@@ -20,12 +20,17 @@
 //! The output type selects the encryption operations: [`TextEq`] includes
 //! ciphertext and an equality term, while [`TextEqQuery`] contains only the term.
 //!
+//! An [`Identifier`] is Stack Encrypt's [`Describe`]: its ZeroKMS descriptor is
+//! the table and the column as two parts, rendered `users/email`, the same
+//! context and descriptor as the two-segment [`stack_encrypt::Label`]. A
+//! direct consumer of Stack Encrypt names its data with a `Label`; an EQL
+//! consumer names it with an `Identifier`, and the two interoperate.
+//!
 //! This complete example runs locally without credentials. It uses real
 //! encryption with `stack_kms::FakeDataKeySource`, whose keys exist only for
 //! this process. Add `stack-encrypt`, `stack-kms` (with `default-features = false`
 //! and `features = ["test-support"]`), and `tokio` (with `features = ["rt", "macros"]`)
-//! to your example's dependencies. Stack Encrypt is currently unpublished;
-//! use the local development helper described in the crate README.
+//! to your example's dependencies.
 //!
 //! The code below is executed by `cargo test -p eql-encryption-tests --test
 //! text_eq_example`. It is excluded from this crate's doctests so its optional
@@ -72,9 +77,9 @@ use stack_encrypt::sem::EqualityTerm;
 use stack_encrypt::target::transcode::{Reader, Transcode, Visitor};
 use stack_encrypt::target::{self, AeadContext, CallerContext};
 use stack_encrypt::{
-    CipherText, ContextPiece, Decrypt, DecryptField, DecryptInto, Decryptable, Decryption, Encrypt,
-    EncryptFrom, Encryption, Error, IntoContext, MaybeEmpty, NonEmpty, SealedValue,
-    StackCipherText,
+    CipherText, ContextPiece, Decrypt, DecryptField, DecryptInto, Decryptable, Decryption,
+    Describe, DescriptorBuilder, Encrypt, EncryptFrom, Encryption, Error, IntoContext, MaybeEmpty,
+    NonEmpty, SealedValue, StackCipherText,
 };
 use vitaminc_prf::PrfValue;
 
@@ -110,13 +115,27 @@ impl MaybeEmpty for Identifier {
         self.t.is_empty() || self.c.is_empty()
     }
 }
+/// The identifier's descriptor is the table and the column, two parts: it
+/// renders `users/email` in the ZeroKMS log, and a table or column that
+/// contains `/` is escaped rather than read as two. The same two parts are the
+/// context the ciphertext is sealed under and the equality term is derived
+/// under ([`IntoContext`] below returns [`Describe::to_context`]), so the
+/// descriptor ZeroKMS binds and the AAD never disagree. It is the same
+/// context as the two-segment [`stack_encrypt::Label`] and as the pair a
+/// `#[stash(struct = .., context = "<table>")]` derive binds.
+impl Describe for Identifier {
+    fn describe(&self, out: &mut DescriptorBuilder) {
+        let _ = out.text(self.t.as_str()).text(self.c.as_str());
+    }
+}
+
 // One context view serves both derivations: vitaminc's `IntoAad` and
 // `IntoPrfContext` are blankets over `IntoContext`, so the ciphertext AAD, the
 // ZeroKMS descriptor and the equality term's PRF context all see the same
-// (table, column) pair.
+// (table, column) pair — the one `Describe` pushes.
 impl<'a> IntoContext<'a> for Identifier {
     fn into_context(self) -> ContextPiece<'a> {
-        (self.t, self.c).into_context()
+        self.to_context()
     }
 }
 
@@ -158,7 +177,11 @@ impl<S: Encrypt + Clone> EncryptFrom<S> for Ciphertext {
     }
 }
 
