@bjornpagen/bumbledb 0.7.0 → 0.8.0

package/dist/statements.js

@@ -2,7 +2,7 @@
  * Dependency statements as typed values (`docs/architecture/30-dependencies.md`
  * owns the semantics; `docs/architecture/70-api.md` the surface): the FD key
  * form, conditional containment, the bidirectional `==` abbreviation, and
- * the cardinality window. A statement value is opaque and inert — no
+ * the capacity statement. A statement value is opaque and inert — no
  * methods, no fluent continuation: a fact about the theory, not a builder.
  *
  * Every field reference is checked against the relation it names in the
@@ -34,13 +34,14 @@
  * authority).
  */
 import * as errors from "@superbuilders/errors";
+import { isCapacityWeight, isCapacityWindow, unitWeight } from "#capacity.ts";
 import { isClosedMember, sealedFieldOf } from "#closed.ts";
 import { renderFace } from "#face.ts";
 import { rosterOf } from "#fields.ts";
-import { renderWindow } from "#spec.ts";
+import { renderCapacityWindow, renderWeight } from "#spec.ts";
 /**
  * The admission brand — a module-private symbol, deliberately unexported
- * (the `count.ts` pattern): `Statement` is a public structural type, so
+ * (the `capacity.ts` pattern): `Statement` is a public structural type, so
  * without this brand a forged plain object of the right shape would walk
  * past the construction-time arity and roster walls into `schema()` — and
  * the roster wall is the one the engine cannot backstop (the wire carries
@@ -171,25 +172,84 @@ function mirrors(source, target) {
     return statement;
 }
 /**
- * `B(Y|ψ) <={window} A(X|φ)` — the cardinality window. READ CAREFULLY: the
- * LEFT face is the window's TARGET, the per-group parent (B-family,
- * target-left — macro parity), and the RIGHT face is the counted source.
- * `window(on(Holder, "id"), atMost(3n), on(Account, "holder"))` says: each
- * Holder id groups at most three Account rows by holder. The two faces
- * pair by arity AND structural shape ({@link SameShapes}), exactly as
- * containment — the grouping join reads the same positionwise field
- * pairing.
+ * The runtime twin of the weight source wall ({@link WeightOnSource}): the
+ * weighed field must be a u64-encoded position of the SOURCE's own row
+ * (a signed weight would break the polarity scheduler — the illegal weight
+ * is unrepresentable, not checked), an interval position for the
+ * `Duration(...)` form. Judged at CONSTRUCTION for untyped callers; the
+ * engine's `validate_capacity` stays the final authority.
  */
-function window(target, count, source) {
+function assertWeightOnSource(weight, source, statement) {
+    if (weight.kind === "unit") {
+        return;
+    }
+    const field = sealedFieldOf(source.owner, weight.field);
+    if (field === undefined) {
+        throw errors.new(`${source.owner.name} has no field ${weight.field} — a weight names a field of the SOURCE's own row (the weight vocabulary is closed at the row) — ${renderStatement(statement)}`);
+    }
+    if (weight.kind === "field" && field.kind !== "u64") {
+        throw errors.new(`${source.owner.name}.${weight.field} is ${field.kind}, not u64 — a weight is u64-encoded (a signed weight would break the polarity scheduler: an insert could lower a sum) — ${renderStatement(statement)}`);
+    }
+    if (weight.kind === "durationField" && field.kind !== "interval") {
+        throw errors.new(`${source.owner.name}.${weight.field} is ${field.kind}, not an interval — Duration(...) weighs an interval field's measure — ${renderStatement(statement)}`);
+    }
+}
+/**
+ * The runtime twin of the dependent-bound target wall
+ * ({@link BoundsOnTarget}): a `ref()` bound must name a u64 field of the
+ * TARGET's own row, a `duration()` bound an interval field — bound names
+ * resolve against the target's FULL roster (C1), never the projection.
+ * `within()` mints dependent bounds in the hi slot only (C6), but the walk
+ * here is total over the window's bound slots.
