datalog: db + naive eval + safety analysis (Phase 3, 87/87)

db.sx: facts indexed by relation name, rules list, dl-add-fact!
(rejects non-ground), dl-add-rule! (rejects unsafe — head vars
not in positive body). eval.sx: dl-saturate! fixpoint, dl-query
with deduped projected results. Negation and arithmetic raise
clear errors (Phase 4/7 to follow). 15 eval tests: transitive
closure, sibling, same-gen, grandparent, cyclic reach, safety.

plans/datalog-on-sx.md

@@ -82,15 +82,26 @@ Key differences from Prolog:
       Lists/tuples unify element-wise (used for arithmetic compounds too).
 - [x] Tests in `lib/datalog/tests/unify.sx` (28). 72 / 72 conformance.
 
-### Phase 3 — extensional DB + naive evaluation
-- [ ] EDB: `{:relation-name → set-of-ground-tuples}` using SX sets (Phase 18 of primitives)
-- [ ] `dl-add-fact!` `db` `relation` `args` → add ground tuple
-- [ ] `dl-add-rule!` `db` `head` `body` → add rule clause
-- [ ] Naive evaluation: iterate rules until fixpoint
-      For each rule, for each combination of body tuples that unify, derive head tuple.
-      Repeat until no new tuples added.
-- [ ] `dl-query` `db` `goal` → list of substitutions satisfying goal against derived DB
-- [ ] Tests: transitive closure (ancestor), sibling, same-generation — classic Datalog programs
+### Phase 3 — extensional DB + naive evaluation + safety analysis
+- [x] EDB+IDB combined: `{:facts {<rel-name-string> -> (literal ...)}}` —
+      relations indexed by name; tuples stored as full literals so they
+      unify directly. Dedup on insert via `dl-tuple-equal?`.
+- [x] `dl-add-fact! db lit` (rejects non-ground) and `dl-add-rule! db rule`
+      (rejects unsafe). `dl-program source` parses + loads in one step.
+- [x] Naive evaluation `dl-saturate! db`: iterate rules until no new tuples.
+      `dl-find-bindings` recursively joins body literals; `dl-match-positive`
+      unifies a literal against every tuple in the relation.
+- [x] `dl-query db goal` → list of substitutions over `goal`'s vars,
+      deduplicated. `dl-relation db name` for derived tuples.
+- [x] Safety analysis at `dl-add-rule!` time: every head variable except
+      `_` must appear in some positive body literal. Built-ins and negated
+      literals do not satisfy safety. Helpers `dl-positive-body-vars`,
+      `dl-rule-unsafe-head-vars` exposed for later phases.
+- [x] Negation and arithmetic built-ins error cleanly at saturate time
+      (Phase 4 / Phase 7 will swap in real semantics).
+- [x] Tests in `lib/datalog/tests/eval.sx` (15): transitive closure,
+      sibling, same-generation, grandparent, cyclic graph reach, six
+      safety cases. 87 / 87 conformance.
 
 ### Phase 4 — semi-naive evaluation (performance)
 - [ ] Delta sets: track newly derived tuples per iteration
@@ -149,6 +160,17 @@ _(none yet)_
 
 _Newest first._
 
+- 2026-05-07 — Phase 3 done. `lib/datalog/db.sx` (~250 LOC) holds facts
+  indexed by relation name plus the rules list, with `dl-add-fact!` /
+  `dl-add-rule!` (rejects non-ground facts and unsafe rules);
+  `lib/datalog/eval.sx` (~150 LOC) implements the naive bottom-up
+  fixpoint via `dl-find-bindings`/`dl-match-positive`/`dl-saturate!`
+  and `dl-query` (deduped projected substitutions). Safety analysis
+  rejects unsafe head vars at load time. Negation and arithmetic
+  built-ins raise clean errors (lifted in later phases). 15 eval
+  tests cover transitive closure, sibling, same-generation, cyclic
+  graph reach, and six safety violations. Conformance 87 / 87.
+
 - 2026-05-07 — Phase 2 done. `lib/datalog/unify.sx` (~140 LOC):
   `dl-var?` (case + underscore), `dl-walk`, `dl-bind`, `dl-unify` (returns
   extended dict subst or `nil`), `dl-apply-subst`, `dl-ground?`, `dl-vars-of`.