-struct NativeCiphertextVisitor;
+/// Reads a stored `c` back as the native sealed leaf it encodes. Public for
+/// the encryption test crate, which opens the leaf with Stack Encrypt directly
+/// to prove the two decryption paths agree; not part of the supported API.
+#[doc(hidden)]
+pub struct NativeCiphertextVisitor;
 impl Visitor for NativeCiphertextVisitor {
     type Value = StackCipherText;
     fn sealed(self, leaf: SealedValue) -> Result<Self::Value, Error> {
@@ -219,3 +242,50 @@ impl<P, Ctx> DecryptField<P, Ctx> for Hmac256 {
         None
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use stack_encrypt::{nonempty, Descriptor, Label};
+
+    use super::*;
+
+    fn id(t: &str, c: &str) -> Identifier {
+        Identifier {
+            t: t.into(),
+            c: c.into(),
+        }
+    }
+
+    #[test]
+    fn an_identifier_describes_as_table_slash_column() {
+        let email = id("users", "email");
+        assert_eq!(email.descriptor().as_str(), "users/email");
+        assert_eq!(Descriptor::of(email.clone()).as_str(), "users/email");
+        // Through `for_column`, the context the targets are sealed under.
+        let column = Identifier::for_column("users", "email").unwrap();
+        assert_eq!(Descriptor::of(column).as_str(), "users/email");
+    }
+
+    #[test]
+    fn an_identifier_is_the_two_segment_label_and_the_derive_pair() {
+        let email = id("users", "email");
+        let label = Label::new(["users", "email"]).unwrap();
+        assert_eq!(email.to_context(), label.to_context());
+        assert_eq!(email.clone().into_context(), label.into_context());
+        assert_eq!(
+            email.into_context(),
+            nonempty!("users").with("email").into_context()
+        );
+    }
+
+    #[test]
+    fn a_separator_in_a_name_is_escaped_never_a_third_part() {
+        let odd = id("users/email", "x");
+        assert_eq!(odd.descriptor().as_str(), "b64:dXNlcnMvZW1haWw=/x");
+        assert_ne!(odd.descriptor(), id("users", "email").descriptor());
+        assert_ne!(
+            odd.descriptor(),
+            Descriptor::of(nonempty!("users").with("email").with("x"))
+        );
+    }
+}
@@ -56,7 +56,7 @@ impl DomainType for Text {
     doc = " Plaintext input and decrypted output: [`String`]. With the `stack-encrypt` feature, implements `EncryptFrom<String>` and `DecryptInto<String>`."
 )]
 #[cfg_attr(
-    doc,
+    all(doc, feature = "stack-encrypt"),
     doc = " Encryption context: `NonEmpty<Identifier>`, constructed with `Identifier::for_column(table, column)` and stored in `i`."
 )]
 #[cfg_attr(
@@ -340,7 +340,7 @@ impl DomainType for TextSearch {
     doc = " Plaintext input: [`String`]. With the `stack-encrypt` feature, implements `EncryptFrom<String>` to build equality query terms. Query operands do not decrypt."
 )]
 #[cfg_attr(
-    doc,
+    all(doc, feature = "stack-encrypt"),
     doc = " Encryption context: `NonEmpty<Identifier>`, constructed with `Identifier::for_column(table, column)` and stored in `i`."
 )]
 #[cfg_attr(
 
@@ -304,15 +304,41 @@ fn render_query_struct(family: &DomainFamily, domain: &Domain) -> TokenStream {
     }
 }
 
