ActQL language

Specification index

This document owns source, types, expressions, operations, nest, effect-intents, canonical-semantics, observable-boundaries. It does not define other owners' wire protocols or a particular Host implementation. Cross-owner links outside the declared dependencies are informative navigation to protocol bindings or conformance evidence; they do not import those documents' requirements. Narrow machine contracts remain authoritative for their explicitly referenced values and envelopes.

On this pageCopy Anchor Link

• Scope and conventions
• Source and Program structure
  • Linear stages
• Carriers, values, and types
• Inputs and external contracts
• Expressions and predicates
• Operations
  • Operation inventory
  • Relation operations
  • Event operations (TEA)
  • Graph operations (SGA)
  • Vector operations (VecA)
  • Pure lexical ranking: text_rank
  • External ranked acquisition: search_candidates
• Named Results and Effect declarations
• Checking and canonical planning
• Structural grammar (normative)
• Complete example (informative)
• Machine contracts

Scope and conventionsCopy Anchor Link

An ActQL Program defines a bounded computation over typed observations, with named Results and optional Effect intents in finite linear stages. The same Program can be executed repeatedly; each execution is managed as a Run. For one Invocation, pure computation yields the same logical Result CIDs. This guarantee does not extend to fresh acquisitions or Effect outcomes (Capture, execution, and replay).

The language covers relations, graphs, vectors, event streams, addressable Resources, captured Artifact bytes, bounded external acquisition, and typed provider commands. Arbitrary scripts and raw HTTP are outside the language.

AoA supplies the common algebra and canonical fragment representation. Compilation combines validated AoA Fragments and typed boundary barriers into an Executable Plan (AoA fragments and algebra lowering).

ActQL fixes a Program's observable semantics and leaves physical execution to the Host. Checking establishes static validity and proof obligations under a Check Environment. After binding, planning derives the closed execution envelope, including limits not written in source. A Host MAY fuse, reorder, push down to a Connector, or place computation elsewhere only when the chosen strategy preserves the specified results and ordering, failure and atomicity behavior, observation and data-egress scope, evidence, permission boundaries, and Checkpoints. Sealed Plan identity and approval preservation are specified in Typed barriers and Plan Documents; runtime admission is specified in Checkpoints and Resolutions.

The Program declares semantic choices and any independent author guards. Contracts supply external-system meaning; checking derives execution facts; the Host supplies current policy and execution ceilings. Concrete observations and continuation state belong to the Run, not to Program source.

Normative conventionsCopy Anchor Link

The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL in this document are to be interpreted as described by RFC 2119 and RFC 8174 when, and only when, they appear in all capitals.

Except for examples and text explicitly marked informative, this document is normative. YAML examples, including Complete example (informative), illustrate the rules rather than define them. Formal grammars, contract definitions, and semantic tables are normative regardless of their code-block formatting.

Checking determines whether a Program satisfies the static language rules under a Check Environment. Binding supplies declared invocation values. Planning produces the canonical bound Executable Plan. These are semantic phases, not command names or requirements on an implementation's internal pass structure. Their results and permitted external access are specified in Checking and canonical planning; execution is specified in Run execution.

Planning fixes an execution contract, not an immutable physical strategy. Strategy selection and scheduling may continue during preparation and execution under that contract (Typed barriers and Plan Documents).

Initial input capture occurs during each activated stage's preparation, subject to authorization and Checkpoints. Program-wide checking cannot prefetch a later stage's business data (Run admission and identity).

Host Discovery (Host Discovery protocol) explicitly supplies published contracts before checking; optional read collection (Read collection protocol) coordinates separate Runs. Neither adds implicit I/O or failure recovery to compilation or pure operations.

Checking validity, binding completeness, and Host execution support are distinct judgments. Rejection at a checker's profile-claim boundary does not assert that the Program violates the language, and does not establish its validity. A valid template without bindings is not runnable. A fully checked bound Plan whose execution the Host does not support is unsupported, not runnable; neither state grants access to external data. The public status mapping is defined in Plan Documents and public planning results.

TermsCopy Anchor Link

The following terms distinguish source, checked meaning, captured computation, and Host lifecycle. Requirements governing their identities and transitions are specified in Canonical identities, AoA fragments and algebra lowering, Capture, execution, and replay, and Run admission and identity.

• Generator — an operation that establishes its output without consuming implicit current; any named additional inputs are still explicit dependencies.

• Delta — typed graph-value change data bound to exact base, target and structural contract identities; it is neither a capability nor a mutation.

• Coverage — evidence about the scope and completeness of a captured observation, not a percentage or proof of absence beyond that scope.

• Program — an actql/0.1 document describing a bounded computation, published Results, and optional Effect intents. Its semantic content is distinguished from presentation-only Authoring Context.

• Bounded — each runnable capacity limit has a checked Resolved limit, witnesses, and a defined enforcement boundary; exceeding the ceiling fails the protected work. The applicable limits are specified by the operations and resolved-limit rules. Exact row counts, cost, or duration need not be known before execution; this does not remove their applicable ceilings.

• Resource — a provider-addressable thing whose identity, kind, authority scope, lifecycle, and version survive any one tabular representation.

• SourceView — a Connector-owned, versioned typed observation contract over a Resource or resource extent.

• Carrier — a logical typed value on which the algebra computes: a relation, graph, vector set, or event stream (Carriers).

• ModelTask — a versioned contract for bounded structured model acquisition (Model acquisition: infer).

• Effect — explicit intent to change external state.

• Effect Set — the unordered finite set of Effects declared by one stage and materialized from its Stage Invocation. Set and member semantics are defined in Effect declarations.

• Stage Definition — a stable local stage ID and canonical local semantics, included in the Program's ordered stage descriptors without hashing its parent.

• Unit Definition — the common Run Graph local definition of an extracted stage: its stable Program-ID/node-ID namespace, Stage Definition, used parameter declarations and incoming producer/import/freshness/gate declarations. It never includes the enclosing Program revision or unrelated stages; see Local approval dependencies.

• Program checked template — all stages checked with typed future ports; it is not a collection of fabricated concrete Stage Invocations.

• Stage Invocation — the semantic identity of one captured stage computation, including its adopted numeric and model observations and imported receipts.

• Program Run — the common Run Graph execution of a staged Program, retaining its logical request, immutable values, pins and recovery history; not a second orchestration state machine.

• Author guard — an optional author-declared upper limit that fails protected work when its measured scope exceeds the limit; it does not select the first N items (Author guards, resolved limits, and Plan facts).

• Program Definition — the authority-bearing identity combining the Program's authored id and canonical semantics, identified by program_definition_cid (Canonical identities).

• Authoring Context — the nonsemantic metadata sidecar associated with a Program Definition and displayed alongside its checked meaning (Authoring Context).

• Resolved limit — the checked effective ceiling combining available bounds and guards, with their provenance and enforcement boundary (Author guards, resolved limits, and Plan facts).

• Executable Plan — the closed checked envelope of validated AoA Fragments, typed barriers, and their execution constraints and evidence (AoA fragments and algebra lowering).

Common AoA foundationCopy Anchor Link

ActQL 0.1 normatively pins the AoA Kernel law-manifest identity, AoA Pipeline IR version, Pipeline law-manifest identity, the reference executable operation-registry identity, the complete target-module contract and its required AoA registry additions, and law aoa.pipeline.effect-plan.terminal-boundary.v0.1. These semantic references form the machine-readable actql-aoa-contract/0.1 artifact, identified by ACTQL_AOA_CONTRACT_CID. A conforming ActQL 0.1 compiler MUST report the ACTQL_AOA_CONTRACT_CID published by its frozen 0.1 conformance manifest. It MUST NOT silently substitute a newer AoA contract. Every frozen conformance report MUST include the exact value it executed.

Package names, registry versions, and source commits are informative reference implementation bindings only. They do not constrain an independent conforming implementation that supplies the same normative semantic identities.

The semantic contracts imported by this document are explicitly pinned in Machine contracts. The family-wide contract index is informative navigation, not an import of every listed protocol. An implementation's internal language, data structures, and compiler pass names do not replace those shared contracts.

Language boundariesCopy Anchor Link

ActQL has no UDF, lambda, custom reducer, user-defined operator registry, inline JavaScript/Python, arbitrary WASM, runtime macro, or custom_compute escape hatch. Adding a contract CID around opaque code does not make its purity, bounds, ordering, pushdown, or replay semantics inspectable and MUST NOT be treated as an ActQL operation.

Semantics outside ActQL 0.1 or the checker's claimed profiles MUST fail during check with a stable error code. The compiler MUST NOT:

• invent an operation;
• silently drop an input or field;
• change exact computation to approximate computation;
• convert event time to processing time;
• convert one join kind to another;
• return an empty result as a substitute for unsupported behavior.

ActQL 0.1 additionally rejects unbounded watch execution, continuous streams, interactive/duplex sessions, arbitrary binary algebra, raw SQL or provider-specific query languages, raw or uncontracted HTTP, ANN as pure VecA, implicit Carrier conversion, cross-provider transactions, Saga orchestration, and natural-language interpretation. Effect composition and its orchestration boundaries are defined in Effect declarations. A provider session or long-running operation may be represented as a Resource, bounded incoming observations as events, and outgoing work as a typed command, but its interactive lifecycle remains host application state.

The closed vocabulary does not include PageRank, community detection, random walks, PCA, general graph clustering or graph isomorphism. Their addition requires an explicit algorithm, initialization/iteration, numerical and resource contract; they are not rejected on the premise that all such algorithms are inherently nondeterministic. Degree distributions compose degree with group. Arbitrary theta joins, dynamic pivot columns and generic failure-catching remain excluded; interval_join and explicit acquisition coverage do not introduce those broader semantics.

Run Graph and HTTP transport are companion contracts, not Program vocabulary (Artifact and companion contract index (normative)). Proposals for future language extensions follow the separate, informative extension policy.

Source and Program structureCopy Anchor Link

The common Program source model is a closed JSON-model document. Structural grammar (normative) defines its structural grammar; this chapter defines representation, naming, and authoring context. Explicit frontend profiles can lower other source representations into this same model, followed by ordinary admission and the common checker.

Source representationCopy Anchor Link

ActQL source files SHOULD use the .aql extension for YAML, JSON and adopted query representations. The extension identifies the language, not the representation, and does not select a parser.

The Frontend r1 adoption registry records adopted query/pattern profiles and the withdrawal of the old AQL / PROGRAM / STAGE / STEP / OP text surface separately from installed parser support. JSON/YAML Program remains public machine input. A caller selects an installed frontend explicitly; a failure in that frontend does not trigger reinterpretation as another format. Each frontend preserves the closed Program model, explicit steps, semantic array order and the existing checking rules. Profile adoption alone is not runtime conformance evidence.

ActQL source MAY be encoded as YAML or JSON. YAML input MUST be restricted to the JSON data model:

• object with string keys;
• array;
• string;
• finite number;
• boolean;
• null.

YAML tags, anchors, aliases, merge keys, executable types, non-string mapping keys, non-finite numbers, duplicate keys, and implementation-specific scalar types MUST be rejected.

Source text encoding MUST be UTF-8. Object key order MUST NOT affect parsing, lowering, or logical identity. Array order is semantic. Duplicate object keys MUST be rejected before validation.

The actql-source-decoding/0.1 profile uses YAML 1.2.2 Core scalar resolution, restricted as above, or JSON syntax. Exactly one non-empty object document is required. A single leading UTF-8 BOM is permitted and is not a value; additional documents and invalid UTF-8 are rejected. Numeric tokens decode to binary64 using round-to-nearest, ties-to-even; overflow and negative zero are rejected. Thus YAML yes, on, and 2026-09-06 are strings, 01 is number 1, and 1e3 is number 1000. JSON does not admit 01 as a number token.

Source decoding interprets the selected source syntax's escapes and, for YAML, its scalar folding/chomping. The resulting well-formed Unicode string values are preserved exactly, including CR, LF, CRLF and composed/decomposed sequences. Builder-provided JSON-model strings already are values and receive no second escape interpretation. Object member names use the separate identifier rule, except inside the quoted Effect literal payloads specified below: Unicode 16.0 NFC, then CRLF and lone CR to LF; colliding names are rejected. Identifier-valued members are admitted by their grammar-owned identifier rules, not by normalization of every String. Admission of a purportedly canonical machine artifact rejects noncanonical identifiers or bytes rather than repairing signed or hashed material. A data string need not be NFC or LF-normalized.

At a grammar-owned EffectValue position, the explicit {literal: value} wrapper quotes the complete value subtree. Member names inside that subtree retain their exact decoded Unicode scalar sequences and CR/LF for source and Program identity, including when a later checked target contract is an Object. Exact decoded duplicate keys remain source errors; distinct keys that would collide only after identifier normalization remain distinct source keys there. Program syntax, the literal wrapper, Effect names and target-field names retain their existing identifier rules. This exception does not select the payload's type or change any other source position. Contract-directed admission of the payload follows Effect declarations.

Document structureCopy Anchor Link

Complete Programs use the stage structure shown below and in the stage scenarios. Unwrapped pipeline snippets in operation sections describe stage-local bodies.

The language version is actql/0.1; the pinned Grammar identity identifies the exact grammar. The checker MUST reject root inputs, from, steps or effects as invalid top-level members. A missing stages fails required-member checking. The compiler MUST NOT invent a stage or execute an implicit repair.

version: actql/0.1
id: orders.shipped_recent
stages:
  - id: main
    inputs:
      orders:
        carrier: relation
        schema:
          id:
            type: string
            nullable: false
          status:
            type: string
            nullable: false
          created_at:
            type: timestamp
            nullable: false
        primary_key:
          - id
    from: orders
    steps:
      - filter: status = 'shipped'
      - select:
          - id
          - status
          - created_at
      - sort:
          - created_at: desc
          - id: asc
      - take: 100
        as: recent_shipments
    results:
      main:
        from: recent_shipments
        fields:
          - id
          - status
          - created_at
        order_by:
          - created_at: desc
          - id: asc
results:
  main:
    from:
      stage: main
      result: main

Structural grammar (normative) defines the closed top-level shape. The following table is an informative summary, not a second grammar:

Unknown top-level keys MUST be rejected. id MUST be a non-empty string. It is an authority-bearing definition namespace, not presentation-only provenance and not an AoA step reference. Changing id intentionally changes Program Definition, Invocation, Effect Preview, approval, and idempotency identities, while leaving program_semantics_cid unchanged.

meta is non-executable Authoring Context. Its syntax, identity, and review semantics are defined in Authoring Context.

Linear stagesCopy Anchor Link

Stages are a source and compilation surface, not a second orchestration runtime. They lower to the common finite Run Graph contract. Every Program, including a single-stage Program, uses the explicit stages array.

A Program has one nonempty finite stages array. Each stage has a unique nonempty id, inputs, steps, a results map, optional from, effects and meta. Root params and bindings are declared once. Dataflow, Result and Effect names are stage-local. The root results map contains only exports {from: {stage: StageId, result: ResultName}}; it performs no computation or projection. A stage may contain a pure dataflow DAG, but the stage list is linear.

All stages MUST be checked before Program execution, including future receipt schemas, references, contracts, profiles and bounds. A future producer supplies a typed unbound port, not a fabricated value or Invocation CID. Missing caller values yield needs_bindings; a checked Stage Plan awaiting its predecessor is pending_predecessor, not missing caller input. Concrete Stage Plans bind every used import and effective parameter before admission; Stage Invocation identity is completed only after its required observations have been captured.

Stage inputs additionally accept {result: {stage, result}} and {receipt: {stage, effect}}. They import an earlier Stage Result or the typed success view of an earlier Effect receipt. Self/forward references, temporary as imports, cycles and cross-stage implicit current are rejected. The ordinary input/as/multi-output namespace and sole-materialized-input completion apply within each stage. Imports never trigger a provider read. Zero-row imports retain their checked schema. Root exports retain the selected Stage Result's schema, order and policy; re-projection belongs in a stage.

Stage order MUST be preserved even without data dependencies. Fresh SourceView reads occur only after that stage activates, never before an earlier Effect. Static contract resolution is not a business read. Within a stage, Effects are an unordered attempt_all set; member rows default to halt. No member consumes an outcome of its own stage. Later stages may consume explicitly imported receipts or perform fresh reads. Arbitrary workflow branching, loops, recursion, dynamic stage creation and implicit compensation are not admitted; pure if and CASE expressions and contract-bounded retry/poll remain distinct.

Only a noninitial stage accepts after: completed|accepted; omission normalizes to completed. It refers to the immediate predecessor, not a selected DAG edge. Activation requires both predecessor success at that level and availability of every import. accepted requires every member applied or validly accepted; it never permits failure or unknown. completed additionally requires terminal success of the necessary asynchronous operations. A completion-only file Ref still waits for completion under after: accepted. Missing finite completion capability is unsupported at check, not an implicitly nullable import.

Any failed or partially applied stage MUST prevent normal downstream activation. An unknown outcome waits for reconciliation. A 99/100 success does not silently advance 99 items into the next stage. A cancelled checkpoint does not resume. Successful stages/items are retained, not rolled back or resent on recovery. Independent per-item progression requires explicitly separate Program Runs; it is not a transparent optimization of the stage barrier. Cleanup, compensation and failure notifications are separate explicit recovery Programs.

Every local Stage Result is an execution root. Delivery selection cannot skip a stage, Result or Effect. Local artifacts can survive later failure for authorized inspection. A complete graph output index requires every explicit export and truthful flow evidence; complete export coverage is not flow or business success.

Program, stage and execution identities follow the canonical envelopes below. Profile support is checked independently of source validity.

Pipeline names and referencesCopy Anchor Link

steps is an ordered array and MAY be empty. steps: [] is the identity pipeline over the selected input; Result ordering and projection still lower to AoA steps when declared. Each step object MUST contain exactly one operation key plus OPTIONAL from, as, and meta keys, subject to the generator and multi-output exceptions below. An empty step object is invalid.

- filter: "status = 'open'"
  from: opportunities
  as: open_opportunities

Here and in operation snippets, an input/step/Result name is local to the enclosing stage. Root Program Results use only the export form in Stages.

For an ordinary consuming step, if from is omitted it consumes the current step result. The first step consumes the stage-level from. If the stage has exactly one input, the stage-level from MAY be omitted and that input is selected deterministically. For these selection rules, count only materialized inputs, not search-template bindings classified under Inputs and external contracts. A template name is not a valid current Carrier, even when it is the only declared input name.

If more than one input exists and stage-level from is omitted, an ordinary consuming step before any explicit current selection MUST be rejected. A compiler MUST NOT select an input by declaration order.

Generators values, time_series, calendar_series and mean_graphs reject step-level from, require as, and set the current result to their output. They consume only the explicitly named additional inputs, if any. Thus an empty inputs map is legal when every dataflow root is generated. Stage-level from is absent with zero inputs. With multiple inputs, a generator or an explicit step from can establish the current result without a stage-level from. search_candidates instead binds the two names in its outputs object, rejects as, and leaves the current result unchanged. References to these names have the same uniqueness, scope and no-forward-reference rules as as. An authored dataflow binding is an input name, a single-output step's as, or an explicitly named multi-output port. Search preserves the current value from before the step, even when its query input uses an explicit from. If current was unset it remains unset. Both output names are registered together; neither output order nor explicit query selection updates current.

as binds a dataflow name for later reuse. All authored dataflow names MUST be non-empty strings. Inputs, as names and explicit multi-output names share one dataflow namespace and MUST be unique within it. Result names form a separate publication namespace: from: name resolves in the dataflow namespace, while from: {result: name} resolves in the publication namespace. A Result MAY therefore reuse a dataflow name. Authors SHOULD NOT reuse one, because a review reader would see the same token denote two objects. Authors SHOULD use as for branches, later reuse, or Result publication; generated names are used for ordinary linear steps.

Name resolution has the following closed scopes:

Forward references, self-references, cycles, duplicate bindings, and unavailable names MUST fail during check. Compiler-generated names are not author-visible bindings.

Join and other multi-input operations name their additional inputs inside the operation. An unavailable or Carrier-incompatible name MUST fail during check.

Field names and nested pathsCopy Anchor Link

An AuthoredFieldName is a flat NFC string containing at least one non-whitespace character. This rule applies to relation/graph/event/vector fields and recursively to object properties. Here whitespace is the union of ECMAScript 2025 WhiteSpace and LineTerminator: U+0009–U+000D, U+0020, U+00A0, U+1680, U+2000–U+200A, U+2028, U+2029, U+202F, U+205F, U+3000, and U+FEFF. Authored schema fields MUST NOT contain ., equal __cid, or begin with the reserved __actql_ prefix. Generated semantic fields such as edge_id, window_start_ms, session_id, and score/identity restorations are checked for collision before lowering. A compiler MUST NOT reinterpret a user field as join provenance or an internal carrier field.

Implementations MUST permit line breaks within field names; source NFC/LF normalization and quoted or escaped representations apply as for other strings.

GeneratedFieldName denotes a field introduced by a specified operation; it is not permission for authors to declare reserved internal fields. ProvenanceQualifiedFieldReference is the explicit left.name or right.name reference to a join operand (join), not an authored field. Subsequent property access is a distinct expression node (Typed access). A raw qualified join output requires a flat projection before another join; recursive join provenance is not inferred from a chain of dots.

A flat field name may hold a closed nested object or array value. Nested values do not create dotted field names. Typed expression access is specified in Typed access; json_pick remains the explicit relational form:

- json_pick:
    column: payload
    path: [customer, id]
    output: customer_id

Note (informative): customer.id selects property id of field customer; it cannot name a flat field containing a dot.

Before ActQL checking, a Connector adapter MUST map every provider-specific source-field selector into a declared flat canonical ActQL field name. This rule governs field names, not value shape: a declared field may still contain a closed nested value.

Authoring ContextCopy Anchor Link

meta provides author-supplied annotations for presentation and review. It MAY appear on the Program, a Stage, an Input (including a Result/receipt import), a Parameter or Binding declaration, a Step, a Result, or an Effect. It MUST NOT appear inside expressions, predicates, value contracts, or operation bodies. Short-form inputs use their object form to carry annotations.

Meta is a non-empty JSON object with service-defined content. Top-level keys beginning with actql_ are reserved and MUST be rejected in 0.1. Its complete content uses the AoA Kernel canonical JSON contract (Canonical identities); non-finite numbers, negative zero, and unpaired UTF-16 surrogates MUST be rejected.

Metadata is nonsemantic authoring context. It MUST NOT change computation, authority, egress, bounds, optimization, Effect Preview identity, or semantic Program, Executable Plan, Invocation, or idempotency identity. It MUST NOT be copied into a model request, Connector request, Effect payload, or provider prompt. Except for validating metadata itself, Hosts MUST NOT use metadata as a structured input to execution admission or policy, permissions, approval routing, Checkpoint requirements, or Resolution validation. A Host MAY impose metadata capacity or content restrictions, but MUST reject violations at intake with a stable diagnostic code rather than silently truncating or rewriting metadata.

An Effect review projection MUST bind both the semantic effect_preview_cid and the exact authoring_context_cid presented to the reviewer. Metadata MUST be identified as author-supplied and separated from verified authority and approval status. A projection MAY present a CID reference to the canonical metadata instead of rendering its contents; the reference remains subject to the applicable access and redaction policy. Changing only metadata therefore does not rebuild the Effect Preview, but it does require a new review projection and approval attestation. Natural-language metadata MUST NOT satisfy a missing structured semantic choice.

Carriers, values, and typesCopy Anchor Link

Carriers describe collections on which the algebra operates. Field contracts describe the values carried by those collections; they are shared by local schemas, external Contracts, expressions, and Results.

CarriersCopy Anchor Link

The graph structural contract has the closed canonical body {version: "actql-graph-contract/0.1", domain, node_definitions, edge_definitions, identity_law_cid, value_law_cid}. Each definition retains its name, nonempty ordered key contracts, matching ordered key_columns, complete property contracts and static label-to-property sets. Edge definitions additionally name their source and target node definitions. Element identity is the admitted definition domain, definition name and complete typed key, not an endpoint tuple. Independently keyed parallel edges are retained. Property types and shared label property sets obey the graph-wide rules in Graph construction. graph_contract_cid is the ordinary ActQL CID of exactly this body, without a self-CID member. key_columns binds each retained constructor key-column name to its component position and type; an anonymous structural definition uses null entries at every position, never a partially named tuple. Snapshot reload retains this mapping without consulting a catalog. Property-map enumeration, observations, graph contents, row counts, policy and provider locators are not contract members. The retired actql-graph-contract/0.1 body is not an alternate Graph profile: current admission rejects it without conversion. Historical bytes and evidence retain their original identity, but do not provide current execution support. Operations not connected to this keyed representation must reject explicitly; their old tuple-based implementations are not a fallback.

For the 0.1 contract, both graph law CID members MUST equal graph_law_manifest_cid in the owned operation-contract inventory. That pin resolves actql-graph-laws/0.1, maintained inside ActQL, which contains the semantic identity and typed value equality laws together. Computing a structural contract CID proves neither snapshot admission nor base/target content identity.

ActQL source uses four public Carrier names:

relation
graph
vectors
events

These map directly to the AoA sorts relation, graph, vector_set, and event_stream. Every materialized input and every step result has exactly one ActQL Carrier. Conversions are legal only through the deterministic semantic expansions defined in this specification. A compiler MUST NOT reinterpret a value as another Carrier.

Relations contain ordered rows with string-named fields. Graph, event-stream, and vector carrier representations are AoA-defined; ActQL restores authored semantic identity field names when returning to relations, except operations with fixed result roles such as nearest's query_id / candidate_id (Vector operations (VecA)).

Physical enumerability, a proven stable total order, and candidate-key evidence are different properties. A candidate key is a non-null field tuple proven unique; candidate keys form a set of independent witnesses. An ordering witness proves the logical row sequence used by order-sensitive operations. Provider arrival order alone proves neither. A complete schema supplies every field name and recursive value contract; knowing some names is not completeness.

Closed value contractsCopy Anchor Link

The closed value type names are string, number, decimal, boolean, timestamp, date, json, object, array, vector, resource_ref, and content_ref. The primitive value domains are:

json provides no recursive static field evidence. object and array carry the recursive contracts described below; vector carries fixed dimensions and the 0.1 f32 element law. Opaque reference values are defined in Opaque reference values. Arithmetic, conversion, and null propagation are specified in Expressions and predicates.

resource_ref and content_ref additionally declare resource_kind or optional media_type and require issuer evidence as specified in Opaque reference values. Every field contract, including an array element contract or object property contract, MUST declare nullable. array contracts MUST declare items; object contracts MUST declare fields. These members contain recursive field contracts and are legal only for their respective types. Values without declared internal structure use json. For json_pick on a typed object, a referenced path MUST be present in the complete recursive contract. When schema is present, it is complete: runtime rows MUST have exactly that field set and every value, nested array element, and declared object property MUST satisfy the declared type/nullability. nullable: true permits a present value to be null; it does not make the field or property optional.

Relation column presence is separate from these ordinary object value rules. A finite complete Relation schema MAY declare a column conditional: an absent row key is omission, not an explicit NULL. Required columns MUST occur in every row; every present cell MUST satisfy its declared value type and nullability. The existence guarantee MUST participate in schema identity and retained schema storage. Row content identity MUST distinguish omitted keys from explicit NULL, without including physical presence bitmap/layout choices.

In the initial presence profile, ordinary references and public Result columns MUST be schema-guaranteed present. Conditional references MUST fail during checking; sample values, an empty Relation and IS NOT NULL do not prove presence. Projection of guaranteed columns and filter/derive expressions that reference only guaranteed columns, Required-key sort, proven-order take and keyed DISTINCT over guaranteed columns, complete-row DISTINCT and GROUP over guaranteed references are supported. Structural DROP MAY remove columns from a conditional schema without reading retained values; it MUST preserve the retained columns' contracts, presence, order and row correspondence, and admit and charge the complete input, including removed columns. It does not make retained Conditional fields ordinary references. Filter MUST preserve the exact input schema, ordered surviving rows and each cell's presence; it MUST admit and charge all input rows before evaluating the predicate, including rejected rows. All syntactic references require presence, including unevaluated branches. Other consumers of a conditional schema remain explicitly unsupported until their preservation or refinement rules are implemented; they MUST NOT fill omission with NULL or silently drop presence. This does not make ordinary object properties optional.

Derive MUST preserve untouched fields' presence, values and row correspondence through execution, retention and reload, without filling omission with NULL.

A computed derive binding MUST be Required with its checked type and nullable contract; ordered replacement refers to the new binding rather than proving the replaced input column present.

Derive MUST reject every reference to an unguaranteed input column during checking, including unevaluated branches; references to a proven earlier binding in ordered derive retain the existing value-version semantics.

Sort and take on conditional Relation inputs MUST preserve the input schema, each selected row's values and presence, and the existing canonical content identity rules through retention and reload. Authored sort keys MUST be schema-guaranteed present, while ordering completion, take determinacy, complete input admission and resource accounting retain their existing obligations; neither observed samples nor an empty result establish order or presence.

Keyed DISTINCT on conditional Relation inputs MUST project only its specified, schema-guaranteed columns before deduplication, preserving their checked value types and nullability and the existing first-occurrence ordering. Unspecified conditional columns MUST NOT survive the projection or participate in equality. The complete sparse input MUST still be admitted and charged, including omitted cells' presence slots and values not selected for output. An unguaranteed key MUST fail during checking.

Complete-row distinct: true on conditional Relation inputs MUST preserve the input schema, values and presence through deduplication, retention and reload. Equality MUST include presence at every column: omitted and explicitly NULL cells are different, and unselected-key projection is not complete-row equality. The entire input MUST be admitted and charged, including duplicate rows and omission slots. Existing first-occurrence ordering and type-specific equality remain in force; deduplication does not make Conditional columns ordinarily referenceable or publishable and does not establish a new stable-order proof.

GROUP on conditional Relation inputs MUST require schema-guaranteed presence for every group key and every reference in aggregate arguments, filters and aggregate-local ordering, including syntactically present unevaluated branches. The complete sparse input MUST be admitted and charged before aggregation, without reading absent unreferenced cells as NULL or omitting their presence storage from resource accounting. The aggregate result MUST retain the existing GROUP output schema, types, nullability, empty-input behavior and ordering through retention and reload; unselected input columns do not survive grouping.

Both authored and checked object contracts MUST permit fields: {}. This closed contract admits only the empty object, plus null when nullable: true.

An empty array retains its declared item contract; its contents do not infer json or change nullability. nest (nest) derives that contract from the selected child schema, with a non-null array and non-null object items.

