@@ -4,6 +4,6 @@
 
 **The `eql-bindings` crate has an `eql_bindings::v4` module, with the `stack-encrypt` feature: payload types for the EQL v4 domains.** EQL v4 is the v3 SQL installed under a second name (ADR-0002), for values written by Stack Encrypt, so the module exists only with that feature and its types derive Stack Encrypt's traits without a further gate. The module is generated from the same catalog as `v3`, with `eql_v4_*` domain names and `"v": 4`. `SchemaVersion` is now generic over the version it admits: `v3::SchemaVersion` is `SchemaVersion<3>` and `v4::SchemaVersion` is `SchemaVersion<4>`, each refusing the other's payloads, and plain `SchemaVersion` still means v3. Only v4 types derive Stack Encrypt's `EncryptFrom` and `DecryptInto`, and the Stack Encrypt target table (now `eql_bindings::v4::targets`) names v4 domains. Besides `TextEq`, Stack Encrypt now produces the storage-only types `Text`, `Integer`, `Bigint`, `Boolean`, `Real` and `Double`, and `TextMatch` (3-grams, `k = 6`, a 2048-bit filter, pinned as `eql_bindings::encryption::EqlMatch`; text shorter than three characters is refused, stored or queried, and only `stored @@ query` matches until #1171 is fixed), from the Rust primitives `i32`, `i64`, `bool`, `f32` and `f64`; the Go SDK's `encrypt/eql` table marks them producible. Stack Encrypt also produces the number equality types `IntegerEq`, `BigintEq`, `RealEq` and `DoubleEq`, whose `=` compares as PostgreSQL compares the plain types: an integer has one term whatever its width, and for floats `-0.0 = 0.0` and `NaN = NaN` (ADR-0002's semantic baseline). Every type it cannot produce yet names the issue that tracks its blocker. The by-name target entry points (`eql_bindings::encryption::targets::encrypt`, `decrypt` and `query`) exchange the plaintext as Stack Encrypt's `dynamic::ValueFrame`, one value as its transport frame, rather than a value tree. They, and the generated `v4::targets` table, need the new `targets` feature, which turns on `stack-encrypt` and Stack Encrypt's `dynamic` feature. `stack-encrypt` alone no longer builds Stack Encrypt's `dynamic` layer, so a Rust program using the typed v4 types through `encrypt_as` doesn't compile it.
 
