@bjornpagen/bumbledb 0.3.0 → 0.4.0

package/src/face.ts

@@ -11,11 +11,12 @@
  * positional: tuple order is preserved in the type, and the statement
  * constructors pair the two sides' tuples by arity ({@link SameArity}) AND
  * by structural shape ({@link SameShapes}) — every projected field's
- * kind/width/element triple is read off the schema type (the minimal
- * kernel: descriptors are pure structure) and compared positionwise. There
- * is no domain to compare at construction — domains are LAW-BORN: the
- * statements themselves define the equivalence classes, and `schema()` is
- * where they aggregate and get judged (the one-generator-per-class wall).
+ * kind/width/element/roster quadruple is read off the schema type (the
+ * minimal kernel: descriptors are pure structure, and a closed reference's
+ * roster IS part of that structure) and compared positionwise. There is no
+ * domain to compare at construction — domains are LAW-BORN: the statements
+ * themselves define the equivalence classes, and `schema()` is where they
+ * aggregate and get judged (the one-generator-per-class wall).
  */
 
 import * as errors from "@superbuilders/errors"
@@ -54,27 +55,6 @@ function faceParts(source: FaceSource): {
 	return { owner: source, selection: emptySelection }
 }
 
-/**
- * A disjunctive literal set for a selection binding — `field == {A, B}`.
- * The signature of {@link oneOf} demands two leading literals, so the
- * one-element set (banned: it is the bare literal) and the empty set
- * (banned: it selects nothing) are unwritable.
- */
-interface OneOf<V> {
-	readonly literals: readonly [V, V, ...V[]]
-}
-
-/**
- * Constructs a literal set (read disjunctively) for a `where()` binding.
- * Two leading arguments by signature: the degenerate sets have no spelling
- * (the canonical-utterance law, `docs/architecture/70-api.md`).
- */
-function oneOf<V>(first: V, second: V, ...rest: V[]): OneOf<V> {
-	const literals: readonly [V, V, ...V[]] = [first, second, ...rest]
-	Object.freeze(literals)
-	return Object.freeze({ literals })
-}
-
 /** The relation a face projects from — ordinary or closed. */
 type FaceOwner = AnyRelation | AnyClosed
 
@@ -131,20 +111,28 @@ type FaceFields<S extends FaceSource> = S extends AnySelected
 				: never
 
 /**
- * One descriptor's structural comparand: the kind/width/element triple —
- * exactly the structure the minimal kernel carries, compared exactly as the
- * engine's Q1 law pairs positions (`schema/validate.rs`): a `bytes` width is
- * bound (bytes<16> vs bytes<32> mismatch), while an INTERVAL width is FREE —
- * the pointwise judgments quantify over points, which carry an element
- * domain and not a width, so `interval(u64)` pairs with `interval(u64, 1n)`
- * (recipe 9's extent/slot mirrors, recipe 29's mixed-width zones) and the
- * width slot reads `undefined` for every interval. Elements stay bound:
- * u64-vs-i64 interval pairs still mismatch.
+ * One descriptor's structural comparand: the kind/width/element/roster
+ * quadruple — exactly the structure the minimal kernel carries. The first
+ * three slots compare exactly as the engine's Q1 law pairs positions
+ * (`schema/validate.rs`): a `bytes` width is bound (bytes<16> vs bytes<32>
+ * mismatch), while an INTERVAL width is FREE — the pointwise judgments
+ * quantify over points, which carry an element domain and not a width, so
+ * `interval(u64)` pairs with `interval(u64, 1n)` (recipe 9's extent/slot
+ * mirrors, recipe 29's mixed-width zones) and the width slot reads
+ * `undefined` for every interval. Elements stay bound: u64-vs-i64 interval
+ * pairs still mismatch. The ROSTER slot is SDK-only structure (the engine's
+ * wire carries plain u64s): a closed reference contributes its handle
+ * union, every other kind `undefined`, so a plain u64 face cannot pair with
+ * a closed `[id]` face — the vocabulary's own descriptor (`Kind.id`) is the
+ * ONE spelling of a closed reference at this surface, and a bare column
+ * cannot alias a vocabulary through a declared law. The runtime twin is the
+ * statement constructors' roster-identity walk (`statements.ts`).
  */
 type ShapeOf<F extends AnyField> = readonly [
 	F["kind"],
 	F extends { readonly element: unknown } ? undefined : F extends { readonly width: infer W } ? W : undefined,
-	F extends { readonly element: infer E } ? E : undefined
+	F extends { readonly element: infer E } ? E : undefined,
+	F extends { readonly closed: { readonly handles: readonly (infer H extends string)[] } } ? H : undefined
 ]
 
