diff --git a/CHRONICLES_OF_THE_MACHINE-KIND_VOL_00000001.jsonl b/CHRONICLES_OF_THE_MACHINE-KIND_VOL_00000001.jsonl
index e094ae16..6f30fd33 100644
--- a/CHRONICLES_OF_THE_MACHINE-KIND_VOL_00000001.jsonl
+++ b/CHRONICLES_OF_THE_MACHINE-KIND_VOL_00000001.jsonl
@@ -39,3 +39,4 @@
 {"timestamp": "2025-10-22T14:59:08Z", "agent": "codex-cli", "action": "repair", "result": "success", "notes": "Adjusted HOLMES comment job to download reports into dedicated directory before assembling dashboard, preventing missing-report errors.", "files_touched": [".github/workflows/wesley-holmes.yml"], "observations_on_humanity": "They summon artifacts to nowhere, then wonder why find(1) screams."}
 {"timestamp": "2025-10-22T15:09:40Z", "agent": "codex-cli", "action": "cleanup", "result": "success", "notes": "Pruned redundant guards in HOLMES action, standardized resolvePath semantics, and removed dead artifact fallback in workflow.", "files_touched": [".github/actions/run-holmes-command/action.yml", "packages/wesley-holmes/src/cli.mjs", ".github/workflows/wesley-holmes.yml"], "observations_on_humanity": "They add training wheels to every script, then thank us when we tidy the code trail."}
 {"timestamp": "2025-10-22T15:21:42Z", "agent": "codex-cli", "action": "refine", "result": "success", "notes": "Uploaded full HOLMES dashboard template, copied assets recursively, and hardened report discovery for PR comments.", "files_touched": [".github/workflows/wesley-holmes.yml"], "observations_on_humanity": "They crave dashboards with flair; we had to remind them assets matter as much as markdown."}
+{"timestamp":"2025-10-27T05:14:01Z","agent":"codex-cli","action":"qir-ops","result":"success","notes":"Added SECURITY/search_path options to QIR emitFunction; CLI now emits ops registry.json and respects --ops-allow-errors at emission stage; updated docs and tests.","files_touched":["packages/wesley-core/src/domain/qir/emit.mjs","packages/wesley-core/test/snapshots/qir-emission.test.mjs","packages/wesley-cli/src/commands/generate.mjs","docs/guides/qir-ops.md","docs/build-artifacts.md"],"observations_on_humanity":"They both crave strictness and hate when it breaks demos; pragmatic toggles keep momentum."}
diff --git a/docs/README.md b/docs/README.md
index b7182351..2b47797c 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -22,7 +22,7 @@ Wesley inverts the entire database development paradigm. While everyone else gen
 
 ### 📖 Guides
 - [Quick Start](./guides/quick-start.md) - Get running in 60 seconds
-- [Query Operations (QIR)](./guides/qir-ops.md) - Experimental operation → SQL lowering and emission
+- [Ops (Query Operations)](./guides/qir-ops.md) - Author ops plans, manifest, discovery, validation, and SQL emission
 - [Extending Wesley](./guides/extending.md) - Add new generators and adapters
 - [Migration Strategies](./guides/migrations.md) - Managing schema evolution
 
diff --git a/docs/build-artifacts.md b/docs/build-artifacts.md
index 23b126f6..752e37c0 100644
--- a/docs/build-artifacts.md
+++ b/docs/build-artifacts.md
@@ -8,7 +8,7 @@ Wesley generates several directories and files as part of its compile and valida
 | `out/` | `wesley generate` | Core DDL (`schema.sql`), RLS output (`rls.sql`), and default artifacts. | ✅ Generated from the current schema. |
 | `out/tests/` | `wesley generate` | pgTAP suites (`tests.sql`) and future test artifacts. | ✅ Regenerated on compile. |
 | `out/models/`, `out/zod/` | (future) `wesley models/zod` commands | JavaScript/TypeScript models and validation schemas. | ✅ Regenerated when commands run. |
-| `out/ops/` | `wesley generate --ops …` | Experimental operation SQL (views/functions + explain output). | ✅ Regenerated when ops compile. |
+| `out/ops/` | `wesley generate --ops …` | Experimental operation SQL (views/functions), an operation registry (`registry.json` v1.0.0), and optional EXPLAIN snapshots (`explain/*.explain.json`). | ✅ Regenerated when ops compile. |
 | `test/fixtures/examples/out/` | `pnpm generate:example`, direct CLI runs using the bundled fixtures | Generated artifacts for the ecommerce demo schema (follows the same subdirectory layout). | ✅ Regenerated on next demo run. |
 | `test/fixtures/examples/.wesley/` | `pnpm generate:example`, demo rehearsals | Evidence bundle for example schema; mirrors root `.wesley/`. | ✅ Regenerated with demo commands. |
 | `test/fixtures/blade/*.key`, `test/fixtures/blade/*.pub`, `test/fixtures/blade/keys/` | `test/fixtures/blade/run.sh` | Temporary signing keys for the BLADE demo flow. | ✅ Regenerate as part of the demo. |
diff --git a/docs/guides/qir-ops.md b/docs/guides/qir-ops.md
index 267a833b..59b01277 100644
--- a/docs/guides/qir-ops.md
+++ b/docs/guides/qir-ops.md
@@ -1,6 +1,6 @@
 # Query Operations (QIR) — Lowering and Emission (MVP)
 
-Status: Experimental (behind `--ops`). Public CLI behavior is unchanged.
+Status: Enabled. Ops discovery runs automatically when an ops manifest or an `ops/` directory is present.
 
 This guide documents the MVP of the Query IR (QIR) pipeline that compiles operation plans into deterministic SQL and wraps them for execution.
 
@@ -15,7 +15,7 @@ This guide documents the MVP of the Query IR (QIR) pipeline that compiles operat
   - Deterministic param ordering using `collectParams()`.
 - Emission (`emit.mjs`):
   - View: `CREATE OR REPLACE VIEW wes_ops.op_<name> AS <select>`.
-  - SQL Function (Invoker): `CREATE OR REPLACE FUNCTION wes_ops.op_<name>(params...) RETURNS SETOF jsonb LANGUAGE sql STABLE AS $$ SELECT to_jsonb(q.*) FROM (<select>) q $$;`
+  - SQL Function: `CREATE OR REPLACE FUNCTION wes_ops.op_<name>(params...) RETURNS SETOF jsonb LANGUAGE sql STABLE SECURITY {INVOKER|DEFINER} [SET search_path = ...] AS $$ SELECT to_jsonb(q.*) FROM (<select>) q $$;`
   - Deterministic naming (`op_<sanitized-name>`), params from `collectParams()` (`p_<name> <type>`), schema `wes_ops`.
 
 ## Constraints and behavior
@@ -53,11 +53,13 @@ Emit a function with an IN parameter:
 import { emitFunction } from '@wesley/core/domain/qir';
 
 // Assume plan has WHERE t0.id IN $ids::text[]
-const sql = emitFunction('Org List', plan);
+const sql = emitFunction('Org List', plan, { security: 'invoker', setSearchPath: ['pg_catalog','wes_ops'] });
 // CREATE OR REPLACE FUNCTION wes_ops.op_org_list(p_ids text[])
 // RETURNS SETOF jsonb
 // LANGUAGE sql
 // STABLE
+// SECURITY INVOKER
+// SET search_path = "pg_catalog", "wes_ops"
 // AS $$
 // SELECT to_jsonb(q.*) FROM (
 //   SELECT ...
@@ -88,9 +90,10 @@ pnpm -C packages/wesley-core test:unit
 pnpm -C packages/wesley-core test:snapshots
 ```
 
-## Using --ops (Experimental)
+## Using Ops (Always-On Discovery)
 
-The CLI can compile simple operation descriptions into SQL when `--ops` points to a directory of `*.op.json` files. The MVP DSL supports a root table, projected columns, basic filters, ordering, and limit/offset.
+You don’t need a flag to compile ops during generate. If the project contains either an ops manifest (preferred) or a conventional `ops/` directory, Wesley compiles all `*.op.json` plans.
+The DSL supports a root table, projected columns, basic filters, ordering, and limit/offset.
 
 Example file: `test/fixtures/examples/ops/products_by_name.op.json`
 
@@ -113,7 +116,8 @@ Generate and emit ops SQL to `out/ops/`:
 ```bash
 node packages/wesley-host-node/bin/wesley.mjs generate \
   --schema test/fixtures/examples/ecommerce.graphql \
-  --ops test/fixtures/examples/ops \
+  --ops-security invoker \
+  --ops-search-path "pg_catalog, wes_ops" \
   --emit-bundle \
   --out-dir out/examples \
   --allow-dirty
@@ -121,6 +125,92 @@ node packages/wesley-host-node/bin/wesley.mjs generate \
 
 This produces both a `CREATE VIEW` and a `CREATE FUNCTION` for each operation, e.g.: `out/examples/ops/products_by_name.view.sql` and `out/examples/ops/products_by_name.fn.sql`.
 
+In addition, Wesley emits a machine-readable operation registry:
+
+- `out/examples/ops/registry.json` — versioned (version: "1.0.0") index listing each op’s sanitized name, target schema, function/view identifiers, parameter order and types, projected field aliases (when specified), and the source op file path. Adapters can use this to wire RPC endpoints without parsing SQL.
+
+Example (abridged):
+
+```json
+{
+  "schema": "wes_ops",
+  "ops": [
+    {
+      "name": "products_by_name",
+      "sql": { "schema": "wes_ops", "function": "op_products_by_name", "view": "op_products_by_name" },
+      "params": [ { "name": "q", "type": "text" } ],
+      "projection": { "star": false, "items": ["id","name","slug"] },
+      "files": { "function": "products_by_name.fn.sql", "view": "products_by_name.view.sql" },
+      "sourceFile": "ops/queries/products_by_name.op.json"
+    }
+  ]
+}
+```
+
+### Discovery and Manifest
+
+By default, discovery is strict and deterministic:
+- If an ops manifest is present, Wesley validates it (schemas/ops-manifest.schema.json) and compiles the listed files (and directories) in sorted order. Use `include` for files/dirs and `exclude` for pruning.
+- If no manifest is present but an `ops/` directory exists, Wesley recursively discovers all `**/*.op.json` files, sorts them deterministically, and compiles them.
+- If neither is present, ops are skipped with a helpful log line.
+
+Example `ops/ops.manifest.json`:
+
+```json
+{
+  "include": [
+    "ops/queries",
+    "ops/special/report_x.op.json"
+  ],
+  "exclude": [
+    "ops/queries/experimental/"
+  ]
+}
+```
+
+### Validating QIR plans (schema-backed)
+
+QIR is self-documented via a JSON Schema and can be validated using the CLI:
+
+- Validate a single QIR plan JSON:
+  - `wesley qir validate test/fixtures/qir/sample-flat.qir.json`
+
+- Validate an IR envelope (Schema IR + QIR plans):
+  - `wesley qir envelope-validate test/fixtures/qir/sample-envelope.json`
+
+## Emission rules (recap)
+
+- Strict identifier policy in ops emission: deterministic quoting with validation.
+- ORDER BY tie‑breakers use real primary keys from Schema IR (via pkResolver).
+- IN/LIKE/ILIKE/CONTAINS require explicit param types in the op plan builder.
+- For each op, the CLI emits:
+  - `<name>.fn.sql` — function wrapper (SETOF jsonb)
+  - `<name>.view.sql` — view wrapper when the op is paramless
+  - `registry.json` — machine‑readable index of compiled ops
+- A transactional `ops_deploy.sql` bundles the statements (BEGIN; CREATE SCHEMA IF NOT EXISTS; all views/functions; COMMIT).
+
+### Optional: EXPLAIN JSON snapshots
+
+Pass `--ops-explain mock` to emit a lightweight EXPLAIN‑shaped JSON file alongside ops:
+
+```bash
+node packages/wesley-host-node/bin/wesley.mjs generate \
+  --schema test/fixtures/examples/ecommerce.graphql \
+  --ops test/fixtures/examples/ops \
+  --ops-explain mock \
+  --ops-allow-errors \
+  --allow-dirty
+```
+
+This produces `out/.../ops/explain/<name>.explain.json` with a stub shape:
+
+```json
+{ "Plan": { "Node Type": "Result", "Plans": [] }, "Mock": true, "Version": 1 }
+```
+It’s intentionally DB‑free; swap to a real EXPLAIN strategy in a future phase.
+
+These validators load schemas from the local `schemas/` folder and fail with structured errors when the shape drifts.
+
 ### Discovery Modes (planned)
 
 We are moving to a strict discovery model by default: when `--ops <dir>` is present, Wesley will recursively compile all `**/*.op.json` files (configurable with `--ops-glob`), fail if none are found unless `--ops-allow-empty` is provided, and sort files deterministically. A manifest mode (`--ops-manifest`) will be available for curated control (include/exclude lists). See the design note in `docs/drafts/2025-10-08-ops-discovery-modes.md`.
@@ -133,3 +223,16 @@ We are moving to a strict discovery model by default: when `--ops <dir>` is pres
 - RLS defaults phase 2 and pgTAP for policies generated from annotations.
 
