@@ -12,6 +12,39 @@ listed under **Breaking**. Releases are tagged `languages/golang/vX.Y.Z`.
 
 ### Added
 
+- **Test several members of one array element of a `JsonSearch` field
+  (#1442).** A field whose `ordered=` paths name members beneath an array's
+  wildcard (`$.contacts[*].relationship;$.contacts[*].calls`) gets
+  `Fields.<Field>.Elements.<Array>.Match`, one accessor per array, named as
+  `At` names a path (`Elements.Contacts`). `Match(ctx, cipher, opts,
+  predicates...)` returns an `eql.JSONSearchElementsQuery` for
+  `eql_v4.json_tree_element_match(col, $1::eql_v4.query_json_elements)`,
+  which finds a row where one element passes every predicate. An `EqAt` and
+  an ordering at the array's paths can each be answered by a different
+  element. The generated `Paths` names each array's ordered members, nested
+  as the JSON nests them (`Paths.Profile.Contacts.Relationship`), and
+  `encrypt.AtPath(path)` makes the predicates: `Eq`, `Lt`, `Lte`, `Gt`,
+  `Gte` and `Between`. A path's type, `encrypt.Path[E, T]`, carries its
+  array and the member's Go type from the document's struct (`any` for a
+  `json.RawMessage`), so a value of another type, or a predicate on another
+  array's member, does not compile. `Paths` holds only fields, so no JSON
+  key is reserved. For a member named at run time, the array accessor's
+  `Member("relationship")` makes the same predicates with `any` values.
+  Each comparison is of the member's ordering term, so `Eq` compares text
+  case- and accent-folded and integers past 2^53 can tie; `EqAt` stays
+  exact. A member named at run time that the field does not order is
+  refused before the engine is asked, with `encrypt.ErrTerm`, naming the
+  member and the array; no predicates, a zero `ElementPredicate` and a
+  member with a wildcard are refused with `encrypt.ErrEncoding`. An array
+  whose members `Paths` cannot name (a key with no Go name, or one name for
+  two paths) gets no accessor and a notice, as two arrays with one
+  accessor name do. A row whose array is
+  longer than `JSONReadOptions.WildcardBound` (64 by default) fails the
+  query with SQLSTATE 22023. An `ElementPredicate` prints and logs its
+  member and comparison, never its values. The embedded EQL guest now names
+  the `eql_v4.query_json_elements` domain, so `Checker.Operators` lists
+  `element_match` (input `path_predicates`) on a field that orders a path.
+
 - **A two-letter word is searchable in `TextMatch`, `TextSearch` and
   `TextSearchOre` (#1309).** The EQL v4 match types index each two-letter
   word whole, beside the 3-grams of the text, so a two-letter surname such
 
@@ -178,6 +178,7 @@ The field's `Fields` entry has a method per operation:
 | `Selector(ctx, c, path)` | `encrypt.JSONSelection`: `Selector()` and `Open` | `col -> $1::text` |
 | `Subtree(ctx, c, path, opts)` | `encrypt.JSONRead`: `Tokens()`, `Open` and `OpenOne` | `eql_v4.json_tree_subtree(col, $1::text[], 64)` |
 | `Children(ctx, c, path)`, `ChildCount(ctx, c, path)` | `encrypt.JSONToken` | `eql_v4.json_tree_children(col, $1::text)`, `eql_v4.json_tree_child_count(col, $1::text)` |
+| `Elements.Visits.Match(ctx, c, opts, predicates...)` | `eql.JSONSearchElementsQuery` | `eql_v4.json_tree_element_match(col, $1::eql_v4.query_json_elements)` |
 
 `At` has one accessor per ordered path, named for its keys (`$.visits[*].at` is `At.VisitsAt`, `$.a.1` is `At.A1`); two paths with one name, or one path given twice, stop `stashgen`.
 An ordering compares the value `->` extracts at its path, and EQL's `<` compares ordering terms alone, so take the selector from the same accessor (`At.Age.Selector`) rather than spelling the path again.
@@ -193,6 +194,50 @@ SELECT id FROM customers ORDER BY (
 ```
 
 with `$1` from `At.VisitsAt.Selector(ctx, c)` and `$2` from `At.VisitsAt.Gt(ctx, c, v)`; for the latest visit, order by `ORDER BY 1 DESC NULLS LAST` inside and `DESC` outside.
