attempt, "kind"), on(Kind, "id")),
-	key(Certificate, ["attempt"]),
-	contained(on(Certificate, "attempt"), on(Attempt, "id")),
-	// ψ reads the payload: certificates carry mastered kinds only — the
-	// member set {DirectPass, JudgedPass} compiles at validate and the
-	// judgment is O(1) at commit (recipe 8 is this statement's own recipe).
-	contained(on(Certificate, "kind"), on(Kind.where({ mastered: true }), "id"))
-])
 
-// The classification read duplicates no flag onto Attempt — ψ walks the
-// vocabulary's payload in the query too: a closed relation is matchable
-// exactly like an ordinary one, and the atom folds at prepare into a
-// plan-constant handle set on its sibling.
-const masteredAttempts = query(Review).rule((r) => {
-	const { id: a, kind: k } = v(Attempt)
-	return r
-		.match(Attempt, { id: a, kind: k })
-		.match(Kind, { id: k, mastered: true })
-		.find({ a })
-})
-
-// Host dispatch on the payload tier is the record-table idiom — a `Record`
-// over the handle union is total by type (a missing or extra entry is a
-// compile error), and each entry reads its sealed axiom row off the typed
-// `Kind.axioms` readback:
-const labels: Record<Infer<typeof Kind.id>, string> = {
-	DirectPass: `mastered, rank ${Kind.axioms.DirectPass.rank}`,
-	JudgedPass: `mastered, rank ${Kind.axioms.JudgedPass.rank}`,
-	Failed: "not mastered"
-}
-const label = (k: Infer<typeof Kind.id>) => labels[k]
-```
-
-Two honest boundaries. The fold has limits: payload escaping to the head and
-param-bearing filters don't fold at prepare — the engine falls back to a
-virtual-image join over the sealed extension, and the semantics are identical
-either way. And for an ALREADY-DEPLOYED store, moving from the old
-complement-window workaround to these ψ spellings is a NEW theory — a
-different fingerprint — which is recipe 28's ETL territory: humans own that
-migration.
-
-## 8. The sub-vocabulary
-
-Guarantee: validator/runtime premise — ψ over the sealed extension compiles
-the exact paging member set; a nonmember write is commit-rejected.
-
-The ψ-selected containment: a reference constrained to the facts of a
-vocabulary that satisfy a payload selection. Because the target is closed and
-sealed, the enforcement plan is not a probe strategy — it is **the answer set
-itself**, fixed when the schema is built.
-
-```ts
-const Severity = closed(
-	"Severity",
-	["Info", "Warning", "Critical", "Fatal"],
-	{ pages: bool },
-	{
-		Info: { pages: false },
-		Warning: { pages: false },
-		Critical: { pages: true },
-		Fatal: { pages: true }
-	}
+const createOnce = Effect.scoped(
+	Effect.gen(function* () {
+		const db = yield* Db.create(localPath, Docs, work)
+		return db.schemaId
+	})
 )
-const Incident = relation("Incident", { id: u64.fresh, severity: Severity.id })
-const Escalation = relation("Escalation", { incident: u64, severity: Severity.id, at: i64 })
-
-const Oncall = schema("Oncall", { Severity, Incident, Escalation }, [
-	contained(on(Incident, "severity"), on(Severity, "id")),
-	contained(on(Escalation, "incident"), on(Incident, "id")),
-	// The sub-vocabulary: an escalation carries a PAGING severity, by
-	// statement. ψ over the sealed extension compiles to the member set
-	// {Critical, Fatal}; the judgment is one bit test per touched fact,
-	// and an escalation at "Info" aborts the commit.
-	contained(on(Escalation, "severity"), on(Severity.where({ pages: true }), "id"))
-])
-
-// who is being paged — the same ψ, on the read side:
-const paged = query(Oncall).rule((r) => {
-	const { incident: i, severity: s } = v(Escalation)
-	return r
-		.match(Escalation, { incident: i, severity: s })
-		.match(Severity, { id: s, pages: true })
-		.find({ i })
-})
-```
-
-## Structure
-
-## 9. Ordered collections
-
-Guarantee: Lean theorem + validator/runtime premises — mutual point coverage
-plus pointwise keys realizes exact partition
-(`lean/Bumbledb/Dependencies.lean: exact_partition_iff`), and the mixed-width
-interval positions type by element domain
-(`lean/Bumbledb/Schema.lean: Value.points_one_tag_u64`); ordering the result
-remains a host presentation step — the SDK ships the comparator (`by`/`desc`,
-keys as data); the engine never orders.
-
-The linked-list verdict: successor pointers are control flow smuggled into
-data. Order is a value. The idiomatic ordered collection is an interval
-partition, spelled as a **triple**: the entity, the extent as a 0..1 child
-(empty lists exist, empty intervals do not — presence of the child IS
-nonemptiness), and the unit-slot sidecar (`interval(u64, 1n)` — the width is
-the type: a wrong-width value is unrepresentable).
-
-```ts
-const Playlist = relation("Playlist", { id: u64.fresh, name: str })
-// The extent: a 0..1 child, because empty playlists exist and empty
-// intervals do not — presence of the child IS nonemptiness.
-const Extent = relation("Extent", { playlist: u64, span: interval(u64) })
-// The unit slot: position p occupies [p, p+1) — the width is the type.
-const Slot = relation("Slot", { playlist: u64, slot: interval(u64, 1n), track: str })
-
-const Playlists = schema("Playlists", { Playlist, Extent, Slot }, [
-	contained(on(Extent, "playlist"), on(Playlist, "id")),
-	contained(on(Slot, "playlist"), on(Playlist, "id")),
-	key(Extent, ["playlist"]), // 0..1 extent per playlist
-	key(Extent, ["playlist", "span"]), // exact target key (recipe 26's note)
-	key(Slot, ["playlist", "slot"]), // one occupant per position
-	mirrors(on(Extent, ["playlist", "span"]), on(Slot, ["playlist", "slot"])) // slots tile the span exactly
-])
-
-// Positional access is membership — "what plays at position ?pos":
-const playingAt = query(Playlists).rule((r) => {
-	const { slot, track } = v(Slot)
-	return r
-		.match(Slot, { playlist: r.param("list"), slot, track })
-		.where(r.pointIn(r.param("pos"), slot))
-		.find({ track })
-})
-
-// Answers are SETS — the host sorts them. Limit is the language's own
-// `.slice(0, n)`.
-const inPlayOrder = [
-	{ slot: { start: 1n, end: 2n }, track: "b" },
-	{ slot: { start: 0n, end: 1n }, track: "a" }
-].sort(function bySlotThenTrack(left, right) {
-	if (left.slot.start < right.slot.start) {
-		return -1
-	}
-	if (left.slot.start > right.slot.start) {
-		return 1
-	}
-	if (left.slot.end < right.slot.end) {
-		return -1
-	}
-	if (left.slot.end > right.slot.end) {
-		return 1
-	}
-	if (left.track < right.track) {
-		return -1
-	}
-	if (left.track > right.track) {
-		return 1
-	}
-	return 0
-})
-```
-
-Middle insert is honest about its cost: making room at position `k` shifts
-every later slot and grows the extent — O(k) writes in **one delta**, judged
-once at commit. If middle inserts dominate, the demoted escape hatch is the
-spread slot: a scalar `pos: u64` written in gapped strides under the same
-composite key — bumbledb has no lexicographic fractional indexing, because
-string order is refused: there is no "between two strings" to allocate.
-
-## 10. Trees and ASTs
-
-Guarantee: Lean theorem + validator/runtime premises for key-backed arms
-(`lean/Bumbledb/Dependencies.lean: keyed_eq_unique_correspondence`); host
-discipline for acyclicity — statements prove arm/edge shape, never a tree theorem.
 