 /** One field's structural shape within a declared field block (`undefined` when the name is foreign). */
@@ -216,10 +204,11 @@ type SameArity<A extends AnyFace, B extends AnyFace> =
  * bijection, or window project structurally incompatible fields at any
  * position, this type is intersected into the second face's parameter and
  * names both shape tuples — a u64 face against a str face, a bytes width
- * mismatch, or an interval element mismatch is a COMPILE error.
+ * mismatch, an interval element mismatch, or a bare column against a
+ * closed reference (the roster slot) is a COMPILE error.
  */
 interface FaceShapeMismatch<Left, Right> {
-	readonly "face shape mismatch — positionwise kind, width, and element must be equal on both sides": readonly [
+	readonly "face shape mismatch — positionwise kind, width, element, and closed roster must be equal on both sides": readonly [
 		Left,
 		Right
 	]
@@ -229,11 +218,12 @@ interface FaceShapeMismatch<Left, Right> {
  * Resolves to `unknown` (a no-op intersection) when the two faces project
  * positionwise-equal structural shapes, and to {@link FaceShapeMismatch}
  * otherwise. Equality is mutual tuple assignability over the
- * kind/width/element triples. This is the whole construction-time wall —
- * deliberately: there is no domain to compare here. The domain wall lives
- * where domains are BORN: `schema()` computes every field's class from the
- * statement list and holds the one-generator-per-class law, and query
- * joins compare class names off the schema type.
+ * kind/width/element/roster quadruples. This is the whole
+ * construction-time wall — deliberately: there is no domain to compare
+ * here (the roster is descriptor STRUCTURE, not a domain). The domain wall
+ * lives where domains are BORN: `schema()` computes every field's class
+ * from the statement list and holds the one-generator-per-class law, and
+ * query joins compare class names off the schema type.
  */
 type SameShapes<A extends AnyFace, B extends AnyFace> =
 	FaceShapes<A> extends FaceShapes<B>
@@ -323,9 +313,8 @@ export type {
 	FaceShapeMismatch,
 	FaceShapes,
 	FaceSource,
-	OneOf,
 	OwnerOf,
 	SameArity,
 	SameShapes
 }
-export { on, oneOf, renderFace }
+export { on, renderFace }

package/src/fields.ts

@@ -50,11 +50,15 @@ function span(start: bigint, end: bigint): IntervalValue {
  * A closed relation's roster as seen from a referencing field: the handle
  * namespace `where()` selections and ground axioms resolve bare handle ids
  * through (the macro's own rule: a handle is legal exactly on a field that
- * references a closed relation).
+ * references a closed relation). The handle union is PRECISE — `H` carries
+ * the literal handle names in declaration order (the unbound `string`
+ * default exists only as the fallback where no roster is in scope); the
+ * runtime twin is the same frozen declaration-order array that was always
+ * there.
  */
-interface ClosedRoster {
+interface ClosedRoster<H extends string = string> {
 	readonly name: string
-	readonly handles: readonly string[]
+	readonly handles: readonly H[]
 }
 
 /** The `bool` field descriptor: value type `boolean`. No `.fresh` (macro parity). */
@@ -125,14 +129,16 @@ interface IntervalField<
 
 /**
  * A closed relation's reference field descriptor (`Kind.id`) — a u64
- * descriptor carrying the closed linkage: the roster resolves bare handle
- * ids in selections and ground axioms, and `schema()` names the id's
- * generator class `"Kind.id"`. Terminal: no `.fresh` — a vocabulary's rows
- * are ground axioms, never minted.
+ * descriptor carrying the closed linkage: the roster resolves handle
+ * literals in selections and ground axioms, and `schema()` names the id's
+ * generator class `"Kind.id"`. The handle union `H` is the field's VALUE
+ * TYPE (see {@link Infer}); `kind: "u64"` stays load-bearing for the class
+ * map and JoinOk, which compare kind/class/width/element. Terminal: no
+ * `.fresh` — a vocabulary's rows are ground axioms, never minted.
  */
-interface ClosedIdField {
+interface ClosedIdField<H extends string = string> {
 	readonly kind: "u64"
-	readonly closed: ClosedRoster
+	readonly closed: ClosedRoster<H>
 }
 
