@@ -12,6 +12,29 @@ listed under **Breaking**. Releases are tagged `languages/golang/vX.Y.Z`.
 
 ### Added
 
+- **Test several members of one array element of a `JsonSearch` field
+  (#1442).** A field whose `ordered=` paths name members beneath an array's
+  wildcard (`$.contacts[*].relationship;$.contacts[*].calls`) gets
+  `Fields.<Field>.Elements.<Array>.Match`, one accessor per array, named as
+  `At` names a path (`Elements.Contacts`). `Match` takes
+  `encrypt.ElementPredicates` made with `encrypt.MemberEq`, `MemberLt`,
+  `MemberLte`, `MemberGt`, `MemberGte` and `MemberBetween`, and returns an
+  `eql.JSONSearchElementsQuery` for
+  `eql_v4.json_tree_element_match(col, $1::eql_v4.query_json_elements)`,
+  which finds a row where one element passes every predicate. An `EqAt` and
+  an ordering at the array's paths can each be answered by a different
+  element. Each comparison is of the member's ordering term, so `MemberEq`
+  compares text case- and accent-folded and integers past 2^53 can tie;
+  `EqAt` stays exact. A member the field does not order is refused before
+  the engine is asked, with `encrypt.ErrTerm`, naming the member and the
+  array; no predicates, a zero `ElementPredicate` and a member with a
+  wildcard are refused with `encrypt.ErrEncoding`. A row whose array is
+  longer than `JSONReadOptions.WildcardBound` (64 by default) fails the
+  query with SQLSTATE 22023. An `ElementPredicate` prints and logs its
+  member and comparison, never its values. The embedded EQL guest now names
+  the `eql_v4.query_json_elements` domain, so `Checker.Operators` lists
+  `element_match` (input `path_predicates`) on a field that orders a path.
+
 - **A two-letter word is searchable in `TextMatch`, `TextSearch` and
   `TextSearchOre` (#1309).** The EQL v4 match types index each two-letter
   word whole, beside the 3-grams of the text, so a two-letter surname such
 
@@ -178,6 +178,7 @@ The field's `Fields` entry has a method per operation:
 | `Selector(ctx, c, path)` | `encrypt.JSONSelection`: `Selector()` and `Open` | `col -> $1::text` |
 | `Subtree(ctx, c, path, opts)` | `encrypt.JSONRead`: `Tokens()`, `Open` and `OpenOne` | `eql_v4.json_tree_subtree(col, $1::text[], 64)` |
 | `Children(ctx, c, path)`, `ChildCount(ctx, c, path)` | `encrypt.JSONToken` | `eql_v4.json_tree_children(col, $1::text)`, `eql_v4.json_tree_child_count(col, $1::text)` |
+| `Elements.Visits.Match(ctx, c, predicates, opts)` | `eql.JSONSearchElementsQuery` | `eql_v4.json_tree_element_match(col, $1::eql_v4.query_json_elements)` |
 
