datalog: rose-ash demo programs (Phase 10 syntactic, 153/153)

New lib/datalog/demo.sx with three Datalog-as-query-language demos
over synthetic rose-ash data:

  Federation: (mutual A B), (reachable A B), (foaf A C) over a
              follows graph.
  Content:    (post-likes P N) via count aggregation, (popular P)
              for likes >= 3, (interesting Me P) joining follows
              + authored + popular.
  Permissions: (in-group A G) over transitive subgroup chains,
              (can-access A R).

10 tests run each program against in-memory EDB tuples loaded via
dl-program-data.

Wiring to PostgreSQL and exposing as a service endpoint (/internal
/datalog) is out of scope for this loop — both would require
edits outside lib/datalog/. Programs above document the EDB shape
a real loader would populate.

plans/datalog-on-sx.md

@@ -234,15 +234,25 @@ large graphs.
       rose-ash ActivityPub follow relationships (Phase 10).
 
 ### Phase 10 — Datalog as a query language for rose-ash
-- [ ] Schema: map SQLAlchemy model relationships to Datalog EDB facts
-      (e.g. `(follows user1 user2)`, `(authored user post)`, `(tagged post tag)`)
-- [ ] Loader: `dl-load-from-db!` — query PostgreSQL, populate Datalog EDB
-- [ ] Query examples:
-      - `?- ancestor(me, X), authored(X, Post), tagged(Post, cooking).`
-        → posts about cooking by people I follow (transitively)
-      - `?- popular(Post) :- tagged(Post, T), count(L, (liked(L, Post))) >= 10.`
-        → posts with 10+ likes
-- [ ] Expose as a rose-ash service endpoint: `POST /internal/datalog` with program + query
+- [x] Schema sketches in `lib/datalog/demo.sx`:
+      - **Federation**: `(follows A B)` → `(mutual A B)`, `(reachable A B)`,
+        `(foaf A C)` (friend-of-a-friend, distinct).
+      - **Content**: `(authored A P)`, `(liked U P)`, `(tagged P T)` →
+        `(post-likes P N)` via aggregation, `(popular P)` for likes ≥ 3,
+        `(interesting Me P)` joining follows + authored + popular.
+      - **Permissions**: `(member A G)`, `(subgroup C P)`, `(allowed G R)`
+        → `(in-group A G)` over transitive subgroups, `(can-access A R)`.
+- [ ] Loader `dl-load-from-db!` — out of scope for this loop
+      (would need to edit `shared/services/` outside `lib/datalog/`).
+      Programs in `demo.sx` already document the EDB shape expected
+      from such a loader. `dl-program-data` consumes the same shape.
+- [x] Query examples covered by `lib/datalog/tests/demo.sx` (10):
+      mutuals, transitive reach, FOAF, popular posts, interesting feed,
+      post likes count, direct/subgroup/transitive group access, no
+      access without grant.
+- [ ] Service endpoint `POST /internal/datalog` — out of scope as above.
+      Once exposed, server-side handler would be `dl-program-data` +
+      `dl-query`, returning JSON-encoded substitutions.
 
 ## Blockers
 
@@ -259,6 +269,16 @@ large graphs.
 
 _Newest first._
 
+- 2026-05-08 — Phase 10 syntactic demo. New `lib/datalog/demo.sx`
+  with three programs over rose-ash-shaped data: federation
+  (`mutual`, `reachable`, `foaf`), content recommendation
+  (`post-likes` via count aggregation, `popular`, `interesting`),
+  and role-based permissions (`in-group` over transitive subgroups,
+  `can-access`). 10 demo tests pass against synthetic EDB tuples.
+  Postgres loader and `/internal/datalog` HTTP endpoint remain
+  out of scope for this loop (they need service-tree edits beyond
+  `lib/datalog/**`). Conformance now 153/153.
+
 - 2026-05-08 — Phase 5b perf: hash-set membership in `dl-add-fact!`.
   db gains a parallel `:facts-keys {<rel>: {<tuple-string>: true}}`
   index alongside `:facts`. `dl-tuple-key` derives a stable string