+ */
+function assertBoundsOnTarget(window, target, statement) {
+    const bounds = window.kind === "range" ? [window.lo, window.hi] : [window.kind === "exact" ? window.n : window.lo];
+    for (const bound of bounds) {
+        if (bound.kind === "lit") {
+            continue;
+        }
+        const field = sealedFieldOf(target.owner, bound.field);
+        if (field === undefined) {
+            throw errors.new(`${target.owner.name} has no field ${bound.field} — a dependent bound names a field of the TARGET's own row (bound names resolve against the target's full roster) — ${renderStatement(statement)}`);
+        }
+        if (bound.kind === "field" && field.kind !== "u64") {
+            throw errors.new(`${target.owner.name}.${bound.field} is ${field.kind}, not u64 — a dependent bound reads a u64 field of the TARGET row (Duration(...) is the interval-measure spelling) — ${renderStatement(statement)}`);
+        }
+        if (bound.kind === "durationField" && field.kind !== "interval") {
+            throw errors.new(`${target.owner.name}.${bound.field} is ${field.kind}, not an interval — Duration(...) bounds by an interval field's measure — ${renderStatement(statement)}`);
+        }
+    }
+}
+function capacity(target, second, third, fourth) {
+    const weighted = fourth !== undefined;
+    const windowValue = weighted ? third : second;
+    const source = weighted ? fourth : third;
+    if (!isCapacityWindow(windowValue)) {
+        throw errors.new("a capacity window is minted only by within() — a structural literal skips the ban table (the canonical-utterance law)");
+    }
+    let weight = unitWeight;
+    if (weighted) {
+        if (!isCapacityWeight(second)) {
+            throw errors.new("a capacity weight is minted only by weigh() — a structural literal skips the row-local weight wall");
+        }
+        weight = second.weight;
+    }
+    const window = windowValue.window;
+    if (weight.kind === "unit" && window.kind === "floor" && window.lo.kind === "lit" && window.lo.value === 1n) {
+        throw errors.new("`{1..*}` on the unit instance says only what the bare containment says — drop the annotation and write the containment: contained(source, target)");
+    }
     const data = Object.freeze({
-        kind: "window",
+        kind: "capacity",
         target: target.data,
-        window: count.window,
+        weight,
+        window,
         source: source.data
     });
     const statement = Object.freeze({ data, [admitted]: true });
     assertArityAgreement(data.source, data.target, statement);
     assertRosterAgreement(data.source, data.target, statement);
+    assertWeightOnSource(weight, data.source, statement);
+    assertBoundsOnTarget(window, data.target, statement);
     return statement;
 }
 /**
@@ -198,9 +258,11 @@ function window(target, count, source) {
  * same shapes for violations) — `Account(id) -> Account`,
  * `Account(holder) <= Holder(id)`,
  * `Account(id | kind == Savings) == SavingsTerms(account)`,
- * `Holder(id) <={0..3} Account(holder)` — so TS-side errors and
+ * `Holder(id) <={0..3} Account(holder)`,
+ * `Pool(id) <=[watts]{0..supply} Device(pool)` — so TS-side errors and
  * engine-side diagnostics read identically. A renderer, never a parser:
- * strings are output-only.
+ * strings are output-only. The unit weight renders nothing — the count
+ * utterance falls out of the one printer.
  */
 function renderStatement(statement) {
     const data = statement.data;
@@ -211,9 +273,9 @@ function renderStatement(statement) {
             const operator = data.bidirectional ? "==" : "<=";
             return `${renderFace(data.source)} ${operator} ${renderFace(data.target)}`;
         }
-        case "window":
-            return `${renderFace(data.target)} <=${renderWindow(data.window)} ${renderFace(data.source)}`;
+        case "capacity":
+            return `${renderFace(data.target)} <=${renderWeight(data.weight)}${renderCapacityWindow(data.window)} ${renderFace(data.source)}`;
     }
 }
-export { contained, isStatement, key, mirrors, renderStatement, window };
+export { capacity, contained, isStatement, key, mirrors, renderStatement };
 //# sourceMappingURL=statements.js.map

package/dist/statements.js.map

@@ -1 +1 @@
-{"version":3,"file":"statements.js","sourceRoot":"","sources":["../src/statements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,MAAM,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE1D,OAAO,EAA+B,UAAU,EAAmC,MAAM,UAAU,CAAA;AACnG,OAAO,EAAqB,QAAQ,EAAE,MAAM,YAAY,CAAA;AAExD,OAAO,EAAE,YAAY,EAAmB,MAAM,UAAU,CAAA;AAkCxD;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAkB,MAAM,CAAC,6BAA6B,CAAC,CAAA;AAQrE;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,CAAA;AACxE,CAAC;AAgCD,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,MAAgC;IACzD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,YAAY,CAAA;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,MAAgB,EAAE,MAAgB,EAAE,SAAoB;IACrF,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,MAAM,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,8EAA8E,eAAe,CAAC,SAAS,CAAC,EAAE,CAC5R,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,MAAgB,EAAE,MAAgB,EAAE,SAAoB;IACtF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,OAAO,CAAC,SAAS,EAAE,QAAQ;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAM;QACP,CAAC;QACD,