@bjornpagen/bumbledb 0.5.0 → 0.7.0

package/src/query/lower.ts

@@ -1,28 +1,37 @@
 /**
- * `query()` and the IR lowering, STRUCTURAL edition. A query is built
- * kysely-shaped — `query(S).rule(r => r.match(Rel, { f: r.var("x") })
- * .where(r.eq(r.var("x"), r.param("p"))).select("x"))` — and is an INERT
- * value: `Query<Rels, Row, Params>` with `Row` inferred from each rule's
- * `.select` and `Params` inferred to be EXACTLY the params the rules use
- * (params are typed BY USE; a param value no rule uses never registers, so
- * every query executes under its own inferred type). Vars are string
- * names, domain-typed by the field they first bind and joined by reuse —
- * the rule builder's environment carries name → field descriptor through
- * the chain, checked structurally at every reuse (`JoinOk`), so the old
- * brand-equal join is now the domain-equal compile error. Lowering is a
- * pure function of the query value down to the bridge's `ProgramIr`
- * (`bumbledb/crates/bumbledb/src/ir.rs`, the bijection target): relations
- * by declaration ordinal (the declaration-order-is-ids law the engine's
- * manifest pins), variables by dense per-rule first-occurrence ids
- * (rule-scoped, exactly as the IR scopes them), params by first-use order
- * across the program walk. Lowering is STABLE — the same query value
- * lowers to deeply-equal IR every time, and two identically-written
- * queries lower identically. Construction validates negation safety and
- * name-boundness (typed, naming the variable — earlier and warmer than
- * the engine's refusal); everything else (strata, types, aggregate
- * rosters, rule caps) is the ENGINE's judge, surfacing its typed errors
- * at prepare. No invented limits: rule and predicate counts are never
- * pre-checked here.
+ * `query()` and the IR lowering, REFERENCE-IDENTITY edition. A query is
+ * built kysely-shaped — variables minted by {@link v} outside the rule and
+ * reused by REFERENCE to join:
+ *
+ *   query(S).rule((r) => {
+ *     const acct = v(Account)
+ *     const h = v(Holder)
+ *     return r
+ *       .match(Account, { id: acct.id, holder: acct.holder })
+ *       .match(Holder, { id: acct.holder })
+ *       .where(r.eq(acct.holder, r.param("root")))
+ *       .find({ account: acct.id, holder: acct.holder })
+ *   })
+ *
+ * — and is an INERT value: `Query<Rels, Row, Params>` with `Row` inferred
+ * from each rule's `.find` RECORD (its keys ARE the answer columns) and
+ * `Params` inferred to be EXACTLY the params the rules use (params are typed
+ * BY USE; a param no rule uses never registers). Variable IDENTITY is the
+ * object reference: reusing one value across binding positions IS the join,
+ * and a name-collision join is unrepresentable. Each binding position is
+ * judged against the variable's MINT slot — and because {@link JoinOk} is an
+ * equality, that alone makes every cross-binding join transitively
+ * class-equal. Lowering is a pure function of the query value down to the
+ * bridge's `ProgramIr` (`bumbledb/crates/bumbledb/src/ir.rs`): relations by
+ * declaration ordinal, variables by dense per-rule first-occurrence ids
+ * (keyed on the object REFERENCE — the discipline is unchanged, only the map
+ * key moved from name to reference), params by first-use order. Lowering is
+ * STABLE — the same query value lowers to deeply-equal IR every time, and
+ * two identically-written queries (fresh mints each) lower identically.
+ * Construction validates negation safety and boundness (typed by the var's
+ * label — object identity is invisible to the type tier, so these are
+ * construction-time walls); everything else (strata, types, aggregate
+ * rosters, rule caps) is the ENGINE's judge, surfacing at prepare.
  */
 
 import * as errors from "@superbuilders/errors"
@@ -39,6 +48,7 @@ import type {
 	HeadTermIr,
 	PredicateDefIr,
 	ProgramIr,
+	QueryParam,
 	RuleIr,
 	TaggedValue,
 	TermIr
@@ -47,7 +57,6 @@ import type {
 	AggData,
 	AnyCond,
 	AtomData,
-	BindEnv,
 	BindingEntry,
 	BindParamsShape,
 	CheckBindings,
@@ -57,6 +66,8 @@ import type {
 	CmpTermData,
 	CondData,
 	CondParamsShape,
+	FindColumn,
+	FindEntryData,
 	MaskData,
 	MatchFields,
 	MatchOwner,
@@ -64,21 +75,20 @@ import type {
 	ParamUse,
 	RecData,
 	RuleData,
-	RuleItem,
-	SelectColumn,
-	SelectEntryData,
-	TreeData
+	RuleItem
 } from "#query/atom.ts"
 import { allen, and, eq, ge, gt, le, lt, ne, not, or, pointIn } from "#query/atom.ts"
+import type { CheckFind, CheckRecFind, FindShape, HeadRecordOf, RowOfFind } from "#query/find.ts"
+import { argMax, argMin, count, countDistinct, max, min, pack, sum } from "#query/find.ts"
 import type {
+	AnyVar,
 	ClassedField,
-	EnvShape,
 	Flatten,
 	InferredOf,
 	JoinOk,
+	MintSlotOf,
 	ParamEntry,
-	ParamsRecord,
-	Var
+	ParamsRecord
 } from "#query/scope.ts"
 import {
 	fieldJoins,
@@ -88,28 +98,18 @@ import {
 	makeMaskParam,
 	makeParam,
 	makeSetParam,
-	makeVar,
 	renderFieldKind,
 	term
 } from "#query/scope.ts"
-import type { CheckNameSelect, CheckSelect, RowOfNameSelect, RowOfSelect, SelectEntry } from "#query/select.ts"
-import { argMax, argMin, count, countDistinct, max, min, pack, sum } from "#query/select.ts"
-import type { FieldsShape } from "#relation.ts"
 import type { AnySchema, Schema, SchemaRelations } from "#schema.ts"
 
 /**
  * The matchable members of a schema's record — ordinary relations AND
- * closed vocabularies (ψ query atoms: a closed atom is an ordinary EDB
- * atom over the sealed extension; the ENGINE decides whether it folds to a
- * plan-constant member set or joins the L1-resident virtual image — the
- * SDK lowers pass-through and never knows which).
+ * closed vocabularies (ψ query atoms; the ENGINE decides folding vs virtual
+ * image, the SDK lowers pass-through).
  */
 type QueryRelation<Rels extends SchemaRelations> = Extract<Rels[keyof Rels], MatchOwner>
 
-/** The environment after one bindings record: the incoming env plus every var the record binds (as classed slots). */
-type EnvOfMatch<Env extends EnvShape, F extends FieldsShape, CR, B> =
-	Flatten<Env & BindEnv<F, CR, B>> extends infer E extends EnvShape ? E : never
-
 /** Reads an inferred-params carrier off a rec reference or rule value. */
 type ParamsOf<T> = InferredOf<T> extends { readonly params: infer P extends ParamsRecord } ? P : Record<never, never>
 
@@ -117,19 +117,16 @@ type ParamsOf<T> = InferredOf<T> extends { readonly params: infer P extends Para
 type RowOf<T> = InferredOf<T> extends { readonly row: infer R } ? R : never
 
 /**
- * A recursive predicate's HEAD signature as classed slots (descriptor +
- * law-computed class), position for position — carried on the rec
- * reference so an `idb` join can be judged against it; `undefined` on
- * values that carry no head (a plain query rule, or an unthreaded rec
- * handle before its first rule).
+ * A recursive predicate's HEAD signature as classed slots, keyed by column
+ * name — carried on the rec reference so an `idb` join can be judged against
+ * it; `undefined` on values that carry no head.
  */
-type HeadShape = readonly ClassedField[] | undefined
+type HeadShape = Readonly<Record<string, ClassedField>> | undefined
 
 /**
  * One finished rule as a plain value: the runtime data plus the inferred
- * row/params carrier (and, for a RECURSIVE rule, the head's positional
- * field descriptors — the signature `idb` joins pair against).
- * `.rule(...)` consumes it; hosts never build one by hand.
+ * row/params carrier (and, for a RECURSIVE rule, the head record of classed
+ * slots `idb` pairs against). `.rule(...)` consumes it.
  */
 interface RuleValue<Row, P extends ParamsRecord, Head extends HeadShape = undefined> {
 	readonly rule: RuleData
@@ -139,22 +136,14 @@ interface RuleValue<Row, P extends ParamsRecord, Head extends HeadShape = undefi
 /** Any finished rule value. */
 type AnyRuleValue = RuleValue<unknown, ParamsRecord, HeadShape>
 
-/** The positional head-field tuple of a recursive rule's names-only select. */
-type HeadFieldsOf<Env extends EnvShape, S extends readonly string[]> = {
-	readonly [I in keyof S]: Env[S[I] & keyof Env]
-}
-
 /** Reads an inferred-head carrier off a rule value or rec reference. */
-type HeadOf<T> = InferredOf<T> extends { readonly head: infer H extends readonly ClassedField[] } ? H : undefined
+type HeadOf<T> =
+	InferredOf<T> extends { readonly head: infer H extends Readonly<Record<string, ClassedField>> } ? H : undefined
 
 /**
  * A recursive predicate REFERENCE — the shape `idb()` targets carry: the
- * name (type-level identity: a recursive rule's own `idb` accepts only its
- * own name — the self-recursion cut), the runtime data (value identity),
- * the params its attached rules have used so far, and the head signature
- * its FIRST rule sealed (thread the value `.rule(...)` returns into an
- * `idb` and the program's `Params` type stays exact AND the idb join is
- * arity- and domain-checked against the head).
+ * name (type-level identity), the runtime data (value identity), the params
+ * its rules have used, and the head signature its FIRST rule sealed.
  */
 interface RecRef<Name extends string, P extends ParamsRecord, Head extends HeadShape = HeadShape> {
 	readonly name: Name
@@ -162,42 +151,44 @@ interface RecRef<Name extends string, P extends ParamsRecord, Head extends HeadS
 	readonly [inferred]?: { readonly params: P; readonly head: Head }
 }
 
-/** One `idb` position's judgment: the var must be bound by a relation atom, class-equal to the head slot when the head is carried. */
-type IdbVarOk<Env extends EnvShape, T, F> =
-	T extends Var<infer N extends string>
-		? N extends keyof Env
-			? F extends ClassedField
-				? JoinOk<Env[N], F>
-				: true
+/** One `idb` position's judgment: a variable class-equal to the head slot when the head is carried. */
+type IdbBindingOk<Classes extends SchemaClasses, HeadSlot, V> = V extends AnyVar
+	? HeadSlot extends ClassedField
+		? JoinOk<HeadSlot, MintSlotOf<Classes, V>> extends true
+			? true
 			: false
-		: false
+		: true
+	: false
 
 /**
- * The validated `idb` variable tuple: every var must already be bound by a
- * relation atom of the rule; and when the target carries its head
- * signature (the threaded rec handle), the tuple must match the head's
- * arity and every position must be class-equal to its head slot — the
- * same wall `JoinOk` holds for EDB atoms. An unthreaded handle carries no
- * head; its joins stay boundness-checked here and arity/class-judged at
- * prepare (the engine's law stands behind both tiers).
+ * The validated `idb` bindings record: when the target carries its head
+ * (a threaded rec handle), the record's key set must EXACTLY equal the
+ * head's (a missing or extra key maps every property to `never`) and each
+ * variable must be class-equal to its head slot — the same wall `JoinOk`
+ * holds for EDB atoms. An unthreaded handle carries no head; every entry
+ * must still be a variable, arity/class judged at construction and prepare.
  */
-type CheckIdbVars<Env extends EnvShape, V, Head extends HeadShape = undefined> = Head extends readonly ClassedField[]
-	? V extends readonly unknown[]
-		? V["length"] extends Head["length"]
-			? { readonly [I in keyof V]: IdbVarOk<Env, V[I], Head[I & keyof Head]> extends true ? V[I] : never }
-			: { readonly [I in keyof V]: never }
-		: never
-	: { readonly [I in keyof V]: IdbVarOk<Env, V[I], undefined> extends true ? V[I] : never }
+type CheckIdbBindings<Classes extends SchemaClasses, Head, B> =
+	Head extends Readonly<Record<string, ClassedField>>
+		? [keyof B] extends [keyof Head]
+			? [keyof Head] extends [keyof B]
+				? {
+						readonly [K in keyof B]: K extends keyof Head
+							? IdbBindingOk<Classes, Head[K], B[K]> extends true
+								? B[K]
+								: never
+							: never
+					}
+				: { readonly [K in keyof B]: never }
+			: { readonly [K in keyof B]: never }
+		: { readonly [K in keyof B]: B[K] extends AnyVar ? B[K] : never }
 
 /**
  * The term/predicate/aggregate constructor vocabulary every rule builder
- * carries — pure value builders, environment-free: the chain's `.where`,
- * `.match`, and `.select` seams judge their output against the rule
- * environment.
+ * carries — pure value builders. Variables are minted by the free {@link v},
+ * outside the rule, and reused by reference; `r` no longer mints them.
  */
 interface TermOps {
-	/** Declares/names one variable: typed by the field it first binds; reuse joins. */
-	readonly var: typeof makeVar
 	/** Names one scalar parameter: typed by its use; the key of the execute params object. */
 	readonly param: typeof makeParam
 	/** Names one ∈-set parameter (the IR's `ParamSet`): bound to a readonly array at execution. */
@@ -227,92 +218,78 @@ interface TermOps {
 	readonly pack: typeof pack
 }
 
