fix(stack-encrypt)!: an order index on bytes is refused

conformance/stack-encrypt/coverage.md

@@ -143,11 +143,10 @@ Each runs in native Rust and Go WASI under `test:conformance`.
 | Native `a_stored_record_that_does_not_fit`, the read profile | `shape-*`, `authenticated-*`, `success-*` | Mutation vocabulary over real ciphertext |
 | Guest `test_frame` and `last_error` tests | `transport-*`, `leaf-*` | Plan-frame boundary cases, ABI status mapping |
 
-Unsupported combinations the corpora record rather than skip: the order
-index on `bytes` stores a term no operator reads; the typed chain refuses
-equality, order and block ORE value refusals only after its keyset loads,
-where the binding refuses before any; a repeated key in a stored record is
-a transport refusal in both decoders, and the engine's own `field_repeated`
+Unsupported combinations the corpora record rather than skip: the typed
+chain refuses equality, order and block ORE value refusals only after its
+keyset loads, where the binding refuses before any; a repeated key in a
+stored record is a transport refusal in both decoders, and the engine's own `field_repeated`
 and `repeated_key` guards are reached natively alone; the Go host refuses
 the zero `Date`, a decimal scale above 28, a timestamp outside the
 decoder's range and non-value Go types before the engine. `NaN` and

conformance/stack-encrypt/declaration-grammar.md

@@ -175,9 +175,14 @@ select a different leaf encoding.
 | Other integer widths | Admitted | Refused | Admitted |
 | float32, float64, decimal, date, timestamp | Admitted | Refused | Admitted |
 | string | Admitted | Admitted | Admitted |
-| bytes | Admitted | Refused | Admitted |
+| bytes | Admitted | Refused | Refused |
 | array, object, json | Refused | Refused | Refused |
 
+An index is admitted only over a kind one of its operators answers. The
+scheme defines an order term for bytes, but no ordering operator is answered
+over bytes, so the term would be stored and never queried. The order indexes
+are refused on bytes as `index_not_admitted`.
+
 The corpus explicitly tests all 21 kinds against all five scalar indexes.
 `array` and `object` may still be sealed without indexes. A `json` field requires
 a document target. A raw `json` output has a recognized syntax but is refused as

conformance/stack-encrypt/exchange-contract.md

@@ -30,7 +30,7 @@ mise run test:conformance:exchange
 
 | Kind | Producer writes | Consumer checks |
 |---|---|---|
-| `values` | One record per positive case of `v1/record-values-v1.cases.json` (the value-boundary corpus), under the plan that case declares, with context `["conformance", "exchange"]`: the sealed leaf and every declared index term; nothing for a SQL null | The record opens to the case's typed input. Every stored term equals the term the consumer's own query of the same value derives (`eq` for equality, `lt` for an order index), and the `equal_query` spelling derives the same equality term. An index the corpus lists as unanswered is present and not queried |
+| `values` | One record per positive case of `v1/record-values-v1.cases.json` (the value-boundary corpus), under the plan that case declares, with context `["conformance", "exchange"]`: the sealed leaf and every declared index term; nothing for a SQL null | The record opens to the case's typed input. Every stored term equals the term the consumer's own query of the same value derives (`eq` for equality, `lt` for an order index), and the `equal_query` spelling derives the same equality term. |
 | `record` | The rows of the corpus's one record: a passthrough `int64` id (held on the host by Go, lowered as a `passthrough` output by Rust), text, `uint32`, decimal, date and timestamp fields with equality and order terms, a SQL-null text field and a sealed-null `float32` field, under context `["conformance", "exchange", "people"]` | The passthrough carried equals the corpus input; every sealed field opens to its input, a sealed null opens as null and a SQL null is absent from storage and opens as null; every stored term equals the consumer's derived query term |
 | `blobs` | A whole struct (`name`, `age`, `tags`, optional `nickname`) as one opaque ciphertext under `["conformance", "exchange", "blob"]`, field `value`: Rust through `OpaqueBlob<T>`, Go through the storage blob the generated opaque path writes (`vcffi.MarshalStorage` sealed as the one `bytes` field) | The ciphertext opens and decodes to the corpus value through the other SDK's opaque reader (`OpaqueBlob<T>` or `gensupport.Opaque`). A nil Go slice and an empty Rust `Vec` are one value; Rust's `Some` marker and Go's bare pointer are one value |
 | `eql-rows` | The EQL v4 `profiles` rows: every column of the committed fixture's plaintexts sealed afresh, Rust through eql-bindings' typed targets, Go through its generated code | Each column opens to the plaintext through the other side's typed target, and each equality column's stored `hm` equals the term the consumer's own equality query derives for that plaintext (the generated `*Eq` query in Go, the typed `*EqQuery` target in Rust) |