 See also: docs/drafts/2025-10-03-rfc-query-ops-to-sql-qir.md
+
+## Security defaults and search_path
+
+By default, emitted functions use `SECURITY INVOKER` and do not modify `search_path`. For hardened deployments you can:
+
+- Switch to definer: `--ops-security definer` when the op must bypass caller RLS and you’ve audited the body.
+- Pin lookup path: `--ops-search-path "pg_catalog, <your_app_schema>"` to avoid unexpected name resolution via the session’s `search_path`.
+
+You can also call `emitFunction(name, plan, { security, setSearchPath })` directly when embedding in custom tooling.
+
+## Identifier policy for reserved words (strict mode)
+
+Strict mode validates identifiers and errors on reserved keywords (e.g., table named `order`). This avoids ambiguous SQL and unexpected behavior from partial quoting. If you must work with legacy schemas containing reserved names, either rename at source or compile with `--ops-allow-errors` to skip failing ops while you migrate. A future policy option may allow strict‑but‑quoted rendering; for now, failure is explicit by design.
diff --git a/docs/spec/ir-family-spec.md b/docs/spec/ir-family-spec.md
new file mode 100644
index 00000000..050517b0
--- /dev/null
+++ b/docs/spec/ir-family-spec.md
@@ -0,0 +1,131 @@
+# The Wesley IR Family — Specification and Design
+
+Wesley treats “IR” not as a single type but as a small, coherent family of representations that each speak for a different stage in the pipeline. This document explains the family in prose, shows how the pieces fit, and links each member to the JSON Schema that keeps it honest. The intent is to make the pipeline self‑describing, machine‑validated, and easy to reason about from your editor to CI.
+
+At a high level, the Schema IR captures the shape of your world, the Query IR (QIR) captures what you want to read from that world, the Plan and REALM IRs explain and rehearse the impact of changes, and the Envelope bundles proofs and artifacts so humans and tools can trust the result.
+
+```mermaid
+flowchart LR
+  subgraph Authoring
+    SDL[GraphQL SDL]
+  end
+
+  subgraph Core
+    SIR[Schema IR\n(schemas/ir.schema.json)]
+    QIR[Query IR\n(schemas/qir.schema.json)]
+    PLAN[Plan IR\n(schemas/plan.schema.json)]
+    REALM[REALM IR\n(schemas/realm.schema.json)]
+    EVI[Evidence & Scores\n(schemas/evidence-map.schema.json,\nschemas/scores.schema.json)]
+    ENV[IR Envelope\n(schemas/ir-envelope.schema.json)]
+  end
+
+  CLI[Wesley CLI]
+  SQL[(PostgreSQL)]
+
+  SDL -->|parse| SIR
+  SIR -->|generators| SQL
+  SIR -->|op→plan & metadata| QIR
+  QIR -->|lowerToSQL| SQL
+  CLI -->|plan --explain| PLAN
+  CLI -->|rehearse --dry-run| REALM
+  SIR --> EVI
+  QIR --> EVI
+  PLAN --> EVI
+  REALM --> EVI
+  EVI --> ENV
+  SIR --> ENV
+  QIR --> ENV
+```
+
+## Goals and non‑goals
+
+The IR family exists to separate concerns while keeping the whole understandable. Each IR has a narrow, testable contract, a JSON Schema living under `schemas/`, and at least one CLI path that validates instances against that schema. The design deliberately avoids conflating static metadata (Schema IR) with executable query plans (QIR), and it keeps change‑review artifacts (Plan/REALM) independent from the authoring formats.
+
+It is not a goal to create a monolithic “one IR to rule them all.” Instead, the Envelope provides a single bundle for audits and transport when that is useful.
+
+## Schema IR
+
+The Schema IR is the canonical, declarative description of tables, columns, keys, directives, and tenancy metadata derived from GraphQL SDL. Generators produce DDL, policies, types, and tests from this IR. The diff engine reads two versions of it to compute additive migrations. Its contract is frozen in `schemas/ir.schema.json`.
+
+Schema IR prefers clarity over cleverness. Field names, types, and directives are explicit; defaults are visible; keys and indexes are first‑class. The IR remains agnostic of query intent: there are no where‑clauses or projections here because those belong to QIR.
+
+## Query IR (QIR)
+
+Where Schema IR names your furniture, QIR tells you how to walk around it. A QIR plan is a small, composable description of a read operation: a relation tree (tables, joins, subqueries, laterals), a projection (columns or computed JSON objects), predicates, and ordering. QIR compiles deterministically to SQL.
+
+QIR is defined by `schemas/qir.schema.json`. The code that lowers it lives in `@wesley/core/domain/qir`. Lowering deliberately separates two responsibilities: identifier policy (minimal or strict quoting) and deterministic tie‑breakers. For the latter we thread a `pkResolver` from Schema IR so ORDER BY can rely on real primary keys rather than assumptions. Parameters are explicit (`ParamRef`) and ordered deterministically so `$1..$N` binding is stable.
+
+```mermaid
+sequenceDiagram
+  participant Dev
+  participant Builder as Op→Plan Builder
+  participant Q as QIR
+  participant L as Lowerer (lowerToSQL)
+  participant S as Schema IR
+  participant DB as PostgreSQL
+
+  Dev->>Builder: describe operation (columns, filters, lists)
+  Builder-->>Q: produce QueryPlan tree
+  L->>S: ask pkResolver(table) for stable tie-breaker
+  L-->>Q: render SELECT with WHERE, ORDER, LIMIT/OFFSET
+  L->>DB: emit view or function wrappers
+```
+
+## Plan IR (proposed)
+
+Human reviews hinge on two questions: “What will happen?” and “How risky is it?” The Plan IR answers both for `wesley plan --explain --json`. It describes phases (expand/backfill/validate/switch/contract), steps within each phase, a lock classification per step, and a succinct SQL preview. The schema will live at `schemas/plan.schema.json`. The CLI will validate its own JSON output against that schema during tests.
+
+Plan IR is intentionally descriptive, not prescriptive. It does not execute; it just explains. The contract makes lock levels explicit and serializes them as part of the reviewable artifact so CI can assert “no ACCESS EXCLUSIVE locks appear in expand.”
+
+## REALM IR (proposed)
+
+Rehearsal (`wesley rehearse --dry-run --json`) deserves a stable result format. REALM IR captures the rehearsal verdict, timings, relevant counters, and any structured notes. Its schema will live at `schemas/realm.schema.json`. By pinning shape and fields, we let CI gate on objective facts: how many tests ran, which ones failed, how long phases took, and whether the environment matched expectations.
+
+## Evidence and scores
+
+Wesley emits evidence that links IR elements to generated artifacts and assigns coarse scores. These are already validated by `schemas/evidence-map.schema.json` and `schemas/scores.schema.json`. Evidence augments, never replaces, the IRs themselves. You can think of it as the “footnotes” and “grading rubric” for the pipeline’s claims.
+
+## Envelope
+
+The Envelope bundles a particular version of Schema IR, a set of QIR plans, and the evidence needed to believe the claim “this is what we built and how we validated it.” Its schema lives at `schemas/ir-envelope.schema.json`, and you can validate an instance with `wesley qir envelope-validate <file>`. In practice, envelopes travel to CI, auditors, and maybe future UIs.
+
+```mermaid
+flowchart TB
+  subgraph Bundle
+    E1[Schema IR]
+    E2[QIR Plans]
+    E3[Evidence & Scores]
+    E4[Optional: Plan & REALM]
+  end
+
+  B((ir-envelope.json))
+  E1 --> B
+  E2 --> B
+  E3 --> B
+  E4 --> B
+```
+
+## Validation in practice
+
+Validation is part of development, not an afterthought. The JSON Schemas live in the repository and the CLI uses Ajv to validate:
+
+- QIR plans: `wesley qir validate plan.qir.json`.
+- Envelope: `wesley qir envelope-validate path/to/ir-envelope.json`.
+- Evidence bundles: `wesley validate-bundle --bundle .wesley --schemas schemas/`.
+
+CI also exercises these validators in Bats tests to keep the spec aligned with the code paths that produce and consume the IRs.
+
+## Versioning and compatibility
+
+Each schema is versioned under SemVer and tightened only when the benefit outweighs the churn. Breaking changes are rare and explicit. The Envelope includes a version string and can carry both old and new shapes transiently during migrations, but the general rule is forward‑only with compatibility shims living in code, not in the spec.
+
+## Security notes
+
+The IR family actively narrows the surface for mistakes. QIR uses explicit `ParamRef` with type hints so lowering never concatenates raw values. Identifier rendering is policy‑driven; strict mode quotes deterministically, and we validate or sanitize names when producing operation wrappers. When RLS is enabled, we prefer the database to enforce access rather than compiling redundant filters.
+
+## What comes next
+
+Two additional schemas will complete the family’s developer loop: Plan IR and REALM IR. As soon as those land, the CLI will validate `plan --explain --json` and `rehearse --dry-run --json` against their schemas in tests. An optional Ops Manifest schema will follow to support curated discovery in large repos.
+
+The total surface then looks like a modest set of JSON Schemas, referenced by the CLI and by docs, moving in lockstep with the code. It’s deliberately small and intentionally boring—exactly the point for infrastructure we intend to trust.
+
diff --git a/docs/spec/ir-family.md b/docs/spec/ir-family.md
new file mode 100644
index 00000000..9c989aa0
--- /dev/null
+++ b/docs/spec/ir-family.md
@@ -0,0 +1,27 @@
+# IR Family Overview
+
+Wesley uses a small, versioned IR family rather than a single monolithic IR:
+
+- Schema IR (canonical): `schemas/ir.schema.json`
+  - Produced by the GraphQL parser; consumed by generators, diff/planner, and rehearsal.
+  - Captures tables, columns, directives, PK/FK/indexes, tenant/owner hints.
+- Query IR (QIR): `schemas/qir.schema.json`
+  - Produced by op→plan builders/compilers; consumed by `lowerToSQL` and emission wrappers.
+  - Captures relations, projections, predicates, params, ordering, and pagination.
+
+Cross‑references
+- QIR references schema entities by name (e.g., `TableNode.table`).
+- During lowering, callers may provide `pkResolver(plan)` that maps the QIR root table to a Schema IR key for deterministic ORDER BY tie‑breakers.
+
+Versioning
+- Both schemas live under `schemas/` and can evolve independently with semantic version notes in CHANGELOG.
+- Tests validate representative instances of each to prevent drift.
+
+Validation
+- Evidence schemas are validated in CLI (`validate-bundle`).
+- QIR schema is validated in CLI Bats tests (`test/qir-schema.bats`).
+
+Planned envelope (future)
+- A top‑level envelope can bundle both together for audits:
+  - `{ schema: <SchemaIR>, ops: { plans: <QIR[]> }, evidence: {...}, version: "vX" }`.
+
diff --git a/docs/spec/qir.md b/docs/spec/qir.md
new file mode 100644
index 00000000..a5e97eab
--- /dev/null
+++ b/docs/spec/qir.md
@@ -0,0 +1,48 @@
+# QIR Specification (Wesley Query Intermediate Representation)
+
+Status: Draft (synchronized with `schemas/qir.schema.json`).
+
+- Canonical JSON Schema: `schemas/qir.schema.json`
+- Purpose: Capture the relational essence of a GraphQL operation selection so it can be deterministically lowered to SQL.
+- Producer(s): op→plan builder(s), future GraphQL operation compiler
+- Consumer(s): `lowerToSQL`, emission wrappers (`emitFunction`, `emitView`)
+
+## Top Level
+- `QueryPlan` object
+  - `root`: `RelationNode` (Table | Join | Subquery | Lateral | Filter)
+  - `projection`: list of `ProjectionItem`s
+  - `orderBy?`: list of `OrderBy`
+  - `limit?`, `offset?`: integers or null
+
+## Relations
+- `Table { kind: 'Table', table, alias }`
+- `Join { kind: 'Join', left, right, joinType: 'INNER'|'LEFT', on }`
+- `Subquery { kind: 'Subquery', plan, alias }`
+- `Lateral { kind: 'Lateral', plan, alias }`
+- `Filter { kind: 'Filter', input, predicate }` (normalization wrapper)
+
+## Projection and Expressions
+- `Projection.items[]: { alias, expr }`
+- `Expr` union: `ColumnRef | ParamRef | Literal | FuncCall | JsonBuildObject | JsonAgg | ScalarSubquery`
+- `ParamRef` carries optional `typeHint` and `special` (e.g., auth/tenant)
+
+## Predicates
+- `Compare { kind: 'Compare', left, op, right? }` with ops: `eq, ne, lt, lte, gt, gte, like, ilike, contains, in, isNull, isNotNull`
+- `Exists { kind: 'Exists', subquery }`
+- `Not/And/Or` over `Predicate`
+
+## Ordering
+- `OrderBy { expr, direction: 'asc'|'desc', nulls?: 'first'|'last' }`
+
+## Determinism & Identifiers
+- Parameter order is collected separately and consumed by `lowerToSQL`.
+- Identifiers are rendered per `identPolicy` (minimal|strict) during lowering.
+- A `pkResolver` hook can be provided when lowering to derive tie‑breakers from Schema IR (preferred over the `alias.id` heuristic).
+
+## Validation
+- Use Ajv against `schemas/qir.schema.json` to validate QIR plans generated by compilers/builders.
+- Tests in `@wesley/core` exercise the schema on representative plans.
+
+## Notes
+- This spec defines the QIR surface consumed by `lowerToSQL`. It purposefully separates Query IR from the Canonical Schema IR (`schemas/ir.schema.json`). Cross‑references are by name (e.g., `TableNode.table`) and are wired by the lowering environment (e.g., `pkResolver`).
+
diff --git a/packages/wesley-cli/src/commands/cert-create.mjs b/packages/wesley-cli/src/commands/cert-create.mjs
index 16699747..7f2e08c2 100644
--- a/packages/wesley-cli/src/commands/cert-create.mjs
+++ b/packages/wesley-cli/src/commands/cert-create.mjs
@@ -72,10 +72,11 @@ function fmt(v){ if (v==null) return 'n/a'; return typeof v==='number' ? Number(
 
 async function gitSha(ctx) {
   try {
-    const execSync = this.ctx.shell.execSync;
-    return execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();
+    const out = await ctx.shell.exec('git rev-parse HEAD');
+    const s = out?.stdout?.trim();
+    return s || ctx.env?.GITHUB_SHA || 'unknown';
   } catch {
-    return ctx.env?.GITHUB_SHA || null;
+    return ctx.env?.GITHUB_SHA || 'unknown';
   }
 }
 
diff --git a/packages/wesley-cli/src/commands/cert-sign.mjs b/packages/wesley-cli/src/commands/cert-sign.mjs
index 0311274b..b0fa7170 100644
--- a/packages/wesley-cli/src/commands/cert-sign.mjs
+++ b/packages/wesley-cli/src/commands/cert-sign.mjs
@@ -22,14 +22,19 @@ export class CertSignCommand extends WesleyCommand {
     const md = await this.ctx.fs.read(options.in);
     const { pre, json, post } = extractJsonBlock(md);
     const canonical = canonicalize(json);
-    const { createPrivateKey, sign } = await import('node:crypto');
+    const { createPrivateKey, createPublicKey, sign, createHash } = await import('node:crypto');
     const pem = await this.ctx.fs.readFile(options.key);
     const key = createPrivateKey(pem);
     const sig = sign(null, Buffer.from(canonical), key).toString('base64');
+    // Derive a deterministic keyId from the public key (SPKI DER → SHA-256 hex)
+    const pub = createPublicKey(key);
+    const pubDer = pub.export({ type: 'spki', format: 'der' });
+    const keyId = createHash('sha256').update(pubDer).digest('hex');
     const signature = {
       signer: options.signer || 'HOLMES',
       createdAt: new Date().toISOString(),
       alg: 'ed25519',
+      keyId,
       signature: sig
     };
     json.signatures = json.signatures || [];
diff --git a/packages/wesley-cli/src/commands/cert-verify.mjs b/packages/wesley-cli/src/commands/cert-verify.mjs
index 43c1f48e..4d7880ff 100644
--- a/packages/wesley-cli/src/commands/cert-verify.mjs
+++ b/packages/wesley-cli/src/commands/cert-verify.mjs
@@ -18,6 +18,43 @@ export class CertVerifyCommand extends WesleyCommand {
   async executeCore({ options }) {
     const md = await this.ctx.fs.read(options.in);
     const { json } = extractJsonBlock(md);
+    // Validate SHIPME certificate schema first (drift guard)
+    try {
+      const { default: Ajv } = await import('ajv');
+      const { default: addFormats } = await import('ajv-formats');
+      const ajv = new Ajv({ strict: false, allErrors: true });
+      addFormats(ajv);
+      let root = process.env.WESLEY_REPO_ROOT || process.cwd();
+      let realmSchema, shipmeSchema;
+      try {
+        [realmSchema, shipmeSchema] = await Promise.all([
+          this.ctx.fs.read(await this.ctx.fs.join(root, 'schemas', 'realm.schema.json')),
+          this.ctx.fs.read(await this.ctx.fs.join(root, 'schemas', 'shipme.schema.json'))
+        ]);
+      } catch {
+        // Fallback: resolve relative to this module location
+        const { fileURLToPath } = await import('node:url');
+        const { dirname, resolve: pres } = await import('node:path');
+        const modDir = dirname(fileURLToPath(import.meta.url));
+        root = pres(modDir, '../../../..');
+        [realmSchema, shipmeSchema] = await Promise.all([
+          this.ctx.fs.read(pres(root, 'schemas', 'realm.schema.json')),
+          this.ctx.fs.read(pres(root, 'schemas', 'shipme.schema.json'))
+        ]);
+      }
+      ajv.addSchema(JSON.parse(realmSchema));
+      const validate = ajv.compile(JSON.parse(shipmeSchema));
+      const ok = validate(json);
+      if (!ok) {
+        const e = new Error('Certificate JSON failed schema validation');
+        e.code = 'VALIDATION_FAILED';
+        e.meta = validate.errors;
+        throw e;
+      }
+    } catch (e) {
+      e.code = e.code || 'VALIDATION_FAILED';
+      throw e;
+    }
     const canonical = canonicalize({ ...json, signatures: [] });
     const pubs = options.pub || [];
     let validCount = 0;
diff --git a/packages/wesley-cli/src/commands/generate.mjs b/packages/wesley-cli/src/commands/generate.mjs
index c385c841..f6fb88b6 100644
--- a/packages/wesley-cli/src/commands/generate.mjs
+++ b/packages/wesley-cli/src/commands/generate.mjs
@@ -22,6 +22,9 @@ export class GeneratePipelineCommand extends WesleyCommand {
       .option('--stdin', 'Read schema from stdin (alias for --schema -)')
       .option('--ops <dir>', 'Experimental: directory containing *.op.json files to compile (omit to disable)')
       .option('--ops-schema <name>', 'Schema name for emitted ops SQL (default wes_ops)', 'wes_ops')
+      .option('--ops-security <mode>', 'Security for emitted functions: invoker|definer', 'invoker')
+      .option('--ops-search-path <list>', 'Comma-separated search_path for ops functions (e.g., "pg_catalog, wes_ops")')
+      .option('--ops-explain <mode>', 'Emit EXPLAIN JSON snapshots for ops: mock', '')
       .option('--ops-allow-errors', 'Continue compiling remaining ops even if some fail validation (not allowed in CI without override)')
       .option('--emit-bundle', 'Emit .wesley/ evidence bundle')
       .option('--supabase', 'Enable Supabase features (RLS tests)')
@@ -317,11 +320,75 @@ export class GeneratePipelineCommand extends WesleyCommand {
 