-/** The rule builder a `query(S).rule(...)` callback receives: the ops plus the first atom (`Classes` — the schema type's class map, the join judge's authority). */
+/** The rule builder a `query(S).rule(...)` callback receives (`Classes` — the join judge's authority). */
 interface QueryRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses = SchemaClasses> extends TermOps {
-	/** The first EDB atom of the rule: fields bind vars, params, ∈-sets, or bare literals; absence is the wildcard (same-named vars within the record join class-equal). */
+	/** The first EDB atom of the rule: fields bind variables, params, ∈-sets, or bare literals; absence is the wildcard. */
 	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
-	): QueryRuleChain<
-		Rels,
-		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
-		BindParamsShape<MatchFields<R>, B>,
-		Classes
-	>
+		bindings: B & CheckBindings<Classes, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): QueryRuleChain<Rels, BindParamsShape<MatchFields<R>, B>, Classes>
 }
 
 /** The chain of a plain query rule: more atoms, residual predicates, then the head. */
 interface QueryRuleChain<
 	Rels extends SchemaRelations,
-	Env extends EnvShape,
 	P extends ParamsRecord,
 	Classes extends SchemaClasses = SchemaClasses
 > {
-	/** One more positive EDB atom — var reuse joins, class-equal by the environment check. */
+	/** One more positive EDB atom — variable reuse joins, class-equal by the mint-slot judgment. */
 	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
-	): QueryRuleChain<
-		Rels,
-		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
-		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
-		Classes
-	>
+		bindings: B & CheckBindings<Classes, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): QueryRuleChain<Rels, Flatten<P & BindParamsShape<MatchFields<R>, B>>, Classes>
 	/** One residual predicate: a comparison, an `and`/`or` tree, or a negated atom (`r.not`). */
 	where<const C extends AnyCond>(
-		cond: CheckCond<Env, Classes, C> & C
-	): QueryRuleChain<Rels, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
-	/** The head projection: var names, the measure, and aggregates; written order = answer column order. */
-	select<const S extends readonly SelectEntry[]>(...entries: CheckSelect<Env, S> & S): RuleValue<RowOfSelect<Env, S>, P>
+		cond: CheckCond<Classes, C> & C
+	): QueryRuleChain<Rels, Flatten<P & CondParamsShape<C>>, Classes>
+	/** The head projection: a `find` RECORD whose keys name the answer columns. */
+	find<const F extends FindShape>(entries: F & CheckFind<F>): RuleValue<RowOfFind<F>, P>
 }
 
 /** The rule builder an OUTPUT rule of a `program()` receives: a query rule plus finished-stratum `idb` atoms. */
 interface OutputRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses = SchemaClasses> extends TermOps {
 	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
-	): OutputRuleChain<
-		Rels,
-		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
-		BindParamsShape<MatchFields<R>, B>,
-		Classes
-	>
+		bindings: B & CheckBindings<Classes, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): OutputRuleChain<Rels, BindParamsShape<MatchFields<R>, B>, Classes>
+	/**
+	 * A rule may START with the finished stratum: an idb atom is a positive
+	 * occurrence exactly as the engine represents it, so its variables ground
+	 * — the identity projection `(c) | reach(c);` is spellable with no
+	 * re-grounding join over a domain relation.
+	 */
+	idb<Target extends RecRef<string, ParamsRecord>, const B extends Readonly<Record<string, AnyVar>>>(
+		target: Target,
+		bindings: B & CheckIdbBindings<Classes, HeadOf<Target>, B>
+	): OutputRuleChain<Rels, ParamsOf<Target>, Classes>
 }
 
 /** The chain of an output rule: atoms, predicates, `idb` joins over the program's recs, then the head. */
 interface OutputRuleChain<
 	Rels extends SchemaRelations,
-	Env extends EnvShape,
 	P extends ParamsRecord,
 	Classes extends SchemaClasses = SchemaClasses
 > {
 	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
-	): OutputRuleChain<
-		Rels,
-		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
-		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
-		Classes
-	>
+		bindings: B & CheckBindings<Classes, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): OutputRuleChain<Rels, Flatten<P & BindParamsShape<MatchFields<R>, B>>, Classes>
 	where<const C extends AnyCond>(
-		cond: CheckCond<Env, Classes, C> & C
-	): OutputRuleChain<Rels, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
+		cond: CheckCond<Classes, C> & C
+	): OutputRuleChain<Rels, Flatten<P & CondParamsShape<C>>, Classes>
 	/**
 	 * One `idb` atom over a FINISHED stratum (any rec of this program): a
-	 * positional join against the rec's head. An idb atom is a join
-	 * position — every variable must already be bound by a relation atom of
-	 * the rule (the theory's own domain relation; the rec's answers are
-	 * theory values, so the join is identity). Threading the rec value the
-	 * last `.rule(...)` returned carries its rules' params into `Params`
-	 * AND its head signature, so the join is arity- and class-checked
-	 * against the head at compile time.
+	 * NAMED join against the rec's head — the bindings record's keys are the
+	 * head columns, each bound to a variable positively bound by a relation
+	 * atom of the rule. Threading the rec value the last `.rule(...)` returned
+	 * carries its params into `Params` AND its head signature, so the join is
+	 * key-exact and class-checked against the head at compile time.
 	 */
-	idb<Target extends RecRef<string, ParamsRecord>, const V extends readonly Var<string>[]>(
+	idb<Target extends RecRef<string, ParamsRecord>, const B extends Readonly<Record<string, AnyVar>>>(
 		target: Target,
-		...vars: CheckIdbVars<Env, V, HeadOf<Target>> & V
-	): OutputRuleChain<Rels, Env, Flatten<P & ParamsOf<Target>>, Classes>
-	select<const S extends readonly SelectEntry[]>(...entries: CheckSelect<Env, S> & S): RuleValue<RowOfSelect<Env, S>, P>
+		bindings: B & CheckIdbBindings<Classes, HeadOf<Target>, B>
+	): OutputRuleChain<Rels, Flatten<P & ParamsOf<Target>>, Classes>
+	find<const F extends FindShape>(entries: F & CheckFind<F>): RuleValue<RowOfFind<F>, P>
 }
 
 /** The rule builder a RECURSIVE rule (`rec.rule(...)`) receives. */
@@ -320,53 +297,35 @@ interface RecRuleScope<Rels extends SchemaRelations, Self extends string, Classe
 	extends TermOps {
 	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
-	): RecRuleChain<
-		Rels,
-		Self,
-		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
-		BindParamsShape<MatchFields<R>, B>,
-		Classes
-	>
+		bindings: B & CheckBindings<Classes, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): RecRuleChain<Rels, Self, BindParamsShape<MatchFields<R>, B>, Classes>
 }
 
 /**
- * The chain of a recursive rule. Its `idb` accepts ONLY the rec itself —
- * the self-recursion cut as a type-level boundary (mutual recursion is
- * unwritable; a finished lower stratum is folded by the OUTPUT rules) —
- * and its `select` takes bound variable NAMES only: aggregates and the
- * measure are unrepresentable in a recursive head (the strata judge's
- * `AggregationThroughCycle`/`MeasureInRecursiveHead`, made unwritable).
+ * The chain of a recursive rule. Its `idb` accepts ONLY the rec itself (the
+ * self-recursion cut) and its `find` takes bound variables only — aggregates
+ * and the measure are unrepresentable in a recursive head.
  */
 interface RecRuleChain<
 	Rels extends SchemaRelations,
 	Self extends string,
-	Env extends EnvShape,
 	P extends ParamsRecord,
 	Classes extends SchemaClasses = SchemaClasses
 > {
 	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
 		relation: R,
-		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
-	): RecRuleChain<
-		Rels,
-		Self,
-		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
-		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
-		Classes
-	>
+		bindings: B & CheckBindings<Classes, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): RecRuleChain<Rels, Self, Flatten<P & BindParamsShape<MatchFields<R>, B>>, Classes>
 	where<const C extends AnyCond>(
-		cond: CheckCond<Env, Classes, C> & C
-	): RecRuleChain<Rels, Self, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
-	/** The self-recursive atom: `idb(self, ...boundVars)` — only this rec's own reference is accepted (threaded, its head arity- and class-checks the join). */
-	idb<Target extends RecRef<Self, ParamsRecord>, const V extends readonly Var<string>[]>(
+		cond: CheckCond<Classes, C> & C
+	): RecRuleChain<Rels, Self, Flatten<P & CondParamsShape<C>>, Classes>
+	/** The self-recursive atom: `idb(self, { headKey: boundVar })` — only this rec's own reference is accepted. */
+	idb<Target extends RecRef<Self, ParamsRecord>, const B extends Readonly<Record<string, AnyVar>>>(
 		target: Target,
-		...vars: CheckIdbVars<Env, V, HeadOf<Target>> & V
-	): RecRuleChain<Rels, Self, Env, P, Classes>
-	/** The recursive head: bound variable names only (the creation quarantine, restated for fixpoint topology); the value carries the head's classed slots for `idb` pairing. */
-	select<const S extends readonly string[]>(
-		...names: CheckNameSelect<Env, S> & S
-	): RuleValue<RowOfNameSelect<Env, S>, P, HeadFieldsOf<Env, S>>
+		bindings: B & CheckIdbBindings<Classes, HeadOf<Target>, B>
+	): RecRuleChain<Rels, Self, P, Classes>
+	/** The recursive head: a `find` record of bound variables only; the value carries the head's classed slots for `idb` pairing. */
+	find<const F extends FindShape>(entries: F & CheckRecFind<F>): RuleValue<RowOfFind<F>, P, HeadRecordOf<Classes, F>>
 }
 
 /** A query's runtime description — everything lowering, the wire marshal, and answer decode read. */
@@ -376,16 +335,15 @@ interface QueryData {
 	/** The output rules in written order (multiple rules = set union). */
 	readonly rules: readonly RuleData[]
 	/** The head columns (every rule derives the same head; written order = answer column order). */
-	readonly select: readonly SelectColumn[]
+	readonly finds: readonly FindColumn[]
 	/** The registered params in first-use order across the program walk (= dense `ParamId`s). */
 	readonly params: readonly ParamEntry[]
 }
 
 /**
  * An inert query value. `Row` is the inferred answer-row object type;
- * `Params` the inferred execute-params object type — exactly the params
- * the rules use. Prepare with `db.prepare(q)`; nothing here touches an
- * engine.
+ * `Params` the inferred execute-params object type — exactly the params the
+ * rules use. Prepare with `db.prepare(q)`.
  */
 interface Query<
 	Rels extends SchemaRelations,
@@ -402,11 +360,7 @@ interface Query<
 	readonly [inferred]?: { readonly row: Row; readonly params: Params }
 }
 
-/**
- * Any query value as lowering and the runtime consume it: the theory it
- * was built against and its runtime description — every `Query` (typed or
- * program-built) carries exactly this.
- */
+/** Any query value as lowering and the runtime consume it. */
 interface AnyQuery {
 	readonly schema: AnySchema
 	readonly data: QueryData
@@ -427,7 +381,6 @@ interface QueryStart<Rels extends SchemaRelations, Classes extends SchemaClasses
 
 /** The frozen constructor vocabulary every rule builder spreads. */
 const termOps: TermOps = Object.freeze({
-	var: makeVar,
 	param: makeParam,
 	inSet: makeSetParam,
 	maskParam: makeMaskParam,
@@ -453,41 +406,49 @@ const termOps: TermOps = Object.freeze({
 	pack
 })
 
-/** One rule under construction: immutable — every chain step is a fresh state. */
+/** One rule under construction: immutable — every chain step is a fresh state. Boundness rides the `bound` set of var references. */
 interface RuleBuildState {
 	readonly items: readonly RuleItem[]
-	readonly varFields: Readonly<Record<string, ClassedField>>
+	readonly bound: ReadonlySet<AnyVar>
 	readonly paramUses: readonly ParamUse[]
 }
 
 /** The empty rule state. */
 const EMPTY_RULE: RuleBuildState = Object.freeze({
 	items: Object.freeze([]),
-	varFields: Object.freeze({}),
+	bound: new Set<AnyVar>(),
 	paramUses: Object.freeze([])
 })
 
-/** One resolved bindings record: the atom entries, the vars it binds (as classed slots), and the params it uses. */
+/** One resolved bindings record: the atom entries, the variable references it binds, and the params it uses. */
 interface ResolvedBindings {
 	readonly atom: AtomData
-	readonly vars: ReadonlyArray<{ readonly name: string; readonly slot: ClassedField }>
+	readonly vars: readonly AnyVar[]
 	readonly uses: readonly ParamUse[]
 }
 