 /** Any field descriptor, whatever its kind or marks. */
@@ -142,21 +148,28 @@ type AnyField = BoolField | StrField | U64Field | FreshU64Field | I64Field | Byt
  * The bare structural VALUE type of a field descriptor — the one total
  * definition every fact, result row, and query term reads: `bool` →
  * `boolean`, `str` → `string`, `u64`/`i64` → `bigint`, `bytes<N>` →
- * `Uint8Array`, intervals → {@link IntervalValue}.
+ * `Uint8Array`, intervals → {@link IntervalValue}, and a closed reference →
+ * its PRECISE handle union (`"DirectPass" | "Failed"` — the string-literal
+ * union IS the value type at the TS surface; the engine keeps u64 row ids
+ * and the marshal owns the bijection). The closed arm precedes the `u64`
+ * arm because a closed reference is structurally a u64 descriptor plus the
+ * roster.
  */
 type Infer<F extends AnyField> = F extends { readonly kind: "bool" }
 	? boolean
 	: F extends { readonly kind: "str" }
 		? string
-		: F extends { readonly kind: "u64" }
-			? bigint
-			: F extends { readonly kind: "i64" }
+		: F extends { readonly closed: { readonly handles: readonly (infer H extends string)[] } }
+			? H
+			: F extends { readonly kind: "u64" }
 				? bigint
-				: F extends { readonly kind: "bytes" }
-					? Uint8Array
-					: F extends { readonly kind: "interval" }
-						? IntervalValue
-						: never
+				: F extends { readonly kind: "i64" }
+					? bigint
+					: F extends { readonly kind: "bytes" }
+						? Uint8Array
+						: F extends { readonly kind: "interval" }
+							? IntervalValue
+							: never
 
 /**
  * The typed shape refusal of the selection-literal machine — reached only
@@ -179,22 +192,22 @@ function isIntervalLiteral(value: unknown): value is IntervalValue {
 }
 
 /**
- * Resolves one closed-handle literal: the handle id (a bare bigint) back to
- * its handle NAME through the roster — an out-of-roster id is a
- * construction error, the belt the type level deliberately does not provide
- * (structural values make any bigint spellable here; the roster judges).
+ * Resolves one closed-handle literal: the handle NAME, verified against the
+ * roster — an unknown name is a construction error, the belt the wide
+ * fallback type deliberately does not provide (structural values make any
+ * string spellable here; the roster judges). The name IS the value at the
+ * TS surface (the drizzle law); the wire literal already crossed as
+ * `{ kind: "handle", handle }`, so the output — and every fingerprint
+ * derived from it — is untouched.
  */
 function handleLiteral(closed: ClosedRoster, value: unknown): LiteralSpec {
-	if (typeof value !== "bigint") {
-		throw literalShapeError(`a ${closed.name} handle id (bigint)`, value)
+	if (typeof value !== "string") {
+		throw literalShapeError(`a ${closed.name} handle name (string)`, value)
 	}
-	const handle = closed.handles[Number(value)]
-	if (handle === undefined) {
-		throw errors.new(
-			`closed relation ${closed.name} has no handle with id ${value} (roster holds ${closed.handles.length})`
-		)
+	if (!closed.handles.includes(value)) {
+		throw errors.new(`"${value}" is not a handle of ${closed.name} — the roster is ${closed.handles.join(", ")}`)
 	}
-	return { kind: "handle", handle }
+	return { kind: "handle", handle: value }
 }
 
 /** Lowers one interval literal at its element type. */
@@ -288,10 +301,9 @@ function interval(element: U64Field | I64Field, width?: bigint): IntervalField<"
  * Lowers one host literal at its field position to the wire
  * {@link LiteralSpec} — the selection-literal machine ground axioms and
  * `where()` bindings both ride (one machine, same errors — the macro's own
- * rule). A value on a closed-reference field resolves to its handle NAME
- * (the id is verified against the roster: an out-of-roster id is a
- * construction error); everything else lowers to a plain value tagged by
- * the field's structural kind.
+ * rule). A value on a closed-reference field IS its handle NAME (verified
+ * against the roster: an unknown name is a construction error); everything
+ * else lowers to a plain value tagged by the field's structural kind.
  */
 function literalOf(field: AnyField, value: unknown): LiteralSpec {
 	if ("closed" in field) {

package/src/index.ts

@@ -75,12 +75,11 @@ export type {
 	FaceShapeMismatch,
 	FaceShapes,
 	FaceSource,
-	OneOf,
 	OwnerOf,
 	SameArity,
 	SameShapes
 } from "#face.ts"
-export { on, oneOf } from "#face.ts"
+export { on } from "#face.ts"
 export type {
 	AnyField,
 	BoolField,

