@bjornpagen/bumbledb 0.5.0 → 0.7.0

package/dist/query/lower.js

@@ -1,38 +1,46 @@
 /**
- * `query()` and the IR lowering, STRUCTURAL edition. A query is built
- * kysely-shaped — `query(S).rule(r => r.match(Rel, { f: r.var("x") })
- * .where(r.eq(r.var("x"), r.param("p"))).select("x"))` — and is an INERT
- * value: `Query<Rels, Row, Params>` with `Row` inferred from each rule's
- * `.select` and `Params` inferred to be EXACTLY the params the rules use
- * (params are typed BY USE; a param value no rule uses never registers, so
- * every query executes under its own inferred type). Vars are string
- * names, domain-typed by the field they first bind and joined by reuse —
- * the rule builder's environment carries name → field descriptor through
- * the chain, checked structurally at every reuse (`JoinOk`), so the old
- * brand-equal join is now the domain-equal compile error. Lowering is a
- * pure function of the query value down to the bridge's `ProgramIr`
- * (`bumbledb/crates/bumbledb/src/ir.rs`, the bijection target): relations
- * by declaration ordinal (the declaration-order-is-ids law the engine's
- * manifest pins), variables by dense per-rule first-occurrence ids
- * (rule-scoped, exactly as the IR scopes them), params by first-use order
- * across the program walk. Lowering is STABLE — the same query value
- * lowers to deeply-equal IR every time, and two identically-written
- * queries lower identically. Construction validates negation safety and
- * name-boundness (typed, naming the variable — earlier and warmer than
- * the engine's refusal); everything else (strata, types, aggregate
- * rosters, rule caps) is the ENGINE's judge, surfacing its typed errors
- * at prepare. No invented limits: rule and predicate counts are never
- * pre-checked here.
+ * `query()` and the IR lowering, REFERENCE-IDENTITY edition. A query is
+ * built kysely-shaped — variables minted by {@link v} outside the rule and
+ * reused by REFERENCE to join:
+ *
+ *   query(S).rule((r) => {
+ *     const acct = v(Account)
+ *     const h = v(Holder)
+ *     return r
+ *       .match(Account, { id: acct.id, holder: acct.holder })
+ *       .match(Holder, { id: acct.holder })
+ *       .where(r.eq(acct.holder, r.param("root")))
+ *       .find({ account: acct.id, holder: acct.holder })
+ *   })
+ *
+ * — and is an INERT value: `Query<Rels, Row, Params>` with `Row` inferred
+ * from each rule's `.find` RECORD (its keys ARE the answer columns) and
+ * `Params` inferred to be EXACTLY the params the rules use (params are typed
+ * BY USE; a param no rule uses never registers). Variable IDENTITY is the
+ * object reference: reusing one value across binding positions IS the join,
+ * and a name-collision join is unrepresentable. Each binding position is
+ * judged against the variable's MINT slot — and because {@link JoinOk} is an
+ * equality, that alone makes every cross-binding join transitively
+ * class-equal. Lowering is a pure function of the query value down to the
+ * bridge's `ProgramIr` (`bumbledb/crates/bumbledb/src/ir.rs`): relations by
+ * declaration ordinal, variables by dense per-rule first-occurrence ids
+ * (keyed on the object REFERENCE — the discipline is unchanged, only the map
+ * key moved from name to reference), params by first-use order. Lowering is
+ * STABLE — the same query value lowers to deeply-equal IR every time, and
+ * two identically-written queries (fresh mints each) lower identically.
+ * Construction validates negation safety and boundness (typed by the var's
+ * label — object identity is invisible to the type tier, so these are
+ * construction-time walls); everything else (strata, types, aggregate
+ * rosters, rule caps) is the ENGINE's judge, surfacing at prepare.
  */
 import * as errors from "@superbuilders/errors";
 import { sealedFieldsOf } from "#closed.ts";
 import { assertDeclarationOrderKey, isIntervalValue, literalShapeError, rosterOf } from "#fields.ts";
 import { allen, and, eq, ge, gt, le, lt, ne, not, or, pointIn } from "#query/atom.ts";
-import { fieldJoins, inferred, isTerm, makeDuration, makeMaskParam, makeParam, makeSetParam, makeVar, renderFieldKind, term } from "#query/scope.ts";
-import { argMax, argMin, count, countDistinct, max, min, pack, sum } from "#query/select.ts";
+import { argMax, argMin, count, countDistinct, max, min, pack, sum } from "#query/find.ts";
+import { fieldJoins, inferred, isTerm, makeDuration, makeMaskParam, makeParam, makeSetParam, renderFieldKind, term } from "#query/scope.ts";
 /** The frozen constructor vocabulary every rule builder spreads. */
 const termOps = Object.freeze({
-    var: makeVar,
     param: makeParam,
     inSet: makeSetParam,
     maskParam: makeMaskParam,
@@ -60,23 +68,28 @@ const termOps = Object.freeze({
 /** The empty rule state. */
 const EMPTY_RULE = Object.freeze({
     items: Object.freeze([]),
-    varFields: Object.freeze({}),
+    bound: new Set(),
     paramUses: Object.freeze([])
 });
+/**
+ * The MINT slot of a variable, the runtime twin of {@link MintSlotOf}: (i)
+ * verifies the mint owner is the schema's own member value — a variable
+ * minted from a foreign relation is refused, naming its label — and (ii)
+ * returns the descriptor it was minted at plus the law-computed class read
+ * off the schema's frozen class map. Because {@link fieldJoins} is an
+ * equality, judging every binding position against this one slot makes all
+ * cross-binding joins mutually class-equal by transitivity.
+ */
+function mintSlotOf(context, ref) {
+    if (context.theory.relations[ref.owner.name] !== ref.owner) {
+        throw errors.new(`the variable ${ref.label} was minted from a relation schema ${context.theory.name} does not declare — mint variables with v() from the schema's own relations`);
+    }
+    return { field: ref.field, class: context.classes[ref.owner.name]?.[ref.column] };
+}
 /**
  * Judges one membership ARRAY at a binding position — legal exactly at a
- * CLOSED-reference field (the owner ruling: ordinary u64/str membership is
- * spelled through `r.inSet` params; literal arrays are the closed
- * vocabulary's spelling), holding ≥ 2 DISTINCT handle names (the
- * degenerate sets are refusals: empty selects nothing, one element is the
- * bare literal respelled, and a duplicate member is the same respelling in
- * disguise — write each member once). The returned name is
- * CONTENT-ADDRESSED (vocabulary + the member SET — the key sorts a copy,
- * so two spellings of one set, reordered or not, share one dense
- * `ParamId`); the members are shape-checked strings here and
- * roster-verified at the one verification point (`taggedHandleId`) when
- * the SDK supplies the set at execute — the same moment a bound `r.inSet`
- * param's members are judged.
+ * CLOSED-reference field, holding ≥ 2 DISTINCT handle names. The returned
+ * name is CONTENT-ADDRESSED (vocabulary + the member SET).
  */
 function membershipSet(context, field, value) {
     const roster = rosterOf(field);
@@ -104,19 +117,18 @@ function membershipSet(context, field, value) {
     return { name: `∈ ${roster.name} ${JSON.stringify(key)}`, members: Object.freeze(members) };
 }
 /**
- * Resolves a bindings record against an atom owner's matchable fields (a
- * relation's declared fields; a closed relation's sealed id + columns), in
+ * Resolves a bindings record against an atom owner's matchable fields, in
  * the record's written order: terms classify by their runtime tag,
- * everything else is a bare literal (typed by the FIELD at lowering — the
- * membership typing rule included). Every bound field carries its
- * law-computed class, read off the schema value's frozen class map — the
- * runtime twin of the type tier's `SlotAt` lookups.
+ * everything else is a bare literal. Every VARIABLE binding judges
+ * `fieldJoins(mintSlot, positionSlot)` and throws on a class-unequal reuse
+ * (the runtime twin of `CheckBindings`); the bound refs are collected for
+ * the rule's boundness set.