+/**
+ * The MINT slot of a variable, the runtime twin of {@link MintSlotOf}: (i)
+ * verifies the mint owner is the schema's own member value — a variable
+ * minted from a foreign relation is refused, naming its label — and (ii)
+ * returns the descriptor it was minted at plus the law-computed class read
+ * off the schema's frozen class map. Because {@link fieldJoins} is an
+ * equality, judging every binding position against this one slot makes all
+ * cross-binding joins mutually class-equal by transitivity.
+ */
+function mintSlotOf(context: ChainContext, ref: AnyVar): ClassedField {
+	if (context.theory.relations[ref.owner.name] !== ref.owner) {
+		throw errors.new(
+			`the variable ${ref.label} was minted from a relation schema ${context.theory.name} does not declare — mint variables with v() from the schema's own relations`
+		)
+	}
+	return { field: ref.field, class: context.classes[ref.owner.name]?.[ref.column] }
+}
+
 /**
  * Judges one membership ARRAY at a binding position — legal exactly at a
- * CLOSED-reference field (the owner ruling: ordinary u64/str membership is
- * spelled through `r.inSet` params; literal arrays are the closed
- * vocabulary's spelling), holding ≥ 2 DISTINCT handle names (the
- * degenerate sets are refusals: empty selects nothing, one element is the
- * bare literal respelled, and a duplicate member is the same respelling in
- * disguise — write each member once). The returned name is
- * CONTENT-ADDRESSED (vocabulary + the member SET — the key sorts a copy,
- * so two spellings of one set, reordered or not, share one dense
- * `ParamId`); the members are shape-checked strings here and
- * roster-verified at the one verification point (`taggedHandleId`) when
- * the SDK supplies the set at execute — the same moment a bound `r.inSet`
- * param's members are judged.
+ * CLOSED-reference field, holding ≥ 2 DISTINCT handle names. The returned
+ * name is CONTENT-ADDRESSED (vocabulary + the member SET).
  */
 function membershipSet(
 	context: string,
@@ -526,24 +487,23 @@ function membershipSet(
 }
 
 /**
- * Resolves a bindings record against an atom owner's matchable fields (a
- * relation's declared fields; a closed relation's sealed id + columns), in
+ * Resolves a bindings record against an atom owner's matchable fields, in
  * the record's written order: terms classify by their runtime tag,
- * everything else is a bare literal (typed by the FIELD at lowering — the
- * membership typing rule included). Every bound field carries its
- * law-computed class, read off the schema value's frozen class map — the
- * runtime twin of the type tier's `SlotAt` lookups.
+ * everything else is a bare literal. Every VARIABLE binding judges
+ * `fieldJoins(mintSlot, positionSlot)` and throws on a class-unequal reuse
+ * (the runtime twin of `CheckBindings`); the bound refs are collected for
+ * the rule's boundness set.
  */
 function resolveBindings(
-	context: string,
+	context: ChainContext,
+	label: string,
 	relation: MatchOwner,
-	bindings: Readonly<Record<string, unknown>>,
-	classes: SchemaClasses
+	bindings: Readonly<Record<string, unknown>>
 ): ResolvedBindings {
 	const entries: BindingEntry[] = []
-	const vars: Array<{ readonly name: string; readonly slot: ClassedField }> = []
+	const vars: AnyVar[] = []
 	const uses: ParamUse[] = []
-	const relationClasses = classes[relation.name]
+	const relationClasses = context.classes[relation.name]
 	const ordered = sealedFieldsOf(relation)
 	for (const [fieldName, value] of Object.entries(bindings)) {
 		if (value === undefined) {
@@ -553,17 +513,23 @@ function resolveBindings(
 			return candidate.name === fieldName
 		})
 		if (declared === undefined) {
-			throw errors.new(`${context} has no field ${fieldName}`)
+			throw errors.new(`${label} has no field ${fieldName}`)
 		}
 		const fieldClass = relationClasses?.[fieldName]
 		let bound: BindingEntry["term"]
 		if (isTerm(value)) {
 			switch (value[term]) {
 				case "var": {
-					bound = Object.freeze({ kind: "var" as const, name: value.name })
-					vars.push(
-						Object.freeze({ name: value.name, slot: Object.freeze({ field: declared.field, class: fieldClass }) })
-					)
+					const ref = value
+					const mint = mintSlotOf(context, ref)
+					const positionSlot: ClassedField = { field: declared.field, class: fieldClass }
+					if (!fieldJoins(mint, positionSlot)) {
+						throw errors.new(
+							`${label}: the variable ${ref.label} joins domain-unequal fields — minted at ${renderFieldKind(mint)}, reused at ${renderFieldKind(positionSlot)} (a var joins only class-equal slots; bare pairs only with bare)`
+						)
+					}
+					bound = Object.freeze({ kind: "var" as const, ref })
+					vars.push(ref)
 					break
 				}
 				case "param": {
@@ -594,15 +560,15 @@ function resolveBindings(
 				}
 				case "maskParam":
 					throw errors.new(
-						`${context}.${fieldName}: an Allen-mask param is not a field-typed value — masks live in allen() conditions only`
+						`${label}.${fieldName}: an Allen-mask param is not a field-typed value — masks live in allen() conditions only`
 					)
 				case "duration":
 					throw errors.new(
-						`${context}.${fieldName}: the measure is not a field-typed value — it lives in comparisons and select entries`
+						`${label}.${fieldName}: the measure is not a field-typed value — it lives in comparisons and find entries`
 					)
 			}
 		} else if (Array.isArray(value)) {
-			const set = membershipSet(`${context}.${fieldName}`, declared.field, value)
+			const set = membershipSet(`${label}.${fieldName}`, declared.field, value)
 			bound = Object.freeze({ kind: "literalSet" as const, name: set.name, members: set.members })
 			uses.push(
 				Object.freeze({
@@ -618,57 +584,40 @@ function resolveBindings(
 		}
 		entries.push(Object.freeze({ field: fieldName, data: declared.field, class: fieldClass, term: bound }))
 	}
-	return {
-		atom: Object.freeze({ relation, bindings: Object.freeze(entries) }),
-		vars,
-		uses
-	}
+	return { atom: Object.freeze({ relation, bindings: Object.freeze(entries) }), vars, uses }
 }
 
-/**
- * Extends a rule state with one positive atom. Vars bind on first
- * occurrence; every LATER occurrence (a later atom's field or a same-record
- * sibling) is a join and must be class-equal — the construction-time twin
- * of the type tier's `JoinOk` (bare pairs only with bare), so the domain
- * wall holds for untyped callers too.
- */
+/** Extends a rule state with one positive atom; the bound variable references accumulate into the boundness set. */
 function advanceMatch(
+	context: ChainContext,
 	state: RuleBuildState,
 	relation: MatchOwner,
-	bindings: Readonly<Record<string, unknown>>,
-	classes: SchemaClasses
+	bindings: Readonly<Record<string, unknown>>
 ): RuleBuildState {
-	const resolved = resolveBindings(`relation ${relation.name}`, relation, bindings, classes)
-	const varFields: Record<string, ClassedField> = { ...state.varFields }
-	for (const bound of resolved.vars) {
-		const existing = varFields[bound.name]
-		if (existing === undefined) {
-			varFields[bound.name] = bound.slot
-		} else if (!fieldJoins(existing, bound.slot)) {
-			throw errors.new(
-				`relation ${relation.name}: the variable ${bound.name} joins domain-unequal fields — first bound at ${renderFieldKind(existing)}, reused at ${renderFieldKind(bound.slot)} (a var joins only class-equal slots; bare pairs only with bare)`
-			)
-		}
+	const resolved = resolveBindings(context, `relation ${relation.name}`, relation, bindings)
+	const bound = new Set(state.bound)
+	for (const ref of resolved.vars) {
+		bound.add(ref)
 	}
-	return {
+	return Object.freeze({
 		items: Object.freeze([...state.items, Object.freeze({ kind: "atom" as const, atom: resolved.atom })]),
-		varFields: Object.freeze(varFields),
+		bound,
 		paramUses: Object.freeze([...state.paramUses, ...resolved.uses])
-	}
+	})
 }
 
-/** Resolves one comparison side to its runtime term. */
+/** Resolves one comparison side to its runtime term (variables and the measure ride by reference). */
 function cmpTermDataOf(op: string, value: unknown): CmpTermData {
 	if (isTerm(value)) {
 		switch (value[term]) {
 			case "var":
-				return Object.freeze({ kind: "var" as const, name: value.name })
+				return Object.freeze({ kind: "var" as const, ref: value })
 			case "param":
 				return Object.freeze({ kind: "param" as const, name: value.name })
 			case "setParam":
 				return Object.freeze({ kind: "setParam" as const, name: value.name })
 			case "duration":
-				return Object.freeze({ kind: "measure" as const, name: value.name })
+				return Object.freeze({ kind: "measure" as const, ref: value.over })
 			case "maskParam":
 				throw errors.new(`${op}: an Allen-mask param is not a comparison term — masks live in allen()'s mask position`)
 		}
@@ -678,23 +627,16 @@ function cmpTermDataOf(op: string, value: unknown): CmpTermData {
 
 /**
  * One comparison side's contribution to the param census: a param/set side
- * anchors to its SIBLING — a bound variable's field descriptor or the
- * measure; an unanchorable use (literal or param sibling) records with no
- * anchor and must be anchored by some other use of the same name.
+ * anchors to its SIBLING — a variable's field descriptor or the measure; an
+ * unanchorable use records with no anchor.
  */
-function sideUses(
-	op: CmpKind,
-	side: CmpTermData,
-	sibling: CmpTermData,
-	varFields: Readonly<Record<string, ClassedField>>,
-	uses: ParamUse[]
-): void {
+function sideUses(op: CmpKind, side: CmpTermData, sibling: CmpTermData, uses: ParamUse[]): void {
 	if (side.kind !== "param" && side.kind !== "setParam") {
 		return
 	}
 	let anchor: AnyField | "measure" | undefined
 	if (sibling.kind === "var") {
-		anchor = varFields[sibling.name]?.field
+		anchor = sibling.ref.field
 	} else if (sibling.kind === "measure") {
 		anchor = "measure"
 	} else {
@@ -712,12 +654,12 @@ function sideUses(
 }
 
 /** Lowers one condition VALUE to its runtime data, recording param uses. */
-function condDataOf(cond: AnyCond, varFields: Readonly<Record<string, ClassedField>>, uses: ParamUse[]): CondData {
+function condDataOf(cond: AnyCond, uses: ParamUse[]): CondData {
 	if (cond.cond === "cmp") {
 		const lhs = cmpTermDataOf(cond.op, cond.lhs)
 		const rhs = cmpTermDataOf(cond.op, cond.rhs)
-		sideUses(cond.op, lhs, rhs, varFields, uses)
-		sideUses(cond.op, rhs, lhs, varFields, uses)
+		sideUses(cond.op, lhs, rhs, uses)
+		sideUses(cond.op, rhs, lhs, uses)
 		let mask: MaskData | undefined
 		if (cond.op === "allen") {
 			const maskValue = cond.mask
@@ -738,15 +680,13 @@ function condDataOf(cond: AnyCond, varFields: Readonly<Record<string, ClassedFie
 				throw errors.new("allen: the mask position takes a 13-bit mask number or a maskParam")
 			}
 		}
-		const data: CmpData = Object.freeze({ kind: "cmp" as const, op: cond.op, mask, lhs, rhs })
-		return data
+		return Object.freeze({ kind: "cmp" as const, op: cond.op, mask, lhs, rhs })
 	}
 	if (cond.cond === "tree") {
 		const children = cond.children.map(function lowerChild(child) {
-			return condDataOf(child, varFields, uses)
+			return condDataOf(child, uses)
 		})
-		const data: TreeData = Object.freeze({ kind: "tree" as const, op: cond.op, children: Object.freeze(children) })
-		return data
+		return Object.freeze({ kind: "tree" as const, op: cond.op, children: Object.freeze(children) })
 	}
 	throw errors.new(
 		"a negated atom is not a condition-tree node — pass not(...) to where() directly, never inside and()/or()"
@@ -754,10 +694,18 @@ function condDataOf(cond: AnyCond, varFields: Readonly<Record<string, ClassedFie
 }
 
 /** Extends a rule state with one `.where` item (a condition or a negated atom). */
-function advanceWhere(state: RuleBuildState, cond: AnyCond, classes: SchemaClasses): RuleBuildState {
+function advanceWhere(context: ChainContext, state: RuleBuildState, cond: AnyCond): RuleBuildState {
 	if (typeof cond !== "object" || cond === null || !("cond" in cond)) {
 		throw errors.new("where() takes a comparison, an and()/or() tree, or a negated atom")
 	}
+	if (cond.cond === "notIdb") {
+		const bindings: Readonly<Record<string, unknown>> = Object.fromEntries(
+			Object.entries(cond.bindings ?? {}).filter(function defined([, value]) {
+				return value !== undefined
+			})
+		)
+		return notIdbAdvance(context, state, cond.target, bindings)
+	}
 	if (cond.cond === "not") {
 		const relation: MatchOwner = cond.relation
 		const bindings: Readonly<Record<string, unknown>> = Object.fromEntries(
@@ -765,136 +713,158 @@ function advanceWhere(state: RuleBuildState, cond: AnyCond, classes: SchemaClass
 				return value !== undefined
 			})
 		)
-		const resolved = resolveBindings(`negated relation ${relation.name}`, relation, bindings, classes)
-		return {
+		const resolved = resolveBindings(context, `negated relation ${relation.name}`, relation, bindings)
+		return Object.freeze({
 			items: Object.freeze([...state.items, Object.freeze({ kind: "negated" as const, atom: resolved.atom })]),
-			varFields: state.varFields,
+			bound: state.bound,
 			paramUses: Object.freeze([...state.paramUses, ...resolved.uses])
-		}
+		})
 	}
 	const uses: ParamUse[] = []
-	const data = condDataOf(cond, state.varFields, uses)
-	return {
+	const data = condDataOf(cond, uses)
+	return Object.freeze({
 		items: Object.freeze([...state.items, Object.freeze({ kind: "cond" as const, cond: data })]),
-		varFields: state.varFields,
+		bound: state.bound,
 		paramUses: Object.freeze([...state.paramUses, ...uses])
-	}
+	})
 }
 