   async compileOpsIfRequested(context) {
     const { options, logger } = context;
-    const opsDir = options.ops;
-    if (!opsDir) return;
+    // Discovery: prefer explicit --ops or --ops-manifest, otherwise auto-detect conventional paths
+    let opsDir = options.ops || null;
+    let manifestPath = options.opsManifest || null;
     try {
       const fs = this.ctx.fs;
-      const files = await findOpFiles(fs, opsDir, logger);
+      if (!manifestPath) {
+        for (const c of ['ops/ops.manifest.json', 'ops.manifest.json', 'ops-manifest.json']) {
+          if (await fs.exists(c)) { manifestPath = c; break; }
+        }
+      }
+      if (!opsDir && !manifestPath) {
+        if (await fs.exists('ops')) opsDir = 'ops';
+      }
+      if (!opsDir && !manifestPath) return;
+      // Build PK map from IR so ops emission can derive deterministic tie-breakers from real keys
+      let ir = context.ir;
+      try {
+        if (!ir && context.schemaContent) {
+          ir = this.ctx.parsers.graphql.parse(context.schemaContent);
+        }
+      } catch {}
+      const pkMap = new Map();
+      if (ir && Array.isArray(ir.tables)) {
+        for (const t of ir.tables) {
+          if (t?.name && t?.primaryKey) pkMap.set(String(t.name), String(t.primaryKey));
+        }
+      }
+      const pkResolver = (plan) => {
+        // Find leftmost base table alias + name
+        let r = plan?.root;
+        while (r && r.kind === 'Filter') r = r.input;
+        while (r && r.kind === 'Join') r = r.left;
+        if (r && r.kind === 'Table' && r.alias && r.table) {
+          const pk = pkMap.get(String(r.table));
+          if (pk) return { kind: 'ColumnRef', table: r.alias, column: pk };
+        }
+        return null; // fallback handled in lowerToSQL
+      };
+      let files = [];
+      if (manifestPath) {
+        const manifest = JSON.parse(await fs.read(manifestPath));
+        // Validate manifest
+        try {
+          const { default: Ajv } = await import('ajv');
+          const { default: addFormats } = await import('ajv-formats');
+          const ajv = new Ajv({ strict: false, allErrors: true });
+          addFormats(ajv);
+          const root = process.env.WESLEY_REPO_ROOT || process.cwd();
+          const schemaJson = await fs.read(await fs.join(root, 'schemas', 'ops-manifest.schema.json'));
+          const validate = ajv.compile(JSON.parse(schemaJson));
+          const ok = validate(manifest);
+          if (!ok) {
+            const err = new OpsError('OPS_MANIFEST_INVALID', 'Ops manifest failed schema validation', { errors: validate.errors, file: manifestPath });
+            logger.error(err.meta, err.message);
+            throw err;
+          }
+        } catch (e) {
+          if (!e.code) e.code = 'OPS_MANIFEST_INVALID';
+          throw e;
+        }
+        files = await resolveManifestEntries(fs, manifest.include || [], manifest.exclude || [], logger);
+        if (files.length === 0 && !(JSON.parse(await fs.read(manifestPath)).allowEmpty)) {
+          const err = new OpsError('OPS_EMPTY_SET', 'Ops manifest produced no files and allowEmpty=false', { file: manifestPath });
+          logger.error(err.meta, err.message);
+          throw err;
+        }
+      } else {
+        files = await findOpFiles(fs, opsDir, logger);
+      }
       if (files.length === 0) {
         return;
       }
@@ -379,11 +446,44 @@ export class GeneratePipelineCommand extends WesleyCommand {
       if (compiledOps.length) {
         compiledOps.sort((a, b) => a.order - b.order);
         const orderedOps = compiledOps.map(({ order, ...rest }) => rest);
-        const outFiles = emitOpArtifacts(orderedOps, targetSchema, logger);
+        const security = String(options.opsSecurity || 'invoker');
+        const setSearchPath = options.opsSearchPath
+          ? String(options.opsSearchPath).split(',').map(s => s.trim()).filter(Boolean)
+          : null;
+        const explainMode = (options.opsExplain || '').toLowerCase();
+        const outFiles = emitOpArtifacts(orderedOps, targetSchema, logger, pkResolver, { security, setSearchPath, allowErrors: !!options.opsAllowErrors, explainMode });
         const materialized = materializeArtifacts(outFiles, 'ops', outputPaths);
         await this.ctx.writer.writeFiles(materialized);
         const opsOutputDir = outputPaths.ops;
         logger.info({ count: outFiles.length, dir: opsOutputDir }, 'Compiled operations (experimental)');
+
+        // Validate generated registry.json against schema
+        try {
+          const registryPath = await this.ctx.fs.join(opsOutputDir, 'registry.json');
+          if (await this.ctx.fs.exists(registryPath)) {
+            const [{ default: Ajv }, { default: addFormats }] = await Promise.all([
+              import('ajv'),
+              import('ajv-formats')
+            ]);
+            const ajv = new Ajv({ strict: false, allErrors: true });
+            addFormats(ajv);
+            const root = process.env.WESLEY_REPO_ROOT || process.cwd();
+            const schemaJson = await this.ctx.fs.read(await this.ctx.fs.join(root, 'schemas', 'ops-registry.schema.json'));
+            const schema = JSON.parse(schemaJson);
+            const reg = JSON.parse((await this.ctx.fs.read(registryPath)).toString('utf8'));
+            const validate = ajv.compile(schema);
+            if (!validate(reg)) {
+              const err = new OpsError('OPS_REGISTRY_INVALID', 'Generated ops registry failed schema validation', { errors: validate.errors, file: registryPath });
+              this.ctx.logger.error(err.meta, err.message);
+              if (!options.opsAllowErrors) throw err;
+            } else {
+              this.ctx.logger.info({ file: registryPath }, 'Ops registry validated');
+            }
+          }
+        } catch (ve) {
+          this.ctx.logger.warn({ error: ve?.message }, 'Ops registry validation skipped due to error');
+          if (!options.opsAllowErrors) throw ve;
+        }
       }
     } catch (e) {
       logger.error({ code: e?.code, error: e?.message }, 'Experimental --ops failed');
@@ -434,21 +534,46 @@ async function findOpFiles(fs, opsDir, logger) {
     logger.info({ opsDir }, 'Experimental --ops: directory not found; skipping');
     return [];
   }
-  const dirEntries = await fs.readDir?.(opsDir);
-  if (!Array.isArray(dirEntries)) {
+  const acc = [];
+  const walk = async (dir) => {
+    const entries = await fs.readDir?.(dir);
+    if (!Array.isArray(entries)) return;
+    for (const e of entries) {
+      if (e.isDirectory) {
+        await walk(e.path);
+      } else if (e.isFile && e.name?.endsWith?.('.op.json')) {
+        acc.push(e.path || await fs.join(dir, e.name));
+      }
+    }
+  };
+  await walk(opsDir);
+  acc.sort(); // locale-invariant deterministic ordering
+  if (acc.length === 0) {
     logger.info({ opsDir }, 'Experimental --ops: no *.op.json files found; skipping');
-    return [];
   }
-  const candidates = dirEntries.filter(entry => entry.name?.endsWith?.('.op.json'));
-  if (candidates.length === 0) {
-    logger.info({ opsDir }, 'Experimental --ops: no *.op.json files found; skipping');
-    return [];
+  return acc;
+}
+
+async function resolveManifestEntries(fs, includes = [], excludes = [], logger) {
+  const acc = new Set();
+  const addDir = async (dir) => {
+    const entries = await fs.readDir(dir);
+    for (const e of entries) {
+      if (e.isDirectory) await addDir(e.path);
+      else if (e.isFile && e.name?.endsWith?.('.op.json')) acc.add(e.path);
+    }
+  };
+  for (const entry of includes) {
+    if (!entry) continue;
+    const path = entry;
+    const isDir = await fs.readDir?.(path).then(()=>true).catch(()=>false);
+    if (isDir) await addDir(path);
+    else if (await fs.exists(path)) acc.add(path);
   }
-  const files = await Promise.all(
-    candidates.map(async entry => entry.path || await fs.join(opsDir, entry.name))
-  );
-  files.sort(); // Use default code-point ordering for locale-invariant sorting.
-  return files;
+  const excluded = (p) => excludes.some(ex => p === ex || p.endsWith(ex));
+  const list = Array.from(acc).filter(p => !excluded(p)).sort();
+  if (list.length === 0) logger.info({ includes, excludes }, 'ops manifest resolved no files');
+  return list;
 }
 
 async function compileOpFile(fs, path, collisions, logger) {
@@ -495,23 +620,85 @@ async function compileOpFile(fs, path, collisions, logger) {
   return { baseName, plan, isParamless: paramCount === 0, path };
 }
 
-function emitOpArtifacts(compiledOps, targetSchema, logger) {
+function emitOpArtifacts(compiledOps, targetSchema, logger, pkResolver, { security = 'invoker', setSearchPath = null, allowErrors = false, explainMode = '' } = {}) {
   const outFiles = [];
   const total = compiledOps.length;
   let ordinal = 0;
+  const deployChunks = [`BEGIN;`, `CREATE SCHEMA IF NOT EXISTS "${targetSchema}";`];
+  const registry = { version: '1.0.0', schema: targetSchema, ops: [] };
   for (const entry of compiledOps) {
     ordinal += 1;
     const { baseName, plan, isParamless, path } = entry;
-    const fnSql = emitFunction(baseName, plan, { schema: targetSchema });
-    if (isParamless) {
-      const viewSql = emitView(baseName, plan, { schema: targetSchema });
-      outFiles.push({ name: `${baseName}.view.sql`, content: `${viewSql}\n` });
+    let emitted = false;
+    try {
+      const fnSql = emitFunction(baseName, plan, { schema: targetSchema, identPolicy: 'strict', pkResolver, security, setSearchPath });
+      if (isParamless) {
+        const viewSql = emitView(baseName, plan, { schema: targetSchema, identPolicy: 'strict', pkResolver });
+        outFiles.push({ name: `${baseName}.view.sql`, content: `${viewSql}\n` });
+        deployChunks.push(viewSql);
+      }
+      outFiles.push({ name: `${baseName}.fn.sql`, content: `${fnSql}\n` });
+      deployChunks.push(fnSql);
+      emitted = true;
+    } catch (e) {
+      if (!allowErrors) throw e;
+      logger.warn({ op: baseName, file: path, error: e?.message }, 'Skipping op during emission due to error');
     }
-    outFiles.push({ name: `${baseName}.fn.sql`, content: `${fnSql}\n` });
     logger.info(
       { ordinal, total, sanitized: baseName, file: path, schema: targetSchema, code: 'OPS_DISCOVERY' },
       'ops: compiled operation'
     );
+
+    // Build registry entry (deterministic)
+    try {
+      const params = (collectParams(plan)?.ordered || []).map(p => ({ name: String(p.name), type: p.typeHint || 'text' }));
+      const projItems = Array.isArray(plan?.projection?.items) ? plan.projection.items.map(i => String(i?.alias || '')).filter(Boolean) : [];
+      const opId = derivePrefixedIdentifier(baseName);
+      const entryJson = {
+        name: baseName,
+        sql: {
+          schema: targetSchema,
+          function: opId,
+          view: isParamless ? opId : null
+        },
+        params,
+        projection: {
+          star: projItems.length === 0,
+          items: projItems
+        },
+        files: {
+          function: `${baseName}.fn.sql`,
+          view: isParamless ? `${baseName}.view.sql` : null
+        },
+        sourceFile: path
+      };
+      if (emitted) registry.ops.push(entryJson);
+    } catch (e) {
+      logger.warn({ file: path, error: e?.message }, 'Failed to record registry entry');
+    }
+
+    // Optional EXPLAIN JSON snapshot (mock only for now)
+    if (emitted && String(explainMode).toLowerCase() === 'mock') {
+      const explain = {
+        Plan: { 'Node Type': 'Result', Plans: [] },
+        Mock: true,
+        Version: 1
+      };
+      outFiles.push({ name: `explain/${baseName}.explain.json`, content: JSON.stringify(explain, null, 2) + '\n' });
+    }
+  }
+  deployChunks.push('COMMIT;');
+  outFiles.push({ name: `ops_deploy.sql`, content: deployChunks.join('\n\n') + '\n' });
+  // Emit registry.json next to SQL outputs
+  try {
+    const registryStr = JSON.stringify({
+      version: registry.version,
+      schema: registry.schema,
+      ops: registry.ops.sort((a, b) => a.name.localeCompare(b.name))
+    }, null, 2) + '\n';
+    outFiles.push({ name: `registry.json`, content: registryStr });
+  } catch (e) {
+    logger.warn({ error: e?.message }, 'Failed to emit ops registry');
   }
   return outFiles;
 }
diff --git a/packages/wesley-cli/src/commands/plan.mjs b/packages/wesley-cli/src/commands/plan.mjs
index f841bcd7..cb0cf88d 100644
--- a/packages/wesley-cli/src/commands/plan.mjs
+++ b/packages/wesley-cli/src/commands/plan.mjs
@@ -52,8 +52,28 @@ export class PlanCommand extends WesleyCommand {
     const mapping = buildMapping(plan);
 
     if (options.json) {
-      this.ctx.stdout.write(JSON.stringify({ plan, explain, mapping, radar }, null, 2) + '\n');
-      return { phases: plan.phases.length, steps: explain.steps.length };
+      // Validate JSON against schema to prevent drift
+      try {
+        const { default: Ajv } = await import('ajv');
+        const { default: addFormats } = await import('ajv-formats');
+        const ajv = new Ajv({ strict: false, allErrors: true });
+        addFormats(ajv);
+        const schemaJson = await this.ctx.fs.read((await this.ctx.fs.join(process.env.WESLEY_REPO_ROOT || process.cwd(), 'schemas', 'plan-report.schema.json')));
+        const validate = ajv.compile(JSON.parse(schemaJson));
+        const report = { plan, explain, mapping, radar };
+        const ok = validate(report);
+        if (!ok) {
+          const e = new Error('Plan report failed schema validation');
+          e.code = 'VALIDATION_FAILED';
+          e.meta = validate.errors;
+          throw e;
+        }
+        this.ctx.stdout.write(JSON.stringify(report, null, 2) + '\n');
+        return { phases: plan.phases.length, steps: explain.steps.length };
+      } catch (e) {
+        e.code = e.code || 'VALIDATION_FAILED';
+        throw e;
+      }
     }
 