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QACrE,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAA;QACvE,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,OAAO,gBAAgB,CAAC,YAAY,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,WAAW,OAAO,gBAAgB,CAAC,YAAY,CAAC,gOAAgO,eAAe,CAAC,SAAS,CAAC,EAAE,CAC/Y,CAAA;QACF,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,GAAG,CAGV,QAAW,EAAE,MAAkB;IAChC,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,GAAG,CACf,OAAO,QAAQ,CAAC,IAAI,2CAA2C,QAAQ,CAAC,IAAI,WAAW,QAAQ,CAAC,IAAI,oEAAoE,CACxK,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAA2B,MAAM,CAAC,MAAM,CAAC;QAClD,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KACjC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAa,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CACjB,MAAS,EACT,MAA8C;IAE9C,MAAM,IAAI,GAA0C,MAAM,CAAC,MAAM,CAAC;QACjE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,aAAa,EAAE,KAAK;KACpB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAa,EAAE,CAAC,CAAA;IACpE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACzD,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1D,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,OAAO,CACf,MAAS,EACT,MAA8C;IAE9C,MAAM,IAAI,GAA0C,MAAM,CAAC,MAAM,CAAC;QACjE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,aAAa,EAAE,IAAI;KACnB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAa,EAAE,CAAC,CAAA;IACpE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACzD,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1D,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,MAAM,CACd,MAAS,EACT,KAAY,EACZ,MAA8C;IAE9C,MAAM,IAAI,GAAqC,MAAM,CAAC,MAAM,CAAC;QAC5D,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,MAAM,CAAC,IAAI;KACnB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAa,EAAE,CAAC,CAAA;IACpE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACzD,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1D,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,SAAoB;IAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAA;IAC3B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,KAAK;YACT,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACjF,KAAK,aAAa,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;YACjD,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;QAC3E,CAAC;QACD,KAAK,QAAQ;YACZ,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;IAC/F,CAAC;AACF,CAAC;AAYD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA"}
+{"version":3,"file":"statements.js","sourceRoot":"","sources":["../src/statements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,MAAM,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAIN,gBAAgB,EAChB,gBAAgB,EAEhB,UAAU,EAEV,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAA+B,UAAU,EAAmC,MAAM,UAAU,CAAA;AACnG,OAAO,EAAqB,QAAQ,EAAE,MAAM,YAAY,CAAA;AAExD,OAAO,EAA2B,oBAAoB,EAAE,YAAY,EAAmB,MAAM,UAAU,CAAA;AAwCvG;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAkB,MAAM,CAAC,6BAA6B,CAAC,CAAA;AAQrE;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,CAAA;AACxE,CAAC;AAgCD,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,MAAgC;IACzD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,YAAY,CAAA;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,MAAgB,EAAE,MAAgB,EAAE,SAAoB;IACrF,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,MAAM,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,8EAA8E,eAAe,CAAC,SAAS,CAAC,EAAE,CAC5R,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,MAAgB,EAAE,MAAgB,EAAE,SAAoB;IACtF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,OAAO,CAAC,SAAS,EAAE,QAAQ;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAM;QACP,CAAC;QACD,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QACrE,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAA;QACvE,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,OAAO,gBAAgB,CAAC,YAAY,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,WAAW,OAAO,gBAAgB,CAAC,YAAY,CAAC,gOAAgO,eAAe,CAAC,SAAS,CAAC,EAAE,CAC/Y,CAAA;QACF,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,GAAG,CAGV,QAAW,EAAE,MAAkB;IAChC,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,GAAG,CACf,OAAO,QAAQ,CAAC,IAAI,2CAA2C,QAAQ,CAAC,IAAI,WAAW,QAAQ,CAAC,IAAI,oEAAoE,CACxK,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAA2B,MAAM,CAAC,MAAM,CAAC;QAClD,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KACjC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAa,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CACjB,MAAS,EACT,MAA8C;IAE9C,MAAM,IAAI,GAA0C,MAAM,CAAC,MAAM,CAAC;QACjE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,aAAa,EAAE,KAAK;KACpB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAa,EAAE,CAAC,CAAA;IACpE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACzD,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1D,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,OAAO,CACf,MAAS,EACT,MAA8C;IAE9C,MAAM,IAAI,GAA0C,MAAM,CAAC,MAAM,CAAC;QACjE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,aAAa,EAAE,IAAI;KACnB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAa,EAAE,CAAC,CAAA;IACpE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACzD,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1D,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,MAAkB,EAAE,MAAgB,EAAE,SAAoB;IACvF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAM;IACP,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