The author-facing field contract contains only semantic choices. An authored object contract omits additional_properties; the compiler inserts the sole 0.1 machine meaning additional_properties: false. An authored vector contract declares positive dimensions and omits element_type; the compiler inserts the sole 0.1 machine meaning element_type: f32. These fixed machine fields appear in checked Plan and protocol contracts but are not authoring vocabulary.

The author and checked contracts are separate closed grammars. Every row below also has type and required nullable; ? marks an optional member.

AuthorValueContract is exactly the author column; CheckedValueContract is its recursive expansion plus only the checked members listed above. Unknown or wrong-type members are rejected. Array max_items is a non-negative safe integer, including zero; it constrains admitted values, unlike an operation guard over measured work (Author guards, resolved limits, and Plan facts). Checked string extents are non-negative safe integers and do not become author syntax. min_length and max_codepoints count Unicode scalar values in the retained string; max_utf8_bytes counts that value's UTF-8 bytes before JSON escaping. Neither counts grapheme clusters or UTF-16 code units.

Type equality and compatibility use the following common relations:

• TypeEqual(A,B) compares complete canonical checked contracts recursively, including nullability, bounds, decimal precision/scale, vector dimensions, reference kind/media type, and object field sets. Object key order is irrelevant.
• Assignable(A,B) means every value permitted by A satisfies B. Non-null may flow to nullable, but not conversely. Base types match without coercion; decimal precision/scale, vector dimensions, and ResourceKind must match. Objects have exactly the same field set with recursively assignable values; arrays have assignable items. An actual upper bound cannot exceed an expected bound, and an actual lower bound cannot be smaller. Missing bounds prove no restriction. An unspecified expected Artifact media type admits any media type; a specified type requires that exact type to be proven.
• JoinNullability(A,B) requires the same recursive base structure and the exact decimal/vector/ResourceKind parameters. It takes nullable OR at each position and the least restrictive common value bounds. Different Artifact media types join to an unspecified media type. Other base-type differences have no join. json is not an implicit supertype of typed objects or references.

append, conditional result branches, coalesce, and array construction use this common join. SourceView request and Command argument checking use assignability. A literal null acquires a nullable form of the other branch's known type; all-null expressions alone provide no non-null type evidence. An explicit cast of null supplies its target type with nullable: true. An immediate fixed signature also supplies a literal NULL's type when its argument domain is unique: len(NULL) uses nullable string, concat(NULL,NULL) uses string arguments, and NULL IS TRUE and CASE WHEN NULL THEN 1 ELSE 2 END use a nullable boolean condition. An overloaded argument without a unique domain supplies no type; two untyped NULL operands of IS DISTINCT FROM still require independent type evidence.

For quantize and decimal_divide, implementations MUST NOT use the output precision and scale to supply an input type: the decimal input domain has no unique precision/scale, and the divisor domain also permits number. Bare literal NULL operands remain unresolved; an explicit cast such as CAST(NULL AS DECIMAL(8,2)) supplies the missing input type. Already-typed nullable operands still propagate null.

An empty array obtains its item type from an explicit empty_array.items contract or the unique common item type of independently typed peers in an if/case, coalesce, or array constructor. A schema-typed array with max_items: 0 and an explicitly typed empty array both supply evidence. Resolution is recursive, ignores only untyped NULL and untyped [] as type evidence, and fails if no unique type remains. It never searches arbitrary downstream consumers. The empty array itself is non-null with max_items: 0; peer nullability is not copied to it. An unresolved field may acquire its type from one explicitly mapped nullable ModelTask input. Outside these explicit type, local signature and peer rules, no other consumer context supplies an unresolved null type in 0.1; absence of a unique type fails with ACTQL_E_NULL_TYPE_UNRESOLVED. An operation may impose stricter preconditions, but not a different coercion. Expression-specific nullability, such as coalesce being non-null when an argument is proven non-null, is refined by Expressions and predicates after this structural join.

KeyComparable(A,B) compares non-null value domains, not entire contracts. Nullability and value-size bounds may differ; each input still satisfies its own contract, and the operation's null policy governs null keys. Base types must match without coercion. Decimal precision/scale may differ: decimal keys compare by exact numeric value under Exact decimal values. ResourceKind must match; ContentRef media restrictions do not change reference equality. Scalar and reference domains are comparable under these rules; object, array, json, and vector keys are not admitted. Join-key compatibility uses this relation, not TypeEqual.

For json_pick through a closed object, result nullability is the OR of the leaf's nullability and every traversed parent's nullability. A null parent returns null; an absent declared property violates the input contract. Parameter declarations reuse the recursive value domains with the parameter-specific default and nullability rules in Parameters and binding.

date and timestamp use the proleptic Gregorian calendar with years 0000 through 9999 and valid month/day combinations. Timestamps require hours 00–23, minutes/seconds 00–59, and exactly three fractional digits in UTC. Leap seconds and out-of-range dates fail. These value rules apply without the optional text-time profile, which only adds transformations over the domain.

Exact decimal valuesCopy Anchor Link

Decimal follows the AoA RelA exact-decimal contract. The closed type is {type: decimal, precision: P, scale: S, nullable: boolean}, with integer 1 <= P <= 38 and 0 <= S <= P. Its exact value is coefficient × 10^(-S). The machine coefficient is a base-10 integer string matching 0|-?[1-9][0-9]*, with at most P digits excluding the sign; leading zeros, a leading +, and negative zero are invalid.

Typed value identity is domain-separated from string identity and includes the decimal contract version, P, S, and coefficient. Each declared type has exactly one canonical spelling per value. Thus 19.90 at scale 2 and 19.900 at scale 3 compare numerically equal but have different types and typed value identities. Arithmetic and conversion rules are defined in Decimal expressions.

Decimal comparison, including join-key equality, compares the exact values coefficient × 10^(-S) without binary64 conversion or rounding. Equivalently, compare integer coefficients aligned to the greater scale; this comparison introduces no precision-38 intermediate-value restriction. Different precision or scale does not prevent comparison or an equal-key match. Hash-based joins use the same numeric equality, not typed value CID equality. This does not change either operand's type, canonical spelling, or typed value identity; changing a stored decimal's precision/scale still requires explicit conversion.

Canonical JSON, JSONL, and CSV serialization uses fixed-scale decimal text: exactly S fractional digits, no exponent or leading +, and no redundant integer leading zeros. When S is zero, the decimal point is omitted. JSON and JSONL encode this text as a string; declared decimal JSON inputs use that same canonical spelling. A coefficient outside the declared precision fails rather than being rounded or truncated.

Opaque reference valuesCopy Anchor Link

Two opaque scalar types cross carrier boundaries:

• resource_ref<K> is a projected Resource identity. It contains a provider namespace plus content identities for provider identity, authority scope, Resource boundary, and the complete reference. It contains no native provider locator, view, connector version, observation time, etag, or schema evidence.
• content_ref<Mime> identifies captured bytes and carries content CID, media type, bounded byte count/range, storage scope, truncation, sensitivity, capture authority, and optional source ResourceRef/version evidence.

ResourceRef equality is equality of identity_cid, scoped by provider namespace, ResourceKind, provider identity, authority scope, and boundary. Connection names and authentication revisions do not determine that identity. ContentRef equality is equality of content_ref_cid, including store, scope, retention, and policy; equal content_cid values establish byte identity only. SourceView and serialization output contracts may expose content_cid as a separate field.

Authored and checked ContentRef media_type descriptors MUST already use lowercase ASCII type, subtype and parameter names. Opaque parameter values, quotes, escapes, parameter order, whitespace and Unicode scalar sequences (including NFC/NFD differences) MUST remain exact descriptor data. Invalid syntax or noncanonical ASCII name case MUST be refused without rewriting the authored descriptor or its Program identity.

Connector-captured ContentRefs MUST retain the exact provider-reported MIME string in metadata.issuer_evidence.reported_media_type. The existing capture owner binds that report to the same checked Source request, scope, byte facts and issuer evidence before issuing the reference. The observed media_type uses case-insensitive MIME type/subtype and parameter names; parameter values MUST NOT be unconditionally lowercased or Unicode-normalized. MIME metadata does not prove that the bytes conform to that file format. Store derivation evidence MUST NOT claim a provider report.

Saved capture recovery MUST reproduce the exact original report, its projected media binding and complete issuer/Ref preimages, in addition to confirming the original Store custody and current authority. Missing, changed or mismatching reports MUST be refused without repair, new Source acquisition or relabeling prior evidence. A report or matching byte CID alone MUST NOT authorize issuance, extend retention, confirm cleanup or permit Model/Effect dispatch.

Reference equality MUST be consistent across predicates, joins, grouping, distinct, and uniqueness checks, independently of acquisition or in-memory object identity. Within each reference type, eq/neq use that equality. References are scalar keys for equality-based operations. For specification-defined canonical identity ordering and deterministic compiler completion, use AoA code-unit order of identity_cid for ResourceRefs or content_ref_cid for ContentRefs. This includes canonical group/partition enumeration and request-key ordering where the operation already admits reference keys; it does not expand any operation's admitted key or Carrier types. Machine-only means not author-selectable as a reference value order, not unobservable: the resulting canonical order remains part of observable semantics. Author-order restrictions and their validation boundaries are defined in Lexical and ordering rules.

Only a Connector host may issue a resource_ref. An content_ref may be issued only by a Connector capture or an authorized content-addressed Artifact Store derivation. Both issuers bind typed issuer evidence; the public protocol exports validators, not an author-accessible issuer. A reference grants no authority. Host-accepted bindings and Artifact or Result inputs MUST revalidate issuer evidence and current usage authorization; authored JSON alone cannot establish a valid reference. References serialize as tagged canonical JSON objects, but their internals MUST NOT be inspected or modified by expressions or json_pick.

An operation requiring a ResourceRef MUST receive it explicitly; hidden execution lineage MUST NOT restore a projected-away reference or supply an implicit write target. Mapping-based Effect selectors remain valid (Effect declarations). Binary bytes and base64 are not embedded into ordinary AoA JSON values, and image/audio-specific carriers do not exist.

Lexical and ordering rulesCopy Anchor Link

AuthorOrderable comprises string, number, decimal, boolean, timestamp, and date. CanonicalOrderable comprises those types plus resource_ref and content_ref. These are specification classifications, not source syntax. A portable order is the specified total order over non-null values of a CanonicalOrderable type: numeric order for number and decimal, false < true for boolean, chronological order for timestamp and date, the string order below, and reference identity order (Opaque reference values). object, array, json, and vector have no portable order. Null placement follows the operation's rules; null does not acquire a value order.

Every authored ordering key, ordered-comparison operand, and min/max input MUST be AuthorOrderable, regardless of operation or field spelling. This includes ranking and explicit tie-break keys, but not equality-based partition, grouping, correlation, or uniqueness keys. Reference identity order is available only for specification-defined canonical identity ordering and deterministic compiler completion (Opaque reference values).

Statically invalid order domains MUST be rejected during check. Where an existing rule permits deferred type validation, the Plan MUST retain the AuthorOrderable obligation and the runtime input boundary MUST validate it before evaluating the ordering operation. This rule permits no new deferral and never authorizes reference ordering.

Every lexicographic ordering in this specification uses UTF-16 code-unit order on the admitted values. String data is not normalized for comparison; identifier names retain their separate NFC/LF admission contract. Locale collation and Unicode code-point order are not permitted alternatives. Connector references are non-empty UTF-8 strings whose normalized spelling is identity-bearing. Author-facing Mapping Contract references use the typed-qualified closed ASCII grammar in Mapping contracts. They are not inferred from the surrounding field and do not change spelling during compilation. A compiler does not perform provider-specific case folding. Duration tokens have lexical form [0-9]+(ms|s|m|h|d), are ASCII case-insensitive at authoring, and canonicalize to positive safe integer milliseconds. Negative zero and non-finite numbers are invalid before identity computation.

Inputs and external contractsCopy Anchor Link

An input referenced as search_candidates.source declares an acquisition template, not a captured Relation. Check classifies that binding before input selection: it resolves the SourceView and static request without dispatch, and excludes it from initial capture and implicit sole-input selection. All references to that binding are template references from search steps; using it as top-level/step from, a local operation operand or Result input fails check, including mixed template/Relation use in one Program. Multiple search steps may reuse the template. An independent snapshot requires a separate input binding with its own complete request and capture evidence. Dynamic request roles are supplied only by each search step; static and dynamic roles together match the exact request contract. Template resolution does not grant provider access, create rows, or establish observation completeness.

Parameter and opaque binding values are declared and supplied under Parameters and binding; they are distinct from the external contracts selected by an input.

The external and computational models are orthogonal:

Resource -> SourceView ---------------------> Carrier
Relation -> ModelTask infer acquisition ----> Relation
Relation -> keyed SourceView join acquisition -> Relation
Relation -> Artifact serialization ---------> Relation<content_ref>
Relation<content_ref> -> typed external SourceView join -> Relation
Carrier  -> AoA algebra -> Effect Plan -> Receipt

Resource, SourceView, Carrier, and Effect are defined in Terms. SourceView, ModelTask, and Artifact serialization contracts are versioned barrier contracts, not intermediate languages. External inference and the acquisition selected for an external join are not AoA operations or business-state mutation Effects. Relation serialization is an explicit Artifact barrier rather than a hidden output-side post-processing pass.

Input duplicate normalizationCopy Anchor Link

Materialized relation inputs accept duplicates: reject or duplicates: {first_by_order: {order_by: [OrderKey, ...]}}; omission normalizes to reject. The array is nonempty and uses declared raw fields and the ordinary OrderKey grammar. The bare string first_by_order is invalid. First-by-order selects the first complete row per declared primary-key tuple using an independently admitted total order. The duplicated key itself, provider arrival order or an invented payload-CID tie-break is not that proof. Without it checking fails; an unkeyed raw input followed by explicit dedupe_rows is a separate business-selection path.

Admission MUST decode and normalize optional provider fields, then validate all raw rows' known fields, types, nullability and non-null key components before selection. A discarded malformed row cannot be hidden. Raw rows/bytes and normalized rows/bytes have separate limits. Non-null uniqueness is proved only on the selected output. Evidence binds the raw artifact, policy, order witness, normalized artifact and excluded count. Raw capture cursor and coverage are unchanged. An authoritative SourceView uniqueness violation remains a contract failure, not something an author can repair with first_by_order or a local schema override.

Local typed inputsCopy Anchor Link

A local input MAY use the short form:

inputs:
  rows: relation
  graph: graph
  events: events
  embeddings: vectors

or the object form:

inputs:
  rows:
    carrier: relation
    expected_columns: [id, status]

An optional inline schema supplies the closed field contracts defined in Closed value contracts:

inputs:
  orders:
    carrier: relation
    schema:
      id: {type: string, nullable: false}
      amount: {type: number, nullable: true}
      occurred_at: {type: timestamp, nullable: false}
      items:
        type: array
        nullable: false
        items:
          type: object
          nullable: false
          fields:
            sku: {type: string, nullable: false}
            quantity: {type: number, nullable: false}
    primary_key: [id]

primary_key, when present, is a non-empty field list. When a complete schema is available, every component MUST exist in it, have a scalar or reference type (Opaque reference values), and declare nullable: false. At the runtime input boundary, every component MUST be present, non-null, and a scalar or reference value, and, after the explicitly admitted input duplicate normalization, the complete tuple MUST be unique by canonical-value equality, including when static type evidence is unavailable. Reference components use the equality defined in Opaque reference values.

The Host may supply schema evidence under Check Environment and source evidence without an authored schema. Such evidence MUST satisfy any explicit input assertions. schema_ref is not an input field; unresolved descriptive labels belong in meta (Authoring Context).

carrier is REQUIRED for an opaque local input. expected_columns is OPTIONAL but, when present, MUST be a duplicate-free array of non-empty field names. Runtime bindings MUST be checked against it before computation. It requires those columns to be present but permits additional columns and specifies neither column order nor value types. A compiler MUST NOT infer a complete field set from expected_columns alone. When schema is also present, every expected column MUST belong to that schema.

Check reports one of three evidence levels rather than rejecting every partially described relation: typed for a resolved complete schema, columns_only for known column names without a complete typed schema, and unknown when neither is available. Static evidence checking MUST NOT reject an operation solely because evidence unrelated to its required proofs is absent.

This rule does not exempt language violations, authorization denials, or runtime failures. A required proof must be established during check unless the operation's existing rules permit a deferred validation obligation; such an obligation is retained in the Plan and discharged at its specified runtime boundary. These evidence levels introduce no additional permission to defer validation.

Known field names, field-set completeness, recursive type evidence, candidate keys, and ordering witnesses are independent evidence axes. columns_only may describe a subset or a complete set of names; the complete set must have separate evidence. The three levels above summarize type knowledge, not all five axes.

Connector SourceViewsCopy Anchor Link

A connector input names a Host-published Connector instance (connector), a Resource within it (resource), and an observation of that Resource (view). The instance selector identifies a Catalog entry, not a Connector implementation name or connection revision (Resource identity contract). For example, if the admitted Catalog exposes only the records SourceView for Opportunity:

inputs:
  opportunities:
    connector: crm/main
    resource: Opportunity
from: opportunities
steps:
  - select: [id, account_id, stage, amount]
  - filter: "stage NOT IN ('ClosedWon', 'ClosedLost')"

connector and resource are required. When view is omitted, Check MUST resolve it from all SourceViews for that exact pair in the admitted Catalog: zero views is rejected as unresolved; one is completed under actql.source.sole-view-completion; more than one is rejected with ACTQL_E_SOURCE_VIEW_AMBIGUOUS and the candidate list. Resolution MUST NOT filter candidates by current execution permissions, request compatibility, or downstream expressions. An explicitly selected SourceView MUST match the full (connector, resource, view) selector, including when a contract CID is pinned. Check does not synthesize a SourceView, implicitly select records, or fall back across Resources. Catalog publication is governed by Connector Catalog and lock.

SourceView resolution MUST bind the concrete Resource using its admitted output data-policy source_ref, exactly `"connector://" + connector_id + "/" + resource

• "#" + view_id, with nonempty resource; resource_kindis a type, not that address. This is literal string construction, not URL parsing: the knownconnector_idprefix andview_id` suffix delimit the Resource. Percent escapes, slashes and fragment characters inside the Resource remain literal. Authored selectors use their source-normalized strings exactly, with no URI-prefix removal, slash trimming, percent decoding or case folding. Different Resources may expose the same kind and view name.

Before resolving inputs, Check MUST reject every supplied SourceView whose policy source reference does not have that exact prefix, nonempty Resource and suffix, and reject duplicate (connector_id, resource, view_id) selectors, even across different kinds or versions and even when unused. This check follows policy-reference admission; Catalog integrity alone does not establish Resource selector uniqueness. Ambiguous candidate names are reported in UTF-16 order.

The resolved Plan MUST identify the SourceView and bind its contract CID. A Catalog change requires rechecking against the new Catalog; it MUST NOT retarget a sealed Plan. Completion is recorded in the normalization journal (Deterministic completion), not required as a rewrite of the authored Program.

The SourceView contract determines acquisition semantics, read authority, output Carrier/schema/facts, ResourceRef issuance, read modes, checkpoint/delivery contract, and pushdown capabilities. Authors MUST NOT repeat the output Carrier. A relation SourceView lowers directly to an AoA relation source; SourceView resolution is not another IR.

Catalog discovery MUST expose each SourceView's name, request contract, acquisition kind, authority, observation classification, output Carrier/schema, modes, and contract CID, including any extraction contract. Human-readable discovery MUST present these facts rather than names alone. Authors and generators select SourceViews from this evidence, not by inferring meaning from their names. Acquisition review projections MUST include the SourceView classification and contract identities reported by the Plan summary (Diagnostic documents), subject to redaction.

request is validated against the resolved SourceView request_schema. It may contain literals, typed scalar parameters, or an explicit {$binding: name}. Opaque invocation bindings are declared separately from scalar parameters:

bindings:
  target_file:
    type: resource_ref
    resource_kind: google_drive.file

inputs:
  file:
    connector: google_drive/main
    resource: drive_file
    view: content
    request:
      resource_ref: {$binding: target_file}
      max_bytes: 262144
      require_full: false

Each field of an authored static request is one whole-value slot. An exact singleton {$param: name} or {$binding: name} at that slot denotes the named declaration; other slot values are literal JSON. Request decoding MUST NOT descend into literal values to discover or substitute references. In particular, nested parameter-shaped or binding-shaped business objects are data, and a literal key does not introduce an additional request quotation operator. The resolved request contract still determines each slot's admissible type and whether all required static and correlation roles are covered.

The host supplies the opaque binding at invocation. Its declaration and request position belong to Program identity; the concrete binding belongs to Invocation identity and resolved_request_cid source evidence. Bindings MUST be used only inside SourceView requests. A binding MUST NOT create a ResourceRef or ContentRef. The host invocation contract MUST expose each declaration name and its resource_kind or media-type constraint separately from the opaque values artifact. Authors MUST NOT inspect that artifact to discover keys, and authoring tooling or compiler MUST NOT guess a missing binding name.

Without all declared opaque bindings, checking establishes only a template proof. An executable Plan requires every binding, validated for presence, kind, and request compatibility (Parameters and binding). Execution MUST use those bound values. The public planning result MUST redact opaque values and resolved requests, reporting only declaration names, constraints, and binding status.

Ordinary SourceView requests are static: they may use literals, parameters, and Host bindings. Data-dependent SourceView acquisition uses the checked external-join lowering in External SourceView joins, or search_candidates for ranked candidate retrieval. A finite left key/query set drives one pinned SourceView access path, with the distinct completeness requirements of each operation. Programs cannot author a general fetch/follow DAG or row-driven acquisition loop.

Every field declared by a complete request contract is present in the resolved request object. nullable: true permits the value null; it does not permit the field to be absent. A Connector MUST bind every declared request field to one typed planning/execution consumer. Declaring a field and then ignoring it is a contract error.

Every resolved SourceView is a canonical actql.source_view/0.1 contract with:

connector_id, connector_version, resource_kind, view_id, view_version,
acquisition {kind, authority, request_schema, modes, default_mode,
             optional correlation {request_fields, response_fields, identity, cardinality},
             optional batching},
observation {kind, optional transform},
output {carrier, schema, facts}, optional resource_identity,
pushdown {contract, operations}, contract_cid

For a keyed access path, acquisition.correlation.cardinality declares the response cardinality (zero_or_one | zero_or_many | one | one_or_many) per requested key. It is not an output.facts field or an authored join assertion. The correlation contract also names request fields, response fields, and response identity; External SourceView joins defines their use in external joins. Join cardinality assertions use the distinct vocabulary and meaning in join.

Each SourceView's request contract MUST be a complete non-null checked object contract, including for views without correlation. Its fields may themselves be nullable; a nullable field still requires a value. A declared correlation uses a search, fetch or follow acquisition and refers to record fields of a Relation, Events or Vectors output. This field-based correlation grammar does not flatten a Graph's nodes or edges into a response record. Request and response field lists are nonempty, duplicate-free and have equal length. Positions pair in supplied order, and every pair resolves existing fields with compatible KeyComparable contracts. Their nullability, string extents and decimal precision/scale need not be identical; declaration compatibility does not bypass actual request-value constraints or the selected null-request policy.

The declared response identity MUST be a nonempty ordered list of distinct existing response fields with non-null KeyComparable contracts. It may overlap the response key fields and need not equal an Events or Vectors intrinsic identity role. It is an acquisition response identity, not a replacement for that Carrier's semantic identity. Validation retains all supplied tuple orders and exact contract ownership without coercion. Non-null types alone do not prove identity uniqueness, response cardinality, completeness, ordering or successful request execution. The existing acquisition obligations still enforce those claims on actual responses. Native batching's transport contract and value validation are separate from these single-request correlation declarations.

acquisition.kind is exactly one of scan, search, fetch, or follow. They mean finite collection enumeration, provider candidate search, exact Resource observation fetch, and provider-declared relationship traversal. Search MAY be ranked and incomplete; it MUST NOT be promoted to a complete extent. Read authority is exactly read_metadata, read_content, or read_binary. A metadata SourceView cannot expose a content or ContentRef field. Referencing one is a check failure. A reference to such a field MUST NOT trigger an implicit read-authority upgrade.

observation.kind MUST be one of the following, with the specified meaning. Observation classification is independent of the output Carrier.

observation.transform MUST be a transformation contract reference for extraction and absent otherwise. Check MUST reject unregistered transformation contracts under SourceView transformation profiles; a Connector-supplied CID alone does not register a transformation. Provider export is capture; parsing its returned bytes is extraction. Extraction evidence MUST bind the captured content CID, resolved arguments, and transformation contract CID.

A SourceView MUST NOT invoke a model as an implicit part of observation; model acquisition uses the ModelTask boundary (Model acquisition: infer). The Host MUST admit the concrete combination of acquisition, authority, observation, and Carrier under its supported contracts, and reject unsupported combinations before provider access. Classification and self-CIDs do not replace conformance or runtime authority checks. Connector-defined names do not extend these laws.

Read modes are snapshot, changes, and watch. Snapshot denotes a finite observation, not proof of a capacity ceiling or snapshot consistency. Changes declares a cursor/watermark/history/resource-version/offset/opaque checkpoint and may execute in 0.1 only when the requested page/range is bounded. Watch is unbounded: selecting it is statically unsupported, even if a Catalog advertises it for another profile. Check MUST report that unsupported selection, and the runtime MUST recheck it before network access. Delivery facts distinguish ordered/partition-ordered/unordered delivery, possible duplicates, acknowledgement, lease, reset, and replay policy. Provider receive order is not event-time order.

A SourceView's advertised read-mode names MUST be unique, and default_mode names exactly one advertised mode. A snapshot mode has bounded: true, a watch mode has bounded: false, and both changes and watch carry a checkpoint contract. A snapshot may also declare a checkpoint. A changes mode may advertise either boundedness; admission of its declaration is distinct from permission to select it for execution. Advertising watch does not make its selection supported in ActQL 0.1. Validation preserves supplied mode order and does not insert a missing default, checkpoint or boundedness declaration.

Snapshot acquisition remains subject to checked ceilings and their enforcement boundaries (Author guards, resolved limits, and Plan facts). Consistency within and across acquisitions depends on the admitted source evidence, not the mode name (Runtime source evidence).

The outgoing checkpoint is provider delivery evidence. It is computed from the provider page/range before user projection, filter, ordering, or limit and is carried separately from relation rows. Those relation operations MUST NOT rewind, erase, or otherwise derive the provider checkpoint.

The stable rejection codes are:

ACTQL_E_SOURCE_READ_MODE_UNSUPPORTED
ACTQL_E_UNBOUNDED_EVENTS_UNSUPPORTED
ACTQL_E_SOURCE_CARRIER_UNSUPPORTED

Execution of a SourceView requires support for its acquisition and Carrier contracts. A runtime MUST reject missing support before provider access; it MUST NOT silently convert graph, vectors, or events to relation. Pagination, retry, projection pushdown, filter pushdown, and completeness remain connector capabilities, not ActQL operations.

A compiler or runtime MUST report whether a connector result is complete. It MUST NOT represent a partial result as complete.

The closed author-facing scan vocabulary contains only mode. mode may select only a mode in the resolved SourceView. A concrete change checkpoint is Invocation/Run state and is invalid in Program source. Projection, filtering, ordering, limiting, and deduplication use ordinary select, filter, sort, take/top_k, and dedupe_rows steps. A Connector MAY push down those checked operations only when its capability evidence proves the same semantics; otherwise the runtime MUST apply them locally or reject before provider access. It MUST NOT interpret an author-only scan predicate, projection, order, limit, or uniqueness dialect.

Connector inputs MUST NOT repeat local carrier, expected_columns, schema, or primary_key declarations. The pinned SourceView contract owns those facts. Such fields are invalid rather than drift assertions that could disagree with the authority-bearing contract.

For a Relation SourceView, its referenced carrier_facts body MAY contain relation_keys: {candidate_keys: [[field, ...], ...]}. This component is closed: the collection and every tuple are nonempty, names in a tuple are distinct, and repeated identical tuples are invalid. Other carrier-facts components retain their existing grammar and admission; the enclosing facts object remains extensible. Each component name resolves exactly against the same SourceView's complete checked output schema, with required presence, non-nullability and the existing KeyComparable value-domain rules. A declaration is conditional input-admission evidence, not proof obtained from a schema or sampled rows.

The checker MUST retain the exact SourceView, facts Envelope, Catalog and schema ownership and the ordinary key-validation obligations. Before a consumer relies on a declared key, the runtime MUST validate it across the complete resolved acquisition, including duplicates on different pages and fully identical repeated rows. Filtering or projection MUST NOT erase that pending obligation, and a filtered subset MUST NOT establish uniqueness of its original acquisition. NULL or missing components and duplicate tuples fail atomically without a published Result. Missing execution support MUST be rejected before provider access. Provider arrival order, delivery-order labels and old facts without this component MUST NOT be promoted to a key or total-order witness.

For a Relation SourceView, its referenced carrier_facts body MAY contain relation_scores: {field: ScoreContract, ...}. This field-scoped map uses the existing closed ScoreContract reader: nonempty domain and normalization, finite ordered two-number range, and optional higher_is_better: true. Fields MUST resolve exactly against the same SourceView's required, non-null Number fields. Duplicate names, unknown fields and invalid contracts are invalid. An absent or empty map asserts no scores. The enclosing facts object remains extensible; unknown extensions are not implicitly admitted as complete bodies.

The checker MUST retain the original facts Envelope, Catalog, SourceView and schema. It MUST project these assertions through the existing ranking-evidence owner, never through a same-named local snapshot or operation argument. Before relying on an assertion, the runtime MUST validate every declared score across the complete captured input, before filtering, renaming, overwriting or dropping fields. Non-finite, NULL, missing and out-of-range values fail without publishing a Result. Existing lawful metadata transfer applies; computed or overwritten scores MUST NOT inherit an unrelated original assertion. Validation consumes the existing work allowance and retains input custody until cleanup completes. Unavailable runtime support MUST refuse before provider access. Empty and key-only facts and historical saved Run identities retain their meaning.

A SourceView used as the keyed right side of an external join MUST NOT author scan, including an empty object. Its keyed access path and bounded default mode are owned by the pinned SourceView contract. Mode selection is available only when the SourceView is read directly; a future checkpointed keyed access path requires its own fully bound contract rather than silent reuse of scan vocabulary.

Whenever the resolved read mode is changes, whether explicit or supplied by the contract's default_mode, the compiler MUST produce a content-addressed actql-source-state-requirement/0.1 in the checked Plan. The requirement binds the Program Definition, owning stage_id, input name, SourceView Contract, mode, and checkpoint value contract. A concrete checkpoint is private Run material represented by an actql-source-state-binding/0.1; changing it changes Invocation/Run identity, not Program Definition identity.