-/** Extends a rule state with one `idb` atom (vars must be bound — validated at completion). */
-function advanceIdb(state: RuleBuildState, rec: RecData, vars: readonly Var<string>[]): RuleBuildState {
-	const names = vars.map(function nameOf(variable) {
-		if (!isTerm(variable) || variable[term] !== "var") {
-			throw errors.new(`idb ${rec.name}: positions take variables — bind literals and params through where()/match()`)
+/**
+ * Extends a rule state with one `idb` atom (a named record over head keys;
+ * vars validated at completion). A POSITIVE idb atom is a positive
+ * occurrence exactly as the engine represents it (`check_atoms` walks Idb
+ * and Edb in one loop), so its variables GROUND: they enter the rule's
+ * boundness set, may ride the head, and satisfy negation safety — the
+ * idb-only identity projection of a finished stratum is spellable with no
+ * re-grounding join. A NEGATED one binds nothing, only rejects.
+ */
+function advanceIdb(
+	state: RuleBuildState,
+	rec: RecData,
+	bindings: Readonly<Record<string, unknown>>,
+	negated: boolean
+): RuleBuildState {
+	const resolved: Array<{ readonly key: string; readonly ref: AnyVar }> = []
+	for (const [key, value] of Object.entries(bindings)) {
+		if (value === undefined) {
+			continue
+		}
+		if (!isTerm(value) || value[term] !== "var") {
+			throw errors.new(
+				`idb ${rec.name}: position ${key} takes a variable — bind literals and params through where()/match()`
+			)
+		}
+		resolved.push(Object.freeze({ key, ref: value }))
+	}
+	const bound = new Set(state.bound)
+	if (!negated) {
+		for (const binding of resolved) {
+			bound.add(binding.ref)
 		}
-		return variable.name
-	})
-	return {
-		items: Object.freeze([...state.items, Object.freeze({ kind: "idb" as const, rec, vars: Object.freeze(names) })]),
-		varFields: state.varFields,
-		paramUses: state.paramUses
 	}
+	return Object.freeze({
+		items: Object.freeze([
+			...state.items,
+			Object.freeze({ kind: "idb" as const, rec, bindings: Object.freeze(resolved), negated })
+		]),
+		bound,
+		paramUses: state.paramUses
+	})
 }
 
-/** Narrows a select entry to an aggregate value. */
+/** Narrows a find entry to an aggregate value. */
 function isAggregateEntry(
 	value: unknown
 ): value is { readonly agg: string; readonly over: unknown; readonly key: unknown } {
 	return typeof value === "object" && value !== null && "agg" in value
 }
 
-/**
- * Classifies one select entry into its named answer column. The `closed`
- * slice is resolved LATER, at rule completion (`completeRule`), where the
- * rule's `varFields` are in hand — until then every column is provisionally
- * bare.
- */
-function selectColumnOf(entry: unknown): SelectColumn {
-	if (typeof entry === "string") {
-		return Object.freeze({
-			name: entry,
-			entry: Object.freeze({ kind: "var" as const, over: entry }),
-			closed: undefined
-		})
-	}
-	if (isTerm(entry)) {
-		if (entry[term] === "duration") {
-			return Object.freeze({
-				name: entry.name,
-				entry: Object.freeze({ kind: "measure" as const, over: entry.name }),
-				closed: undefined
-			})
-		}
-		throw errors.new(
-			`query select: a ${entry[term]} is not projectable — select takes variable names, duration(v), or aggregates`
-		)
-	}
-	if (isAggregateEntry(entry)) {
-		return aggregateColumnOf(entry)
+/** Narrows a value to a variable term, else a pointed refusal. */
+function asVarTerm(context: string, value: unknown): AnyVar {
+	if (isTerm(value) && value[term] === "var") {
+		return value
 	}
-	throw errors.new("query select: not a select entry — select takes variable names, duration(v), or aggregates")
+	throw errors.new(`${context}: expected a variable`)
 }
 
-/** Classifies one aggregate select entry. */
-function aggregateColumnOf(entry: {
-	readonly agg: string
-	readonly over: unknown
-	readonly key: unknown
-}): SelectColumn {
-	function column(name: string, agg: AggData): SelectColumn {
-		return Object.freeze({
-			name,
-			entry: Object.freeze({ kind: "aggregate" as const, agg: Object.freeze(agg) }),
-			closed: undefined
-		})
-	}
+/** Classifies one aggregate find entry into its runtime data (variables ride by reference). */
+function aggDataOf(
+	name: string,
+	entry: { readonly agg: string; readonly over: unknown; readonly key: unknown }
+): AggData {
 	const over = entry.over
 	switch (entry.agg) {
 		case "count":
-			return column("count", { op: "count" })
-		case "countDistinct": {
-			if (typeof over !== "string") {
-				throw errors.new("countDistinct takes a variable name")
-			}
-			return column(over, { op: "countDistinct", over })
-		}
+			return Object.freeze({ op: "count" as const })
+		case "countDistinct":
+			return Object.freeze({ op: "countDistinct" as const, over: asVarTerm(`find ${name} (countDistinct)`, over) })
 		case "sum":
 		case "min":
 		case "max": {
-			if (typeof over === "string") {
-				return column(over, { op: "fold", fold: entry.agg, over })
+			if (isTerm(over) && over[term] === "var") {
+				return Object.freeze({ op: "fold" as const, fold: entry.agg, over })
 			}
 			if (isTerm(over) && over[term] === "duration") {
-				return column(over.name, { op: "fold", fold: entry.agg, over: Object.freeze({ duration: over.name }) })
+				return Object.freeze({ op: "fold" as const, fold: entry.agg, over: Object.freeze({ duration: over.over }) })
 			}
-			throw errors.new(`${entry.agg} takes a variable name or duration(v)`)
+			throw errors.new(`find ${name} (${entry.agg}): takes a variable or r.duration(v)`)
 		}
 		case "argMax":
-		case "argMin": {
-			if (typeof over !== "string" || typeof entry.key !== "string") {
-				throw errors.new(`${entry.agg} takes a carried variable name and an orderable key variable name`)
-			}
-			return column(over, { op: "arg", direction: entry.agg, over, key: entry.key })
+		case "argMin":
+			return Object.freeze({
+				op: "arg" as const,
+				direction: entry.agg,
+				over: asVarTerm(`find ${name} (${entry.agg})`, over),
+				key: asVarTerm(`find ${name} (${entry.agg} key)`, entry.key)
+			})
+		case "pack":
+			return Object.freeze({ op: "pack" as const, over: asVarTerm(`find ${name} (pack)`, over) })
+		default:
+			throw errors.new(`find ${name}: unknown aggregate ${entry.agg}`)
+	}
+}
+
+/**
+ * Classifies one find entry into its named answer column (the KEY names the
+ * column, `count` included). The `slot`/`closed` slices are resolved LATER,
+ * at rule completion, where boundness and the mint slots are in hand.
+ */
+function findColumnOf(name: string, entry: unknown): FindColumn {
+	if (isTerm(entry)) {
+		if (entry[term] === "var") {
+			return Object.freeze({
+				name,
+				entry: Object.freeze({ kind: "var" as const, over: entry }),
+				closed: undefined,
+				slot: undefined
+			})
 		}
-		case "pack": {
-			if (typeof over !== "string") {
-				throw errors.new("pack takes a variable name")
-			}
-			return column(over, { op: "pack", over })
+		if (entry[term] === "duration") {
+			return Object.freeze({
+				name,
+				entry: Object.freeze({ kind: "measure" as const, over: entry.over }),
+				closed: undefined,
+				slot: undefined
+			})
 		}
-		default:
-			throw errors.new(`unknown aggregate ${entry.agg}`)
+		throw errors.new(
+			`find ${name}: a ${entry[term]} is not projectable — find takes variables, r.duration(v), or aggregates`
+		)
+	}
+	if (isAggregateEntry(entry)) {
+		return Object.freeze({
+			name,
+			entry: Object.freeze({ kind: "aggregate" as const, agg: aggDataOf(name, entry) }),
+			closed: undefined,
+			slot: undefined
+		})
 	}
+	throw errors.new(`find ${name}: not a find entry — find takes variables, r.duration(v), or aggregates`)
 }
 
 /**
  * The orderable ban's pointed refusal (`docs/architecture/10-data-model.md`
- * § orderability): a closed reference is equality-and-membership only —
- * its declaration-id order is an encoding accident, so every
- * order-comparison and fold position refuses it. The construction-time
- * twin of the type tier's `OrderVarOk` exclusion, so the wall holds for
- * untyped callers too (the engine cannot backstop this one: the wire IR
- * carries plain u64s, no rosters).
+ * § orderability): a closed reference is equality-and-membership only.
  */
 function closedOrderError(context: string, position: string, vocabulary: string): Error {
 	return errors.new(
@@ -902,82 +872,62 @@ function closedOrderError(context: string, position: string, vocabulary: string)
 	)
 }
 
-/** The comparison ops under the orderable ban (order roster + point membership — every order-comparison position). */
+/** The comparison ops under the orderable ban (order roster + point membership). */
 function isOrderOp(op: CmpKind | "binding"): op is "lt" | "le" | "gt" | "ge" | "pointIn" {
 	return op === "lt" || op === "le" || op === "gt" || op === "ge" || op === "pointIn"
 }
 
-/** Requires a var name to be bound by a relation atom of the rule. */
-function assertBound(context: string, varFields: Readonly<Record<string, ClassedField>>, name: string): ClassedField {
-	const slot = varFields[name]
-	if (slot === undefined) {
-		throw errors.new(`${context}: the variable ${name} is not bound by a relation atom of the rule`)
+/** Requires a variable to be bound by a relation atom of the rule (the boundness wall — invisible to the type tier). */
+function assertBound(where: string, bound: ReadonlySet<AnyVar>, ref: AnyVar): void {
+	if (!bound.has(ref)) {
+		throw errors.new(`${where}: the variable ${ref.label} is not bound by a relation atom of the rule`)
 	}
-	return slot
 }
 
-/** Requires a var name to be bound at an interval field (the measure's and pack's domain). */
-function assertIntervalBound(context: string, varFields: Readonly<Record<string, ClassedField>>, name: string): void {
-	const slot = assertBound(context, varFields, name)
-	if (slot.field.kind !== "interval") {
+/** Requires a variable to be interval-typed (the measure's and pack's domain), off its own descriptor. */
+function assertInterval(where: string, ref: AnyVar): void {
+	if (ref.field.kind !== "interval") {
 		throw errors.new(
-			`${context}: ${name} is not interval-typed — the measure is defined over interval-typed variables only`
+			`${where}: ${ref.label} is not interval-typed — the measure is defined over interval-typed variables only`
 		)
 	}
 }
 
+/** Requires a variable's own field to be non-closed (the orderable ban's runtime twin). */
+function assertNotClosed(where: string, position: string, ref: AnyVar): void {
+	const roster = rosterOf(ref.field)
+	if (roster !== undefined) {
+		throw closedOrderError(where, `${position} ${ref.label}`, roster.name)
+	}
+}
+
 /**
- * Validates one condition's variable references against the rule's bound
- * names — and, for `eq`/`ne` over two variables, holds the class wall: the
- * unification IS a join, so the two slots must be class-equal exactly as a
- * match-reuse join must be (the construction-time twin of the type tier's
- * `EqOk` → `JoinOk`; bare pairs only with bare). The engine cannot backstop
- * this one — the query IR carries no domains — so the wall lives here for
- * untyped callers too.
+ * The classed mint slot one answer column's VALUES flow from: a projected
+ * variable's mint slot, or an Arg-carried payload's. Counts, folds, `pack`
+ * and the measure derive numbers/intervals, so they resolve no slot.
  */
-function validateCond(context: string, varFields: Readonly<Record<string, ClassedField>>, cond: CondData): void {
-	if (cond.kind === "cmp") {
-		for (const side of [cond.lhs, cond.rhs]) {
-			if (side.kind === "var") {
-				const slot = assertBound(context, varFields, side.name)
-				const roster = rosterOf(slot.field)
-				if (isOrderOp(cond.op) && roster !== undefined) {
-					throw closedOrderError(context, `the ${cond.op} side ${side.name}`, roster.name)
-				}
-			}
-			if (side.kind === "measure") {
-				assertIntervalBound(context, varFields, side.name)
-			}
-		}
-		if ((cond.op === "eq" || cond.op === "ne") && cond.lhs.kind === "var" && cond.rhs.kind === "var") {
-			const lhs = assertBound(context, varFields, cond.lhs.name)
-			const rhs = assertBound(context, varFields, cond.rhs.name)
-			if (!fieldJoins(lhs, rhs)) {
-				throw errors.new(
-					`${context}: ${cond.op}(${cond.lhs.name}, ${cond.rhs.name}) unifies domain-unequal fields — ${cond.lhs.name} bound at ${renderFieldKind(lhs)}, ${cond.rhs.name} at ${renderFieldKind(rhs)} (a var joins only class-equal slots; bare pairs only with bare)`
-				)
-			}
-		}
-		return
+function findColumnSlotOf(context: ChainContext, column: FindColumn): ClassedField | undefined {
+	const entry = column.entry
+	if (entry.kind === "var") {
+		return mintSlotOf(context, entry.over)
 	}
-	for (const child of cond.children) {
-		validateCond(context, varFields, child)
+	if (entry.kind === "aggregate" && entry.agg.op === "arg") {
+		return mintSlotOf(context, entry.agg.over)
 	}
+	return undefined
 }
 