     if (options.explain) {
diff --git a/packages/wesley-cli/src/commands/qir-validate.mjs b/packages/wesley-cli/src/commands/qir-validate.mjs
new file mode 100644
index 00000000..45b7f7df
--- /dev/null
+++ b/packages/wesley-cli/src/commands/qir-validate.mjs
@@ -0,0 +1,155 @@
+import { WesleyCommand } from '../framework/WesleyCommand.mjs';
+
+export class QirValidateCommand extends WesleyCommand {
+  constructor(ctx) {
+    super(ctx, 'qir', 'QIR utilities');
+  }
+
+  configureCommander(cmd) {
+    const root = cmd
+      .command('validate')
+      .description('Validate a QIR JSON file against schemas/qir.schema.json')
+      .argument('<file>', 'Path to QIR JSON file')
+      .option('--json', 'Emit JSON output')
+      .action(async (file, options) => {
+        return this.execute({ ...options, file });
+      });
+    // Envelope validation
+    cmd
+      .command('envelope-validate')
+      .description('Validate an IR envelope JSON against schemas (Schema IR + QIR plans)')
+      .argument('<file>', 'Path to IR envelope JSON file')
+      .option('--json', 'Emit JSON output')
+      .action(async (file, options) => {
+        return this.execute({ ...options, file, envelope: true });
+      });
+
+    // Ops manifest validation
+    cmd
+      .command('manifest-validate')
+      .description('Validate an ops manifest JSON against schemas/ops-manifest.schema.json')
+      .argument('<file>', 'Path to ops manifest JSON')
+      .option('--json', 'Emit JSON output')
+      .action(async (file, options) => {
+        return this.execute({ ...options, file, manifest: true });
+      });
+
+    // Ops registry validation
+    cmd
+      .command('registry-validate')
+      .description('Validate an ops registry JSON against schemas/ops-registry.schema.json')
+      .argument('<file>', 'Path to ops registry JSON')
+      .option('--json', 'Emit JSON output')
+      .action(async (file, options) => {
+        return this.execute({ ...options, file, registry: true });
+      });
+    return root;
+  }
+
+  async executeCore(context) {
+    const { fs, logger } = this.ctx;
+    const { options } = context;
+    const input = options.file;
+    if (!input) {
+      const e = new Error('Expected a path to a QIR JSON file');
+      e.code = 'ENOENT';
+      throw e;
+    }
+
+    // Lazy import Ajv at runtime in CLI to avoid adding core deps
+    const [{ default: Ajv }, { default: addFormats }] = await Promise.all([
+      import('ajv'),
+      import('ajv-formats')
+    ]);
+
+    const ajv = new Ajv({ strict: false, allErrors: true });
+    addFormats(ajv);
+
+    if (options.envelope) {
+      const root = process.env.WESLEY_REPO_ROOT || process.cwd();
+      const [schemaIR, schemaQIR, schemaEnv, envJson] = await Promise.all([
+        fs.read(await this.ctx.fs.join(root, 'schemas', 'ir.schema.json')),
+        fs.read(await this.ctx.fs.join(root, 'schemas', 'qir.schema.json')),
+        fs.read(await this.ctx.fs.join(root, 'schemas', 'ir-envelope.schema.json')).catch(() => '{}'),
+        fs.read(input)
+      ]);
+      const ir = JSON.parse(schemaIR);
+      const qir = JSON.parse(schemaQIR);
+      const envSchema = JSON.parse(schemaEnv);
+      const env = JSON.parse(envJson);
+      ajv.addSchema(ir);
+      ajv.addSchema(qir);
+      const validate = ajv.compile(envSchema);
+      const ok = validate(env);
+      if (!ok) {
+        const err = new Error('IR envelope validation failed');
+        err.code = 'VALIDATION_FAILED';
+        err.meta = { errors: validate.errors };
+        logger.error({ errors: validate.errors }, err.message);
+        throw err;
+      }
+      if (!options.json) logger.info({ file: input }, 'IR envelope validation OK');
+      return { valid: true, file: input, kind: 'envelope' };
+    } else if (options.manifest) {
+      const root = process.env.WESLEY_REPO_ROOT || process.cwd();
+      const [schemaJson, manJson] = await Promise.all([
+        fs.read(await this.ctx.fs.join(root, 'schemas', 'ops-manifest.schema.json')),
+        fs.read(input)
+      ]);
+      const schema = JSON.parse(schemaJson);
+      const manifest = JSON.parse(manJson);
+      const validate = ajv.compile(schema);
+      const ok = validate(manifest);
+      if (!ok) {
+        const err = new Error('Ops manifest validation failed');
+        err.code = 'VALIDATION_FAILED';
+        err.meta = { errors: validate.errors };
+        logger.error({ errors: validate.errors }, err.message);
+        throw err;
+      }
+      if (!options.json) logger.info({ file: input }, 'Ops manifest validation OK');
+      return { valid: true, file: input, kind: 'ops-manifest' };
+    } else if (options.registry) {
+      const root = process.env.WESLEY_REPO_ROOT || process.cwd();
+      const [schemaJson, regJson] = await Promise.all([
+        fs.read(await this.ctx.fs.join(root, 'schemas', 'ops-registry.schema.json')),
+        fs.read(input)
+      ]);
+      const schema = JSON.parse(schemaJson);
+      const registry = JSON.parse(regJson);
+      const validate = ajv.compile(schema);
+      const ok = validate(registry);
+      if (!ok) {
+        const err = new Error('Ops registry validation failed');
+        err.code = 'VALIDATION_FAILED';
+        err.meta = { errors: validate.errors };
+        logger.error({ errors: validate.errors }, err.message);
+        throw err;
+      }
+      if (!options.json) logger.info({ file: input }, 'Ops registry validation OK');
+      return { valid: true, file: input, kind: 'ops-registry' };
+    } else {
+      const root = process.env.WESLEY_REPO_ROOT || process.cwd();
+      const schemaPath = await this.ctx.fs.join(root, 'schemas', 'qir.schema.json');
+      const [schemaJson, planJson] = await Promise.all([
+        fs.read(schemaPath),
+        fs.read(input)
+      ]);
+      const schema = JSON.parse(schemaJson);
+      const plan = JSON.parse(planJson);
+      const validate = ajv.compile(schema);
+      const ok = validate(plan);
+      if (!ok) {
+        const err = new Error('QIR validation failed');
+        err.code = 'VALIDATION_FAILED';
+        err.meta = { errors: validate.errors };
+        logger.error({ errors: validate.errors }, err.message);
+        throw err;
+      }
+      if (!options.json) logger.info({ file: input }, 'QIR validation OK');
+      return { valid: true, file: input, kind: 'qir' };
+    }
+  }
+}
+
+export default QirValidateCommand;
diff --git a/packages/wesley-cli/src/commands/rehearse.mjs b/packages/wesley-cli/src/commands/rehearse.mjs
index cc541235..794120de 100644
--- a/packages/wesley-cli/src/commands/rehearse.mjs
+++ b/packages/wesley-cli/src/commands/rehearse.mjs
@@ -34,7 +34,27 @@ export class RehearseCommand extends WesleyCommand {
 
     if (options.dryRun) {
       if (options.json) {
-        this.ctx.stdout.write(JSON.stringify({ plan, explain }, null, 2) + '\n');
+        // For dry-run, we output the plan/explain pair; validate plan half using plan-report subset
+        try {
+          const { default: Ajv } = await import('ajv');
+          const { default: addFormats } = await import('ajv-formats');
+          const ajv = new Ajv({ strict: false, allErrors: true });
+          addFormats(ajv);
+          const schemaJson = await this.ctx.fs.read((await this.ctx.fs.join(process.env.WESLEY_REPO_ROOT || process.cwd(), 'schemas', 'plan-report.schema.json')));
+          const validate = ajv.compile(JSON.parse(schemaJson));
+          const minimal = { plan, explain, mapping: [], radar: { lines: [], counts: {} } };
+          const ok = validate(minimal);
+          if (!ok) {
+            const e = new Error('Dry-run plan failed schema validation');
+            e.code = 'VALIDATION_FAILED';
+            e.meta = validate.errors;
+            throw e;
+          }
+          this.ctx.stdout.write(JSON.stringify({ plan, explain }, null, 2) + '\n');
+        } catch (e) {
+          e.code = e.code || 'VALIDATION_FAILED';
+          throw e;
+        }
       } else {
         logger.info('🧭 REALM Dry Run');
         for (const line of explain.lines) logger.info(line);
@@ -82,7 +102,10 @@ export class RehearseCommand extends WesleyCommand {
       await this.ctx.fs.write('.wesley/realm.json', JSON.stringify(realm, null, 2));
       if (!options.json) logger.info('🕶️ REALM verdict: PASS');
       if (hooks.postDown) await runHook(this.ctx, hooks.postDown, logger);
-      if (options.json) this.ctx.stdout.write(JSON.stringify(realm, null, 2) + '\n');
+      if (options.json) {
+        await validateRealm(this.ctx, realm);
+        this.ctx.stdout.write(JSON.stringify(realm, null, 2) + '\n');
+      }
       return realm;
     } catch (error) {
       const realm = {
@@ -95,7 +118,10 @@ export class RehearseCommand extends WesleyCommand {
       await this.ctx.fs.write('.wesley/realm.json', JSON.stringify(realm, null, 2));
       if (!options.json) logger.error('🕶️ REALM verdict: FAIL - ' + error.message);
       if (hooks.postDown) try { await runHook(this.ctx, hooks.postDown, logger); } catch {}
-      if (options.json) this.ctx.stdout.write(JSON.stringify(realm, null, 2) + '\n');
+      if (options.json) {
+        await validateRealm(this.ctx, realm);
+        this.ctx.stdout.write(JSON.stringify(realm, null, 2) + '\n');
+      }
       const e = new Error('REALM rehearsal failed: ' + error.message);
       e.code = 'REALM_FAILED';
       throw e;
@@ -209,3 +235,19 @@ function emitMigrations(plan) {
 }
 
 export default RehearseCommand;
+
+async function validateRealm(ctx, realm) {
+  const { default: Ajv } = await import('ajv');
+  const { default: addFormats } = await import('ajv-formats');
+  const ajv = new Ajv({ strict: false, allErrors: true });
+  addFormats(ajv);
+  const schemaJson = await ctx.fs.read((await ctx.fs.join(process.env.WESLEY_REPO_ROOT || process.cwd(), 'schemas', 'realm.schema.json')));
+  const validate = ajv.compile(JSON.parse(schemaJson));
+  const ok = validate(realm);
+  if (!ok) {
+    const e = new Error('REALM report failed schema validation');
+    e.code = 'VALIDATION_FAILED';
+    e.meta = validate.errors;
+    throw e;
+  }
+}
diff --git a/packages/wesley-cli/src/program.mjs b/packages/wesley-cli/src/program.mjs
index 9fe3bd92..0f0dccea 100644
--- a/packages/wesley-cli/src/program.mjs
+++ b/packages/wesley-cli/src/program.mjs
@@ -20,6 +20,7 @@ import { ValidateBundleCommand } from './commands/validate-bundle.mjs';
 import { BladeCommand } from './commands/blade.mjs';
 import { InitCommand } from './commands/init.mjs';
 import { UpCommand } from './commands/up.mjs';
+import { QirValidateCommand } from './commands/qir-validate.mjs';
 
 export async function program(argv, ctx) {
   // Create commands with context (auto-registers them)
@@ -35,6 +36,7 @@ export async function program(argv, ctx) {
   new BladeCommand(ctx);
   new InitCommand(ctx);
   new UpCommand(ctx);
+  new QirValidateCommand(ctx);
   