  */
-function resolveBindings(context, relation, bindings, classes) {
+function resolveBindings(context, label, relation, bindings) {
     const entries = [];
     const vars = [];
     const uses = [];
-    const relationClasses = classes[relation.name];
+    const relationClasses = context.classes[relation.name];
     const ordered = sealedFieldsOf(relation);
     for (const [fieldName, value] of Object.entries(bindings)) {
         if (value === undefined) {
@@ -126,15 +138,21 @@ function resolveBindings(context, relation, bindings, classes) {
             return candidate.name === fieldName;
         });
         if (declared === undefined) {
-            throw errors.new(`${context} has no field ${fieldName}`);
+            throw errors.new(`${label} has no field ${fieldName}`);
         }
         const fieldClass = relationClasses?.[fieldName];
         let bound;
         if (isTerm(value)) {
             switch (value[term]) {
                 case "var": {
-                    bound = Object.freeze({ kind: "var", name: value.name });
-                    vars.push(Object.freeze({ name: value.name, slot: Object.freeze({ field: declared.field, class: fieldClass }) }));
+                    const ref = value;
+                    const mint = mintSlotOf(context, ref);
+                    const positionSlot = { field: declared.field, class: fieldClass };
+                    if (!fieldJoins(mint, positionSlot)) {
+                        throw errors.new(`${label}: the variable ${ref.label} joins domain-unequal fields — minted at ${renderFieldKind(mint)}, reused at ${renderFieldKind(positionSlot)} (a var joins only class-equal slots; bare pairs only with bare)`);
+                    }
+                    bound = Object.freeze({ kind: "var", ref });
+                    vars.push(ref);
                     break;
                 }
                 case "param": {
@@ -160,13 +178,13 @@ function resolveBindings(context, relation, bindings, classes) {
                     break;
                 }
                 case "maskParam":
-                    throw errors.new(`${context}.${fieldName}: an Allen-mask param is not a field-typed value — masks live in allen() conditions only`);
+                    throw errors.new(`${label}.${fieldName}: an Allen-mask param is not a field-typed value — masks live in allen() conditions only`);
                 case "duration":
-                    throw errors.new(`${context}.${fieldName}: the measure is not a field-typed value — it lives in comparisons and select entries`);
+                    throw errors.new(`${label}.${fieldName}: the measure is not a field-typed value — it lives in comparisons and find entries`);
             }
         }
         else if (Array.isArray(value)) {
-            const set = membershipSet(`${context}.${fieldName}`, declared.field, value);
+            const set = membershipSet(`${label}.${fieldName}`, declared.field, value);
             bound = Object.freeze({ kind: "literalSet", name: set.name, members: set.members });
             uses.push(Object.freeze({
                 name: set.name,
@@ -181,49 +199,33 @@ function resolveBindings(context, relation, bindings, classes) {
         }
         entries.push(Object.freeze({ field: fieldName, data: declared.field, class: fieldClass, term: bound }));
     }
-    return {
-        atom: Object.freeze({ relation, bindings: Object.freeze(entries) }),
-        vars,
-        uses
-    };
+    return { atom: Object.freeze({ relation, bindings: Object.freeze(entries) }), vars, uses };
 }
-/**
- * Extends a rule state with one positive atom. Vars bind on first
- * occurrence; every LATER occurrence (a later atom's field or a same-record
- * sibling) is a join and must be class-equal — the construction-time twin
- * of the type tier's `JoinOk` (bare pairs only with bare), so the domain
- * wall holds for untyped callers too.
- */
-function advanceMatch(state, relation, bindings, classes) {
-    const resolved = resolveBindings(`relation ${relation.name}`, relation, bindings, classes);
-    const varFields = { ...state.varFields };
-    for (const bound of resolved.vars) {
-        const existing = varFields[bound.name];
-        if (existing === undefined) {
-            varFields[bound.name] = bound.slot;
-        }
-        else if (!fieldJoins(existing, bound.slot)) {
-            throw errors.new(`relation ${relation.name}: the variable ${bound.name} joins domain-unequal fields — first bound at ${renderFieldKind(existing)}, reused at ${renderFieldKind(bound.slot)} (a var joins only class-equal slots; bare pairs only with bare)`);
-        }
+/** Extends a rule state with one positive atom; the bound variable references accumulate into the boundness set. */
+function advanceMatch(context, state, relation, bindings) {
+    const resolved = resolveBindings(context, `relation ${relation.name}`, relation, bindings);
+    const bound = new Set(state.bound);
+    for (const ref of resolved.vars) {
+        bound.add(ref);
     }
-    return {
+    return Object.freeze({
         items: Object.freeze([...state.items, Object.freeze({ kind: "atom", atom: resolved.atom })]),
-        varFields: Object.freeze(varFields),
+        bound,
         paramUses: Object.freeze([...state.paramUses, ...resolved.uses])
-    };
+    });
 }
-/** Resolves one comparison side to its runtime term. */
+/** Resolves one comparison side to its runtime term (variables and the measure ride by reference). */
 function cmpTermDataOf(op, value) {
     if (isTerm(value)) {
         switch (value[term]) {
             case "var":
-                return Object.freeze({ kind: "var", name: value.name });
+                return Object.freeze({ kind: "var", ref: value });
             case "param":
                 return Object.freeze({ kind: "param", name: value.name });
             case "setParam":
                 return Object.freeze({ kind: "setParam", name: value.name });
             case "duration":
-                return Object.freeze({ kind: "measure", name: value.name });
+                return Object.freeze({ kind: "measure", ref: value.over });
             case "maskParam":
                 throw errors.new(`${op}: an Allen-mask param is not a comparison term — masks live in allen()'s mask position`);
         }
@@ -232,17 +234,16 @@ function cmpTermDataOf(op, value) {
 }
 /**
  * One comparison side's contribution to the param census: a param/set side
- * anchors to its SIBLING — a bound variable's field descriptor or the
- * measure; an unanchorable use (literal or param sibling) records with no
- * anchor and must be anchored by some other use of the same name.
+ * anchors to its SIBLING — a variable's field descriptor or the measure; an
+ * unanchorable use records with no anchor.
  */
-function sideUses(op, side, sibling, varFields, uses) {
+function sideUses(op, side, sibling, uses) {
     if (side.kind !== "param" && side.kind !== "setParam") {
         return;
     }
     let anchor;
     if (sibling.kind === "var") {
-        anchor = varFields[sibling.name]?.field;
+        anchor = sibling.ref.field;
     }
     else if (sibling.kind === "measure") {
         anchor = "measure";
@@ -259,12 +260,12 @@ function sideUses(op, side, sibling, varFields, uses) {
     }));
 }
 /** Lowers one condition VALUE to its runtime data, recording param uses. */
-function condDataOf(cond, varFields, uses) {
+function condDataOf(cond, uses) {
     if (cond.cond === "cmp") {
         const lhs = cmpTermDataOf(cond.op, cond.lhs);
         const rhs = cmpTermDataOf(cond.op, cond.rhs);
-        sideUses(cond.op, lhs, rhs, varFields, uses);
-        sideUses(cond.op, rhs, lhs, varFields, uses);
+        sideUses(cond.op, lhs, rhs, uses);
+        sideUses(cond.op, rhs, lhs, uses);
         let mask;
         if (cond.op === "allen") {
             const maskValue = cond.mask;
@@ -285,213 +286,217 @@ function condDataOf(cond, varFields, uses) {
                 throw errors.new("allen: the mask position takes a 13-bit mask number or a maskParam");
             }
         }
-        const data = Object.freeze({ kind: "cmp", op: cond.op, mask, lhs, rhs });
-        return data;
+        return Object.freeze({ kind: "cmp", op: cond.op, mask, lhs, rhs });
     }
     if (cond.cond === "tree") {
         const children = cond.children.map(function lowerChild(child) {
-            return condDataOf(child, varFields, uses);
+            return condDataOf(child, uses);
         });
-        const data = Object.freeze({ kind: "tree", op: cond.op, children: Object.freeze(children) });
-        return data;
+        return Object.freeze({ kind: "tree", op: cond.op, children: Object.freeze(children) });
     }
     throw errors.new("a negated atom is not a condition-tree node — pass not(...) to where() directly, never inside and()/or()");
 }
 /** Extends a rule state with one `.where` item (a condition or a negated atom). */
-function advanceWhere(state, cond, classes) {
+function advanceWhere(context, state, cond) {
     if (typeof cond !== "object" || cond === null || !("cond" in cond)) {
         throw errors.new("where() takes a comparison, an and()/or() tree, or a negated atom");
     }
+    if (cond.cond === "notIdb") {
+        const bindings = Object.fromEntries(Object.entries(cond.bindings ?? {}).filter(function defined([, value]) {
+            return value !== undefined;
+        }));
+        return notIdbAdvance(context, state, cond.target, bindings);
+    }
     if (cond.cond === "not") {
         const relation = cond.relation;
         const bindings = Object.fromEntries(Object.entries(cond.bindings ?? {}).filter(function defined([, value]) {
             return value !== undefined;
         }));
-        const resolved = resolveBindings(`negated relation ${relation.name}`, relation, bindings, classes);
-        return {
+        const resolved = resolveBindings(context, `negated relation ${relation.name}`, relation, bindings);
+        return Object.freeze({
             items: Object.freeze([...state.items, Object.freeze({ kind: "negated", atom: resolved.atom })]),
-            varFields: state.varFields,
+            bound: state.bound,
             paramUses: Object.freeze([...state.paramUses, ...resolved.uses])
-        };
+        });
     }
     const uses = [];
-    const data = condDataOf(cond, state.varFields, uses);
-    return {
+    const data = condDataOf(cond, uses);
+    return Object.freeze({
         items: Object.freeze([...state.items, Object.freeze({ kind: "cond", cond: data })]),
-        varFields: state.varFields,
+        bound: state.bound,
         paramUses: Object.freeze([...state.paramUses, ...uses])
-    };
-}
-/** Extends a rule state with one `idb` atom (vars must be bound — validated at completion). */
-function advanceIdb(state, rec, vars) {
-    const names = vars.map(function nameOf(variable) {
-        if (!isTerm(variable) || variable[term] !== "var") {
-            throw errors.new(`idb ${rec.name}: positions take variables — bind literals and params through where()/match()`);
-        }
-        return variable.name;
     });
-    return {
-        items: Object.freeze([...state.items, Object.freeze({ kind: "idb", rec, vars: Object.freeze(names) })]),
-        varFields: state.varFields,
-        paramUses: state.paramUses
-    };
-}
-/** Narrows a select entry to an aggregate value. */
-function isAggregateEntry(value) {
-    return typeof value === "object" && value !== null && "agg" in value;
 }
 /**
- * Classifies one select entry into its named answer column. The `closed`
- * slice is resolved LATER, at rule completion (`completeRule`), where the
- * rule's `varFields` are in hand — until then every column is provisionally
- * bare.