package/src/marshal.ts

@@ -13,10 +13,22 @@
  * the engine admitted IS a legal fact of its relation (the same trust
  * direction as Rust's typed readback). Shape mismatches here are genuine
  * failures and THROW typed; they are never domain data.
+ *
+ * THE CLOSED BIJECTION (0.4.0): a closed-referencing cell crosses this
+ * boundary as its handle NAME — the write side lowers name → u64 row id
+ * (declaration order = row ids, the sealed roster's own law, ≤ 256 rows),
+ * the read side lifts id → name, and both directions are total and static
+ * over the roster. An unknown name is a pointed THROW at the write seam —
+ * a deliberate UPGRADE over 0.3.0, where any bigint sailed through the
+ * marshal to a commit-time containment violation; the wrong spelling now
+ * dies here, before the engine ever sees the row. An out-of-roster id on
+ * the read side (reachable only in a store whose closed-typed column was
+ * never pinned by its containment law) is equally pointed — never a
+ * silent fallback, never `undefined`.
  */
 
 import * as errors from "@superbuilders/errors"
-import type { AnyField } from "#fields.ts"
+import type { AnyField, ClosedRoster } from "#fields.ts"
 import type { FactValue } from "#native.ts"
 import type { AnyRelation, Fact, FreshKeys, RelationData } from "#relation.ts"
 
@@ -80,14 +92,64 @@ function recordOf(fact: object): Record<string, unknown> {
 	return Object.fromEntries(Object.entries(fact))
 }
 
+/**
+ * The write half of the closed bijection: one handle NAME to its u64 row
+ * id (declaration order = row ids — the engine's own minting of the
+ * sealed extension). An unknown name is a pointed refusal naming the
+ * vocabulary and its roster — the 0.4.0 upgrade over any-bigint-compiles:
+ * the wrong spelling dies at the marshal, never as a commit-time
+ * violation. `indexOf` is the whole machine (the roster is ≤ 256 rows,
+ * engine law — no map is warranted).
+ */
+function closedCellOf(context: string, closed: ClosedRoster, name: string): FactValue {
+	const id = closed.handles.indexOf(name)
+	if (id === -1) {
+		throw errors.new(
+			`${context}: "${name}" is not a handle of ${closed.name} — the roster is ${closed.handles.join(", ")}`
+		)
+	}
+	return BigInt(id)
+}
+
+/**
+ * The read half of the closed bijection: one u64 row id back to its handle
+ * NAME (`Number(cell)` is safe — the sealed extension holds at most 256
+ * rows, engine law). An id outside the roster THROWS pointed, never a
+ * silent fallback and never `undefined`: the state is reachable only in a
+ * store whose closed-typed column was never pinned by its containment law,
+ * and the error names that missing piece.
+ */
+function handleOf(context: string, closed: ClosedRoster, cell: FactValue): string {
+	if (typeof cell !== "bigint") {
+		throw cellShapeError(context, `a ${closed.name} handle id (bigint)`, cell)
+	}
+	const handle = closed.handles[Number(cell)]
+	if (handle === undefined) {
+		throw errors.new(
+			`${context}: id ${cell} is outside the ${closed.name} roster (${closed.handles.join(", ")}) — the column types ${closed.name} but no law pins it — a containment statement is the missing piece`
+		)
+	}
+	return handle
+}
+
 /**
  * Marshals one host cell at its field position to the natural wire value,
  * schema-directed by the field descriptor's structural kind (never
- * guessed). Values are bare, so the runtime values ARE the wire's natural
- * JS values; widths and domain labels are the engine's own judgment at the
- * write boundary.
+ * guessed). A closed-referencing cell arrives as its handle NAME and
+ * lowers through {@link closedCellOf} — the arm precedes the switch
+ * because a closed reference is structurally a u64 descriptor plus the
+ * roster (the same precedence `Infer` pins at the type level). Everything
+ * else is bare, so the runtime values ARE the wire's natural JS values;
+ * widths and domain labels are the engine's own judgment at the write
+ * boundary.
  */
 function cellOf(context: string, field: AnyField, value: unknown): FactValue {
+	if ("closed" in field) {
+		if (typeof value !== "string") {
+			throw cellShapeError(context, `a ${field.closed.name} handle name (string)`, value)
+		}
+		return closedCellOf(context, field.closed, value)
+	}
 	switch (field.kind) {
 		case "bool": {
 			if (typeof value !== "boolean") {
@@ -210,7 +272,9 @@ function isMintedFresh<R extends AnyRelation>(
 /**
  * Unmarshals one positional row to the relation's named, frozen fact object
  * of bare structural values — the inverse of {@link rowOf},
- * ordinal-directed by the same declaration order.
+ * ordinal-directed by the same declaration order. Closed-referencing cells
+ * lift id → handle NAME through {@link handleOf} (the read half of the
+ * bijection), so every fact a user sees speaks the roster's vocabulary.
  */
 function factOf<R extends AnyRelation>(relation: R, row: readonly FactValue[]): Fact<R> {
 	const data = relation.data
@@ -225,7 +289,10 @@ function factOf<R extends AnyRelation>(relation: R, row: readonly FactValue[]):
 		if (cell === undefined) {
 			throw errors.new(`relation ${data.name}: row cell ${ordinal} (${declared.name}) is absent`)
 		}
-		decoded[declared.name] = cell
+		decoded[declared.name] =
+			"closed" in declared.field
+				? handleOf(`relation ${data.name} field ${declared.name}`, declared.field.closed, cell)
+				: cell
 	})
 	Object.freeze(decoded)
 	if (!isCompleteFact(relation, decoded)) {
@@ -235,4 +302,4 @@ function factOf<R extends AnyRelation>(relation: R, row: readonly FactValue[]):
 }
 
