feat(stack-encrypt)!: a data plan field with a term output declares its type

Closes #1082 (CIP-4326). A data plan field with any term output (eq,
match, ore, ope) and no "type" is now refused when the plan is built, with
Error::Plan, by record::plan, plan_with and Plan::new / new_with alike: an
indexed field's terms derive from the one declared kind, and every value is
checked against it on the way in and on the way out, so the engine never
trusts a binding to have tagged each value the same way. Before this a 34
sent once as a Float64 and once as an Int64 under one "ore" field was
accepted both times and stored two terms. That gap was kept open only
until the Go side filled the type; the Go SDK (#1094) fills it on every
field from the Go kind, so nothing a binding sends today is refused.

The type stays optional where no term derives from the field: a field whose
only output is "c" or "passthrough", and a target field, whose kind is the
EQL type's own (#1095). Declaring a type changes no stored byte (#1093), so
no row is re-encrypted. The IndexSpec: Index<Value> dispatch is unchanged:
the value still carries its tag, now always checked against a declaration
before the term is derived. The "transitional" wording goes from the
dynamic module, kind and record docs and from the plan document.

Tests: refused at build for every index kind, alone and beside a
ciphertext, spelled as a key and as the match object form, by the parser
and by hand; a sealed-only and a passthrough field still build, seal and
open without a type. Every test that indexed an untyped field now declares
the type; the one that fed a float to an untyped equality field now shows
there is no such field to feed, since float64 is refused at build and an
integer kind refuses the float value. The guest's native tests and
plan_check cover the refusal; the check_record fuzz generator emits a
"type" entry so indexed plans still parse under fuzzing.

Claude-Session: https://claude.ai/code/session_01V3WFXwax4J3uecpFEJ6yHc

Author: coderdan

docs/plans/2026-10-04-plan-builder.md

@@ -1122,9 +1122,10 @@ uses the guest.
    kinds, not new names. A wire-format addition, so it goes in the first
    engine PR. This is the one gap in the plan approach itself that the
    language check found. #1069 added the type to the grammar as an optional
-   key, so a field with none is still dispatched on each value's own tag;
-   that is transitional, until Go fills the type (#1046) and the key becomes
-   required on indexed fields.
+   key; the Go SDK fills it on every field from the Go type (#1094), and
+   since #1082 the key is required on every field with a term output: a plan
+   whose indexed field has none is refused when it is built. A field that
+   only seals, or only carries its value through, may still leave it out.
 2. **The guest's synchronous transport import, on the edge path only.**
    `transport_send` is synchronous from the guest's point of view and the ABI
    relies on it ("`block_on` never parks"). A wazero host function may block a

languages/golang/encrypt/guest/tests/native_ops.rs

@@ -163,13 +163,15 @@ fn plan_under(ctx: impl Fn(&str) -> FfiValue) -> Vec<u8> {
             obj(vec![
                 ("context", ctx("age")),
                 ("outputs", FfiValue::Array(vec![s("c"), s("eq"), s("ore")])),
+                ("type", s("uint32")),
             ]),
         ),
         (
             "name",
             obj(vec![
                 ("context", ctx("name")),
                 ("outputs", FfiValue::Array(vec![s("c"), s("match")])),
+                ("type", s("string")),
             ]),
         ),
     ]))
@@ -1296,6 +1298,17 @@ fn plan_check_answers_without_a_cipher() {
     )]));
     assert_eq!(ops::plan_check(&bad_index), Err(STATUS_ENCODING));
 
+    // an indexed field with no declared type: every term derives from one
+    // declared kind, so the plan is refused before any value arrives.
+    let untyped_index = encode(obj(vec![(
+        "age",
+        obj(vec![
+            ("context", label("age")),
+            ("outputs", FfiValue::Array(vec![s("c"), s("eq")])),
+        ]),
+    )]));
+    assert_eq!(ops::plan_check(&untyped_index), Err(STATUS_ENCODING));
+
     // a one-segment context is not a label a fields plan can seal under.
     let one_segment = encode(obj(vec![(
         "age",