+ * Extends a rule state with one `idb` atom (a named record over head keys;
+ * vars validated at completion). A POSITIVE idb atom is a positive
+ * occurrence exactly as the engine represents it (`check_atoms` walks Idb
+ * and Edb in one loop), so its variables GROUND: they enter the rule's
+ * boundness set, may ride the head, and satisfy negation safety — the
+ * idb-only identity projection of a finished stratum is spellable with no
+ * re-grounding join. A NEGATED one binds nothing, only rejects.
  */
-function selectColumnOf(entry) {
-    if (typeof entry === "string") {
-        return Object.freeze({
-            name: entry,
-            entry: Object.freeze({ kind: "var", over: entry }),
-            closed: undefined
-        });
-    }
-    if (isTerm(entry)) {
-        if (entry[term] === "duration") {
-            return Object.freeze({
-                name: entry.name,
-                entry: Object.freeze({ kind: "measure", over: entry.name }),
-                closed: undefined
-            });
+function advanceIdb(state, rec, bindings, negated) {
+    const resolved = [];
+    for (const [key, value] of Object.entries(bindings)) {
+        if (value === undefined) {
+            continue;
+        }
+        if (!isTerm(value) || value[term] !== "var") {
+            throw errors.new(`idb ${rec.name}: position ${key} takes a variable — bind literals and params through where()/match()`);
         }
-        throw errors.new(`query select: a ${entry[term]} is not projectable — select takes variable names, duration(v), or aggregates`);
+        resolved.push(Object.freeze({ key, ref: value }));
     }
-    if (isAggregateEntry(entry)) {
-        return aggregateColumnOf(entry);
+    const bound = new Set(state.bound);
+    if (!negated) {
+        for (const binding of resolved) {
+            bound.add(binding.ref);
+        }
     }
-    throw errors.new("query select: not a select entry — select takes variable names, duration(v), or aggregates");
+    return Object.freeze({
+        items: Object.freeze([
+            ...state.items,
+            Object.freeze({ kind: "idb", rec, bindings: Object.freeze(resolved), negated })
+        ]),
+        bound,
+        paramUses: state.paramUses
+    });
 }
-/** Classifies one aggregate select entry. */
-function aggregateColumnOf(entry) {
-    function column(name, agg) {
-        return Object.freeze({
-            name,
-            entry: Object.freeze({ kind: "aggregate", agg: Object.freeze(agg) }),
-            closed: undefined
-        });
+/** Narrows a find entry to an aggregate value. */
+function isAggregateEntry(value) {
+    return typeof value === "object" && value !== null && "agg" in value;
+}
+/** Narrows a value to a variable term, else a pointed refusal. */
+function asVarTerm(context, value) {
+    if (isTerm(value) && value[term] === "var") {
+        return value;
     }
+    throw errors.new(`${context}: expected a variable`);
+}
+/** Classifies one aggregate find entry into its runtime data (variables ride by reference). */
+function aggDataOf(name, entry) {
     const over = entry.over;
     switch (entry.agg) {
         case "count":
-            return column("count", { op: "count" });
-        case "countDistinct": {
-            if (typeof over !== "string") {
-                throw errors.new("countDistinct takes a variable name");
-            }
-            return column(over, { op: "countDistinct", over });
-        }
+            return Object.freeze({ op: "count" });
+        case "countDistinct":
+            return Object.freeze({ op: "countDistinct", over: asVarTerm(`find ${name} (countDistinct)`, over) });
         case "sum":
         case "min":
         case "max": {
-            if (typeof over === "string") {
-                return column(over, { op: "fold", fold: entry.agg, over });
+            if (isTerm(over) && over[term] === "var") {
+                return Object.freeze({ op: "fold", fold: entry.agg, over });
             }
             if (isTerm(over) && over[term] === "duration") {
-                return column(over.name, { op: "fold", fold: entry.agg, over: Object.freeze({ duration: over.name }) });
+                return Object.freeze({ op: "fold", fold: entry.agg, over: Object.freeze({ duration: over.over }) });
             }
-            throw errors.new(`${entry.agg} takes a variable name or duration(v)`);
+            throw errors.new(`find ${name} (${entry.agg}): takes a variable or r.duration(v)`);
         }
         case "argMax":
-        case "argMin": {
-            if (typeof over !== "string" || typeof entry.key !== "string") {
-                throw errors.new(`${entry.agg} takes a carried variable name and an orderable key variable name`);
-            }
-            return column(over, { op: "arg", direction: entry.agg, over, key: entry.key });
+        case "argMin":
+            return Object.freeze({
+                op: "arg",
+                direction: entry.agg,
+                over: asVarTerm(`find ${name} (${entry.agg})`, over),
+                key: asVarTerm(`find ${name} (${entry.agg} key)`, entry.key)
+            });
+        case "pack":
+            return Object.freeze({ op: "pack", over: asVarTerm(`find ${name} (pack)`, over) });
+        default:
+            throw errors.new(`find ${name}: unknown aggregate ${entry.agg}`);
+    }
+}
+/**
+ * Classifies one find entry into its named answer column (the KEY names the
+ * column, `count` included). The `slot`/`closed` slices are resolved LATER,
+ * at rule completion, where boundness and the mint slots are in hand.
+ */
+function findColumnOf(name, entry) {
+    if (isTerm(entry)) {
+        if (entry[term] === "var") {
+            return Object.freeze({
+                name,
+                entry: Object.freeze({ kind: "var", over: entry }),
+                closed: undefined,
+                slot: undefined
+            });
         }
-        case "pack": {
-            if (typeof over !== "string") {
-                throw errors.new("pack takes a variable name");
-            }
-            return column(over, { op: "pack", over });
+        if (entry[term] === "duration") {
+            return Object.freeze({
+                name,
+                entry: Object.freeze({ kind: "measure", over: entry.over }),
+                closed: undefined,
+                slot: undefined
+            });
         }
-        default:
-            throw errors.new(`unknown aggregate ${entry.agg}`);
+        throw errors.new(`find ${name}: a ${entry[term]} is not projectable — find takes variables, r.duration(v), or aggregates`);
+    }
+    if (isAggregateEntry(entry)) {
+        return Object.freeze({
+            name,
+            entry: Object.freeze({ kind: "aggregate", agg: aggDataOf(name, entry) }),
+            closed: undefined,
+            slot: undefined
+        });
     }
+    throw errors.new(`find ${name}: not a find entry — find takes variables, r.duration(v), or aggregates`);
 }
 /**
  * The orderable ban's pointed refusal (`docs/architecture/10-data-model.md`
- * § orderability): a closed reference is equality-and-membership only —
- * its declaration-id order is an encoding accident, so every
- * order-comparison and fold position refuses it. The construction-time
- * twin of the type tier's `OrderVarOk` exclusion, so the wall holds for
- * untyped callers too (the engine cannot backstop this one: the wire IR
- * carries plain u64s, no rosters).
+ * § orderability): a closed reference is equality-and-membership only.
  */
 function closedOrderError(context, position, vocabulary) {
     return errors.new(`${context}: ${position} is a ${vocabulary} reference — declaration order is an accident, not semantics: vocabularies do not order (docs/architecture/10-data-model.md; equality, membership, and counting remain)`);
 }
-/** The comparison ops under the orderable ban (order roster + point membership — every order-comparison position). */
+/** The comparison ops under the orderable ban (order roster + point membership). */
 function isOrderOp(op) {
     return op === "lt" || op === "le" || op === "gt" || op === "ge" || op === "pointIn";
 }
-/** Requires a var name to be bound by a relation atom of the rule. */
-function assertBound(context, varFields, name) {
-    const slot = varFields[name];
-    if (slot === undefined) {
-        throw errors.new(`${context}: the variable ${name} is not bound by a relation atom of the rule`);
+/** Requires a variable to be bound by a relation atom of the rule (the boundness wall — invisible to the type tier). */
+function assertBound(where, bound, ref) {
+    if (!bound.has(ref)) {
+        throw errors.new(`${where}: the variable ${ref.label} is not bound by a relation atom of the rule`);
     }
-    return slot;
 }
-/** Requires a var name to be bound at an interval field (the measure's and pack's domain). */
-function assertIntervalBound(context, varFields, name) {
-    const slot = assertBound(context, varFields, name);
-    if (slot.field.kind !== "interval") {
-        throw errors.new(`${context}: ${name} is not interval-typed — the measure is defined over interval-typed variables only`);
+/** Requires a variable to be interval-typed (the measure's and pack's domain), off its own descriptor. */
+function assertInterval(where, ref) {
+    if (ref.field.kind !== "interval") {
+        throw errors.new(`${where}: ${ref.label} is not interval-typed — the measure is defined over interval-typed variables only`);
+    }
+}
+/** Requires a variable's own field to be non-closed (the orderable ban's runtime twin). */
+function assertNotClosed(where, position, ref) {
+    const roster = rosterOf(ref.field);
+    if (roster !== undefined) {
+        throw closedOrderError(where, `${position} ${ref.label}`, roster.name);
     }
 }
 /**
- * Validates one condition's variable references against the rule's bound
- * names — and, for `eq`/`ne` over two variables, holds the class wall: the
- * unification IS a join, so the two slots must be class-equal exactly as a
- * match-reuse join must be (the construction-time twin of the type tier's
- * `EqOk` → `JoinOk`; bare pairs only with bare). The engine cannot backstop
- * this one — the query IR carries no domains — so the wall lives here for
- * untyped callers too.