-**The EQL v4 SQL bundle has range query domains and `eql_v4.between`, so a `BETWEEN` query is one operand.** The v4 bundle (`cipherstash-encrypt-v4.sql`) is built from this source and reaches users as the `eql-v4-install.sql` attached to each Go release; neither the npm package nor the crate ships it, and the v3 SQL they ship does not change. Every ordered family has one range query domain per order term, beside its single-bound ones: `eql_v4.query_integer_range_ore` beside `eql_v4.query_integer_ord_ore`, `eql_v4.query_integer_range_ope` beside `eql_v4.query_integer_ord_ope`, and the same for `smallint`, `bigint`, `date`, `timestamp`, `numeric`, `text`, `real` and `double`. A range is `{"v": 4, "i": …, "lo": <term>, "hi": <term>}`: each bound is the single-bound domain's `ob` (ORE) or `op` (OPE) value, in a `{v, i, lo, hi}` envelope. Stack Encrypt does not build that envelope yet; it will need to when the ordered types become producible. `eql_v4.between(column, range)` is true when the column's order term lies between the bounds, both included, and has an overload for every ordered column domain with the range of the term it stores (`_ord_ore` and `_search_ore` take the ORE range; `_ord`, `_ord_ope` and `_search` the OPE one). It is an inlinable SQL function, so a btree on the column's order term (`eql_v4.ord_term_ore(col)` or `eql_v4.ord_term(col)`) serves it as one index range scan. Write it schema-qualified (`BETWEEN` is an SQL keyword, so a bare `between(...)` does not parse), and cast the range to its exact domain (`$1::eql_v4.query_integer_range_ore`): an uncast `$1`, a `jsonb` parameter, or a range of another term or family fails with SQLSTATE 42725 ("function … is not unique"), unlike the single-bound operators, which resolve an untyped `$1`. In the crate, `eql_bindings::v4` (`stack-encrypt` feature) has a type for each range domain (`IntegerRangeOreQuery`, `TextRangeOpeQuery`, …, listed by `v4::all_range_query()`). EQL v3 has no range domains: its SQL and types are unchanged (ADR-0009, decision 7).
+**The EQL v4 SQL bundle has range query domains and `eql_v4.between`, so a `BETWEEN` query is one operand.** The v4 bundle (`cipherstash-encrypt-v4.sql`) is built from this source and reaches users as the `eql-v4-install.sql` attached to each Go release; neither the npm package nor the crate ships it, and the v3 SQL they ship does not change. Every ordered family has one range query domain per order term, beside its single-bound ones: `eql_v4.query_integer_range_ore` beside `eql_v4.query_integer_ord_ore`, `eql_v4.query_integer_range_ope` beside `eql_v4.query_integer_ord_ope`, and the same for `smallint`, `bigint`, `date`, `timestamp`, `numeric`, `text`, `real` and `double`. A range is `{"v": 4, "i": …, "lo": <term>, "hi": <term>}`: each bound is the single-bound domain's `ob` (ORE) or `op` (OPE) value, in a `{v, i, lo, hi}` envelope. Stack Encrypt does not build that envelope yet; it will need to when the ordered types become producible. `eql_v4.between(column, range)` is true when the column's order term lies between the bounds, both included, and has an overload for every ordered column domain with the range of the term it stores (`_ord_ore` and `_search_ore` take the ORE range; `_ord`, `_ord_ope` and `_search` the OPE one). It is an inlinable SQL function, so a btree on the column's order term (`eql_v4.ord_term_ore(col)` or `eql_v4.ord_term(col)`) serves it as one index range scan. Write it schema-qualified (`BETWEEN` is an SQL keyword, so a bare `between(...)` does not parse), and cast the range to its exact domain (`$1::eql_v4.query_integer_range_ore`): an uncast `$1`, a `jsonb` parameter, or a range of another term or family fails with SQLSTATE 42725 ("function … is not unique"), unlike the single-bound operators, which resolve an untyped `$1`. An ORE range scan needs the `ore_block_256` btree operator class, which the installer creates only as a superuser; on an install without it (Supabase and other non-superuser roles), the ORE range domains are disabled like the single-bound ORE domains, and a value cast to one raises `feature_not_supported` naming the family's OPE range. In the crate, `eql_bindings::v4` (`stack-encrypt` feature) has a type for each range domain (`IntegerRangeOreQuery`, `TextRangeOpeQuery`, …, listed by `v4::all_range_query()`). EQL v3 has no range domains: its SQL and types are unchanged (ADR-0009, decision 7).
 
 Nothing a released version shipped has changed. The v3 types, the v3 SQL and the TypeScript package are as they were; the `stack-encrypt` derives on the v3 text types and the `v3::targets` module were added after the last release and are moved to v4 here, not removed from a release.
@@ -31,7 +31,7 @@
 use eql_domains::{DomainFamily, Term, RANGE_BOUND_KEYS};
 
 use crate::consts::{sql_str, INTERNAL_SCHEMA};
-use crate::context::{domain_name, environment};
+use crate::context::{domain_name, environment, query_domain_name};
 use crate::render::{EqlVersion, ONLY_DIRECTIVE};
 
 /// The version the range surface belongs to.
@@ -94,23 +94,59 @@ struct RangeDomainBlock {
     comment: String,
 }
 