The requirement's stage_id MUST be the normalized authored ID of the Stage that declares the input, and input_name MUST remain that Stage's normalized input name without an encoded prefix. Both fields participate in the canonical requirement preimage. Distinct Stages with the same input name and SourceView MUST NOT share a source-state requirement. requirement_cid hashes the complete canonical requirement object except requirement_cid itself; no concrete checkpoint or internal Stage index is substituted for the owning Stage ID.

For resolved changes inputs, the compiler MUST emit requirement: required and initial_position: explicit_state_required. ActQL 0.1 does not infer an initial checkpoint from missing Run state or from the fact that the Contract advertises a bounded mode. The checkpoint value is admitted separately against the exact selected mode's checkpoint value contract before acquisition.

Changes-read state is governed by Source-state advancement. Local graph, vector, and event inputs belong to their algebra profiles independently of Connector execution support.

Parameters and bindingCopy Anchor Link

ActQL 0.1 has typed invocation parameters for reusable programs:

params:
  cutoff: {type: timestamp}
  threshold: {type: number}
  account_ids:
    type: array
    items: {type: string}

steps:
  - filter: "occurred_at >= $cutoff AND score >= $threshold"

Scalar parameter types are string, number, decimal, boolean, timestamp, and date. Closed typed objects and homogeneous recursive arrays are also admitted. Arrays declare one item contract under items and MAY declare a positive fixed length, which is required when the value is used as a fixed-dimension query vector. Decimal declarations MUST specify literal precision and scale under Exact decimal values; decimal array items declare the same pair once under items, shared by every element. For example:

params:
  unit_price: {type: decimal, precision: 18, scale: 2}
  tax_rates:
    type: array
    items: {type: decimal, precision: 5, scale: 4}

Decimal bindings MUST use the fixed-scale canonical string representation defined in Exact decimal values. Binding MUST reject noncanonical text, precision overflow, and binary64 numeric input without implicit rounding or conversion. Parameter value identity MUST use the typed decimal identity of Exact decimal values, not the identity of its wire-format string, including for array elements.

Number declarations MAY add integer: true and finite inclusive minimum/maximum; string declarations MAY add format: duration. These type-specific constraints apply recursively to Parameter object fields and array items. integer: false imposes no integrality restriction; integer: true requires a finite integral binary64 value, not an implicit safe-integer ceiling. Array length is a positive safe integer and fixes the exact element count; the shared optional max_items bound remains a nonnegative safe integer. These constraints are checked at bind time, before AoA lowering. Parameters may appear in scalar value positions, including predicate literals, explicit ID lists, time/duration values, k, query vectors, and numeric author guards, including max_items, max_output_rows, and serialization bounds. They MUST NOT select an operation, input/result name, field name, join kind, metric, direction, contiguity, overlap, connector, resource, view, mapping, permission, approval, or failure policy. A sequence pattern is structural and cannot be parameterized.

The additional recursive-value positions are exactly a values CellValue {$param: name}, a pivot fill CellValue {$param: name}, an immediate EffectValue {literal: {$param: name}}, and a SourceView request value role accepting the same declared object/array contract. An array parameter may also occupy an IN literal list, explicit ID list or query-vector value where that consumer admits its element contract and extent. Only these whole-value holes are substituted, once; nested business JSON is opaque. An object EffectValue may supply an object-valued mapped field, but this does not turn raw create.payload into a recursive template or parameterize its field names. Existing consumer type, constructibility, egress and bound rules still apply. A declared recursive value is not permission to use it at an otherwise structural position.

Invocation value admission is closed:

In Parameter type syntax, nullable defaults to false at every recursive type position, including object fields and array items; this shorthand does not change the explicit-nullability rule for general value contracts or checked contracts. default and annotation meta are admitted only on a named Parameter declaration, not on its nested type contracts. A business object field named meta is ordinary data. Optional default is a complete typed canonical literal, never an expression, clock, environment lookup or reference to another parameter. Every object field is required; nullable does not mean optional. Default substitution is top-level only, without deep merge. An explicit null is never replaced by the default. Ordinary parameters cannot fabricate opaque references or secrets. Consumer constraints such as positive safe-integer guards are checked independently of parameter nullability.

Effective parameter values MUST be resolved once before the Program starts and remain immutable across all stages, attempts and resume. Explicitly supplying a default's value and omitting that value have the same typed values CID; origin evidence is separate. Changing the default declaration changes Program semantics. Usage is checked over all stages; extra supplied names and unused declarations remain invalid. Public explain exposes type, bound state and default presence, not private values.

For a direct SourceView, the authored request supplies its entire closed request schema. For a keyed SourceView join (External SourceView joins), those fields are the disjoint union of authored static request fields and Contract-defined correlation fields; missing fields, overlap, and extra fields are rejected.

Check MUST classify a correlated SourceView input using both its authored request fields and its actual consumers. Supplying every correlation request field selects direct acquisition, including when that resulting Relation is a join operand; a join reference does not remove supplied values or turn that request into a key-driven template. Supplying none selects keyed acquisition only when the input has at least one logical join-right consumer and no other direct operation or Result consumer. Supplying only some correlation fields, using an incomplete template directly, or leaving such a template without a join-right consumer fails Check. A SourceView without correlation uses direct request admission. Every non-correlated request field remains required in either form. Classification does not prove boundedness, response completeness, mode support, policy admission or the remaining join requirements, and does not authorize deleting an unused declaration or an authored operation.

Within EffectValue, {literal: {$param: name}} is an immediate parameter hole; other literal payloads are opaque JSON, not recursively substituted. An explicit create.payload is likewise data, including $param-shaped objects.

A parameterized author guard MUST resolve to a positive safe integer before executable planning. It retains the fail-closed semantics of a literal guard (Author guards, resolved limits, and Plan facts), and does not override Contract or Host ceilings or grant authority.

Every declaration MUST be referenced and every runtime invocation MUST resolve all references by explicit binding or a missing-only default to a value of the exact declared type. Binding does not rewrite the Program CID. A change to canonical bound values changes parameter_values_cid, compiled-plan identity, Invocation CID, and any resulting Effect Preview CID, even if the lowered AoA computation is unchanged (Canonical identities). An approval MUST NOT carry across a parameter change.

Parameter binding precedes bound AoA lowering. The semantic phases (Normative conventions) have the following obligations; they do not prescribe compiler pass names:

checking   template + Check Environment proof
binding    canonical values + range/length/duration proof
planning   substitute bound values before AoA Fragment and barrier planning
execution  capture source evidence before establishing Invocation identity

actql-bound-invocation-template/0.1 binds Program Definition CID, Parameter Values CID, Check Environment CID, and the fact that runtime source evidence remains unbound. The compiler MAY use type-valid witness values solely to prove the template; it MUST NOT publish a compiled-plan or invocation identity for those witnesses. Planning without every referenced value reports needs_bindings and does not publish a runnable Plan Document. Emitting a Plan Document and starting execution require every referenced value. Effect preview accepts a Captured Run and MUST NOT perform parameter binding again. An executable Plan MUST bind the exact parameter values used to resolve its operations and limits; execution MUST NOT substitute different values.

Callers supply concrete values. A Host that derives parameters from clocks, schedules, or other invocation settings MUST resolve them before executable planning and retain them for the Run. Same-Run retry or resume MUST NOT recompute these values. Schedule registration is not authorization of future executions; each occurrence is subject to Run admission (Run admission and identity).

Note (informative): A scheduler may store a Program and parameter-generation settings, then bind values and plan each occurrence. Timezone and whether a date is derived from the scheduled or actual start time are Host settings, not implicit ActQL expressions.

Resource identity contractCopy Anchor Link

A SourceView resource_identity contract contains only the static provider namespace, ResourceKind, provider-ID field, output field, and required boundary topology. Connection revision, concrete authority scope, and boundary CID are resolved connection evidence recorded by the plan/source evidence and hydration receipt; host connection-secret rotation does not churn the static Connector Catalog or lock. The SourceView issues the same resource_ref<K> for the same provider namespace, resolved authority scope/boundary, ResourceKind, and provider identity across all its views. View/version/etag/observation facts do not alter Resource identity. Runtime hydration, Artifact issuance, and availability leases are specified in Reference admission and availability.

Expressions and predicatesCopy Anchor Link

Expression text and structured trees share one typed expression model. Expression<T> produces a value of T; Predicate names a condition position requiring a boolean Expression, optionally nullable, not a separate value domain. Comparisons and boolean operations produce true, false, or null (the three-valued unknown). Storing the result preserves null. No string or number truthiness is admitted. A boolean field or function is directly usable as a condition. if(p, TRUE, FALSE) deliberately maps null to false; it is not the general representation of a boolean expression's value.

count counts non-null argument values, including false; count_if counts only true. Each consumer uses these rules without inserting a Program-level cast or changing the boolean expression's identity.

The following table closes expression placement and lowering in 0.1:

An inadmissible expression or selector node MUST fail during check in either notation. Moving a subexpression to a separate step is valid only if its evaluation conditions, failure behavior, and resource bounds remain unchanged; a compiler MUST NOT evaluate an unselected branch by hoisting it before its conditional. Profile admission applies to every branch, but a pure profile does not require an author-visible intermediate step. Effect selector and invocation-value restrictions are not widened by expression composition.

Source notation and precedence are in Expression text; canonical representation, printing, and diagnostics in Decoding, identity, and printing. Value families and their evaluation rules are in Scalar expressions and Decimal expressions–Text, time, and regular expressions; predicate structure and evaluation are in Predicates.

Scalar expressionsCopy Anchor Link

An expression or predicate position accepts expression text (Expression text) or the structured tree form. In the tree form, field references, literals, and parameters use {field: ...}, {literal: ...}, and {$param: name}. Text is decoded to the same tree before identity computation (Decoding, identity, and printing). Strings in non-expression positions, including inside literal, meta, requests, and template bodies, retain their declared meaning and are not recursively parsed as expressions. The Core scalar grammar contains:

• arithmetic add, subtract, multiply, divide, and modulo;
• boolean/comparison expressions, case, three-argument if, coalesce, and nullif;
• len, contains, starts_with, ends_with, concat, safe_div, safe_divide, safe_add, safe_subtract, safe_multiply, safe_negate, sqrt, cbrt, sin, cos, tan, asin, acos, atan, atan2, sinh, cosh, tanh, asinh, acosh, atanh, pow, exp, ln, log, log10, abs, sign, round, trunc, greatest, least, and floor;
• the authoring-only string template form;
• lower, upper, trim, ltrim, rtrim, substring, left, right, lpad, rpad, split, and literal replace;
• date_trunc, date_add, and date_diff; and
• explicit to_number, to_string, to_boolean, and to_timestamp;
• to_decimal, try_decimal, quantize, and decimal_divide; and
• closed object, homogeneous array and typed empty-array construction;
• typed property/subscript access and type-preserving numeric negate.

coalesce is a lazy expression, not a macro that evaluates a child twice. template is a deterministic authoring macro for ordinary messages and labels:

- derive:
    message: {template: "{name} is at risk — active users: {active_users_30d}"}

Each {field} placeholder MUST name one visible string, number, decimal, boolean, timestamp, or date field. The compiler MUST lower placeholders to canonical to_string followed by left-to-right strict concat_strict. The lowering uses no locale, host formatting, or expression evaluator. {{ and }} emit literal braces. Unmatched braces, empty placeholders, unknown fields, and non-scalar fields are invalid. Null interpolation follows the to_string and concat_strict rules and therefore produces null. Parameters and nested expressions are not template placeholders; authors use the ordinary explicit expression grammar when those are required.

substring(value, start[, length]) MUST use the GoogleSQL STRING position rule in the common scalar owner: positive positions are one-based, zero and positions below negative input scalar length select the first scalar, other negative positions count from the end, and positions beyond the input select an empty string. An omitted length retains the suffix, zero length returns empty, and positive length retains at most that many Unicode scalars. Every supplied child evaluates once in value/start/length order; any NULL result propagates after all children succeed and before domain validation. A non-integer or unsafe start/length, or negative length, fails only when the non-null call is demanded. Index arithmetic is exact and clamped before addition. Retained scalars, including astral, combining, NUL and line breaks, remain unchanged. The result retains known input max_codepoints and max_utf8_bytes, drops min_length, and unions supplied operand nullability. The closed source body is {substring: {value, start, length?}}; omission is preserved in the corresponding machine body. SQL SUBSTR and SUBSTRING select this same operation, with the existing finite binary64 safe-integer range rather than the complete GoogleSQL INT64 domain. BYTES is not admitted. Substring has no text-time envelope/profile requirement; nested profile calls retain their own obligations, input preflight and selected resource limits. All scalar logical-work, live-value, output-byte, workspace, failure and cooperative cancellation requirements remain applicable.

left(value, length) and right(value, length) MUST return at most the specified number of Unicode scalars from the corresponding end. Zero returns empty; a length at least the input scalar count returns the entire input. lpad(value, length[, pattern]) and rpad(value, length[, pattern]) MUST return exactly the requested scalar length. They truncate the original value to its leftmost requested scalars when the requested length does not exceed its length. Otherwise they prepend or append repetitions of the pattern, taking only the needed prefix of its final repetition. The omitted pattern is U+0020. An explicitly empty pattern is a domain failure even when no padding is needed.

Every supplied child MUST evaluate once, left to right, before strict NULL propagation and then domain validation. A demanded, non-null call fails for negative, nonintegral or unsafe-integer lengths. Child failure identity and lazy branch demand remain unchanged. All lengths use ActQL finite binary64 safe integers; full GoogleSQL INT64, BYTES and collation remain unsupported. Unicode scalars, including astral characters, combining marks, NUL and line breaks, MUST remain unchanged without normalization or grapheme segmentation.

The common source bodies are ordered arrays: {left: [value, length]}, {right: [value, length]}, {lpad: [value, length, pattern?]} and {rpad: [value, length, pattern?]}, with corresponding machine operation/body arrays. Omission stays omitted; an implicit pattern expression is not inserted. Side slices retain input String maxima and drop minimum length. Padding drops input maxima because runtime padding can expand beyond them. All supplied operands contribute to result nullability. The existing scalar continuation owns cooperative counting, boundary location, exact output sizing and construction. Before output buffer allocation, all output logical bytes and workspace MUST be admitted. Retained operand roots, logical work, live values, control work and cancellation stay with the existing owners.

split(value[, delimiter]) MUST accept one STRING expression and an optional ordinary STRING delimiter expression, returning an Array of non-null String elements. The Array is nullable exactly when any supplied operand is nullable; untyped NULL takes the unique STRING signature at either position. The admitted domain is the existing finite, bounded String domain without implicit conversion, BYTES, regular-expression or collation overloads.

A demanded non-null split MUST split at non-overlapping literal matches of the delimiter in authored input order, preserving leading, adjacent and trailing empty parts. An omitted delimiter is U+002C COMMA. Empty input produces one empty String, including with an empty delimiter; an empty delimiter on nonempty input produces one String per Unicode scalar. No normalization, case folding, trimming or grapheme segmentation is applied, including to astral characters, combining marks, NUL and line breaks. A literal match does not restrict the delimiter expression to a literal or parameter.

The split result type MUST retain the input String's known max_codepoints and max_utf8_bytes on its non-null element contract and drop min_length. For a known scalar-count ceiling n, use max_items = n + 1 only when that addition is representable in the existing safe-integer bound domain. The ceiling is the smaller of both known input maxima, or the sole known maximum; a UTF-8 byte ceiling is also a conservative scalar-count ceiling. If neither is known, or the addition is unrepresentable, omit max_items. Type derivation does not evaluate the value or delimiter expression or invent a minimum bound.

Every supplied split child MUST evaluate exactly once, value before delimiter, before strict NULL propagation. A NULL value does not suppress a demanded delimiter failure. Preserve the first child failure and enclosing lazy demand; no secondary evaluator or Host splitting helper replaces the common owner.

The common source and machine node MUST retain ordered argument arrays, {split: [value, delimiter?]} and {op: split, body: [value, delimiter?]}, including a one-element array when the delimiter is omitted. Omission remains distinct from explicit NULL or an explicit comma expression. Do not fold the node, reorder children or substitute the separately owned split_part profile. Earlier pinned bodies retain their original meaning and identities.

The common expression continuation MUST preserve retained operand roots, logical operand/result charges, control work, live-value/output-byte limits, node/depth limits, workspace limits and cooperative cancellation throughout literal search, exact sizing and construction. Admit the complete Array's wire bytes, node/depth shape, String storage and Array slots before allocating output builders or their storage; no eager whole-input split or boundary array substitutes for bounded continuation work. This is an ordinary common expression with no split-specific text-time profile, policy or envelope; nested profile calls retain their own obligations and input preflight.

byte_length(value) and unicode(value) MUST accept exactly one STRING expression and return Number with that operand's nullability. chr(value) accepts exactly one finite Number expression and returns String with its operand's nullability. Untyped NULL takes each operation's unique signature. The CHR result has intrinsic max_codepoints = 1 and max_utf8_bytes = 4, without a minimum length; type derivation does not evaluate its child. There are no implicit conversions, BYTES, Decimal or distinct INT64 overloads.

A demanded non-null byte_length MUST return the exact UTF-8 byte count of its complete String operand, including zero for empty input. This is not a UTF-16 code-unit, Unicode scalar, grapheme or JSON-escaped byte count. Preserve all input scalars without normalization; octet_length is its text alias.

A demanded non-null unicode MUST return the first Unicode scalar's code point, or zero for empty input or a leading U+0000. An astral scalar contributes its complete code point, not a surrogate or encoded byte. Combining marks remain independent scalars without normalization or grapheme segmentation.

A demanded non-null chr MUST require an integral Number in the inclusive ranges 0..55295 or 57344..1114111 before integer conversion. Zero returns an empty String; every other admitted code point returns exactly one Unicode scalar, including noncharacters. Negative, fractional, surrogate and above U+10FFFF values fail without truncation or wrapping. NULL propagates before this domain validation and produces NULL.

The common expression continuation MUST demand each sole child exactly once and preserve its failure before strict NULL propagation. Enclosing lazy demand, retained roots, logical operand/result and control charges, live-value, output-byte, workspace and cancellation owners remain unchanged. Admit complete CHR output bytes and storage before constructing the bounded String. These ordinary operations require no text-time profile or frontend/Host evaluator.

Canonical lowering MUST retain the three closed direct unary source bodies {byte_length: expression}, {unicode: expression} and {chr: expression} and corresponding {op, body: expression_node} machine nodes, without folding, duplication or synthetic arrays. SQL and expression-text BYTE_LENGTH and OCTET_LENGTH share byte_length; no canonical octet_length operation is added. UNICODE and CHR select their respective common nodes. Earlier pinned contract bodies retain their original meaning and identities.

sin, cos, tan, asin, acos, atan, sinh, cosh, tanh, asinh, acosh and atanh MUST accept exactly one finite binary64 Number operand; atan2(first, second) accepts exactly two ordered finite Number operands. Each returns Number, nullable exactly when any operand is nullable. Untyped NULL takes the unique Number signature. No implicit conversion, distinct INT64/NUMERIC/BIGNUMERIC, Decimal or non-finite overload is introduced.

sin, cos and tan MUST compute their circular functions with radians; asin, acos and atan return principal inverse values in radians, with ranges [-pi/2, pi/2], [0, pi] and [-pi/2, pi/2] respectively. sinh, cosh and tanh compute their hyperbolic functions; asinh, acosh and atanh compute the corresponding inverse functions. Reject non-finite operands and preserve the existing arithmetic failure for any non-finite result, including hyperbolic overflow. Canonicalize every zero result to positive zero.

Demanded non-null asin and acos MUST fail outside [-1, 1], acosh below 1, and atanh outside the strict interval (-1, 1), including both endpoints. These checks follow strict NULL propagation; the other direct operations add no finite-input domain restriction. A finite result is still required.

atan2(first, second) MUST compute the principal inverse tangent of first/second in [-pi, pi], using the signs of both arguments for the quadrant and passing first then second directly to core atan2, without division or argument swapping. Raw signed-zero pairs (+0, +0) and (-0, +0) yield canonical positive zero, (+0, -0) selects positive pi, and (-0, -0) selects negative pi. Public canonical Number zero is positive, so public atan2(0, 0) is positive zero; the raw signed-zero diagnostic does not admit negative-zero wire values.

Each direct trigonometric operation MUST use the same pinned portable MoonBit core Double primitive in src/scalar_numeric_kernel across JS, WebAssembly and Native, with canonical finite-result validation. Reconstruction from other operations or a frontend/Host evaluator is forbidden. Preserve all existing numeric accuracy and exception contracts. Identical admitted inputs and selected semantic contracts preserve exact logical Number bits across targets; live-BigQuery last-bit equivalence is not claimed.

Typing MUST check every authored Number operand without evaluating it and return Number, nullable exactly when any operand is nullable. Runtime domain checks do not narrow the static type or add a distinct numeric overload.

The common continuation MUST demand each child exactly once in authored left-to-right order, preserving child failures before strict NULL propagation and only then applying value-domain checks. Preserve enclosing lazy demand, retained roots, logical operand/result and control charges, live-value and workspace limits, and cooperative cancellation through the canonical scalar owner.

Canonical lowering MUST retain each unary source {name: expression} and matching machine {op: name, body: expression_node}; atan2 retains the ordered pair source {atan2: [first, second]} and matching machine {op: atan2, body: [first_node, second_node]}. SQL and expression-text calls select these same direct operations without folding, duplication, synthetic children or frontend evaluation, including constant arguments. Earlier pinned bodies retain their meaning and identities.

cbrt(value) MUST accept exactly one finite binary64 Number operand and return Number with exactly the operand nullability. Untyped NULL takes the unique Number signature. No implicit conversion, distinct INT64, NUMERIC, BIGNUMERIC, Decimal or non-finite overload is introduced.

A demanded non-null cbrt MUST return the real cube root, including negative inputs, subnormals and largest finite magnitudes. Either zero sign produces canonical positive zero; NULL produces NULL. The finite Number domain adds no value-domain failure. Reject non-finite operands and preserve the existing arithmetic failure for an unexpected non-finite result.

cbrt MUST use the same pinned portable MoonBit core Double cube-root primitive in src/scalar_numeric_kernel across JS, WebAssembly and Native, with canonical finite-result validation. Substitution with pow(x, 1/3) or logarithmic reconstruction or a frontend/Host evaluator is forbidden. Preserve all existing numeric accuracy and exception contracts. Identical admitted inputs and selected semantic contracts preserve exact logical Number bits across targets; live-BigQuery last-bit equivalence is not claimed.

Typing MUST check the sole Number operand without evaluating it and return Number with exactly its nullability. Positive, negative, zero, subnormal and largest finite values remain within the admitted domain.

The common continuation MUST demand the sole child exactly once, preserving its failure before strict NULL propagation. Preserve enclosing lazy demand, retained roots, logical operand/result and control charges, live-value and workspace limits, and cooperative cancellation through the canonical unary scalar owner.

Canonical lowering MUST retain the closed direct unary source {cbrt: expression} and matching {op: cbrt, body: expression_node} machine node. SQL and expression-text CBRT select this same common operation without folding, duplication or synthetic children, including constant arguments. Earlier pinned bodies retain their meaning and identities.

translate(value, source, target) MUST accept exactly three STRING operands. instr(value, subvalue[, position[, occurrence]]) accepts two STRING operands and zero, one or two finite Number operands in that order. Untyped NULL takes the unique positional signature. No implicit conversion, BYTES, collation, regex or distinct INT64 overload is introduced.

Demanded non-null translate MUST map each original Unicode scalar at most once using its source index to select the corresponding target scalar, leave scalars absent from source unchanged, delete source scalars without a target, and ignore surplus target scalars. Reject every duplicate source scalar, including unused duplicates and an empty value. Mapping is simultaneous, not cascading; preserve astral scalars, combining marks and NUL without normalization or grapheme segmentation.

Demanded non-null instr MUST return the 1-based Unicode scalar start position of the requested exact subvalue occurrence, or zero when unreachable. Omitted position and occurrence each mean one. Positive position starts a forward search at that 1-based scalar; negative position starts a backward search at scalar length plus position plus one. Count overlapping matches separately, preserve exact strings without normalization, and apply the same direction to subsequent occurrences.

An empty instr subvalue MUST match the scalar length plus one boundaries. Positive position starts at that boundary; negative position starts at scalar length plus position plus two. Each further occurrence moves one boundary in the search direction; return zero outside the boundary range. Empty value and empty subvalue at default position and occurrence return one. Thus instr('ab', '', 1, 3) is three, its fourth occurrence is zero, instr('a', '', -1) is two, and instr('a', '', -2) is one.

After strict NULL propagation, instr MUST require an integral nonzero position and integral positive occurrence, validating both domains before empty or out-of-range shortcuts. This explicitly adapts Google's INT64 parameters to the existing finite binary64 Number domain without a safe-integer or INT64 cap. Compare valid positions and occurrences with bounded scalar or boundary counts before narrowing; huge unreachable integral values return zero without a huge binary64 decrement loop. Earlier SUBSTR and padding domains remain unchanged.

Typing MUST check every authored operand without evaluating it and union all supplied operand nullabilities. translate returns String, retaining only its value input max_codepoints bound when present: deletion can empty the result and substitution can expand UTF-8 width, so min_length and max_utf8_bytes are dropped. instr returns Number; omitted defaults do not add operands or narrow the type. Runtime domain checks do not replace static operand checking.

The common continuation MUST demand every supplied child exactly once in authored left-to-right order, preserving later child failures after an earlier NULL, before strict NULL propagation and operation-domain validation. Preserve enclosing lazy demand, retained roots, logical operand/result and control charges, live-value/output-byte and workspace limits, and cooperative cancellation. Admit scratch and complete output storage through existing owners before allocation. No arbitrary scalar cap or frontend/Host evaluator is added.

Canonical lowering MUST retain ordered arrays {translate: [value, source, target]} and {instr: [value, subvalue, position?, occurrence?]}, with matching {op, body} machine nodes containing the same authored expression nodes. Preserve two-, three- and four-operand INSTR forms as distinct identities even when explicit defaults have equal results. SQL and expression-text calls select these same operations without folding, duplication, injected default children or rewriting INSTR as STRPOS. Earlier pinned bodies retain their identities.

repeat(value, count) MUST accept exactly a STRING and finite Number in that order and return String with their unioned nullability. reverse(value) accepts exactly one STRING and preserves its nullability. Untyped NULL takes each unique positional signature. No implicit conversion, BYTES, Decimal or distinct INT64 overload is introduced.

A demanded non-null repeat MUST require a nonnegative integral Number count before an empty-input shortcut. Negative and fractional counts fail. Zero count or empty input returns empty, including empty input with a very large valid count. Otherwise concatenate the complete input scalar sequence count times without normalization. This explicitly adapts GoogleSQL's INT64 count to the existing finite binary64 domain without adding a safe-integer or INT64 cap; NULL propagates before operation-domain validation.

A demanded non-null reverse MUST reverse Unicode scalar order, preserving complete astral scalars, NUL and combining marks without normalization or grapheme segmentation. It reverses neither UTF-16 code units nor UTF-8 bytes. Empty input returns empty and NULL produces NULL.

Typing MUST preserve the complete input String contract for reverse, including minimum length and codepoint/UTF-8 maxima, because scalar and byte counts do not change. repeat returns an otherwise unconstrained String, dropping input minimum and maximum lengths because a dynamic count can be zero or expand it. Neither rule evaluates operands during checking.

The common continuation MUST demand every child exactly once in authored order, preserving a later child failure after an earlier NULL, before strict NULL propagation. Preserve enclosing lazy demand, retained roots, logical operand, result and control charges, live-value, output-byte, workspace and cooperative cancellation owners. Validate a non-null repetition count before narrowing. Prove a nonempty repetition count fits bounded execution using existing storage limits before narrowing. Admit complete output storage through existing resource owners before allocation. No arbitrary scalar cap, huge binary64 decrement loop, profile or frontend/Host evaluator is introduced.

Canonical lowering MUST retain the closed ordered binary source {repeat: [expression, expression]} and direct unary source {reverse: expression}, with matching {op, body} machine nodes. SQL and expression-text REPEAT/REVERSE select these same common operations without folding, duplication or synthetic children. Earlier pinned bodies retain their meaning and identities.

Explicit String transformations follow their declared Unicode and locale-independent laws; ordinary String values are preserved. replace is literal substring replacement, not regex. date_add and date_diff require an explicit unit from ms|s|m|h|d; calendar-month or timezone guesses are not admitted in 0.1. Their forms are {date_add: [{field: timestamp}, {literal: amount}, {literal: unit}]} and {date_diff: [{field: end_timestamp}, {field: start_timestamp}, {literal: unit}]}. Timestamp inputs and date_add results use canonical UTC ISO-8601 strings; date_diff returns a finite numeric count in the authored fixed unit. The decoded unit is a {literal: ms|s|m|h|d}. Full-word units and day-specific helper names are not ActQL source vocabulary. The expression 0.1 contract retains the binary64 arithmetic laws of actql-scalar-semantics/0.1, with the conversion/concatenation rules below. Every binary64 arithmetic result rounds to binary64; negative zero is normalized at operation boundaries and remains invalid in canonical source. Overflow/non-finite results and ordinary division by zero fail the operation except for the explicitly safe operations below. The legacy safe_div(_, 0) returns null but retains overflow failure; it is not an alias of GoogleSQL SAFE_DIVIDE or the common safe_divide operation.

safe_add, safe_subtract, safe_multiply, and safe_divide accept exactly two Number operands and produce nullable Number. They apply the corresponding binary64 arithmetic operation and return null for their own overflow; safe_divide also returns null for a zero divisor, including zero divided by zero. Finite subnormal results and underflow to canonical positive zero remain ordinary numeric results. safe_negate accepts exactly one Number and returns its negation with the operand nullability: every finite binary64 value has a finite negation, so no extra null is introduced in this supported domain. These operations do not admit Decimal, INT64, NUMERIC, BIGNUMERIC or non-finite values, and they do not coerce strings or booleans.

The common strict rule evaluates every demanded child exactly once in source order before applying null or arithmetic handling. A null first operand does not suppress a failing second operand. Child-expression, domain, cancellation, control, logical-work, live-byte and workspace failures are not converted to null. Authored SAFE nodes and their children remain in canonical lowering even when constant. Existing lazy expressions retain their demand rules.