+
+Two queries at a wildcard path, an `EqAt` and an ordering say, can each be answered by a different element.
+To test several members of one element together, use `Match` under `Elements`.
+`Elements` has one accessor per array whose elements have an ordered member, named for the array's keys as `At` names a path: with `ordered=$.visits[*].at;$.visits[*].place`, `$.visits[*]` is `Elements.Visits`, with the members `at` and `place`.
+A root array (`ordered=$[*].name`) is `Elements.Root`.
+An ordered path that ends at its wildcard (`$.tags[*]`), or has none, gives no accessor, and a field without one has no `Elements`.
+Two arrays whose keys give one name (`$.a_b[*]` and `$.aB[*]` are both `AB`), and an array whose keys give no name, get no accessor: `stashgen` still writes the field and its `At`, and prints a notice naming the ordered paths, which the generated file repeats in a comment.
+
+The generated `Paths` names each accessor's members, nested as the JSON nests them: `$.visits[*].place` is `Paths.Profile.Visits.Place`.
+`encrypt.AtPath` makes a predicate from one, with `Eq`, `Lt`, `Lte`, `Gt`, `Gte` or `Between` (inclusive).
+
+```go
+// rows with one visit that is at home and after 15
+q, err := customers.Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.JSONReadOptions{},
+	encrypt.AtPath(customers.Paths.Profile.Visits.Place).Eq("home"),
+	encrypt.AtPath(customers.Paths.Profile.Visits.At).Gt(15),
+)
+```
+
+```sql
+SELECT id FROM customers WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)
+```
+
+A path is an `encrypt.Path[E, T]`.
+`E` is a type `stashgen` writes for the array (`ProfileFieldElementsVisits`), and `Match` takes only `encrypt.ElementPredicate[E]` of its own array, so a predicate on another array's member does not compile.
+`T` is the member's Go type in the document's struct, read as `encoding/json` reads the document (through pointers, promoted fields, maps and slices), so a value of another type does not compile either.
+It is `any` where the type names none: a `json.RawMessage` document, a path the struct does not hold, or a member inside a type with its own `MarshalJSON`.
+`Paths` holds only fields, and its paths' methods are the SDK's, so any JSON key can name a member.
+With `-name Customer`, it is `CustomerPaths`, as `Fields` is `CustomerFields`.
+
+For a filter built at run time, from text such as `visits:(place = "home" AND at > 15)`, name the member with the array's `Member`, written as it is below the array in the tag (`place`, or `address.city`):
+
+```go
+visits := customers.Fields.Profile.Elements.Visits
+q, err := visits.Match(ctx, cipher, encrypt.JSONReadOptions{}, visits.Member("place").Eq("home"), visits.Member("at").Gt(15))
+```
+
+Its values are `any`, as the orderings take them.
+A member the field does not order is refused before the engine is asked, with `encrypt.ErrTerm`, naming the member, the array and the members it orders; no predicates, a zero `ElementPredicate`, and a member with a wildcard, are refused with `encrypt.ErrEncoding`.
+`Paths` names each key on its own, so an array whose members it cannot name gets no accessor and the same notice: a key that gives no Go name there (`$.a.1[*].x`, whose `1` `At` joins to `A1X`), or one name for two paths (`$.a[*].b` beside `$.a[*].b.c`, or `$.x.a_b[*].m` beside `$.x.aB.n[*].o`).
+Each comparison is of the member's ordering term, so `Eq` is an equality of folded values: text compares case- and accent-folded (`"home"` equals `"Home"`), and integers past 2^53 can tie.
+`EqAt` at the member's full path is exact, of any element.
+`Match` reads each array to `opts.WildcardBound` elements, 64 when it is 0, and a row whose array is longer fails the query with SQLSTATE 22023 rather than answer over part of it: set the bound past the longest array.
+The function runs on each row a scan gives it, so narrow the rows first with an indexed predicate, such as `@>` on the same values.
 `OpenOne` reads one value and refuses a read whose path has a wildcard before anything is opened; open a wildcard read with `Open`.
 A needle and a value are Go values: a `json.RawMessage` of JSON text crosses as it is, and anything else is marshalled with `encoding/json`.