,iBAAiB,MAAM,CAAC,KAAK,oGAAoG,eAAe,CAAC,SAAS,CAAC,EAAE,CACjL,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrD,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,2HAA2H,eAAe,CAAC,SAAS,CAAC,EAAE,CAC5M,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,0EAA0E,eAAe,CAAC,SAAS,CAAC,EAAE,CAC3J,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,MAA0B,EAAE,MAAgB,EAAE,SAAoB;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAClH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,SAAQ;QACT,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,iBAAiB,KAAK,CAAC,KAAK,uHAAuH,eAAe,CAAC,SAAS,CAAC,EAAE,CACnM,CAAA;QACF,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACpD,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,wHAAwH,eAAe,CAAC,SAAS,CAAC,EAAE,CACxM,CAAA;QACF,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjE,MAAM,MAAM,CAAC,GAAG,CACf,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,6EAA6E,eAAe,CAAC,SAAS,CAAC,EAAE,CAC7J,CAAA;QACF,CAAC;IACF,CAAC;AACF,CAAC;AA+BD,SAAS,QAAQ,CAChB,MAAe,EACf,MAAe,EACf,KAAc,EACd,MAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAA;IACrC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,KAAiB,CAAA;IACrD,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,GAAG,CACf,uHAAuH,CACvH,CAAA;IACF,CAAC;IACD,IAAI,MAAM,GAAe,UAAU,CAAA;IACnC,IAAI,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,GAAG,CACf,oGAAoG,CACpG,CAAA;QACF,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;IACjC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC7G,MAAM,MAAM,CAAC,GAAG,CACf,mJAAmJ,CACnJ,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAiB,MAAM,CAAC,MAAM,CAAC;QACxC,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,MAAM;QACN,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,IAAI;KACnB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAa,EAAE,CAAC,CAAA;IACpE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACzD,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1D,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACpD,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACpD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,SAAoB;IAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAA;IAC3B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,KAAK;YACT,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACjF,KAAK,aAAa,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;YACjD,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;QAC3E,CAAC;QACD,KAAK,UAAU;YACd,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;IACnI,CAAC;AACF,CAAC;AAYD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bjornpagen/bumbledb",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Type-theoretic TypeScript SDK for the bumbledb embedded relational engine",
   "type": "module",
   "exports": {
@@ -41,7 +41,7 @@
     "@superbuilders/errors": "^4.0.2"
   },
   "optionalDependencies": {
-    "@bjornpagen/bumbledb-darwin-arm64": "0.7.0"
+    "@bjornpagen/bumbledb-darwin-arm64": "0.8.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.0.0-beta.5",

package/src/capacity.ts

@@ -0,0 +1,454 @@
+/**
+ * Capacity-law mints — the window, weight, and dependent-bound vocabulary
+ * the one `capacity()` statement constructor consumes
+ * (`docs/architecture/70-api.md` § the canonical-utterance law, restated
+ * around the aggregate form). `within()` is the ONE window spelling —
+ * `within(n)` exact (`within(0n)` IS the exclusion's one spelling),
+ * `within(lo, hi)` range (`within(0n, hi)` the canonical ceiling),
+ * `within(lo, "*")` floor — `weigh()` names the measure on the SOURCE row
+ * (`weigh("watts")` a u64 field, `weigh(duration("booked"))` an interval's
+ * measure), and `ref()`/`duration()` read a dependent bound from the
+ * TARGET row (hi slot only — ruled 2026-07-24, C6). The ban table is
+ * enforced REPRESENTATIONALLY in two tiers, split per-aggregate where
+ * weight-sensitive (design § 6: a ban is canonical-utterance policing when
+ * it is weight-independent, semantic deduplication when it is not):
+ *
+ * - **The type tier**: a banned spelling written as a LITERAL does not
+ *   compile — every negative bound, `within(n, n)`, `within(0n, 0n)`, and
+ *   `within(0n, "*")` are type errors naming the canonical form. The
+ *   weight-SENSITIVE row rides the `capacity()` overloads themselves:
+ *   `within(1n, "*")` is banned on the unit overload only (`{1..*}` on the
+ *   count instance is the bare containment respelled —
+ *   `window_floor_containment`), and LEGAL on the weighted one ("positive
+ *   total" is not an existence claim over rows).
+ * - **The construction tier**: a bound the type level cannot judge — a
+ *   COMPUTED `bigint`, or an inverted `within(lo, hi)` order — is judged at
+ *   construction with the same canonical-naming errors; and past both
+ *   tiers the engine's own spec validation remains the law for a hostile
+ *   FFI caller (the standing two-tier ban enforcement).
+ *
+ * The weight vocabulary is closed at the row (ruled 2026-07-24, ruling 6):
+ * a path weight (`weigh("model.watts")`) is a typed refusal at BOTH tiers
+ * whose diagnostic names the pinned-column idiom — the two-column
+ * containment IS the join, stated as a law. Bounds are `bigint` (u64
+ * crosses as bigint always, PRD-04's law); the witnessed measure comes
+ * back as `bigint` too (u128-wide engine accumulator, C3).