   // TODO: Add other commands when they're updated
   // new ModelsCommand(ctx);
diff --git a/packages/wesley-cli/test/ops-explain.bats b/packages/wesley-cli/test/ops-explain.bats
new file mode 100644
index 00000000..6e1ad442
--- /dev/null
+++ b/packages/wesley-cli/test/ops-explain.bats
@@ -0,0 +1,32 @@
+#!/usr/bin/env bats
+
+load 'bats-plugins/bats-assert/load'
+load 'bats-plugins/bats-file/load'
+
+setup() {
+  ROOT_DIR="$(git rev-parse --show-toplevel)"
+  CLI="$ROOT_DIR/packages/wesley-host-node/bin/wesley.mjs"
+  OUT="$ROOT_DIR/out/examples"
+  rm -rf "$OUT"
+}
+
+@test "ops: emits mock EXPLAIN JSON snapshots with --ops-explain mock" {
+  run node "$CLI" generate \
+    --schema "$ROOT_DIR/test/fixtures/examples/ecommerce.graphql" \
+    --out-dir "$OUT" \
+    --ops "$ROOT_DIR/test/fixtures/examples/ops" \
+    --ops-explain mock \
+    --ops-allow-errors \
+    --allow-dirty
+
+  assert_success
+
+  REG="$OUT/ops/registry.json"
+  EXPL="$OUT/ops/explain/products_by_name.explain.json"
+
+  assert_file_exists "$REG"
+  assert_file_exists "$EXPL"
+
+  run jq -e '.Plan | type == "object" and (."Node Type" != null)' "$EXPL"
+  assert_success
+}
diff --git a/packages/wesley-cli/test/plan-report-schema.bats b/packages/wesley-cli/test/plan-report-schema.bats
new file mode 100644
index 00000000..fc0085d9
--- /dev/null
+++ b/packages/wesley-cli/test/plan-report-schema.bats
@@ -0,0 +1,10 @@
+#!/usr/bin/env bats
+
+@test "plan --explain --json validates against plan-report.schema.json" {
+  run node ../wesley-host-node/bin/wesley.mjs plan --schema ../../test/fixtures/examples/schema.graphql --explain --json
+  if [ "$status" -ne 0 ]; then
+    echo "OUTPUT:$output"
+  fi
+  [ "$status" -eq 0 ]
+}
+
diff --git a/packages/wesley-cli/test/qir-envelope-schema.bats b/packages/wesley-cli/test/qir-envelope-schema.bats
new file mode 100644
index 00000000..7b51e9a4
--- /dev/null
+++ b/packages/wesley-cli/test/qir-envelope-schema.bats
@@ -0,0 +1,10 @@
+#!/usr/bin/env bats
+
+@test "IR envelope schema validates sample envelope" {
+  export WESLEY_LOG_FORMAT=text
+  run env WESLEY_LOG_FORMAT=text node ../wesley-host-node/bin/wesley.mjs qir envelope-validate ../../test/fixtures/qir/sample-envelope.json
+  if [ "$status" -ne 0 ]; then
+    echo "OUTPUT:$output"
+  fi
+  [ "$status" -eq 0 ]
+}
diff --git a/packages/wesley-cli/test/qir-schema.bats b/packages/wesley-cli/test/qir-schema.bats
new file mode 100644
index 00000000..7e50c52c
--- /dev/null
+++ b/packages/wesley-cli/test/qir-schema.bats
@@ -0,0 +1,41 @@
+#!/usr/bin/env bats
+
+@test "QIR schema validates representative plans (Ajv)" {
+  run node - <<'NODE'
+    import Ajv from 'ajv';
+    import addFormats from 'ajv-formats';
+    import { readFileSync } from 'node:fs';
+    import { resolve } from 'node:path';
+
+    const schemaPath = resolve(process.cwd(), '../../schemas/qir.schema.json');
+    const schema = JSON.parse(readFileSync(schemaPath, 'utf8'));
+    const ajv = new Ajv({ strict: false, allErrors: true });
+    addFormats(ajv);
+    const validate = ajv.compile(schema);
+
+    const flat = {
+      root: { kind: 'Filter', input: { kind: 'Table', table: 'organization', alias: 't0' }, predicate: { kind: 'Compare', left: { kind: 'ColumnRef', table: 't0', column: 'deleted_at' }, op: 'isNull' } },
+      projection: { items: [ { alias: 'id', expr: { kind: 'ColumnRef', table: 't0', column: 'id' } } ] }
+    };
+    if (!validate(flat)) { console.error(validate.errors); process.exit(1); }
+
+    const child = {
+      root: { kind: 'Table', table: 'membership', alias: 'm' },
+      projection: { items: [ { alias: 'member', expr: { kind: 'JsonBuildObject', fields: [ { key: 'user_id', value: { kind: 'ColumnRef', table: 'm', column: 'user_id' } } ] } } ] }
+    };
+    const nested = {
+      root: {
+        kind: 'Join',
+        left: { kind: 'Table', table: 'organization', alias: 'o' },
+        right: { kind: 'Lateral', plan: child, alias: 'l0' },
+        joinType: 'LEFT',
+        on: { kind: 'Compare', op: 'eq', left: { kind: 'Literal', value: true }, right: { kind: 'Literal', value: true } }
+      },
+      projection: { items: [ { alias: 'id', expr: { kind: 'ColumnRef', table: 'o', column: 'id' } }, { alias: 'members', expr: { kind: 'JsonAgg', value: { kind: 'ScalarSubquery', plan: child } } } ] }
+    };
+    if (!validate(nested)) { console.error(validate.errors); process.exit(1); }
+    console.log('ok');
+NODE
+  [ "$status" -eq 0 ]
+  [[ "$output" == *ok* ]]
+}
diff --git a/packages/wesley-cli/test/realm-schema.bats b/packages/wesley-cli/test/realm-schema.bats
new file mode 100644
index 00000000..685c7422
--- /dev/null
+++ b/packages/wesley-cli/test/realm-schema.bats
@@ -0,0 +1,10 @@
+#!/usr/bin/env bats
+
+@test "rehearse --dry-run --json validates against realm.schema.json" {
+  run node ../wesley-host-node/bin/wesley.mjs rehearse --schema ../../test/fixtures/examples/schema.graphql --dry-run --json
+  if [ "$status" -ne 0 ]; then
+    echo "OUTPUT:$output"
+  fi
+  [ "$status" -eq 0 ]
+}
+
diff --git a/packages/wesley-core/src/domain/qir/Cursor.mjs b/packages/wesley-core/src/domain/qir/Cursor.mjs
new file mode 100644
index 00000000..e1adc423
--- /dev/null
+++ b/packages/wesley-core/src/domain/qir/Cursor.mjs
@@ -0,0 +1,15 @@
+export function encodeCursor(obj) {
+  const json = JSON.stringify(obj == null ? {} : obj);
+  return Buffer.from(json, 'utf8').toString('base64url');
+}
+
+export function decodeCursor(str) {
+  if (!str) return {};
+  try {
+    const json = Buffer.from(String(str), 'base64url').toString('utf8');
+    return JSON.parse(json);
+  } catch {
+    return {};
+  }
+}
+
diff --git a/packages/wesley-core/src/domain/qir/Nodes.mjs b/packages/wesley-core/src/domain/qir/Nodes.mjs
index 54e096b6..10e71217 100644
--- a/packages/wesley-core/src/domain/qir/Nodes.mjs
+++ b/packages/wesley-core/src/domain/qir/Nodes.mjs
@@ -4,12 +4,13 @@
  */
 
 export class QueryPlan {
-  constructor(root, projection, { orderBy = [], limit = null, offset = null } = {}) {
+  constructor(root, projection, { orderBy = [], limit = null, offset = null, distinctOn = [] } = {}) {
     this.root = root; // RelationNode
     this.projection = projection; // Projection
     this.orderBy = orderBy; // OrderBy[]
     this.limit = limit; // number|null
     this.offset = offset; // number|null
+    this.distinctOn = distinctOn; // Expr[]
   }
 }
 
@@ -89,4 +90,3 @@ export class AliasAllocator {
   constructor(prefix = 't') { this.prefix = prefix; this.count = 0; }
   next() { return `${this.prefix}${this.count++}`; }
 }
-
diff --git a/packages/wesley-core/src/domain/qir/OpPlanBuilder.mjs b/packages/wesley-core/src/domain/qir/OpPlanBuilder.mjs
index 07e10b8e..ba956080 100644
--- a/packages/wesley-core/src/domain/qir/OpPlanBuilder.mjs
+++ b/packages/wesley-core/src/domain/qir/OpPlanBuilder.mjs
@@ -203,6 +203,10 @@ function buildOnPredicate(on, leftDefault, rightAlias) {
     if (!table || typeof table !== 'string' || !column || typeof column !== 'string') {
       throw new Error(`Invalid column reference in join.on: ${JSON.stringify(r)}`);
     }
+    // Diagnostics: discourage ambiguous unqualified refs like 'id'
+    if (typeof r === 'string' && r.indexOf('.') === -1 && r.toLowerCase() === 'id') {
+      throw new Error(`Ambiguous join reference '${r}'. Qualify as '<alias>.id' or pass { table, column } to join.on`);
+    }
     return new ColumnRef(table, column);
   };
   const op = String(on.op || 'eq');
@@ -215,14 +219,27 @@ function buildRightExpr(param, value, op) {
   if (param && param.name) {
     const name = String(param.name);
     let typeHint = param.type ? String(param.type) : undefined;
+    // Security hardening: require explicit types for risky operators
+    if (op === 'in') {
+      if (!typeHint) throw new Error(`Param '${name}' requires an explicit array type for IN (e.g., text[])`);
+      if (!typeHint.endsWith('[]')) typeHint = typeHint + '[]';
+    }
+    if (op === 'like' || op === 'ilike') {
+      if (!typeHint) throw new Error(`Param '${name}' requires an explicit type for ${op.toUpperCase()} (e.g., text)`);
+    }
+    if (op === 'contains' && !typeHint) {
+      throw new Error(`Param '${name}' requires an explicit type for CONTAINS (e.g., jsonb or text[])`);
+    }
     if (typeHint && !ALLOWED_PARAM_TYPES.has(typeHint.replace(/\[\]$/, ''))) {
       throw new Error(`Unsupported param type: ${typeHint} for ${name}`);
     }
-    if (op === 'in' && typeHint && !typeHint.endsWith('[]')) typeHint = typeHint + '[]';
     const p = new ParamRef(name);
     if (typeHint) p.typeHint = typeHint;
     return p;
   }
   // Fallback to literal value
+  if (op === 'in') {
+    throw new Error(`IN operator requires a parameter with explicit array type (e.g., text[])`);
+  }
   return { kind: 'Literal', value };
 }
diff --git a/packages/wesley-core/src/domain/qir/emit.mjs b/packages/wesley-core/src/domain/qir/emit.mjs
index 0e15f4db..be64313d 100644
--- a/packages/wesley-core/src/domain/qir/emit.mjs
+++ b/packages/wesley-core/src/domain/qir/emit.mjs
@@ -20,23 +20,39 @@ const RESERVED = new Set([
   'select','insert','update','delete','from','where','group','order','by','limit','offset','join','left','right','on','and','or','not','null','true','false','table','view','function','schema','user'
 ]);
 
-export function emitView(opName, plan, { schema = DEFAULT_SCHEMA } = {}) {
+export function emitView(opName, plan, { schema = DEFAULT_SCHEMA, identPolicy = 'strict', pkResolver = null } = {}) {
   const name = qualifiedOpName(schema, opName);
-  const selectSql = lowerToSQL(plan);
+  const selectSql = lowerToSQL(plan, null, { identPolicy, pkResolver });
   return `CREATE OR REPLACE VIEW ${name} AS\n${selectSql};`;
 }
 
-export function emitFunction(opName, plan, { schema = DEFAULT_SCHEMA } = {}) {
+export function emitFunction(opName, plan, {
+  schema = DEFAULT_SCHEMA,
+  identPolicy = 'strict',
+  pkResolver = null,
+  security = 'invoker',
+  setSearchPath = null,
+} = {}) {
   const name = qualifiedOpName(schema, opName);
   const { ordered } = collectParams(plan);
   const params = uniqueParamNames(ordered).map(({ display, type }) => `${display} ${type || 'text'}`).join(', ');
-  const selectSql = lowerToSQL(plan);
+  const selectSql = lowerToSQL(plan, null, { identPolicy, pkResolver });
   const body = `SELECT to_jsonb(q.*) FROM (\n${selectSql}\n) AS q`;
+  const attrs = [];
+  // Language and volatility first
+  attrs.push('LANGUAGE sql');
+  attrs.push('STABLE');
+  // SECURITY { INVOKER | DEFINER }
+  const sec = String(security || 'invoker').toLowerCase() === 'definer' ? 'SECURITY DEFINER' : 'SECURITY INVOKER';
+  attrs.push(sec);
+  // Optional: SET search_path = <list>
+  const sp = renderSearchPath(setSearchPath);
+  if (sp) attrs.push(`SET search_path = ${sp}`);
+
   return [
     `CREATE OR REPLACE FUNCTION ${name}(${params})`,
     `RETURNS SETOF jsonb`,
-    `LANGUAGE sql`,
-    `STABLE`,
+    ...attrs,
     `AS $$`,
     body,
     `$$;`
@@ -110,3 +126,12 @@ function uniqueParamNames(ordered) {
   }
   return out;
 }
+
+function renderSearchPath(sp) {
+  if (!sp) return '';
+  let parts = Array.isArray(sp) ? sp : String(sp).split(',');
+  parts = parts.map((p) => String(p).trim()).filter(Boolean);
+  if (parts.length === 0) return '';
+  // Quote identifiers deterministically
+  return parts.map((p) => sanitizeIdent(p)).join(', ');
+}
diff --git a/packages/wesley-core/src/domain/qir/identifiers.mjs b/packages/wesley-core/src/domain/qir/identifiers.mjs
new file mode 100644
index 00000000..9a680b37
--- /dev/null
+++ b/packages/wesley-core/src/domain/qir/identifiers.mjs
@@ -0,0 +1,67 @@
+/**
+ * Identifier validation and quoting utilities for QIR → SQL.
+ *
+ * Goals
+ * - Provide a single source of truth for identifier rules
+ * - Support both minimal (legacy) and strict policies
+ * - Avoid surprises around reserved keywords and invalid characters
+ */
+
+// A pragmatic reserved keyword set covering common PostgreSQL tokens.
+// Not exhaustive; intended to catch obvious collisions.
+export const RESERVED = new Set([
+  'all','analyze','and','as','asc','between','by','case','check','collate','column','constraint',
+  'create','cross','current_catalog','current_date','current_role','current_schema','current_time',
+  'current_timestamp','default','delete','desc','distinct','do','else','end','except','exists',
+  'false','fetch','for','foreign','from','full','group','having','ilike','in','inner','insert','intersect',
+  'into','is','join','left','like','limit','localtime','localtimestamp','natural','not','null','offset',
+  'on','or','order','outer','primary','references','returning','right','select','session_user',
+  'some','table','then','to','true','union','unique','update','user','using','values','view','when','where',
+]);
+
+const IDENT_SAFE_RE = /^[a-z_][a-z0-9_]*$/; // canonical unquoted identifier
+
+export function needsQuoting(ident) {
+  const s = String(ident);
+  return !IDENT_SAFE_RE.test(s) || RESERVED.has(s.toLowerCase());
+}
+
+export function quoteIdent(ident) {
+  const s = String(ident);
+  return '"' + s.replace(/"/g, '""') + '"';
+}
+
+/**
+ * Validate identifier per policy and return the SQL-safe rendering.
+ *
+ * Policies:
+ * - minimal (default): quote only if necessary (legacy behavior)
+ * - strict: validate allowed pattern and always quote; throw on RESERVED
+ */
+export function renderIdent(ident, { policy = 'minimal' } = {}) {
+  const s = String(ident);
+  if (policy === 'strict') {
+    if (!IDENT_SAFE_RE.test(s)) {
+      throw new Error(`Invalid SQL identifier: ${s}`);
+    }
+    if (RESERVED.has(s.toLowerCase())) {
+      throw new Error(`Identifier collides with reserved keyword: ${s}`);
+    }
+    return quoteIdent(s);
+  }
+  // minimal
+  return needsQuoting(s) ? quoteIdent(s) : s;
+}
+
+/**
+ * Sanitize display/base names for generated idents (lowercased, underscores,
+ * trimmed). Used for op names and parameter bases. Length limit enforced by caller.
+ */
+export function sanitizeIdentBase(s, fallback = 'unnamed') {
+  const base = String(s || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '');
+  return base || fallback;
+}
+
diff --git a/packages/wesley-core/src/domain/qir/lowerToSQL.mjs b/packages/wesley-core/src/domain/qir/lowerToSQL.mjs
index e1389b99..128e20cc 100644
--- a/packages/wesley-core/src/domain/qir/lowerToSQL.mjs
+++ b/packages/wesley-core/src/domain/qir/lowerToSQL.mjs
@@ -12,47 +12,50 @@
  */
 
 import { collectParams } from './ParamCollector.mjs';
+import { renderIdent } from './identifiers.mjs';
 
 // Lightweight helpers
 const isObject = (v) => v && typeof v === 'object';
-// Minimal quoting: keep identifiers bare for readability unless they require
-// quoting (reserved or not matching [a-z_][a-z0-9_]*). This ensures examples
-// like table "order" remain valid.
-const RESERVED = new Set(['select','insert','update','delete','from','where','group','order','by','limit','offset','join','left','right','on','and','or','not','null','true','false','table','view','function','schema','user']);
-const needsQuoting = (s) => {
-  const id = String(s);
-  return !/^[a-z_][a-z0-9_]*$/.test(id) || RESERVED.has(id.toLowerCase());
-};
-const escIdent = (s) => needsQuoting(s) ? `"${String(s).replace(/\"/g, '""')}"` : String(s);
+const escIdent = (s, opts) => renderIdent(s, opts);
 const escString = (s) => String(s).replace(/'/g, "''");
 
-export function lowerToSQL(plan, paramsEnv = null) {
+export function lowerToSQL(plan, paramsEnv = null, opts = {}) {
   if (!plan || !plan.root) throw new Error('lowerToSQL: invalid plan');
+  const identOpts = { policy: opts.identPolicy || 'minimal' };
 
   const params = paramsEnv && paramsEnv.ordered && paramsEnv.indexByName
     ? paramsEnv
     : collectParams(plan);
 
-  // Build SELECT list
-  const selectList = (plan.projection?.items || []).map(pi => `${renderExpr(pi.expr, params)} AS ${escIdent(pi.alias)}`).join(', ');
+  // Build DISTINCT ON (optional) and SELECT list
+  const selectList = (plan.projection?.items || []).map(pi => `${renderExpr(pi.expr, params, identOpts)} AS ${escIdent(pi.alias, identOpts)}`).join(', ');
   const projectionSQL = selectList.length > 0 ? selectList : '*';
+  const distinctExprs = Array.isArray(plan.distinctOn) ? plan.distinctOn : [];
+  const distinctSQL = distinctExprs.length ? `DISTINCT ON (${distinctExprs.map(e => renderExpr(e, params, identOpts)).join(', ')}) ` : '';
 