-/** Validates one select column's variable references. */
-function validateColumn(
-	context: string,
-	varFields: Readonly<Record<string, ClassedField>>,
-	column: SelectColumn
-): void {
+/** Validates one find column's variable references (boundness + the orderable/interval walls, off the var's own field). */
+function validateColumn(context: ChainContext, bound: ReadonlySet<AnyVar>, column: FindColumn): void {
+	const where = `${contextLabel(context)} find ${column.name}`
 	const entry = column.entry
 	if (entry.kind === "var") {
-		assertBound(`${context} select ${column.name}`, varFields, entry.over)
+		assertBound(where, bound, entry.over)
 		return
 	}
 	if (entry.kind === "measure") {
-		assertIntervalBound(`${context} select ${column.name}`, varFields, entry.over)
+		assertBound(where, bound, entry.over)
+		assertInterval(where, entry.over)
 		return
 	}
 	const agg = entry.agg
@@ -985,145 +935,170 @@ function validateColumn(
 		case "count":
 			return
 		case "countDistinct":
-			assertBound(`${context} select ${column.name}`, varFields, agg.over)
+			assertBound(where, bound, agg.over)
 			return
 		case "fold": {
-			if (typeof agg.over === "string") {
-				const slot = assertBound(`${context} select ${column.name}`, varFields, agg.over)
-				const roster = rosterOf(slot.field)
-				if (roster !== undefined) {
-					throw closedOrderError(`${context} select ${column.name}`, `the ${agg.fold} input ${agg.over}`, roster.name)
-				}
+			if ("duration" in agg.over) {
+				assertBound(where, bound, agg.over.duration)
+				assertInterval(where, agg.over.duration)
 				return
 			}
-			assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over.duration)
+			assertBound(where, bound, agg.over)
+			assertNotClosed(where, `the ${agg.fold} input`, agg.over)
 			return
 		}
 		case "arg": {
-			assertBound(`${context} select ${column.name}`, varFields, agg.over)
-			const key = assertBound(`${context} select ${column.name}`, varFields, agg.key)
-			const keyRoster = rosterOf(key.field)
-			if (keyRoster !== undefined) {
-				throw closedOrderError(
-					`${context} select ${column.name}`,
-					`the ${agg.direction} key ${agg.key}`,
-					keyRoster.name
-				)
-			}
+			assertBound(where, bound, agg.over)
+			assertBound(where, bound, agg.key)
+			assertNotClosed(where, `the ${agg.direction} key`, agg.key)
 			return
 		}
 		case "pack":
-			assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over)
+			assertBound(where, bound, agg.over)
+			assertInterval(where, agg.over)
 			return
 	}
 }
 
 /**
- * Resolves the roster one select column decodes through: a projected var,
- * or an Arg-carried payload, bound at a closed-referencing field carries
- * that field's roster (read off `varFields` — the same slot the domain
- * machinery reads), and `decodeAnswers` lifts the column's row ids back to
- * handle NAMES through it — the runtime twin of the row type's `Infer`
- * claim. Every other entry decodes bare: counts are counts, the measure
- * and `pack` are never closed, and a closed FOLD is banned outright
- * ({@link closedOrderError}) before this resolution runs.
+ * Validates one condition's variable references against the rule's bound
+ * set — and, for `eq`/`ne` over two variables, holds the class wall through
+ * the mint slots (the unification IS a join; bare pairs only with bare).
  */
-function selectClosedOf(
-	varFields: Readonly<Record<string, ClassedField>>,
-	entry: SelectEntryData
-): ClosedRoster | undefined {
-	let over: string | undefined
-	if (entry.kind === "var") {
-		over = entry.over
-	} else if (entry.kind === "aggregate" && entry.agg.op === "arg") {
-		over = entry.agg.over
-	} else {
-		over = undefined
+function validateCond(context: ChainContext, bound: ReadonlySet<AnyVar>, cond: CondData): void {
+	const label = contextLabel(context)
+	if (cond.kind === "cmp") {
+		for (const side of [cond.lhs, cond.rhs]) {
+			if (side.kind === "var") {
+				assertBound(label, bound, side.ref)
+				const roster = rosterOf(side.ref.field)
+				if (isOrderOp(cond.op) && roster !== undefined) {
+					throw closedOrderError(label, `the ${cond.op} side ${side.ref.label}`, roster.name)
+				}
+			}
+			if (side.kind === "measure") {
+				assertBound(label, bound, side.ref)
+				assertInterval(label, side.ref)
+			}
+		}
+		if ((cond.op === "eq" || cond.op === "ne") && cond.lhs.kind === "var" && cond.rhs.kind === "var") {
+			assertBound(label, bound, cond.lhs.ref)
+			assertBound(label, bound, cond.rhs.ref)
+			const lhs = mintSlotOf(context, cond.lhs.ref)
+			const rhs = mintSlotOf(context, cond.rhs.ref)
+			if (!fieldJoins(lhs, rhs)) {
+				throw errors.new(
+					`${label}: ${cond.op}(${cond.lhs.ref.label}, ${cond.rhs.ref.label}) unifies domain-unequal fields — ${cond.lhs.ref.label} bound at ${renderFieldKind(lhs)}, ${cond.rhs.ref.label} at ${renderFieldKind(rhs)} (a var joins only class-equal slots; bare pairs only with bare)`
+				)
+			}
+		}
+		return
 	}
-	if (over === undefined) {
-		return undefined
+	for (const child of cond.children) {
+		validateCond(context, bound, child)
 	}
-	return rosterOf(varFields[over]?.field)
 }
 
 /**
- * Completes one rule: classifies the select record (written order = answer
- * column order, names must be declaration-order-safe keys), and validates
- * boundness — every condition/select/idb variable bound by a relation atom,
- * and every NEGATED atom's variable positively bound (the safety rule: a
- * negated atom binds nothing, only rejects).
+ * Validates one `idb` item: every head column of the rec is bound exactly
+ * once (a missing or extra key is a pointed error) and each variable joins
+ * its head column's classed slot. A POSITIVE idb atom GROUNDS its
+ * variables (a positive occurrence, exactly the engine's representation),
+ * so no boundness precondition exists; a NEGATED one binds nothing — its
+ * variables must be positively bound elsewhere in the rule, the same
+ * safety rule as EDB negation. When the rec's own rule 0 is in flight
+ * (`rec.rules[0]` absent), the completing rule's OWN find columns ARE the
+ * head.
  */
-function completeRule(context: string, state: RuleBuildState, columns: readonly SelectColumn[]): RuleData {
-	if (columns.length === 0) {
-		throw errors.new(`${context}: a select needs at least one entry`)
+function validateIdb(
+	context: ChainContext,
+	bound: ReadonlySet<AnyVar>,
+	item: {
+		readonly rec: RecData
+		readonly bindings: ReadonlyArray<{ readonly key: string; readonly ref: AnyVar }>
+		readonly negated: boolean
+	},
+	columns: readonly FindColumn[]
+): void {
+	const label = contextLabel(context)
+	const head = item.rec.rules[0]
+	const headColumns = head !== undefined ? head.finds : columns
+	const headNames = headColumns.map(function nameOf(column) {
+		return column.name
+	})
+	const keys = item.bindings.map(function keyOf(binding) {
+		return binding.key
+	})
+	for (const key of keys) {
+		if (!headNames.includes(key)) {
+			throw errors.new(
+				`${label}: idb ${item.rec.name} binds ${key}, not a head column of ${item.rec.name} (head columns: ${headNames.join(", ")})`
+			)
+		}
 	}
-	const seen = new Set<string>()
-	for (const column of columns) {
-		assertDeclarationOrderKey(`${context} select column`, column.name)
-		if (seen.has(column.name)) {
-			throw errors.new(`${context}: select names the answer column ${column.name} twice`)
+	for (const name of headNames) {
+		if (!keys.includes(name)) {
+			throw errors.new(
+				`${label}: idb ${item.rec.name} omits the head column ${name} — an idb join binds every head column of ${item.rec.name}`
+			)
 		}
-		seen.add(column.name)
-		validateColumn(context, state.varFields, column)
 	}
+	for (const binding of item.bindings) {
+		if (item.negated && !bound.has(binding.ref)) {
+			throw errors.new(
+				`${label}: negated idb ${item.rec.name} names the variable ${binding.ref.label}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`
+			)
+		}
+		const headColumn = headColumns.find(function byName(column) {
+			return column.name === binding.key
+		})
+		if (headColumn === undefined || headColumn.slot === undefined) {
+			continue
+		}
+		const mint = mintSlotOf(context, binding.ref)
+		if (!fieldJoins(headColumn.slot, mint)) {
+			throw errors.new(
+				`${label}: idb ${item.rec.name} joins the variable ${binding.ref.label} (${renderFieldKind(mint)}) at head column ${binding.key} (${renderFieldKind(headColumn.slot)}) — a var joins only class-equal slots; bare pairs only with bare`
+			)
+		}
+	}
+}
+
+/**
+ * Completes one rule: enriches the find columns (declaration-order-safe
+ * keys, boundness validated, each column's classed slot and closed slice
+ * resolved), then walks the body walls — negated-atom boundness safety, idb
+ * head pairing, and condition validation.
+ */
+function completeRule(context: ChainContext, state: RuleBuildState, rawColumns: readonly FindColumn[]): RuleData {
+	const label = contextLabel(context)
+	if (rawColumns.length === 0) {
+		throw errors.new(`${label}: a find needs at least one entry`)
+	}
+	const columns = rawColumns.map(function enrichColumn(column): FindColumn {
+		assertDeclarationOrderKey(`${label} find column`, column.name)
+		validateColumn(context, state.bound, column)
+		const slot = findColumnSlotOf(context, column)
+		return Object.freeze({ name: column.name, entry: column.entry, slot, closed: rosterOf(slot?.field) })
+	})
 	for (const item of state.items) {
 		if (item.kind === "negated") {
 			for (const binding of item.atom.bindings) {
-				if (binding.term.kind === "var") {
-					const bound = state.varFields[binding.term.name]
-					if (bound === undefined) {
-						throw errors.new(
-							`${context}: negated ${item.atom.relation.name} atom binds the variable ${binding.term.name} at position ${binding.field}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`
-						)
-					}
-					const negatedSlot: ClassedField = { field: binding.data, class: binding.class }
-					if (!fieldJoins(bound, negatedSlot)) {
-						throw errors.new(
-							`${context}: negated ${item.atom.relation.name} atom reuses the variable ${binding.term.name} at ${binding.field} (${renderFieldKind(negatedSlot)}), but the rule binds it at ${renderFieldKind(bound)} — a var joins only class-equal slots; bare pairs only with bare`
-						)
-					}
+				if (binding.term.kind === "var" && !state.bound.has(binding.term.ref)) {
+					throw errors.new(
+						`${label}: negated ${item.atom.relation.name} atom binds the variable ${binding.term.ref.label} at position ${binding.field}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`
+					)
 				}
 			}
 		}
 		if (item.kind === "idb") {
-			const head = item.rec.rules[0]
-			item.vars.forEach(function checkIdbVar(name, position) {
-				const bound = state.varFields[name]
-				if (bound === undefined) {
-					throw errors.new(
-						`${context}: idb ${item.rec.name} names the variable ${name}, but no relation atom of the rule binds it — an idb atom is a join position; bind the variable through the theory's own relation first`
-					)
-				}
-				const column = head?.select[position]
-				if (column === undefined || column.entry.kind !== "var") {
-					return
-				}
-				const headSlot = head?.varFields[column.entry.over]
-				if (headSlot !== undefined && !fieldJoins(headSlot, bound)) {
-					throw errors.new(
-						`${context}: idb ${item.rec.name} joins the variable ${name} (${renderFieldKind(bound)}) at head position ${position} (${column.name}: ${renderFieldKind(headSlot)}) — a var joins only class-equal slots; bare pairs only with bare`
-					)
-				}
-			})
+			validateIdb(context, state.bound, item, columns)
 		}
 		if (item.kind === "cond") {
-			validateCond(context, state.varFields, item.cond)
+			validateCond(context, state.bound, item.cond)
 		}
 	}
-	return Object.freeze({
-		items: state.items,
-		select: Object.freeze(
-			columns.map(function enrichColumn(column): SelectColumn {
-				return Object.freeze({
-					name: column.name,
-					entry: column.entry,
-					closed: selectClosedOf(state.varFields, column.entry)
-				})
-			})
-		),
-		varFields: state.varFields,
-		paramUses: state.paramUses
-	})
+	return Object.freeze({ items: state.items, finds: Object.freeze(columns), paramUses: state.paramUses })
 }
 