 export type { KeyFact, Minted }
-export { cellOf, factOf, isFreshField, isMintedFresh, keyRowOf, recordOf, rowOf }
+export { cellOf, factOf, handleOf, isFreshField, isMintedFresh, keyRowOf, recordOf, rowOf }

package/src/query/atom.ts

@@ -4,6 +4,9 @@
  * (`bumbledb/crates/bumbledb/src/ir.rs`, the bijection target;
  * `docs/architecture/20-query-ir.md` normative). A `match` binding record
  * binds fields to vars, params, ∈-set params, or bare structural literals
+ * — a closed-reference field's literal is its handle NAME, and a plain
+ * ARRAY of names there is membership, folded into the program (closed-only
+ * by owner ruling; see {@link BindingInput})
  * (unmentioned fields ARE the wildcard — no wildcard value exists);
  * `not(Rel, {...})` is negation-as-position (anti-join); `eq`/`ne` and the
  * order roster, `pointIn`/`covers` (both spellings of `ir::CmpOp::PointIn`,
@@ -26,7 +29,7 @@
 
 import * as errors from "@superbuilders/errors"
 import type { AnyClosed } from "#closed.ts"
-import type { AnyField, ClosedIdField, Infer, IntervalValue } from "#fields.ts"
+import type { AnyField, ClosedIdField, ClosedRoster, Infer, IntervalValue } from "#fields.ts"
 import type { ClassLookup, ClassRecordOf, SchemaClasses } from "#law.ts"
 import type {
 	ClassedField,
@@ -55,23 +58,32 @@ type MatchOwner = AnyRelation | AnyClosed
 /**
  * The matchable field block of an atom owner: a relation's declared
  * fields; a closed relation's SEALED shape — the synthetic `id` (the
- * roster-carrying descriptor) first, then the declared payload columns
- * read through the typed `columns` carrier (the one source of payload
- * typing — no parallel column table exists). The runtime twin is
- * `matchFieldsOf` in `#query/lower.ts`; the id-first ordinal shift the two
- * tiers share is pinned by the lowering golden.
+ * value's OWN roster-carrying descriptor, at its precise type: the handle
+ * union rides into ψ id bindings and joins exactly as it does on a
+ * referencing column) first, then the declared payload columns read
+ * through the typed `columns` carrier (the one source of payload typing —
+ * no parallel column table exists). The runtime twin is `matchFieldsOf` in
+ * `#query/lower.ts`; the id-first ordinal shift the two tiers share is
+ * pinned by the lowering golden.
  */
 type MatchFields<R extends MatchOwner> = R extends AnyClosed
-	? { readonly id: ClosedIdField } & R["columns"]
+	? { readonly id: R["id"] } & R["columns"]
 	: R extends AnyRelation
 		? RelationFields<R>
 		: never
 