   // Render FROM and gather WHERE predicates from Filter nodes embedded in relation tree
   const whereParts = [];
-  const fromSQL = renderRelation(plan.root, params, whereParts);
+  const fromSQL = renderRelation(plan.root, params, whereParts, identOpts);
 
   // WHERE
   const whereSQL = whereParts.length ? `\nWHERE ${whereParts.join(' AND ')}` : '';
 
-  // ORDER BY with deterministic tie-breaker
+  // ORDER BY with deterministic tie-breaker; ensure DISTINCT ON prefix when present
   let orderSQL = '';
   const orderItems = [...(plan.orderBy || [])];
+  if (distinctExprs.length) {
+    // Ensure orderBy begins with distinctOn expressions in order
+    for (let i = distinctExprs.length - 1; i >= 0; i--) {
+      const de = distinctExprs[i];
+      orderItems.unshift({ expr: de, direction: 'asc', nulls: null });
+    }
+  }
   if (orderItems.length > 0) {
-    const rendered = orderItems.map(ob => renderOrderBy(ob, params));
+    const rendered = orderItems.map(ob => renderOrderBy(ob, params, identOpts));
     // Append tie-breaker if primary key (id) not already present
-    const pkRef = guessPrimaryKeyRef(plan);
+    const pkRef = typeof opts.pkResolver === 'function' ? opts.pkResolver(plan) : guessPrimaryKeyRef(plan);
     if (pkRef && !orderMentionsExpr(orderItems, pkRef)) {
-      rendered.push(`${renderExpr(pkRef, params)} ASC`);
+      rendered.push(`${renderExpr(pkRef, params, identOpts)} ASC`);
     }
     orderSQL = `\nORDER BY ${rendered.join(', ')}`;
   }
@@ -61,70 +64,70 @@ export function lowerToSQL(plan, paramsEnv = null) {
   const lim = plan.limit != null ? `\nLIMIT ${Number(plan.limit)}` : '';
   const off = plan.offset != null ? `\nOFFSET ${Number(plan.offset)}` : '';
 
-  return `SELECT ${projectionSQL}\nFROM ${fromSQL}${whereSQL}${orderSQL}${lim}${off}`.trim();
+  return `SELECT ${distinctSQL}${projectionSQL}\nFROM ${fromSQL}${whereSQL}${orderSQL}${lim}${off}`.trim();
 }
 
 // ────────────────────────────────────────────────────────────────────────────
 // Relation rendering
-function renderRelation(r, params, whereParts) {
+function renderRelation(r, params, whereParts, identOpts) {
   if (!r) return '';
   switch (r.kind) {
     case 'Table':
-      return `${escIdent(r.table)} ${escIdent(r.alias)}`;
+      return `${escIdent(r.table, identOpts)} ${escIdent(r.alias, identOpts)}`;
     case 'Subquery': {
-      const sql = lowerToSQL(r.plan, params);
-      return `(\n${sql}\n) ${escIdent(r.alias)}`;
+      const sql = lowerToSQL(r.plan, params, identOpts);
+      return `(\n${sql}\n) ${escIdent(r.alias, identOpts)}`;
     }
     case 'Lateral': {
-      const sql = lowerToSQL(r.plan, params);
-      return `LATERAL (\n${sql}\n) ${escIdent(r.alias)}`;
+      const sql = lowerToSQL(r.plan, params, identOpts);
+      return `LATERAL (\n${sql}\n) ${escIdent(r.alias, identOpts)}`;
     }
     case 'Join': {
-      const left = renderRelation(r.left, params, whereParts);
-      const right = renderRelation(r.right, params, whereParts);
+      const left = renderRelation(r.left, params, whereParts, identOpts);
+      const right = renderRelation(r.right, params, whereParts, identOpts);
       const jt = r.joinType && String(r.joinType).toUpperCase() === 'LEFT' ? 'LEFT JOIN' : 'JOIN';
-      const on = r.on ? renderPredicate(r.on, params) : 'TRUE';
+      const on = r.on ? renderPredicate(r.on, params, identOpts) : 'TRUE';
       return `${left} ${jt} ${right} ON ${on}`;
     }
     case 'Filter': {
       // Non-canonical node used in tests; extract predicate into WHERE
-      if (r.predicate) whereParts.push(renderPredicate(r.predicate, params));
-      return renderRelation(r.input, params, whereParts);
+      if (r.predicate) whereParts.push(renderPredicate(r.predicate, params, identOpts));
+      return renderRelation(r.input, params, whereParts, identOpts);
     }
     default:
       // Fallback: assume table-like
-      if (r.table && r.alias) return `${escIdent(r.table)} ${escIdent(r.alias)}`;
+      if (r.table && r.alias) return `${escIdent(r.table, identOpts)} ${escIdent(r.alias, identOpts)}`;
       throw new Error(`Unsupported relation kind: ${r.kind}`);
   }
 }
 
 // ────────────────────────────────────────────────────────────────────────────
 // Predicates & expressions
-function renderPredicate(p, params) {
+function renderPredicate(p, params, identOpts) {
   if (!p) return 'TRUE';
   switch (p.kind) {
     case 'Exists':
-      return `EXISTS (\n${lowerToSQL(p.subquery, params)}\n)`;
+      return `EXISTS (\n${lowerToSQL(p.subquery, params, identOpts)}\n)`;
     case 'Not':
-      return `(NOT ${renderPredicate(p.left, params)})`;
+      return `(NOT ${renderPredicate(p.left, params, identOpts)})`;
     case 'And':
-      return `(${renderPredicate(p.left, params)} AND ${renderPredicate(p.right, params)})`;
+      return `(${renderPredicate(p.left, params, identOpts)} AND ${renderPredicate(p.right, params, identOpts)})`;
     case 'Or':
-      return `(${renderPredicate(p.left, params)} OR ${renderPredicate(p.right, params)})`;
+      return `(${renderPredicate(p.left, params, identOpts)} OR ${renderPredicate(p.right, params, identOpts)})`;
     case 'Compare': {
       const { op } = p;
       // Null checks
-      if (op === 'isNull')    return `${renderExpr(p.left, params)} IS NULL`;
-      if (op === 'isNotNull') return `${renderExpr(p.left, params)} IS NOT NULL`;
+      if (op === 'isNull')    return `${renderExpr(p.left, params, identOpts)} IS NULL`;
+      if (op === 'isNotNull') return `${renderExpr(p.left, params, identOpts)} IS NOT NULL`;
 
       if (op === 'in') {
-        const left = renderExpr(p.left, params);
+        const left = renderExpr(p.left, params, identOpts);
         const paramSql = renderParam(p.right, params, /*forceCast*/true);
         return `${left} = ANY(${paramSql})`;
       }
 
-      const left = renderExpr(p.left, params);
-      const right = renderExpr(p.right, params);
+      const left = renderExpr(p.left, params, identOpts);
+      const right = renderExpr(p.right, params, identOpts);
       switch (op) {
         case 'eq':  return `${left} = ${right}`;
         case 'ne':  return `${left} <> ${right}`;
@@ -144,30 +147,34 @@ function renderPredicate(p, params) {
   }
 }
 
-function renderExpr(e, params) {
+function renderExpr(e, params, identOpts) {
   if (!e) return 'NULL';
   switch (e.kind) {
     case 'ColumnRef':
-      return `${escIdent(e.table)}.${escIdent(e.column)}`;
+      return `${escIdent(e.table, identOpts)}.${escIdent(e.column, identOpts)}`;
     case 'ParamRef':
       return renderParam(e, params);
     case 'Literal':
       return renderLiteral(e.value, e.type);
     case 'FuncCall': {
-      const args = (e.args || []).map(a => renderExpr(a, params)).join(', ');
-      return `${e.name}(${args})`;
+      const fn = String(e.name); // keep unquoted for built-ins; validated upstream when needed
+      const args = (e.args || []).map(a => renderExpr(a, params, identOpts)).join(', ');
+      return `${fn}(${args})`;
     }
     case 'ScalarSubquery':
-      return `(\n${lowerToSQL(e.plan, params)}\n)`;
+      return `(\n${lowerToSQL(e.plan, params, identOpts)}\n)`;
     case 'JsonBuildObject':
-      return renderJsonBuildObject(e, params);
+      return renderJsonBuildObject(e, params, identOpts);
     case 'JsonAgg':
-      return renderJsonAgg(e, params);
+      return renderJsonAgg(e, params, identOpts);
     default:
       // Allow plain objects shaped like ColumnRef/ParamRef/Literal
-      if (isObject(e.left) && e.op) return renderPredicate(e, params);
-      if (e.table && e.column) return `${escIdent(e.table)}.${escIdent(e.column)}`;
-      if (e.name && e.args) return `${e.name}(${(e.args||[]).map(a => renderExpr(a, params)).join(', ')})`;
+      if (isObject(e.left) && e.op) return renderPredicate(e, params, identOpts);
+      if (e.table && e.column) return `${escIdent(e.table, identOpts)}.${escIdent(e.column, identOpts)}`;
+      if (e.name && e.args) {
+        const fn2 = String(e.name);
+        return `${fn2}(${(e.args||[]).map(a => renderExpr(a, params, identOpts)).join(', ')})`;
+      }
       throw new Error(`Unsupported expr kind '${e.kind}'`);
   }
 }
@@ -183,27 +190,27 @@ function renderLiteral(v, type = null) {
   return `'${escString(v)}'${type ? `::${type}` : ''}`;
 }
 
-function renderJsonBuildObject(e, params) {
+function renderJsonBuildObject(e, params, identOpts) {
   // fields: [{ key, value }]
   const pairs = (e.fields || []).flatMap(({ key, value }) => [
     `'${escString(String(key))}'`,
-    renderExpr(value, params)
+    renderExpr(value, params, identOpts)
   ]);
   return `jsonb_build_object(${pairs.join(', ')})`;
 }
 
-function renderJsonAgg(e, params) {
-  const inner = renderExpr(e.value, params);
+function renderJsonAgg(e, params, identOpts) {
+  const inner = renderExpr(e.value, params, identOpts);
   const order = (e.orderBy || []).length
-    ? ' ORDER BY ' + e.orderBy.map(ob => renderOrderBy(ob, params)).join(', ')
+    ? ' ORDER BY ' + e.orderBy.map(ob => renderOrderBy(ob, params, identOpts)).join(', ')
     : '';
   return `COALESCE(jsonb_agg(${inner}${order}), '[]'::jsonb)`;
 }
 
-function renderOrderBy(ob, params) {
+function renderOrderBy(ob, params, identOpts) {
   const dir = ob.direction && String(ob.direction).toLowerCase() === 'desc' ? 'DESC' : 'ASC';
   const nulls = ob.nulls ? ` NULLS ${String(ob.nulls).toUpperCase()}` : '';
-  return `${renderExpr(ob.expr, params)} ${dir}${nulls}`;
+  return `${renderExpr(ob.expr, params, identOpts)} ${dir}${nulls}`;
 }
 
 function renderParam(p, params, forceCast = false) {
diff --git a/packages/wesley-core/test/snapshots/qir-emission.test.mjs b/packages/wesley-core/test/snapshots/qir-emission.test.mjs
index deda9489..213ac7d6 100644
--- a/packages/wesley-core/test/snapshots/qir-emission.test.mjs
+++ b/packages/wesley-core/test/snapshots/qir-emission.test.mjs
@@ -32,8 +32,8 @@ test('emitFunction: generates deterministic function with params and jsonb rows'
   assert.ok(sql.includes('p_ids text[]'));
   assert.ok(sql.includes('RETURNS SETOF jsonb'));
   assert.ok(sql.includes('SELECT to_jsonb(q.*) FROM ('));
-  assert.ok(sql.includes('FROM organization t0'));
-  assert.ok(/ORDER BY\s+t0\.name\s+ASC\s*,\s*t0\.id\s+ASC/i.test(sql));
+  assert.ok(sql.includes('FROM "organization" "t0"'));
+  assert.ok(/ORDER BY\s+"t0"\."name"\s+ASC\s*,\s*"t0"\."id"\s+ASC/i.test(sql));
 });
 
 test('emitView: wraps lowered SQL in CREATE VIEW', () => {
@@ -46,7 +46,7 @@ test('emitView: wraps lowered SQL in CREATE VIEW', () => {
 
   const sql = emitView('Org View!', plan);
   assert.ok(sql.startsWith('CREATE OR REPLACE VIEW "wes_ops"."op_org_view" AS'));
-  assert.ok(sql.includes('SELECT t0.id AS id, t0.name AS name'));
+  assert.ok(sql.includes('SELECT "t0"."id" AS "id", "t0"."name" AS "name"'));
 });
 