+ */
+
+import * as errors from "@superbuilders/errors"
+import type { AnyFace, FaceFields, FaceSource, ProjectedShape } from "#face.ts"
+import type { CapacityBoundSpec, CapacityWindowSpec, WeightSpec } from "#spec.ts"
+
+/**
+ * The admission brand — a module-private symbol, deliberately unexported
+ * (the standing statement-mint pattern): `CapacityWindowSpec` and
+ * `WeightSpec` are public wire types, so without this brand every banned
+ * spelling in the ban table would be writable as a plain object literal.
+ * The symbol makes `within()` and `weigh()` the ONLY producers of the
+ * values `capacity()` accepts, which is what "the ban table is unwritable"
+ * means.
+ */
+const admitted: unique symbol = Symbol("bumbledb.capacity.admitted")
+
+/**
+ * An admitted capacity window — opaque and inert: a fact about the theory,
+ * not a builder. Only `within()` produces one; the spec is carried at its
+ * EXACT type so the weight-sensitive `{1..*}` ban and the dependent-bound
+ * target wall are judged at the `capacity()` call.
+ */
+interface CapacityWindow<S extends CapacityWindowSpec = CapacityWindowSpec> {
+	readonly window: S
+	readonly [admitted]: true
+}
+
+/**
+ * An admitted measure — `weigh()`'s product, the `[w]` bracket of the
+ * operator. The spec is carried at its exact type so the u64/interval
+ * source wall ({@link WeightOnSource}) reads the weighed field's name off
+ * the value.
+ */
+interface CapacityWeight<S extends WeightSpec = WeightSpec> {
+	readonly weight: S
+	readonly [admitted]: true
+}
+
+/**
+ * A dependent bound naming a u64 field of the TARGET row — `ref()`'s
+ * product, legal in `within()`'s hi slot only (C6: a dependent floor has
+ * no use case; inversion with idents is unrepresentable). Carries no
+ * value: bounds resolve per target row at judge time.
+ */
+interface FieldRef<F extends string = string> {
+	readonly kind: "field"
+	readonly field: F
+}
+
+/**
+ * A dependent interval-measure bound (`Duration(field)` of the TARGET
+ * row), or — handed to `weigh()` — the interval-measure weight of the
+ * SOURCE row. One mint, both slots: the interval enters through the
+ * measure argument, never the group key.
+ */
+interface DurationRef<F extends string = string> {
+	readonly kind: "durationField"
+	readonly field: F
+}
+
+/** Narrows any value to an admitted capacity window through the module-private brand. */
+function isCapacityWindow(value: unknown): value is CapacityWindow {
+	return typeof value === "object" && value !== null && admitted in value && "window" in value
+}
+
+/** Narrows any value to an admitted capacity weight through the module-private brand. */
+function isCapacityWeight(value: unknown): value is CapacityWeight {
+	return typeof value === "object" && value !== null && admitted in value && "weight" in value
+}
+
+/**
+ * The legible banned-spelling verdict: intersected into a mint's parameter
+ * when the LITERAL argument spells a banned window, naming the canonical
+ * form — the compile-time face of the ban table.
+ */
+interface BannedWindow<Canonical extends string> {
+	readonly "banned window spelling — the canonical-utterance law names the one legal form": Canonical
+}
+
+/**
+ * The path-weight refusal (ruling 6 — a boundary, not a deferral): the
+ * verdict names the pinned-column idiom, the same diagnostic the macro
+ * expansion and the spec resolver carry.
+ */
+interface RefusedPath<Idiom extends string> {
+	readonly "path spelling refused — the vocabulary is closed at the row": Idiom
+}
+
+/** `true` exactly when the literal bigint `N` is negative (out of the u64 bound domain). */
+type IsNegative<N extends bigint> = `${N}` extends `-${string}` ? true : false
+
+/**
+ * The dotted-name ban, both mints: a `a.b` spelling is a typed refusal
+ * whose verdict names the composition idiom — pin the column with a
+ * two-column containment (`Device(model, watts) <= Model(id, watts)`) and
+ * name the local field.
+ */
+type PathBan<F extends string> = string extends F
+	? unknown
+	: F extends `${string}.${string}`
+		? RefusedPath<"pin the column — a two-column containment (Source(ref, f) <= Catalog(id, f)) proves the local copy, then name the local field">
+		: unknown
+
+/** The ban verdict on a single bound: negatives are out of the u64 domain. */
+type NegativeBan<N extends bigint> = bigint extends N
+	? unknown
+	: IsNegative<N> extends true
+		? BannedWindow<"capacity bounds are u64 — a negative bound is out of domain">
+		: unknown
+
+/**
+ * The ban verdict on `within(lo, "*")`: `{0..*}` is vacuous —
+ * weight-independent (sums are ≥ 0). `{1..*}` is NOT judged here: the ban
+ * is weight-sensitive (Count-instance only) and rides the `capacity()`
+ * unit overload ({@link UnitWindowBan}).