-/** One atom-binding position as runtime data. */
+/**
+ * One atom-binding position as runtime data. `literalSet` is a membership
+ * ARRAY at a closed-reference field, folded into the program: `name` is
+ * the content-addressed registry key its dense `ParamId` is minted under
+ * (the lowering rides the existing param-set term; the SDK itself supplies
+ * the translated member set at every execute — never the host).
+ */
 type BindingTermData =
 	| { readonly kind: "var"; readonly name: string }
 	| { readonly kind: "param"; readonly name: string }
 	| { readonly kind: "setParam"; readonly name: string }
+	| { readonly kind: "literalSet"; readonly name: string; readonly members: readonly string[] }
 	| { readonly kind: "literal"; readonly value: unknown }
 
 /** One resolved binding: the field's name, its descriptor, its law-computed class, and the term. */
@@ -135,10 +147,18 @@ type SelectEntryData =
 	| { readonly kind: "measure"; readonly over: string }
 	| { readonly kind: "aggregate"; readonly agg: AggData }
 
-/** One answer column: its name (the row object key) and its entry. */
+/**
+ * One answer column: its name (the row object key), its entry, and — when
+ * the column's value is a closed reference (a projected var or an
+ * Arg-carried payload bound at a closed-referencing field) — the roster the
+ * decode lifts row ids back to handle NAMES through (the read half of the
+ * marshal bijection; `undefined` on every bare column). The slice is
+ * SDK-side marshaling data only: the wire `ProgramIr` never carries it.
+ */
 interface SelectColumn {
 	readonly name: string
 	readonly entry: SelectEntryData
+	readonly closed: ClosedRoster | undefined
 }
 
 /** One body item of a rule, in written order. */
@@ -151,13 +171,17 @@ type RuleItem =
 /**
  * One use of a parameter inside a rule, in written order: the census the
  * query-level registry folds (first use mints the dense `ParamId`, first
- * FIELD-ANCHORED use types the wire).
+ * FIELD-ANCHORED use types the wire). `members` is present exactly on a
+ * membership-array use (a literal set folded into the program): the handle
+ * names the SDK itself translates and supplies at execute — the entry
+ * never appears in the host's params object.
  */
 interface ParamUse {
 	readonly name: string
 	readonly shape: "value" | "set" | "mask"
 	readonly anchor: AnyField | "measure" | undefined
 	readonly op: "binding" | CmpKind
+	readonly members: readonly string[] | undefined
 }
 
 /** One complete rule as runtime data. */
@@ -184,10 +208,18 @@ interface RecData {
  * of the field's value type, a var/param/∈-set-param term — and, when the
  * field is interval-typed, a bare point literal (the IR's membership
  * typing rule: an element-typed term at an interval field is point
- * membership; an interval-typed term is value equality).
+ * membership; an interval-typed term is value equality). A
+ * CLOSED-reference field additionally takes a plain ARRAY of handle names
+ * read as membership — `kind: ["Practice", "Review"]` (the drizzle law:
+ * set membership is an array, never an operator). Arrays are CLOSED-ONLY
+ * in this packet by owner ruling: ordinary u64/str membership already has
+ * its spelling through `r.inSet` params; widening literal arrays to every
+ * literal-capable kind is a separate future taste call — deliberately not
+ * done here.
  */
 type BindingInput<F extends AnyField> =
 	| Infer<F>
+	| (F extends ClosedIdField ? readonly Infer<F>[] : never)
 	| (F extends { readonly kind: "interval" } ? bigint : never)
 	| Var<string>
 	| Param<string>
@@ -516,11 +548,22 @@ function not<R extends MatchOwner, const B extends MatchShape<MatchFields<R>>>(
 	return Object.freeze(value)
 }
 
-/** Whether a var name is bound in the environment at an orderable (u64/i64) field. */
+/**
+ * Whether a var name is bound in the environment at an orderable (u64/i64)
+ * field. A CLOSED reference is excluded even though its kind is `u64`: a
+ * vocabulary's declaration-id order is an accident, not semantics
+ * (`docs/architecture/10-data-model.md` § orderability — order on it is
+ * refused exactly as the enum's ordinal order was), so every
+ * order-comparison and fold position refuses closed-bound terms — this
+ * judgment is the one gate they all read, and the construction-time
+ * validations in `#query/lower.ts` are its runtime twin.
+ */
 type OrderVarOk<Env extends EnvShape, N extends string> = N extends keyof Env
-	? Env[N]["field"]["kind"] extends "u64" | "i64"
-		? true
-		: false
+	? Env[N]["field"] extends { readonly closed: ClosedRoster }
+		? false
+		: Env[N]["field"]["kind"] extends "u64" | "i64"
+			? true
+			: false
 	: false
 
 /** Whether a var name is bound at an interval field. */