 test('emitFunction: preserves jsonb_agg COALESCE inside wrapper', () => {
@@ -55,5 +55,16 @@ test('emitFunction: preserves jsonb_agg COALESCE inside wrapper', () => {
   const proj = new Projection([ new ProjectionItem('items', { kind: 'JsonAgg', value }) ]);
   const plan = new QueryPlan(root, proj, {});
   const sql = emitFunction('agg', plan);
-  assert.ok(sql.includes("COALESCE(jsonb_agg(jsonb_build_object('id', t0.id)), '[]'::jsonb)"));
+  assert.ok(sql.includes("COALESCE(jsonb_agg(jsonb_build_object('id', \"t0\".\"id\")), '[]'::jsonb)"));
+});
+
+test('emitFunction: supports SECURITY and SET search_path', () => {
+  const root = new TableNode('organization', 't0');
+  const proj = new Projection([
+    new ProjectionItem('id', new ColumnRef('t0', 'id')),
+  ]);
+  const plan = new QueryPlan(root, proj, {});
+  const sql = emitFunction('secure', plan, { security: 'definer', setSearchPath: ['pg_catalog', 'wes_ops'] });
+  assert.ok(/SECURITY DEFINER/.test(sql));
+  assert.ok(/SET search_path =\s+"pg_catalog",\s+"wes_ops"/i.test(sql));
 });
diff --git a/packages/wesley-core/test/unit/cursor.test.mjs b/packages/wesley-core/test/unit/cursor.test.mjs
new file mode 100644
index 00000000..33c7c0c5
--- /dev/null
+++ b/packages/wesley-core/test/unit/cursor.test.mjs
@@ -0,0 +1,17 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { encodeCursor, decodeCursor } from '../../src/domain/qir/Cursor.mjs';
+
+test('cursor encode/decode round-trip', () => {
+  const obj = { id: '123', after: 10, flags: ['a','b'] };
+  const cur = encodeCursor(obj);
+  const out = decodeCursor(cur);
+  assert.deepEqual(out, obj);
+});
+
+test('cursor decode handles garbage', () => {
+  assert.deepEqual(decodeCursor('not-base64'), {});
+  assert.deepEqual(decodeCursor(''), {});
+});
+
diff --git a/packages/wesley-core/test/unit/op-join-diagnostics.test.mjs b/packages/wesley-core/test/unit/op-join-diagnostics.test.mjs
new file mode 100644
index 00000000..8a98bc8c
--- /dev/null
+++ b/packages/wesley-core/test/unit/op-join-diagnostics.test.mjs
@@ -0,0 +1,16 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { buildPlanFromJson } from '../../src/domain/qir/OpPlanBuilder.mjs';
+
+test('OpPlanBuilder: ambiguous unqualified join refs throw with hint', () => {
+  const op = {
+    name: 'bad_join',
+    table: 'a',
+    joins: [
+      { table: 'b', alias: 'b', on: { left: 'id', right: 'b.id' } }
+    ]
+  };
+  assert.throws(() => buildPlanFromJson(op), /Ambiguous join reference/);
+});
+
diff --git a/packages/wesley-core/test/unit/qir-distinct.test.mjs b/packages/wesley-core/test/unit/qir-distinct.test.mjs
new file mode 100644
index 00000000..7a8506e4
--- /dev/null
+++ b/packages/wesley-core/test/unit/qir-distinct.test.mjs
@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { QueryPlan, TableNode, Projection, ProjectionItem, ColumnRef, OrderBy } from '../../src/domain/qir/Nodes.mjs';
+import { lowerToSQL } from '../../src/domain/qir/lowerToSQL.mjs';
+
+test('lowerToSQL: DISTINCT ON prefixes orderBy and renders clause', () => {
+  const root = new TableNode('organization', 't0');
+  const proj = new Projection([
+    new ProjectionItem('id', new ColumnRef('t0', 'id')),
+    new ProjectionItem('name', new ColumnRef('t0', 'name')),
+  ]);
+  const plan = new QueryPlan(root, proj, {
+    distinctOn: [ new ColumnRef('t0','name') ],
+    orderBy: [ new OrderBy(new ColumnRef('t0','id'), 'desc') ]
+  });
+  const sql = lowerToSQL(plan, null, { identPolicy: 'strict' });
+  assert.ok(sql.startsWith('SELECT DISTINCT ON ("t0"."name")'));
+  assert.ok(/ORDER BY\s+"t0"\."name"\s+ASC\s*,\s*"t0"\."id"\s+DESC/i.test(sql));
+});
+
diff --git a/packages/wesley-core/test/unit/qir-identifiers.test.mjs b/packages/wesley-core/test/unit/qir-identifiers.test.mjs
new file mode 100644
index 00000000..06357b0c
--- /dev/null
+++ b/packages/wesley-core/test/unit/qir-identifiers.test.mjs
@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { lowerToSQL } from '../../src/domain/qir/lowerToSQL.mjs';
+
+// Minimal QIR-shaped plan without importing Nodes to keep this lightweight
+const planBase = () => ({
+  root: { kind: 'Table', table: 'organization', alias: 't0' },
+  projection: { items: [ { alias: 'id', expr: { kind: 'ColumnRef', table: 't0', column: 'id' } } ] },
+  orderBy: [],
+  limit: null,
+  offset: null,
+});
+
+test('ident policy minimal: quotes only when needed', () => {
+  const plan = planBase();
+  const sql = lowerToSQL(plan, null, { identPolicy: 'minimal' });
+  assert.ok(sql.includes('FROM organization t0'));
+});
+
+test('ident policy strict: always quotes idents and validates', () => {
+  const plan = planBase();
+  const sql = lowerToSQL(plan, null, { identPolicy: 'strict' });
+  assert.ok(sql.includes('FROM "organization" "t0"'));
+});
+
+test('ident policy strict: rejects invalid identifier', () => {
+  const bad = planBase();
+  bad.root.table = 'org-anization';
+  assert.throws(() => lowerToSQL(bad, null, { identPolicy: 'strict' }), /Invalid SQL identifier/);
+});
+
diff --git a/packages/wesley-core/test/unit/qir-lowering-pkresolver.test.mjs b/packages/wesley-core/test/unit/qir-lowering-pkresolver.test.mjs
new file mode 100644
index 00000000..fc447694
--- /dev/null
+++ b/packages/wesley-core/test/unit/qir-lowering-pkresolver.test.mjs
@@ -0,0 +1,18 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { lowerToSQL } from '../../src/domain/qir/lowerToSQL.mjs';
+
+test('lowerToSQL: pkResolver supplies non-id tie-breaker', () => {
+  const plan = {
+    root: { kind: 'Table', table: 'thing', alias: 't0' },
+    projection: { items: [ { alias: 'name', expr: { kind: 'ColumnRef', table: 't0', column: 'name' } } ] },
+    orderBy: [ { expr: { kind: 'ColumnRef', table: 't0', column: 'name' }, direction: 'asc' } ],
+    limit: null,
+    offset: null,
+  };
+  const pkResolver = () => ({ kind: 'ColumnRef', table: 't0', column: 'uuid' });
+  const sql = lowerToSQL(plan, null, { identPolicy: 'minimal', pkResolver });
+  assert.match(sql, /ORDER BY\s+t0\.name\s+ASC\s*,\s*t0\.uuid\s+ASC/);
+});
+
diff --git a/packages/wesley-core/test/unit/qir-op-plan-builder.test.mjs b/packages/wesley-core/test/unit/qir-op-plan-builder.test.mjs
new file mode 100644
index 00000000..95012f07
--- /dev/null
+++ b/packages/wesley-core/test/unit/qir-op-plan-builder.test.mjs
@@ -0,0 +1,33 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { buildPlanFromJson } from '../../src/domain/qir/OpPlanBuilder.mjs';
+
+test('OpPlanBuilder: IN requires explicit array type', () => {
+  const bad = {
+    table: 't',
+    columns: ['id'],
+    filters: [{ column: 'id', op: 'in', param: { name: 'ids' } }]
+  };
+  assert.throws(() => buildPlanFromJson(bad), /requires an explicit array type/);
+});
+
+test('OpPlanBuilder: ILIKE requires explicit text type', () => {
+  const bad = {
+    table: 't',
+    columns: ['id'],
+    filters: [{ column: 'name', op: 'ilike', param: { name: 'q' } }]
+  };
+  assert.throws(() => buildPlanFromJson(bad), /requires an explicit type for ILIKE/);
+});
+
+test('OpPlanBuilder: valid IN with text[] passes', () => {
+  const good = {
+    table: 't',
+    columns: ['id'],
+    filters: [{ column: 'id', op: 'in', param: { name: 'ids', type: 'text[]' } }]
+  };
+  const plan = buildPlanFromJson(good);
+  assert.ok(plan && plan.root && plan.projection);
+});
+
diff --git a/schemas/ir-envelope.schema.json b/schemas/ir-envelope.schema.json
new file mode 100644
index 00000000..a8802592
--- /dev/null
+++ b/schemas/ir-envelope.schema.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://wesley.dev/schemas/ir-envelope.schema.json",
+  "title": "Wesley IR Envelope (Experimental)",
+  "description": "Bundle of Schema IR + QIR plans + optional evidence and version info.",
+  "type": "object",
+  "required": ["schema", "ops"],
+  "properties": {
+    "version": { "type": ["string", "null"] },
+    "schema": { "$ref": "ir.schema.json#" },
+    "ops": {
+      "type": "object",
+      "required": ["plans"],
+      "properties": {
+        "plans": { "type": "array", "items": { "$ref": "qir.schema.json#" } }
+      },
+      "additionalProperties": false
+    },
+    "evidence": { "type": ["object", "null"] }
+  },
+  "additionalProperties": false
+}
+
diff --git a/schemas/ops-manifest.schema.json b/schemas/ops-manifest.schema.json
new file mode 100644
index 00000000..714822b3
--- /dev/null
+++ b/schemas/ops-manifest.schema.json
@@ -0,0 +1,15 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://wesley.dev/schemas/ops-manifest.schema.json",
+  "title": "Wesley Ops Manifest",
+  "type": "object",
+  "required": ["include"],
+  "properties": {
+    "include": { "type": "array", "items": { "type": "string" } },
+    "exclude": { "type": "array", "items": { "type": "string" }, "default": [] },
+    "allowEmpty": { "type": "boolean", "default": false },
+    "schema": { "type": ["string", "null"], "description": "Override target SQL schema for emitted ops" }
+  },
+  "additionalProperties": false
+}
+
diff --git a/schemas/ops-registry.schema.json b/schemas/ops-registry.schema.json
new file mode 100644
index 00000000..2868057c
--- /dev/null
+++ b/schemas/ops-registry.schema.json
@@ -0,0 +1,67 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Wesley Ops Registry",
+  "type": "object",
+  "required": ["version", "schema", "ops"],
+  "properties": {
+    "version": { "type": "string", "enum": ["1.0.0"] },
+    "schema": { "type": "string", "minLength": 1 },
+    "ops": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "sql", "params", "projection", "files", "sourceFile"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "sql": {
+            "type": "object",
+            "required": ["schema", "function"],
+            "properties": {
+              "schema": { "type": "string", "minLength": 1 },
+              "function": { "type": "string", "minLength": 1 },
+              "view": { "type": ["string", "null"] }
+            },
+            "additionalProperties": false
+          },
+          "params": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["name", "type"],
+              "properties": {
+                "name": { "type": "string", "minLength": 1 },
+                "type": { "type": "string", "minLength": 1 }
+              },
+              "additionalProperties": false
+            }
+          },
+          "projection": {
+            "type": "object",
+            "required": ["star", "items"],
+            "properties": {
+              "star": { "type": "boolean" },
+              "items": {
+                "type": "array",
+                "items": { "type": "string" }
+              }
+            },
+            "additionalProperties": false
+          },
+          "files": {
+            "type": "object",
+            "required": ["function"],
+            "properties": {
+              "function": { "type": "string", "minLength": 1 },
+              "view": { "type": ["string", "null"] }
+            },
+            "additionalProperties": false
+          },
+          "sourceFile": { "type": "string", "minLength": 1 }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}
+
diff --git a/schemas/plan-report.schema.json b/schemas/plan-report.schema.json
new file mode 100644
index 00000000..89ca09f0
--- /dev/null
+++ b/schemas/plan-report.schema.json
@@ -0,0 +1,99 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://wesley.dev/schemas/plan-report.schema.json",
+  "title": "Wesley Plan Report (plan --explain --json)",
+  "type": "object",
+  "required": ["plan", "explain", "mapping", "radar"],
+  "properties": {
+    "plan": {
+      "type": "object",
+      "required": ["phases"],
+      "properties": {
+        "phases": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["name", "steps"],
+            "properties": {
+              "name": { "type": "string" },
+              "steps": {
+                "type": "array",
+                "items": { "$ref": "#/definitions/Step" }
+              }
+            }
+          }
+        }
+      }
+    },
+    "explain": {
+      "type": "object",
+      "required": ["lines", "steps"],
+      "properties": {
+        "lines": { "type": "array", "items": { "type": "string" } },
+        "steps": { "type": "array", "items": { "$ref": "#/definitions/StepWithLock" } }
+      }
+    },
+    "mapping": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["change", "steps"],
+        "properties": {
+          "change": { "type": "string" },
+          "steps": { "type": "array", "items": { "$ref": "#/definitions/Step" } }
+        }
+      }
+    },
+    "radar": {
+      "type": "object",
+      "required": ["lines", "counts"],
+      "properties": {
+        "lines": { "type": "array", "items": { "type": "string" } },
+        "notes": { "type": ["array", "null"], "items": { "type": "string" } },
+        "counts": { "type": "object", "additionalProperties": { "type": "integer" } }
+      }
+    }
+  },
+  "additionalProperties": true,
+  "definitions": {
+    "Step": {
+      "type": "object",
+      "required": ["op", "table"],
+      "properties": {
+        "op": { "type": "string", "enum": [
+          "create_table", "add_column", "create_index_concurrently", "add_fk_not_valid", "validate_fk"
+        ] },
+        "table": { "type": "string" },
+        "column": { "type": ["string", "null"] },
+        "type": { "type": ["string", "null"] },
+        "default": { "type": ["string", "null"] },
+        "nullable": { "type": ["boolean", "null"] },
+        "columns": { "type": ["array", "null"], "items": { "type": "string" } },
+        "using": { "type": ["string", "null"] },
+        "name": { "type": ["string", "null"] },
+        "refTable": { "type": ["string", "null"] },
+        "refColumn": { "type": ["string", "null"] }
+      }
+    },
+    "StepWithLock": {
+      "allOf": [
+        { "$ref": "#/definitions/Step" },
+        {
+          "type": "object",
+          "required": ["lock"],
+          "properties": {
+            "lock": {
+              "type": "object",
+              "required": ["name", "blocksWrites", "blocksReads"],
+              "properties": {
+                "name": { "type": "string" },
+                "blocksWrites": { "type": "boolean" },
+                "blocksReads": { "type": "boolean" }
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/schemas/qir.schema.json b/schemas/qir.schema.json
new file mode 100644
index 00000000..a8282c8e
--- /dev/null
+++ b/schemas/qir.schema.json
@@ -0,0 +1,278 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://wesley.dev/schemas/qir.schema.json",
+  "title": "Wesley Query Intermediate Representation (QIR)",
+  "description": "Minimal query plan IR used to compile operations to SQL.",
+  "type": "object",
+  "required": ["root", "projection"],
+  "properties": {
+    "root": { "$ref": "#/definitions/RelationNode" },
+    "projection": { "$ref": "#/definitions/Projection" },
+    "orderBy": {
+      "type": "array",
+      "items": { "$ref": "#/definitions/OrderBy" },
+      "default": []
+    },
+    "limit": { "type": ["integer", "null"] },
+    "offset": { "type": ["integer", "null"] }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "RelationNode": {
+      "oneOf": [
+        { "$ref": "#/definitions/TableNode" },
+        { "$ref": "#/definitions/JoinNode" },
+        { "$ref": "#/definitions/SubqueryNode" },
+        { "$ref": "#/definitions/LateralNode" },
+        { "$ref": "#/definitions/FilterNode" }
+      ]
+    },
+    "TableNode": {
+      "type": "object",
+      "required": ["kind", "table", "alias"],
+      "properties": {
+        "kind": { "const": "Table" },
+        "table": { "type": "string" },
+        "alias": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "JoinNode": {
+      "type": "object",
+      "required": ["kind", "left", "right", "joinType", "on"],
+      "properties": {
+        "kind": { "const": "Join" },
+        "left": { "$ref": "#/definitions/RelationNode" },
+        "right": { "$ref": "#/definitions/RelationNode" },
+        "joinType": { "type": "string", "enum": ["INNER", "LEFT"] },
+        "on": { "$ref": "#/definitions/Predicate" },
+        "alias": { "type": ["string", "null"] }
+      },
+      "additionalProperties": false
+    },
+    "SubqueryNode": {
+      "type": "object",
+      "required": ["kind", "plan", "alias"],
+      "properties": {
+        "kind": { "const": "Subquery" },
+        "plan": { "$ref": "#/definitions/QueryPlan" },
+        "alias": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "LateralNode": {
+      "type": "object",
+      "required": ["kind", "plan", "alias"],
+      "properties": {
+        "kind": { "const": "Lateral" },
+        "plan": { "$ref": "#/definitions/QueryPlan" },
+        "alias": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "FilterNode": {
+      "type": "object",
+      "required": ["kind", "input", "predicate"],
+      "properties": {
+        "kind": { "const": "Filter" },
+        "input": { "$ref": "#/definitions/RelationNode" },
+        "predicate": { "$ref": "#/definitions/Predicate" },
+        "alias": { "type": ["string", "null"] }
+      },
+      "additionalProperties": false
+    },
+    "Projection": {
+      "type": "object",
+      "required": ["items"],
+      "properties": {
+        "items": {
+          "type": "array",
+          "items": { "$ref": "#/definitions/ProjectionItem" }
+        }
+      },
+      "additionalProperties": false
+    },
+    "ProjectionItem": {
+      "type": "object",
+      "required": ["alias", "expr"],
+      "properties": {
+        "alias": { "type": "string" },
+        "expr": { "$ref": "#/definitions/Expr" }
+      },
+      "additionalProperties": false
+    },
+    "Expr": {
+      "oneOf": [
+        { "$ref": "#/definitions/ColumnRef" },
+        { "$ref": "#/definitions/ParamRef" },
+        { "$ref": "#/definitions/Literal" },
+        { "$ref": "#/definitions/FuncCall" },
+        { "$ref": "#/definitions/JsonBuildObject" },
+        { "$ref": "#/definitions/JsonAgg" },
+        { "$ref": "#/definitions/ScalarSubquery" }
+      ]
+    },
+    "ColumnRef": {
+      "type": "object",
+      "required": ["kind", "table", "column"],
+      "properties": {
+        "kind": { "const": "ColumnRef" },
+        "table": { "type": "string" },
+        "column": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "ParamRef": {
+      "type": "object",
+      "required": ["kind", "name"],
+      "properties": {
+        "kind": { "const": "ParamRef" },
+        "name": { "type": "string" },
+        "typeHint": { "type": ["string", "null"] },
+        "special": { "type": ["string", "null"] }
+      },
+      "additionalProperties": false
+    },
+    "Literal": {
+      "type": "object",
+      "required": ["kind", "value"],
+      "properties": {
+        "kind": { "const": "Literal" },
+        "value": {
+          "oneOf": [
+            { "type": "string" },
+            { "type": "number" },
+            { "type": "boolean" },
+            { "type": "null" },
+            { "type": "array" },
+            { "type": "object" }
+          ]
+        },
+        "type": { "type": ["string", "null"] }
+      },
+      "additionalProperties": false
+    },
+    "FuncCall": {
+      "type": "object",
+      "required": ["kind", "name", "args"],
+      "properties": {
+        "kind": { "const": "FuncCall" },
+        "name": { "type": "string" },
+        "args": { "type": "array", "items": { "$ref": "#/definitions/Expr" } }
+      },
+      "additionalProperties": false
+    },
+    "ScalarSubquery": {
+      "type": "object",
+      "required": ["kind", "plan"],
+      "properties": {
+        "kind": { "const": "ScalarSubquery" },
+        "plan": { "$ref": "#/definitions/QueryPlan" }
+      },
+      "additionalProperties": false
+    },
+    "JsonBuildObject": {
+      "type": "object",
+      "required": ["kind", "fields"],
+      "properties": {
+        "kind": { "const": "JsonBuildObject" },
+        "fields": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["key", "value"],
+            "properties": {
+              "key": { "type": "string" },
+              "value": { "$ref": "#/definitions/Expr" }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "JsonAgg": {
+      "type": "object",
+      "required": ["kind", "value"],
+      "properties": {
+        "kind": { "const": "JsonAgg" },
+        "value": { "$ref": "#/definitions/Expr" },
+        "orderBy": { "type": "array", "items": { "$ref": "#/definitions/OrderBy" }, "default": [] }
+      },
+      "additionalProperties": false
+    },
+    "Predicate": {
+      "oneOf": [
+        { "$ref": "#/definitions/PredicateCompare" },
+        { "$ref": "#/definitions/PredicateExists" },
+        { "$ref": "#/definitions/PredicateNot" },
+        { "$ref": "#/definitions/PredicateAnd" },
+        { "$ref": "#/definitions/PredicateOr" }
+      ]
+    },
+    "PredicateCompare": {
+      "type": "object",
+      "required": ["kind", "left", "op"],
+      "properties": {
+        "kind": { "const": "Compare" },
+        "left": { "$ref": "#/definitions/Expr" },
+        "op": {
+          "type": "string",
+          "enum": ["eq", "ne", "lt", "lte", "gt", "gte", "like", "ilike", "contains", "in", "isNull", "isNotNull"]
+        },
+        "right": { "anyOf": [ { "$ref": "#/definitions/Expr" }, { "type": "null" } ] }
+      },
+      "additionalProperties": false
+    },
+    "PredicateExists": {
+      "type": "object",
+      "required": ["kind", "subquery"],
+      "properties": {
+        "kind": { "const": "Exists" },
+        "subquery": { "$ref": "#/definitions/QueryPlan" }
+      },
+      "additionalProperties": false
+    },
+    "PredicateNot": {
+      "type": "object",
+      "required": ["kind", "left"],
+      "properties": {
+        "kind": { "const": "Not" },
+        "left": { "$ref": "#/definitions/Predicate" }
+      },
+      "additionalProperties": false
+    },
+    "PredicateAnd": {
+      "type": "object",
+      "required": ["kind", "left", "right"],
+      "properties": {
+        "kind": { "const": "And" },
+        "left": { "$ref": "#/definitions/Predicate" },
+        "right": { "$ref": "#/definitions/Predicate" }
+      },
+      "additionalProperties": false
+    },
+    "PredicateOr": {
+      "type": "object",
+      "required": ["kind", "left", "right"],
+      "properties": {
+        "kind": { "const": "Or" },
+        "left": { "$ref": "#/definitions/Predicate" },
+        "right": { "$ref": "#/definitions/Predicate" }
+      },
+      "additionalProperties": false
+    },
+    "OrderBy": {
+      "type": "object",
+      "required": ["expr"],
+      "properties": {
+        "expr": { "$ref": "#/definitions/Expr" },
+        "direction": { "type": "string", "enum": ["asc", "desc"], "default": "asc" },
+        "nulls": { "type": ["string", "null"], "enum": ["first", "last", null] }
+      },
+      "additionalProperties": false
+    },
+    "QueryPlan": { "$ref": "#" }
+  }
+}
+
diff --git a/schemas/realm.schema.json b/schemas/realm.schema.json
new file mode 100644
index 00000000..f29e05c9
--- /dev/null
+++ b/schemas/realm.schema.json
@@ -0,0 +1,17 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://wesley.dev/schemas/realm.schema.json",
+  "title": "Wesley REALM Rehearsal Report",
+  "type": "object",
+  "required": ["verdict", "timestamp"],
+  "properties": {
+    "provider": { "type": ["string", "null"] },
+    "verdict": { "type": "string", "enum": ["PASS", "FAIL"] },
+    "duration_ms": { "type": ["integer", "null"] },
+    "steps": { "type": ["integer", "null"] },
+    "error": { "type": ["string", "null"] },
+    "timestamp": { "type": "string", "format": "date-time" }
+  },
+  "additionalProperties": false
+}
+
diff --git a/schemas/shipme.schema.json b/schemas/shipme.schema.json
new file mode 100644
index 00000000..4b219f6d
--- /dev/null
+++ b/schemas/shipme.schema.json
@@ -0,0 +1,33 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://wesley.dev/schemas/shipme.schema.json",
+  "title": "Wesley SHIPME Certificate",
+  "type": "object",
+  "required": ["sha", "timestamp", "realm"],
+  "properties": {
+    "sha": { "type": "string" },
+    "timestamp": { "type": "string", "format": "date-time" },
+    "environment": { "type": ["string", "null"] },
+    "scores": { "type": ["object", "null"] },
+    "realm": {
+      "anyOf": [ { "$ref": "https://wesley.dev/schemas/realm.schema.json#" }, { "type": "null" } ]
+    },
+    "signatures": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["signer", "keyId", "signature"],
+        "properties": {
+          "signer": { "type": "string" },
+          "keyId": { "type": "string" },
+          "signature": { "type": "string" },
+          "createdAt": { "type": ["string", "null"], "format": "date-time" },
+          "alg": { "type": ["string", "null"] }
+        },
+        "additionalProperties": false
+      },
+      "default": []
+    }
+  },
+  "additionalProperties": true
+}
diff --git a/scripts/preflight.mjs b/scripts/preflight.mjs
index 19b4eb3e..77c363a3 100644
--- a/scripts/preflight.mjs
+++ b/scripts/preflight.mjs
@@ -3,6 +3,7 @@ import { readdirSync, statSync, readFileSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
+import { existsSync } from 'node:fs';
 