Binary64 sum and avg use the captured numeric-observation boundary defined below, rather than requiring a placement-independent reduction bit pattern. Exact decimal arithmetic uses a separate coefficient/precision/scale value domain (Exact decimal values), not an implicit binary64 or money coercion.

The conversion/boundary truth table is normative:

Strict scalar functions propagate a null input unless the row above states another rule. Conditional selection follows the table; constructors follow Object and array construction rather than null-propagating their children. This table and the machine-readable expression 0.1 laws are the human- and machine-readable views of the same contract.

if evaluates its condition and only the selected branch. case evaluates conditions in order until the first true condition, then only that branch; otherwise it evaluates its else expression. coalesce evaluates arguments in order through the first non-null value. Non-selected expressions do not produce runtime failures, although all expressions are statically checked. Static checking validates syntax, names, arity, types, profile admission, and signature-declared static argument constraints in every branch. Checking a conversion's input type does not apply its value-conversion law. Positional arguments, array elements, and n-ary operands evaluate in canonical array order; object children and one derive map evaluate in canonical field-name order. Conditional demand takes precedence over these orders. The first evaluated failure is the operation's failure; JSON/YAML object-key enumeration never chooses it. Strict functions evaluate arguments before their null rule. try_* catches only its own specified conversion failure, not an argument's failure, a malformed static argument, an engine failure, or a bound breach.

Decode never computes values. Canonical lowering follows the fixed expression contract, not a compiler-selected constant-folding policy. Physical optimization may fold/reuse values only while preserving canonical identity, evaluation demand, failure precedence, and applicable logical limits. A failing fold can be left unfolded; it is not a new check-time error. Logical size and cardinality obligations survive optimization; physical CPU, allocation, and memory use need not match a reference evaluator. Every limit retains its measured scope and enforcement boundary (Resolved limits).

The signature arities and positional mapping are defined in Expression text; their value contracts are completed by this table. S is string, N is number, and T is the common type from Closed value contracts. Strict functions propagate null except for their explicit value rules, including membership; domain failures are atomic, not null, except where the named function explicitly specifies it.

ms|s|m|h|d are fixed UTC durations, with a day exactly 86,400,000ms; these fixed-unit functions perform no DST, month, or calendar-day arithmetic. Explicit calendar operations use the separate calendar profile. Date-only values (Closed value contracts) require explicit conversion before timestamp comparison, and admit only integer d arithmetic. date_trunc('d', date) is the identity, date_add(date, integer, 'd') returns a date, and date_diff between two dates is measured only in whole fixed UTC days. A date/timestamp mix or a sub-day date unit is rejected rather than silently promoting midnight to a timestamp.

String value and ordering rules are defined in Carriers, values, and types. len counts Unicode scalar values; trim follows the pinned Unicode whitespace rule below; contains is case-sensitive exact retained-value matching. starts_with and ends_with compare the exact retained Unicode scalar prefix or suffix without normalization, case folding, trimming or locale rules. An empty prefix or suffix matches every non-null string, including the empty string; one longer than the value cannot match. These functions preserve ordinary strict-null propagation and evaluate both children in authored order, including after a null first operand. They admit STRING/default binary comparison; BYTES and explicit collations remain unsupported overloads of the selected GoogleSQL reference. like is case-sensitive with %, _, and backslash escape; replace is non-overlapping left-to-right and an empty search is a no-op. lower/upper use Unicode 16.0 default mappings; a runtime without exactly those tables MUST reject those functions rather than use host-dependent mappings.

Finite Number math MUST accept unary exp, ln, log10 and binary pow, log with a Number result, nullable exactly when any operand is nullable.

These functions MUST NOT coerce STRING, BOOLEAN, DECIMAL, arrays or objects into Number.

JSON pow and log bodies MUST be exactly two ordered expressions, while JSON exp, ln and log10 bodies are one expression.

Expression text MUST accept power(x, y) as pow(x, y) and log(x) as ln(x) without a distinct canonical operation.

For non-null finite inputs, POW MUST require an integral exponent for a negative base, fail for a zero base with a negative exponent, and return one for zero to zero.

EXP and POW MUST fail on overflow, preserve representable subnormals and return canonical positive zero for unrepresentable underflow.

LN and LOG10 MUST require a positive argument; binary LOG requires a positive value and a positive base other than one.

These functions MUST evaluate demanded operands once in source order and preserve ordinary child failures before strict NULL handling, including a later demanded child failure after an earlier NULL. They do not catch child errors. The same pinned portable numeric kernel MUST be used across JS, WebAssembly and Native, preserving exact logical Number bits for identical admitted inputs and selected contracts. Live-BigQuery last-bit equality is not guaranteed.

greatest(x, ...) and least(x, ...) MUST take one or more finite binary64 number expressions.

The result MUST be number, nullable exactly when any operand is nullable, with each immediate untyped NULL taking the unique number signature including an all-NULL list and any NULL producing NULL only after all demanded child evaluations succeed.

ActQL's common expression continuation MUST evaluate each demanded child exactly once in authored left-to-right order, preserve the first child failure and enclosing lazy IF/CASE/COALESCE demand, and retain the existing entry/operand/result charges, live-root, frame, control/workspace and cancellation rules without charging fold accumulators as extra semantic results.

For non-null operands the result MUST be the greatest or least operand in the existing finite numeric order, preserving its exact binary64 value with canonical positive zero for either zero sign, with singleton calls using the same zero rule and without arithmetic overflow or precision reduction.

This finite Number subset MUST reject STRING, BOOLEAN, temporal, decimal, BYTES, non-finite and mixed-type overloads, explicit collation, and implicit conversions without adding a private STRING comparator or changing shared global comparison or canonical-key ordering. GoogleSQL string ordering is by Unicode code point, whereas the current canonical ActQL string owner orders UTF-16 code units. Other overloads remain implementation gaps, without imposing new language-wide restrictions.

The closed source forms {greatest: [first, ...]} and {least: [first, ...]} MUST lower to the same operation with an ordered nonempty machine body array, retaining singleton calls and every authored child in order including repetitions, without sorting, deduplication or constant folding and without changing the meanings of earlier contract bodies or CIDs.

round(x) and trunc(x) MUST each take one finite binary64 number, optionally followed by a second finite binary64 number expression n for the decimal position. The result is number, nullable exactly when any operand is nullable. Untyped NULL takes the unique number signature. The unary value and canonical body are unchanged: round(x) returns the nearest integral value, with halfway cases away from zero; trunc(x) discards the fractional part toward zero. Every already-integral finite input, including the largest finite magnitudes, is unchanged by the unary forms, which cannot overflow.

With explicit n, positive positions select places right of the decimal point and negative positions select places left of it. Each demanded child MUST be evaluated exactly once in authored left-to-right order, including evaluation of n after a NULL x. Only after both evaluations succeed does either NULL produce NULL. Otherwise a non-integral n MUST fail with the existing arithmetic failure, without truncation or implicit conversion. Integral n > 323 leaves x unchanged and integral n < -308 returns canonical positive zero; these comparisons MUST precede any narrowing to a bounded integer. n = 0 uses the unary value rule. The position is an ActQL binary64 number, including integral values outside the safe-integer range, rather than a distinct GoogleSQL INT64 value. This does not introduce an INT64 type, a full INT64 overload or exact representation of every INT64 position.

For -308 <= n <= 323, the selected value algorithm is the finite-input DecimalRounding<false>/RoundDecimal or DecimalRounding<true>/TruncDecimal in GoogleSQL round_decimal.cc at revision 81c15b796138185c046aefe852321011fdf96615, with Full<double> from the same revision's double_double.h. The selected product path is the portable ComputeDekkerProduct/Split path, with every individual binary64 addition, subtraction and multiplication rounded to nearest, ties-to-even. Implementations MUST preserve the reference's range reductions, power-of-five pairs high = RN(5^k) and low = RN(5^k - high) for -323 <= k <= 323, FromSum and Fast2Sum operation order, relative-error correction with 2^-105, sticky-bit adjustment, signed halfway-away selection for ROUND and the negative-correction floor rule for TRUNC, and the Full-by-Full multiplication order. Here RN rounds the exact operand to binary64, nearest ties-to-even. Implementations may derive the pinned high/low pairs exactly rather than store the table.

The final product's high binary64 component MUST be selected before the separate final power-of-two scaling, including its additional rounding for subnormal results. Fused multiply-add, reassociation, a single binary64 x * 10^n calculation, or ideal exact-rational decimal rounding MUST NOT replace the prescribed sequence. In particular, the selected results include round(1.005,2) = 1, round(2.675,2) = 2.67, trunc(0.3,1) = 0.2, round(2.2250738585072014e-308,311) = 2.2250000000000004e-308, and round(2.328158521232893e41,-26) = 2.3281585212328932e41. These results describe the selected binary64 implementation sequence, not rounding exact decimal spellings to an ideal rational result.

A non-finite ROUND result MUST fail with the existing arithmetic failure. TRUNC cannot overflow for admitted finite input and integral position. All zero results follow the existing positive-zero canonicalization. Child failure identity, lazy demand, first-failure order, cancellation and existing work, frame, workspace and live-value budgets MUST be preserved. Decimal-position work remains bounded and cancellable, and no-op value cases do not skip logical operand charges.

This is a selected finite-FLOAT64 compatibility boundary, not a claim about live BigQuery behavior or execution coverage on every target. A third rounding_mode argument, NUMERIC/BIGNUMERIC or other decimal overloads, distinct integer overloads, implicit conversion and non-finite values remain outside this ActQL profile; they MUST NOT be silently ignored or coerced. The common source forms remain {round: expression} and {trunc: expression} for one child, and are {round: [value, n]} and {trunc: [value, n]} for two. Machine bodies retain the sole child or the two-element ordered array, respectively. Explicit n = 0 and no-op positions MUST retain the two children; they do not become a unary body or a constant. Existing unary canonical bytes and earlier expression contract meanings remain unchanged; earlier contract CIDs do not acquire the new overload.

trim(value) with its character set omitted MUST take one string and remove the longest leading and trailing sequences of Unicode 16.0 White_Space code points: U+0009..U+000D, U+0020, U+0085, U+00A0, U+1680, U+2000..U+200A, U+2028, U+2029, U+202F, U+205F and U+3000. This fixed set contains 25 code points; U+FEFF and U+200B are excluded. The exact interior scalar sequence, including whitespace, combining sequences and CR/LF, remains unchanged. No normalization, case folding, line-break conversion or host-dependent whitespace rule is applied. Empty and all-whitespace inputs produce the empty string; null produces null. The result preserves operand nullability, and untyped NULL takes the unique string signature. The sole child evaluates once when demanded; enclosing lazy demand, first-failure precedence, cancellation and logical charges remain in force. Physical scanning, output sizing and construction remain bounded and cancellable. The authored TRIM node and its child remain in canonical lowering, even for an unchanged value. This selects the unary GoogleSQL STRING behavior. The explicit STRING character-set overload is specified below; BYTES and explicit collation remain outside the admitted signature.

ltrim(value) and rtrim(value) with their character sets omitted MUST each take one string and remove only the longest leading or trailing sequence, respectively, of the same pinned Unicode 16.0 White_Space set as trim. They MUST preserve the exact remaining Unicode scalar sequence, including whitespace at the opposite end, interior whitespace, combining sequences and line breaks. U+FEFF, U+200B and U+180E are not members of this set. No normalization, case folding, line-break conversion or host-dependent whitespace rule is applied. Empty and all-whitespace inputs produce the empty string; null produces null. Operand nullability is preserved, and untyped NULL takes the unique string signature. Each sole child evaluates exactly once when demanded; child failures, enclosing lazy demand, first-failure precedence, cancellation and existing logical charges remain in force. Physical scanning, exact output sizing and construction MUST remain bounded and cancellable. Each authored node and its child remain in canonical lowering even when the value is unchanged. The closed common source forms are {ltrim: expression} and {rtrim: expression}. BYTES, implicit conversions and explicit collation are excluded. Earlier expression and scalar-law CIDs retain their previous meaning.

trim(value, characters), ltrim(value, characters) and rtrim(value, characters) MUST take exactly two STRING expressions. They remove the longest leading and trailing sequences, the leading sequence only, or the trailing sequence only, respectively, of Unicode code points contained in the explicit characters string. Each code point is an independent set member; order and duplicates in the set do not change the result. An empty set MUST leave the value unchanged, including its whitespace. An empty value stays empty, and a value made entirely of set members becomes empty. No substring matching, grapheme-cluster matching, normalization, case folding or line-break conversion is permitted. A combining mark in the set can be removed from a different combining sequence: trim('abaW̊', 'Y̊') is 'abaW', while precomposed letters remain distinct from decomposed sequences. Supplementary code points are whole members, never separately matched surrogate code units. U+FEFF, U+200B and U+180E can be removed when explicitly present in the set.

Both operands MUST evaluate exactly once in authored order, value before set, when demanded. A NULL first operand MUST NOT suppress evaluation or failure of the second. Only after both succeed does either NULL yield NULL. Result nullability is the OR of both operand nullabilities; untyped NULL resolves to STRING in either position. Enclosing lazy demand, first-failure identity, cancellation and all existing logical operand charges remain in force. Physical membership comparisons, scanning, exact output sizing and construction MUST be bounded and cancellable, including large sets and nonmatching values. No unbounded set-preparation step may escape those budgets.

The closed source body is exactly a two-element array, for example {trim: [value, characters]}; the machine body is likewise {op: trim, body: [value_node, characters_node]}. The same shapes apply to ltrim and rtrim. Existing unary forms and their canonical bytes remain unchanged. Both authored children and the operation MUST remain in canonical lowering: empty, duplicated or reordered set expressions are not rewritten even when their values are equivalent. Other arities, BYTES and explicit collation remain excluded. Earlier contract CIDs keep the unary-only signature.

strpos(value, subvalue) MUST take exactly two strings and return the first exact match's 1-based Unicode scalar position, or positive zero when absent. An empty subvalue yields 1, including when the value is empty. It counts scalar values, not UTF-8 bytes, UTF-16 code units or grapheme clusters. Comparison preserves retained strings without normalization, case folding or locale conversion. Both children evaluate once, value before subvalue, even after a null value; only after both succeed does either null produce null. Result nullability is the union of operand nullability, independent of row count. Enclosing lazy demand, first-failure precedence, cancellation and logical operand charges remain unchanged. The result is an exact integer represented by the common finite number over the existing bounded string domain. This connects the GoogleSQL STRING/default binary rule without adding its INT64 result type, BYTES overload or explicit collation.

Before executable compilation, the compiler MUST resolve each LIKE pattern literal or Parameter from the selected checked bindings to a non-null string and validate its escape syntax, including in unselected branches. Backslash quotes exactly the next Unicode scalar; a final unpaired backslash is invalid. The empty pattern is valid, % matches any scalar sequence, and _ matches one scalar, including line separators. Other scalars are literal and no regex syntax or flags are inferred. Validation preserves the normalized pattern text without rewriting repeated wildcards or escapes. A null value operand retains the ordinary nullable predicate semantics; it does not excuse an invalid or null static pattern. LIKE does not acquire the text-time profile's Host policy requirements merely because its pattern is checked at the same boundary.

Expression textCopy Anchor Link

Expression text borrows SQL-style identifiers, quoting, operators, function calls, and searched CASE, not SQL type conversion or execution semantics. ActQL is not PostgreSQL-compatible. The following comparison is informative; the ActQL rules in this chapter remain normative.

PostgreSQL references: arithmetic, strings, and identifiers. PostgreSQL is not an oracle for ActQL expressions; differential tests require an explicitly identified subset with matching semantics. The complete syntax is defined by ActQL expression EBNF and the closed mappings below. An implementation MUST reject unlisted syntax, functions, and wrong arities, and consume the whole expression string.

- derive:
    total: "unit_price * quantity"
- filter: "total >= $threshold"
- derive:
    label: "coalesce(customer_name, 'Name unavailable')"
    category: |
      CASE WHEN total >= 100000 THEN 'Large' ELSE 'Standard' END

The following are the complete borrowed spellings and their tree meanings:

Function names are exact lowercase names. Their complete signatures are below; arguments are positional and map to the existing tree operands or named fields in the order shown. ... means one or more arguments in total; brackets denote an optional final argument, not expression syntax.

Pure text-time calls require their profile and per-expression envelopes. object, template, and opaque JSON literals retain their structured forms; array literals and typed access are defined below. Aggregate and window operations, subqueries, named arguments, ::, COLLATE, simple CASE, SQL comments, and user-defined functions are not expression syntax. Text is admitted only at Expression and Predicate positions, not at restricted EffectValue or request-binding positions. The decoded tree MUST satisfy the position's type and allowed-node contract. Each element of the Effect where conjunction array is a restricted condition position accepting text, with fields referring to the target Resource.

IN (x) is a one-element list, not grouping. Parameter references inside its literal-list template are resolved before checking the bound literal array; parentheses around a literal or parameter are permitted, including x IN ((1)) and x LIKE ('a%'). Validation examines the decoded node, so x LIKE ('a' || '%') remains invalid. Other literal payloads are opaque data, not locations for recursive parameter substitution. Literal-list templates cannot contain row-dependent expressions. An unparenthesized right operand at unary precedence may be any ARRAY-valued Expression, including a field, property, subscript, ARRAY constructor, if, searched CASE, or coalesce. The ordinary type checker rejects scalar right operands. Both membership operands remain strict and evaluated once; an operand's own conditional branches retain their existing lazy demand. A NULL ARRAY remains an empty membership set under the existing membership law. Unary - on a nonliteral numeric expression decodes to negate, preserving number or decimal type.

The EBNF fixes precedence, highest first:

Bare names match [A-Za-z_][A-Za-z0-9_]* and retain case. Other names use double quotes with doubled "" for a quote; all decoded names still obey their field or parameter naming contracts. The closed, ASCII-case-insensitive reserved words are AND OR NOT IS NULL TRUE FALSE IN BETWEEN LIKE CASE WHEN THEN ELSE END CAST AS UNKNOWN DISTINCT FROM; reserved field names require quotes. Function names are contextual: len is a field and len(x) is a call. Parameter names after $ retain their declared spelling, including names matching keywords. String literals use single quotes and doubled '', with no adjacent-string concatenation, E'...', or dollar quoting. Backslash has no lexical escape meaning here; a LIKE, regex, or other pattern consumer interprets the resulting string under its own law.

Unadorned numeric literals denote finite binary64 number, including those with a fractional part or exponent. Negative zero is invalid. Decimal values use explicit to_decimal/try_decimal conversion, decimal parameters, or decimal fields; no decimal/binary64 promotion is inferred. / is number division even for integral operands; decimal division uses decimal_divide. An ordinary =, <>, <, <=, >, or >= comparison with a literal NULL operand MUST be rejected; IS [NOT] DISTINCT FROM follows its explicit null-safe rule. Nullable fields otherwise retain Predicates three-valued semantics. SQL implicit conversions and host-specific arithmetic or evaluation behavior do not apply.

Note (informative): JSON/YAML decoding happens first. Quote the entire expression or use a YAML | block; a SQL string literal is still quoted inside it. A block avoids YAML double-quote processing of pattern backslashes. YAML comments outside the expression are not expression comments.

Decoding, identity, and printingCopy Anchor Link

values cells are outside expression printing. Their literal wrappers use CellValue quoting, not expression decoding, template expansion or the mixed expression printer. Printing never interprets a cell payload as expression children, even when its keys resemble expression tags or parameter holes.

Text decoding MUST finish before parameter-reference discovery, semantic checking, and Program CID computation. Structured and text expressions may be mixed; both use the same tree validation and lowering. The canonical local_body referenced by program_template contains decoded expression trees, never expression-text nodes; string literal payloads remain string values. Decoding does not evaluate expressions, reassociate arithmetic, or infer semantic choices, and is not a Normalization Journal entry. Existing semantic completion and macro rules still apply to the decoded tree (Deterministic completion).

Text and structured forms decoding to the same tree MUST have the same Program identity. Whitespace outside tokens, keyword case, and equivalent field quoting do not change that tree. Parentheses wrapping an existing subtree preserve its identity only when they do not change operator grouping or arity. An unparenthesized chain of AND, OR, or || decodes to one n-ary node (and, or, or concat_strict), in operand order; explicit grouping retains nesting. Arithmetic remains binary and is not reassociated. For example, a = 1 AND b = 2 AND c = 3 and (a = 1 AND b = 2) AND c = 3 have different trees and Program identities. coalesce remains a dedicated node in both the canonical Program and the expression 0.1 canonical fragment. CASE expansion is not canonical lowering. An executor may implement equivalent control flow, but reuses each evaluated operand rather than duplicating its evaluation.

A canonical expression printer MUST preserve the tree, operand order, and literal values. It uses uppercase keywords, lowercase function names, unquoted non-reserved ASCII names where permitted, doubled quote escaping, AoA canonical number spelling, one space around infix operators, and comma followed by one space between arguments. It parenthesizes each operator application, prints conditionals as searched CASE or if according to their tree kind, and emits no trailing whitespace. It does not resugar arithmetic subtraction into unary minus. negate prints as unary minus with its operand parenthesized, or negate(...) when a signed-literal decode would change the tree; strict concatenation prints as concat_strict(...), never concat(...). Casts print as CAST(value AS TYPE); other functions use their named call spelling. Binary arithmetic and boolean expressions use the operator spellings in Expression text; n-ary and/or print as a parenthesized chain. Membership prints a literal array as an IN list. Other ARRAY-valued right operands use their postfix spelling without an enclosing pair of grouping parentheses, because an initial ( after IN selects a literal list. Nested operators inside calls, ARRAY constructors, or searched CASE retain their ordinary parentheses. A tree without an unambiguous text spelling retains its structured source form. not prints as NOT (p) rather than rewriting the child predicate.

For each text-representable canonical tree t, decoding its canonical printed text MUST yield t. Arrays print as [a, ...]; an explicitly typed empty array retains its structured form. Trees without a text spelling, including object constructors, opaque JSON literals, and unary and/or nodes, retain their structured envelope with recursively printed expression children; literal payloads are never traversed. Reviews may use this mixed printed form, bound to the exact underlying tree identity. A printer MUST NOT stringify a structured constructor or change it to an allegedly equivalent literal. The expression grammar, reserved words, signatures, decoding rules, and printer rules belong to Grammar Manifest identity, not a separately selectable execution engine.

Expression diagnostics MUST distinguish syntax errors, unknown functions, unknown field/parameter references, and type/arity errors (including a non-boolean condition or an inadmissible selector node). They identify the enclosing JSON path and a zero-based half-open Unicode-scalar offset range in the decoded expression string; EOF is a zero-width range. Public diagnostics remain subject to Diagnostic documents redaction. The versioned diagnostic catalog assigns their codes; this syntax does not authorize uncataloged codes.

PredicatesCopy Anchor Link

The structured predicate grammar is below; expression text in Expression text decodes to this same vocabulary. Predicate operands may be scalar expressions:

Operand := Expression
SelectorOperand := {field: TargetField} | {literal: JsonValue} | ParamRef
ComputationPredicate := Expression checked as boolean (nullable permitted)
EffectPredicate := SelectorPredicate<SelectorOperand>

BooleanNode<Operand> :=
    {eq|neq|lt|lte|gt|gte|in|not_in|like|contains: [Operand, Operand]}
  | {between: [Operand, Operand, Operand]}
  | {is_null|not_null: Operand}
  | {and|or: [Expression, ...]}
  | {not: Expression}
  | {is_true|is_false|is_unknown: Expression}
  | {is_distinct_from: [Expression, Expression]}

SelectorPredicate<Operand> :=
    {eq|neq|lt|lte|gt|gte|in|not_in|like|contains: [Operand, Operand]}
  | {between: [Operand, Operand, Operand]}
  | {is_null|not_null: Operand}
  | {and|or: [SelectorPredicate<Operand>, ...]}
  | {not: SelectorPredicate<Operand>}

Bare Predicate denotes ComputationPredicate. Boolean nodes are also value expressions. Effect selectors use their closed structural subset; boolean fields and new calls are not implicitly added to that subset. IN-list and LIKE restrictions apply in both variants. Common decoding does not widen Effect operands. The lt, lte, gt, gte, and between operands require AuthorOrderable (Lexical and ordering rules), including under not or inside a conditional; reference operands remain inadmissible in either notation.

AoA RelA boolean predicates evaluate operands left to right, eagerly, before combining their three-valued results. AND does not skip later operands after false, nor OR after true; the first evaluated failure aborts the operation. For example, x <> 0 AND 10 / x > 1 fails at x = 0. Use a lazy conditional to guard a failure-prone value expression. Pushdown and other optimizations MUST preserve these evaluation and failure rules, not only the truth table.

Boolean structure uses:

filter: "status = 'open' AND (region = 'jp' OR region = 'us') AND NOT (deleted = TRUE)"

The same predicate has this structured form:

filter:
  and:
    - {eq: [{field: status}, {literal: open}]}
    - {or: [{eq: [{field: region}, {literal: jp}]}, {eq: [{field: region}, {literal: us}]}]}
    - {not: {eq: [{field: deleted}, {literal: true}]}}

The following AoA predicate vocabulary applies only to the restricted Effect selector lowering, not to expression 0.1 computation roots:

• column reference: {type: col, path: [field, ...]};
• scalar literal: {type: lit, value: ...};
• comparison: {type: cmp, op, left, right};
• membership: {type: in, op: in|nin, left, right};
• interval: {type: between, expr, low, high};
• deterministic pattern: {type: like, left, pattern};
• string containment as the admitted two-argument contains scalar function compared with true;
• null check: {type: isnull, expr};
• boolean and, or, and not.

Null equality MUST NOT be inferred from ordinary eq/neq; authors use null tests or explicit is_distinct_from. Reference equality and ordering follow Opaque reference values. Membership follows the common membership rules, including their explicit exception to strict null propagation; other missing and null behavior follows AoA relation semantics. The scalar expression vocabulary is the closed set in Scalar expressions. like uses deterministic AoA pattern semantics; ActQL does not expose a host regex engine. The arbitrary-code boundary is defined in Language boundaries.

Common in and not_in use a set of admitted scalar values. A null array and an empty array both denote the empty set; an array containing a null element is nonempty. This is an explicit exception to strict scalar null propagation. After evaluating the left operand and right collection once each in canonical operand order, apply these rules in order:

1. If the set is empty, in returns false, including when the left operand is null.
2. For a nonempty set, a null left operand produces null.
3. Otherwise, any equal non-null element makes in true, even if another element is null.
4. Without a match, a null element makes in null; otherwise in is false.

not_in is the three-valued negation of in: true becomes false, false becomes true, and null remains null. The result type is Boolean. A checked collection with max_items: 0 yields a non-nullable result. Otherwise result nullability is the disjunction of left and item nullability; collection nullability alone does not make the result nullable. Operand domains are still checked for every expression, including an empty set. An empty set does not supply a missing scalar type for an otherwise unresolved NULL.

The common law corresponds to GoogleSQL set membership, including IN UNNEST treating a null array as zero rows. This correspondence does not admit SQL IN (), UNNEST, or subquery syntax in an otherwise unsupported Frontend profile. Constant evaluation uses the same ordered membership rules; an optimizer still preserves operand failures, demand, logical limits, and canonical identity, so a known empty set does not authorize discarding a failing left operand.

Relation filters and their Connector pushdowns use the common boolean expression; Effect selectors admit only the restricted selector subset above. A connector MAY advertise only a subset for pushdown, but the runtime MUST apply the remaining predicate with the same canonical predicate semantics or reject it; it MUST NOT reinterpret it. In an Effect where selector, field operands address the target Resource as specified in Effect declarations, not a computation Result.

Common expression contractCopy Anchor Link

The adopted contract is actql-expression-contract/0.1. It extends the pinned AoA foundation with the closed expression schema and laws linked in Machine contracts. It is not a UDF registry or a Host callback interface. actql/0.1 uses this contract for all general computation positions; there is no source revision selector or compatibility mode. The Program semantics envelope pins expression_contract_cid.

A structured typed_literal with exactly type: "json" and value containing decoded JSON text MUST use the common typed JSON literal law in the expression contract. The output is non-null json, including for JSON null and scalars; SQL NULL and ordinary scalar literals retain their existing meanings. JSON data keys and strings preserve Unicode scalar sequences and CR/LF; duplicate keys retain the first decoded value. Exact numeric parsing rejects precision loss under the selected binary64 subset, including unsupported negative zero; this is not the full GoogleSQL JSON integer domain. The complete input is bounded, including discarded duplicates, with depth at most 500 and the caller's tighter value/expression ceilings.

Non-SQL-NULL JSON values MUST retain their common JSON domain in canonical typed-cell wire as the closed {"$json":payload} envelope. SQL NULL remains null under a nullable contract. Typed-wire admission decodes this envelope only under a checked JSON contract; raw authored JSON does not select a type by its keys. Canonical data-key spelling does not apply identifier normalization. Literal IR, retention, capture/replay and Result delivery use this same contract; wire bounds include the envelope. Graph identity and Delta semantic-body codecs obtain the checked JSON payload explicitly rather than changing their body format to the typed-cell envelope. Changed contracts and dependent pins reject old untagged typed-cell data rather than silently reinterpreting it.

All named expression bodies are closed; no sibling tags or unknown fields are accepted. Text and structured spellings undergo the same normalization, including to_* to cast and qualified {field: "left.name"} to join_field. Bare field spelling and explicit quotation retain the same field node, except that quotation prevents lexical recognition of a leading join qualifier, not subsequent whole-field alias normalization. Cast targets contain type and, only for decimal, precision and scale, not nullable. An explicit cast of null remains a cast node in Program identity; it supplies the typed null in checking. A same-type cast also remains a node, even though its value law is identity. No constant evaluation occurs during this normalization.

IS TRUE, IS FALSE, and IS UNKNOWN require boolean input and produce non-null boolean. IS UNKNOWN tests boolean null; IS NULL is the general typed null test. IS DISTINCT FROM requires KeyComparable operands (a literal null receives its peer's type); both null gives false, exactly one null gives true, otherwise it uses non-null inequality. Two untyped null operands still require explicit type evidence. nullif requires KeyComparable inputs, returns the first operand's type made nullable, and evaluates both arguments once even if the first is null. It returns null only when ordinary equality is true, otherwise the already evaluated first value.

Ordinary equality and ordered comparison propagate null; is_null/not_null are non-null boolean. AND/OR use three-valued conjunction/disjunction, eagerly: false dominates AND, true dominates OR, otherwise a null operand yields null. No truthiness or reference inspection is introduced.