-Node header + per-kind arms (recipe 2's pattern); every edge resolves; the
-shape theorems come from keys on the edge relations.
-
-```ts
-const Kind = closed("Kind", ["Lit", "Add"])
-const Node = relation("Node", { id: u64.fresh, kind: Kind.id })
-const Lit = relation("Lit", { node: u64, value: i64 })
-const Add = relation("Add", { node: u64, lhs: u64, rhs: u64 })
-const Parent = relation("Parent", { child: u64, parent: u64 })
-
-const Ast = schema("Ast", { Kind, Node, Lit, Add, Parent }, [
-	contained(on(Node, "kind"), on(Kind, "id")),
-	key(Lit, ["node"]),
-	key(Add, ["node"]),
-	// Every node's arm is total, valid, and exclusive (recipe 2's theorems):
-	mirrors(on(Node.where({ kind: "Lit" }), "id"), on(Lit, "node")),
-	mirrors(on(Node.where({ kind: "Add" }), "id"), on(Add, "node")),
-	// Every child edge resolves — no dangling subtrees, judged at commit
-	// (these containments also put lhs/rhs in the "Node.id" class, which is
-	// exactly what lets the query below join lhs against Lit.node):
-	contained(on(Add, "lhs"), on(Node, "id")),
-	contained(on(Add, "rhs"), on(Node, "id")),
-	// Functional parent (one parent per child) ⇒ the reachable shape is
-	// paths-or-cycles; acyclicity itself is outside the ∀∃ vocabulary —
-	// host discipline, recorded. Transitive reach is recipe 24's closure.
-	key(Parent, ["child"]),
-	contained(on(Parent, "child"), on(Node, "id")),
-	contained(on(Parent, "parent"), on(Node, "id"))
-])
-
-const lhsLiteral = query(Ast).rule((r) => {
-	const { lhs: l } = v(Add)
-	const { value } = v(Lit)
-	return r
-		.match(Add, { node: r.param("n"), lhs: l })
-		.match(Lit, { node: l, value })
-		.find({ value })
-})
+// One boundary; an Effect app provides the layer in its own graph instead.
+const layer = NativeRuntime.layer(runtimePolicy)
+void [openExisting.pipe(Effect.provide(layer)), createOnce.pipe(Effect.provide(layer))]
+```
+
+## 3. Changes: build lazily, normalize once, apply atomically
+
+`ChangeSet.builder` acquires a scoped database-free draft. Ingestion effects
+are lazy and re-runnable while the draft is building — each execution reads
+the then-current iterable and charges work again. Within ONE change set the
+normalization is `(add, remove ∖ add)`: the identical fact's add wins
+independent of call order. `finish()` consumes the draft into an immutable,
+reusable `ChangeSet`.
+
+```ts
+const Task = relation("Task", { id: uuid, title: str, done: u64 })
+const Tasks = schema("Tasks", { Task }, [key(Task, ["id"])])
+
+const applyOnce = Effect.scoped(
+	Effect.gen(function* () {
+		const db = yield* Db.open(localPath, Tasks, work)
+		const taskId = yield* Effect.sync(() => crypto.randomUUID())
+		const draft = yield* ChangeSet.builder(Tasks, work)
+		yield* draft.insert(Task, [{ id: taskId, title: "write the cookbook", done: 0n }])
+		const changes = yield* draft.finish()
+		const outcome: ApplyOutcome = yield* db.apply(changes, { ...work, expected: { kind: "any" } })
+		switch (outcome.kind) {
+			case "accepted":
+			case "no-change":
+				return outcome.witness
+			case "invariant-rejected":
+				// Complete statement diagnostics, typed data — never a throw.
+				return yield* Effect.fail(outcome.violations)
+			case "moved":
+				return outcome.current
+		}
+	})
+)
+void applyOnce
 ```
 
-## 11. Typed graphs
-
-Guarantee: validator/runtime premises — endpoint containments type each edge
-and composite keys deduplicate pairs; no transitive graph property is claimed.
+## 4. Keyed reads are Options
 
-One relation per edge kind: endpoint containments pin which node kinds each
-edge may touch.
+`get` reads through the relation's primary declared key. A missing key is
+`Option.none` — never a fake I/O error, never a nullable row.
 
 ```ts
-const Person = relation("Person", { id: u64.fresh, name: str })
-const Repo = relation("Repo", { id: u64.fresh, name: str })
-const Follows = relation("Follows", { follower: u64, followee: u64 })
-const Maintains = relation("Maintains", { person: u64, repo: u64 })
+const Person = relation("Person", { id: uuid, name: str })
+const People = schema("People", { Person }, [key(Person, ["id"])])
 
-const Graph = schema("Graph", { Person, Repo, Follows, Maintains }, [
-	contained(on(Follows, "follower"), on(Person, "id")), // a Person→Person edge, by statement —
-	contained(on(Follows, "followee"), on(Person, "id")), // a Follows fact cannot touch a Repo
-	key(Follows, ["follower", "followee"]), // at most one edge per pair
-	contained(on(Maintains, "person"), on(Person, "id")),
-	contained(on(Maintains, "repo"), on(Repo, "id")),
-	key(Maintains, ["person", "repo"])
-])
-
-// Mutual follows — joins are explicit var reuse on both ends (both columns
-// live in the "Person.id" class, so the reuse is lawful); `lt` keeps each
-// pair once:
-const mutual = query(Graph).rule((r) => {
-	const { follower: a, followee: b } = v(Follows)
-	return r
-		.match(Follows, { follower: a, followee: b })
-		.match(Follows, { follower: b, followee: a })
-		.where(r.lt(a, b))
-		.find({ a, b })
-})
-```
-
-## 12. Entity-component
-
-Guarantee: definition + validator/runtime premises — component keys give 0..1
-and containments require the stated entity/archetype facts.
-
-The 0..1 idiom (recipe 3) at scale: components are sidecar relations; an
-entity has a component iff the fact exists; a new component kind is a new
-relation, not a wider fact.
-
-```ts
-const Entity = relation("Entity", { id: u64.fresh, name: str })
-const Transform = relation("Transform", { entity: u64, x: i64, y: i64 })
-const Velocity = relation("Velocity", { entity: u64, dx: i64, dy: i64 })
-const Renderable = relation("Renderable", { entity: u64, mesh: str })
-
-const Ecs = schema("Ecs", { Entity, Transform, Velocity, Renderable }, [
-	key(Transform, ["entity"]), // each component 0..1 per entity
-	contained(on(Transform, "entity"), on(Entity, "id")),
-	key(Velocity, ["entity"]),
-	contained(on(Velocity, "entity"), on(Entity, "id")),
-	key(Renderable, ["entity"]),
-	// An archetype rule is one containment: every Renderable has a Transform
-	// (and, through it, an Entity — containment composes, and the class
-	// composes with it: every `entity` column lands in "Entity.id").
-	contained(on(Renderable, "entity"), on(Transform, "entity"))
-])
-
-// The physics join is the component intersection:
-const physics = query(Ecs).rule((r) => {
-	const { entity, x, y } = v(Transform)
-	const { dx, dy } = v(Velocity)
-	return r
-		.match(Transform, { entity, x, y })
-		.match(Velocity, { entity, dx, dy })
-		.find({ entity, x, y, dx, dy })
-})
+const lookup = (reader: QueryReader<typeof People>, personId: Uuid) =>
+	Effect.gen(function* () {
+		const found = yield* reader.get(Person, { id: personId }, work)
+		return Option.isSome(found) ? found.value.name : "unknown"
+	})
+void lookup
 ```
 
-## 13. State machines
+## 5. Queries are reusable typed values
 
-Guarantee: Lean theorem + validator/runtime premises for the shipped arm
-(`lean/Bumbledb/Dependencies.lean: keyed_eq_unique_correspondence`); host
-discipline for allowed transitions — equality pins state evidence, not paths.
-
-States are a discriminated union; per-state data lives in arms; and the
-conditional reference target — a reference to "an order *that is shipped*" —
-is one selected statement, the statement SQL cannot write.
+`v(R)` mints typed variables; reusing one across `match` records is the
+join. The `find` record names the answer columns, and parameters infer from
+use. A template contains no tenant rows or live snapshot — execute it
+against any matching-schema reader.
 
 ```ts
-const State = closed("State", ["Cart", "Placed", "Shipped"])
-const Order = relation("Order", { id: u64.fresh, state: State.id })
-const Placement = relation("Placement", { order: u64, at: i64 })
-const Shipment = relation("Shipment", { order: u64, carrier: str, at: i64 })
-
-const Orders = schema("Orders", { State, Order, Placement, Shipment }, [
-	contained(on(Order, "state"), on(State, "id")),
-	key(Placement, ["order"]),
-	key(Shipment, ["order"]),
-	// History accretes: a Shipped order keeps its Placement — one-way
-	// containment admits arms from earlier states surviving the transition.
-	contained(on(Placement, "order"), on(Order, "id")),
-	// The conditional target, both ways: every Shipment references an order
-	// THAT IS Shipped (validity), and every Shipped order has its Shipment
-	// (totality) — the transition and its evidence commit together.
-	mirrors(on(Shipment, "order"), on(Order.where({ state: "Shipped" }), "id"))
-	// Transition predicates ("only Placed may ship") are host code under the
-	// generation witness — recipe 20; the schema pins the states, not the paths.
+const Author = relation("Author", { id: uuid, name: str })
+const Book = relation("Book", { id: uuid, author: uuid, pages: u64 })
+const Library = schema("Library", { Author, Book }, [
+	key(Author, ["id"]),
+	key(Book, ["id"]),
+	contained(on(Book, "author"), on(Author, "id"))
 ])
 
-const shipped = query(Orders).rule((r) => {
-	const { id } = v(Order)
-	const { carrier } = v(Shipment)
+const booksBy = query(Library).rule((r) => {
+	const { id, author, pages } = v(Book)
+	const { name } = v(Author)
 	return r
-		.match(Order, { id, state: "Shipped" })
-		.match(Shipment, { order: id, carrier })
-		.find({ id, carrier })
+		.match(Book, { id, author, pages })
+		.match(Author, { id: author, name })
+		.where(r.eq(name, r.param("name")))
+		.find({ id, pages })
 })
-```
-
-## Time and coverage
-
-## 14. The calendar core
 