 /** Builds one typed rule value over completed rule data. */
@@ -1132,28 +1107,24 @@ function makeRuleValue<Row, P extends ParamsRecord>(rule: RuleData): RuleValue<R
 }
 
 /**
- * The one runtime chain every context shares — non-generic on purpose: the
- * typed chain interfaces (`QueryRuleChain`/`OutputRuleChain`/`RecRuleChain`)
- * apply at the scope factories' boundaries, and the runtime beneath them is
- * one plain value walk. Context gates the two context-bound verbs: `idb`
- * (a program construct — self-only inside a rec, any rec of the program in
- * the output, refused in a plain query) and the recursive `select`
- * (bound variable names only — the creation quarantine).
+ * The one runtime chain every context shares — non-generic on purpose. The
+ * typed chain interfaces apply at the scope factories' boundaries.
  */
 interface RawChain {
 	match(relation: MatchOwner, bindings: Readonly<Record<string, unknown>>): RawChain
 	where(cond: AnyCond): RawChain
-	idb(target: RecRef<string, ParamsRecord>, ...vars: readonly Var<string>[]): RawChain
-	select(...entries: readonly SelectEntry[]): RuleValue<never, never>
+	idb(target: RecRef<string, ParamsRecord>, bindings: Readonly<Record<string, unknown>>): RawChain
+	find(entries: Readonly<Record<string, unknown>>): RuleValue<never, never>
 }
 
 /** The runtime rule-builder shape beneath every typed scope. */
 interface RawScope extends TermOps {
 	match(relation: MatchOwner, bindings: Readonly<Record<string, unknown>>): RawChain
+	idb(target: RecRef<string, ParamsRecord>, bindings: Readonly<Record<string, unknown>>): RawChain
 }
 
-/** Which rule family a chain builds — gates `idb` and the recursive select — plus the schema's runtime class map (the join judge's authority). */
-type ChainContext = { readonly classes: SchemaClasses } & (
+/** Which rule family a chain builds — plus the schema's runtime class map and theory value (the join judge's authority). */
+type ChainContext = { readonly classes: SchemaClasses; readonly theory: AnySchema } & (
 	| { readonly kind: "query" }
 	| { readonly kind: "rec"; readonly self: RecData }
 	| { readonly kind: "output"; readonly program: ProgramState }
@@ -1176,7 +1147,7 @@ function idbAdvance(
 	context: ChainContext,
 	state: RuleBuildState,
 	target: RecRef<string, ParamsRecord>,
-	vars: readonly Var<string>[]
+	bindings: Readonly<Record<string, unknown>>
 ): RuleBuildState {
 	if (context.kind === "query") {
 		throw errors.new("idb is a program construct — declare recs and outputs through program(), never a plain query()")
@@ -1187,42 +1158,76 @@ function idbAdvance(
 				`rec ${context.self.name}: a recursive rule's idb target must be the rec itself — the self-recursion-only cut (mutual recursion is unwritable; fold a finished stratum in the output rules)`
 			)
 		}
-		return advanceIdb(state, context.self, vars)
+		return advanceIdb(state, context.self, bindings, false)
+	}
+	if (!context.program.recs.includes(target.data)) {
+		throw errors.new(
+			`idb ${target.name}: the rec was declared by a different program — rec identity is the membership rule`
+		)
+	}
+	return advanceIdb(state, target.data, bindings, false)
+}
+
+/**
+ * Validates and records one NEGATED finished-stratum atom — output rules
+ * only: there every rec is a finished set before the output's operator
+ * runs (negation OF lower strata is engine-legal; the strata judge refuses
+ * only negation *through* a cycle, which the rec-context refusal here
+ * makes unwritable).
+ */
+function notIdbAdvance(
+	context: ChainContext,
+	state: RuleBuildState,
+	target: { readonly name: string; readonly data: RecData },
+	bindings: Readonly<Record<string, unknown>>
+): RuleBuildState {
+	if (context.kind === "query") {
+		throw errors.new("idb is a program construct — declare recs and outputs through program(), never a plain query()")
+	}
+	if (context.kind === "rec") {
+		throw errors.new(
+			`rec ${context.self.name}: a recursive rule negates no stratum — self-negation is negation through the cycle (a finished set is what keeps the operator monotone), and a finished stratum's fold belongs in the output rules`
+		)
 	}
 	if (!context.program.recs.includes(target.data)) {
 		throw errors.new(
 			`idb ${target.name}: the rec was declared by a different program — rec identity is the membership rule`
 		)
 	}
-	return advanceIdb(state, target.data, vars)
+	return advanceIdb(state, target.data, bindings, true)
 }
 
-/** Classifies one select tuple per the context (a recursive head projects bound NAMES only). */
-function selectColumns(context: ChainContext, entries: readonly SelectEntry[]): SelectColumn[] {
-	return entries.map(function columnOf(entry): SelectColumn {
-		if (context.kind === "rec" && typeof entry !== "string") {
+/** Classifies one find record per the context (a recursive head projects bound variables only). */
+function findColumns(context: ChainContext, entries: Readonly<Record<string, unknown>>): FindColumn[] {
+	const columns: FindColumn[] = []
+	for (const [name, entry] of Object.entries(entries)) {
+		if (entry === undefined) {
+			continue
+		}
+		if (context.kind === "rec" && !(isTerm(entry) && entry[term] === "var")) {
 			throw errors.new(
-				`rec ${context.self.name}: a recursive head projects bound variable NAMES only — aggregates and the measure read finished sets (the strata judge's quarantine, unwritable here)`
+				`rec ${context.self.name}: a recursive head projects bound variables only — aggregates and the measure read finished sets (the strata judge's quarantine, unwritable here)`
 			)
 		}
-		return selectColumnOf(entry)
-	})
+		columns.push(findColumnOf(name, entry))
+	}
+	return columns
 }
 
 /** Builds one runtime chain (immutably — every step is a fresh chain over fresh state). */
 function makeRawChain(context: ChainContext, state: RuleBuildState): RawChain {
 	const chain: RawChain = {
 		match(relation, bindings) {
-			return makeRawChain(context, advanceMatch(state, relation, bindings, context.classes))
+			return makeRawChain(context, advanceMatch(context, state, relation, bindings))
 		},
 		where(cond) {
-			return makeRawChain(context, advanceWhere(state, cond, context.classes))
+			return makeRawChain(context, advanceWhere(context, state, cond))
 		},
-		idb(target, ...vars) {
-			return makeRawChain(context, idbAdvance(context, state, target, vars))
+		idb(target, bindings) {
+			return makeRawChain(context, idbAdvance(context, state, target, bindings))
 		},
-		select(...entries) {
-			return makeRuleValue<never, never>(completeRule(contextLabel(context), state, selectColumns(context, entries)))
+		find(entries) {
+			return makeRuleValue<never, never>(completeRule(context, state, findColumns(context, entries)))
 		}
 	}
 	Object.freeze(chain)
@@ -1234,7 +1239,10 @@ function makeRawScope(context: ChainContext): RawScope {
 	const scope: RawScope = {
 		...termOps,
 		match(relation, bindings) {
-			return makeRawChain(context, advanceMatch(EMPTY_RULE, relation, bindings, context.classes))
+			return makeRawChain(context, advanceMatch(context, EMPTY_RULE, relation, bindings))
+		},
+		idb(target, bindings) {
+			return makeRawChain(context, idbAdvance(context, EMPTY_RULE, target, bindings))
 		}
 	}
 	Object.freeze(scope)
@@ -1243,14 +1251,12 @@ function makeRawScope(context: ChainContext): RawScope {
 
 /**
  * The rule builders' trusted admission seam — THE home of the
- * trusted-admission-seam pattern the other mint guards cite (the face,
- * class-map, axiom-readback, rec-handle, and query-value seams): the raw
- * builder is one runtime shape for every context, and this guard verifies
- * the checkable fact — the builder verbs exist — before the value is
- * admitted at its TYPED face. The type-level
- * judgments (domain-equal joins, boundness, the recursion cut) live in the
- * interfaces themselves; the runtime twin of every one of them is a
- * construction-time validation in this module.
+ * trusted-admission-seam pattern the other mint guards cite: the raw builder
+ * is one runtime shape for every context, and this guard verifies the
+ * checkable fact — the builder verbs exist — before the value is admitted at
+ * its TYPED face. The type-level judgments (class-equal joins, the recursion
+ * cut) live in the interfaces themselves; boundness is a construction-time
+ * validation in this module (object identity is invisible to the type tier).
  */
 function isTypedScope<S>(scope: RawScope): scope is RawScope & S {
 	return typeof scope.match === "function"
@@ -1258,9 +1264,9 @@ function isTypedScope<S>(scope: RawScope): scope is RawScope & S {
 
 /** Builds one query-rule builder (the typed face of the raw builder). */
 function makeQueryRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses>(
-	classes: SchemaClasses
+	theory: AnySchema
 ): QueryRuleScope<Rels, Classes> {
-	const raw = makeRawScope({ kind: "query", classes })
+	const raw = makeRawScope({ kind: "query", classes: theory.classes, theory })
 	if (!isTypedScope<QueryRuleScope<Rels, Classes>>(raw)) {
 		throw errors.new("query rule builder construction incomplete")
 	}
@@ -1271,17 +1277,18 @@ function makeQueryRuleScope<Rels extends SchemaRelations, Classes extends Schema
 function makeOutputRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses>(
 	program: ProgramState
 ): OutputRuleScope<Rels, Classes> {
-	const raw = makeRawScope({ kind: "output", program, classes: program.classes })
+	const raw = makeRawScope({ kind: "output", program, classes: program.classes, theory: program.theory })
 	if (!isTypedScope<OutputRuleScope<Rels, Classes>>(raw)) {
 		throw errors.new("program output rule builder construction incomplete")
 	}
 	return raw
 }
 
-/** One program's build-time registry: its recs in declaration order (sealed when the output is declared) and the theory's class map. */
+/** One program's build-time registry: its recs in declaration order, the theory value, and its class map. */
 interface ProgramState {
 	readonly recs: RecData[]
 	readonly classes: SchemaClasses
+	readonly theory: AnySchema
 	sealed: boolean
 }
 
@@ -1291,7 +1298,7 @@ function renderClosedSlice(closed: ClosedRoster | undefined): string {
 }
 
 /** Renders one head column's signature for the rule-alignment check. */
-function headSignature(column: SelectColumn): string {
+function headSignature(column: FindColumn): string {
 	const entry = column.entry
 	if (entry.kind === "var" || entry.kind === "measure") {
 		return `${column.name}:var`
@@ -1306,26 +1313,7 @@ function headSignature(column: SelectColumn): string {
 	return `${column.name}:${agg.op}`
 }
 
-/**
- * The classed slot one answer column's VALUES flow from, resolved through
- * the rule's own binding environment: a projected var's first-binding slot,
- * or an Arg-carried payload's (`argMax`/`argMin` carry `over` verbatim —
- * the same two shapes the closed slice lifts). Counts, folds, `pack` and
- * the measure derive numbers/intervals rather than carrying a slot's ids,
- * so they resolve no slot (`undefined`).
- */
-function headSlotOf(rule: RuleData, column: SelectColumn): ClassedField | undefined {
-	const entry = column.entry
-	if (entry.kind === "var") {
-		return rule.varFields[entry.over]
-	}
-	if (entry.kind === "aggregate" && entry.agg.op === "arg") {
-		return rule.varFields[entry.agg.over]
-	}
-	return undefined
-}
-
-/** The roster a param anchor carries: present exactly on a closed-reference field anchor (rides THE one `rosterOf` reader). */
+/** The roster a param anchor carries: present exactly on a closed-reference field anchor. */
 function anchorRosterOf(anchor: AnyField | "measure" | undefined): ClosedRoster | undefined {
 	return anchor === "measure" ? undefined : rosterOf(anchor)
 }
@@ -1337,20 +1325,9 @@ function renderParamAnchor(roster: ClosedRoster | undefined): string {
 