The canonical extension node is {op: tag, body: payload} under actql-expression-node/0.1. Lowering recursively preserves each normalized tag and its closed payload shape from the machine expression schema, replacing expression children with extension nodes; structural arguments and opaque literal data are copied. Non-null parameter nodes become literals from bound values. The author-only template is first expanded to its ordered literal segments and cast-to-string placeholders under one concat_strict; a template with no segments yields an empty-string literal. It is not an executable template node. Empty array constructors become empty_array with the canonical checked item contract; explicit empty arrays lower to the same node. Every typed NULL, including a null parameter and a missing CASE ELSE, uses {op: typed_null, body: {contract: CheckedValueContract}}, with nullable: true. Explicit casts retain their cast node around that typed child. There is no primitive-versus-structural alternative for implicit ELSE completion. This machine-only form is not an author conversion to object or array.

Canonical fragments bind the extension contract CID, roots at their semantic expression positions, and profile envelopes sorted by canonical expression pointer. The existing AoA relational operations consume those typed roots; conversion to a scalar node with different meaning is forbidden. Placement requires support for this extension, including boolean value roots, typed empty arrays and per-expression demand. A profile operation is still a pure expression, not an acquisition or arbitrary callback. This defines the canonical lowering under the pinned AoA and expression contracts.

The Relation binding is actql-expression-fragment/0.1, whose closed machine schema is in Machine contracts. Its request fixes the canonical source pipeline, checked source schemas, typed parameter values, max_rows and max_value_bytes. The latter ceiling applies per input value, evaluated root value and published output value, not to physical allocations. graph contains inline expression 0.1 nodes with unambiguous typed contracts. expression_contract_cid pins the exact expression contract. fragment_cid hashes the whole fragment excluding only itself. The containing executable artifact pins this fragment CID; its inner graph is not a standalone AoA execution artifact. The request is private execution material, not a public diagnostic projection.

In the containing AoA composition, ACTQL.expression_fragment/0.1 has one Relation input and output. Its params contains exactly fragment; the fragment request names its single local source input. Admission rechecks the sealed fragment before evaluating the composition. A carrier-validation projection is not a semantic graph, a hash input, or an execution replacement.

Optional request.open_sources maps each incompletely described source to its sorted required column set. Checked field contracts remain in source_schemas; unknown fields gain no inferred type. Pass-through operations preserve those fields, while every expression still requires its own type evidence. Derive rejects collisions with required or actual input fields; group closes its output. output_open and output_schema are regenerated at admission. Runtime validates required columns, known contracts and all actual value ceilings.

request.null_contexts optionally maps derive step IDs and output names to nullable checked contracts for literal NULL roots. The source remains NULL; the lowered node is typed_null. Program checking derives these contexts only from the append-peer or explicitly mapped nullable ModelTask rules in Closed value contracts, through field projection, rename and row-preserving steps. Conflicting contexts or missing evidence fail; arbitrary later computations and Effects supply no type evidence.

For text-time calls, request.text_time_policy contains the closed actql-text-time-host-policy/0.1 value; its CID is the envelope's host_policy_profile_cid. evaluations lists every profile occurrence once, sorted by envelope.expression_pointer, or is empty when none occur. Each entry's node_pointer addresses /roots/<index>/node; its envelope addresses the corresponding /roots/<index>/source occurrence and binds that root's step_id and regenerated demand path, including its aggregate filter. Admission regenerates the envelopes, pointers, argument CIDs and bounds. Known literal or checked source extents prove input bounds; otherwise a demanded expression performs input preflight against the selected Host ceiling. Successful results satisfy the output ceiling. These checks introduce no I/O.

The group binding admits the complete group aggregate vocabulary, with an expr root and optional own filter. count_if requires a boolean argument and counts only true values; it does not admit distinct. Distinct is admitted only by each aggregate's declared signature, preserving first occurrence before the pinned fold. avg accepts number, not decimal. Decimal sum has precision 38 and preserves scale; array_agg retains order and its positive guard.

The limits list contains a Resolved limit for each request ceiling and each aggregate max_items or max_bytes, ordered by its RFC6901 request_pointer. Each limit has that pointer as subject_ref, a contract_ceiling witness binding the canonical request CID and pointer, law actql.expression-fragment.capacity, source derivation and that request CID as its sole dependency. Enforcement is engine_atomic, breach is fail; units are rows, bytes, and array_items respectively. These are declared ceilings, not estimated or proven row counts. Admission regenerates these witnesses and limits alongside the graph. The capacity law is registered by the expression 0.1 contract for this fragment's admission. Admission uses that pinned law and its witness contract.

The selected pipeline registry MUST register ACTQL.expression_fragment/0.1 with its one-Relation-input/output signature and the execution contract at spec/contracts/actql-aoa.json#/execution_contracts/ACTQL.expression_fragment~10.1. That contract pins both the expression contract and its existing fragment schema; schema references MUST resolve against those pinned bodies, not a network lookup. A consumer MUST reject a missing registration, mismatched contract or dependency CID, or unsupported execution capability. Registration is not whole-Program completion or execution authorization; sealed-fragment re-admission and all required runtime checks remain mandatory.

Names use RFC6901 escaping. The roots array follows canonical graph step order, then code-unit order of the parameter pointer within each step. Each entry binds step_id, parameter_pointer, canonical source, lowered node, checked contract and demand_paths. The inline graph node equals that root's node. Semantic pointers address /roots/<index>/source, not the differently shaped lowered node. An aggregate argument prepends its own filter root's true test to every inherited path. The filter has no self-demand.

Fragment admission MUST recheck the bound request and require exact equality of the canonical graph, root set and ordering, types and demand paths. A valid self-CID or schema alone is insufficient. An implementation MUST reject a consumer or expression revision outside its declared binding capability; this Relation binding does not implicitly assign root positions to graph, temporal, vector or Effect consumers.

Graph and temporal conditions use actql-predicate-consumer/0.1, carried by ACTQL.predicate_consumer/0.1 with exactly {consumer} as params and the underlying operation's carrier signature. Its request fixes the operation, closed parameters, context schemas and expression ceilings. Roots are ordered by RFC6901 pointer code-unit order, relative to request.params:

Each root is a single REL.where fragment with source input and step condition; its open-source requirements are the sorted context schema keys. The consumer CID excludes only consumer_cid. Admission regenerates the whole consumer and validates the pinned operation's structural constraints. Condition evaluation follows that operation's traversal or matching demand, not a prepass over unreachable graph elements. VEC has no scalar expression slot; its filtered Relation input uses the Relation binding. Effect selectors remain separate and restricted.

Aggregate evaluation follows canonical group order, aggregate output-name order, and logical input-row order within each group. Each aggregate evaluates its own filter before its argument; it does not share an unconditional precomputed argument column with another aggregate. Value failure publishes no partial operation output. Input admission remains independent of row demand.

An envelope pointer addresses the normalized semantic expression tree with JSON Pointer escaping. Every child inherits the outer demand path; the following tests are appended in the listed logical order.

Admission MUST rederive demand paths from the expression tree and consumer position and require exact equality, not merely valid pointers or self-CIDs. Tests reference values already evaluated in the same row and evaluation frame; demand testing never reevaluates a condition or operand.

Within one expression frame, failure priority follows its prescribed child evaluation order. For a derive operation it is logical input-row order, then canonical output-field-name order, then expression evaluation order. Parallel completion order does not choose the representative value failure. Failed operations publish no partial output; this is not a Run-wide or cross-Effect transaction guarantee.

Text and structured input pass through the same alias normalization and closed node validation. left.id, "left.id", and qualified {field: "left.id"} all normalize to a join-field node; "left".id remains property access on the ordinary field left. Quoting suppresses the lexical qualifier, not subsequent whole-field alias normalization. Normalization is idempotent, including after mixed printing. Intake byte, token, node and actual AST-depth limits are distinct from evaluation budgets; exceeding a declared intake limit produces a stable diagnostic, never truncation or a partial tree. Structured input has the same tree limits; opaque literal payloads are counted but not parsed as code.

Explicit castsCopy Anchor Link

Target names are ASCII case-insensitive and normalize to lowercase type names. Decimal P/S are integer literal type arguments under Exact decimal values. CAST(NULL AS target) supplies that nullable target without evaluating a conversion. Other null operands propagate after input-type checking. No reference, object, array, json, or vector cast is supplied by this table. Same-type acceptance also applies to corresponding to_* calls, so equivalent spellings have the same tree. DATE, ::, and arbitrary SQL type names are not cast targets in this revision. Decimal/binary64 fractional mixing remains invalid; CAST('0.1' AS DECIMAL(2,1)) is exact, while casting binary64 0.1 fails if evaluated. quantize remains the explicit rounding operation.

Conversion diagnostics distinguish static source/target incompatibility from evaluation-time domain failure. Repair candidates may suggest an explicit cast or parameter, but never automatically choose decimal P/S, rounding, or replace a binary64 value with text claiming the author's original exact decimal intent.

Typed accessCopy Anchor Link

Property and subscript access apply to any typed expression, including items[0].sku and coalesce(primary_address, backup_address).city. They are pure row-local value operations, not provider navigation or Relation expansion. Property names are static AuthoredFieldNames; receivers must have a complete object type. Subscripts require an array receiver and a number expression; the index is checked at evaluation as a non-negative safe integer without rounding. Arrays are zero-based, independently of SQL-named string functions. Receiver then index are evaluated once, eagerly; invalid/null indexes fail even if the receiver is null. Negative or fractional literal indexes are evaluation-time domain failures, not static signature constraints.

Property nullability is the OR of receiver and property nullability. Subscript results are conservatively nullable, retain the item contract, and do not infer a minimum length from max_items. An explicit empty-array node therefore remains typed and always yields null for a valid subscript.

An unquoted leading left. or right. is always a join qualifier, never a schema-dependent guess. It requires that join scope and selects its following field; later dots are object properties. left.customer.city therefore means property city of the join-left customer field. "left".city means property city of the ordinary field left. Missing join scope is an error, not a fallback. Property names after a receiver do not create another qualifier. The printer quotes an ordinary receiver field named left/right when followed by access.

Decimal expressionsCopy Anchor Link

Implementations MUST validate decimal precision, scale, coefficient, explicit rounding, and the prohibition on implicit binary64 mixing before publishing results.

The four expressions have these text forms (shown as derive entries):

amount: "to_decimal(amount_text, 18, 2)"
maybe_amount: "try_decimal(amount_text, 18, 2)"
tax: "quantize(raw_tax, 18, 2, 'half_up')"
daily: "decimal_divide(total, 31, 18, 2, 'half_even')"

For example, the structured form of tax is:

tax:
  quantize:
    value: {field: raw_tax}
    precision: 18
    scale: 2
    rounding: half_up

Conversion accepts decimal values, safe integers, or text matching -?(0|[1-9][0-9]*)(\.[0-9]+)?. Exponents, leading +, grouping, currencies, negative zero, excess fractional digits, and overflow are rejected without rounding. try_decimal makes only invalid/unrepresentable conversion input null. Null inputs propagate. Only quantize and decimal_divide round, using half_even|half_up|toward_zero|floor|ceiling. Division by zero fails.

decimal_divide requires a decimal left operand and a decimal or safe-integer number right operand. A number divisor is interpreted exactly as an integer; fractional or unsafe-integer numbers are rejected. This is an explicit function contract, not an implicit decimal/binary64 conversion for other operators.

add, subtract, multiply, and comparison accept two decimals without binary64 mixing. Addition/subtraction use scale max(S1,S2) and precision min(38,max(P1-S1,P2-S2)+scale+1); multiplication uses scale S1+S2 and precision min(38,P1+P2). An unrepresentable scale or coefficient fails. sum returns precision 38 at the input scale; min/max retain the type. Decimal avg is rejected: use sum, count, and explicit decimal_divide. Branches and array elements require one compatible closed decimal type; explicit quantize resolves different precision/scale choices.

Object and array constructionCopy Anchor Link

Implementations MUST preserve closed object/array types and reject unknown constructor fields, heterogeneous elements, and hidden capability references.

{object: {static_name: Expression, ...}} builds a closed, non-empty product; all named properties are present, including nullable properties. Field names use the same closed schema rules as relation fields. Computed keys, spread, merge, omission, opaque JSON, and hidden ResourceRef/ContentRef values are not admitted. Key order is canonical for identity, not an author-selected semantic order. Classification/provenance includes every child dependency.

{array: [Expression, ...]} builds a finite sequence with one homogeneous recursively compatible value contract; its source length proves the item bound. Dynamic collections use array_agg or nest (nest), expansion uses unnest, and json_pick derives types from closed object paths. Size proofs use child contracts or the checked Host envelope when child sizes are unresolved. Effects remain field/literal consumers of named Results; nested payload construction happens in preceding computation, not inside an Effect. The empty form is legal only with the unique type evidence defined in Closed value contracts, or explicit empty_array.items. Aggregation and nest retain their operation-defined typed empty cases; no empty array is guessed to be json or left dynamically untyped.

Text, time, and regular expressionsCopy Anchor Link

The optional actql-text-time/0.1 pure scalar profile adds exactly split_part, utf8_truncate, try_number, parse_timestamp, format_timestamp, regex_match, regex_extract, regex_replace, nfkc, case_fold, and try_timestamp. Profile admission follows Conformance profiles. The inherited text-time base remains pinned to its original body. Its former fixed-three-argument substring membership, Host envelope and interval law are superseded by the current common scalar substring rule. Current text-time source/envelope/barrier schemas omit that operation; earlier bodies and CIDs are not reinterpreted. A nested profile call receives a checked substring String upper bound when known, otherwise the usual selected-policy runtime input preflight. Profile-derived extents across a substring may be conservatively widened; identical admission for every old nested profile plan is not implied.

This profile pins its Unicode tables, timestamp grammar, and regex grammar. Implementations MUST use those pinned definitions as the semantic authority. Host library, ICU, and locale defaults MUST NOT define normalization, folding, or pattern syntax.

Note (informative): A library can implement the pinned definitions; using a library is not itself a fallback. Its environment-dependent defaults do not determine ActQL semantics.

- derive:
    region_code: "split_part(external_key, '-', 1)"
    short_name: "substring(display_name, 1, 40)"
    export_name: "utf8_truncate(display_name, 120)"

split_part uses the one-based Unicode-scalar positions defined below; array subscripts remain zero-based. String position/length arguments are number expressions checked at evaluation as safe integers without rounding. utf8_truncate requires a non-negative safe integer byte limit and returns the greatest prefix whose UTF-8 encoding is within max_bytes. It MUST NOT split a Unicode scalar.

Returned strings retain the operation's resulting scalar sequence without implicit NFC or line-break conversion. Explicit normalization/case-folding operations keep their separately pinned laws. No locale, collation, provider, or Host compatibility mode changes these rules. The admitted overload is the displayed fixed arity; SQL regex-substring overloads are not added.

- derive:
    parsed_at: "parse_timestamp(local_datetime, 'yyyy-MM-dd HH:mm:ss')"
    maybe_amount: "try_number(amount_text)"
- derive:
    export_at: "format_timestamp(parsed_at, 'yyyyMMddHHmmss')"

The profile uses the finite grammar artifact spec/grammar/actql-timestamp-pattern-0.1.ebnf and its closed canonical AST. Fixed-duration and text-time operations have a fixed UTC timezone and no timezone author field, TZDB, or locale dependency. Only the explicit calendar profile uses its admitted timezone and pinned TZDB; those settings never flow into ordinary timestamp conversion or date arithmetic. parse_timestamp requires yyyy, MM, and dd exactly once; HH and mm occur together, ss requires both, SSS requires ss, duplicate semantic tokens are forbidden, the whole input is consumed, and an invalid calendar value fails. Missing time components MUST resolve to ActQL-defined zero values, not host defaults: absent HH/mm means 00:00, absent ss means 00, and absent SSS means 000. Parsing uses the proleptic Gregorian calendar, UTC, and the closed year range 0000..9999. format_timestamp is locale-independent. try_number uses the same canonical number grammar as to_number, but returns null instead of failing for a non-null unparsable string.

Timestamp patterns MUST be nonempty sequences of the admitted components; both parse and format modes reject duplicate semantic tokens and apply the HH/mm, ss, and SSS dependencies above. Only parse mode requires yyyy, MM, and dd. Format mode admits a pattern consisting solely of the admitted literals, producing that literal text for a non-null timestamp. Literal components retain their individual occurrences in the canonical AST, without coalescing or reordering. An empty pattern is not a literal-only pattern.

Text, pattern, replacement, and output resource bounds are not expression arguments. The compiler derives the strongest envelope available from the field contract and resolved literal or parameter values. Every text/time expression also binds a versioned Host ceiling; the derived input codepoint and UTF-8 extents MUST fit that ceiling, including literal and contract-bounded inputs. Runtime-bound input is rechecked against the same ceiling when the expression is demanded, before evaluation. If a finite admitted envelope cannot be established, the unit is rejected before evaluation; a runtime MUST NOT silently substitute unbounded host string, time, or regex behavior.

Every checked expression binds one machine-only actql-text-time-evaluation-envelope/0.1 containing the semantic step, canonical expression pointer, demand path, and operation, input codepoint and UTF-8 extents with an evidence CID, parsed pattern-AST CID and byte extent where applicable, canonical replacement-AST CID, literal byte total, capture-reference count and maximum capture index, replacement-count and output-byte ceilings, verification phase, current Host policy-profile CID, and a self CID. Each canonical AoA Fragment binds these envelopes in expression-pointer order, including expressions inside conditions, constructors and aggregate arguments. No derive-only acquisition barrier is introduced. The portable bound law is versioned as actql-text-time-bound-laws/0.1; Hosts MUST implement that law rather than a local estimate. Every text/time expression requires a versioned Host ceiling in the checked Plan; runtime-bound strings are additionally rechecked at their demanded evaluation boundary. Without that ceiling, Check MUST NOT issue a checked Plan.

Demand paths preserve selected conditional branches, earlier coalesce null tests, and the containing aggregate's filter. Moving a pure profile call into another physical unit preserves that same row mask and first-failure order. Expression-local enforcement is not performed on undemanded rows. Input admission, static pattern checks, and whole-unit limits retain their separate scopes and cannot be bypassed by lazy evaluation. Logical output/size bounds use the pinned Unicode/regex/time laws with the string rules above; physical scheduling and resource consumption are not deterministic logical charges.

For split_part, the canonical conservative output-byte ceiling is the input UTF-8 ceiling. utf8_truncate uses min(input_bytes, max_bytes) for a bound nonnegative safe-integer literal limit, otherwise the input ceiling. These calculations use exact integer arithmetic before comparison with Host limits. Dynamic lengths and invalid conversion-data literals do not trigger speculative evaluation or a new static rejection; their domain checks occur only on demanded rows. Other output-bound formulas retain the pinned base profile's laws. Each parent consumes its children's checked extents, including nullable outputs, rather than requiring those children to be named columns. Envelope self-CIDs exclude only their self-CID field; argument CIDs bind the canonical argument subtrees.

Input evidence CIDs MUST hash the following complete canonical JSON preimages. For source: value_contract, the preimage is the complete checked input value contract. For source: literal, it is {version: "actql-literal-text-extent/0.1", value: V}, where V is the resolved canonical string, timestamp wire string, or known null. Selected Parameter values use the same rule as literals; declaration metadata and binding origin do not enter this extent identity. Known null has zero scalar and byte extent. For source: runtime_preflight, the preimage is {version: "actql-text-time-runtime-preflight/0.1", contract: C, policy: P}, where C is the complete checked input contract and P is the complete selected actql-text-time-host-policy/0.1 value, not only its input ceilings. A derived child output uses value_contract with its checked output contract.

This CID identifies the extent evidence content, not its applicability: the owning expression, selected bindings, policy and child producer dependencies MUST still be verified and retained. Equal contract CIDs do not discharge a child's demanded runtime checks or authorize evidence from another Program. These preimages contain no process-local handle or step index and are not Program, Invocation, expression-argument or envelope identities.

Regex expressions use spec/grammar/actql-regex-0.1.ebnf and the closed actql-regex-ast/0.1 schema. Check MUST parse every literal or bound regex and timestamp pattern into its canonical AST and bind that AST's CID. The admitted regex grammar contains literals, classes/ranges, captures, alternation, anchors, dot, and greedy bounded/unbounded quantifiers. Lookaround, backreferences, named captures, lazy quantifiers, Unicode property escapes, and implementation-specific escapes are outside the grammar. Patterns are literal or invocation-parameter values, not fields; recursion and host-specific flags are forbidden.

Regex AST literal nodes MUST use the closed form {kind: "literal", codepoint: n}, where n is one Unicode scalar integer (0..1114111, excluding 55296..57343), not a UTF-16 code unit or string. Assignment in the Unicode version is not required. Character-class range start and end use the same scalar integer domain, with start <= end and inclusive membership over the scalar universe. Decoded \\n, \\r, and \\t therefore carry 10, 13, and 9 respectively. Source pattern text retains its ordinary NFC/LF admission; decoded AST scalars are not text-normalized. Literal nodes, class items, branches and captures retain their prescribed occurrence order.

Canonical regex AST construction MUST retain each capturing group, number captures from one in opening-parenthesis order, and omit sequence/alternation wrappers only when they have exactly one child. Empty patterns, groups and alternation branches are invalid. A leading or trailing unescaped hyphen inside a class is a literal; elsewhere inside a class it separates scalar range endpoints. Outside a class, hyphen is a metacharacter and requires escaping. Quantifier bounds are exact nonnegative integers with the grammar's canonical decimal spelling. They are not rounded to fit AST numbers: a finite binary64 integer must represent the complete authored integer exactly, without an additional safe-integer ceiling. A finite maximum is at least the minimum; an omitted unbounded maximum is represented by null. Identical class items, branches and repeated occurrences are not deduplicated.

The regex AST CID MUST use ordinary canonical JSON of the complete AST body, excluding only ast_cid. Numeric scalar representation preserves CR versus LF and range endpoints without an exception to global canonical JSON rules. Schema checking covers scalar domains and closed node shapes; capture numbering, capture counts, range ordering and quantified-expression rules remain separate semantic checks.

The expression contract's pinned regex_ast_contract MUST govern regex AST representation and identity in preference to the inherited text-time profile's older string-literal AST representation. Matching, source grammar, flags and demand laws otherwise remain unchanged. Old string-valued literal nodes and range endpoints are rejected, not silently converted or assigned the new CID. A backend without this exact AST dependency and expression-contract support cannot produce an executable Plan for it; the old registry is not relabeled as supporting the new representation.

Regex flags MUST be a string containing only m (anchors also match U+000A line boundaries) and s (dot also matches U+000A), each at most once, in either order. Omitted flags and the empty string both select neither flag.

The regex_extract capture argument MUST be a nonnegative integer literal or an invocation parameter of number type. The regex_replace replacement argument MUST be a string literal or an invocation parameter of string type. Neither argument admits a row field or a computed expression, including a constant expression. Check validates the resolved non-null parameter value and its capture/replacement consistency with the admitted pattern before evaluation; declaration-only type checking does not discharge that obligation.

The profile requires positive limits for input codepoints, pattern bytes, output bytes, and replacements. regex_extract requires an explicit capture index and returns null for no match; regex_replace applies a bounded left-to-right global replacement. Its closed replacement grammar uses $$ for a literal dollar and $1..$99 for captures; references to absent captures are rejected at Check, while an unmatched admitted capture expands to the empty string. The portable output ceiling accounts for every literal and repeated capture expansion. A limit breach fails atomically.

Regex replacement tokenization MUST consume $$ as one literal dollar, or a dollar followed by one ASCII digit 1..9 and, when present, one further ASCII digit 0..9 as a capture reference. Further digits are literal text: $100 denotes capture 10 followed by literal 0, not capture 100. Other dollar forms, including $0, $01, a bare dollar and ${1}, are invalid. Backslash has no special replacement meaning. The canonical replacement AST coalesces adjacent literal text, including decoded $$, into one nonempty literal part; capture parts retain their order and repetition. An empty replacement has an empty parts array. Its literal UTF-8 byte total, capture reference count and maximum capture index (zero with no references) describe these parts, not the source spelling or a deduplicated set of captures.

The operation/input matrix is closed: split_part, utf8_truncate, try_number, parse_timestamp, regex_match, regex_extract, regex_replace, nfkc, case_fold, and try_timestamp consume strings; format_timestamp consumes a timestamp. parse_timestamp preserves input nullability. try_number and try_timestamp have nullable output because input parse failure produces null.

nfkc uses Unicode 16.0.0 compatibility normalization; case_fold uses full default C/F mappings, not locale-specific T mappings. Both return NFC. The profile pins the vendored Unicode table CID and derives expansion ceilings from those tables (18 decomposed scalars for NFKC, 4 for full folding/NFC per input scalar). try_timestamp uses the same UTC grammar as parse_timestamp. It MUST return null for invalid calendar/input text. An invalid pattern, bound breach, or engine failure MUST fail the operation rather than produce null. Null input propagates after the pattern has been checked.

A quantified subexpression MUST consume at least one Unicode scalar on every successful match. Check rejects quantified anchors and any quantified capture, sequence, alternation, or repeat whose canonical AST is nullable; this keeps the grammar and the finite matcher state space identical across runtimes.

Implementations MUST use the exact ActQL regex sets and boundaries below. Regex shorthand classes are exact ASCII sets: \\d is 0..9, \\w is A..Z, a..z, 0..9, and _, and \\s is TAB, LF, VT, FF, CR, and SPACE. Their uppercase forms are complements over the Unicode scalar universe. Dot excludes only LF unless s is set. With m, anchors use document or LF boundaries; CR remains an ordinary scalar, including in CRLF. An unmatched capture is null and expands to the empty string in $1..$99 replacement. All ActQL strings and object keys MUST reject unpaired UTF-16 surrogates.

OperationsCopy Anchor Link

Each operation specifies its accepted Carrier, parameters, result, ordering, and failure conditions. Shared expressions are defined in Expressions and predicates; author guards and proof-derived execution limits are defined in Author guards, resolved limits, and Plan facts.

Operation definitions use the following common contracts rather than repeating them for each spelling:

Operation inventoryCopy Anchor Link

Family is an author-visible functional grouping, not an AoA opcode namespace or a profile identifier. Search/text_rank belongs to actql-text-rank/0.1 and lowers to REL.text_rank; Calendar belongs to actql-calendar/0.1 and lowers to the specified TEA calendar opcodes. Acquisition/search_candidates is a typed barrier, not an algebra opcode. Profile claims and registry admission are checked independently of this display classification.

ActQL has exactly one canonical operation name for each operation in the Program model. Registered frontend surfaces lower into that vocabulary; they do not add operation aliases to the structured model or bypass its checker. Structural STEP and closed OP preserve existing operations. Query sugar is governed by its explicit frontend profile, not inferred from backend SQL. The complete canonical vocabulary is:

Reserved operation, argument-key, scalar-function, predicate, Effect-kind, and binding-form spellings are exact lowercase. Author-defined identifiers retain case under Pipeline names and references and Parameters and binding. Case folding and conversion of spaces, dots, or hyphens to underscores are not part of ActQL. Implementations MUST NOT execute an unknown spelling through fuzzy matching or an undocumented synonym.

Bare search and bare dedupe are not ActQL vocabulary. A compiler MUST reject them as unknown operations; authors choose the exact operation whose semantics they require. The compiler MUST NOT turn an unknown word into an ambiguity resolver or operation-discovery side channel.

row_window is the relation-in/relation-out window operation and window_events is the event-stream-preserving operation; both require explicit kind. graph, nearest, row_window, and the other declared semantic macros may insert typed carrier bridges, but their computation remains AoA IR. infer is an explicit typed external acquisition operation; serialize is an explicit Artifact barrier. An ordinary join whose right side is a keyed SourceView may lower to an actql-lookup/0.1 acquisition barrier. These barriers are not AoA algebra operations, hidden Connector callbacks, Effects, or control-flow constructs.

The Grammar Manifest operations inventory is the complete author-visible operation vocabulary. ACTQL_INTEGRATION_PROFILE_CONTRACT identifies the corresponding optional production-profile contracts. Profile conformance and unsupported-profile rejection follow Conformance profiles. No operation outside these closed contracts may execute as ActQL 0.1.

Relation operationsCopy Anchor Link

filterCopy Anchor Link

filter accepts the one explicit predicate grammar in Predicates:

- filter:
    and:
      - {eq: [{field: status}, {literal: open}]}
      - {gte: [{field: amount}, {literal: 100000}]}

Field-to-field and field-to-literal comparisons use the same binary form:

- filter:
    lt:
      - {field: score}
      - {field: required_score}

- filter:
    lt:
      - {field: score}
      - {literal: required_score}

These are structured-form examples. Predicates also accept expression text (Expression text): score < required_score compares fields, while score < 'required_score' compares a field with a string literal. Operand expressions follow Expressions and predicates; names and literals are distinguished by syntax, not inferred from their values.

filter lowers to REL.where.

selectCopy Anchor Link

Simple projection:

- select: [id, status, amount]

Projection with deterministic renaming:

- select:
    - opportunity_id: id
    - account_id

The map form means {output_name: input_field}. Projection order is semantic. select lowers to REL.select.

rename: {existing_name: new_name} and drop: [field, ...] are convenience forms that retain the remaining complete input shape and lower directly to REL.select. They require a complete statically known field set. Duplicate output names, unknown fields, or dropping every field MUST fail during check.

Given a complete input schema, check MUST accept rename: {} and drop: [] as identity projections retaining every input field, including when the input schema itself has no fields. The prohibition on dropping every field applies to removing all fields from a nonempty input, not to preserving an already empty input. This does not admit select: []. Accepting an identity projection does not authorize deleting the authored operation or equating its semantic identity with omission of the operation; ordinary lowering and identity rules continue to apply. Repeated names in drop denote the same removal, not duplicate output fields.

sortCopy Anchor Link

- sort:
    - {score: desc}
    - {id: asc}

Each key MUST follow OrderKey in Structural grammar (normative) and specify asc or desc. The single-field map uses last for null placement where the AoA contract defines that completion as exact. The explicit {field, dir, nulls} form selects first or last; nulls is REQUIRED in that form. Null placement is independent of ascending or descending direction. sort lowers to REL.orderByStable for a nonempty authored key list.

Check MUST accept sort: [] as an identity operation preserving row values, multiplicity, schema, current order and existing evidence, including for empty input. An empty sort MUST NOT perform candidate-key sorting or establish new order evidence; it is an exception to the completion rule below. Acceptance MUST NOT authorize deleting the authored operation or equating its semantic identity with omission. Later consumers still apply their own order requirements, including any candidate-key completion permitted for take.