-Guarantee: Lean theorem + validator/runtime premises — accepted equality is
-key-backed correspondence (`lean/Bumbledb/Dependencies.lean:
-keyed_eq_unique_correspondence`), while pointwise keys/coverage enforce only
-declared hard policy.
-
-Policy as schema: hard rules are pointwise keys, soft rules are the statements
-you decline to write. `Claim.source` carries the accepted attendance's id and
-declares nothing about it — the selected `mirrors` law below is what TYPES
-it: pairing `source` with `Attendance.id` puts it in the `"Attendance.id"`
-generator class. The class flows from the statement; no link declaration
-exists or is needed.
-
-```ts
-const Rsvp = closed("Rsvp", ["Accepted", "Tentative", "Declined"])
-const Arm = closed("Arm", ["Busy", "Ooo"])
-
-const Person = relation("Person", { id: u64.fresh, name: str })
-const Room = relation("Room", { id: u64.fresh, name: str })
-const Event = relation("Event", { id: u64.fresh, span: interval(i64) })
-const Attendance = relation("Attendance", {
-	id: u64.fresh,
-	event: u64,
-	person: u64,
-	rsvp: Rsvp.id
-})
-const Claim = relation("Claim", {
-	source: u64,
-	person: u64,
-	arm: Arm.id,
-	span: interval(i64)
-})
-const Booking = relation("Booking", { room: u64, event: u64, span: interval(i64) })
-const WorkHours = relation("WorkHours", { person: u64, hours: interval(i64) })
-
-const Calendar = schema("Calendar", { Rsvp, Arm, Person, Room, Event, Attendance, Claim, Booking, WorkHours }, [
-	contained(on(Attendance, "event"), on(Event, "id")),
-	contained(on(Attendance, "person"), on(Person, "id")),
-	contained(on(Attendance, "rsvp"), on(Rsvp, "id")),
-	key(Attendance, ["event", "person"]), // one RSVP per (event, person)
-	key(Claim, ["source"]),
-	contained(on(Claim, "person"), on(Person, "id")),
-	contained(on(Claim, "arm"), on(Arm, "id")),
-	// HARD: rooms cannot double-book — the pointwise key (recipe 1's theorem).
-	key(Booking, ["room", "span"]),
-	// SOFT: people CAN double-book — key(Claim, ["person", "span"]) is simply
-	// not declared. Policy is the presence or absence of one statement.
-	// Accepting an invitation IS claiming the time (totality + validity) —
-	// and this is the statement that types Claim.source:
-	mirrors(on(Attendance.where({ rsvp: "Accepted" }), "id"), on(Claim.where({ arm: "Busy" }), "source")),
-	// Busy time lies inside working hours, pointwise — coverage rides the
-	// target's own key (disjoint + ordered is a theorem, not a request):
-	key(WorkHours, ["person", "hours"]),
-	contained(on(Claim.where({ arm: "Busy" }), ["person", "span"]), on(WorkHours, ["person", "hours"])),
-	contained(on(Booking, "room"), on(Room, "id")),
-	contained(on(Booking, "event"), on(Event, "id"))
-])
-
-const roomConflicts = query(Calendar).rule((r) => {
-	const { room, span } = v(Booking)
-	return r
-		.match(Booking, { room, span })
-		.where(r.allen(span, ALLEN.intersects, r.param("want")))
-		.find({ room, span })
-})
-const personLoad = query(Calendar).rule((r) => {
-	const { person, span } = v(Claim)
-	return r
-		.match(Claim, { person, span })
-		.where(r.allen(span, ALLEN.intersects, r.param("window")))
-		.find({ person, span })
-})
+const readBooks = (reader: QueryReader<typeof Library>, name: string) =>
+	Effect.scoped(
+		Effect.gen(function* () {
+			const result = yield* reader.execute(booksBy, { name }, work)
+			return yield* result.collect({ maxBytes: work.resultBytes }, work)
+		})
+	)
+void readBooks
 ```
 
-## 15. Effective-dated configuration
-
-Guarantee: Lean theorem/countermodel + validator/runtime premise — pointwise
-keys plus one-way support inclusion form a disjoint cover
-(`lean/Bumbledb/Dependencies.lean: pointwise_key_disjoint`,
-`coverage_is_support_inclusion`); target overhang is legal
-(`lean/Bumbledb/Countermodels.lean: one_way_overhang`).
+## 6. Grouped exact aggregates
 
-Versioned rules: no overlaps (pointwise key), no gaps in the policy's source
-lifetime (one-way coverage; version overhang remains legal), and "in force on
-date t" is one membership probe.
+Aggregates fold the group's distinct full bindings: keep the identity-bearing
+`id` in the binding set so equal scores in different rows both contribute.
+Exact float `sum`/`mean` are deterministic with one final rounding.
 
 ```ts
-const Policy = relation("Policy", { id: u64.fresh, live: interval(i64) })
-const Version = relation("Version", { policy: u64, rate_bps: i64, valid: interval(i64) })
+const Sample = relation("Sample", { id: uuid, series: uuid, value: f64 })
+const Series = schema("Series", { Sample }, [key(Sample, ["id"])])
 
-const Pricing = schema("Pricing", { Policy, Version }, [
-	contained(on(Version, "policy"), on(Policy, "id")),
-	// No overlapping versions: at any instant, at most one rate is the law.
-	key(Version, ["policy", "valid"]),
-	// No gaps in the policy lifetime: every source point is covered by
-	// versions. Together with the key above this is a disjoint cover, not an
-	// exact partition: Version intervals may overhang (recipe 16).
-	contained(on(Policy, ["id", "live"]), on(Version, ["policy", "valid"]))
-])
-
-// in force on date t — one membership probe:
-const inForce = query(Pricing).rule((r) => {
-	const { rate_bps, valid } = v(Version)
-	return r
-		.match(Version, { policy: r.param("p"), rate_bps, valid })
-		.where(r.pointIn(r.param("t"), valid))
-		.find({ rate_bps })
-})
-// clean successions (half-open makes MEETS exact, no ±1 fudge):
-const successions = query(Pricing).rule((r) => {
-	const { policy: p, valid: a } = v(Version)
-	const { valid: b } = v(Version)
-	return r
-		.match(Version, { policy: p, valid: a })
-		.match(Version, { policy: p, valid: b })
-		.where(r.allen(a, ALLEN.meets, b))
-		.find({ a, b })
+const stats = query(Series).rule((r) => {
+	const { id, series, value } = v(Sample)
+	return r.match(Sample, { id, series, value }).find({
+		series,
+		total: r.sum(value),
+		mean: r.mean(value),
+		points: r.count()
+	})
 })
+void stats
 ```
 
-## 16. Disjoint covers
-
-Guarantee: Lean theorem/countermodel + validator/runtime premise —
-`lean/Bumbledb/Dependencies.lean: coverage_is_support_inclusion` proves source
-coverage, not exact partition (`lean/Bumbledb/Countermodels.lean:
-one_way_overhang`).
+## 7. Nonrecursive composition — a template is a relation expression
 
-Pay periods, shifts, estimated-tax quarters: a pointwise key plus one-way
-coverage is a **disjoint cover** — no overlaps among pay periods and no holes
-in the fiscal year's source span. Pay periods may extend beyond that span.
+A typed query template of the same schema splices as a derived stage:
+`v(imported)` mints variables for its head columns and `match(imported, …)`
+joins them. Naming materializes nothing.
 
 ```ts
-const FiscalYear = relation("FiscalYear", { id: u64.fresh, span: interval(i64) })
-const PayPeriod = relation("PayPeriod", { year: u64, seq: u64, span: interval(i64) })
-
-const Payroll = schema("Payroll", { FiscalYear, PayPeriod }, [
-	contained(on(PayPeriod, "year"), on(FiscalYear, "id")),
-	key(PayPeriod, ["year", "seq"]), // sequence numbers stay unique
-	key(PayPeriod, ["year", "span"]), // disjoint: no shared instant
-	// Covering: no holes in the fiscal year's span; overhang is legal.
-	contained(on(FiscalYear, ["id", "span"]), on(PayPeriod, ["year", "span"]))
+const Reading = relation("Reading", { id: uuid, sensor: uuid, value: f64 })
+const Sensor = relation("Sensor", { id: uuid, label: str })
+const Telemetry = schema("Telemetry", { Reading, Sensor }, [
+	key(Reading, ["id"]),
+	key(Sensor, ["id"]),
+	contained(on(Reading, "sensor"), on(Sensor, "id"))
 ])
 