+ */
+type FloorBan<N extends bigint> = bigint extends N
+	? unknown
+	: IsNegative<N> extends true
+		? BannedWindow<"capacity bounds are u64 — a negative bound is out of domain">
+		: N extends 0n
+			? BannedWindow<"`{0..*}` is vacuous — it provably says nothing; delete the statement">
+			: unknown
+
+/**
+ * The ban verdict on `within(lo, hi)` with both literals known: `{n..n}`
+ * is the exact measure respelled (`within(n)`, or `within(0n)` at 0) —
+ * weight-independent canonical policing. Bound ORDER (`{hi..lo}` inverted)
+ * is not type-expressible — bigint literals have no type-level comparison
+ * — so inversion stays a construction error.
+ */
+type RangeBan<Lo extends bigint, Hi extends bigint> = bigint extends Lo
+	? unknown
+	: bigint extends Hi
+		? unknown
+		: IsNegative<Lo> extends true
+			? BannedWindow<"capacity bounds are u64 — a negative bound is out of domain">
+			: IsNegative<Hi> extends true
+				? BannedWindow<"capacity bounds are u64 — a negative bound is out of domain">
+				: Lo extends Hi
+					? Hi extends Lo
+						? Lo extends 0n
+							? BannedWindow<"`{0..0}` — the point window is written `{0}`: use within(0n)">
+							: BannedWindow<"`{n..n}` — an exact measure is written `{n}`: use within(n)">
+						: unknown
+					: unknown
+
+/**
+ * The weight-SENSITIVE ban row, judged at the `capacity()` call where the
+ * aggregate instance is known (design § 6): on the UNIT overload a
+ * `{1..*}` floor says only what the bare containment says
+ * (`window_floor_containment`) and is banned naming `contained`; on the
+ * weighted overload the same window is LEGAL — "positive total" admits
+ * zero-weight rows and is a different, weaker law.
+ */
+type UnitWindowBan<W extends CapacityWindow> = W["window"] extends {
+	readonly kind: "floor"
+	readonly lo: { readonly kind: "lit"; readonly value: 1n }
+}
+	? BannedWindow<"`{1..*}` on the unit instance says only what the bare containment says — write contained(source, target)">
+	: unknown
+
+/** The projected kind of one field of a face's source, read off the schema type. */
+type KindAt<S extends FaceSource, K extends string> =
+	ProjectedShape<S, K> extends readonly [infer Kind, ...unknown[]] ? Kind : undefined
+
+/**
+ * The legible off-roster verdict for a dependent bound: bound names
+ * resolve against the TARGET's full field roster (C1 — the written
+ * projection tuple stays the pure grouping key), and the verdict names
+ * that roster.
+ */
+interface BoundOffTargetRoster<K, Roster> {
+	readonly "dependent bound must name a field of the TARGET's own row — bound names resolve against the target's full roster": readonly [
+		K,
+		Roster
+	]
+}
+
+/** The legible kind-mismatch verdict for a dependent bound: `ref()` needs u64, `duration()` an interval. */
+interface BoundKindMismatch<K, Want> {
+	readonly "dependent bound kind mismatch — ref() reads a u64 field, duration() an interval field, of the TARGET row": readonly [
+		K,
+		Want
+	]
+}
+
+/**
+ * One dependent-bound slot judged against the target face's roster and
+ * kinds. A WIDE field name (the untyped-caller path — literal identity
+ * already lost) passes the type tier and is judged at construction.
+ */
+type BoundOnTarget<K extends string, Want extends "u64" | "interval", B extends AnyFace> = string extends K
+	? unknown
+	: K extends FaceFields<B["source"]>
+		? KindAt<B["source"], K> extends Want
+			? unknown
+			: BoundKindMismatch<K, Want>
+		: BoundOffTargetRoster<K, FaceFields<B["source"]>>
+
+/**
+ * The dependent-bound target wall (type tier): for a `ref(K)` bound in the
+ * window's hi slot, `K` must name a u64 field of the TARGET face's own
+ * row; for a `duration(K)` bound, an interval field. Literal-bound windows
+ * pass untouched. The runtime twin for untyped callers lives at the
+ * `capacity()` construction (`statements.ts`).
+ */
+type BoundsOnTarget<W extends CapacityWindow, B extends AnyFace> = W["window"] extends {
+	readonly hi: FieldRef<infer K>
+}
+	? BoundOnTarget<K, "u64", B>
+	: W["window"] extends { readonly hi: DurationRef<infer K> }
+		? BoundOnTarget<K, "interval", B>
+		: unknown
+
+/** The legible off-roster verdict for a weight: the vocabulary is closed at the SOURCE row. */
+interface WeightOffSourceRoster<K, Roster> {
+	readonly "weight must name a field of the SOURCE's own row — the weight vocabulary is closed at the row": readonly [
+		K,
+		Roster
+	]
+}
+
+/**
+ * The legible kind-mismatch verdict for a weight: a signed weight would
+ * break the polarity scheduler (an insert could lower a sum), so the
+ * illegal weight is unrepresentable, not checked.
