fix(stack-encrypt): address the review of removing target::legacy

The review of the removal found no slip in the rewritten tests. It
found four places where the prose was incomplete or out of date.

- CHANGELOG: the upgrade note gave no replacement for
  P::decrypt_from(stored, &cipher), and did not say how to name the
  target that Target::encrypt_from named in its path. It now has a
  table with one replacement for each removed call. It also warns that
  a source that is already a reference must be passed as it is. The
  removed methods took it through method-call autoref, so a &String
  receiver encrypted a String. encrypt_as(&value, ..) on a &String
  encrypts a &String, and into StackCipherText that compiles.
- tests/ui/bare_context.rs: the module doc described the
  _with_context forms, which the cases no longer call. It now says
  what the snapshot pins: a &str does not convert into a context.
- ADR-0012 said the target::legacy helpers stay until plans, EQL, Go
  and the guest move to the owned API. They are now removed first.
- The API plan: a stray comma in one code comment.

Author: coderdan

docs/plans/2026-10-24-stack-encrypt-api-plan.md

@@ -293,8 +293,8 @@ let email = Identifier::for_column("members", "email")?;
 let age = Identifier::for_column("members", "age")?;
 
 // Not on `next` yet: the new traits for EQL types, and a borrowed value
-// and context. Today this needs `keyset.encrypt_as(&value, context)`,
-// and an owned context.
+// and context. Today this needs `keyset.encrypt_as(&value, context)`
+// with an owned context.
 let by_email: TextEqQuery = "alice@example.com"
     .encrypt_into_with_context(&keyset, Scope::new(&email))
     .await?;

packages/stack-encrypt/CHANGELOG.md

@@ -104,9 +104,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - To upgrade a type that implements only `EncryptFrom` or
     `DecryptInto`, call the cipher. The context is `T::Context`, so
     convert it with `into()`:
-    `keyset.encrypt_as(&value, context.into())`,
-    `keyset.encrypt_as(&value, Default::default())` for a record with no
-    caller context, and `cipher.decrypt_as(stored, context.into())`.
+
+    | Removed call | Replacement |
+    | --- | --- |
+    | `value.encrypt_into(&keyset)` | `keyset.encrypt_as(&value, Default::default())` |
+    | `value.encrypt_into_with_context(&keyset, context)` | `keyset.encrypt_as(&value, context.into())` |
+    | `Target::encrypt_from(&value, &keyset, context)` | `keyset.encrypt_as::<_, Target>(&value, context.into())` |
+    | `stored.decrypt_into(&cipher, context)` | `cipher.decrypt_as(stored, context.into())` |
+    | `P::decrypt_from(stored, &cipher)` | `cipher.decrypt_as::<P, _>(stored, Default::default())` |
+    | `P::decrypt_from_with_context(stored, &cipher, context)` | `cipher.decrypt_as::<P, _>(stored, context.into())` |
+
+    `encrypt_as` does not name the target, so name it with a type
+    annotation on the result or with the turbofish shown.
+  - If `value` is already a reference, pass it as it is:
+    `keyset.encrypt_as(value, ..)`. The removed methods took the value
+    through method-call autoref, so a `&String` receiver encrypted a
+    `String`. `encrypt_as(&value, ..)` on a `&String` encrypts a
+    `&String` instead. Into a derived record that is a compile error.
+    Into `StackCipherText` it compiles, because that target accepts any
+    `Encrypt` source.
 
 - **`target::ExpectedContext` is no longer part of the API** (#1488). It
   is the check that a `#[stash(context_field)]` record runs on decrypt:

packages/stack-encrypt/docs/adr/0012-owned-record-declarations.md

@@ -1,7 +1,7 @@
 ---
 status: accepted
 date: 2026-11-03
-revised: 2026-11-09
+revised: 2026-11-11
 extends: ADR-0003, ADR-0004
 ---
 
@@ -198,9 +198,11 @@ with a hand-written `EncryptTarget`, with the derive, and with a data plan.
 All three give the same descriptors and the same search term bytes, and each
 decrypts the records of the other two.
 
-The plan removes the structural traits, the `encrypt_as` and `decrypt_as`
-calls, and the helpers in `target::legacy`. They stay until plans, EQL, Go,
-and the guest have moved to the owned API.
+The plan removes the structural traits and the `encrypt_as` and
+`decrypt_as` calls. They stay until plans, EQL, Go, and the guest have moved
+to the owned API. The helpers in `target::legacy` were removed first. They
+were only a second way to call `encrypt_as` and `decrypt_as`, so their
+callers now call those methods.
 
 ### 6. The structural `Vec` decrypts through the wiping path
 

packages/stack-encrypt/tests/ui/bare_context.rs

@@ -1,10 +1,10 @@
-//! The `_with_context` forms take anything that converts into a
-//! `NonEmpty<_>` — a `nonempty!(..)` literal, a `NonEmpty::new(..)?` value,
-//! a bare integer — and nothing unproven: a `&str` is not a context until it
-//! has been checked, so it is turned away at the call, not at a leaf. That
-//! holds on every path that reaches a leaf — a term, a struct record, a
-//! plaintext-derived record, a leaf opened directly — so the proof cannot be
-//! skipped by passing the raw value.
+//! A context converts from a `NonEmpty<_>`: a `nonempty!(..)` literal, a
+//! `NonEmpty::new(..)?` value, or a bare integer. It does not convert from
+//! anything unchecked. A `&str` is not a context until it has been checked,
+//! so `"..".into()` does not compile, and the value never reaches a leaf.
+//! This holds on every path to a leaf: a term, a struct record, a
+//! plaintext-derived record, and a leaf opened directly. So the check cannot
+//! be skipped by passing the raw value.
 use stack_encrypt::sem::EqualityTerm;
 
 use stack_encrypt::{DecryptInto, EncryptFrom, KeysetCipher, StackCipher, StackCipherText};