-// the period holding date t:
-const holding = query(Payroll).rule((r) => {
-	const { seq, span } = v(PayPeriod)
-	return r
-		.match(PayPeriod, { year: r.param("y"), seq, span })
-		.where(r.pointIn(r.param("t"), span))
-		.find({ seq })
+const perSensor = query(Telemetry).rule((r) => {
+	const { id, sensor, value } = v(Reading)
+	return r.match(Reading, { id, sensor, value }).find({ sensor, mean: r.mean(value) })
 })
-```
-
-## 17. Federal income tax
-
-Guarantee: validator/runtime premises + host discipline — keys prove bracket
-disjointness and statements prove residency coverage; full bracket coverage and proration are host duties.
-
-Brackets are intervals over money; the top bracket is a ray; regimes key on
-(year, status); and proration happens at write time, never at query time.
-
-```ts
-const Status = closed("Status", ["Single", "MarriedJoint", "HeadOfHousehold"])
-const Regime = relation("Regime", { id: u64.fresh, year: i64, status: Status.id })
-const Bracket = relation("Bracket", { regime: u64, income: interval(i64), rate_bps: i64 })
-const Residency = relation("Residency", { person: u64, span: interval(i64) })
-// Split at write: an Earned fact never spans a year boundary — writers
-// split (prorate) at the boundary, so no reader ever clips. The
-// representation move that deletes clip-at-query (gravestone, recipe 23).
-const Earned = relation("Earned", { person: u64, regime: u64, span: interval(i64), minor: i64 })
 
-const Tax = schema("Tax", { Status, Regime, Bracket, Residency, Earned }, [
-	contained(on(Regime, "status"), on(Status, "id")),
-	key(Regime, ["year", "status"]), // one regime per (year, filing status)
-	contained(on(Bracket, "regime"), on(Regime, "id")),
-	// Brackets are disjoint per regime. Seed data conventionally covers
-	// [0, ∞) and the top bracket is a ray, but this key proves disjointness
-	// only. end == MAX denotes [s, ∞), an honest value of the representation,
-	// not a sentinel (the point-domain law).
-	key(Bracket, ["regime", "income"]),
-	contained(on(Earned, "regime"), on(Regime, "id")),
-	key(Residency, ["person", "span"]),
-	// Residency exclusion: income counts only where earned inside a residency
-	// period — pointwise coverage, the same judgment as recipe 15's. This
-	// pair statement is also what puts the two bare `person` columns in one
-	// (generator-less) class: "Residency.person", by least coordinate.
-	contained(on(Earned, ["person", "span"]), on(Residency, ["person", "span"]))
-])
-
-// the marginal bracket (membership probes the disjoint bracket set). Tax
-// owed is host arithmetic over the bracket walk — arithmetic beyond the
-// measure is refused (the ledger).
-const marginal = query(Tax).rule((r) => {
-	const { id: reg } = v(Regime)
-	const { income: b, rate_bps } = v(Bracket)
+const labeled = query(Telemetry).rule((r) => {
+	const { sensor, mean } = v(perSensor)
+	const { label } = v(Sensor)
 	return r
-		.match(Regime, { id: reg, year: r.param("y"), status: r.param("s") })
-		.match(Bracket, { regime: reg, income: b, rate_bps })
-		.where(r.pointIn(r.param("taxable"), b))
-		.find({ rate_bps })
-})
-```
-
-## 18. Free time and coalescing
-
-Guarantee: Lean theorem + runtime query semantics — `pack` coalesces answer
-intervals (`lean/Bumbledb/Query/Aggregates.lean: pack_canonical`,
-`pack_extensional`); it asserts no stored disjointness, completeness, or
-maintenance behavior.
-
-`pack` is Snodgrass's coalesce as an aggregate — maximal disjoint segments per
-group, one answer per (group, segment). Coalescing is never a write rule: the
-engine stores the claims it was given.
-
-```ts
-const Person = relation("Person", { id: u64.fresh, name: str })
-const Claim = relation("Claim", { person: u64, span: interval(i64) })
-
-const FreeTime = schema("FreeTime", { Person, Claim }, [
-	contained(on(Claim, "person"), on(Person, "id"))
-	// No pointwise key, on purpose: claims overlap freely and pack coalesces
-	// at read time. Wanting them stored-disjoint is recipe 1's key instead.
-])
-
-// busy time, coalesced (adjacent segments merge — the half-open law):
-const busy = query(FreeTime).rule((r) => {
-	const { person, span } = v(Claim)
-	return r.match(Claim, { person, span }).find({ person, packed: r.pack(span) })
+		.match(perSensor, { sensor, mean })
+		.match(Sensor, { id: sensor, label })
+		.find({ label, mean })
 })
-// raw claimed time is host arithmetic on the interval endpoints every
-// answer row already carries (`end − start`). Overlaps double-count,
-// often the wrong question.
-// Coalesced totals = the two-query composition (pack, then a host fold) —
-// aggregates never nest; free time (gaps) is the two-line host walk over
-// sorted packed answers (host sorts by person then span start/end) — both
-// refusals recorded in the ledger.
+void labeled
 ```
 
-## The write side
-
-## 19. The ledger
-
-Guarantee: Lean theorem + runtime invariant for bounded sums
-(`lean/Bumbledb/Query/Aggregates.lean: checkedSum_sound`); host discipline
-for double entry — statements resolve posting references, not arithmetic agreement.
+## 8. Bounded results: capped collect, one-shot page stream
 
-The census workload. Balance is a query, never a column.
+`collect({ maxBytes }, work)` is database-enforced total materialization and
+leaves the result available. `pages({ pageBytes }, work)` is a ONE-SHOT consuming
+stream over the completed result: the first run moves the backing into a
+private scoped cursor; a second run refuses. Every element is one owned page
+array — pages, not rows — delivered after complete evaluation.
 
 ```ts
-const Account = relation("Account", { id: u64.fresh, name: str })
-const JournalEntry = relation("JournalEntry", { id: u64.fresh, at: i64, memo: str })
-const Posting = relation("Posting", {
-	id: u64.fresh,
-	entry: u64,
-	account: u64,
-	minor: i64
-})
-
-const Ledger = schema("Ledger", { Account, JournalEntry, Posting }, [
-	contained(on(Posting, "entry"), on(JournalEntry, "id")),
-	contained(on(Posting, "account"), on(Account, "id"))
-	// A stored balance column equaling Sum(postings) is the arithmetic-
-	// agreement statement — refused (the ledger): statements prove presence
-	// and topology, never that a value equals a computation. Balance is host
-	// arithmetic over sum; a materialized rollup is recipe 21's shape.
-])
+const Event = relation("Event", { id: uuid, at: i64 })
+const Feed = schema("Feed", { Event }, [key(Event, ["id"])])
 
-// balances (bind the fresh id — set semantics collapses duplicates):
-const balances = query(Ledger).rule((r) => {
-	const { id, account, minor } = v(Posting)
-	return r.match(Posting, { id, account, minor }).find({ account, balance: r.sum(minor) })
+const everything = query(Feed).rule((r) => {
+	const { id, at } = v(Event)
+	return r.match(Event, { id, at }).find({ id, at })
 })
-// double-entry audit (host asserts every total is 0 — discipline, not schema):
-const doubleEntry = query(Ledger).rule((r) => {
-	const { id, entry, minor } = v(Posting)
-	return r.match(Posting, { id, entry, minor }).find({ entry, balance: r.sum(minor) })
-})
-```
-
-## 20. Conditional writes
-
-Guarantee: Lean theorem + generation-witness/runtime premise + host retry
-discipline — snapshot-derived writes detect movement
-(`lean/Bumbledb/Txn.lean: writeFrom_moved`, `witness_conflict_distinct`);
-final-state point reads need no earlier witness.
-
-The generation witness: read the model, propose a delta, commit iff the model
-you read is still the model. The SDK ships one-shot `writeFrom` (the witness
-escapes the read callback; the instance does not). Retry on
-`{ tag: "moved" }` is host policy — a short loop around `db.read` +
-`writeFrom` if the host wants it. `abandon(payload)`
-declines to commit without issuing anything — from `db.write` and
-`db.writeFrom` alike (the sentinel's contract is unconditional, and
-the outcome arm is in the result type exactly when the callback can
-abandon).
 