conformance/stack-encrypt/query-refusals-contract.md

@@ -21,7 +21,7 @@ and `languages/golang/encrypt/query_refusal_conformance_test.go`.
 `["conformance", <name>]`: equality-only text, match-only text, order-only
 text (ORE and block ORE), an integer with equality and order, an order-only
 float, a 128-bit integer with equality and OPE, a ciphertext-only bool and
-text, a sealed-null and a SQL-null integer, and bytes with an order index.
+text, a sealed-null and a SQL-null integer, and equality-only bytes.
 
 A case names a `field`, an `operator` and an `input`: a scalar `{type, text}`
 in the value profile's form, or `{"type": "list", "items": [...]}` for a
@@ -40,7 +40,7 @@ Source and plan refusals cover every scalar operator (`eq`, `lt`, `lte`,
 indexes do not answer it, one case per pair: the equality-only text and
 integer, the match-only text, the ORE and block ORE text, the order-only
 float, the ciphertext-only bool and text, and the bytes field (equality
-and an order index no operator reads). The 128-bit integer (equality and
+alone: a declaration refuses an order index on bytes). The 128-bit integer (equality and
 OPE) and the 32-bit integer (equality and ORE) answer every operator but
 `matches`. The SQL-null integer shares the equality-only
 integer's indexes and is not repeated. A JSON document operator on an

conformance/stack-encrypt/v1/record-declarations-v1.cases.json

@@ -1916,7 +1916,11 @@
           }
         }
       },
-      "accepted": true
+      "accepted": false,
+      "expected_error": {
+        "code": "stack_encrypt::dynamic_plan",
+        "fields": { "reason": "index_not_admitted", "field": "value" }
+      }
     },
     {
       "id": "type-bytes-ope",
@@ -1929,7 +1933,11 @@
           }
         }
       },
-      "accepted": true
+      "accepted": false,
+      "expected_error": {
+        "code": "stack_encrypt::dynamic_plan",
+        "fields": { "reason": "index_not_admitted", "field": "value" }
+      }
     },
     {
       "id": "type-bytes-ore_block",
@@ -1942,7 +1950,11 @@
           }
         }
       },
-      "accepted": true
+      "accepted": false,
+      "expected_error": {
+        "code": "stack_encrypt::dynamic_plan",
+        "fields": { "reason": "index_not_admitted", "field": "value" }
+      }
     },
     {
       "id": "type-array-eq",