 /**
  * Folds every rule's param uses (recs in declaration order first, output
- * rules last — exactly the lowering walk) into the query's registry:
- * first use mints the dense `ParamId`, the first FIELD-ANCHORED use types
- * the wire, and one name must keep one shape AND one closedness — every
- * anchored use of one name must agree on the roster (value identity), so a
- * param anchored at a closed reference is GUARANTEED to ride the one
- * roster-verification point (`taggedHandleId`) at execute; a name anchored
- * both at a closed reference and at a non-closed position (or at two
- * vocabularies) is refused here, because the wire would translate only the
- * first anchor's reading (the type tier intersects the uses to `never`;
- * this is its runtime twin for untyped callers). A param whose anchor is a
- * CLOSED reference must never sit in an order-comparison position — the
- * anchor types its value a handle name and the engine would order the
- * translated row ids, so the pairing is refused here too (the registry is
- * the one place a name's every use and its anchoring field meet).
+ * rules last — exactly the lowering walk) into the query's registry: first
+ * use mints the dense `ParamId`, the first FIELD-ANCHORED use types the
+ * wire, and one name keeps one shape AND one closedness.
  */
 function paramRegistryOf(recs: readonly RecData[], rules: readonly RuleData[]): readonly ParamEntry[] {
 	const order: string[] = []
@@ -1360,7 +1337,7 @@ function paramRegistryOf(recs: readonly RecData[], rules: readonly RuleData[]):
 			shape: ParamEntry["shape"]
 			anchor: ParamEntry["anchor"]
 			op: ParamEntry["op"]
-			members: ParamEntry["members"]
+			members: readonly string[] | undefined
 			orderOp: "lt" | "le" | "gt" | "ge" | "pointIn" | undefined
 		}
 	>()
@@ -1424,7 +1401,30 @@ function paramRegistryOf(recs: readonly RecData[], rules: readonly RuleData[]):
 			if (entry.orderOp !== undefined && anchorRoster !== undefined) {
 				throw closedOrderError(`query param ${name}`, `its ${entry.orderOp} use's anchor`, anchorRoster.name)
 			}
-			return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op, members: entry.members })
+			/**
+			 * A membership array's handle names are program constants, so the
+			 * entry stores the resolved IMAGE: each name rides the one
+			 * roster-verification point (`taggedHandleId`, through
+			 * `taggedCmpLiteral`) exactly once, HERE — an out-of-roster name
+			 * fails at build, and every execute returns this frozen value by
+			 * reference.
+			 */
+			let membership: QueryParam | undefined
+			if (entry.members !== undefined) {
+				const anchor = entry.anchor
+				if (anchor === undefined) {
+					throw errors.new(`query param ${name} lost its membership anchor`)
+				}
+				membership = Object.freeze({
+					kind: "set" as const,
+					values: Object.freeze(
+						entry.members.map(function tagMember(member, index) {
+							return Object.freeze(taggedCmpLiteral(`membership array ${name}[${index}]`, anchor, member, entry.op))
+						})
+					)
+				})
+			}
+			return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op, membership })
 		})
 	)
 }
@@ -1439,49 +1439,43 @@ interface RawQuery {
 /**
  * Assembles the runtime query value over completed rules: every rule must
  * derive the SAME head (name and aggregate shape, position for position —
- * the decode labels and the engine's alignment rule agree by
- * construction), and the param registry folds in program-walk order.
+ * the decode labels and the engine's alignment rule agree), and the param
+ * registry folds in program-walk order.
  */
 function makeRawQuery(theory: AnySchema, recs: readonly RecData[], rules: readonly RuleData[]): RawQuery {
 	const first = rules[0]
 	if (first === undefined) {
 		throw errors.new("a query needs at least one rule")
 	}
-	const signature = first.select.map(headSignature).join(", ")
+	const signature = first.finds.map(headSignature).join(", ")
 	rules.forEach(function verifyHead(rule, index) {
-		const candidate = rule.select.map(headSignature).join(", ")
+		const candidate = rule.finds.map(headSignature).join(", ")
 		if (candidate !== signature) {
 			throw errors.new(
-				`every rule of a query derives the same head — rule 0 selects (${signature}), rule ${index} selects (${candidate})`
+				`every rule of a query derives the same head — rule 0 finds (${signature}), rule ${index} finds (${candidate})`
 			)
 		}
 		// The closed slice is part of the head too: one answer column decodes
-		// through one roster, so a union whose rules bind a column at
-		// different vocabularies (or one closed, one bare — the ids would
-		// mistranslate silently) is refused pointed. Vocabulary identity is
-		// value identity, the SDK's membership rule everywhere.
-		rule.select.forEach(function verifyClosedSlice(column, position) {
-			const lead = first.select[position]
+		// through one roster, so a union whose rules bind a column at different
+		// vocabularies (or one closed, one bare) is refused pointed.
+		rule.finds.forEach(function verifyClosedSlice(column, position) {
+			const lead = first.finds[position]
 			if (lead !== undefined && column.closed !== lead.closed) {
 				throw errors.new(
 					`every rule of a query derives the same head — the answer column ${lead.name} is ${renderClosedSlice(lead.closed)} in rule 0 but ${renderClosedSlice(column.closed)} in rule ${index} (one column decodes through one roster)`
 				)
 			}
 			// The law-class wall on the union head: one answer column is one
-			// value space, so the classed slot each rule binds the column at
-			// must join across rules — the SAME fieldJoins judgment every
-			// join/eq/negated-atom position enforces. The SDK holds this wall
-			// because the wire IR carries no domains: the engine cannot
-			// backstop it, and without it a union mixes (say) Holder ids and
-			// Account ids in one column the consumer reads as one id space.
+			// value space, so the classed mint slot each rule binds the column
+			// at must join across rules — the SAME fieldJoins judgment every
+			// join/eq/negated-atom position enforces (the SDK holds it because
+			// the wire IR carries no domains).
 			if (lead === undefined) {
 				return
 			}
-			const leadSlot = headSlotOf(first, lead)
-			const slot = headSlotOf(rule, column)
-			if (leadSlot !== undefined && slot !== undefined && !fieldJoins(leadSlot, slot)) {
+			if (lead.slot !== undefined && column.slot !== undefined && !fieldJoins(lead.slot, column.slot)) {
 				throw errors.new(
-					`every rule of a query derives the same head — the answer column ${lead.name} unions domain-unequal fields: bound at ${renderFieldKind(leadSlot)} in rule 0 but at ${renderFieldKind(slot)} in rule ${index} (a union column joins only class-equal slots; bare pairs only with bare)`
+					`every rule of a query derives the same head — the answer column ${lead.name} unions domain-unequal fields: bound at ${renderFieldKind(lead.slot)} in rule 0 but at ${renderFieldKind(column.slot)} in rule ${index} (a union column joins only class-equal slots; bare pairs only with bare)`
 				)
 			}
 		})
@@ -1489,14 +1483,14 @@ function makeRawQuery(theory: AnySchema, recs: readonly RecData[], rules: readon
 	const data: QueryData = Object.freeze({
 		recs: Object.freeze([...recs]),
 		rules: Object.freeze([...rules]),
-		select: first.select,
+		finds: first.finds,
 		params: paramRegistryOf(recs, rules)
 	})
 	const value: RawQuery = {
 		schema: theory,
 		data,
 		rule(build) {
-			const built = build(makeRawScope({ kind: "query", classes: theory.classes }))
+			const built = build(makeRawScope({ kind: "query", classes: theory.classes, theory }))
 			return makeRawQuery(theory, recs, [...rules, built.rule])
 		}
 	}
@@ -1530,11 +1524,10 @@ function makeQuery<Rels extends SchemaRelations, Row, P extends ParamsRecord, Cl
 }
 
 /**
- * Opens a query over a schema: `query(S).rule(r => ...)`. Each `.rule`
- * adds one conjunctive rule; multiple rules are the set union (answers are
- * SETS — no order or limit exists anywhere; hosts sort). The schema's
- * law-computed class map rides into every rule builder — the join walls
- * compare class names off it, at the type level and at construction alike.
+ * Opens a query over a schema: `query(S).rule(r => ...)`. Each `.rule` adds
+ * one conjunctive rule; multiple rules are the set union. The schema's
+ * law-computed class map and theory value ride into every rule builder — the
+ * join walls compare against the mint slots off it.
  */
 function query<Rels extends SchemaRelations, Classes extends SchemaClasses>(
 	theory: Schema<Rels, Classes>
@@ -1543,7 +1536,7 @@ function query<Rels extends SchemaRelations, Classes extends SchemaClasses>(
 		rule<RV extends AnyRuleValue>(
 			build: (r: QueryRuleScope<Rels, Classes>) => RV
 		): Query<Rels, RowOf<RV>, ParamsOf<RV>, Classes> {
-			const built = build(makeQueryRuleScope<Rels, Classes>(theory.classes))
+			const built = build(makeQueryRuleScope<Rels, Classes>(theory))
 			return makeQuery<Rels, RowOf<RV>, ParamsOf<RV>, Classes>(theory, [], [built.rule])
 		}
 	}
@@ -1553,13 +1546,8 @@ function query<Rels extends SchemaRelations, Classes extends SchemaClasses>(
 
 /**
  * Tags one closed-reference literal: the handle NAME, verified against the
- * roster (the belt the wide fallback type cannot provide — structural
- * values make any string spellable here) and translated to its
- * declaration-order row id, tagged u64 — queries cross ids, never handle
- * names; the wire is untouched. THE single roster-verification point of
- * the query surface: atom-binding literals, comparison literals,
- * execute-time params, and membership-array members all reach it (never
- * duplicate the check per call site).
+ * roster and translated to its declaration-order row id, tagged u64. THE
+ * single roster-verification point of the query surface.
  */
 function taggedHandleId(
 	context: string,
@@ -1601,11 +1589,7 @@ function taggedAtElementDomain(context: string, element: "u64" | "i64", value: u
 
 /**
  * Tags one host literal at a FIELD position (atom bindings): the field's
- * structural kind directs the tag, never a guess. At an interval field a
- * bigint literal tags as the ELEMENT type — the IR's membership typing
- * rule (point membership), an interval-shaped literal as the interval
- * (value equality). A closed-reference literal is its bare handle id,
- * tagged u64 after a roster verification.
+ * structural kind directs the tag, never a guess.
  */
 function taggedLiteral(context: string, field: AnyField, value: unknown): TaggedValue {
 	const roster = rosterOf(field)
@@ -1635,15 +1619,6 @@ function taggedLiteral(context: string, field: AnyField, value: unknown): Tagged
 			if (typeof value !== "string") {
 				throw literalShapeError(context, "string", value)
 			}
-			/**
-			 * The marshal's bijection law at the query seam (`marshal.ts`
-			 * cellOf): a lone surrogate would be lossily replaced with
-			 * U+FFFD at the bridge's UTF-8 crossing and silently match a
-			 * fact the typed write surface can never store — distinct JS
-			 * strings collapsing to one wire query. This is the single
-			 * seam every query string literal, string param
-			 * (`taggedCmpLiteral`), and membership member lowers through.
-			 */
 			if (!value.isWellFormed()) {
 				throw literalShapeError(context, "well-formed string", value)
 			}
@@ -1661,17 +1636,13 @@ function taggedLiteral(context: string, field: AnyField, value: unknown): Tagged
 }
 
 /**
- * Tags one host literal at a COMPARISON or PARAM position, where the
- * SIBLING anchors the type: a measure sibling is u64, an interval-field
- * sibling contributes its element domain (so both a point literal in
- * `pointIn` and a `span` literal in `allen` tag correctly), a scalar
- * sibling its own type. At `pointIn` the operand order is interval-left,
- * point-right (`ir::CmpOp::PointIn`), so an interval-shaped literal
- * beside a scalar element-typed sibling is the LEGAL interval operand of
- * `pointIn(t, span(...))` and tags as the interval of the sibling's
- * element domain; under every other operator an interval shape against a
- * scalar sibling stays refused (the engine's IllegalComparison — the
- * bug-hunt fix, preserved op-aware).
+ * Tags one host literal at a COMPARISON or PARAM position, where the SIBLING
+ * anchors the type: a measure sibling is u64, an interval-field sibling
+ * contributes its element domain, a scalar sibling its own type. At
+ * `pointIn` the operand order is interval-left, point-right, so an
+ * interval-shaped literal beside a scalar element-typed sibling is the LEGAL
+ * interval operand of `pointIn(t, span(...))`; under every other operator an
+ * interval shape against a scalar sibling stays refused.
  */
 function taggedCmpLiteral(
 	context: string,
@@ -1708,22 +1679,22 @@ interface LowerContext {
 	readonly params: ReadonlyMap<string, ParamEntry>
 }
 
-/** One rule's dense variable numbering: first occurrence in written order. */
+/** One rule's dense variable numbering: first occurrence in written order, keyed on the object REFERENCE. */
 interface VarIds {
-	of(name: string): number
+	of(ref: AnyVar): number
 }
 
 /** Creates one rule-scoped variable numberer. */
-function makeVarIds(): VarIds {
-	const assigned = new Map<string, number>()
+function freshVarIds(): VarIds {
+	const assigned = new Map<AnyVar, number>()
 	return {
-		of(name) {
-			const existing = assigned.get(name)
+		of(ref) {
+			const existing = assigned.get(ref)
 			if (existing !== undefined) {
 				return existing
 			}
 			const id = assigned.size
-			assigned.set(name, id)
+			assigned.set(ref, id)
 			return id
 		}
 	}
@@ -1740,10 +1711,7 @@ function paramIdOf(ctx: LowerContext, name: string): number {
 