Ordering ties that can affect a published Result or an order-sensitive operation MUST be resolved. For a nonempty authored sort, when the current relation retains a candidate key whose fields all have a portable order, the compiler MUST append missing key fields in ascending order as a deterministic identity tie-break and journal the completion. This does not invent a business field: it reuses proven identity evidence. Without a retained candidate key, the compiler MUST NOT invent a tie-break.

REL.orderByStable MUST compare the supplied keys in their declared priority and preserve input-relative order for rows equal on all keys, without adding valueCID or any other implicit tie-break. The compiler MUST pass completed explicit keys and their completion record to lowering; the primitive does not perform candidate-key inference. An existing admitted total-order witness can justify stable tie resolution where the consuming operation's rules permit it; this is distinct from appending candidate-key fields. Stability alone MUST NOT promote physical input enumeration into deterministic total-order evidence. The empty-sort identity and evidence rules above remain unchanged.

For nonempty sort, the compiler MUST prefer eligible candidate-key completion. If no eligible candidate key exists but an applicable admitted total input-order witness exists, it MUST resolve equal explicit-key tuples using only the relative order established by that witness. The sorted output MUST identify this sort as its order producer and retain the prior witness as a tie-resolution dependency, not copy the prior order as if the complete input sequence were unchanged. Projection hiding prior order fields does not itself invalidate a retained occurrence-order witness. With neither strategy available, the compiler MUST retain the order as unresolved and reject it at a boundary requiring total order. The checked strategy, authored keys, completion record or exact owned prior witness MUST be exposed to lowering without requiring order re-inference. This fallback is specific to sort; it does not relax the separate candidate-key requirements of top_k or top_k_by.

takeCopy Anchor Link

- take: 20

The object form is take: {count: 20, offset: 40}; its count member is named count, not limit.

The count MUST be a positive safe integer. take: n and take: {count: n, offset: 0} normalize to the same closed object; offset defaults to zero and otherwise is a nonnegative safe integer. Skip that many rows, then retain at most count rows; an offset beyond the input yields empty output. take lowers to REL.limit with both values. The input MUST already have a proven stable order from sort, top_k, an ordered deterministic operation, admitted connector order evidence, or a retained candidate key that the compiler can order by and journal. Provider return order alone is not evidence and MUST NOT make take valid.

distinctCopy Anchor Link

- distinct: true

removes duplicate complete rows. A key projection MAY be written as:

- distinct: [customer_id]

Keyed distinct projects the declared keys before applying REL.distinct; it does not retain unspecified fields. A compiler MUST NOT choose a representative row for unspecified fields.

Distinct MUST retain the first occurrence of each equal complete row in existing input order; keyed distinct applies this rule after the declared projection. It does not sort surviving rows or select values for fields omitted by that projection. Existing logical order is preserved, but provider arrival order without evidence does not become a stable-order proof through deduplication. This rule is independent of candidate-key propagation and does not introduce a non-null scalar identity for arbitrary complete rows.

A keyed distinct list MUST be nonempty and contain no repeated field references, because it defines a projection with distinct output names. Check MUST reject distinct: [] rather than reinterpret it as distinct: true. The list retains its authored projection order; these rules do not reject empty runtime input or impose a scalar-only schema on whole-row distinct.

Fields selected by keyed distinct and fields in dedupe_rows.by MUST belong to the scalar or reference domains admitted by KeyComparable; nullable keys are permitted. Object, array, json and vector fields are not admitted as these explicit equality keys. This restriction does not apply to complete-row distinct: true. Authored ordering keys separately follow AuthorOrderable.

Representative-row selection is a separate operation:

- dedupe_rows:
    by: [customer_id]
    order_by:
      - {updated_at: desc}
      - {source_id: asc}

by and non-empty order_by are REQUIRED. The operation keeps the first row in that order and fails an unresolved top tie; those are language invariants rather than authoring fields and are recorded in the Plan. The compiler lowers this to REL.dedupeRows. If two candidate rows for one key tie on every authored order key, execution MUST fail; implementation row order or CID MUST NOT silently choose the representative. Groups are emitted in ascending canonical typed key order, comparing the authored by tuple component by component with NULLS FIRST and the declared type's non-null comparison. This order is separate from canonical key encoding and from the authored order used to select each representative.

Check MUST accept dedupe_rows with by: [], treating all input rows as one global partition. Its required nonempty order_by selects the first existing row; empty input yields zero rows, and a tie between top candidates fails under the same rule as any other partition. No representative row is synthesized. This differs from a global aggregate and from sort followed by take-one. Check MUST accept repeated by references while checking each reference's existence and applicable type requirements. The checked representation MUST retain their authored order and repetitions without preimage deduplication; repetition neither adds output columns nor proves uniqueness or resolves ties.

groupCopy Anchor Link

Aggregate calls MUST use the closed function-specific grammar below: field and expr are mutually exclusive, and only row-count count may omit both. String shorthand, op, function-name keys and count_if.where are not aliases. Check MUST accept an empty aggregates map and repeated by references while checking every input contract, reference and budget. An empty aggregate map produces only the grouping fields, once each in first-occurrence order; repeated conditions do not duplicate rows or strengthen uniqueness. With by: [], it produces one empty object even on empty input. Authored repetitions and the operation remain in the semantic source; no preimage deduplication, operation deletion or identity equivalence with another operation is implied.

The distinct member accepts either boolean for count(expr), sum, avg, array_agg and string_agg; only false for row-count count, min and max; and neither boolean for all other aggregate functions. No implicit cast is performed. A unique fixed immediate input domain supplies literal NULL with type evidence (for example number for avg, boolean for count_if, string for string_agg), but overloaded input domains and unresolved child computations receive no inferred type from the aggregate's result.

array_agg constructs a non-null array of non-null root items, retaining nested nullability. Its item contract follows recursive value-construction rules: opaque json and reference types, including those hidden in arrays or objects, are not constructible here. In contrast, first and last select existing typed values and may retain structured, opaque JSON and reference contracts; their ordering keys independently satisfy AuthorOrderable. Aggregate capacity, order completion and numeric observation obligations are not discharged by static type checking alone.

- group:
    by: [customer_id]
    aggregates:
      event_count: {fn: count}
      total_amount: {fn: sum, field: amount}

Supported aggregate functions are count, count_if, sum, avg, min, max, array_agg, and the ordered and statistical aggregates. Every aggregate MUST have an output name. Every function except row-count count MUST name an input expression or field. distinct: true is admitted only for count(expr), sum, avg, and array_agg and the explicitly admitted additional aggregates; it is invalid for row-count count, count_if, min, and max. The fixed evaluation order is each aggregate's filter, its argument expression on true rows only, null exclusion, canonical-value CID distinct, then stable fold. Argument expressions are not hoisted before their filters. Separate aggregates evaluate in canonical output-name order; each consumes rows in its specified input order. Every array_agg MUST declare its own non-empty order_by; these orders may differ between aggregates. The compiler applies each after its own filter, without imposing one aggregate's order or demand on another. Group results are canonically ordered by the group keys in ascending AoA order, including reference identity order (Opaque reference values). The key tuple is compared lexicographically in authored by order, with NULLS FIRST independently at every component: two null components compare equal and comparison continues at the next component; a null component precedes every non-null value of its declared type. Non-null components retain their type-specific canonical order. This is group output enumeration, not the default null placement of authored sort or the input order of an aggregate. group lowers to REL.groupBy followed by that canonical group order. The final order also applies when aggregates is empty; primitive deduplication enumeration is not a substitute for it.

Null group keys of the same declared type form one group. by: [] is the global aggregate and emits one group even for empty input. count counts rows; count with an expression counts non-null expression values; count_if counts only true and excludes false/null. sum, avg, min, and max ignore null and return null when no non-null value exists. min/max require one AuthorOrderable type (Lexical and ordering rules). array_agg excludes null, applies distinct equality by canonical value CID while retaining the first occurrence in the authored stable order. array_agg.max_items is an author guard as defined in Author guards, resolved limits, and Plan facts, counting elements in each aggregate array after null exclusion and any distinct step. Its resolved limit uses input proof, Host policy, and any authored guard. Its order MUST retain a candidate key so equal authored keys cannot choose a row by provider enumeration. A breach MUST fail the aggregate operation without publishing a partial Relation or truncated array.

For groups containing binary64 sum/avg, lowering preserves the same checked grouping and result contract but inserts typed numeric observation slots for those aggregate values. Exact aggregates remain AoA computation; replay uses the captured slot values. Describing group as REL.groupBy does not authorize recomputing an observed floating reduction on replay.

Captured floating-point aggregatesCopy Anchor Link

Binary64 sum and avg, including their group, window_group, pivot and analytic forms, use a compiler-inserted numeric observation boundary. Both local and remote reductions MUST capture the admitted result before any downstream filter, ordering, Result or Preview consumes it. Replay reuses that value, never a newly computed approximation. Determinism is over the ObservationSet including numeric observations, not merely over the original input rows.

Placement may choose a Contract-admitted reduction algorithm with its declared rounding and error law; it cannot choose arbitrary opaque code. A numeric contract fixes contributors, input type, filter demand, NULL/distinct semantics, group/window identity, count, finite output, overflow and algorithm/error law. Wrong groups, counts, domains or demand are not numerical tolerance. The closed boundary does not authorize unrelated provider computation or additional egress. No universal epsilon is inferred. Cancellation in [1e16, 1, -1e16] can produce 0 or 1 under different reductions; differences are not necessarily one last bit.

Numeric observations MUST bind the semantic aggregate slot, logical input artifact, post-filter contributor evidence, group/window key, NULL/distinct law, input type/count, adopted finite value, provider/kernel law and policy/cost evidence. Slot identity precedes response capture and excludes future Stage Invocation/Result CIDs. The logical Plan binds the aggregate and slot contract, not future physical parallelism or response bytes. Different fresh placements may change ObservationSet, Invocation and Result identities without changing Program identity; same-observation replay cannot.

count, count_if, exact decimal sum, and a separately proved integer sum retain exact semantics and final public-domain checks. Integer evidence requires an admitted integer/range contract, not values that happen to look integral. Integer sums use exact accumulation; an admitted integer average requires an explicit result/rounding law. Decimal average is not introduced implicitly. Decimal scale zero remains an explicit exact route. Min/max, ordered strings, variance/percentile laws, VecA scores and graph means retain their own laws. Scalar binary64 arithmetic is unchanged. Money and exact decisions should use the explicit exact value domains, not assume approximate reduction invariance.

joinCopy Anchor Link

- join:
    with: contracts
    kind: left
    on:
      - {left: organization_id, right: organization_id}
      - {left: account_id, right: crm_account_id}
    cardinality: many_to_one
    select:
      opportunity_id: left.id
      renewal_at: right.renewal_at

with names the right relation. left MAY explicitly replace the current relation. kind is REQUIRED and MUST be one of inner, left, full, semi, or anti. on MUST state one equality key or a non-empty array of equality keys; same-name field shorthand is permitted. Arbitrary non-equality conditions are not part of this join; bounded Cartesian products and temporal overlap use the separately specified cross_join and interval_join operations.

Check MUST permit step-level from together with join.left: step from selects the main input first, then join.left replaces it as the actual left operand. Without step from, join.left replaces current and can establish the left operand when current is unset. Both explicit selectors MUST resolve to available Relation bindings under the ordinary name-scope rules; an invalid from is not ignored merely because join.left overrides its selection. The checked join's left input edge identifies the final selected operand, not the overridden binding. The join output becomes current as usual.

Check MUST accept repeated equality pairs and repeated use of one side's field with different fields on the other side. Every pair is checked independently; the checked representation MUST retain the authored pair order and repetitions. Acceptance does not authorize deduplication of the operation's semantic preimage.

cardinality is an OPTIONAL validation assertion, not output semantics. It is one of one_to_one, many_to_one, or one_to_many; it asserts uniqueness of both sides, the right side, or the left side respectively. A violated uniqueness assertion MUST fail before a result is accepted. This failure behavior is a language invariant, not an authoring policy.

When cardinality is omitted, the compiler MUST derive it only when candidate key evidence proves the join-key tuple unique on the left, the right, or both. Uniqueness on both sides proves one_to_one; uniqueness only on the right proves many_to_one; uniqueness only on the left proves one_to_many. When neither side is proven unique, cardinality remains unproven; the compiler MUST NOT infer many_to_many. A derived cardinality and its candidate-key proof, including any SourceView Contract CID on which it depends, belong to the Compiled Plan and are not source normalization. An authored cardinality is recorded as an author assertion and requires the same fail-on-violation runtime check.

Static uniqueness evidence and the authored assertion are combined per side. A proven unique right side together with an asserted unique left side yields one_to_one; the Plan retains both sources of evidence. The assertion does not discard a stronger static proof.

Omitted null_key has the fixed SQL-style no_match language law and creates no normalization entry. Explicit null_key: no_match is legal and normalizes to the same canonical form as omission; null_key: fail is the sole authored override and rejects a null key component on either input. max_output_rows is an author guard as defined in Author guards, resolved limits, and Plan facts, counting joined output rows. Its resolved limit uses safe join-cardinality transfer over both inputs, current Host policy, and any authored guard. A breach MUST fail the join before publishing its output Relation. Join-key types MUST satisfy KeyComparable (Closed value contracts) under the resolved schemas; implicit coercion is forbidden.

Without select, join fields retain explicit left. and right. provenance. These compiler-generated names are the sole exception to the authored flat field rule in Field names and nested paths; an author cannot declare a source field with either prefix. Unqualified field access on a raw join result MUST fail as ambiguous. semi and anti joins expose only left fields. full is the reconciliation join: unmatched rows from either side are preserved, absent-side fields are null, and output ordering follows the row-order contract below. Both complete typed schemas and stable identities for both sides are REQUIRED for full; the compiler MUST NOT synthesize them.

With select, every output field maps to a provenance-qualified source field, and subsequent steps use the flat output names. A compiler MUST NOT select a same-named field from one side by precedence.

An explicitly authored join select MUST be a nonempty map; {} MUST fail during check. Omission retains the qualified output and is not an empty projection. Check MUST permit distinct output names to select the same source field, preserving its exact type and nullability in each output. Duplicate output names remain invalid. Projection mappings MUST retain every alias; accepting aliases does not itself prove candidate-key preservation.

Because object key order is not semantic, join select output names are lowered in AoA canonical UTF-16 code-unit order. Authors control final column order with the selected named result's fields.

All join kinds have a fixed row-order contract. inner and left enumerate left rows in their stable input order and matching right rows in stable right input order; unmatched left rows remain in place for left. semi emits each matching left row once and anti emits each unmatched left row, both in stable left order. full uses the left order first and then unmatched right rows in stable right order. Null keys MUST NOT match under no_match; fail aborts before publishing output. Projection may hide key fields but does not erase the runtime ordering evidence attached to the relation result.

Candidate-key preservation is separate from row ordering and follows this closed table:

Each input may have more than one candidate key. A select or rename retains each key for which every field maps to one distinct output field. It may drop one key while preserving another. Outer-join null extension is not evidence for right-side uniqueness.

deriveCopy Anchor Link

Computations and replacements belong to derive; closing the field set belongs to select. Derive preserves input fields, row order and multiplicity.

An empty derive map MUST be accepted, including with an empty input schema, and preserves input values, schema, row order and row count. Input-contract and budget checks still apply. No-op admission does not authorize operation deletion or CID equivalence with an omitted operation. This rule does not require a complete input schema for derive in general; the ordinary input contract applies. The array form remains nonempty, with exactly one entry in every slot map.

All map expressions read the input, never siblings. Map keys are canonically sorted before lowering to the existing REL.derive. An output name MUST NOT collide with a visible input field in map form.

- derive:
    - original_amount: "amount"
    - amount: "amount * $multiplier"
    - tax: "amount * $tax_rate"
    - total: "amount + tax"
- select: [id, original_amount, amount, tax, total]
  as: calculated

Array slots MUST be nonempty singleton maps with static flat field names and common Expression RHSs. Output names are unique after NFC normalization. Shadowing an input once is distinct from declaring the same slot name twice. Reserved-name and prototype-safe field handling remains unchanged; lawful __proto__ and numeric-looking names are data, not dictionary instructions. No spread, wildcard, dynamic LHS, slot metadata or sequential flag is added. No project operation is registered by this revision.

For each row start with E0=input. Evaluate slot i against E(i-1), then bind its name to that value to obtain Ei; publish En. Its own binding is not in scope during its RHS. A previous slot wins over input; otherwise an existing input wins even when a future slot uses that name. A name found only in a future slot, or a self-definition without an input value, fails check. Save an old value under a different name before shadowing to use it later; there is no new input. namespace or implicit original-value accessor.

Checking MUST record each reference as the exact input field or earlier value-version slot. A shadow takes its checked RHS type without coercion or joining it to the old type. No type inference flows backwards from future slots. Required input admission precedes shadowing, including a value that will be overwritten. An otherwise admitted open input need not gain a complete schema: retain unknown fields under its existing contract and require the ordinary type evidence for every field actually read. Map collision requirements are not relaxed by this rule.

Array output retains every input field unless shadowed, replacing a shadowed field's value and type. Unmentioned fields remain. Object-key enumeration is not a column-order identity law; final publication order is ResultDefinition.fields. The authored slot sequence is semantic for evaluation and dependency identity, not an implicit reordering of published columns. For amount=10, multiplier=2, tax_rate=0.5 the example yields original_amount=10, amount=20, tax=10, total=30; only the final select removes other input columns. Selecting only final columns before derive may drop required raw fields or refer to fields not yet created. Optional early projection must preserve all input dependencies and admission, failure, bounds and policy obligations. Result.fields may close publication shape without a final select, but does not close the intermediate Relation.

Both forms MUST preserve row-major failure: logical row, canonical map name or authored array slot, then common expression child order. Each demanded RHS is evaluated once in one shared row frame; lazy unselected children remain undemanded. Every authored slot retains its evaluation obligation even if a later select drops it. A discarded division by zero still fails the operation. Whole-Relation derive steps are not an equivalent expansion when they change the representative failing row/slot. No partial row or slot is published.

Candidate keys whose values are unchanged remain. Computed replacement of a key loses its proof even under the same name; an exact copy of the complete non-null tuple to retained distinct aliases can preserve it. Row-position witnesses may survive shadowing, but old sort-key proofs do not describe new values. Field policy follows resolved value versions; replacement by a less sensitive value does not erase required observation provenance or Relation policy. Effects use the actual published target fields, not hidden old values.

Source normalization and printing MUST preserve map versus array shape, normalizing only RHS expressions. Literal payloads and structural arguments remain opaque. Map permutation is not array permutation. The common checked row-binding contract records source shape, ordered {name, expr} slots, input/prior-slot references, types, demand, retained input field contracts, proofs and one failure scope. Array roots use /bindings/i/expr; input references are {input_field: name}, earlier slots {prior_slot: i}. The ordinary current Relation is the sole graph input. The map AoA node shape remains unchanged. Ordered bindings require the pinned shared row-kernel extension, not an unregistered opcode or Host row rewrite.

Input, root, output, live-value and total-work ceilings retain their existing measurement scopes; slots do not reset budgets. Fusion with select must preserve derive's logical retained-output limits.

Ordered derive MUST use the REL.derive registration's ordered_bindings execution extension, pinned at actql-aoa.json#/execution_contracts/REL.derive.ordered. The closed params are {row_kernel_contract_cid, bindings, references}. The CID selects that exact extension, not a new opcode; bindings is a nonempty authored-order array of closed {name, expr} entries using the existing machine expression nodes. The legacy snapshot-map exprs representation is unchanged. An adapter lacking this extension cannot interpret the alternative as legacy params.

The reference table MUST contain exactly one closed {at, target} entry for every field-node occurrence, in binding order then semantic expression preorder. The RFC6901 at pointer is relative to params and starts at /bindings/i/expr; it never traverses literal payloads. Target is exactly {input_field: name} or {prior_slot: j}. The field spelling and checked type agree with the target. For binding i, the latest earlier slot of that name takes precedence; otherwise the original input is selected. Missing, duplicate, reordered, extraneous, self or future references are invalid, even when hashes match.

In fragment.request.pipeline, an ordered REL.derive step MUST have exactly {id, in, op, params}, with params exactly {bindings: [{name, expr}, ...]}. The nonempty bindings retain authored order and unique canonical names; each expr is the canonical normalized source Expression, not a machine expression node. Parameter references remain source syntax, with checked bindings retained in request.parameters; literal payloads remain opaque. Source params contain no reference table, extension pin, contexts, limits or derive evidence. The legacy map alternative remains exactly {exprs: {name: Expression, ...}}. Request and graph preserve the same canonical step IDs, input edges and binding names/order. Regeneration lowers the RHSs, adds the selected registry extension CID and derives the machine reference table, rather than trusting those as source assertions. Each root's source equals its corresponding source RHS.

A fragment with ordered nodes MUST carry row_kernel_evidence containing bindings, contexts, limits and shapes: each referenced body once, in self-CID order, with no unreferenced bodies. There is one existing actql-derive-binding/0.1 record per ordered node. Its node, input/output, binding names and types, expression roots, contexts and limits are regenerated from the same checked request. With no ordered nodes this member is absent. Root-list serialization still follows graph order then pointer UTF-16 order; it does not change authored binding evaluation order.

For this extension, checked_expression_cid MUST hash the complete corresponding fragment root, including its step ID, parameter pointer, source, node, checked contract and demand paths. context_contract_cid resolves an actql-derive-row-context/0.1 body binding the same input contract and the exact prefix of prior {name, contract} slots. Input/output contract CIDs resolve actql-derive-row-shape/0.1 bodies with known fields, sorted unique required_fields and boolean additional_fields; known fields are a subset of required fields. Unknown field types stay unknown. Context, shape and limit self-CIDs omit only self_cid; no diagnostic spans enter these preimages. Node identity includes its extension pin, never the evidence that names it.

For ordered derive, derive_binding.aoa_node_cid MUST be the canonical JSON CID of the complete corresponding fragment.graph.steps[i] object, exactly {id, in, op, params}, without a wrapper, domain field or omitted member. op is REL.derive, in is the one-element ordered input-edge array, and params is the complete machine alternative defined above, including row_kernel_contract_cid, ordered lowered bindings and the full reference table. This is not the source request step, params alone, a scalar expression node, the whole pipeline, a sort-validation projection or a resolved step augmented with input_sorts/output_sort. The actual canonical fragment graph names are included; process-local handles are not substitutes. The derive evidence, contexts, shapes, limits and their self-CIDs remain outside the step. Changing the step ID, input edge, extension pin, bindings or references changes this preimage; changing only external evidence does not. Fragment identity still binds the complete evidence. Node identity proves neither type correctness nor ownership; admission regenerates the same-request graph and evidence together.

request.row_kernel_limits MUST map exactly the ordered step IDs to their actql-derive-row-limits/0.1 bodies. Each has nonnegative safe-integer max_input_rows, max_value_bytes, max_live_value_bytes, max_work and a self-CID. Evidence limits_cid resolves the exact same-step request body; the row/value ceilings do not exceed the enclosing request's corresponding ceilings and selected Host constraints remain applicable. These limits are declared enforcement bounds, not inferred capacity proofs. A fragment without ordered nodes omits this request member.

Enforcement MUST count all input row occurrences, and measure each admitted input value, demanded root value and complete retained output row as canonical JSON UTF-8 bytes of its typed wire value. Live-value bytes sum live input, slot, temporary and pending-output roots; aliases count as separate logical roots even with shared physical storage. Release follows last use. A transfer of ownership does not create a second root. These are logical measures, not a process heap ceiling; additional backend resource limits remain separate.

Work MUST accumulate one unit per row, binding and demanded expression entry, plus value weight for input admission, each consumed operand, each produced value and the retained output. Value weight is one per scalar/container plus raw UTF-8 octets of string values and object keys, counting every logical occurrence. Caching and short-circuit scalar comparisons do not discount this weight; unselected lazy expressions incur no evaluation work. Logical work is not an instruction count. Charges precede traversal/construction, check arithmetic overflow, accept exact caps and never reset per row or slot. All required input validation precedes shadowing; failure exposes no partial operation output. Later projection cannot waive retained-output charges.

Saved plans are rechecked under their exact admitted law; map/array conversion, early select or expression deletion is not an automatic meaning-preserving repair. Ordered derive retains the input shape; explicit select closes the output shape. These are distinct operations with their own measured bounds.

top_kCopy Anchor Link

- top_k:
    k: 20
    by: [{score: desc}, {id: asc}]

k MUST be a positive safe integer and by MUST contain at least one explicit stable order key. Selection requires a total order. When retained candidate-key evidence exists, the completion algorithm in Deterministic completion selects and appends missing key fields and journals the change; without it, a possibly tied order is rejected. top_k lowers directly to REL.topk.

Partitioned ranking is a distinct operation:

- top_k_by:
    partition_by: [customer_id]
    k: 3
    by:
      - {score: desc}
      - {candidate_id: asc}

partition_by, positive k, and a stable non-empty by order are REQUIRED. The same total-order and retained-candidate-key rule applies inside every partition. The result preserves no input order across partitions: partitions are ordered by their keys in canonical ascending order, and rows within each partition use the authored order. It lowers to an AoA partitioned-top-k operation; repeated global top_k or host-side grouping is not a conforming substitute.

Check MUST use the closed {k, by} body for top_k and {partition_by, k, by} for top_k_by. The count is a positive-safe-integer literal or whole Parameter reference, not an arbitrary expression; bound values satisfy the same range before execution. The operations retain the input field contracts without fabricating row-count or total-order evidence.

Check MUST accept empty and repeated top_k_by.partition_by references while validating each equality-key field. Empty partition keys mean one global partition of existing rows, with no row synthesized on empty input. Repetitions and authored order remain in the checked representation; they add neither rows nor uniqueness evidence. Repeated authored order keys are also retained and cannot establish a missing tie-breaker. Neither empty partition keys nor repetition authorizes operation deletion, preimage deduplication, or identity equivalence with top_k.

Relational temporal operatorsCopy Anchor Link

row_window assigns fixed or sliding window columns without changing sort:

- row_window:
    kind: sliding
    time: occurred_at
    size: 1h
    step: 15m

kind, time, and positive size are REQUIRED; sliding windows also require positive step. It lowers to REL.window.fixed or REL.window.sliding. Window membership and emitted boundary values are defined in Canonical fixed and sliding windows.

window_group lowers to REL.window.project and uses the same named aggregate grammar and type rules as group (group). Its input MUST carry statically known window_start and window_end fields produced by row_window or declared by an already-windowed relation contract; it MUST NOT interpret an ordinary relation as windowed. lag lowers to REL.window.lag and requires partition_by, non-empty order_by, field, and an output name. An authored offset is a positive safe integer; omission and explicit offset: 1 normalize to the same one-row lag. Its partition order must retain a candidate key so lag selection has no unresolved tie. The output name is written as output. watermark_rows lowers to REL.watermark and requires time, an explicit late_policy of drop or mark, and either a finite watermark_ms or positive max_skew.

watermark_rows MUST specify exactly one of watermark_ms and max_skew; neither omission of both nor precedence between two supplied sources is admitted. It adds fresh non-null fields watermark_ms: number, watermark_late: boolean and watermark_decision: string. Any collision with an input field fails check. For max_skew, the threshold at input occurrence i is the maximum time over occurrences 0 through i inclusive, minus the resolved skew. This is an unpartitioned prefix in the proven logical input order, not a maximum over the complete Relation or a provider-arrival-order completion. Such order evidence is required for the prefix path. A row is late exactly when its time is strictly less than its threshold; equality is not late. mark preserves every row, using decision mark for late rows and keep otherwise. drop removes late rows and emits keep for retained rows. Empty input has the same output contract and no threshold observation. Non-finite threshold arithmetic fails before publication; invalid time rows cannot be silently discarded or emitted with missing generated fields.

window_group MUST have checked window-boundary role evidence, introduced by row_window or an admitted already-windowed input contract. Coincidentally named fields are insufficient. The evidence identifies the two boundary fields and their interval law separately from ordinary field-type knowledge. Value-preserving filters and whole-row distinct retain it. A name-changing projection transfers each role to every alias in its explicit, value-preserving field mapping; keyed distinct follows its projection. Removing an alias or replacing its value through computation removes only that alias's evidence. An exact whole-field derive copy transfers the copied value's role to its output alias, including self-copies and prior-slot copy chains. Snapshot and ordered derive use their checked reference scopes; neither equal field types nor evaluation of a general expression establishes a role. The final value version of each output name determines its surviving role. The window evidence becomes invalid when either boundary has no surviving alias. Window grouping retains only aliases that remain actual grouping keys, not same-named aggregate outputs. Required evidence must resolve before window-group checking is complete; this rule grants no new runtime deferral. Window keys are prepended exactly once to the ordinary group keys; the shared empty-group and repeated-key laws remain unchanged.

Reshaping and nested dataCopy Anchor Link

- pivot:
    index: [customer_id]
    column: status
    values: [open, won, lost]
    value: amount
    aggregate: sum
    fill: 0
- unpivot:
    columns: [jan, feb]
    name_column: month
    value_column: amount
    keep: [customer_id]
- json_pick:
    column: payload
    path: [customer, id]
    output: customer_id
- unnest:
    column: items
    as: item
    with_index: item_index

pivot uses index for its key fields and supports the aggregates sum, avg, count, min, max, and first; min/max require AuthorOrderable inputs (Lexical and ordering rules). unpivot requires explicit source columns plus the canonical name_column and value_column fields. json_pick accepts a non-empty path of object keys and MUST NOT evaluate JSONPath code. unnest requires an array-typed field, preserves the source row, emits one row per array element, and optionally emits a zero-based index named by with_index; with_index: true names it <as>_index. They lower to REL.pivot, REL.unpivot, REL.json.pick, and REL.unnest.

All unpivot.columns MUST have exactly the same statically proven type and nullability. ActQL 0.1 has no implicit common-supertype conversion; authors derive explicit casts before unpivoting heterogeneous fields. object means a parsed JSON object only, while json means any canonical JSON value. json_pick accepts an object or object-valued json; it MUST NOT parse a JSON string implicitly or inspect an opaque reference (Opaque reference values). For statically typed objects, every path segment MUST exist in the recursive fields contract and retains the leaf type with nullability composed through the parent path under Closed value contracts. An opaque json value may be checked only with host-provided shape evidence; absence of that evidence is not permission to guess a result type.

unpivot.columns MUST be nonempty; an empty list cannot establish the value column's type. A typed input containing zero rows is valid. Repeated source columns are retained. Omitted keep means []; overlapping keep and columns is permitted. The output consists of the kept fields followed by name_column and value_column. Generated names MUST be authored field names and the actual output names must be distinct, including repeated keep entries. Names of input fields that are not kept do not cause collisions. The name column is non-null string; the value column retains the exact selected contract, including nested structure and nullability. Each input row MUST produce one row per authored column occurrence, in input-row then column order, retaining null values. Expansion bounds count repeated columns; repeating a source column does not establish uniqueness of the input candidate key combined with the name column.