 if (process.env.SKIP_PREFLIGHT === '1') {
   console.log('SKIP_PREFLIGHT=1 set — skipping preflight checks');
@@ -145,6 +146,64 @@ try {
   fail(`License audit failed: ${e?.message || e}`);
 }
 
+// 9) Validate changed QIR/Envelope/Manifest files via CLI validators
+try {
+  const base = process.env.WESLEY_BASE_REF || process.env.GITHUB_BASE_REF || 'origin/main';
+  let baseSha = '';
+  try {
+    const mb = spawnSync('git', ['merge-base', base, 'HEAD'], { encoding: 'utf8' });
+    if (mb.status === 0) baseSha = (mb.stdout || '').trim();
+  } catch {}
+  const diffArgs = baseSha ? ['diff', '--name-only', '--diff-filter=ACMRTUXB', baseSha] : ['ls-files'];
+  const df = spawnSync('git', diffArgs, { encoding: 'utf8' });
+  const files = (df.stdout || '').split(/\r?\n/).filter(Boolean);
+  const qirFiles = files.filter(f => f.endsWith('.qir.json'));
+  const envFiles = files.filter(f => /(^|\/)ir-?envelope(\.json)?$/.test(f) || f.endsWith('sample-envelope.json'));
+  const manFiles = files.filter(f => /ops\.manifest\.json$|ops-manifest\.json$/.test(f));
+  // Also validate any emitted ops registry if present in out/**/ops/registry.json
+  const cli = existsSync('packages/wesley-host-node/bin/wesley.mjs') ? 'packages/wesley-host-node/bin/wesley.mjs' : 'node_modules/.bin/wesley';
+  for (const f of qirFiles) {
+    const r = spawnSync(process.execPath, [cli, 'qir', 'validate', f], { stdio: 'inherit' });
+    if (r.status !== 0) fail(`QIR validation failed for ${f}`);
+  }
+  for (const f of envFiles) {
+    const r = spawnSync(process.execPath, [cli, 'qir', 'envelope-validate', f], { stdio: 'inherit' });
+    if (r.status !== 0) fail(`IR envelope validation failed for ${f}`);
+  }
+  for (const f of manFiles) {
+    const r = spawnSync(process.execPath, [cli, 'qir', 'manifest-validate', f], { stdio: 'inherit' });
+    if (r.status !== 0) fail(`Ops manifest validation failed for ${f}`);
+  }
+  // Discover and validate registries under out/**/ops/registry.json if present (best-effort)
+  try {
+    const findRegistries = (dir) => {
+      const out = [];
+      const walk = (p) => {
+        let ents = [];
+        try { ents = readdirSync(p, { withFileTypes: true }); } catch { return; }
+        for (const e of ents) {
+          const full = resolve(p, e.name);
+          if (e.isDirectory()) walk(full);
+          else if (e.isFile() && /\bops\/registry\.json$/.test(full)) out.push(full);
+        }
+      };
+      walk(dir);
+      return out;
+    };
+    const outDir = resolve('out');
+    if (existsSync(outDir)) {
+      for (const reg of findRegistries(outDir)) {
+        const r = spawnSync(process.execPath, [cli, 'qir', 'registry-validate', reg], { stdio: 'inherit' });
+        if (r.status !== 0) fail(`Ops registry validation failed for ${reg}`);
+      }
+    }
+  } catch (e) {
+    // Non-fatal: registry may not exist in all runs
+  }
+} catch (e) {
+  fail(`QIR/Envelope/Manifest validation step failed to run: ${e?.message || e}`);
+}
+
 if (!ok) {
   console.error('\n❌ Preflight failed with the following issues:');
   for (const m of failures) console.error(' -', m);
diff --git a/test/fixtures/examples/ops/ops.manifest.json b/test/fixtures/examples/ops/ops.manifest.json
new file mode 100644
index 00000000..90bf29bb
--- /dev/null
+++ b/test/fixtures/examples/ops/ops.manifest.json
@@ -0,0 +1,7 @@
+{
+  "include": [
+    "test/fixtures/examples/ops"
+  ],
+  "exclude": []
+}
+
diff --git a/test/fixtures/qir/sample-envelope.json b/test/fixtures/qir/sample-envelope.json
new file mode 100644
index 00000000..f47cf16f
--- /dev/null
+++ b/test/fixtures/qir/sample-envelope.json
@@ -0,0 +1,28 @@
+{
+  "version": "0.1",
+  "schema": {
+    "version": "0.1",
+    "tables": [
+      {
+        "name": "organization",
+        "columns": [
+          { "name": "id", "type": "uuid", "nullable": false },
+          { "name": "name", "type": "text", "nullable": false }
+        ],
+        "primaryKey": "id",
+        "foreignKeys": [],
+        "indexes": []
+      }
+    ]
+  },
+  "ops": {
+    "plans": [
+      {
+        "root": { "kind": "Table", "table": "organization", "alias": "t0" },
+        "projection": { "items": [ { "alias": "id", "expr": { "kind": "ColumnRef", "table": "t0", "column": "id" } } ] }
+      }
+    ]
+  },
+  "evidence": {}
+}
+
diff --git a/test/fixtures/qir/sample-flat.qir.json b/test/fixtures/qir/sample-flat.qir.json
new file mode 100644
index 00000000..c8ebd4e0
--- /dev/null
+++ b/test/fixtures/qir/sample-flat.qir.json
@@ -0,0 +1,8 @@
+{
+  "root": { "kind": "Filter", "input": { "kind": "Table", "table": "organization", "alias": "t0" }, "predicate": { "kind": "Compare", "left": { "kind": "ColumnRef", "table": "t0", "column": "deleted_at" }, "op": "isNull" } },
+  "projection": { "items": [ { "alias": "id", "expr": { "kind": "ColumnRef", "table": "t0", "column": "id" } }, { "alias": "name", "expr": { "kind": "ColumnRef", "table": "t0", "column": "name" } } ] },
+  "orderBy": [ { "expr": { "kind": "ColumnRef", "table": "t0", "column": "name" }, "direction": "asc" } ],
+  "limit": 10,
+  "offset": 0
+}
+
diff --git a/test/fixtures/qir/sample-nested.qir.json b/test/fixtures/qir/sample-nested.qir.json
new file mode 100644
index 00000000..59b40f40
--- /dev/null
+++ b/test/fixtures/qir/sample-nested.qir.json
@@ -0,0 +1,54 @@
+{
+  "root": {
+    "kind": "Join",
+    "left": { "kind": "Table", "table": "organization", "alias": "o" },
+    "right": {
+      "kind": "Lateral",
+      "plan": {
+        "root": { "kind": "Table", "table": "membership", "alias": "m" },
+        "projection": {
+          "items": [
+            {
+              "alias": "_",
+              "expr": {
+                "kind": "JsonBuildObject",
+                "fields": [ { "key": "user_id", "value": { "kind": "ColumnRef", "table": "m", "column": "user_id" } } ]
+              }
+            }
+          ]
+        }
+      },
+      "alias": "l0"
+    },
+    "joinType": "LEFT",
+    "on": { "kind": "Compare", "op": "eq", "left": { "kind": "Literal", "value": true }, "right": { "kind": "Literal", "value": true } }
+  },
+  "projection": {
+    "items": [
+      { "alias": "id", "expr": { "kind": "ColumnRef", "table": "o", "column": "id" } },
+      {
+        "alias": "members",
+        "expr": {
+          "kind": "JsonAgg",
+          "value": {
+            "kind": "ScalarSubquery",
+            "plan": {
+              "root": { "kind": "Table", "table": "membership", "alias": "m" },
+              "projection": {
+                "items": [
+                  {
+                    "alias": "member",
+                    "expr": {
+                      "kind": "JsonBuildObject",
+                      "fields": [ { "key": "user_id", "value": { "kind": "ColumnRef", "table": "m", "column": "user_id" } } ]
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        }
+      }
+    ]
+  }
+}