-```ts
-const State = closed("State", ["Queued", "Running", "Done"])
-const Job = relation("Job", { id: u64.fresh, state: State.id, payload: str })
-const Lease = relation("Lease", { job: u64, worker: u64, until: i64 })
-
-const Jobs = schema("Jobs", { State, Job, Lease }, [
-	contained(on(Job, "state"), on(State, "id")),
-	key(Lease, ["job"]),
-	// A lease exists iff its job is Running (recipe 13's conditional target):
-	// claiming a job and leasing it commit together or not at all.
-	mirrors(on(Lease, "job"), on(Job.where({ state: "Running" }), "id"))
-])
-
-// update-where's premise — "still Queued" is the witness:
-const stillQueued = query(Jobs).rule((r) => {
-	const { id, payload } = v(Job)
-	return r.match(Job, { id, state: "Queued", payload }).find({ id, payload })
-})
-
-const created = await Db.create("./jobs.db", Jobs)
-if (created.tag !== "accepted") {
-	throw new Error("create rejected")
-}
-const db = created.value
-const prepared = db.prepare(stillQueued)
-
-// The witnessed write: premise reads via `instance`, the delta via `tx`.
-// On a moved generation `writeFrom` returns `{ tag: "moved" }` — retry is
-// host policy. The other two idioms: insert-select is the same shape (query
-// source answers, insert the derived facts); key-shaped read-modify-write
-// uses `tx.get`/`tx.contains` — final-state point reads need no earlier
-// witness.
-const outcome = db.read(function attempt(instance, witness) {
-	return db.writeFrom(witness, function updateWhere(tx) {
-		const queued = instance.execute(prepared, {})
-		if (queued.length === 0) {
-			return abandon("nothing queued")
-		}
-		for (const row of queued) {
-			tx.delete(Job, [{ id: row.id, state: "Queued", payload: row.payload }])
-			tx.insert(Job, [{ id: row.id, state: "Running", payload: row.payload }])
-			tx.insert(Lease, [{ job: row.id, worker: 7n, until: 60n }])
-		}
-		return undefined
-	})
-})
+const drain = (result: CompleteResult<{ readonly id: Uuid; readonly at: bigint }>) =>
+	result.pages({ pageBytes: 65536n }, work).pipe(
+		Stream.runForEach((page) =>
+			Effect.sync(() => {
+				// One owned page array; caller mutation cannot reach native
+				// state or another delivered page.
+				return page.length
+			})
+		)
+	)
+void [everything, drain]
 ```
 
-## 21. Derived relations
-
-Guarantee: Lean theorem + validator/runtime premises for soundness
-(`lean/Bumbledb/Txn.lean: derived_soundness_vs_freshness`); host
-discipline for completeness — containment rejects unsupported facts but never refreshes omissions.
+## 9. Application identity: generate once, retain, never regenerate
 
-The materialized view as a relation under statements — unsoundness the schema
-can name is uncommittable; incompleteness remains representable until the host
-refreshes it.
+`Effect.sync(() => crypto.randomUUID())` is effectful cryptographic entropy — run it once for an
+original intent, persist the value with the request, and never regenerate
+inside a retry. `Uuid.parse` is the pure fixed-size parser returning
+`Result`.
 
 ```ts
-const Arm = closed("Arm", ["Busy", "Ooo"])
-const Claim = relation("Claim", { source: u64, person: u64, arm: Arm.id, span: interval(i64) })
-const BusySpan = relation("BusySpan", { person: u64, span: interval(i64) })
+const parsed = Uuid.parse("00112233-4455-6677-8899-aabbccddeeff")
+const okOrRefused: boolean = Result.isSuccess(parsed)
 
-const Rollup = schema("Rollup", { Arm, Claim, BusySpan }, [
-	contained(on(Claim, "arm"), on(Arm, "id")),
-	key(Claim, ["source"]),
-	key(Claim, ["person", "span"]),
-	key(BusySpan, ["person", "span"]), // packed ⇒ disjoint: statable
-	// Soundness, pointwise: every stored rollup point is covered by busy
-	// claims — an UNSOUND rollup (claiming busy time that isn't, or surviving
-	// its sources' deletion) cannot commit, judged on every touching commit.
-	contained(on(BusySpan, ["person", "span"]), on(Claim.where({ arm: "Busy" }), ["person", "span"]))
-])
-
-// Maintenance is the third witness idiom (recipe 20): re-run the deriving
-// query on a snapshot, diff, commit witnessed — the rollup cannot commit
-// against sources it didn't actually read. The deriving query (pack IS the
-// coalesce):
-const deriving = query(Rollup).rule((r) => {
-	const { person, span } = v(Claim)
-	return r.match(Claim, { person, span, arm: "Busy" }).find({ person, packed: r.pack(span) })
+const mintOnce = Effect.gen(function* () {
+	const id = yield* Effect.sync(() => crypto.randomUUID())
+	// Persist `id` with the original request BEFORE any database dispatch;
+	// a timeout retries the identical intent, never a new identity.
+	return id
 })
+void [okOrRefused, mintOnce]
 ```
 
-## 22. Union reads
-
-Guarantee: Lean theorem + represented planner/runtime premise — rule union is
-set-idempotent (`lean/Bumbledb/Query/Denotation.lean: union_idempotent`);
-key-backed DU arms satisfy the disjoint-arms licence
-(`lean/Bumbledb/Exec/Dedup.lean: disjoint_witness_licence`); execution
-always keeps one spanning seen-set.
+## 10. Witnessed correction: exact expected state
 
-The whole-DU read is a set of rules: one head, one rule per arm — disjunction
-is data at the top, never an execution node.
+Read under a short scope, keep the copied witness, and apply with
+`expected: { kind: "exact", at: witness }`. An intervening net change moves
+the apply instead of silently overwriting.
 
 ```ts
-const Kind = closed("Kind", ["Card", "Ach"])
-const Payment = relation("Payment", { id: u64.fresh, kind: Kind.id })
-const Card = relation("Card", { payment: u64, last4: u64 })
-const Ach = relation("Ach", { payment: u64, routing: u64 })
+const Account = relation("Account", { id: uuid, balance: i64 })
+const Bank = schema("Bank", { Account }, [key(Account, ["id"])])
 