When every component of an input candidate key is retained by keep and the generated name labels are distinct, the output retains that key extended with name_column. Each label is the canonical field reference text, including left. or right. qualification when present. The witness depends on the input key validation and the checked one-occurrence-per-column expansion. A generated column does not count as retention of an unkept input field with the same name. Dropping every alias of a component loses this witness; null values in the value column and empty input do not invalidate it. Repeated columns remain admitted but do not generate this composite witness.

json_pick preserves every existing field and adds output; its output name MUST be an authored field name and MUST NOT collide with an existing field. Each path segment denotes one exact object key, not a dot-separated path or an array index. A selected leaf may have type json; shape evidence is needed only when traversing an opaque json, not when retaining it as a leaf.

For unnest, as and a string with_index MUST be authored field names. Omitting with_index emits no index field; its only explicit forms are true or a field-name string. false and null MUST fail during check. The source array field remains in the output. Without outer: true, the element contract retains exactly the array's item contract: a nullable array container does not make its elements nullable. outer accepts only booleans when present.

pivot aggregate: first is order-sensitive and requires a previously proven stable input order. Pivot values are REQUIRED, NFC-unique output field names. Dynamic data-derived output columns are not part of ActQL 0.1. Null pivot values do not match a declared string value; the string "null" is ordinary text. A generated column that collides with an index field, another generated field after NFC normalization, or the reserved namespace fails during check. Pivot aggregates ignore null input values. count returns the non-null count; sum, avg, min, max, and first return null for an empty non-null bucket, after which an authored fill is applied. Binary64 sum/avg use the same captured numeric boundary as group; exact aggregates keep their own laws. Only first observes the already-proven stable input order.

Check MUST accept pivot.index: [] and pivot.values: [] while retaining all input-contract, name, type and budget checks. Empty index means one global group, including empty input; empty values emits only index fields, once in first-occurrence order. Both empty emits one empty object. Repeated index references are retained without adding output columns or uniqueness evidence. The operation and authored value order remain identity-relevant; empty axes do not authorize operation deletion or CID equivalence with another operation.

The pivot column MUST have string or nullable string type, without implicit conversion. A null or undeclared string contributes to no generated bucket but still establishes its index group. Generated columns follow canonical UTF-16 string order, independently of authored values order; index fields precede them. Empty buckets produce zero for count and null for the other five functions, then apply fill only to null, never to count's zero.

Pivot fill MUST use the whole-value CellValue alternatives and satisfy the aggregate result contract without implicit coercion or deep merge. Bare unreserved wire values and {literal: WireValue} are literals, with the latter's payload opaque. Only an exact singleton {$param: name} is a Parameter hole; malformed reserved roots fail, and nested holes are not traversed. Recursive object/array Parameters are admitted at this whole-value position. Bound Parameter values receive the same value validation before execution. Decimal literal fills use the exact canonical fixed-scale wire string and are validated in the aggregate's precision/scale context. A compatible non-null fill makes an otherwise nullable result non-null; nullable fills do not. Fill is validated even for count and empty generated-column lists. Reference values still require their own evidence: a raw JSON object is not reference proof. Literal NULL requires only a nullable result and constructs no reference value.

For unnest, optional outer: true retains a parent with an empty or null array as exactly one row whose element and exposed index are null. Omitted or explicit outer: false normalizes to false and emits zero rows in those cases. Nonempty arrays retain ordinary element multiplicity, including null elements; their indices are non-null. Outer output therefore has nullable element and index contracts. A missing or non-array value is a runtime type failure. as, with_index, and existing fields MUST NOT collide. The internal row identity is source primary identity plus zero-based element index. It remains provable when the source identity is known during the operation. Because the index is otherwise not an author-visible field, ordinary non-outer unnest retains a candidate key only when with_index is emitted and retained alongside the source key. This rule does not infer a non-null candidate key from the nullable outer index.

The synthetic outer row has an internal missing-element identity distinct from every nonnegative element index. Exposed nullable index is not a non-null primary key. Outer output has conservative per-parent bound max(1, array_max_items), with the normal nested byte and output-row limits. An independently proven at-most-one expansion per parent preserves the parent key. Otherwise outer unnest retains internal occurrence/order evidence only; later non-null refinement and uniqueness assertions may establish new keys.

appendCopy Anchor Link

- append: {with: archived_rows}

append requires two available relations and has no author-selectable schema mode. Both inputs MUST have complete schemas with the same field names and compatible recursive contracts under Closed value contracts. Field order may differ; the compiler deterministically aligns the right relation by name before lowering to REL.unionAll. Missing or extra fields and incompatible types MUST fail. The common contract is JoinNullability (Closed value contracts); no implicit base-type coercion occurs.

Field-set comparison MUST include typed qualification: an unqualified id is not left.id or right.id. Compatible qualified schemas MAY be appended without flattening, and their qualification is preserved. Two empty schemas are compatible; appending their zero-column rows still adds their multiplicities. The closed body is {with: InputOrStepName}. Its left operand is the current relation selected by the normal step from rule; there is no append.left selector. Both operands may name the same available relation, in which case both occurrences are retained, without deduplication or no-op elimination.

Contextual null typing follows Closed value contracts. The compiler MUST NOT add a missing field; the author writes the explicit null-producing derive when a branch lacks it.

Append does not deduplicate; authors add distinct explicitly when required. It is not an identity assertion. When both inputs retain the same local candidate key and a retained field has statically known, disjoint literal domains, the compiler proves the composite candidate key consisting of that discriminator followed by the local key. For example, local key [source_id] plus source = crm on one branch and source = support on the other proves [source, source_id]. Without such a proof, append does not invent a global identity and infer reports ACTQL_E_APPEND_IDENTITY_UNPROVEN when one is required.

Append order is every left row followed by every right row. Completeness is complete only when both inputs are complete; source provenance remains evidence even when not projected.

Complete-row distinct compares canonical AoA value CIDs. Object key order is therefore irrelevant, array order is relevant, strings/timestamps use their canonical spellings, and null differs from a missing field (the latter is normally excluded by a complete typed schema).

assert_rowsCopy Anchor Link

- assert_rows:
    where: {not_null: {field: customer_id}}
- assert_rows:
    unique_by: [account_id, external_id]

Exactly one of where and unique_by is present. where requires strict true on every row; false and three-valued unknown fail. unique_by is a non-empty, duplicate-free list of visible fields and rejects null or missing components and duplicate canonical tuples. Both variants preserve row bytes, shape, order, and identity on success. The unique_by variant additionally proves non-null uniqueness for the declared tuple. The physical assertion precedes every consumer of that proof. Any violation fails before publishing the assertion output. Unconsumed assertion branches fail planning rather than silently disappearing. No on_failure, skip, warning, catch, or custom-message form is admitted.

Fields in assert_rows.unique_by MUST belong to the scalar or reference domains admitted by KeyComparable (Closed value contracts), including ResourceRef and ContentRef. Object, array, json and vector fields are not admitted. Nullable field contracts MUST be accepted during type checking; the physical assertion rejects null or missing component values. Type checking alone neither narrows those contracts nor establishes a non-null uniqueness proof.

Implementations MUST execute an atomic row assertion before any consumer of its candidate-key proof and preserve the successful input relation unchanged. where lowers to REL.assert_all; unique_by lowers to REL.assert_unique.

nestCopy Anchor Link

nest is a pure Relation operation. It attaches an ordered child-object array to each parent row. Example fragment:

- from: customers
  nest:
    with: orders
    on: [{left: customer_id, right: customer_id}]
    into: orders
    fields: [order_id, amount, created_at]
    order_by: [{created_at: desc}, {order_id: asc}]
  as: customer_tree

The closed body contains required with, on, into, fields, and optional order_by, max_items. with follows dataflow scope; on is a nonempty list of explicit equality-key pairs checked with KeyComparable. fields reuses select projection/rename syntax; calculations belong in preceding derive. into must be a fresh parent field. No implicit relationship lookup, recursive query, overwrite mode, or error handler is added. Both operands are Relations from the checked graph; keyed-only acquisition must be explicit upstream work.

Parent and child schemas may carry qualified fields. fields MUST use only field strings or singleton {output_name: input_field} maps, with distinct flat authored output names. A qualified child field requires an explicit flat alias; the legacy {from: ..., to: ...} object is not authored projection syntax. Parent fields retain their qualification. Repeated on pairs MUST retain their authored sequence and do not multiply matching child rows or prove uniqueness. This does not alter the canonical lowering's first-occurrence deduplication of right correlation fields for the internal group key.

Values, types, and orderCopy Anchor Link

Output preserves every parent row, its fields, order, and candidate keys. Each parent receives all matching children; null correlation components never match. Duplicate parent correlation keys remain separate rows. Legal child multiplicity is preserved; duplicate identities still violate input contracts. Zero matches produce []; an existing all-null child produces an object with null fields, not an empty array. Acquisition failure never produces [].

The new field is a non-null array of non-null closed objects. Selected field contracts, including nullability, are preserved even for empty inputs. Required field/type evidence is static. Constructibility follows Object and array construction: nesting does not permit hidden references or infer safe structure from opaque JSON. Reference correlation/tie-break keys need not appear in the child payload.

Before child projection, resolve order using Named Results and Effect declarations's precedence: explicit order, existing total witness, canonical candidate key, eligible full projected row, otherwise rejection. Authored order requires AuthorOrderable; canonical completion uses CanonicalOrderable and Deterministic completion's key selection. Internal reference order remains in Plan/evidence, not authored source. Array order is observable and identity-bearing. Projection does not discard ordering evidence. With explicit order_by, ties require an eligible candidate key or an existing total witness preserved by stable sorting; otherwise checking fails. Full-projection fallback applies only when order_by is omitted. Its comparison priority MUST follow the declared projection sequence, not object property enumeration or canonical object-key serialization.

Lowering and limitsCopy Anchor Link

The canonical Program retains a nest node. Its value-level expansion is:

child semijoin against original parents (null keys never match)
→ effective child order → closed child objects
→ array_agg by correlation key → many-to-one left join to original parents
→ typed empty array for missing groups only → parent fields plus into

The canonical node sequence is fixed below; equivalent physical rewrites do not replace it. Generated IDs follow the ordinary AoA operation-base allocator in insertion order; only the final projection may use the authored as. Reference key aliases are __actql_nest_ref_i, where i is the field's index in the lexically sorted complete input schema. Derive aliases on parent first, then child, only if that side contains reference fields; their values are the reference identity components defined in Opaque reference values. All correlation and completed order terms use these aliases. Original equality-pair order is retained.

The child schema projection uses canonical schema-key order; this is separate from the authored payload projection sequence. Item-limit bindings target each group node's params.aggs.<internal-field>.max_items. Byte bindings target the child-array group and final projection as specified below. Empty-array evidence uses the fixed upper bound 1, not a guessed element type or a Host replacement.

Generated aggregation consumes verified effective order; it does not relax authored array_agg rules. Required upstream failures cannot be optimized away. Unmatched child groups do not incur nest-specific per-array guards. Independent collections aggregate separately, avoiding sibling Cartesian products. Deeper nesting uses finite bottom-up dataflow steps, not recursive acquisition.

max_items, when supplied, is a positive-safe-integer guard or an admitted parameter bound before planning. It caps each emitted child array, never truncates it; use preceding top_k_by for selection. With parent bound P and per-parent bound M, total nested elements are bounded by P×M. A child-total bound can tighten this only when parent correlation keys themselves are proven unique. Other parent primary keys do not prove that fact. Sibling bytes add; deep values compose recursive byte/depth bounds, checked for overflow. Resolved ceilings and enforcement boundaries follow Author guards, resolved limits, and Plan facts; violations fail publication atomically. Statistics and shared physical storage do not reduce logical expansion bounds.

Count bounds derived from the attachment byte ceiling MUST remain conditional on successful enforcement at that output, not evidence authorizing an upstream read. For ceiling B, each preserved parent contributes at least [] (two bytes), and every emitted child element is a non-null object contributing at least {} (two bytes). Thus floor(B/2) separately bounds successful parent occurrences and total child elements. These are alternative bounds from the same byte scope, not independent byte charges to add together.

When combining these byte-derived bounds with P×M, the expansion calculation MUST compute the mathematical minimum exactly without wrapping or rounding an intermediate product. A product larger than an already applicable finite bound need not be materialized and is not a reason by itself to reject the operation; no saturated product is emitted as a multiplication proof. This is a nest expansion-bound calculation, not a change to other registered arithmetic laws. Using a total child-row bound as a total-element bound still requires the parent correlation-key uniqueness specified above; unrelated parent keys do not suffice.

The Host capacity contract supplies max_nested_value_bytes and max_nested_value_depth. Depth counts array/object containers in the child payload and is checked from its recursive type before execution. Byte usage is the sum of UTF-8 AoA canonical JSON encodings of the emitted array values, including each repeated parent copy. The Plan binds byte ceilings both after child aggregation and after parent attachment as aoa_output limit targets (step_id, canonical sorted fields, measure: bytes). Attachment measures all retained top-level object/array fields together, so sibling collections share the ceiling; nested containers are counted within their enclosing value. Core admission checks these outputs before any consumer, even if a later step would discard them. This envelope validates values; it performs no construction or acquisition.

Policy and completeness propagate through payload, membership, correlation, ordering, and count dependencies. Partial child observations do not become a complete parent history. [] proves absence only in the supplied Relation. Results remain Relations; delivery only serializes their materialized values.

The typed empty constant lowers to REL.where(false) on the child input and global REL.groupBy([], array_agg(object(...))). Attach this singleton and use case only for missing groups. Host JSON postprocessing is forbidden; no untyped empty author constructor is introduced. Hand expansion need not have the same Program Definition CID as a nest Program.

Finite relation construction: valuesCopy Anchor Link

values: {schema, rows} is an input-free generator; schema is a nonempty closed author field-contract map and rows is a finite list of complete objects with exactly those fields. An empty list has the declared schema. Each cell is a CellValue as defined below and in Structural grammar; nested literal data is opaque to binding resolution. Decimal cells use fixed-scale wire strings decoded under the declared type. No row expressions, provider access, implicit casts, or opaque-reference fabrication occur here. Constructor admissibility follows Object and array construction. Rows retain list order and multiplicity. An internal occurrence ordinal proves order, not uniqueness of projected field values. Generated Relations have local definition provenance, not external-observation completeness evidence.

At a cell root, an exact singleton {$param: name} is a parameter hole and an exact singleton {literal: WireValue} quotes literal data. A malformed parameter name in the singleton hole fails; schema compatibility or parameter existence never chooses its interpretation. Every other wire value is literal. The quoted payload is opaque, including nested parameter or literal shapes. For example {literal: {$param: business_value}} stores the business object; {literal: {literal: 1}} stores the object {literal: 1}. Both plain 1 and {literal: 1} normalize to the same canonical cell {literal: 1}. Canonical cells are exclusively {literal: WireValue} or {$param: name}; the printer quotes every literal whose root collides with either reserved singleton shape. This cell grammar admits no expression evaluation and changes no value-domain or constructor eligibility rule.

Checking MUST validate the complete schema, bindings and every literal row; resolved row, byte and recursive-value limits apply before publication. A values, time_series, calendar_series, or mean_graphs generator requires as, does not consume the current Carrier, and rejects a step-level from. inputs: {} is legal when all dataflow roots are generators; top-level from is then absent. Current-input selection follows Pipeline names and references.

For values, recursive-value byte usage MUST equal the sum of canonical typed-wire UTF-8 encodings of all cells whose declared root type is array, object or vector, across all row occurrences. Nullable cells contribute the encoding of null when null. Siblings and repeated rows contribute separately; containers inside a selected cell are counted only within that cell's encoding. Row-object keys, row wrappers, the outer rows array and scalar-typed cells are excluded from this scope. The selected Host max_nested_value_bytes applies to this sum, separately from the complete /rows wire limit. No selected cells means zero byte usage.

The selected Host max_nested_value_depth MUST apply to declared cell type depth: scalar types have depth zero, vector has depth one, array has one plus its item depth, and object has one plus its maximum field depth (zero for no fields). Use the maximum across declared fields, without adding row or rows wrappers. Check this type depth even for empty rows, empty arrays and nullable values; those values do not remove the declared resource requirement. These scopes are specific to values, not a redefinition of nest or Artifact limits. Binding and typed-value admission precede measurement. Limit breaches fail before any consumer receives the Relation; no row or cell may be truncated.

Row set operations: except and intersectCopy Anchor Link

Both bodies are {with, duplicates}, where with names a Relation and duplicates is required distinct|all. Fields are matched by exact name, never position; the field sets and recursive value domains agree, with nullability and extents joined under the common type rules. No implicit cast or field inference is performed. Equality compares the complete typed row: NULL equals NULL here, references use semantic reference identity, arrays are ordered, objects compare exact field sets recursively, and opaque JSON compares canonical JSON values. Decimal equality uses the common decimal equality law, not wire spelling or a different precision-tag hash. Hashing is an implementation of this equivalence, not an alternative definition.

For an equivalence class with left multiplicity m and right multiplicity n, except all MUST emit max(m-n,0) left occurrences; intersect all emits min(m,n). The ALL variants retain the earliest required number of left occurrences. distinct emits the first left occurrence exactly when m>0 and respectively n=0 or n>0. Surviving occurrences retain left input order. Absence here is absence from the right captured Relation, not proof of absence outside its observation scope. Output bounds never exceed the left bound; comparison, hash-table and byte resources remain separately limited.

cross_joinCopy Anchor Link

The closed body is {with, select?, right_rows?, max_output_rows?}. right_rows, when present, is exactly one: a checked assertion of one right row, not a request to select one row. Both operands are Relations. Provenance, projection and collisions follow ordinary join rules. Without the assertion, an empty operand yields no rows; with it, zero or multiple right rows fail. Output enumerates left occurrences then right occurrences in their logical input order. The product of retained operand identities proves output identity.

The compiler MUST derive the product bound with checked arithmetic and combine it with Host ceilings and any positive author guard. A singleton assertion is discharged statically or enforced before any consumer uses it; a failed assertion publishes no rows. No input is silently truncated or null-extended. This operator introduces no acquisition or permission. In particular, a singleton aggregate can be broadcast without a fabricated equality field.

Row-preserving analytics: analyticCopy Anchor Link

Check MUST retain repeated partition_by references and their authored order while validating every key. Repetition adds no rows, output fields or key evidence. An empty partition list denotes one global partition of existing rows; empty input remains empty. Names in functions are checked against the input snapshot, not earlier sibling outputs. Neither identity rewriting nor a new publication order follows from these acceptance rules.

Navigation offset and numeric preceding/following boundaries MUST be a literal or whole Parameter reference, not an arbitrary expression. Offset is a nonnegative safe integer; preceding/following distance is positive. Invalid static literals and structurally reversed boundary classes fail during checking; unbound values and unresolved within-class boundary comparisons are validated before execution. A Parameter cannot select frame kind, boundary direction or function name. Selecting existing structured or reference values with navigation or first_value/last_value does not construct new reference evidence; their argument contracts are retained with nullable root output.

The body contains required partition_by, order_by, functions, and optional frame. partition_by is a possibly empty list of equality-key fields; order_by is a nonempty authored OrderKey list. functions is a nonempty map of fresh output names to closed calls. Partition NULLs group together. Results retain original input-row order, fields, multiplicity and candidate keys; window ordering determines calculations, not a new publication order. Ranking functions return non-null safe-integer numbers; navigation/value functions retain their argument domain and bounds with nullable output. Frame aggregates have their ordinary result contracts and empty-input behavior.

Calls are {fn: row_number|rank|dense_rank}, {fn: lag|lead, expr, offset?}, {fn: first_value|last_value, expr}, or a group aggregate call without an aggregate-local order_by. Offsets are nonnegative safe integers, default 1; out-of-partition navigation yields typed NULL and does not fabricate a row. first_value and last_value respect NULL elements. Rank/navigation calls reject filter and distinct. Aggregate calls retain their own filter/null/ distinct laws. Result types follow the function, including nullable navigation. First_value and last_value are frame functions, not navigation functions; they require frame and reject filter/distinct. Only lag/lead are navigation calls. Aggregate frame functions retain their explicitly admitted modifiers.

frame is {start, end}. A boundary is unbounded_preceding, current_row, unbounded_following, {preceding: n}, or {following: n}, with n a positive safe integer. It is a ROWS frame; RANGE, GROUPS and exclusion clauses are not admitted. Start cannot be unbounded_following, end cannot be unbounded_preceding, and start cannot follow end in logical offset order. Intersect the logical inclusive interval with the partition; do not clamp an out-of-partition start to an existing row. Empty frames use aggregate empty-set laws and yield NULL for first/last value. Frame is required for frame functions, absent for calls consisting solely of ranking/navigation. It does not affect lag, lead or ranking. A bounded partition may use unbounded frame boundaries.

Checking MUST separate authored peer order from physical position completion. rank is one plus the number of preceding rows with different authored order values; dense_rank is one plus the preceding distinct peer-group count. row_number starts at 1 in completed order. Missing candidate-key fields or a retained total witness complete position order without splitting peer groups. Reference keys are eligible for internal completion, not authored value order. Without an adequate position witness, position-sensitive functions fail check. Position completion is journaled under Deterministic completion, recording the authored peer order, the added identity terms or reused total witness, and the supporting evidence. It does not change peer groups or publication order.

Each call's filter and argument MUST be evaluated once per demanded source row in its partition, then reused by every output frame that consumes it. Filter false/null excludes the argument from demand. A navigation or first/last call demands only referenced rows. A row used by several calls has separate call frames; no callback or hidden source retrieval is permitted. Representative value failure order is canonical partition-key order, source position, canonical output name, then child-expression order, independent of parallel completion. Binary64 frame sum/avg are numeric observation slots per output frame under Numeric aggregate observations; exact aggregates keep their own laws. Frame position selects members and binds the observation demand, not a bit-fixed floating-point summation order. Bounds include input and output bytes, partition storage, and total frame memberships; optimized prefix sums are legal only when they preserve specified values and failures.

Ordered and statistical aggregatesCopy Anchor Link

The aggregate vocabulary additionally contains string_agg, first, last, percentile_disc, percentile_cont, var_pop, var_samp, stddev_pop, and stddev_samp. They use existing {fn, expr, filter?} calls. First/last and string_agg require an aggregate-local total order_by outside analytic frames; different aggregates may use different orders. first and last exclude NULL like other group aggregates; this differs intentionally from analytic first_value/last_value. string_agg accepts strings, requires a literal string delimiter, ignores NULL, returns NULL on no values, and admits distinct. It has optional positive max_bytes, enforced on UTF-8 output without truncation. Ordered aggregates evaluate their own filter before arguments and sorting. For string_agg, the logical sequence is filter, demanded argument evaluation, NULL exclusion, stable ordering by the aggregate's total order_by, distinct by canonical value CID retaining the first occurrence in that order, then joining with the delimiter. In analytic frames, the completed frame position order supplies that order. Argument failures follow the shared aggregate evaluation law; sorting or deduplication cannot remove a demanded argument failure.

Percentile calls require fraction in [0,1], a bound finite number; they reject distinct and explicit order_by. Values sort ascending in their value domain. percentile_disc accepts AuthorOrderable and returns item max(1,ceil(p*n)) in 1-based order. percentile_cont accepts number and for n>0 computes h=(n-1)p, i=floor(h), f=h-i, then x[i] if f=0, otherwise x[i]+f(x[i+1]-x[i]), with binary64 rounding after each arithmetic operation. No rows returns typed NULL; no implicit decimal-to-number conversion occurs.

Variance and standard deviation MUST use number inputs, NULL exclusion, and canonical value-CID input order. First compute the binary64 left-fold sum and mean; then left-fold (x-mean)*(x-mean), rounding after each subtraction, multiplication and addition. Divide by n for population and n-1 for sample; insufficient n (0 or <2 respectively) returns NULL. Standard deviation uses correctly rounded binary64 square root. Non-finite intermediates fail, even if a different algebraic formula could avoid overflow. These definitions and percentile interpolation admit no reassociation or approximate sketch silently. Statistical/first/last calls reject distinct; all input, sort and output bounds remain enforced. Physical memory/CPU savings need not simulate discarded allocations, but do not erase logical membership or output limits.

The mean inside variance/stddev is part of that operation's own strict fold, not an observed avg slot and not required to equal a separately captured avg. These statistical operations retain the stated deterministic numerical law; the sum/avg observation boundary does not implicitly relax them.

Event operations (TEA)Copy Anchor Link

actql-tea/0.1 is the authoring-complete deterministic event-time module. A module claim covers fixed, sliding, and session assignment; explicit late policy; stable event deduplication; bounded as-of correlation; bounded event sequence matching; and relation projection. The module also covers finite time_series and interval_join; calendar operations require the separate calendar claim. Fixed/sliding support alone is partial TEA support and MUST NOT be reported as module conformance.

Processing-time substitution, unbounded state, implicit reordering, implicit gap fill, and interval relations beyond interval_join are outside 0.1. An implementation MAY support them only under a separately versioned profile.

Canonical fixed and sliding windowsCopy Anchor Link

- row_window:
    kind: fixed
    time: occurred_at
    size: 1h

Relation input uses row_window; event-stream input uses window_events. There is no generic window spelling in ActQL 0.1. This keeps carrier choice explicit without adding an alias or another authoring layer. kind is REQUIRED and MUST be fixed or sliding. size is REQUIRED and accepts a positive integer millisecond value or a duration string using ms, s, m, h, or d. Sliding windows additionally require step.

Fixed windows MUST admit an explicit step, validate it under the same positive integer millisecond constraints as a sliding step, and retain its authored and identity representation. It does not participate in boundary, membership or cardinality-bound calculations, which continue to use size and offset. Omission does not insert a step. An explicit Parameter step retains its binding and value-validation obligations even though it does not affect these calculations.

Both row_window and window_events MUST admit offset. It is a signed safe-integer millisecond value, a positive duration token under the common lexical rule, or a whole Parameter reference to a compatible number or duration declaration. Numeric values and bound numeric Parameters must be safe integers. Omission inserts numeric zero; explicit zero is valid. Fixed-window starts are offset + n * size, and sliding-window starts are offset + n * step, for integer n. A window contains t exactly when start <= t < start + size; emitted memberships are in ascending start order. Checked arithmetic must not saturate or wrap. offset is not reduced modulo size or step for canonical identity. In particular, a supplied sliding offset must not be ignored by a lowerer or evaluator. Membership and the grid are computed at the exact value of the admitted time, including fractional numbers and large timestamps. An intermediate grid value need not fit binary64. A required output boundary that cannot be represented exactly as binary64 fails with the window arithmetic error; rounding it to change the width or membership is not permitted.

Window output MUST enumerate input occurrences in their existing logical order, then each occurrence's memberships in ascending window-start order, for both Relation and Events inputs. This is not a global sort by window start. Fixed windows retain one occurrence; sliding windows retain each matching membership. The operation does not establish input order when no such evidence exists. Removing boundary columns can lose window-role evidence without changing the retained occurrence sequence. Membership expansion alone does not prove ID uniqueness, completeness or successful discharge of resource obligations.

row_window preserves relation fields and adds window_start and window_end. It lowers directly:

relation
-> REL.window.fixed or REL.window.sliding
-> relation

window_events preserves the event-stream carrier, adds window_start_ms and window_end_ms, and lowers to TEA.window.fixed_label or TEA.window.sliding_assign. Event windows use closed-open intervals; the boundary is a language invariant recorded in the Plan. Fixed windows preserve the event-count upper bound. Sliding windows derive an event-membership upper bound of input_events * ceil(size / step) using checked multiplication; overflow fails planning rather than saturating. session has a distinct shape in session and MUST NOT be inferred from either operation.

Shared event clock domainCopy Anchor Link

Clock fields consumed by to_events, sequence, row_window, watermark_rows, asof_join and interval_join MUST use one non-null domain: a typed UTC timestamp or a finite exact safe-integer number of UTC milliseconds. This applies to each side of a temporal join and to both Relation and Events inputs. Timestamp conversion is internal, with the source column retained in its original type and value. No rounding, string conversion or host-clock sampling supplies a clock; bounds and timestamp range checks remain mandatory. A watermark threshold is a scalar value with its separately declared numeric constraints, not an alternative row clock source.

Event-stream-preserving operations and explicit bridgesCopy Anchor Link

When a later TEA operation must consume the carrier, authors use the explicit event-stream form:

- to_events: {id: event_id, time: occurred_at}
  as: events
- window_events: {kind: sliding, size: 1h, step: 15m}
- watermark_events: {watermark_ms: 0, policy: mark}
- events: true

to_events and events lower to BRIDGE.rows.to_events and BRIDGE.events.to_rows. window_events uses the same fixed closed-open boundary and lowers to TEA.window.fixed_label or TEA.window.sliding_assign and preserves events. watermark_events requires a finite watermark_ms and an explicit drop or mark policy, lowers to TEA.watermark.label, and also preserves events.

The to_events body MUST contain exactly id and time field references on its Relation input, with the time source having a non-null UTC timestamp or exact integer-millisecond number contract. Other field types may remain unknown, and the retained payload field set may be open. A timestamp source is converted to the internal numeric UTC-millisecond clock without replacing its authored payload value or inserting a public event_time_ms alias. The Event carrier retains the source role and its clock encoding separately; clock-consuming operations validate values and perform the required conversion before temporal arithmetic. An explicitly authored clock field on an existing Event carrier uses the same clock domain, including a retained timestamp payload field. The authored payload column is preserved.

watermark_events MUST have a closed body containing watermark_ms as a finite numeric literal or whole declared numeric ParamRef and an explicit policy, with the bound value validated against the same finite-number domain. Both policies add fresh non-null fields watermark_ms: number, late: boolean and watermark_decision: string to every retained event. Existing fields with any of these names are collisions; unknown field-set completeness does not establish their absence. The event is late exactly when its numeric millisecond time is less than the threshold; equality is not late. mark retains every event, with decision mark for late events and keep otherwise. drop removes late events and labels all survivors keep. Both preserve retained events' semantic identity, time, payload and relative order; they do not establish uniqueness or a new ordering proof. The threshold is a finite numeric literal or whole declared Parameter, and may be negative or fractional. No row expression, implicit NOW(), or clock recomputation on resume is admitted; the Run retains the original admitted Parameter value.

to_events.id MUST have a complete, non-null KeyComparable value contract. The semantic identity retains that contract and its values; it is not limited to strings. Type comparability does not prove uniqueness: duplicate event identities MUST be rejected separately before identity-dependent operations. Session and sequence order equal-time events by the existing type-specific scalar order, or by the existing internal identity order for reference values. This does not admit references as authored OrderKey fields. Lowering MUST preserve typed equality and ordering, and MUST reject unsupported identity domains before claiming executable support rather than implicitly converting identities to strings or replacing them with CIDs.

