datalog: stratified negation (Phase 7, 124/124)

New lib/datalog/strata.sx: dl-build-dep-graph (relation -> deps with
:neg flag), Floyd-Warshall reachability, SCC-via-mutual-reach for
non-stratifiability detection, iterative dl-compute-strata, and
dl-group-rules-by-stratum.

eval.sx refactor:
- dl-saturate-rules! db rules — semi-naive worker over a rule subset
- dl-saturate! db — stratified driver. Rejects non-stratifiable
  programs at saturation time, then iterates strata in order
- dl-match-negation — succeeds iff inner positive match is empty

Order-aware safety in dl-rule-check-safety (Phase 4) already
required negation vars to be bound by a prior positive literal.
Stratum dict keys are strings (SX dicts don't accept ints).

Phase 6 magic sets deferred — opt-in path, semi-naive default
suffices for current workloads.

plans/datalog-on-sx.md

@@ -162,17 +162,27 @@ large graphs.
       reachability query from a single root.
 
 ### Phase 7 — stratified negation
-- [ ] Dependency graph analysis: which relations depend on which (positively or negatively)
-- [ ] Stratification check: error if negation is in a cycle (non-stratifiable program)
-- [ ] `dl-stratify db` → SCC analysis → stratum ordering
-- [ ] Evaluation: process strata in order — lower stratum fully computed
-      before using its complement in a higher stratum
-- [ ] `not(P)` in rule body: at evaluation time, check P is NOT in the
-      derived EDB
-- [ ] Safety extension: head vars in negative literals must also appear in
-      some positive body literal of the same rule
-- [ ] Tests: non-member (`not(member(X,L))`), colored-graph
-      (`not(same-color(X,Y))`), stratification error detection
+- [x] Dependency graph: `dl-build-dep-graph db` returns `{head -> ({:rel
+      :neg} ...)}`. Built-ins drop out (they're not relations).
+- [x] Reachability via Floyd-Warshall in `dl-build-reach`; cycles
+      detected by `reach[A][B] && reach[B][A]`. Programs are
+      non-stratifiable iff any negative dependency falls inside an SCC.
+      `dl-check-stratifiable` returns nil on success or a clear message.
+- [x] `dl-compute-strata` propagates stratum numbers iteratively:
+      `stratum(R) = max over deps of (stratum(dep) + (1 if negated else 0))`.
+- [x] Saturator refactor: `dl-saturate-rules! db rules` is the semi-
+      naive worker; `dl-saturate! db` rejects non-stratifiable programs,
+      groups rules by head's stratum, and runs the worker on each
+      stratum in increasing order.
+- [x] `not(P)` in body: `dl-match-negation` walks the inner literal
+      under the current subst and uses `dl-match-positive` — succeeds
+      iff zero matches. Order-aware safety in `dl-rule-check-safety`
+      (already present from Phase 4) requires negation vars to be
+      bound by an earlier positive literal.
+- [x] Tests in `lib/datalog/tests/negation.sx` (10): EDB and IDB
+      negation, two-step strata, multi-level strata, with-arithmetic,
+      empty-result and always-fail cases, non-stratifiability
+      rejection, and a negation safety violation.
 
 ### Phase 8 — aggregation (Datalog+)
 - [ ] `count(X, Goal)` → number of distinct X satisfying Goal
@@ -220,6 +230,19 @@ large graphs.
 
 _Newest first._
 
+- 2026-05-08 — Phase 7 done (Phase 6 magic sets deferred — opt-in,
+  semi-naive default suffices for current test suite). New
+  `lib/datalog/strata.sx` (~290 LOC): dep graph build, Floyd-Warshall
+  reachability, SCC-via-mutual-reachability for non-stratifiability
+  detection, iterative stratum computation, rule grouping by head
+  stratum. eval.sx split: `dl-saturate-rules!` is the per-rule-set
+  semi-naive worker, `dl-saturate!` is now the stratified driver
+  (errors out on non-stratifiable programs). `dl-match-negation` in
+  eval.sx: succeeds iff inner positive match is empty. Stratum-keyed
+  dicts use `(str s)` since SX dicts only accept string/keyword keys.
+  10 negation tests cover EDB/IDB negation, multi-level strata,
+  non-stratifiability rejection, and a negation safety violation.
+
 - 2026-05-08 — Phase 5 done. `lib/datalog/eval.sx` rewritten to
   semi-naive default. `dl-saturate!` tracks a per-relation delta and
   on each iteration walks every positive body position substituting