-const Payments = schema("Payments", { Kind, Payment, Card, Ach }, [
-	contained(on(Payment, "kind"), on(Kind, "id")),
-	key(Card, ["payment"]),
-	key(Ach, ["payment"]),
-	mirrors(on(Payment.where({ kind: "Card" }), "id"), on(Card, "payment")),
-	mirrors(on(Payment.where({ kind: "Ach" }), "id"), on(Ach, "payment"))
-])
-
-// One query, two rules (set union). The exclusivity theorem (recipe 2) is
-// spent a third time here: rules selecting different `kind` handles are
-// provably disjoint. Execution still probes one spanning seen-set — the
-// measured refutation deleted the elision.
-const wholeDu = query(Payments)
-	.rule((r) => {
-		const { id } = v(Payment)
-		const { last4: n } = v(Card)
-		return r
-			.match(Payment, { id, kind: "Card" })
-			.match(Card, { payment: id, last4: n })
-			.find({ id, n })
-	})
-	.rule((r) => {
-		const { id } = v(Payment)
-		const { routing: n } = v(Ach)
-		return r
-			.match(Payment, { id, kind: "Ach" })
-			.match(Ach, { payment: id, routing: n })
-			.find({ id, n })
-	})
-```
-
-## 23. The anti-recipes: five gravestones
-
-Guarantee: intentionally refused — each gravestone names unsupported vocabulary
-and its representable replacement; none asserts an engine theorem.
-
-What not to model. Each gravestone cites its replacement; the block's
-relations are the replacements, compiled.
-
-```ts
-// GRAVESTONE: successor pointers (a `next` column). A linked list inside a
-// relation is control flow smuggled into data. REPLACEMENT: the ordering
-// triple (recipe 9).
-const Step = relation("Step", { flow: u64, pos: u64, action: str })
-// GRAVESTONE: floats for scores, rates, money. Permanently refused (the
-// ledger). REPLACEMENT: fixed-point i64 — basis points (recipe 4).
-const Score = relation("Score", { subject: u64, bps: i64 })
-// GRAVESTONE: conditional keys ("at most one active run per student") —
-// rejected as FDs. REPLACEMENT: the relation split, whose ordinary key IS
-// the invariant (recipe 13's arm shape).
-const ActiveRun = relation("ActiveRun", { student: u64, run: u64 })
-// GRAVESTONE: clip-at-query intervals (facts spanning period boundaries,
-// every reader clipping). REPLACEMENT: split at write (recipe 17).
-const Usage = relation("Usage", { meter: u64, period: u64, used: interval(i64) })
-// GRAVESTONE: uuid keys. uuidv7 is identity + clash-avoidance + clock in
-// one lie. REPLACEMENT: fresh (minted identity) + an explicit i64 time column.
-const Event = relation("Event", { id: u64.fresh, at: i64 })
-
-const Gravestones = schema("Gravestones", { Step, Score, ActiveRun, Usage, Event }, [
-	key(Step, ["flow", "pos"]),
-	key(Score, ["subject"]),
-	key(ActiveRun, ["student"]),
-	key(Usage, ["meter", "used"])
-])
-```
-
-## Host-driven closure
-
-## 24. The closure idiom
-
-Guarantee: host discipline for the loop — the finite `seen` set proves
-termination for the host run; the engine-native form beside it executes
-whole under the linear reach driver, budget-bounded
-(`lean/Bumbledb/Exec/Reach.lean: evalLinearReach_eq_lfp` /
-`evalQuery_sound`).
-
-Reachability, in two dialects. The host-loop idiom remains the depth-bounded
-answer: the loop runs depth-many rounds and each round is one ∈-set query —
-an `inSet` probe, microsecond-class. The frontier discipline below *is*
-semi-naive evaluation's Δ, spent where a loop is a loop: the host. The
-engine-native form is the same closure as one query with `.reach()`.
-
-```ts
-const Node = relation("Node", { id: u64.fresh, name: str })
-// One parent per child — a forest (recipe 10's edge shape); a root is a
-// node whose Parent fact is absent (recipe 3's honest 0..1).
-const Parent = relation("Parent", { child: u64, parent: u64 })
-
-const Closure = schema("Closure", { Node, Parent }, [
-	key(Parent, ["child"]),
-	contained(on(Parent, "child"), on(Node, "id")),
-	contained(on(Parent, "parent"), on(Node, "id"))
-])
-
-// The loop's one query — the frontier's children, one ∈-set probe:
-const step = query(Closure).rule((r) => {
-	const { child: c } = v(Parent)
-	return r.match(Parent, { child: c, parent: r.inSet("frontier") }).find({ c })
-})
-```
-
-The loop (the compiled, driven copy is in `test/cookbook.test.ts`, over a
-three-level forest with the exact reachable set asserted):
-
-```ts
-const created = await Db.create("./closure.db", Closure)
-if (created.tag !== "accepted") {
-	throw new Error("create rejected")
-}
-const db = created.value
-const stepPrepared = db.prepare(step)
-const root = 1n // the host's chosen root node id
-
-const seen = new Set<bigint>([root])
-let frontier: readonly bigint[] = [root]
-for (;;) {
-	const next = db.read((i) => i.execute(stepPrepared, { frontier })) // one set-param query
-	const fresh = next
-		.map((row) => row.c)
-		.filter((c) => {
-			return !seen.has(c)
+const correct = (accountId: Uuid) =>
+	Effect.scoped(
+		Effect.gen(function* () {
+			const db = yield* Db.open(localPath, Bank, work)
+			const observed = yield* Effect.scoped(
+				Effect.gen(function* () {
+					const snapshot = yield* db.snapshot(work)
+					const previous = yield* snapshot.get(Account, { id: accountId }, work)
+					if (Option.isNone(previous)) {
+						return yield* Effect.fail({ missing: accountId })
+					}
+					return { previous: previous.value, at: snapshot.witness }
+				})
+			)
+			const draft = yield* ChangeSet.builder(Bank, work)
+			yield* draft.delete(Account, [observed.previous])
+			yield* draft.insert(Account, [{ ...observed.previous, balance: observed.previous.balance + 1n }])
+			const changes = yield* draft.finish()
+			return yield* db.apply(changes, { ...work, expected: { kind: "exact", at: observed.at } })
 		})
-	if (fresh.length === 0) {
-		break
-	}
-	for (const c of fresh) {
-		seen.add(c)
-	}
-	frontier = fresh
-}
-```
-
-Termination is the host's theorem: `seen` grows strictly or the loop breaks,
-inside a finite node set. When the idiom's costs bite — **unbounded or large
-depth**, or **closure composed into a larger plan** — write the engine-native
-form instead: `?root` seeds the rec, and the main rule is the finished
-set's own identity projection (an interior atom is a positive occurrence, so it
-grounds its variables — no re-grounding join over a domain relation exists):
-
-```ts
-const reach = query(Closure)
-	.reach("reach", {
-		base: [
-			(r) => {
-				const { id: c } = v(Node)
-				return r
-					.match(Node, { id: c })
-					.where(r.eq(c, r.param("root")))
-					.find({ c })
-			}
-		],
-		rec: [
-			(r) => {
-				const { child: c, parent } = v(Parent)
-				return r.match(Parent, { child: c, parent }).interior("reach", { c: parent }).find({ c })
-			}
-		]
-	})
-	.rule((r) => {
-		const { id: c } = v(Node)
-		return r.interior("reach", { c }).find({ c })
-	})
-const reachPrepared = db.prepare(reach)
-```
-
-The complement is one `r.not` away — negation **of** a finished rec is
-engine-legal (negation in rec is refused), so
-"every node the closure never reached" runs in-plan through the engine's
-anti-probe, never as a host-side set difference — the same query with the
-main rule:
-
-```ts
-const unreached = query(Closure)
-	.reach("reach", {
-		base: [
-			(r) => {
-				const { id: c } = v(Node)
-				return r
-					.match(Node, { id: c })
-					.where(r.eq(c, r.param("root")))
-					.find({ c })
-			}
-		],
-		rec: [
-			(r) => {
-				const { child: c, parent } = v(Parent)
-				return r.match(Parent, { child: c, parent }).interior("reach", { c: parent }).find({ c })
-			}
-		]
-	})
-	.rule((r) => {
-		const { id: c } = v(Node)
-		return r.match(Node, { id: c }).where(r.not("reach", { c })).find({ c })
-	})
-```
-
-(the test drives both dialects and asserts the same reachable sets, root for
-root). What stays host-side is the **chain-window class** — interval
-intersection along paths — which the recursion surface fences out: the idiom
-carries the window in the host's frontier, one intersection per hop, and that
-composition has no engine form.
-
-## 25. The chart of accounts
-
-Guarantee: host discipline + runtime aggregate semantics — the host computes
-closure, then one checked `sum` (`lean/Bumbledb/Query/Aggregates.lean:
-checkedSum_sound`); the engine-native form folds over a finished rec,
-the one aggregation shape the rec roster admits.
-
-The ledger workload's real recursion case, in the same two dialects: a
-hierarchical chart of accounts and a subtree rollup. The host composition —
-recipe 24's loop accumulates the subtree's ∈-set, then **one `sum` query over
-the accumulated set** folds the postings. The engine aggregates, the host
-composes (aggregates never nest). The engine-native form is one query:
-aggregation *through* a cycle is refused, but a fold over a finished rec
-from main reads a finished set and is ordinary.
-
-```ts
-const Account = relation("Account", { id: u64.fresh, name: str })
-const AccountParent = relation("AccountParent", { child: u64, parent: u64 })
-const Posting = relation("Posting", { id: u64.fresh, account: u64, minor: i64 })
-
-const Accounts = schema("Accounts", { Account, AccountParent, Posting }, [
-	key(AccountParent, ["child"]), // one parent per account
-	contained(on(AccountParent, "child"), on(Account, "id")),
-	contained(on(AccountParent, "parent"), on(Account, "id")),
-	contained(on(Posting, "account"), on(Account, "id"))
-])
-
-// The two queries the host rollup composes:
-//   the frontier step (recipe 24's loop, verbatim):
-const frontierStep = query(Accounts).rule((r) => {
-	const { child: c } = v(AccountParent)
-	return r.match(AccountParent, { child: c, parent: r.inSet("frontier") }).find({ c })
-})
-//   the rollup over the accumulated subtree (bind the fresh id — recipe
-//   19's discipline, spent again; equal postings to one account both count):
-const subtreeRollup = query(Accounts).rule((r) => {
-	const { id, minor } = v(Posting)
-	return r.match(Posting, { id, account: r.inSet("subtree"), minor }).find({ total: r.sum(minor) })
-})
-// The engine-native form: the rec converges first, then the
-// main fold runs once over the finished subtree.
-const nativeRollup = query(Accounts)
-	.reach("sub", {
-		base: [
-			(r) => {
-				const { id: a } = v(Account)
-				return r
-					.match(Account, { id: a })
-					.where(r.eq(a, r.param("root")))
-					.find({ a })
-			}
-		],
-		rec: [
-			(r) => {
-				const { child: a, parent } = v(AccountParent)
-				return r.match(AccountParent, { child: a, parent }).interior("sub", { a: parent }).find({ a })
-			}
-		]
-	})
-	.rule((r) => {
-		const { id, account: a, minor } = v(Posting)
-		return r
-			.match(Posting, { id, account: a, minor })
-			.interior("sub", { a })
-			.find({ total: r.sum(minor) })
-	})
-```
-
-## 26. Exact partition
-
-Guarantee: Lean theorem + validator/runtime premises — mutual point coverage
-plus pointwise keys realizes exact partition
-(`lean/Bumbledb/Dependencies.lean: exact_partition_iff`).
-
-An exact partition needs both coverage directions. The first containment below