 `EqAt` and the orderings take a scalar: a string, a number, a bool, or `nil` for JSON `null`.
@@ -253,6 +298,7 @@ For `-type User`, the file `user_stash.go` holds:
   `encrypt_into=TextMatch` answers `Matches`, which returns an `encrypt.EQLMatchQuery`: the `eql.TextMatchQuery` operand, with `Verify` and `TargetLimit`.
   The query of `Matches` carries `Verify` and `TargetLimit`, because its answer can hold rows that do not match; an exact operator's query carries neither.
   See the encrypt package's README for each method's result and the query with `database/sql`.
+- `Paths`, when a `JsonSearch` field orders members of an array's elements: those members, nested as the JSON nests them, for `encrypt.AtPath` and the array's `Match` (see [Encrypted JSON documents](#encrypted-json-documents)).
 - `String` and `LogValue` on `EncryptedUser`, which print the passthrough fields and hide the sealed ones.
 - A copy of the fields of `User`, so a change to them stops the build.
 
@@ -263,7 +309,7 @@ Generated code uses no reflection, and no function in it panics.
 | Flag | Meaning |
 |---|---|
 | `-type T` | The struct that carries the `stash` tags. Required. |
-| `-name N` | Write `EncryptN`, `DecryptN` and `NFields`. A package holds one `Encrypt`; the second struct in a package needs a name. |
+| `-name N` | Write `EncryptN`, `DecryptN` and `NFields` (and `NPaths`). A package holds one `Encrypt`; the second struct in a package needs a name. |
 | `-for P.F` | `T` declares the tags for `F`, a type in another package. Each field of `T` names a field of `F` with the same name and type, and every exported field of `F` is named. |
 | `-model Name=R` | A model `R` for separate columns: one field for each column, each tagged with the output it holds, `stash:"email"` or `stash:"email,equality"`. Writes `EncryptName` and `DecryptName`. Any number. |
 | `-model Name=R:D` | The same, for an `R` that cannot carry tags. The struct `D` in your package declares them. |
 
@@ -520,7 +520,7 @@ The EQL types the engine produces, and the Go field types each takes:
 | `Numeric` | `encrypt.Decimal` | none |
 | `NumericEq` | `encrypt.Decimal` | `=`, `<>` (`1.5 = 1.50`) |
 | `NumericOrd`, `NumericOrdOpe`, `NumericOrdOre` | `encrypt.Decimal` | `<`, `<=`, `>`, `>=`, `ORDER BY` |
-| `JsonSearch` (`eql.JSONSearch`) | struct, map, slice, or `json.RawMessage` | containment, equality at a path, ordering at declared paths, selection, subtree reads; see [Encrypted JSON documents](#encrypted-json-documents) |
+| `JsonSearch` (`eql.JSONSearch`) | struct, map, slice, or `json.RawMessage` | containment, equality at a path, ordering at declared paths, several members of one array element, selection, subtree reads; see [Encrypted JSON documents](#encrypted-json-documents) |
 
 Any built-in Go integer field takes an integer EQL type (ADR-0002): the field
 is sealed at the type's width, and opens back into the field's type. A type
@@ -658,6 +658,35 @@ element of each row, so an ordering over every element is written over
 `eql_v4.json_tree_path_query(col, $sel)`, its matches (the stashgen README
 shows the SQL).
 
+Two such queries can each be answered by a different element. To test
+several members of one array element together, use `Match` on the array's
+accessor under `Elements`. A field has one for each array whose elements
+have an ordered member (`ordered=$.visits[*].at;$.visits[*].place`). The
+generated `Paths` names those members, nested as the JSON nests them, and
+`encrypt.AtPath` makes a predicate from one:
+
+```go
+q, err := users.Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.JSONReadOptions{},
+	encrypt.AtPath(users.Paths.Profile.Visits.Place).Eq("home"),
+	encrypt.AtPath(users.Paths.Profile.Visits.At).Gt(15),
+)
+rows, err := db.QueryContext(ctx, `SELECT id FROM users WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)`, q)
+```
+
+A path carries its array and the member's Go type from the document's
+struct, so a value of another type, or a predicate on another array's
+member, does not compile. For a filter built at run time, name the member
+with the array's `Member`:
+`users.Fields.Profile.Elements.Visits.Member("place").Eq("home")`. A member
+named so that the field does not order is refused before the engine is
+asked, naming it.