+ */
+interface WeightKindMismatch<K, Want> {
+	readonly "weight kind mismatch — weigh(field) reads a u64 field, weigh(duration(field)) an interval field, of the SOURCE row": readonly [
+		K,
+		Want
+	]
+}
+
+/**
+ * The weight source wall (type tier): `weigh(K)`'s field must be a
+ * u64-encoded position of the SOURCE face's own row (signed encodings are
+ * the typed polarity refusal), `weigh(duration(K))`'s an interval
+ * position. Checked at the `capacity()` call where the source face is
+ * inferred — the proven constrain-after-inference pattern.
+ */
+type WeightOnSource<M extends CapacityWeight, A extends AnyFace> = M["weight"] extends {
+	readonly kind: "field"
+	readonly field: infer K extends string
+}
+	? string extends K
+		? unknown
+		: K extends FaceFields<A["source"]>
+			? KindAt<A["source"], K> extends "u64"
+				? unknown
+				: WeightKindMismatch<K, "u64">
+			: WeightOffSourceRoster<K, FaceFields<A["source"]>>
+	: M["weight"] extends { readonly kind: "durationField"; readonly field: infer K extends string }
+		? string extends K
+			? unknown
+			: K extends FaceFields<A["source"]>
+				? KindAt<A["source"], K> extends "interval"
+					? unknown
+					: WeightKindMismatch<K, "interval">
+				: WeightOffSourceRoster<K, FaceFields<A["source"]>>
+		: unknown
+
+/** The unit weight — a case, not an absence (C4): the count instance's one wire spelling. */
+const unitWeight: WeightSpec = Object.freeze({ kind: "unit" })
+
+/** The construction-tier twin of {@link PathBan}: a dotted name refuses naming the idiom. */
+function assertRowLocal(field: string, role: string): string {
+	if (field.includes(".")) {
+		throw errors.new(
+			`${role} \`${field}\` walks a reference — the vocabulary is closed at the row (ruling 6): pin the column with a two-column containment (Source(ref, f) <= Catalog(id, f)) and name the local field`
+		)
+	}
+	return field
+}
+
+/** Stamps one admitted window spec as a frozen branded value. */
+function admitWindow<S extends CapacityWindowSpec>(window: S): CapacityWindow<S> {
+	const value: CapacityWindow<S> = { window, [admitted]: true }
+	return Object.freeze(value)
+}
+
+/** One literal bound. */
+function lit(value: bigint): CapacityBoundSpec {
+	return Object.freeze({ kind: "lit", value })
+}
+
+/**
+ * `{n}` — THE exact-measure spelling; `within(0n)` IS the exclusion's one
+ * spelling on the unit instance, and the weaker "total is zero" law on a
+ * weighted one (zero-weight rows may exist — design § 6, stated loudly).
+ */
+function within<const N extends bigint>(
+	n: N & NegativeBan<N>
+): CapacityWindow<{ readonly kind: "exact"; readonly n: { readonly kind: "lit"; readonly value: N } }>
+/**
+ * `{lo..*}` — a floor with no ceiling. `within(0n, "*")` is vacuous
+ * (unwritable as a literal); `within(1n, "*")` constructs — the `{1..*}`
+ * ban is weight-sensitive and judged at the `capacity()` call (unit
+ * instance only).
+ */
+function within<const Lo extends bigint>(
+	lo: Lo & FloorBan<Lo>,
+	hi: "*"
+): CapacityWindow<{ readonly kind: "floor"; readonly lo: { readonly kind: "lit"; readonly value: Lo } }>
+/**
+ * `{lo..field}` / `{lo..Duration(field)}` — the dependent ceiling, read
+ * from the TARGET row per group (C6: hi slot only). The ref carries no
+ * value, so no inversion judgment exists at construction — a per-row
+ * inverted window is the judge's typed refusal.
+ */
+function within<const Lo extends bigint, const R extends FieldRef | DurationRef>(
+	lo: Lo & NegativeBan<Lo>,
+	hi: R
+): CapacityWindow<{
+	readonly kind: "range"
+	readonly lo: { readonly kind: "lit"; readonly value: Lo }
+	readonly hi: R
+}>
+/**
+ * `{lo..hi}` — both bounds explicit, lo < hi; `within(0n, hi)` is the
+ * canonical ceiling. `lo === hi` is the exact measure respelled
+ * (unwritable as literals — {@link RangeBan} names `within(n)`), rejected
+ * at construction when computed; an inverted window is unsatisfiable and
+ * rejected at construction (bigint literals carry no type-level order).