-is the intent-level reference; the two pointwise keys make each side disjoint;
-the final pair proves equal point supports per policy — forward coverage
-forbids gaps and reverse coverage forbids overhang.
-
-The explicit `key(Policy, ["id", "live"])` is load-bearing. Containment
-targets resolve by their exact projected field set, so the fresh `{id}` key
-cannot serve the `{id, live}` target and the engine infers no key closure.
-
-```ts
-const Policy = relation("Policy", { id: u64.fresh, live: interval(i64) })
-const Version = relation("Version", { policy: u64, valid: interval(i64) })
-
-const ExactPartition = schema("ExactPartition", { Policy, Version }, [
-	contained(on(Version, "policy"), on(Policy, "id")), // reference intent
-	key(Version, ["policy", "valid"]), // disjoint versions
-	key(Policy, ["id", "live"]), // exact target key, not implied by {id}
-	contained(on(Policy, ["id", "live"]), on(Version, ["policy", "valid"])), // no gaps in the policy source span
-	contained(on(Version, ["policy", "valid"]), on(Policy, ["id", "live"])) // no version overhang
-])
-```
-
-Together the mutual containments prove equal point supports for each policy;
-the pointwise keys make those supports genuine partitions rather than
-overlapping covers. Touching half-open segments remain legal, and the same
-construction works with any scalar-prefix arity before the final interval
-position.
-
-## 27. Derived facts, maintained
-
-Guarantee: host discipline + validator/runtime premises — freshness comes from
-the generation witness; containment proves surviving rollup facts sound only
-(`lean/Bumbledb/Txn.lean: derived_soundness_vs_freshness`).
-
-A stored rollup is an ordinary relation with an ordinary soundness statement.
-Here `pack` derives maximal busy spans, while containment prevents any stored
-`BusySpan` point that has no busy claim behind it. That is soundness, not a
-refresh theorem: a missing span remains representable until the host
-maintenance loop fills it.
-
-```ts
-const Arm = closed("Arm", ["Busy", "Ooo"])
-const Claim = relation("Claim", { source: u64, person: u64, arm: Arm.id, span: interval(i64) })
-const BusySpan = relation("BusySpan", { person: u64, span: interval(i64) })
-
-const MaintainedRollup = schema("MaintainedRollup", { Arm, Claim, BusySpan }, [
-	contained(on(Claim, "arm"), on(Arm, "id")),
-	key(Claim, ["source"]),
-	key(Claim, ["person", "span"]),
-	key(BusySpan, ["person", "span"]),
-	contained(on(BusySpan, ["person", "span"]), on(Claim.where({ arm: "Busy" }), ["person", "span"]))
-])
-
-// Derive the desired rollup on the maintenance snapshot:
-const deriving = query(MaintainedRollup).rule((r) => {
-	const { source, person, span } = v(Claim)
-	return r.match(Claim, { source, person, arm: "Busy", span }).find({ person, packed: r.pack(span) })
-})
-```
-
-The host loop is `db.read` + `writeFrom`: derive on the attempt's snapshot, diff,
-build the delta — recipe 20's third idiom. On a moved generation the host
-throws away the attempt and retries on a fresh snapshot; it
-never retries a stale diff. Dependencies prove every surviving stored span
-sound, while the witness proves which source state the derivation saw;
-neither mechanism proves completeness. The engine's compiled copy
-(`maintain_busy_spans` in `cookbook.rs`) drives the retry-and-repack loop.
-
-## Operating the store
-
-## 28. Migration is ETL
-
-Guarantee: Lean theorem + validator/runtime premises + host discipline —
-fingerprints refuse reinterpretation, final-state judgments validate each load
-(`lean/Bumbledb/Txn.lean: etl_lands_valid`), and the host owns
-the semantic transform and dependency-safe load order.
-
-There is no in-place migration and never will be: a schema is a theory, the
-store records the theory's fingerprint, and `Db.open` under a changed theory
-is a hard fingerprint mismatch — the engine refuses to reinterpret facts it
-judged under different laws. Migration is extract, transform, load: `scan`
-exports every fact of a relation as typed values under one snapshot, the host
-transforms, and inserts (fresh ids resupplied — identity survives) land into
-a store created under the new theory, judged whole by the ordinary
-final-state judgment: load containment targets first, and a chunk that lands
-is already valid.
-
-The v2 theory below adds what v1 never recorded — *when* a salary applied —
-as an interval with a pointwise key: one salary per employee per instant. The
-transform supplies the missing dimension (a ray from the migration epoch).
-
-```ts
-// The old theory, judged and fingerprinted:
-const EmployeeV1 = relation("Employee", { id: u64.fresh, name: str })
-const SalaryV1 = relation("Salary", { employee: u64, amount: i64 })
-const PayrollV1 = schema("PayrollV1", { Employee: EmployeeV1, Salary: SalaryV1 }, [
-	contained(on(SalaryV1, "employee"), on(EmployeeV1, "id"))
-])
-
-// The new theory adds what v1 never recorded:
-const Employee = relation("Employee", { id: u64.fresh, name: str })
-const Salary = relation("Salary", { employee: u64, amount: i64, applies: interval(i64) })
-const Payroll = schema("Payroll", { Employee, Salary }, [
-	contained(on(Salary, "employee"), on(Employee, "id")),
-	key(Salary, ["employee", "applies"]) // one salary per instant
-])
-
-// The post-migration read — salaries in force at an instant:
-const inForceAt = query(Payroll).rule((r) => {
-	const { id: e, name } = v(Employee)
-	const { amount, applies: w } = v(Salary)
-	return r
-		.match(Employee, { id: e, name })
-		.match(Salary, { employee: e, amount, applies: w })
-		.where(r.pointIn(r.param("at"), w))
-		.find({ name, amount })
-})
-```
-
-The engine's compiled test drives the whole loop (export under one snapshot,
-the fingerprint refusal, load order, identity, mint catch-up, judgment); the
-SDK pin asserts the two theories carry two distinct fingerprints — the
-refusal's premise. For stores whose creating schema is gone, `Db.exhume`
-reads the store's own persisted descriptor — the one schema-independent read
-path, the E half of ETL. Its lifetime is a `using` scope (`using exhumed =
-await Db.exhume(oldPath)`): disposal releases the store's exclusive lock at
-scope exit, so the rebirth loop's same-path retry never waits on GC.
-
-## Composition
-
-## 29. The zone ledger
-
-Guarantee: Lean theorem + validator/runtime premises — per-kind mutual point
-coverage realizes each arm's exact partition
-(`lean/Bumbledb/Dependencies.lean: exact_partition_iff`) over one
-disjointness witness, and the mixed-width `==` positions type by element
-domain (`lean/Bumbledb/Schema.lean: Value.points_one_tag_u64`); witness
-segmentation is host discipline (the honesty note below).
-
-Recipe 9's sidecar, composed: a ledger whose timeline divides into zones of
-two kinds — unit zones (`interval(u64, 1n)`) and pair zones
-(`interval(u64, 2n)`), each kind carrying its own payload sidecar. The
-discriminated-union pattern (recipe 2) applied at interval positions: a
-kind-discriminated `Zone` witness relation owns **cross-sidecar disjointness**
-through its one pointwise key, and since each sidecar's point support equals
-its kind's zone support (the per-kind `mirrors`), a unit slot can never
-overlap a pair slot even though they live in different relations. The arm
-widths are enforced **by type**: a `UnitSlot` value is width 1 or does not
-exist — no runtime width check, nothing to enforce at commit.
-
-```ts
-const Kind = closed("Kind", ["Unit", "Pair"])
-const Ledger = relation("Ledger", { id: u64.fresh, name: str })
-// The witness: every zone of the ledger, kind-discriminated; its one
-// pointwise key is the cross-sidecar disjointness proof.
-const Zone = relation("Zone", { ledger: u64, kind: Kind.id, at: interval(u64) })
-const UnitSlot = relation("UnitSlot", { ledger: u64, at: interval(u64, 1n), entry: u64 })
-const PairSlot = relation("PairSlot", { ledger: u64, at: interval(u64, 2n), entry: u64 })
-
-const ZoneLedger = schema("ZoneLedger", { Kind, Ledger, Zone, UnitSlot, PairSlot }, [
-	contained(on(Zone, "ledger"), on(Ledger, "id")),
-	contained(on(Zone, "kind"), on(Kind, "id")),
-	key(Zone, ["ledger", "at"]), // all zones disjoint, whatever the kind
-	key(UnitSlot, ["ledger", "at"]),
-	key(PairSlot, ["ledger", "at"]),
-	// Each kind's zones carry exactly its sidecar's points — mixed widths,
-	// one element domain:
-	mirrors(on(Zone.where({ kind: "Unit" }), ["ledger", "at"]), on(UnitSlot, ["ledger", "at"])),
-	mirrors(on(Zone.where({ kind: "Pair" }), ["ledger", "at"]), on(PairSlot, ["ledger", "at"]))
-])
+	)
+void correct
 ```
 
-The honesty note — **coalescing insensitivity**: the `mirrors` judgments
-compare point supports, not rows. A single Unit-kind zone `[4,6)` beside two
-unit slots `[4,5)`, `[5,6)` satisfies both directions, because nothing forces
-the witness rows to mirror the sidecar's segmentation — only its points. If
-per-row correspondence matters, the host writes zones at slot granularity;
-the schema proves disjointness and coverage either way.
-
-## Point reads
+## 11. Exact floats and dense intervals
 
-## 30. The keyed read
-
-Guarantee: validator/runtime premises — a declared key FD admits at most one
-fact per determinant tuple (the key phase of the commit judgment), and every
-keyed point read answers exactly that fact or nothing, on every scope
-(`ts/test/keyed-get.test.ts`; the engine half is
-`crates/bumbledb/tests/keyed_get.rs`).
-
-The key is a **law**, and the read surface is that law made callable. The
-schema says `key(Course, ["grp"])` — one course per group — so "the
-course of a group" is a well-posed question with at most one answer, and
-the store already enforces that on every commit. Hold the statement VALUE:
-it is the read's selector below (statement identity is the membership rule).
-
-```ts
-const Grp = relation("Grp", { id: u64.fresh, label: str })
-const Course = relation("Course", { id: u64.fresh, grp: u64, title: str })
-// The law: one course per group — the callable key.
-const courseGrpKey = key(Course, ["grp"])
-
-const KeyedRead = schema("KeyedRead", { Grp, Course }, [
-	contained(on(Course, "grp"), on(Grp, "id")),
-	courseGrpKey
-])
-```
-
-The point read is the statement handed back to `get` — one spelling on
-every scope (the symmetry rule): `db.get` standalone, `snap.get` inside a
-read scope, `tx.get` inside a write transaction, where the transaction side
-answers the FINAL state (base plus pending delta: read-your-writes, a
-pending delete answers `undefined`). The key object is typed by the
-statement's own projection — a wrong field name is a compile error, never a
-runtime shape check. The primary 2-arg form needs no statement: the fresh
-field IS the primary key.
+`f64` is a real schema scalar: NaN canonicalizes to the one quiet NaN,
+`-0` to `+0`, and the relational order is total. `interval(f64)` is the
+parameterized dense interval — half-open, NaN-free, strictly ordered.
+`span` builds checked interval values as `Result`s.
 