-/// Text equality is the first supported encryption domain. Keep attributes in
-/// the generator so regeneration preserves the opt-in derives without enabling
-/// other domains before their operations and plaintext contracts are supported.
+/// The `(family, domain)` pairs whose generated structs carry the opt-in
+/// `stack-encrypt` derives. Text equality is the first; every other stored
+/// domain has a reason in [`encryption_gap`], and a test holds the two
+/// together so a new domain cannot arrive without either a derive or a reason.
+pub const ENCRYPTION_DOMAINS: &[(&str, &str)] = &[("text", "eq")];
+
+/// Why a stored domain carries no `stack-encrypt` derive yet, or `None` when
+/// it does. Derived from the catalog's own facts (family, terms), not from a
+/// per-domain list, so it answers for a domain added tomorrow.
+pub fn encryption_gap(family: &DomainFamily, domain: &Domain) -> Option<&'static str> {
+    if ENCRYPTION_DOMAINS.contains(&(family.name, domain.name)) {
+        return None;
+    }
+    Some(if family.name != "text" {
+        "only the text family's plaintext encoding is specified for the stack-encrypt \
+         producer profile; the numeric, date, boolean and JSON encodings are plan section 2 \
+         and have not been settled"
+    } else if domain.terms.iter().any(|t| !matches!(t, Term::Hm)) {
+        "ordering and match terms need stack-encrypt operations that have not landed \
+         (block-ORE and OPE term derivation, bloom-filter match terms)"
+    } else {
+        "the storage-only text domain follows once TextEq is proven end to end in \
+         PostgreSQL and the interoperability matrix is recorded"
+    })
+}
+
+/// Keep attributes in the generator so regeneration preserves the opt-in
+/// derives without enabling other domains before their operations and
+/// plaintext contracts are supported ([`ENCRYPTION_DOMAINS`]).
 fn encryption_attrs(
     family: &DomainFamily,
     domain: &Domain,
     query: bool,
 ) -> (TokenStream, TokenStream, TokenStream) {
-    if family.name != "text" || domain.name != "eq" {
+    if encryption_gap(family, domain).is_some() {
         return Default::default();
     }
     let decrypt = (!query).then(
@@ -329,7 +355,7 @@ fn encryption_attrs(
         quote! {
             #[cfg_attr(doc, doc = "")]
             #[cfg_attr(doc, doc = #plaintext)]
-            #[cfg_attr(doc, doc = " Encryption context: `NonEmpty<Identifier>`, constructed with `Identifier::for_column(table, column)` and stored in `i`.")]
+            #[cfg_attr(all(doc, feature = "stack-encrypt"), doc = " Encryption context: `NonEmpty<Identifier>`, constructed with `Identifier::for_column(table, column)` and stored in `i`.")]
             #[cfg_attr(all(doc, feature = "stack-encrypt"), doc = " See the [complete encryption example](crate::encryption#example).")]
             #[cfg_attr(feature = "stack-encrypt", derive(stack_encrypt::EncryptFrom))]
             #decrypt
@@ -1405,4 +1431,36 @@ mod tests {
         // Idempotent: re-running rustfmt over the output changes nothing.
         assert_eq!(rustfmt(&out), out);
     }
+    /// Plan section 5: catalog-derived coverage, with an explicit reason for
+    /// every domain that carries no derive. The catalog is the input, so a
+    /// domain added tomorrow fails here until it has a derive or a reason.
+    #[test]
+    fn every_stored_domain_has_an_encryption_derive_or_a_reason() {
+        let mut derived = Vec::new();
+        for (family, domain) in stored_payload_domains() {
+            match encryption_gap(family, domain) {
+                None => derived.push((family.name, domain.name)),
+                Some(reason) => assert!(
+                    !reason.is_empty(),
+                    "{}: an empty reason explains nothing",
+                    domain.full_name(family.name)
+                ),
+            }
+        }
+        // Every derived pair is a real catalog domain, and every catalog
+        // derive is listed: the list and the catalog agree both ways.
+        assert_eq!(derived, ENCRYPTION_DOMAINS.to_vec());
+        // The generated attributes follow the same answer: exactly the listed
+        // pairs carry the opt-in derive.
+        for (family, domain) in stored_payload_domains() {
+            let (attrs, _, _) = encryption_attrs(family, domain, false);
+            let has_derive = attrs.to_string().contains("stack_encrypt :: EncryptFrom");
+            assert_eq!(
+                has_derive,
+                ENCRYPTION_DOMAINS.contains(&(family.name, domain.name)),
+                "{}",
+                domain.full_name(family.name)
+            );
+        }
+    }
 }
@@ -1,23 +1,15 @@
 mod common;
 
+use eql_bindings::encryption::NativeCiphertextVisitor as NativeLeaf;
 use eql_bindings::v3::terms::{Ciphertext, Hmac256};
 use eql_bindings::v3::text::{TextEq, TextEqQuery};
 use eql_bindings::{Identifier, SchemaVersion};
-use stack_encrypt::target::transcode::{Reader, Transcode, Visitor};
-use stack_encrypt::{
-    Cipher, CipherText, Encrypt, Error, IntoAad, NonEmpty, SealedValue, StackCipherText,
-};
+use stack_encrypt::target::transcode::{Reader, Transcode};
+use stack_encrypt::{Cipher, Encrypt, IntoAad, NonEmpty};
 
 fn column() -> NonEmpty<Identifier> {
     Identifier::for_column("users", "email").unwrap()
 }
-struct NativeLeaf;
-impl Visitor for NativeLeaf {
-    type Value = StackCipherText;
-    fn sealed(self, leaf: SealedValue) -> Result<Self::Value, Error> {
-        Ok(CipherText::Single(leaf))
-    }
-}
 
 #[tokio::test]
 async fn text_round_trips_through_json_and_both_canonical_directions() {