+
+Each comparison is of the member's ordering term, so `Eq` compares text
+case- and accent-folded, and integers past 2^53 can tie; `EqAt` is exact.
+A row whose array is longer than
+`JSONReadOptions.WildcardBound` (64 by default) fails the query with
+SQLSTATE 22023.
+
 ## Building
 
 The package embeds `wasm/stack_encrypt_guest.wasm`, a build artefact of the
 
@@ -242,6 +242,29 @@
 // A selection or a subtree read opens values as JSON text ([JSONValue],
 // [JSONRead.Open]). [DecodeJSON] reads one into a Go type.
 //
+// Two queries at an array's paths can each be answered by a different
+// element. To test several members of one element together, use Match on
+// the array's accessor under Elements, which a field has for each array
+// whose elements have an ordered member. The generated Paths names those
+// members, nested as the JSON nests them, and [AtPath] makes a predicate
+// from one:
+//
+//	q, err := customers.Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.JSONReadOptions{},
+//		encrypt.AtPath(customers.Paths.Profile.Visits.Place).Eq("home"),
+//		encrypt.AtPath(customers.Paths.Profile.Visits.At).Gt(15),
+//	)
+//	// WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)
+//
+// A [Path] carries its array and the member's Go type, so a value of
+// another type, or a predicate on another array's member, does not
+// compile. For a filter built at run time, the array accessor's Member
+// names the member as text: Visits.Member("place").Eq("home").
+//
+// Each comparison is of the member's ordering term, so [MemberTest.Eq]
+// compares text case- and accent-folded, and integers past 2^53 can tie. A row whose
+// array is longer than [JSONReadOptions.WildcardBound] (64 by default)
+// fails the query with SQLSTATE 22023.
+//
 // # Cancellation
 //
 // Every call takes a [context.Context], and a call whose context is
 
@@ -1,8 +1,9 @@
 # Typed encrypted JSON document example
 
 This program stores a Go `Profile` struct as one encrypted EQL v4 JSON column.
-It finds a row by containment, compares an ordered path, decrypts a whole
-profile, and opens only the visit times from another query.
+It finds a row by containment, compares an ordered path, finds a row where one
+visit passes two tests, decrypts a whole profile, and opens only the visit
+times from another query.
 
 ## Run
 
@@ -35,8 +36,28 @@ its `stash` tags. After changing the struct or tags, run this from
 go generate ./encrypt/example/json
 ```
 
-`Profile` uses `encoding/json` for the document shape. The `ordered=$.age`
-tag adds an ordering term for that path. A containment needle made from a
+`Profile` uses `encoding/json` for the document shape. The
+`ordered=$.age;$.visits[*].at;$.visits[*].place` tag adds an ordering term
+for each of those paths. Because `at` and `place` are ordered members of
+each visit, the generated `Fields.Profile.Elements.Visits.Match` tests both
+on one visit. The generated `Paths` names them as the JSON nests them:
+
+```go
+q, err := Fields.Profile.Elements.Visits.Match(ctx, cipher, encrypt.JSONReadOptions{},
+	encrypt.AtPath(Paths.Profile.Visits.Place).Eq("home"),
+	encrypt.AtPath(Paths.Profile.Visits.At).Gt(15),
+)
+// SELECT id FROM customers WHERE eql_v4.json_tree_element_match(profile, $1::eql_v4.query_json_elements)
+```
+
+`Paths.Profile.Visits.At` has the Go type of `Visit.At`, `int64`, so
+`Gt("15")` does not compile, and neither does a predicate on another
+array's member. Ada has a visit at home and a visit after 15, but no one
+visit that is both, so only Bea's row matches. Each comparison is of the
+ordering term, so text
+compares case- and accent-folded. A row with more visits than
+`JSONReadOptions.WildcardBound` (64 by default) fails the query with SQLSTATE
+22023. A containment needle made from a
 struct includes every field without `omitempty`, including zero values;
 `main.go` uses a map to name only the member being queried. The prepared
 subtree read returns JSON text, which `encrypt.DecodeJSON[int64]` decodes.