 ```ts
-const created = await Db.create("./courses.db", KeyedRead)
-if (created.tag !== "accepted") {
-	throw new Error("create rejected")
-}
-const db = created.value
-
-const minted: { grp?: bigint } = {}
-db.write((tx) => {
-	const g = tx.reserve(Grp, "id", 1n).at(0n)!
-	tx.insert(Grp, [{ id: g, label: "algebra" }])
-	const course = tx.reserve(Course, "id", 1n).at(0n)!
-	tx.insert(Course, [{ id: course, grp: g, title: "linear equations" }])
-	minted.grp = g
-})
-const grp = minted.grp ?? 0n
+const Window = relation("Window", { id: uuid, confidence: interval(f64), during: interval(i64) })
+const Windows = schema("Windows", { Window }, [key(Window, ["id"])])
 
-// db.get — the standalone keyed read through the declared law:
-const byGroup = db.read((i) => i.get(Course, courseGrpKey, { grp }))
-
-// snap.get — the same spelling inside a read scope:
-const viaSnap = db.read((instance) => instance.get(Course, courseGrpKey, { grp }))
-
-// tx.get — key-shaped read-modify-write, final-state (recipe 20's third
-// idiom): per-fact premises need no earlier snapshot witness.
-db.write((tx) => {
-	const current = tx.get(Course, courseGrpKey, { grp })
-	if (current !== undefined) {
-		tx.delete(Course, [current])
-		tx.insert(Course, [{ id: current.id, grp: current.grp, title: "linear equations II" }])
-	}
-})
-
-// The primary 2-arg form — the fresh field is the primary key:
-const byId = byGroup === undefined ? undefined : db.read((i) => i.get(Course, { id: byGroup.id }))
+const discrete = span(0n, 60n)
+const dense = span(0.25, 1.5)
+const bothChecked: boolean = Result.isSuccess(discrete) && Result.isSuccess(dense)
+void [Windows, bothChecked]
 ```
 
-The anti-pattern this recipe retires: a scan-and-find where a key law
-exists — `snap.scan(Course).find((row) => row.grp === grp)` — re-derives
-in the host what the store already enforces. The uniqueness the fold
-quietly assumes IS the declared key statement; spell the law and the point
-read comes with it.
-
-## Capacity laws
-
-## 31. The power budget
+## 12. Scoped ownership and honest close
 
-Guarantee: Lean theorem + validator/runtime premises — the capacity law
-bounds each pool's summed draw by the pool's own row
-(`lean/Bumbledb/Capacity.lean: CapacityLaw`; per touched parent, one keyed
-probe plus one measure walk, `lean/Bumbledb/Oracle.lean:
-capacity_plan_decides`); the pinned-column containment proves a device's
-watts equals its model's at every commit.
-
-Per-group capacity is one statement — the `capacity` builder mirrors the
-operator positionally (target, weight, window, source): `weigh` names the
-measure on the SOURCE row, and `ref` reads each group's ceiling from the
-TARGET row (hi slot only — ruled 2026-07-24, C6; bound names resolve
-against the target's full roster, ruled 2026-07-24, C1).
+Every native resource is scoped; early `close()` is itself an Effect
+returning the honest `CloseReport`. A scope finalizer that cannot complete
+teardown surfaces a structured `CloseFailure` DEFECT in the Cause — never a
+silently swallowed failure, never falsely reclaimed resources.
 
 ```ts
-const Pool = relation("Pool", { id: u64.fresh, supply: u64 })
-const Model = relation("Model", { id: u64.fresh, watts: u64 })
-const Device = relation("Device", {
-	id: u64.fresh,
-	pool: u64,
-	model: u64,
-	watts: u64
-})
+const Item = relation("Item", { id: uuid, label: str })
+const Items = schema("Items", { Item }, [key(Item, ["id"])])
 
-const Racks = schema("Racks", { Pool, Model, Device }, [
-	contained(on(Device, "pool"), on(Pool, "id")),
-	// The pinned column: a device's watts provably equals its model's — the
-	// two-column containment IS the join, stated as a law. The superkey it
-	// targets is deliberate write-amplification rent.
-	key(Model, ["id", "watts"]),
-	contained(on(Device, ["model", "watts"]), on(Model, ["id", "watts"])),
-	// Σ watts over a pool's devices stays within the pool's own supply:
-	capacity(on(Pool, "id"), weigh("watts"), within(0n, ref("supply")), on(Device, "pool"))
-])
-
-// utilization is a query, never a column (the ledger's law, recipe 19):
-const draw = query(Racks).rule((r) => {
-	const { id, pool, watts } = v(Device)
-	return r.match(Device, { id, pool, watts }).find({ pool, total: r.sum(watts) })
-})
+const explicitClose = Effect.scoped(
+	Effect.gen(function* () {
+		const db = yield* Db.open(localPath, Items, work)
+		const report = yield* db.close()
+		// `closed` releases this capability's obligations; `incomplete` and
+		// `failed` retain native Closing accounting — they are never
+		// counted as reclaimed.
+		return report.kind
+	})
+)
+void explicitClose
 ```
 
-A path weight (`weigh("model.watts")`) is a typed refusal whose diagnostic
-names exactly this pair — the weight vocabulary is closed at the row (ruled
-2026-07-24, ruling 6): a weight read through a reference would be a
-maintained copy of another relation's field, and a catalog edit would
-silently re-weigh deployed fleets. Pinned, the inconsistent commit refuses
-at the device site and the migration is explicit.
-
-## 32. Calendar capacity
+## 13. Unresolved field arithmetic is authoring metadata
 
-Guarantee: Lean theorem + validator/runtime premises — the Duration weight
-sums each booking's interval measure against the room's own span measure
-(`lean/Bumbledb/Capacity.lean: CapacityLaw`; Duration weights pair with
-Duration-capable bounds, ruled 2026-07-24, C18; a ray-valued weight or
-bound refuses typed at the law site, ruled 2026-07-24, C10).
-
-"Total booked time per room stays within the room's span" — one statement.
-The interval enters through the measure argument, never the group key.
+`Scalar.field("units")` is not a typed program. Builders accept it inside
+arithmetic. Native compilation binds it against the verified source
+schema — including empty input — before any manifest write or freeze.
 
 ```ts
-const Room = relation("Room", { id: u64.fresh, span: interval(i64) })
-const Booking = relation("Booking", {
-	id: u64.fresh,
-	room: u64,
-	booked: interval(i64)
-})
-
-const Rooms = schema("Rooms", { Room, Booking }, [
-	contained(on(Booking, "room"), on(Room, "id")),
-	// The pointwise key forbids double-booking (recipe 1); the capacity law
-	// bounds the TOTAL. Different laws — a schema usually wants both.
-	key(Booking, ["room", "booked"]),
-	capacity(
-		on(Room, "id"),
-		weigh(duration("booked")),
-		within(0n, duration("span")),
-		on(Booking, "room")
-	)
-])
-
-// the booked time per room is host arithmetic on the `booked`
-// endpoints every answer row already carries (`end − start`).
+const incrementUnits = Scalar.add(Scalar.field("units"), Scalar.u64(1n))
+const asFloat = Scalar.toF64(Scalar.add(Scalar.field("units"), Scalar.u64(1n)))
+void [incrementUnits, asFloat]
 ```
-
-Mind the weighted `{0}` and the weighted floor: on a weighted statement
-`within(0n)` says "the group's total is zero" (zero-measure rows may exist
-— the weaker law than the unit exclusion), and `within(1n, "*")` under a
-weight ("positive total") is not "at least one booking" — that intent is
-the bare `contained`. Choose by what you mean.