conformance/stack-encrypt/v1/record-query-refusals-v1.cases.json

@@ -51,7 +51,7 @@
     },
     "data": {
       "kind": "bytes",
-      "outputs": ["c", "eq", "ore"]
+      "outputs": ["c", "eq"]
     }
   },
   "cases": [
@@ -216,7 +216,7 @@
       }
     },
     {
-      "id": "lt-on-bytes-order-index",
+      "id": "lt-on-bytes",
       "field": "data",
       "operator": "lt",
       "input": {
@@ -773,7 +773,7 @@
       }
     },
     {
-      "id": "lte-on-bytes-order-index",
+      "id": "lte-on-bytes",
       "field": "data",
       "operator": "lte",
       "input": {
@@ -789,7 +789,7 @@
       }
     },
     {
-      "id": "gt-on-bytes-order-index",
+      "id": "gt-on-bytes",
       "field": "data",
       "operator": "gt",
       "input": {
@@ -805,7 +805,7 @@
       }
     },
     {
-      "id": "gte-on-bytes-order-index",
+      "id": "gte-on-bytes",
       "field": "data",
       "operator": "gte",
       "input": {
@@ -821,7 +821,7 @@
       }
     },
     {
-      "id": "between-on-bytes-order-index",
+      "id": "between-on-bytes",
       "field": "data",
       "operator": "between",
       "input": {
@@ -846,7 +846,7 @@
       }
     },
     {
-      "id": "matches-on-bytes-order-index",
+      "id": "matches-on-bytes",
       "field": "data",
       "operator": "matches",
       "input": {

conformance/stack-encrypt/v1/record-values-v1.cases.json

@@ -342,13 +342,12 @@
       "id": "bytes-binary",
       "kind": "bytes",
       "null": "",
-      "outputs": ["c", "eq", "ore"],
+      "outputs": ["c", "eq"],
       "input": {
         "type": "bytes",
         "text": "00ff10"
       },
-      "frame": "0b0300000000ff10",
-      "unanswered": ["ore"]
+      "frame": "0b0300000000ff10"
     },
     {
       "id": "string-nul",

conformance/stack-encrypt/values-contract.md

@@ -93,19 +93,21 @@ requirements 1 to 4: it stores no record, so no data key is generated, no
 term exists to compare and no ciphertext is opened; its row reads back as
 null.
 
-`unanswered` lists stored indexes no query operator answers for the kind. A
-query of such an index is refused as `operator_not_answered` in both
-runners. Today that is the order index on `bytes`: the declaration admits
-it and the engine stores an order term, but no dynamic operator reads it.
-
-This is a leak, not only a gap. Anyone who holds the stored rows can
-compare the order terms without a key. No query uses them.
-
-The typed Rust path has the same fault. An order index needs only
-`Orderable`, but its operators need `Ordered`, and `Vec<u8>` is not
-`Ordered`. The fix is to refuse an order index on `bytes` when it is
-declared, at compile time on the typed path. Data that Go rc.3 stored must
-stay readable. Until then, this entry keeps the behaviour visible.
+Every index a case declares is one a query operator answers for the kind,
+because a declaration admits no other. An order index on `bytes` is the
+case that shows it: the scheme defines an order term for bytes, but no
+ordering operator is answered over them, so a stored term would let anyone
+who holds two rows compare them without a key, and no query could use it.
+Both paths refuse it. The typed Rust path declares an order index over
+`Ordered`, the trait its operators need, and `Vec<u8>` is not `Ordered`,
+so the declaration does not compile. The dynamic path, which both runners
+use, refuses the declaration as `index_not_admitted`
+(`v1/record-declarations-v1.cases.json`, cases `type-bytes-ore`,
+`type-bytes-ope` and `type-bytes-ore_block`).
+
+A row stored under an earlier declaration of such an index still opens
+once the index is removed from the plan: opening ignores a stored term the
+plan does not declare.
 
 `expected_error` cases are refused before any pending operation, with the
 structured diagnostic `code`, `reason` and `field`, and no key call. They

docs/plans/2026-10-24-stack-encrypt-api-plan.md

@@ -2155,6 +2155,16 @@ review. The rules are the query artifact's.
      generated from the `op` types. Each index declares its operators and admitted
      plaintexts once, and `index_for` reads them. Overlap is refused on
      both paths. A test shows the typed and dynamic faces agree.
+     An index admits exactly the plaintexts one of its operators
+     answers. The typed path enforces this with a trait bound, not a
+     test: each order index, and each low-level order operation an
+     index can be built from, is declared over `op::Ordered`, the trait
+     its operators need. So an order index on bytes does not compile
+     (#1577). The dynamic path refuses the declaration, in
+     `dynamic::admits`, as `index_not_admitted`. A row stored under
+     such a declaration still opens once the index is removed from the
+     plan, because opening ignores a stored term the plan does not
+     declare.
   2. Derivation once, refusals once. The `sem` query functions, the
      analyzer in place of `MatchCase`, and `Match<Dynamic>` arrive.
      `check`, `verifier`, `admit`, `QueryToken`, `check_input`, and the