+/// An ORE range domain the file disables when the install has no ORE
+/// operator class, as `ore_fallback.sql` disables the single-bound ORE
+/// domains: `name` for the identifier position, `name_literal` sql_str-escaped
+/// for the poison error's message, `alternatives` for its hint.
+#[derive(serde::Serialize)]
+struct OreRangeFallback {
+    name: String,
+    name_literal: String,
+    alternatives: String,
+}
+
 #[derive(serde::Serialize)]
 struct RangeTypesContext {
     only_directive: String,
     family_name: String,
+    requires: Vec<String>,
     domains: Vec<RangeDomainBlock>,
+    ore_ranges: Vec<OreRangeFallback>,
+}
+
+/// The file whose poison function an ORE range's fallback calls.
+const ORE_FALLBACK: &str = "src/v3/scalars/ore_fallback.sql";
+
+/// The poison hint for an ORE range: the family's OPE range, which needs no
+/// operator class. Every family with an ORE range has one today; a future
+/// family without must still render a sentence.
+fn ore_range_alternatives(spec: &DomainFamily) -> String {
+    if spec.range_terms().contains(&Term::Ope) {
+        format!(
+            "{} (range)",
+            query_domain_name(&spec.range_query_name(Term::Ope))
+        )
+    } else {
+        "a non-ORE encrypted domain".to_string()
+    }
 }
 
 /// Body of `query_<T>_range_types.sql`, or `None` for a family with no
 /// ordering term.
+///
+/// An ORE range domain is disabled on an install without the ORE operator
+/// class, as the single-bound ORE domains are. `ore_fallback.sql` cannot do
+/// it, since it is shared with EQL v3 and the range domains are v4 only, so
+/// this file adds the same NOT VALID poison CHECK to its own ORE range,
+/// calling the function `ore_fallback.sql` creates under the same condition.
 pub fn render_range_types_file(spec: &DomainFamily) -> Option<String> {
     let terms = spec.range_terms();
     if terms.is_empty() {
         return None;
     }
     let domains = terms
-        .into_iter()
-        .map(|term| {
+        .iter()
+        .map(|&term| {
             let name = spec.range_query_name(term);
             RangeDomainBlock {
                 typname: sql_str(&name),
@@ -129,10 +165,28 @@ pub fn render_range_types_file(spec: &DomainFamily) -> Option<String> {
             }
         })
         .collect();
+    let ore_ranges: Vec<OreRangeFallback> = terms
+        .iter()
+        .filter(|&&t| t == Term::Ore)
+        .map(|&t| {
+            let name = query_domain_name(&spec.range_query_name(t));
+            OreRangeFallback {
+                name_literal: sql_str(&name),
+                name,
+                alternatives: sql_str(&ore_range_alternatives(spec)),
+            }
+        })
+        .collect();
+    let mut requires = vec!["src/v3/schema.sql".to_string()];
+    if !ore_ranges.is_empty() {
+        requires.push(ORE_FALLBACK.to_string());
+    }
     let ctx = RangeTypesContext {
         only_directive: only_directive(),
         family_name: spec.name.to_string(),
+        requires,
         domains,
+        ore_ranges,
     };
     Some(
         environment()
@@ -161,6 +215,10 @@ struct Between {
     /// An ORE range, whose index needs the opclass a non-superuser
     /// install skips: the generated docs say so.
     ore: bool,
+    /// For an ORE range, the family's OPE column domains and OPE range,
+    /// which the generated docs point to instead. Empty otherwise.
+    ope_columns: String,
+    ope_range: String,
 }
 
 #[derive(serde::Serialize)]
@@ -196,6 +254,17 @@ pub fn render_range_functions_file(spec: &DomainFamily) -> Option<String> {
     ];
     let mut accessors = Vec::new();
     let mut betweens = Vec::new();
+    let ope_columns = spec
+        .range_columns(Term::Ope)
+        .iter()
+        .map(|d| format!("`{}`", domain_name(&d.full_name(family_name))))
+        .collect::<Vec<_>>()
+        .join(", ");
+    let ope_range = if terms.contains(&Term::Ope) {
+        format!("`{}`", query_domain_name(&spec.range_query_name(Term::Ope)))
+    } else {
+        String::new()
+    };
     for &term in &terms {
         let range = spec.range_query_name(term);
         let returns = format!("{INTERNAL_SCHEMA}.{}", term.ctor());
@@ -228,6 +297,16 @@ pub fn render_range_functions_file(spec: &DomainFamily) -> Option<String> {
                 range: range.clone(),
                 extractor: term.extractor(),
                 ore: term == Term::Ore,
+                ope_columns: if term == Term::Ore {
+                    ope_columns.clone()
+                } else {
+                    String::new()
+                },
+                ope_range: if term == Term::Ore {
+                    ope_range.clone()
+                } else {
+                    String::new()
+                },
             });
         }
     }
@@ -445,6 +524,69 @@ mod tests {
         }
     }
 