 `At` has one accessor per ordered path, named for its keys (`$.visits[*].at` is `At.VisitsAt`, `$.a.1` is `At.A1`); two paths with one name, or one path given twice, stop `stashgen`.
 An ordering compares the value `->` extracts at its path, and EQL's `<` compares ordering terms alone, so take the selector from the same accessor (`At.Age.Selector`) rather than spelling the path again.
@@ -193,6 +194,32 @@ SELECT id FROM customers ORDER BY (
 ```
 
 with `$1` from `At.VisitsAt.Selector(ctx, c)` and `$2` from `At.VisitsAt.Gt(ctx, c, v)`; for the latest visit, order by `ORDER BY 1 DESC NULLS LAST` inside and `DESC` outside.
+
+Two queries at a wildcard path, an `EqAt` and an ordering say, can each be answered by a different element.
+To test several members of one element together, use `Match` under `Elements`.
+`Elements` has one accessor per array whose elements have an ordered member, named for the array's keys as `At` names a path: with `ordered=$.visits[*].at;$.visits[*].place`, `$.visits[*]` is `Elements.Visits`, with the members `at` and `place`.
+A root array (`ordered=$[*].name`) is `Elements.Root`.
+An ordered path that ends at its wildcard (`$.tags[*]`), or has none, gives no accessor, and a field without one has no `Elements`.
+Two arrays whose keys give one name (`$.a_b[*]` and `$.aB[*]` are both `AB`), and an array whose keys give no name, get no accessor: `stashgen` still writes the field and its `At`, and prints a notice naming the ordered paths, which the generated file repeats in a comment.
+
+```go
+// rows with one visit that is at home and after 15
+q, err := customers.Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.ElementPredicates{
+	encrypt.MemberEq("place", "home"),
+	encrypt.MemberGt("at", 15),
+}, encrypt.JSONReadOptions{})
+```
+
+```sql
+SELECT id FROM customers WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)
+```
+
+The predicates are `encrypt.MemberEq`, `MemberLt`, `MemberLte`, `MemberGt`, `MemberGte` and `MemberBetween` (inclusive), each with a member written as it is below the array in the tag (`place`, or `address.city`) and Go values, as the orderings take.
+A member the field does not order is refused before the engine is asked, with `encrypt.ErrTerm`, naming the member, the array and the members it orders; no predicates, and a member with a wildcard, are refused with `encrypt.ErrEncoding`.
+Each comparison is of the member's ordering term, so `MemberEq` is an equality of folded values: text compares case- and accent-folded (`"home"` equals `"Home"`), and integers past 2^53 can tie.
+`EqAt` at the member's full path is exact, of any element.
+`Match` reads each array to `opts.WildcardBound` elements, 64 when it is 0, and a row whose array is longer fails the query with SQLSTATE 22023 rather than answer over part of it: set the bound past the longest array.
+The function runs on each row a scan gives it, so narrow the rows first with an indexed predicate, such as `@>` on the same values.
 `OpenOne` reads one value and refuses a read whose path has a wildcard before anything is opened; open a wildcard read with `Open`.
 A needle and a value are Go values: a `json.RawMessage` of JSON text crosses as it is, and anything else is marshalled with `encoding/json`.
 `EqAt` and the orderings take a scalar: a string, a number, a bool, or `nil` for JSON `null`.
 
@@ -520,7 +520,7 @@ The EQL types the engine produces, and the Go field types each takes:
 | `Numeric` | `encrypt.Decimal` | none |
 | `NumericEq` | `encrypt.Decimal` | `=`, `<>` (`1.5 = 1.50`) |
 | `NumericOrd`, `NumericOrdOpe`, `NumericOrdOre` | `encrypt.Decimal` | `<`, `<=`, `>`, `>=`, `ORDER BY` |
-| `JsonSearch` (`eql.JSONSearch`) | struct, map, slice, or `json.RawMessage` | containment, equality at a path, ordering at declared paths, selection, subtree reads; see [Encrypted JSON documents](#encrypted-json-documents) |
+| `JsonSearch` (`eql.JSONSearch`) | struct, map, slice, or `json.RawMessage` | containment, equality at a path, ordering at declared paths, several members of one array element, selection, subtree reads; see [Encrypted JSON documents](#encrypted-json-documents) |
 
 Any built-in Go integer field takes an integer EQL type (ADR-0002): the field
 is sealed at the type's width, and opens back into the field's type. A type
@@ -658,6 +658,26 @@ element of each row, so an ordering over every element is written over
 `eql_v4.json_tree_path_query(col, $sel)`, its matches (the stashgen README
 shows the SQL).
 
+Two such queries can each be answered by a different element. To test
+several members of one array element together, use `Match` on the array's
+accessor under `Elements`. A field has one for each array whose elements
+have an ordered member (`ordered=$.visits[*].at;$.visits[*].place`):
+
+```go
+q, err := users.Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.ElementPredicates{
+	encrypt.MemberEq("place", "home"),
+	encrypt.MemberGt("at", 15),
+}, encrypt.JSONReadOptions{})
+rows, err := db.QueryContext(ctx, `SELECT id FROM users WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)`, q)
+```
+
+Each comparison is of the member's ordering term, so `MemberEq` compares
+text case- and accent-folded, and integers past 2^53 can tie; `EqAt` is
+exact. A member the field does not order is refused before the engine is
+asked, naming it. A row whose array is longer than
+`JSONReadOptions.WildcardBound` (64 by default) fails the query with
+SQLSTATE 22023.
+
 ## Building
 
 The package embeds `wasm/stack_encrypt_guest.wasm`, a build artefact of the
 
@@ -242,6 +242,22 @@
 // A selection or a subtree read opens values as JSON text ([JSONValue],
 // [JSONRead.Open]). [DecodeJSON] reads one into a Go type.
 //
+// Two queries at an array's paths can each be answered by a different
+// element. To test several members of one element together, use Match on
+// the array's accessor under Elements, which a field has for each array
+// whose elements have an ordered member:
+//
+//	q, err := customers.Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.ElementPredicates{
+//		encrypt.MemberEq("place", "home"),
+//		encrypt.MemberGt("at", 15),
+//	}, encrypt.JSONReadOptions{})
+//	// WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)
+//
+// Each comparison is of the member's ordering term, so [MemberEq] compares
+// text case- and accent-folded, and integers past 2^53 can tie. A row whose
+// array is longer than [JSONReadOptions.WildcardBound] (64 by default)
+// fails the query with SQLSTATE 22023.
+//
 // # Cancellation
 //
 // Every call takes a [context.Context], and a call whose context is
 
@@ -1,8 +1,9 @@
 # Typed encrypted JSON document example
 
 This program stores a Go `Profile` struct as one encrypted EQL v4 JSON column.
-It finds a row by containment, compares an ordered path, decrypts a whole
-profile, and opens only the visit times from another query.
+It finds a row by containment, compares an ordered path, finds a row where one
+visit passes two tests, decrypts a whole profile, and opens only the visit
+times from another query.
 
 ## Run
 
@@ -35,8 +36,25 @@ its `stash` tags. After changing the struct or tags, run this from
 go generate ./encrypt/example/json
 ```
 