+ */
+function within<const Lo extends bigint, const Hi extends bigint>(
+	lo: Lo,
+	hi: Hi & RangeBan<Lo, Hi>
+): CapacityWindow<{
+	readonly kind: "range"
+	readonly lo: { readonly kind: "lit"; readonly value: Lo }
+	readonly hi: { readonly kind: "lit"; readonly value: Hi }
+}>
+function within(lo: bigint, hi?: bigint | "*" | FieldRef | DurationRef): CapacityWindow {
+	if (lo < 0n) {
+		throw errors.new(`capacity bounds are u64: within(${lo}${hi === undefined ? "" : ", …"}) is out of domain`)
+	}
+	if (hi === undefined) {
+		return admitWindow({ kind: "exact", n: lit(lo) })
+	}
+	if (hi === "*") {
+		if (lo === 0n) {
+			throw errors.new("the `{0..*}` window is vacuous — it provably says nothing; delete the statement")
+		}
+		return admitWindow({ kind: "floor", lo: lit(lo) })
+	}
+	if (typeof hi === "bigint") {
+		if (hi < 0n) {
+			throw errors.new(`capacity bounds are u64: within(${lo}, ${hi}) is out of domain`)
+		}
+		if (hi < lo) {
+			throw errors.new(
+				`the window \`{${lo}..${hi}}\` is inverted — no measure satisfies it; bounds are \`{lo..hi}\` with lo < hi (an exact measure is \`{n}\`: within(n))`
+			)
+		}
+		if (lo === hi) {
+			if (lo === 0n) {
+				throw errors.new("`{0..0}` — the point window is written `{0}`: use within(0n)")
+			}
+			throw errors.new(`\`{${lo}..${lo}}\` — an exact measure is written \`{${lo}}\`: use within(${lo}n)`)
+		}
+		return admitWindow({ kind: "range", lo: lit(lo), hi: lit(hi) })
+	}
+	const field = assertRowLocal(hi.field, "dependent bound")
+	if (hi.kind === "durationField") {
+		return admitWindow({ kind: "range", lo: lit(lo), hi: Object.freeze({ kind: "durationField", field }) })
+	}
+	return admitWindow({ kind: "range", lo: lit(lo), hi: Object.freeze({ kind: "field", field }) })
+}
+
+/** Stamps one admitted weight spec as a frozen branded value. */
+function admitWeight<S extends WeightSpec>(weight: S): CapacityWeight<S> {
+	const value: CapacityWeight<S> = { weight, [admitted]: true }
+	return Object.freeze(value)
+}
+
+/**
+ * `[field]` — the measure: a u64-encoded field of the SOURCE row summed
+ * per target group. A dotted path is the typed refusal naming the
+ * pinned-column idiom (ruling 6); `weigh(duration(field))` is the
+ * interval-measure weight — calendar capacity as one statement.
+ */
+function weigh<const F extends string>(
+	field: F & PathBan<F>
+): CapacityWeight<{ readonly kind: "field"; readonly field: F }>
+function weigh<const F extends string>(
+	measure: DurationRef<F>
+): CapacityWeight<{ readonly kind: "durationField"; readonly field: F }>
+function weigh(measure: string | DurationRef): CapacityWeight {
+	if (typeof measure === "string") {
+		return admitWeight({ kind: "field", field: assertRowLocal(measure, "weight") })
+	}
+	return admitWeight({ kind: "durationField", field: assertRowLocal(measure.field, "weight") })
+}
+
+/**
+ * A dependent bound by name — `within(0n, ref("supply"))` reads each
+ * group's ceiling from the TARGET row's u64 field (bound names resolve
+ * against the target's FULL roster, C1 — the projection tuple stays the
+ * pure grouping key). Carries no value.
+ */
+function ref<const F extends string>(field: F & PathBan<F>): FieldRef<F> {
+	return Object.freeze({ kind: "field", field: assertRowLocal(field, "dependent bound") }) as FieldRef<F>
+}
+
+/**
+ * `Duration(field)` — the interval-measure spelling, one mint for both
+ * slots: handed to `weigh()` it is the SOURCE row's interval measure;
+ * in `within()`'s hi slot it is the TARGET row's interval-measure bound
+ * (Duration weights pair with Duration-capable bounds — C18).
+ */
+function duration<const F extends string>(field: F & PathBan<F>): DurationRef<F> {
+	return Object.freeze({ kind: "durationField", field: assertRowLocal(field, "Duration measure") }) as DurationRef<F>
+}
+
+export type { BoundsOnTarget, CapacityWeight, CapacityWindow, DurationRef, FieldRef, UnitWindowBan, WeightOnSource }
+export { duration, isCapacityWeight, isCapacityWindow, ref, unitWeight, weigh, within }