packages/stack-encrypt/CHANGELOG.md

@@ -32,6 +32,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Breaking
 
+- **A data plan field with a term output must declare its `"type"`.** A
+  plan whose indexed field (`"eq"`, `"match"`, `"ore"`, `"ope"`) has no
+  `"type"` is refused when it is built (`Error::Plan`), by `record::plan`,
+  `record::plan_with` and `Plan::new` / `Plan::new_with` alike: the field's
+  terms derive from the one declared kind, with every value checked against
+  it, never from whatever tag each value arrived with. The type stays
+  optional on a field whose only output is `"c"` or `"passthrough"`, and on
+  a target field, whose kind is the EQL type's own. The Go SDK already
+  fills `"type"` on every field from the Go type, and `record.Plan.Validate`
+  refuses an indexed `Untyped` field naming it, so generated code is
+  unaffected; a plan written by hand without types must add them. Declaring
+  a type changes no stored byte, so no row is re-encrypted.
+
 - **A target description carries a source mode.** `Encryption` gains a
   last type parameter, `M: SourceMode = Borrowed`, saying how it is handed
   its plaintext. Code that names `Encryption<'s, S, T, K, Ctx>` still

packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs

@@ -166,12 +166,41 @@ enum SpecEntry {
     Context(Ctx),
     Outputs(Vec<Name>),
     Target(Name),
+    /// A `"type"`: required on an indexed field, so a plan with terms parses
+    /// only when one of these names a kind that admits them.
+    Type(Kind),
     ContextWrongShape(u32),
     OutputsWrongShape(u32),
     TargetWrongShape(u32),
     Unknown(Ctx),
 }
 
+/// A `"type"` value: a few kinds, and a name that is not one.
+#[derive(Arbitrary, Debug, Clone, Copy)]
+enum Kind {
+    UInt32,
+    Int64,
+    String,
+    Bytes,
+    Float64,
+    Object,
+    NotAKind,
+}
+
+impl Kind {
+    fn as_str(self) -> &'static str {
+        match self {
+            Kind::UInt32 => "uint32",
+            Kind::Int64 => "int64",
+            Kind::String => "string",
+            Kind::Bytes => "bytes",
+            Kind::Float64 => "float64",
+            Kind::Object => "object",
+            Kind::NotAKind => "integer",
+        }
+    }
+}
+
 impl SpecEntry {
     fn into_entry(self) -> (String, FfiValue) {
         match self {
@@ -189,6 +218,7 @@ impl SpecEntry {
                 "target".to_string(),
                 FfiValue::String(name.as_str().into()),
             ),
+            SpecEntry::Type(kind) => ("type".to_string(), FfiValue::String(kind.as_str().into())),
             SpecEntry::ContextWrongShape(v) => ("context".to_string(), FfiValue::UInt32(v)),
             SpecEntry::OutputsWrongShape(v) => ("outputs".to_string(), FfiValue::UInt32(v)),
             SpecEntry::TargetWrongShape(v) => ("target".to_string(), FfiValue::UInt32(v)),

packages/stack-encrypt/src/dynamic/kind.rs

@@ -33,8 +33,10 @@
 //!   types of its own can rely on the declaration for what it gets back (an
 //!   integer, not a float; bytes, not a string).
 //!
-//! A field with no `"type"` is dispatched on each value's own tag. That is
-//! transitional; see [`record::plan`](super::record::plan()).
+//! Every field with a term output declares its kind; a plan whose indexed
+//! field has none is refused when it is built
+//! ([`record::plan`](super::record::plan())). A field that only seals, or
+//! only carries its value through, may leave it out: no term derives from it.
 use vitaminc_aead_value::{FfiValue, ValueKind};
 
 use super::Error;

packages/stack-encrypt/src/dynamic/mod.rs

@@ -59,9 +59,9 @@
 //! vitaminc's [`ValueKind`], re-exported here, whose names vitaminc freezes
 //! beside its tag table. This crate adds only what a kind means to an index
 //! ([`admits`]) and to a query value ([`read`]); it decides nothing about
-//! the bytes ([`record`]). A field without `"type"` is dispatched on each
-//! value's own tag; that is transitional, and [`record::plan`] says until
-//! when.
+//! the bytes ([`record`]). Every field with a term output declares one;
+//! a plan whose indexed field has none is refused when it is built
+//! ([`record::plan`]).
 //!
 //! For the same reason the enums that spell them — [`Output`],
 //! [`IndexSpec`] and [`ValueKind`] — are *not* `#[non_exhaustive]`, against this workspace's