+ * The classed mint slot one answer column's VALUES flow from: a projected
+ * variable's mint slot, or an Arg-carried payload's. Counts, folds, `pack`
+ * and the measure derive numbers/intervals, so they resolve no slot.
  */
-function validateCond(context, varFields, cond) {
-    if (cond.kind === "cmp") {
-        for (const side of [cond.lhs, cond.rhs]) {
-            if (side.kind === "var") {
-                const slot = assertBound(context, varFields, side.name);
-                const roster = rosterOf(slot.field);
-                if (isOrderOp(cond.op) && roster !== undefined) {
-                    throw closedOrderError(context, `the ${cond.op} side ${side.name}`, roster.name);
-                }
-            }
-            if (side.kind === "measure") {
-                assertIntervalBound(context, varFields, side.name);
-            }
-        }
-        if ((cond.op === "eq" || cond.op === "ne") && cond.lhs.kind === "var" && cond.rhs.kind === "var") {
-            const lhs = assertBound(context, varFields, cond.lhs.name);
-            const rhs = assertBound(context, varFields, cond.rhs.name);
-            if (!fieldJoins(lhs, rhs)) {
-                throw errors.new(`${context}: ${cond.op}(${cond.lhs.name}, ${cond.rhs.name}) unifies domain-unequal fields — ${cond.lhs.name} bound at ${renderFieldKind(lhs)}, ${cond.rhs.name} at ${renderFieldKind(rhs)} (a var joins only class-equal slots; bare pairs only with bare)`);
-            }
-        }
-        return;
+function findColumnSlotOf(context, column) {
+    const entry = column.entry;
+    if (entry.kind === "var") {
+        return mintSlotOf(context, entry.over);
     }
-    for (const child of cond.children) {
-        validateCond(context, varFields, child);
+    if (entry.kind === "aggregate" && entry.agg.op === "arg") {
+        return mintSlotOf(context, entry.agg.over);
     }
+    return undefined;
 }
-/** Validates one select column's variable references. */
-function validateColumn(context, varFields, column) {
+/** Validates one find column's variable references (boundness + the orderable/interval walls, off the var's own field). */
+function validateColumn(context, bound, column) {
+    const where = `${contextLabel(context)} find ${column.name}`;
     const entry = column.entry;
     if (entry.kind === "var") {
-        assertBound(`${context} select ${column.name}`, varFields, entry.over);
+        assertBound(where, bound, entry.over);
         return;
     }
     if (entry.kind === "measure") {
-        assertIntervalBound(`${context} select ${column.name}`, varFields, entry.over);
+        assertBound(where, bound, entry.over);
+        assertInterval(where, entry.over);
         return;
     }
     const agg = entry.agg;
@@ -499,128 +504,146 @@ function validateColumn(context, varFields, column) {
         case "count":
             return;
         case "countDistinct":
-            assertBound(`${context} select ${column.name}`, varFields, agg.over);
+            assertBound(where, bound, agg.over);
             return;
         case "fold": {
-            if (typeof agg.over === "string") {
-                const slot = assertBound(`${context} select ${column.name}`, varFields, agg.over);
-                const roster = rosterOf(slot.field);
-                if (roster !== undefined) {
-                    throw closedOrderError(`${context} select ${column.name}`, `the ${agg.fold} input ${agg.over}`, roster.name);
-                }
+            if ("duration" in agg.over) {
+                assertBound(where, bound, agg.over.duration);
+                assertInterval(where, agg.over.duration);
                 return;
             }
-            assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over.duration);
+            assertBound(where, bound, agg.over);
+            assertNotClosed(where, `the ${agg.fold} input`, agg.over);
             return;
         }
         case "arg": {
-            assertBound(`${context} select ${column.name}`, varFields, agg.over);
-            const key = assertBound(`${context} select ${column.name}`, varFields, agg.key);
-            const keyRoster = rosterOf(key.field);
-            if (keyRoster !== undefined) {
-                throw closedOrderError(`${context} select ${column.name}`, `the ${agg.direction} key ${agg.key}`, keyRoster.name);
-            }
+            assertBound(where, bound, agg.over);
+            assertBound(where, bound, agg.key);
+            assertNotClosed(where, `the ${agg.direction} key`, agg.key);
             return;
         }
         case "pack":
-            assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over);
+            assertBound(where, bound, agg.over);
+            assertInterval(where, agg.over);
             return;
     }
 }
 /**
- * Resolves the roster one select column decodes through: a projected var,
- * or an Arg-carried payload, bound at a closed-referencing field carries
- * that field's roster (read off `varFields` — the same slot the domain
- * machinery reads), and `decodeAnswers` lifts the column's row ids back to
- * handle NAMES through it — the runtime twin of the row type's `Infer`
- * claim. Every other entry decodes bare: counts are counts, the measure
- * and `pack` are never closed, and a closed FOLD is banned outright
- * ({@link closedOrderError}) before this resolution runs.
+ * Validates one condition's variable references against the rule's bound
+ * set — and, for `eq`/`ne` over two variables, holds the class wall through
+ * the mint slots (the unification IS a join; bare pairs only with bare).
  */
-function selectClosedOf(varFields, entry) {
-    let over;
-    if (entry.kind === "var") {
-        over = entry.over;
-    }
-    else if (entry.kind === "aggregate" && entry.agg.op === "arg") {
-        over = entry.agg.over;
-    }
-    else {
-        over = undefined;
+function validateCond(context, bound, cond) {
+    const label = contextLabel(context);
+    if (cond.kind === "cmp") {
+        for (const side of [cond.lhs, cond.rhs]) {
+            if (side.kind === "var") {
+                assertBound(label, bound, side.ref);
+                const roster = rosterOf(side.ref.field);
+                if (isOrderOp(cond.op) && roster !== undefined) {
+                    throw closedOrderError(label, `the ${cond.op} side ${side.ref.label}`, roster.name);
+                }
+            }
+            if (side.kind === "measure") {
+                assertBound(label, bound, side.ref);
+                assertInterval(label, side.ref);
+            }
+        }
+        if ((cond.op === "eq" || cond.op === "ne") && cond.lhs.kind === "var" && cond.rhs.kind === "var") {
+            assertBound(label, bound, cond.lhs.ref);
+            assertBound(label, bound, cond.rhs.ref);
+            const lhs = mintSlotOf(context, cond.lhs.ref);
+            const rhs = mintSlotOf(context, cond.rhs.ref);
+            if (!fieldJoins(lhs, rhs)) {
+                throw errors.new(`${label}: ${cond.op}(${cond.lhs.ref.label}, ${cond.rhs.ref.label}) unifies domain-unequal fields — ${cond.lhs.ref.label} bound at ${renderFieldKind(lhs)}, ${cond.rhs.ref.label} at ${renderFieldKind(rhs)} (a var joins only class-equal slots; bare pairs only with bare)`);
+            }
+        }
+        return;
     }
-    if (over === undefined) {
-        return undefined;
+    for (const child of cond.children) {
+        validateCond(context, bound, child);
     }
-    return rosterOf(varFields[over]?.field);
 }
 /**
- * Completes one rule: classifies the select record (written order = answer
- * column order, names must be declaration-order-safe keys), and validates
- * boundness — every condition/select/idb variable bound by a relation atom,
- * and every NEGATED atom's variable positively bound (the safety rule: a
- * negated atom binds nothing, only rejects).
+ * Validates one `idb` item: every head column of the rec is bound exactly
+ * once (a missing or extra key is a pointed error) and each variable joins
+ * its head column's classed slot. A POSITIVE idb atom GROUNDS its
+ * variables (a positive occurrence, exactly the engine's representation),
+ * so no boundness precondition exists; a NEGATED one binds nothing — its
+ * variables must be positively bound elsewhere in the rule, the same
+ * safety rule as EDB negation. When the rec's own rule 0 is in flight
+ * (`rec.rules[0]` absent), the completing rule's OWN find columns ARE the
+ * head.
