fix(stack-encrypt): address the review of the planned lowering

The review of #1597 found five in-diff mutants surviving. Three were
equivalent: the "keys nothing" distinction in `compose` under a label
context, where a passthrough ignores its context either way, and the
context-field disjunct of the predicate, dead because a context field
is always a passthrough. The distinction is removed rather than
excluded. Two were checks nothing reached: `check_stored` and
`check_names` are now reached by unit tests in `planned.rs`.

`validate` is deleted. Its duplicate-field and label rules were refused
by the parser first; the one live rule, shared identity between keyed
fields, is in `Plan::build`'s loop beside the target rule. The
builder's `join`, `field_label`, `FROM_PLAN` and `FROM_CALL` are shared
with the lowering rather than copied. A target field is skipped by
`operation_of` returning `None`, so no `unreachable!` sits in library
code. Docs that still described lowering through the builder, or that
said the checks run the lowering, are reworded: the checks share
`check_names`, `check_stored` and `opening_base` with it.

Tests added: a context field declared last, a batch with absent fields
under a context field opened with an expected context, the stored and
value checks refusing each kind of misfit, and the shared-identity
table with exact reasons.

Refs #1488.

Author: coderdan

docs/plans/2026-10-24-stack-encrypt-api-plan.md

@@ -1998,8 +1998,9 @@ table.
   `dynamic::planned::compose` and `opening` build each field's combinator
   from the parsed plan, and `encrypt_with`, `decrypt_with`, `contexts()`
   and the checks read them. The dynamic path no longer uses the plan
-  builder. The builder, the chain, the old traits and `Label` are still
-  to be removed.
+  builder. Those functions do not yet build a `Planned`: they run the
+  lowering themselves. That inversion, the builder, the chain, the old
+  traits and `Label` are still to be removed.
 - **Tracked in.** Issue #1488 is open. Its first pull request is the
   lowering; the removals follow it.
 - **Finished when** the old API is gone, and every consumer uses the new

packages/stack-encrypt/CHANGELOG.md

@@ -58,16 +58,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `K: 'static`, as `record::encrypt_with` does. The key source's bounds
   apply when the pending is awaited, not when the term is described.
 
-### Changed
-
-- **A data plan lowers to the combinators directly** (#1488, first part).
-  `dynamic::planned::compose` and `opening` build each field's combinator
-  from the parsed plan. The dynamic entry points run them: `encrypt_with`,
-  `decrypt_with`, `check_source`, `check_record`, and `Plan::contexts`.
-  The plan builder is no longer in the dynamic path. No stored byte
-  changes: the record shape, the terms, and the contexts are the ones the
-  builder's lowering produced, and the conformance vectors pin them.
-
 ### Breaking
 
 - **Every operator is declared once, and `op::Supports` has one method**
@@ -507,6 +497,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **A data plan lowers to the combinators directly** (#1488, first part).
+  `dynamic::planned::compose` and `opening` build each field's combinator
+  from the parsed plan, and the dynamic entry points run them:
+  `encrypt_with`, `decrypt_with`, `check_source`, `check_record`, and
+  `Plan::contexts`. The checks a binding asks without a cipher share
+  `check_names`, `check_stored` and `opening_base` with the lowering. The
+  plan builder is no longer in the dynamic path. No stored byte changes:
+  the record shape, the terms, and the contexts are the ones the
+  builder's lowering produced, and the conformance vectors pin them.
 - **The context parameter of the cipher-directed methods is named
   `context`, not `aad`** (#1568): `KeysetCipher::encrypt_tree`,
   `KeysetCipher::decrypt_tree`, `StackCipher::decrypt`,

packages/stack-encrypt/docs/adr/0007-bindings-enter-through-a-plan-never-a-second-executor.md

@@ -382,6 +382,9 @@ The first pull request for #1488 did the lowering: `compose` and
 `opening` in `dynamic::planned` build the combinators from the parsed
 plan, and `encrypt_with`, `decrypt_with`, `check_source`, `check_record`
 and `contexts()` run them. The builder is no longer in the dynamic path.
+The inversion is still to come: those functions run `compose` and
+`opening` themselves rather than building a `Planned`, so `Planned` and
+the record functions are two callers of one lowering until then.
 
 **The derive emits no plan.** `encryption_plan()` is not added. A typed
 query starts from a field marker. The marker has the field's context and