Every relation-form TEA time field MUST have complete typed evidence as either a non-null timestamp or a non-null number containing UTC epoch milliseconds. For a typed timestamp, the compiler inserts a reserved, collision-checked REL.derive using date_diff(authored_time, 1970-01-01T00:00:00.000Z, ms) before the event bridge, records the fixed UTC epoch-millisecond carrier law in the checked Plan, and preserves the authored timestamp in public relation results. A numeric field passes through unchanged. Unknown, nullable, date-only, string, or other time evidence is rejected; an explicit not-null filter may refine nullable evidence, but the compiler MUST NOT guess a parse, timezone, or null policy.

sessionCopy Anchor Link

- session:
    id: event_id
    time: occurred_at
    by: [customer_id]
    gap: 30m

by and positive gap are REQUIRED. Sessions use the closed-open boundary recorded in the Plan. Relation input also requires id and time; event-stream input already carries those roles. Within each key, events are ordered by event time ascending then event identity ascending. An event belongs to the preceding session only when its time is strictly less than the preceding event time plus gap; an event exactly on the gap boundary begins a new session. The result preserves the input Carrier and includes the key fields, event fields, session_start_ms, session_end_ms, and a stable session_id derived from the key tuple, session start, and first event identity. session_end_ms is the last event time plus gap and is exclusive. Events retain their original event identity and time; session labels do not change event order or identity. Relation results retain the specified event ordering. Later sequence/dedupe operations use session_id explicitly in their partition keys to prevent crossing sessions; Carrier preservation alone does not provide that guarantee.

The closed session body MUST contain by and gap, plus exactly id and time on Relation input; Events input uses its intrinsic roles and does not admit role overrides. by contains known KeyComparable fields, preserves repeated references and admits an empty global partition. Empty input remains empty. gap uses the same positive safe-integer millisecond, positive fixed duration token or whole non-null number/duration Parameter forms as window size; a Parameter retains validation obligations even if its default is known. The three generated session fields are fresh and non-null: start/end have number type and session_id has string type. Unrelated payload contracts may remain unknown, but generated-field absence requires field-set evidence.

time_seriesCopy Anchor Link

The generator body is {start, end, step}: start/end are bound non-null UTC timestamp values, and step is a positive fixed duration. Start<=end is required. It emits {time: timestamp} at start+i*step while time<end, in ascending time order; start=end emits an empty typed Relation. Time is its candidate key. No end sentinel or extrapolated row is emitted. Timestamp domain or safe integer overflow fails before publication. Its row bound is the checked ceiling of duration/step. No timezone or calendar arithmetic is implicit.

The closed time_series body MUST contain exactly start, end and step. Each endpoint is a canonical UTC millisecond timestamp string or a whole Parameter reference with a non-null timestamp declaration. Step uses the shared positive safe-integer millisecond literal, fixed duration token or whole non-null number/duration Parameter forms. Literal endpoint validity and reversed ranges are checked statically; Parameter defaults are not substituted during declaration checking, and bound ranges and positive steps are validated before generation.

A generated time grid MUST NOT attest observed absence. Joining it to counts and replacing missing counts with zero is explicit computation; describing a zero as confirmed absence additionally requires complete source coverage of that interval. Neither an empty grid nor a synthetic row replaces failed acquisition. Grid, partition cross-product and final output have separate resolved bounds.

interval_joinCopy Anchor Link

Full is deliberately not admitted here: 0.1 temporal correlation covers left-driven matching and absence within captured scope, not symmetric temporal reconciliation. A full variant is possible, but would additionally need a closed unmatched-right ordering, identity transfer and coverage contract. This restriction is not a claim that full temporal joins are inherently unsafe.

The closed body is {with, kind, mode, on, left, right, select?, max_output_rows?}. kind is inner|left|semi|anti; mode is point_in_interval|overlap; on is a possibly empty equality-key-pair list. left is {time} for point mode or {start,end} for overlap; right is {start,end}. These names refer to fields of two Relations, not dataflow sources. Each temporal field has the same non-null timestamp domain or all use safe-integer UTC milliseconds; explicit casts precede mixed-domain joins. Every interval requires start<end, even when its equality key matches no row. Null equality keys do not match. Each on item MUST be exactly {left: Field, right: Field}; the list preserves authored pair order and repeated pairs without multiplying matches. Empty on applies temporal matching across the two captured Relations without equality partitioning. Ordinary join's single-name or standalone-pair shorthand is not part of this body's list grammar. Step from selects the left Relation; body left specifies its temporal fields and does not replace that selection.

Point mode matches r.start<=l.time<r.end. Overlap matches l.start<r.end and r.start<l.end. Endpoints are closed-open, so touching intervals do not overlap. All matching pairs are retained; kind, null extension, projection, provenance and left-major/right-minor order follow ordinary join. Semi/anti emit a left occurrence at most once. Input endpoint validation is atomic before matching. Candidate-key transfer follows retained pair identity.

Interval-join candidate-key transfer MUST use the following closed rules, subject to retaining a complete mapped key in the output. Semi and anti retain left keys only. Inner and left retain every available pair of left and right keys; left null-extends the right components without promoting them to non-null. Inner and left additionally retain a left key when the equality correlation fields cover an entire right candidate key; inner additionally retains a right key when they cover an entire left candidate key. Temporal overlap alone does not establish this at-most-one condition. These independent-side conclusions do not suppress retained pair witnesses for interval joins. Projection must retain at least one exact alias per required key component; a missing component invalidates that witness. Input-key and endpoint validation remain prerequisites. Pair uniqueness with nullable components does not establish eligibility for a non-null primary key or canonical-order completion. Full is not an admitted interval-join kind and has no transfer rule here.

An interval join MUST resolve output and search-work ceilings separately, using the checked operand product bound where no stronger proof exists. Output overflow fails, never truncates. Membership or nonmembership refers to the captured right Relation; an external absence assertion requires sufficient per-key and interval coverage. This operation is local computation, not a complete external-join acquisition path or permission to run arbitrary theta joins.

The search ceiling MUST measure ordered left/right row-occurrence pair visits, including visits that fail the equality or temporal predicate and repeated visits to the same pair. The product fallback applies only to a realization that examines each pair at most once; semi/anti output bounds and output guards do not reduce it. Missing or overflowing operand products leave this fallback unavailable, rather than prohibiting another admitted finite bound. A known zero operand bound yields zero search visits, not exemption from whole-input validation. Endpoint admission, index construction, ordering and memory retain their separate physical budgets. This fixes the search quantity; it does not assert that a particular backend satisfies the fallback's conditions.

../../spec/contracts/actql-interval-search.json# sha256:4a41fc2f6967ceecd95fcd2ae1f5accc722af3090a6db6a1405d8091a8bae3c3

A persistent product-fallback limit MUST use the closed actql-interval-search-limit/0.1 body below. Its CID hashes the whole canonical body without a self CID; its subject is the owning interval operation's unit:<Unit Definition CID>#/steps/<authored ordinal>. The separate left/right arrays contain sorted unique applicable Program row-witness CIDs, after producer subjects and all dependent identities have been rebuilt. Admission checks those proofs, their exact operand correspondence and effective binding, and recomputes the product of the two minima; one proved zero permits an empty opposite set. Equal numeric bounds do not substitute for these dependencies. search_contract_cid identifies the pinned search contract, not an arbitrary same-shape schema. Internal handles, observed counts and backend proposals do not enter this preimage. Shape and digest alone establish neither applicability nor execution; the single-visit condition and atomic enforcement remain required.

../../spec/contracts/actql-interval-search.json#/schemas/limit sha256:88d201eeb401828d32ed3a07172c6d406f48dae726071d01ac7de3a0ed281ded

Calendar profileCopy Anchor Link

actql-calendar/0.1 adds calendar_bucket and calendar_series; it does not change fixed-duration arithmetic or the text-time UTC functions. Calendar calculations use the proleptic Gregorian calendar in years 0001..9999. The closed shared parameters are unit: day|week|month|quarter|year, timezone, and, for week only, required week_start: monday|sunday. Timezone is UTC or an exact IANA name in the profile's pinned TZDB artifact; Host locale/timezone and ambient OS databases are irrelevant. No optional gap/fold interpretation switch is admitted. Unknown zones or out-of-domain boundaries fail.

unit, timezone, and week_start MUST be literal strings, not expressions or Parameters. week_start is required exactly for unit: week and forbidden for other units, including explicit null. Series start and end are canonical UTC timestamp literals or whole non-null timestamp Parameters; bound values retain calendar-year and interval validation obligations. Literal endpoints use years 0001..9999, reject reversed ranges, and admit equal endpoints as an empty range. Bucket time is a field reference and into an ordinary authored output name. Source-option admission alone is not recognition of a timezone: a checked Calendar operation requires membership in the selected fixed semantic artifact.

calendar_bucket: {time, unit, timezone, week_start?, into} is row-preserving. time names a non-null timestamp field; into is a fresh object field with non-null timestamp start and end. Local calendar boundaries start at midnight, day 1 for month, Jan/Apr/Jul/Oct 1 for quarter, Jan 1 for year. Week boundaries use the selected weekday. An ambiguous boundary uses its earliest UTC occurrence; a nonexistent boundary advances to the first valid instant at or after that local boundary. Coincident UTC boundaries collapse; a skipped civil day produces no zero-duration bucket. Bucket is the unique adjacent-boundary interval containing time; boundaries are closed-open.

calendar_series: {start,end,unit,timezone,week_start?} generates the distinct full {start,end} bucket intervals intersecting the nonempty UTC range [start,end), in ascending UTC start order; start=end emits none, start>end fails. It does not clip buckets to the requested range. Bucket start is the candidate key. The planner derives a conservative finite calendar-count bound from the admitted year range and input interval, then enforces actual row/byte ceilings. TZDB transition tables are checked local semantic artifacts, not implicit provider acquisition.

Calendar Plans MUST pin the TZDB version, canonical transition-table bytes and conversion-law identity in Check Environment and semantic dependencies. Missing artifacts prevent a runnable Plan; data cannot select a different zone or database during execution. DST buckets need not be 24 hours. Generated calendar rows carry no external absence evidence. Independent vectors cover leap years, quarter/year boundaries, both weekly origins, folds, gaps, skipped days, coincident boundaries and version-sensitive historical transitions.

The selected transition artifact MUST be exact canonical JSON with closed shape {version: "actql-tzdb-table/0.1", tzdb_version, conversion_law: "actql-calendar-boundaries/0.1", coverage_start_ms: -62135596800000, coverage_end_ms: 253402300800000, zones}. Coverage is UTC year 0001 inclusive through year 10000 exclusive; lookup outside it fails without extrapolation. tzdb_version is the nonempty external release identifier selected by Check Environment, not an ActQL-owned version. zones maps exact nonempty names to closed {initial_offset_seconds, transitions} objects; each transition is closed {at_ms, offset_seconds}. Times are exact safe-integer UTC milliseconds, strictly increasing and interior to coverage. Offsets are signed 32-bit integer seconds excluding -2147483648. Initial offset holds at coverage start; each transition changes the offset at its instant. Repeated offsets are omitted from this offset-only representation, regardless of abbreviation or DST-label changes. The map includes UTC with zero initial offset and no transitions. Other selected names, including aliases, retain exact spellings and complete offset tables.

Artifact admission MUST compare the original bytes' SHA-256 CID and external release identifier against the independently selected Check Environment pins, reject noncanonical bytes without repair, and validate table structure within explicit byte, node, depth, zone and cumulative transition ceilings before exposing a profile. The conversion-law domain identifies the Calendar boundary rules above, including earliest fold resolution, gap advancement and coincident boundary collapse; it is not a Host-selectable interpretation. A matching CID proves selected-byte integrity, not independent IANA authenticity. Establishing release provenance belongs to selection of the trusted semantic artifact. Synthetic tables test admission but do not establish historical TZDB or Calendar conformance. Exact-name lookup has no locale, case-folding, alias inference or ambient database fallback.

dedupe_eventsCopy Anchor Link

- dedupe_events:
    by: [event_id]
    order_by:
      - {occurred_at: asc}
      - {source_sequence: asc}

The shape matches dedupe_rows. by and a stable non-empty order_by are REQUIRED. It keeps the first event in that order and fails an unresolved top tie. It preserves an event stream and MUST fail when the authored order cannot choose one record. Arrival order MUST NOT serve as an implicit tie-break.

The closed body MUST contain only by and order_by, using the same partition and OrderKey rules as dedupe_rows: empty by selects one global partition, repeated partition references remain in authored order, and order_by is nonempty. An empty input yields no event, including for the global partition. Partition fields require known KeyComparable contracts; order fields require known AuthorOrderable contracts. Unrelated payload contracts and field-set completeness may remain unknown. The operation retains the chosen events' identity, clock encoding, payload, and window boundary values, but a repeated key does not prove uniqueness or resolve a top tie. Existing duplicate event IDs are not repaired by business-key deduplication.

asof_joinCopy Anchor Link

- asof_join:
    with: account_history
    kind: left
    by:
      - {left: account_id, right: account_id}
    left_id: event_id
    left_time: occurred_at
    right_time: valid_from
    direction: backward
    tolerance: 90d
    select:
      event_id: left.event_id
      owner_id: right.owner_id

The body MUST contain exactly with, kind, by, left_time, right_time, direction, tolerance, select, and optionally left_id and right_tie_break. by is a possibly empty array of exactly {left: Field, right: Field} pairs. Empty by correlates across the entire captured right Relation; repeated pairs retain authored order but neither multiply candidates nor prove uniqueness. Each pair has compatible KeyComparable types. select is a nonempty ordinary join alias map; repeated source fields under different output aliases are allowed. null_key is not an authored option. Explicit null is not omission for any optional member.

Both time fields MUST have complete non-null number or timestamp contracts. Number values are safe-integer UTC milliseconds; timestamp values use canonical UTC millisecond precision and are mechanically converted to that clock for matching without changing their authored values or contracts. The two fields may use different representations of this same clock. tolerance uses MillisecondValue: a positive safe-integer millisecond number, a positive fixed duration token, or a whole non-null number/duration Parameter. Parameter binding does not bypass the positive safe-integer constraint. All time values and checked distance arithmetic are validated before output is exposed, including rows with no key match. The explicit left_time selects the comparison clock on either Relation or Events input; it does not rewrite an Events carrier's intrinsic role.

Left identity MUST be complete, non-null and KeyComparable, with uniqueness validated independently of its type. Relation left_id selects a single field; when omitted, retained candidate-key evidence supplies the entire ordered key tuple, never just its first field. Without that evidence omission fails during Check. Events use their retained semantic identity; an explicit left_id, if present, names that same role rather than replacing it. Internal ascending identity order is the existing type-specific order, including internal Ref identity order; this does not make Ref fields authored order keys. No implicit stringification or hidden row CID replaces semantic identity.

kind: left|inner, direction: backward|forward|nearest, and positive tolerance are REQUIRED. Relation input additionally requires left_id unless a retained candidate key supplies it. Null join keys mean no match; this is a TEA 0.1 law rather than an author field. An unresolved time tie fails. The chosen right row must share the complete key and be within tolerance. Backward chooses the greatest right time not after the left time; forward chooses the least right time not before it; nearest chooses minimum absolute distance. Equal candidates fail unless a complete right candidate key supplies a compiler-journaled stable tie-break. Provenance and select follow ordinary join rules. left preserves unmatched left rows with null right fields; inner drops them. Results use stable ascending left (time, identity) order.

right_tie_break is an ordered list of field names in ascending order. Descending business priority requires an explicit preceding derive that produces an ascending surrogate; a compiler MUST NOT infer direction from a field name or input order.

Each authored right_tie_break field MUST be AuthorOrderable; ascending null placement is last. An empty list supplies no authored tie evidence. Repeated fields and their order are retained, without strengthening uniqueness. A valid complete right candidate key can complete either an omitted or an insufficient authored tie-break, with that completion recorded in the compiler journal. Absent such evidence, equal first-place candidates fail rather than selecting input order or a hidden identifier. Merely naming fields is not proof that their tuple is unique. A nearest tie can involve different right timestamps at equal distance, not only two rows at the same timestamp.

The output has at most one row per left occurrence and therefore inherits the checked left row-count upper bound. Search-work and allocation ceilings remain separate requirements; a small output bound does not authorize an unbounded right scan. Empty input and no-match results refer only to the captured operands, not to unobserved external coverage. None of these static contracts authorizes execution before the remaining value, identity, tie and resource obligations are discharged.

As-of search MUST select a finite ceiling independently of the output-row bound. One pair_visits unit examines an ordered captured left/right occurrence pair for correlation, direction or tolerance eligibility, including rejected pairs. A realization examining each pair at most once MAY use the exact product of applicable operand row upper bounds; re-examinations count again and require another admitted bound. This fallback applies to both kinds and all directions. A proved zero operand permits zero visits even if the other bound is unknown, but does not waive either input's mandatory validation. Supplied bounds must be validated; missing or overflowing products leave the fallback unavailable rather than imposing a language prohibition. Equality with the chosen ceiling succeeds; exceeding it fails atomically. Candidate comparison, tie resolution, sorting, indexing, bytes and retained memory require separate physical budgets. A small output or an in-tolerance candidate does not discharge these requirements.

../../spec/contracts/actql-asof-search.json# sha256:f6638f0527a537a66cb1bfee82c1d01ae9fb3756356fd6360b514c092f56d3f4

../../spec/contracts/actql-asof-search.json#/schemas/limit sha256:22b4ebc943770dde101f2f1e6cf70d2627dbc5f70eadbb7f49fc59e8f07651ec

A persistent as-of search limit MUST use the complete canonical body without a self CID, with subject unit:<Unit Definition CID>#/steps/<source ordinal>. Its separate left and right arrays MUST retain the sorted unique CIDs of all applicable reidentified Program row witnesses. Rebuild producer subjects and dependent proof/witness CIDs before taking these references. Internal claim indices, observations and output limits MUST NOT replace them. The admitted search contract CID, exact operand correspondence, effective binding and product arithmetic require semantic validation beyond the closed schema. A proved zero permits an empty opposite set; otherwise both sets are required. This identity does not attest completed single-visit enforcement or authorize execution.

sequenceCopy Anchor Link

- sequence:
    by: [customer_id]
    time: occurred_at
    id: event_id
    pattern:
      - {as: opened, where: {eq: [{field: event_type}, {literal: opened}]}}
      - {as: purchased, where: {eq: [{field: event_type}, {literal: purchased}]}}
    within: 30m
    overlap: disallow
    contiguity: subsequence

The checked canonical body MUST contain by, id, time, pattern, within, overlap and contiguity, completing omitted authored by, overlap and contiguity to [], disallow and adjacent respectively. The authored body requires id, time, pattern and within; the two limit guards remain optional. The schema admits the authored shorthand, but a checked canonical body records every completed key explicitly and remains closed. by is a possibly empty list of KeyComparable fields: empty denotes one global partition. Repeated grouping fields retain their source occurrences but do not duplicate output columns or strengthen uniqueness. Each pattern element is exactly {as: label, where: predicate}; the predicate has Boolean result type, possibly nullable, and only true matches. It sees the original input fields and Parameters, not fields captured by earlier pattern labels. Generated column names obey the ordinary output-field name rules in addition to collision checks. id is non-null and KeyComparable; on Events it names the retained semantic identity, not a replacement identity. within uses MillisecondValue, and the optional guards use PositiveIntegerValue; supplied Parameters retain binding and value-validation obligations. Omitted guards insert no fixed language default and still require resolved execution limits from current Host policy.

The event time, event identity, at least two pattern elements and positive within are REQUIRED; omitted grouping and matching modes use the fixed normalization above, with vocabulary allow|disallow and adjacent|subsequence. adjacent permits no non-matching event between pattern elements; subsequence may skip them but all selected events remain ordered and within the bound. Each pattern predicate uses the closed RelA predicate grammar. Pattern as labels MUST be non-empty and unique. Selected event indices are strictly increasing (i1 < i2 < ... < in), so one event record cannot satisfy two positions. The inclusive temporal bound is last.event_time_ms - first.event_time_ms <= within. Matching is in ascending (time,id) order. disallow chooses the lexicographically earliest complete match, emits it, and advances the per-key cursor to the event immediately after that match's final selected event; skipped events before that final event are consumed with the interval. allow emits every complete bounded match. Output is a stable relation containing the key, match start/end, and the authored label's {label}_id and {label}_time_ms for each pattern element. It does not copy arbitrary event payload fields into the match relation. No unbounded automaton or processing-time interpretation is permitted.

The match boundary fields MUST be exactly match_start_ms and match_end_ms, both non-null numbers in UTC milliseconds. Each {label}_id retains the complete non-null semantic event-identity contract, and each {label}_time_ms is a non-null numeric millisecond value. Group fields retain their contracts and appear once for each distinct authored grouping field. All generated names must be distinct from one another and the retained group fields. Collisions fail check, not overwrite or implicit renaming. Empty results retain this complete contract.

max_matches_per_key and max_output_rows are author guards as defined in Author guards, resolved limits, and Plan facts. They count matches for one key and total output matches respectively. Both limits use current Host policy and any authored guards; this specification does not define a static sequence match-count proof. A breach of either limit MUST fail the whole operation without publishing partial matches.

The authored sequence clock MUST satisfy this closed carrier contract: a Relation or Events input accepts a typed non-null UTC timestamp or exact integer UTC-millisecond field, converting timestamp values only for internal temporal arithmetic while retaining the authored column and its type; every other type is rejected rather than coerced, rounded or parsed from a string.

For overlap: disallow, cursor advancement and unique event-carrier identity prove each emitted {label}_id to be a candidate key. For overlap: allow, no individual label ID is inferred as a candidate key because an event may appear in more than one match.

Event carrier record identity is the unique to_events.id value. Duplicate record identity is invalid before session, dedupe, as-of, or sequence semantics. Business duplicate keys belong in dedupe_events.by; they are not carrier identity. Session-generated session_start_ms, session_end_ms, and session_id MUST NOT collide with source fields. The complete event schema is preserved alongside those generated fields.

Graph operations (SGA)Copy Anchor Link

actql-sga/0.1 is the authoring-complete deterministic graph-value module. A module claim covers graph construction, node/edge property matching, typed and directed bounded traversal, stable node/path projection, shortest path, connected components, degree/bounds, and pure structural graph changes. Construction plus simple reachability alone is partial SGA support.

Unbounded traversal and a general graph-pattern language are outside 0.1. The closed traverse shape below is sufficient for bounded repeated-edge and authored hop-by-hop patterns without importing Cypher or arbitrary predicates.

Master-data graph boundaryCopy Anchor Link

The SGA module does not define canonical-entity or persistent-MDM semantics. A graph node identifier is only an authored semantic identity. It is not proof of any of the following distinct concepts:

• canonical entity identity;
• source-record binding;
• entity type;
• merge or split lineage; or
• entity-resolution evidence.

An implementation MUST NOT infer those concepts from an ordinary node, edge, label, property, or vector score. It MUST reject authoring terms such as canonical_entity, bind_source_record, merge_entity, or split_entity as unsupported unless a future separately versioned MDM module is explicitly claimed.

The 0.1 SGA module is a computation carrier rather than an authority-bearing persistent master graph. ActQL 0.1 does not define persistent graph source versions, graph-delta proposals, compare-and-swap base versions, merge/split preview, approval, apply, or graph-mutation receipts. Ordinary graft_graph, union_graphs, and subtract_graphs are pure graph-value computation and MUST NOT be presented as persistent entity mutation or authorization. apply_graph_delta is pure computation over captured graph values, not persistent MDM identity change, provider mutation, approval or application to an external graph store.

MDM completeness remains a separate future profile. Property match and typed traversal/path query are part of SGA 0.1 and do not imply MDM authority.

graph: keyed Graph constructionCopy Anchor Link

actql-graph-constructor/0.1 selects the sole actql-graph-contract/0.1 representation. Unversioned constructor bodies and previous stored contracts are rejected without conversion. Historical evidence retains its original bytes and identities. The Graph profile requires explicit installed profile selection; claiming the SGA module alone does not enable it.

The closed constructor body has version, nodes and edges. Each ordered node definition has name, from, a nonempty ordered key column list and optional labels. Each edge definition additionally has source and target, each with a node definition, ordered source key columns and optional references_key naming that node's declared key columns in the same order. Names resolve through common checking. A constructor requires step as and has no implicit current operand or outer step from. Repeated producer references remain separate input occurrences; an empty definition family has zero occurrences, not an invented operand.

A label entry has a static name and optional closed properties selector: {mode: "columns", columns: [{from, to}, ...]}, {mode: "all_columns"}, {mode: "all_columns_except", except: [...]}, or {mode: "no_properties"}. Omitted labels use the definition name; an omitted selector selects all columns, including key columns. An explicit empty label list has no labels. Property aliases remain property mappings, never semantic label roles. Conflicting aliases, unknown columns and incomplete types reject admission.

Property value types are compatible across all definitions under a case-insensitive property name, even when labels differ or one definition is a node and the other an edge. Nullability remains declaration-local rather than making otherwise compatible value types conflict. Independently, a shared case-insensitive label must expose a compatible complete property set across both node and edge definitions. Construction and external snapshot admission enforce both obligations; neither label separation nor absent rows can bypass them.

Identity is the admitted constructor-definition domain, element definition name, ordered semantic key types and complete non-null key tuple. Edge keys are independent of endpoints: different keys retain parallel edges and self-loops. NULL element keys exclude that element. Duplicate non-null keys reject even identical payloads, including duplicate edge keys whose endpoints would later be excluded. NULL or missing endpoints exclude an edge without inventing nodes. These are different rules from legacy equal-payload collapse.

Domain issuance projects resolved constructor source references to ordered input occurrences and retains the unbound producer definitions. Outer WITH binding names and source locations do not enter identity. Neither bound Artifact CIDs, parameter values, Run/Invocation CIDs nor Graph content enters the domain. Editing inline VALUES or semantic mapping defines a different domain; cross-domain comparison has no implicit compatibility mapping. Within one admitted domain and typed key, changed properties, labels or endpoints change snapshot content, not element identity. SourceView inputs retain the original Stage declaration and the selected Catalog Carrier owner. Their domain projection includes the unbound Source declaration, the canonical static Carrier schema body CID and the selected SourceView member body CID; it does not include the enclosing Program ID, WITH binding name or Environment bundle CID. The common checker requires the original Stage's steps and registered input, and SourceView attachment requires the exact selected Catalog owner. This retention is not acquisition or execution permission: the existing request, policy and runtime admission still apply. A bare external Carrier/name is not producer-definition provenance and is rejected rather than inventing a domain.

Definition-scoped match_nodes and match_edges select a required definition, optional static label, existing predicate/projection fields and optional explicit bindings (identity, plus edge source/target). Binding names are ordinary caller-selected fields; collisions reject. Bounded keyed traverse requires explicit path_mode (walk, trail or acyclic) and emit: "paths" or emit: "nodes". TRAIL tracks independent edge identities, not endpoint tuples. Unimplemented SGA consumers reject this profile; keyed construction and this vertical path are not a claim of complete SGA support.

Construction and reload reuse the existing bounded Graph storage, checking, stop and cleanup owners. Selected construction row/node/edge ceilings apply before exposing a complete Graph; failure or cancellation exposes no partial Graph. actql-graph-snapshot/0.1 separately records the admitted contract, full typed identities, properties, labels and endpoints. Reload revalidates this correspondence and exact content identity, without creating a new domain or implicitly interpreting legacy snapshot bytes.

Graph construction MUST select all three construction ceilings from the admitted Host capacity policy: max_graph_construction_input_rows, max_graph_construction_nodes, and max_graph_construction_edges. They are positive safe integers; absence does not select a default or waive a construction check. Input rows sum the ordered node-definition and edge-definition input occurrences before NULL-key or missing-endpoint exclusion. Repeated producer references count once per occurrence. Output node and edge scopes count the independently keyed elements in the successfully constructed Graph. Input-Graph preflight ceilings and query-row ceilings are separate scopes.

Construction MUST enforce these ceilings, value admission, work and retention budgets using the existing resource owner. Failure or cancellation MUST expose no partial Graph. Pending physical cleanup retains its reservation until the same owner confirms release. Neither a checked contract nor a content CID is execution, storage or cleanup authority.

node_rows and edge_rowsCopy Anchor Link

These operations convert the admitted Graph to the existing Relation using the corresponding registered bridge. Bare to_rows is not accepted for a graph because node rows and edge rows are distinct meanings.

{"from":"g","node_rows":{"definition":"Person"},"as":"people"}
{"from":"g","node_rows":{"label":"Person"},"as":"people"}

The body MUST be either true (all definitions of the corresponding element kind), a closed object containing only definition (one definition of that kind), or a closed object containing only label. The forms are exclusive; mixed selectors, missing selectors and additional fields MUST reject at check time. Name lookup MUST use the admitted Graph name identity and reject unknown names or a name belonging only to the wrong element kind, rather than return an empty Relation. Output schema and presence MUST derive from the selected declarations even for zero rows; nullable remains independent of presence. Selection is part of the Program and emitted Plan meaning, not a runtime inference from data. Selected rows retain their original typed identities, domains, key components and node endpoint identities.

A label selector MUST select all definitions of the corresponding element kind whose admitted declarations contain that label. Candidate membership MUST NOT depend on observed rows, non-NULL values or empty results. The finite output schema MUST use all candidate declarations, including their retained key aliases and properties not associated with the selected label. A column is Required only when it exists in every candidate and each candidate guarantees its presence; otherwise it is Conditional. Compatible value types use the existing common type composition and nullable remains independent of presence; incompatible types MUST reject. The resolved label MUST be retained in the emitted Plan parameters, with deterministic declared spelling under the existing Graph name rules. Label selection filters canonical Graph row enumeration without weakening input admission, traversal work, output ceilings or cleanup obligations.

Graph row projection MUST retain the admitted identity types and property evidence. Node rows expose required id, labels; edge rows expose required id, src, dst, labels. Identity roles retain domain, definition and typed key; endpoint tuples and strings MUST NOT replace them. labels is a non-null array of non-null strings, with [] for no labels, using the admitted Graph's existing label identity, duplicate rejection and deterministic canonical order. There is no nullable rel role or compatibility output.