  */
-function completeRule(context, state, columns) {
-    if (columns.length === 0) {
-        throw errors.new(`${context}: a select needs at least one entry`);
+function validateIdb(context, bound, item, columns) {
+    const label = contextLabel(context);
+    const head = item.rec.rules[0];
+    const headColumns = head !== undefined ? head.finds : columns;
+    const headNames = headColumns.map(function nameOf(column) {
+        return column.name;
+    });
+    const keys = item.bindings.map(function keyOf(binding) {
+        return binding.key;
+    });
+    for (const key of keys) {
+        if (!headNames.includes(key)) {
+            throw errors.new(`${label}: idb ${item.rec.name} binds ${key}, not a head column of ${item.rec.name} (head columns: ${headNames.join(", ")})`);
+        }
     }
-    const seen = new Set();
-    for (const column of columns) {
-        assertDeclarationOrderKey(`${context} select column`, column.name);
-        if (seen.has(column.name)) {
-            throw errors.new(`${context}: select names the answer column ${column.name} twice`);
+    for (const name of headNames) {
+        if (!keys.includes(name)) {
+            throw errors.new(`${label}: idb ${item.rec.name} omits the head column ${name} — an idb join binds every head column of ${item.rec.name}`);
         }
-        seen.add(column.name);
-        validateColumn(context, state.varFields, column);
     }
+    for (const binding of item.bindings) {
+        if (item.negated && !bound.has(binding.ref)) {
+            throw errors.new(`${label}: negated idb ${item.rec.name} names the variable ${binding.ref.label}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`);
+        }
+        const headColumn = headColumns.find(function byName(column) {
+            return column.name === binding.key;
+        });
+        if (headColumn === undefined || headColumn.slot === undefined) {
+            continue;
+        }
+        const mint = mintSlotOf(context, binding.ref);
+        if (!fieldJoins(headColumn.slot, mint)) {
+            throw errors.new(`${label}: idb ${item.rec.name} joins the variable ${binding.ref.label} (${renderFieldKind(mint)}) at head column ${binding.key} (${renderFieldKind(headColumn.slot)}) — a var joins only class-equal slots; bare pairs only with bare`);
+        }
+    }
+}
+/**
+ * Completes one rule: enriches the find columns (declaration-order-safe
+ * keys, boundness validated, each column's classed slot and closed slice
+ * resolved), then walks the body walls — negated-atom boundness safety, idb
+ * head pairing, and condition validation.
+ */
+function completeRule(context, state, rawColumns) {
+    const label = contextLabel(context);
+    if (rawColumns.length === 0) {
+        throw errors.new(`${label}: a find needs at least one entry`);
+    }
+    const columns = rawColumns.map(function enrichColumn(column) {
+        assertDeclarationOrderKey(`${label} find column`, column.name);
+        validateColumn(context, state.bound, column);
+        const slot = findColumnSlotOf(context, column);
+        return Object.freeze({ name: column.name, entry: column.entry, slot, closed: rosterOf(slot?.field) });
+    });
     for (const item of state.items) {
         if (item.kind === "negated") {
             for (const binding of item.atom.bindings) {
-                if (binding.term.kind === "var") {
-                    const bound = state.varFields[binding.term.name];
-                    if (bound === undefined) {
-                        throw errors.new(`${context}: negated ${item.atom.relation.name} atom binds the variable ${binding.term.name} at position ${binding.field}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`);
-                    }
-                    const negatedSlot = { field: binding.data, class: binding.class };
-                    if (!fieldJoins(bound, negatedSlot)) {
-                        throw errors.new(`${context}: negated ${item.atom.relation.name} atom reuses the variable ${binding.term.name} at ${binding.field} (${renderFieldKind(negatedSlot)}), but the rule binds it at ${renderFieldKind(bound)} — a var joins only class-equal slots; bare pairs only with bare`);
-                    }
+                if (binding.term.kind === "var" && !state.bound.has(binding.term.ref)) {
+                    throw errors.new(`${label}: negated ${item.atom.relation.name} atom binds the variable ${binding.term.ref.label} at position ${binding.field}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`);
                 }
             }
         }
         if (item.kind === "idb") {
-            const head = item.rec.rules[0];
-            item.vars.forEach(function checkIdbVar(name, position) {
-                const bound = state.varFields[name];
-                if (bound === undefined) {
-                    throw errors.new(`${context}: idb ${item.rec.name} names the variable ${name}, but no relation atom of the rule binds it — an idb atom is a join position; bind the variable through the theory's own relation first`);
-                }
-                const column = head?.select[position];
-                if (column === undefined || column.entry.kind !== "var") {
-                    return;
-                }
-                const headSlot = head?.varFields[column.entry.over];
-                if (headSlot !== undefined && !fieldJoins(headSlot, bound)) {
-                    throw errors.new(`${context}: idb ${item.rec.name} joins the variable ${name} (${renderFieldKind(bound)}) at head position ${position} (${column.name}: ${renderFieldKind(headSlot)}) — a var joins only class-equal slots; bare pairs only with bare`);
-                }
-            });
+            validateIdb(context, state.bound, item, columns);
         }
         if (item.kind === "cond") {
-            validateCond(context, state.varFields, item.cond);
+            validateCond(context, state.bound, item.cond);
         }
     }
-    return Object.freeze({
-        items: state.items,
-        select: Object.freeze(columns.map(function enrichColumn(column) {
-            return Object.freeze({
-                name: column.name,
-                entry: column.entry,
-                closed: selectClosedOf(state.varFields, column.entry)
-            });
-        })),
-        varFields: state.varFields,
-        paramUses: state.paramUses
-    });
+    return Object.freeze({ items: state.items, finds: Object.freeze(columns), paramUses: state.paramUses });
 }
 /** Builds one typed rule value over completed rule data. */
 function makeRuleValue(rule) {
@@ -638,7 +661,7 @@ function contextLabel(context) {
     }
 }
 /** Validates and records one `idb` atom per the context's cut. */
-function idbAdvance(context, state, target, vars) {
+function idbAdvance(context, state, target, bindings) {
     if (context.kind === "query") {
         throw errors.new("idb is a program construct — declare recs and outputs through program(), never a plain query()");
     }
@@ -646,36 +669,60 @@ function idbAdvance(context, state, target, vars) {
         if (target.data !== context.self) {
             throw errors.new(`rec ${context.self.name}: a recursive rule's idb target must be the rec itself — the self-recursion-only cut (mutual recursion is unwritable; fold a finished stratum in the output rules)`);
         }
-        return advanceIdb(state, context.self, vars);
+        return advanceIdb(state, context.self, bindings, false);
     }
     if (!context.program.recs.includes(target.data)) {
         throw errors.new(`idb ${target.name}: the rec was declared by a different program — rec identity is the membership rule`);
     }
-    return advanceIdb(state, target.data, vars);
+    return advanceIdb(state, target.data, bindings, false);
 }
-/** Classifies one select tuple per the context (a recursive head projects bound NAMES only). */
-function selectColumns(context, entries) {
-    return entries.map(function columnOf(entry) {
-        if (context.kind === "rec" && typeof entry !== "string") {
-            throw errors.new(`rec ${context.self.name}: a recursive head projects bound variable NAMES only — aggregates and the measure read finished sets (the strata judge's quarantine, unwritable here)`);
+/**
+ * Validates and records one NEGATED finished-stratum atom — output rules
+ * only: there every rec is a finished set before the output's operator
+ * runs (negation OF lower strata is engine-legal; the strata judge refuses
+ * only negation *through* a cycle, which the rec-context refusal here
+ * makes unwritable).