languages/golang/CHANGELOG.md

@@ -12,15 +12,27 @@ listed under **Breaking**. Releases are tagged `languages/golang/vX.Y.Z`.
 
 ### Breaking
 
+- **An order index on bytes is refused** (#1577). A `[]byte` field tagged
+  `index=ore` or `index=ope` is now a field error from `stashgen`. A plan
+  built by hand with an `ore`, `ope` or `ore_block` output on a `bytes`
+  field is refused by the guest (`index_not_admitted`) before any key is
+  requested. No ordering operator
+  is answered over bytes, so the field stored an order term that anyone
+  who read the column could compare and that no query could use.
+  `stashgen`'s notice for an index no generated method queries is gone
+  with the case it described. To upgrade, remove the index from the tag
+  and generate again. Rows stored with the term still open: opening
+  ignores a stored term the plan does not declare. The stored terms stay
+  in the database until the row is written again or the column is dropped.
+
 - **A field declares at most one order index** (#1233). The engine refuses
   a field tagged `index=ore;ope` (or `ore;ore_block`), so `stashgen` now
   reports it as a field error at generate time, and a plan built by hand
   with both is refused by the guest (`overlapping_outputs`) before any key
   is requested. Before, the field stored both terms and every query used
   the ORE one; the OPE term cost a write and told anyone who read the
   column how its values order. `stashgen`'s notice for a second order index
-  is gone with the case it described; the notice for an order index on
-  bytes stays.
+  is gone with the case it described.
 
 - **`Cipher.Extend` is now `Cipher.Scope`, and `Cipher.Bind` is new**
   (#1487). A scope narrows the data and the queries over it. A binding ties

languages/golang/encrypt/README.md

@@ -238,7 +238,7 @@ or a type defined over one (`type Email string`):
 | Go field | Seals as | Indexes it can store | Query methods |
 |---|---|---|---|
 | `string` | text | `equality`, `match`, `ore`, `ope` | `Eq`, `Matches`, `Lt`, `Lte`, `Gt`, `Gte`, `Between` |
-| `[]byte` | bytes | `equality`, `ore`, `ope` | `Eq` |
+| `[]byte` | bytes | `equality` | `Eq` |
 | `bool` | a boolean | none | none |
 | `int16`, `int32`, `int64`, `int` | an integer of the field's own width (`int` is 64-bit) | `equality`, `ore`, `ope` | `Eq`, `Lt`, `Lte`, `Gt`, `Gte`, `Between` |
 | `uint16`, `uint32`, `uint64`, `uint` | the same, unsigned | `equality`, `ore`, `ope` | the same |
@@ -249,9 +249,10 @@ or a type defined over one (`type Email string`):
 | `encrypt.Date` | a calendar date | `equality` | `Eq` |
 | `time.Time` | a timestamp, to the nanosecond, in UTC | `equality` | `Eq` |
 
-Each query method needs its index declared. An `ore` or `ope` index on bytes
-stores its term, but the engine answers no ordering through it, so such a
-field has no `Lt` (see [Queries](#queries)).
+Each query method needs its index declared. A field of bytes takes no `ore`
+or `ope` index: the engine answers no ordering over bytes, so the term
+would be stored and never queried, and `stashgen` refuses the declaration
+(see [Queries](#queries)).
 