-`Profile` uses `encoding/json` for the document shape. The `ordered=$.age`
-tag adds an ordering term for that path. A containment needle made from a
+`Profile` uses `encoding/json` for the document shape. The
+`ordered=$.age;$.visits[*].at;$.visits[*].place` tag adds an ordering term
+for each of those paths. Because `at` and `place` are ordered members of
+each visit, the generated `Fields.Profile.Elements.Visits.Match` tests both
+on one visit:
+
+```go
+q, err := Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.ElementPredicates{
+	encrypt.MemberEq("place", "home"),
+	encrypt.MemberGt("at", 15),
+}, encrypt.JSONReadOptions{})
+// SELECT id FROM customers WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)
+```
+
+Ada has a visit at home and a visit after 15, but no one visit that is both,
+so only Bea's row matches. Each comparison is of the ordering term, so text
+compares case- and accent-folded. A row with more visits than
+`JSONReadOptions.WildcardBound` (64 by default) fails the query with SQLSTATE
+22023. A containment needle made from a
 struct includes every field without `omitempty`, including zero values;
 `main.go` uses a map to name only the member being queried. The prepared
 subtree read returns JSON text, which `encrypt.DecodeJSON[int64]` decodes.
 
@@ -50,8 +50,8 @@ func run(ctx context.Context) error {
 	defer client.Close()
 	cipher := client.DefaultKeyset()
 	customers := []Customer{
-		{ID: 1, Profile: Profile{Name: "Ada", Age: 35, Visits: []Visit{{At: 10}, {At: 20}}}},
-		{ID: 2, Profile: Profile{Name: "Bea", Age: 28, Visits: []Visit{{At: 30}}}},
+		{ID: 1, Profile: Profile{Name: "Ada", Age: 35, Visits: []Visit{{At: 10, Place: "home"}, {At: 20, Place: "work"}}}},
+		{ID: 2, Profile: Profile{Name: "Bea", Age: 28, Visits: []Visit{{At: 30, Place: "home"}}}},
 	}
 	sealed, err := Encrypt(ctx, cipher, customers)
 	if err != nil {
@@ -101,6 +101,26 @@ func run(ctx context.Context) error {
 	}
 	fmt.Printf("customer older than 30: %d\n", olderID)
 
+	// Test two members of one visit together: a visit at home after 15.
+	// Ada has a visit at home and a visit after 15, but not one visit that
+	// is both, so only Bea's row matches. Match compares ordering terms, so
+	// "Home" would equal "home": text compares case- and accent-folded.
+	homeLate, err := Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.ElementPredicates{
+		encrypt.MemberEq("place", "home"),
+		encrypt.MemberGt("at", 15),
+	}, encrypt.JSONReadOptions{})
+	if err != nil {
+		return fmt.Errorf("prepare visit match: %w", err)
+	}
+	var homeLateID int64
+	if err := conn.QueryRowContext(ctx,
+		`SELECT id FROM customers WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)`,
+		homeLate,
+	).Scan(&homeLateID); err != nil {
+		return fmt.Errorf("find a visit at home after 15: %w", err)
+	}
+	fmt.Printf("customer with a visit at home after 15: %d\n", homeLateID)
+
 	// Read only the visit times of one row. The database returns encrypted
 	// entries; Open checks them against the prepared read and returns JSON text.
 	read, err := Fields.Profile.Subtree(ctx, cipher, "$.visits[*].at", encrypt.JSONReadOptions{})
 
@@ -6,10 +6,12 @@ package main
 
 // Visit is one visit stored inside a customer's encrypted profile.
 type Visit struct {
-	At int64 `json:"at"`
+	At    int64  `json:"at"`
+	Place string `json:"place"`
 }
 
-// Profile is a typed JSON document. Its Age is searchable by order.
+// Profile is a typed JSON document. Its Age, and each visit's At and Place,
+// are searchable by order.
 type Profile struct {
 	Name   string  `json:"name"`
 	Age    int64   `json:"age"`
@@ -20,5 +22,5 @@ type Profile struct {
 type Customer struct {
 	_       struct{} `stash:"context=customers"`
 	ID      int64    `stash:"id,passthrough"`
-	Profile Profile  `stash:"profile,encrypt_into=JsonSearch(ordered=$.age)"`
+	Profile Profile  `stash:"profile,encrypt_into=JsonSearch(ordered=$.age;$.visits[*].at;$.visits[*].place)"`
 }