+ */
+function notIdbAdvance(context, state, target, bindings) {
+    if (context.kind === "query") {
+        throw errors.new("idb is a program construct — declare recs and outputs through program(), never a plain query()");
+    }
+    if (context.kind === "rec") {
+        throw errors.new(`rec ${context.self.name}: a recursive rule negates no stratum — self-negation is negation through the cycle (a finished set is what keeps the operator monotone), and a finished stratum's fold belongs in the output rules`);
+    }
+    if (!context.program.recs.includes(target.data)) {
+        throw errors.new(`idb ${target.name}: the rec was declared by a different program — rec identity is the membership rule`);
+    }
+    return advanceIdb(state, target.data, bindings, true);
+}
+/** Classifies one find record per the context (a recursive head projects bound variables only). */
+function findColumns(context, entries) {
+    const columns = [];
+    for (const [name, entry] of Object.entries(entries)) {
+        if (entry === undefined) {
+            continue;
         }
-        return selectColumnOf(entry);
-    });
+        if (context.kind === "rec" && !(isTerm(entry) && entry[term] === "var")) {
+            throw errors.new(`rec ${context.self.name}: a recursive head projects bound variables only — aggregates and the measure read finished sets (the strata judge's quarantine, unwritable here)`);
+        }
+        columns.push(findColumnOf(name, entry));
+    }
+    return columns;
 }
 /** Builds one runtime chain (immutably — every step is a fresh chain over fresh state). */
 function makeRawChain(context, state) {
     const chain = {
         match(relation, bindings) {
-            return makeRawChain(context, advanceMatch(state, relation, bindings, context.classes));
+            return makeRawChain(context, advanceMatch(context, state, relation, bindings));
         },
         where(cond) {
-            return makeRawChain(context, advanceWhere(state, cond, context.classes));
+            return makeRawChain(context, advanceWhere(context, state, cond));
         },
-        idb(target, ...vars) {
-            return makeRawChain(context, idbAdvance(context, state, target, vars));
+        idb(target, bindings) {
+            return makeRawChain(context, idbAdvance(context, state, target, bindings));
         },
-        select(...entries) {
-            return makeRuleValue(completeRule(contextLabel(context), state, selectColumns(context, entries)));
+        find(entries) {
+            return makeRuleValue(completeRule(context, state, findColumns(context, entries)));
         }
     };
     Object.freeze(chain);
@@ -686,7 +733,10 @@ function makeRawScope(context) {
     const scope = {
         ...termOps,
         match(relation, bindings) {
-            return makeRawChain(context, advanceMatch(EMPTY_RULE, relation, bindings, context.classes));
+            return makeRawChain(context, advanceMatch(context, EMPTY_RULE, relation, bindings));
+        },
+        idb(target, bindings) {
+            return makeRawChain(context, idbAdvance(context, EMPTY_RULE, target, bindings));
         }
     };
     Object.freeze(scope);
@@ -694,21 +744,19 @@ function makeRawScope(context) {
 }
 /**
  * The rule builders' trusted admission seam — THE home of the
- * trusted-admission-seam pattern the other mint guards cite (the face,
- * class-map, axiom-readback, rec-handle, and query-value seams): the raw
- * builder is one runtime shape for every context, and this guard verifies
- * the checkable fact — the builder verbs exist — before the value is
- * admitted at its TYPED face. The type-level
- * judgments (domain-equal joins, boundness, the recursion cut) live in the
- * interfaces themselves; the runtime twin of every one of them is a
- * construction-time validation in this module.
+ * trusted-admission-seam pattern the other mint guards cite: the raw builder
+ * is one runtime shape for every context, and this guard verifies the
+ * checkable fact — the builder verbs exist — before the value is admitted at
+ * its TYPED face. The type-level judgments (class-equal joins, the recursion
+ * cut) live in the interfaces themselves; boundness is a construction-time
+ * validation in this module (object identity is invisible to the type tier).
  */
 function isTypedScope(scope) {
     return typeof scope.match === "function";
 }
 /** Builds one query-rule builder (the typed face of the raw builder). */
-function makeQueryRuleScope(classes) {
-    const raw = makeRawScope({ kind: "query", classes });
+function makeQueryRuleScope(theory) {
+    const raw = makeRawScope({ kind: "query", classes: theory.classes, theory });
     if (!isTypedScope(raw)) {
         throw errors.new("query rule builder construction incomplete");
     }
@@ -716,7 +764,7 @@ function makeQueryRuleScope(classes) {
 }
 /** Builds one output-rule builder over a program's recs. */
 function makeOutputRuleScope(program) {
-    const raw = makeRawScope({ kind: "output", program, classes: program.classes });
+    const raw = makeRawScope({ kind: "output", program, classes: program.classes, theory: program.theory });
     if (!isTypedScope(raw)) {
         throw errors.new("program output rule builder construction incomplete");
     }
@@ -741,25 +789,7 @@ function headSignature(column) {
     }
     return `${column.name}:${agg.op}`;
 }
-/**
- * The classed slot one answer column's VALUES flow from, resolved through
- * the rule's own binding environment: a projected var's first-binding slot,
- * or an Arg-carried payload's (`argMax`/`argMin` carry `over` verbatim —
- * the same two shapes the closed slice lifts). Counts, folds, `pack` and
- * the measure derive numbers/intervals rather than carrying a slot's ids,
- * so they resolve no slot (`undefined`).
- */
-function headSlotOf(rule, column) {
-    const entry = column.entry;
-    if (entry.kind === "var") {
-        return rule.varFields[entry.over];
-    }
-    if (entry.kind === "aggregate" && entry.agg.op === "arg") {
-        return rule.varFields[entry.agg.over];
-    }
-    return undefined;
-}
-/** The roster a param anchor carries: present exactly on a closed-reference field anchor (rides THE one `rosterOf` reader). */
+/** The roster a param anchor carries: present exactly on a closed-reference field anchor. */
 function anchorRosterOf(anchor) {
     return anchor === "measure" ? undefined : rosterOf(anchor);
 }
@@ -769,20 +799,9 @@ function renderParamAnchor(roster) {
 }
 /**
  * Folds every rule's param uses (recs in declaration order first, output
- * rules last — exactly the lowering walk) into the query's registry:
- * first use mints the dense `ParamId`, the first FIELD-ANCHORED use types
- * the wire, and one name must keep one shape AND one closedness — every
- * anchored use of one name must agree on the roster (value identity), so a
- * param anchored at a closed reference is GUARANTEED to ride the one
- * roster-verification point (`taggedHandleId`) at execute; a name anchored
- * both at a closed reference and at a non-closed position (or at two
- * vocabularies) is refused here, because the wire would translate only the
- * first anchor's reading (the type tier intersects the uses to `never`;
- * this is its runtime twin for untyped callers). A param whose anchor is a
- * CLOSED reference must never sit in an order-comparison position — the
- * anchor types its value a handle name and the engine would order the
- * translated row ids, so the pairing is refused here too (the registry is
- * the one place a name's every use and its anchoring field meet).
+ * rules last — exactly the lowering walk) into the query's registry: first
+ * use mints the dense `ParamId`, the first FIELD-ANCHORED use types the
+ * wire, and one name keeps one shape AND one closedness.
  */
 function paramRegistryOf(recs, rules) {
     const order = [];
@@ -840,64 +859,79 @@ function paramRegistryOf(recs, rules) {
         if (entry.orderOp !== undefined && anchorRoster !== undefined) {
             throw closedOrderError(`query param ${name}`, `its ${entry.orderOp} use's anchor`, anchorRoster.name);
         }
-        return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op, members: entry.members });
+        /**
+         * A membership array's handle names are program constants, so the
+         * entry stores the resolved IMAGE: each name rides the one
+         * roster-verification point (`taggedHandleId`, through
+         * `taggedCmpLiteral`) exactly once, HERE — an out-of-roster name
+         * fails at build, and every execute returns this frozen value by
+         * reference.
+         */
+        let membership;
+        if (entry.members !== undefined) {
+            const anchor = entry.anchor;
+            if (anchor === undefined) {
+                throw errors.new(`query param ${name} lost its membership anchor`);
+            }
+            membership = Object.freeze({
+                kind: "set",
+                values: Object.freeze(entry.members.map(function tagMember(member, index) {
+                    return Object.freeze(taggedCmpLiteral(`membership array ${name}[${index}]`, anchor, member, entry.op));
+                }))
+            });
+        }
+        return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op, membership });
     }));
 }
 /**
  * Assembles the runtime query value over completed rules: every rule must
  * derive the SAME head (name and aggregate shape, position for position —
- * the decode labels and the engine's alignment rule agree by
- * construction), and the param registry folds in program-walk order.
+ * the decode labels and the engine's alignment rule agree), and the param
+ * registry folds in program-walk order.
  */
 function makeRawQuery(theory, recs, rules) {
     const first = rules[0];
     if (first === undefined) {
         throw errors.new("a query needs at least one rule");
     }
-    const signature = first.select.map(headSignature).join(", ");
+    const signature = first.finds.map(headSignature).join(", ");
     rules.forEach(function verifyHead(rule, index) {
-        const candidate = rule.select.map(headSignature).join(", ");
+        const candidate = rule.finds.map(headSignature).join(", ");
         if (candidate !== signature) {
-            throw errors.new(`every rule of a query derives the same head — rule 0 selects (${signature}), rule ${index} selects (${candidate})`);
+            throw errors.new(`every rule of a query derives the same head — rule 0 finds (${signature}), rule ${index} finds (${candidate})`);
         }
         // The closed slice is part of the head too: one answer column decodes
-        // through one roster, so a union whose rules bind a column at
-        // different vocabularies (or one closed, one bare — the ids would
-        // mistranslate silently) is refused pointed. Vocabulary identity is
-        // value identity, the SDK's membership rule everywhere.
-        rule.select.forEach(function verifyClosedSlice(column, position) {
-            const lead = first.select[position];
+        // through one roster, so a union whose rules bind a column at different
+        // vocabularies (or one closed, one bare) is refused pointed.
+        rule.finds.forEach(function verifyClosedSlice(column, position) {
+            const lead = first.finds[position];
             if (lead !== undefined && column.closed !== lead.closed) {
                 throw errors.new(`every rule of a query derives the same head — the answer column ${lead.name} is ${renderClosedSlice(lead.closed)} in rule 0 but ${renderClosedSlice(column.closed)} in rule ${index} (one column decodes through one roster)`);
             }
             // The law-class wall on the union head: one answer column is one
-            // value space, so the classed slot each rule binds the column at
-            // must join across rules — the SAME fieldJoins judgment every
-            // join/eq/negated-atom position enforces. The SDK holds this wall
-            // because the wire IR carries no domains: the engine cannot
-            // backstop it, and without it a union mixes (say) Holder ids and
-            // Account ids in one column the consumer reads as one id space.