 /**
  * Lowers one EDB atom (either polarity). A CLOSED owner lowers through the
- * same edb source — its ordinal is its record-declaration slot exactly like
- * an ordinary relation's — with field ordinals over the SEALED shape: `id`
- * at 0, each payload column at its declared index + 1 (`sealedFieldsOf`
- * carries the shift; the lowering golden pins it).
+ * same edb source, with field ordinals over the SEALED shape.
  */
 function lowerAtom(ctx: LowerContext, atom: AtomData, ids: VarIds): AtomIr {
 	const member = ctx.theory.relations[atom.relation.name]
@@ -1769,17 +1737,12 @@ function lowerAtom(ctx: LowerContext, atom: AtomData, ids: VarIds): AtomIr {
 	return { source: { kind: "edb", relation: relationId }, bindings }
 }
 
-/**
- * Lowers one binding term. A membership ARRAY (`literalSet`) lowers to the
- * existing param-set term over its content-addressed registry entry — the
- * program IR is byte-identical to the same set spelled `r.inSet`; the SDK
- * supplies the translated member set itself at execute (`wireParams`).
- */
+/** Lowers one binding term. A membership ARRAY lowers to the existing param-set term over its content-addressed entry. */
 function lowerBindingTerm(ctx: LowerContext, context: string, binding: BindingEntry, ids: VarIds): TermIr {
 	const bound = binding.term
 	switch (bound.kind) {
 		case "var":
-			return { kind: "var", var: ids.of(bound.name) }
+			return { kind: "var", var: ids.of(bound.ref) }
 		case "param":
 			return { kind: "param", param: paramIdOf(ctx, bound.name) }
 		case "setParam":
@@ -1791,42 +1754,51 @@ function lowerBindingTerm(ctx: LowerContext, context: string, binding: BindingEn
 	}
 }
 
-/** Lowers one idb atom: positional head bindings, `FieldId(i)` = head position i. */
-function lowerIdbAtom(ctx: LowerContext, rec: RecData, vars: readonly string[], ids: VarIds): AtomIr {
+/**
+ * Lowers one idb atom: named bindings placed by HEAD order, `FieldId(i)` =
+ * head position i. Every head column of the rec must be bound (a missing key
+ * is refused pointed); the var-id assignment order is head order, so the
+ * first-use numbering matches the name-keyed edition exactly.
+ */
+function lowerIdbAtom(
+	ctx: LowerContext,
+	rec: RecData,
+	bindings: ReadonlyArray<{ readonly key: string; readonly ref: AnyVar }>,
+	ids: VarIds
+): AtomIr {
 	const pred = ctx.recIds.get(rec)
 	if (pred === undefined) {
 		throw errors.new(`query lowering: rec ${rec.name} was declared by a different program`)
 	}
-	const arity = rec.rules[0]?.select.length
-	if (arity !== undefined && vars.length !== arity) {
-		throw errors.new(`query lowering: idb ${rec.name} takes ${arity} positions, got ${vars.length}`)
+	const head = rec.rules[0]
+	if (head === undefined) {
+		throw errors.new(`query lowering: rec ${rec.name} has no rules`)
 	}
-	const bindings: Array<readonly [number, TermIr]> = vars.map(function lowerPosition(name, position) {
-		return [position, { kind: "var", var: ids.of(name) } as const] as const
+	const irBindings: Array<readonly [number, TermIr]> = head.finds.map(function lowerPosition(column, position) {
+		const binding = bindings.find(function byKey(candidate) {
+			return candidate.key === column.name
+		})
+		if (binding === undefined) {
+			throw errors.new(`query lowering: idb ${rec.name} omits head column ${column.name}`)
+		}
+		return [position, { kind: "var", var: ids.of(binding.ref) } as const] as const
 	})
-	return { source: { kind: "idb", pred }, bindings }
+	return { source: { kind: "idb", pred }, bindings: irBindings }
 }
 
 /** Lowers one comparison side; literals tag by the sibling's anchor (op-aware at `pointIn`). */
-function lowerCmpTerm(
-	ctx: LowerContext,
-	rule: RuleData,
-	side: CmpTermData,
-	sibling: CmpTermData,
-	ids: VarIds,
-	op: CmpKind
-): TermIr {
+function lowerCmpTerm(ctx: LowerContext, side: CmpTermData, sibling: CmpTermData, ids: VarIds, op: CmpKind): TermIr {
 	switch (side.kind) {
 		case "var":
-			return { kind: "var", var: ids.of(side.name) }
+			return { kind: "var", var: ids.of(side.ref) }
 		case "param":
 			return { kind: "param", param: paramIdOf(ctx, side.name) }
 		case "setParam":
 			return { kind: "paramSet", param: paramIdOf(ctx, side.name) }
 		case "measure":
-			return { kind: "measure", var: ids.of(side.name) }
+			return { kind: "measure", var: ids.of(side.ref) }
 		case "literal": {
-			const anchor = cmpAnchorOf(ctx, rule, sibling)
+			const anchor = cmpAnchorOf(ctx, sibling)
 			if (anchor === undefined) {
 				throw errors.new(
 					"query lowering: a comparison literal needs a bound-variable, measure, or anchored-param sibling to type it"
@@ -1837,10 +1809,10 @@ function lowerCmpTerm(
 	}
 }
 
-/** Resolves the anchor a comparison literal tags by: the sibling's field, the measure, or an anchored param. */
-function cmpAnchorOf(ctx: LowerContext, rule: RuleData, sibling: CmpTermData): AnyField | "measure" | undefined {
+/** Resolves the anchor a comparison literal tags by: the sibling variable's field, the measure, or an anchored param. */
+function cmpAnchorOf(ctx: LowerContext, sibling: CmpTermData): AnyField | "measure" | undefined {
 	if (sibling.kind === "var") {
-		return rule.varFields[sibling.name]?.field
+		return sibling.ref.field
 	}
 	if (sibling.kind === "measure") {
 		return "measure"
@@ -1852,7 +1824,7 @@ function cmpAnchorOf(ctx: LowerContext, rule: RuleData, sibling: CmpTermData): A
 }
 
 /** Lowers one comparison. */
-function lowerComparison(ctx: LowerContext, rule: RuleData, cmp: CmpData, ids: VarIds): ComparisonIr {
+function lowerComparison(ctx: LowerContext, cmp: CmpData, ids: VarIds): ComparisonIr {
 	if (cmp.op === "allen") {
 		const maskData = cmp.mask
 		if (maskData === undefined) {
@@ -1864,32 +1836,32 @@ function lowerComparison(ctx: LowerContext, rule: RuleData, cmp: CmpData, ids: V
 				: { kind: "param" as const, param: paramIdOf(ctx, maskData.name) }
 		return {
 			op: { kind: "allen", mask },
-			lhs: lowerCmpTerm(ctx, rule, cmp.lhs, cmp.rhs, ids, "allen"),
-			rhs: lowerCmpTerm(ctx, rule, cmp.rhs, cmp.lhs, ids, "allen")
+			lhs: lowerCmpTerm(ctx, cmp.lhs, cmp.rhs, ids, "allen"),
+			rhs: lowerCmpTerm(ctx, cmp.rhs, cmp.lhs, ids, "allen")
 		}
 	}
 	return {
 		op: { kind: cmp.op },
-		lhs: lowerCmpTerm(ctx, rule, cmp.lhs, cmp.rhs, ids, cmp.op),
-		rhs: lowerCmpTerm(ctx, rule, cmp.rhs, cmp.lhs, ids, cmp.op)
+		lhs: lowerCmpTerm(ctx, cmp.lhs, cmp.rhs, ids, cmp.op),
+		rhs: lowerCmpTerm(ctx, cmp.rhs, cmp.lhs, ids, cmp.op)
 	}
 }
 
 /** Lowers one condition node (comparison leaf or and/or tree). */
-function lowerCondition(ctx: LowerContext, rule: RuleData, cond: CondData, ids: VarIds): ConditionTreeIr {
+function lowerCondition(ctx: LowerContext, cond: CondData, ids: VarIds): ConditionTreeIr {
 	if (cond.kind === "cmp") {
-		return { kind: "leaf", cmp: lowerComparison(ctx, rule, cond, ids) }
+		return { kind: "leaf", cmp: lowerComparison(ctx, cond, ids) }
 	}
 	return {
 		kind: cond.op,
 		children: cond.children.map(function lowerChild(child) {
-			return lowerCondition(ctx, rule, child, ids)
+			return lowerCondition(ctx, child, ids)
 		})
 	}
 }
 
-/** Lowers one select entry to its per-rule find term. */
-function lowerFind(entry: SelectEntryData, ids: VarIds): FindTermIr {
+/** Lowers one find entry to its per-rule find term. */
+function lowerFind(entry: FindEntryData, ids: VarIds): FindTermIr {
 	if (entry.kind === "var") {
 		return { kind: "var", var: ids.of(entry.over) }
 	}
@@ -1903,10 +1875,10 @@ function lowerFind(entry: SelectEntryData, ids: VarIds): FindTermIr {
 		case "countDistinct":
 			return { kind: "aggregate", op: { kind: "countDistinct" }, over: ids.of(agg.over) }
 		case "fold": {
-			if (typeof agg.over === "string") {
-				return { kind: "aggregate", op: { kind: agg.fold }, over: ids.of(agg.over) }
+			if ("duration" in agg.over) {
+				return { kind: "aggregateMeasure", op: { kind: agg.fold }, over: ids.of(agg.over.duration) }
 			}
-			return { kind: "aggregateMeasure", op: { kind: agg.fold }, over: ids.of(agg.over.duration) }
+			return { kind: "aggregate", op: { kind: agg.fold }, over: ids.of(agg.over) }
 		}
 		case "arg":
 			return { kind: "aggregate", op: { kind: agg.direction, key: ids.of(agg.key) }, over: ids.of(agg.over) }
@@ -1931,8 +1903,8 @@ function headOpOf(agg: AggData): HeadOpIr {
 	}
 }
 
-/** One select entry's var-free head shape. */
-function headTermOf(column: SelectColumn): HeadTermIr {
+/** One find entry's var-free head shape. */
+function headTermOf(column: FindColumn): HeadTermIr {
 	const entry = column.entry
 	if (entry.kind === "var" || entry.kind === "measure") {
 		return { kind: "var" }
@@ -1942,7 +1914,7 @@ function headTermOf(column: SelectColumn): HeadTermIr {
 
 /** Lowers one rule: body walked in written order (var ids by first occurrence), finds last. */
 function lowerRule(ctx: LowerContext, rule: RuleData): RuleIr {
-	const ids = makeVarIds()
+	const ids = freshVarIds()
 	const atoms: AtomIr[] = []
 	const negated: AtomIr[] = []
 	const conditions: ConditionTreeIr[] = []
@@ -1957,17 +1929,18 @@ function lowerRule(ctx: LowerContext, rule: RuleData): RuleIr {
 				break
 			}
 			case "idb": {
-				atoms.push(lowerIdbAtom(ctx, item.rec, item.vars, ids))
+				const bucket = item.negated ? negated : atoms
+				bucket.push(lowerIdbAtom(ctx, item.rec, item.bindings, ids))
 				break
 			}
 			case "cond": {
-				conditions.push(lowerCondition(ctx, rule, item.cond, ids))
+				conditions.push(lowerCondition(ctx, item.cond, ids))
 				break
 			}
 		}
 	}
 	return {
-		finds: rule.select.map(function findOf(column) {
+		finds: rule.finds.map(function findOf(column) {
 			return lowerFind(column.entry, ids)
 		}),
 		atoms,
@@ -1979,11 +1952,7 @@ function lowerRule(ctx: LowerContext, rule: RuleData): RuleIr {
 /**
  * Lowers a query value to the bridge's `ProgramIr` — pure and stable: the
  * recs in declaration order (`PredId` = index), the output predicate
- * (rules + head) appended last. Relations lower by declaration ordinal,
- * the law the engine's own manifest pins; `db.prepare` re-verifies the
- * alignment against the live manifest before sending. Every registered
- * param must carry a field anchor by now — an unanchorable param (its
- * every use beside a literal) is refused here, naming it.
+ * appended last. Every registered param must carry a field anchor by now.
  */
 function lowerQuery(q: AnyQuery): ProgramIr {
 	const theory = q.schema
@@ -2013,14 +1982,14 @@ function lowerQuery(q: AnyQuery): ProgramIr {
 			throw errors.new(`query lowering: rec ${rec.name} has no rules`)
 		}
 		return {
-			head: head.select.map(headTermOf),
+			head: head.finds.map(headTermOf),
 			rules: rec.rules.map(function lowerRecRule(rule) {
 				return lowerRule(ctx, rule)
 			})
 		}
 	})
 	predicates.push({
-		head: q.data.select.map(headTermOf),
+		head: q.data.finds.map(headTermOf),
 		rules: q.data.rules.map(function lowerOutputRule(rule) {
 			return lowerRule(ctx, rule)
 		})
@@ -2031,7 +2000,6 @@ function lowerQuery(q: AnyQuery): ProgramIr {
 export type {
 	AnyQuery,
 	AnyRuleValue,
-	HeadFieldsOf,
 	HeadOf,
 	HeadShape,
 	OutputRuleChain,