 `encrypt.Date`, `Int128`, `Uint128` and `Decimal` are vitaminc's `vcvalue`
 types; build them with `encrypt.DateOf`, `ParseInt128`, `ParseUint128` and
@@ -333,11 +334,9 @@ one value, and every NaN is one value, above `+Inf`, so `Between(math.NaN(),
 math.Inf(1))` matches nothing. A `float32` orders as the `float64` it
 widens to.
 
-An order index on bytes stores its term but answers no ordering
-operator, so such a field has no `Lt`; nor does the `ope` index of a field
-that declares `ore` too, since `ore` answers the orderings. stashgen prints a notice for each such index, on stderr and in
-the generated file: the terms are stored, and only your own code can compare
-them. A match index on an index-only field (`index=match` with no `encrypt`)
+An order index on bytes is refused: no ordering operator is answered over
+bytes, so the term would be stored, where anyone who reads the column can
+compare it, and no query could use it. A match index on an index-only field (`index=match` with no `encrypt`)
 is refused, because `Verify` checks a match query's rows by decrypting them.
 
 Every query type implements `driver.Valuer`, so it binds as a parameter in

languages/golang/encrypt/exchange_conformance_test.go

@@ -227,10 +227,8 @@ func exchangeOperator(t testing.TB, index string) string {
 
 // checkExchangeTerms checks that every stored term is the term this
 // runner's own query of the same value derives: the query semantics of the
-// artifact, independent of who wrote it. An index the corpus lists as
-// unanswered has no operator to compare with, so only its presence is
-// checked.
-func checkExchangeTerms(t testing.TB, ctx context.Context, cipher *encrypt.Cipher, plan *record.Plan, field string, stored exchangeStored, declared, unanswered []string, input any, equal *conformanceInput, what string) {
+// artifact, independent of who wrote it.
+func checkExchangeTerms(t testing.TB, ctx context.Context, cipher *encrypt.Cipher, plan *record.Plan, field string, stored exchangeStored, declared []string, input any, equal *conformanceInput, what string) {
 	t.Helper()
 	if len(stored.Terms) != len(declared)-1 {
 		t.Fatalf("%s: stored %d terms for %v", what, len(stored.Terms), declared[1:])
@@ -240,13 +238,6 @@ func checkExchangeTerms(t testing.TB, ctx context.Context, cipher *encrypt.Ciphe
 		if !ok {
 			t.Fatalf("%s: no %s term", what, index)
 		}
-		skip := false
-		for _, u := range unanswered {
-			skip = skip || u == index
-		}
-		if skip {
-			continue
-		}
 		probes := []any{input}
 		if index == "eq" && equal != nil {
 			probes = append(probes, conformanceValue(t, *equal))
@@ -482,7 +473,7 @@ func consumeExchange(t testing.TB, ctx context.Context, cipher *encrypt.Cipher,
 				t.Fatalf("%s: a SQL null stores no term", what)
 			}
 		} else {
-			checkExchangeTerms(t, ctx, cipher, plan, corpus.Values.Field, stored, c.Outputs, c.Unanswered, input, c.EqualQuery, what)
+			checkExchangeTerms(t, ctx, cipher, plan, corpus.Values.Field, stored, c.Outputs, input, c.EqualQuery, what)
 			sealed[corpus.Values.Field] = exchangeOutputsOf(t, stored, what)
 		}
 		opened, err := cipher.Open(ctx, plan, []record.Sealed{sealed})
@@ -529,7 +520,7 @@ func consumeExchange(t testing.TB, ctx context.Context, cipher *encrypt.Cipher,
 				}
 				continue
 			}
-			checkExchangeTerms(t, ctx, cipher, plan, f.Name, outputs, f.Outputs, nil, conformanceValue(t, input), nil, what+": "+f.Name)
+			checkExchangeTerms(t, ctx, cipher, plan, f.Name, outputs, f.Outputs, conformanceValue(t, input), nil, what+": "+f.Name)
 			sealed[f.Name] = exchangeOutputsOf(t, outputs, what+": "+f.Name)
 		}
 		if len(stored.Passthrough) != passthroughs {