+            // value space, so the classed mint slot each rule binds the column
+            // at must join across rules — the SAME fieldJoins judgment every
+            // join/eq/negated-atom position enforces (the SDK holds it because
+            // the wire IR carries no domains).
             if (lead === undefined) {
                 return;
             }
-            const leadSlot = headSlotOf(first, lead);
-            const slot = headSlotOf(rule, column);
-            if (leadSlot !== undefined && slot !== undefined && !fieldJoins(leadSlot, slot)) {
-                throw errors.new(`every rule of a query derives the same head — the answer column ${lead.name} unions domain-unequal fields: bound at ${renderFieldKind(leadSlot)} in rule 0 but at ${renderFieldKind(slot)} in rule ${index} (a union column joins only class-equal slots; bare pairs only with bare)`);
+            if (lead.slot !== undefined && column.slot !== undefined && !fieldJoins(lead.slot, column.slot)) {
+                throw errors.new(`every rule of a query derives the same head — the answer column ${lead.name} unions domain-unequal fields: bound at ${renderFieldKind(lead.slot)} in rule 0 but at ${renderFieldKind(column.slot)} in rule ${index} (a union column joins only class-equal slots; bare pairs only with bare)`);
             }
         });
     });
     const data = Object.freeze({
         recs: Object.freeze([...recs]),
         rules: Object.freeze([...rules]),
-        select: first.select,
+        finds: first.finds,
         params: paramRegistryOf(recs, rules)
     });
     const value = {
         schema: theory,
         data,
         rule(build) {
-            const built = build(makeRawScope({ kind: "query", classes: theory.classes }));
+            const built = build(makeRawScope({ kind: "query", classes: theory.classes, theory }));
             return makeRawQuery(theory, recs, [...rules, built.rule]);
         }
     };
@@ -921,16 +955,15 @@ function makeQuery(theory, recs, rules) {
     return raw;
 }
 /**
- * Opens a query over a schema: `query(S).rule(r => ...)`. Each `.rule`
- * adds one conjunctive rule; multiple rules are the set union (answers are
- * SETS — no order or limit exists anywhere; hosts sort). The schema's
- * law-computed class map rides into every rule builder — the join walls
- * compare class names off it, at the type level and at construction alike.
+ * Opens a query over a schema: `query(S).rule(r => ...)`. Each `.rule` adds
+ * one conjunctive rule; multiple rules are the set union. The schema's
+ * law-computed class map and theory value ride into every rule builder — the
+ * join walls compare against the mint slots off it.
  */
 function query(theory) {
     const start = {
         rule(build) {
-            const built = build(makeQueryRuleScope(theory.classes));
+            const built = build(makeQueryRuleScope(theory));
             return makeQuery(theory, [], [built.rule]);
         }
     };
@@ -939,13 +972,8 @@ function query(theory) {
 }
 /**
  * Tags one closed-reference literal: the handle NAME, verified against the
- * roster (the belt the wide fallback type cannot provide — structural
- * values make any string spellable here) and translated to its
- * declaration-order row id, tagged u64 — queries cross ids, never handle
- * names; the wire is untouched. THE single roster-verification point of
- * the query surface: atom-binding literals, comparison literals,
- * execute-time params, and membership-array members all reach it (never
- * duplicate the check per call site).
+ * roster and translated to its declaration-order row id, tagged u64. THE
+ * single roster-verification point of the query surface.
  */
 function taggedHandleId(context, closed, value) {
     if (typeof value !== "string") {
@@ -979,11 +1007,7 @@ function taggedAtElementDomain(context, element, value) {
 }
 /**
  * Tags one host literal at a FIELD position (atom bindings): the field's
- * structural kind directs the tag, never a guess. At an interval field a
- * bigint literal tags as the ELEMENT type — the IR's membership typing
- * rule (point membership), an interval-shaped literal as the interval
- * (value equality). A closed-reference literal is its bare handle id,
- * tagged u64 after a roster verification.
+ * structural kind directs the tag, never a guess.
  */
 function taggedLiteral(context, field, value) {
     const roster = rosterOf(field);
@@ -1013,15 +1037,6 @@ function taggedLiteral(context, field, value) {
             if (typeof value !== "string") {
                 throw literalShapeError(context, "string", value);
             }
-            /**
-             * The marshal's bijection law at the query seam (`marshal.ts`
-             * cellOf): a lone surrogate would be lossily replaced with
-             * U+FFFD at the bridge's UTF-8 crossing and silently match a
-             * fact the typed write surface can never store — distinct JS
-             * strings collapsing to one wire query. This is the single
-             * seam every query string literal, string param
-             * (`taggedCmpLiteral`), and membership member lowers through.
-             */
             if (!value.isWellFormed()) {
                 throw literalShapeError(context, "well-formed string", value);
             }
@@ -1038,17 +1053,13 @@ function taggedLiteral(context, field, value) {
     }
 }
 /**
- * Tags one host literal at a COMPARISON or PARAM position, where the
- * SIBLING anchors the type: a measure sibling is u64, an interval-field
- * sibling contributes its element domain (so both a point literal in
- * `pointIn` and a `span` literal in `allen` tag correctly), a scalar
- * sibling its own type. At `pointIn` the operand order is interval-left,
- * point-right (`ir::CmpOp::PointIn`), so an interval-shaped literal
- * beside a scalar element-typed sibling is the LEGAL interval operand of
- * `pointIn(t, span(...))` and tags as the interval of the sibling's
- * element domain; under every other operator an interval shape against a
- * scalar sibling stays refused (the engine's IllegalComparison — the
- * bug-hunt fix, preserved op-aware).
+ * Tags one host literal at a COMPARISON or PARAM position, where the SIBLING
+ * anchors the type: a measure sibling is u64, an interval-field sibling
+ * contributes its element domain, a scalar sibling its own type. At
+ * `pointIn` the operand order is interval-left, point-right, so an
+ * interval-shaped literal beside a scalar element-typed sibling is the LEGAL
+ * interval operand of `pointIn(t, span(...))`; under every other operator an
+ * interval shape against a scalar sibling stays refused.
  */
 function taggedCmpLiteral(context, sibling, value, op) {
     if (sibling === "measure") {
@@ -1069,16 +1080,16 @@ function taggedCmpLiteral(context, sibling, value, op) {
     return taggedLiteral(context, sibling, value);
 }
 /** Creates one rule-scoped variable numberer. */
-function makeVarIds() {
+function freshVarIds() {
     const assigned = new Map();
     return {
-        of(name) {
-            const existing = assigned.get(name);
+        of(ref) {
+            const existing = assigned.get(ref);
             if (existing !== undefined) {
                 return existing;
             }
             const id = assigned.size;
-            assigned.set(name, id);
+            assigned.set(ref, id);
             return id;
         }
     };
@@ -1093,10 +1104,7 @@ function paramIdOf(ctx, name) {
 }
 /**
  * Lowers one EDB atom (either polarity). A CLOSED owner lowers through the
- * same edb source — its ordinal is its record-declaration slot exactly like
- * an ordinary relation's — with field ordinals over the SEALED shape: `id`
- * at 0, each payload column at its declared index + 1 (`sealedFieldsOf`
- * carries the shift; the lowering golden pins it).
+ * same edb source, with field ordinals over the SEALED shape.
  */
 function lowerAtom(ctx, atom, ids) {
     const member = ctx.theory.relations[atom.relation.name];
@@ -1119,17 +1127,12 @@ function lowerAtom(ctx, atom, ids) {
     });
     return { source: { kind: "edb", relation: relationId }, bindings };
 }
-/**
- * Lowers one binding term. A membership ARRAY (`literalSet`) lowers to the
- * existing param-set term over its content-addressed registry entry — the
- * program IR is byte-identical to the same set spelled `r.inSet`; the SDK
- * supplies the translated member set itself at execute (`wireParams`).
- */
+/** Lowers one binding term. A membership ARRAY lowers to the existing param-set term over its content-addressed entry. */
 function lowerBindingTerm(ctx, context, binding, ids) {
     const bound = binding.term;
     switch (bound.kind) {
         case "var":
-            return { kind: "var", var: ids.of(bound.name) };
+            return { kind: "var", var: ids.of(bound.ref) };
         case "param":
             return { kind: "param", param: paramIdOf(ctx, bound.name) };
         case "setParam":
@@ -1140,34 +1143,45 @@ function lowerBindingTerm(ctx, context, binding, ids) {
             return { kind: "literal", value: taggedLiteral(context, binding.data, bound.value) };
     }
 }
-/** Lowers one idb atom: positional head bindings, `FieldId(i)` = head position i. */
-function lowerIdbAtom(ctx, rec, vars, ids) {
+/**
+ * Lowers one idb atom: named bindings placed by HEAD order, `FieldId(i)` =
+ * head position i. Every head column of the rec must be bound (a missing key
+ * is refused pointed); the var-id assignment order is head order, so the
+ * first-use numbering matches the name-keyed edition exactly.
+ */
+function lowerIdbAtom(ctx, rec, bindings, ids) {
     const pred = ctx.recIds.get(rec);
     if (pred === undefined) {
         throw errors.new(`query lowering: rec ${rec.name} was declared by a different program`);
     }
-    const arity = rec.rules[0]?.select.length;
-    if (arity !== undefined && vars.length !== arity) {
-        throw errors.new(`query lowering: idb ${rec.name} takes ${arity} positions, got ${vars.length}`);
+    const head = rec.rules[0];
+    if (head === undefined) {
+        throw errors.new(`query lowering: rec ${rec.name} has no rules`);
     }
-    const bindings = vars.map(function lowerPosition(name, position) {
-        return [position, { kind: "var", var: ids.of(name) }];
+    const irBindings = head.finds.map(function lowerPosition(column, position) {
+        const binding = bindings.find(function byKey(candidate) {
+            return candidate.key === column.name;
+        });
+        if (binding === undefined) {
+            throw errors.new(`query lowering: idb ${rec.name} omits head column ${column.name}`);
+        }
+        return [position, { kind: "var", var: ids.of(binding.ref) }];
     });
-    return { source: { kind: "idb", pred }, bindings };
+    return { source: { kind: "idb", pred }, bindings: irBindings };
 }
 /** Lowers one comparison side; literals tag by the sibling's anchor (op-aware at `pointIn`). */
-function lowerCmpTerm(ctx, rule, side, sibling, ids, op) {
+function lowerCmpTerm(ctx, side, sibling, ids, op) {
     switch (side.kind) {
         case "var":
-            return { kind: "var", var: ids.of(side.name) };
+            return { kind: "var", var: ids.of(side.ref) };
         case "param":
             return { kind: "param", param: paramIdOf(ctx, side.name) };
         case "setParam":
             return { kind: "paramSet", param: paramIdOf(ctx, side.name) };
         case "measure":
-            return { kind: "measure", var: ids.of(side.name) };
+            return { kind: "measure", var: ids.of(side.ref) };
         case "literal": {
-            const anchor = cmpAnchorOf(ctx, rule, sibling);
+            const anchor = cmpAnchorOf(ctx, sibling);
             if (anchor === undefined) {
                 throw errors.new("query lowering: a comparison literal needs a bound-variable, measure, or anchored-param sibling to type it");
             }
@@ -1175,10 +1189,10 @@ function lowerCmpTerm(ctx, rule, side, sibling, ids, op) {
         }
     }
 }
-/** Resolves the anchor a comparison literal tags by: the sibling's field, the measure, or an anchored param. */
-function cmpAnchorOf(ctx, rule, sibling) {
+/** Resolves the anchor a comparison literal tags by: the sibling variable's field, the measure, or an anchored param. */
+function cmpAnchorOf(ctx, sibling) {
     if (sibling.kind === "var") {
-        return rule.varFields[sibling.name]?.field;
+        return sibling.ref.field;
     }
     if (sibling.kind === "measure") {
         return "measure";
@@ -1189,7 +1203,7 @@ function cmpAnchorOf(ctx, rule, sibling) {
     return undefined;
 }
 /** Lowers one comparison. */
-function lowerComparison(ctx, rule, cmp, ids) {
+function lowerComparison(ctx, cmp, ids) {
     if (cmp.op === "allen") {
         const maskData = cmp.mask;
         if (maskData === undefined) {
@@ -1200,29 +1214,29 @@ function lowerComparison(ctx, rule, cmp, ids) {
             : { kind: "param", param: paramIdOf(ctx, maskData.name) };
         return {
             op: { kind: "allen", mask },
-            lhs: lowerCmpTerm(ctx, rule, cmp.lhs, cmp.rhs, ids, "allen"),
-            rhs: lowerCmpTerm(ctx, rule, cmp.rhs, cmp.lhs, ids, "allen")
+            lhs: lowerCmpTerm(ctx, cmp.lhs, cmp.rhs, ids, "allen"),
+            rhs: lowerCmpTerm(ctx, cmp.rhs, cmp.lhs, ids, "allen")
         };
     }
     return {
         op: { kind: cmp.op },
-        lhs: lowerCmpTerm(ctx, rule, cmp.lhs, cmp.rhs, ids, cmp.op),
-        rhs: lowerCmpTerm(ctx, rule, cmp.rhs, cmp.lhs, ids, cmp.op)
+        lhs: lowerCmpTerm(ctx, cmp.lhs, cmp.rhs, ids, cmp.op),
+        rhs: lowerCmpTerm(ctx, cmp.rhs, cmp.lhs, ids, cmp.op)
     };
 }
 /** Lowers one condition node (comparison leaf or and/or tree). */
-function lowerCondition(ctx, rule, cond, ids) {
+function lowerCondition(ctx, cond, ids) {
     if (cond.kind === "cmp") {
-        return { kind: "leaf", cmp: lowerComparison(ctx, rule, cond, ids) };
+        return { kind: "leaf", cmp: lowerComparison(ctx, cond, ids) };
     }
     return {
         kind: cond.op,
         children: cond.children.map(function lowerChild(child) {
-            return lowerCondition(ctx, rule, child, ids);
+            return lowerCondition(ctx, child, ids);
         })
     };
 }
-/** Lowers one select entry to its per-rule find term. */
+/** Lowers one find entry to its per-rule find term. */
 function lowerFind(entry, ids) {
     if (entry.kind === "var") {
         return { kind: "var", var: ids.of(entry.over) };
@@ -1237,10 +1251,10 @@ function lowerFind(entry, ids) {
         case "countDistinct":
             return { kind: "aggregate", op: { kind: "countDistinct" }, over: ids.of(agg.over) };
         case "fold": {
-            if (typeof agg.over === "string") {
-                return { kind: "aggregate", op: { kind: agg.fold }, over: ids.of(agg.over) };
+            if ("duration" in agg.over) {
+                return { kind: "aggregateMeasure", op: { kind: agg.fold }, over: ids.of(agg.over.duration) };
             }
-            return { kind: "aggregateMeasure", op: { kind: agg.fold }, over: ids.of(agg.over.duration) };
+            return { kind: "aggregate", op: { kind: agg.fold }, over: ids.of(agg.over) };
         }
         case "arg":
             return { kind: "aggregate", op: { kind: agg.direction, key: ids.of(agg.key) }, over: ids.of(agg.over) };
@@ -1263,7 +1277,7 @@ function headOpOf(agg) {
             return "pack";
     }
 }
-/** One select entry's var-free head shape. */
+/** One find entry's var-free head shape. */
 function headTermOf(column) {
     const entry = column.entry;
     if (entry.kind === "var" || entry.kind === "measure") {
@@ -1273,7 +1287,7 @@ function headTermOf(column) {
 }
 /** Lowers one rule: body walked in written order (var ids by first occurrence), finds last. */
 function lowerRule(ctx, rule) {
-    const ids = makeVarIds();
+    const ids = freshVarIds();
     const atoms = [];
     const negated = [];
     const conditions = [];
@@ -1288,17 +1302,18 @@ function lowerRule(ctx, rule) {
                 break;
             }
             case "idb": {
-                atoms.push(lowerIdbAtom(ctx, item.rec, item.vars, ids));
+                const bucket = item.negated ? negated : atoms;
+                bucket.push(lowerIdbAtom(ctx, item.rec, item.bindings, ids));
                 break;
             }
             case "cond": {
-                conditions.push(lowerCondition(ctx, rule, item.cond, ids));
+                conditions.push(lowerCondition(ctx, item.cond, ids));
                 break;
             }
         }
     }
     return {
-        finds: rule.select.map(function findOf(column) {
+        finds: rule.finds.map(function findOf(column) {
             return lowerFind(column.entry, ids);
         }),
         atoms,
@@ -1309,11 +1324,7 @@ function lowerRule(ctx, rule) {
 /**
  * Lowers a query value to the bridge's `ProgramIr` — pure and stable: the
  * recs in declaration order (`PredId` = index), the output predicate
- * (rules + head) appended last. Relations lower by declaration ordinal,
- * the law the engine's own manifest pins; `db.prepare` re-verifies the
- * alignment against the live manifest before sending. Every registered
- * param must carry a field anchor by now — an unanchorable param (its
- * every use beside a literal) is refused here, naming it.
+ * appended last. Every registered param must carry a field anchor by now.
  */
 function lowerQuery(q) {
     const theory = q.schema;
@@ -1341,14 +1352,14 @@ function lowerQuery(q) {
             throw errors.new(`query lowering: rec ${rec.name} has no rules`);
         }
         return {
-            head: head.select.map(headTermOf),
+            head: head.finds.map(headTermOf),
             rules: rec.rules.map(function lowerRecRule(rule) {
                 return lowerRule(ctx, rule);
             })
         };
     });
     predicates.push({
-        head: q.data.select.map(headTermOf),
+        head: q.data.finds.map(headTermOf),
         rules: q.data.rules.map(function lowerOutputRule(rule) {
             return lowerRule(ctx, rule);
         })