+    /// The ORE note names the family's own OPE columns and OPE range, not a
+    /// fixed list: only text has a `_search` domain.
+    #[test]
+    fn the_ore_note_names_the_familys_own_ope_columns() {
+        let integer = render_range_functions_file(integer()).unwrap();
+        assert!(
+            integer.contains(
+                "use an OPE column (`public.{{prefix}}_integer_ord`, \
+                 `public.{{prefix}}_integer_ord_ope`)\n--!       and `{{prefix}}.query_integer_range_ope`"
+            ),
+            "{integer}"
+        );
+        assert!(!integer.contains("_search"), "{integer}");
+        let text = render_range_functions_file(&TEXT).unwrap();
+        assert!(text.contains("`public.{{prefix}}_text_search`"), "{text}");
+    }
+
+    /// An ORE range is disabled where the single-bound ORE domains are: the
+    /// file requires `ore_fallback.sql`, whose poison function it calls, and
+    /// adds the poison CHECK to the ORE range alone, behind the same opclass
+    /// check, with the OPE range as the hint.
+    #[test]
+    fn the_ore_range_is_disabled_without_the_ore_opclass() {
+        for f in CATALOG.iter().filter(|f| !f.range_terms().is_empty()) {
+            let body = render_range_types_file(f).unwrap();
+            let ore = f.range_terms().contains(&Term::Ore);
+            assert_eq!(
+                body.contains("-- REQUIRE: src/v3/scalars/ore_fallback.sql"),
+                ore,
+                "{}",
+                f.name
+            );
+            let v4 = render_str(&body, EqlVersion::V4).unwrap();
+            let alters: Vec<&str> = v4
+                .lines()
+                .filter(|l| l.contains("ADD CONSTRAINT eql_ore_unavailable"))
+                .collect();
+            if !ore {
+                assert!(alters.is_empty(), "{}", f.name);
+                continue;
+            }
+            let name = format!("eql_v4.query_{}_range_ore", f.name);
+            assert_eq!(
+                alters,
+                [format!(
+                    "  ALTER DOMAIN {name} ADD CONSTRAINT eql_ore_unavailable"
+                )],
+                "{}",
+                f.name
+            );
+            assert!(
+                v4.contains(&format!(
+                    "CHECK (eql_v4_internal.ore_domain_unavailable(VALUE, '{name}', \
+                     'eql_v4.query_{}_range_ope (range)')) NOT VALID;",
+                    f.name
+                )),
+                "{v4}"
+            );
+            assert!(v4
+                .contains("AND c.opcintype = 'eql_v4_internal.ore_block_256'::pg_catalog.regtype"));
+        }
+    }
+
     #[test]
     fn every_function_is_documented() {
         for f in CATALOG.iter().filter(|f| !f.range_terms().is_empty()) {
 
@@ -43,8 +43,9 @@ AS $$ SELECT {{ a.body }} $$;
 --!       serves as one range scan.{% if b.ore %} For this ORE range that index needs the
 --!       default btree operator class on {{ internal_schema }}.ore_block_256, which the
 --!       installer creates only with superuser privileges. Without it (on Supabase,
---!       for instance) the installer disables the ORE column domains, so use an OPE
---!       column (`_ord`, `_ord_ope`, `_search`) and its OPE range, which index everywhere.{% endif %}
+--!       for instance) the installer disables the ORE column domains and this ORE range,
+--!       so use an OPE column ({{ b.ope_columns }})
+--!       and {{ b.ope_range }}, which index everywhere.{% endif %}
 --! @note `BETWEEN` is an SQL keyword, so call it schema-qualified:
 --!       `{{ schema }}.between(...)` parses, a bare `between(...)` does not.
 --! @note Cast the range to its exact domain, `$1::{{ schema }}.{{ b.range }}`.
 
@@ -1,7 +1,8 @@
 -- AUTOMATICALLY GENERATED FILE.
 {{ only_directive }}
--- REQUIRE: src/v3/schema.sql
-
+{% for r in requires -%}
+-- REQUIRE: {{ r }}
+{% endfor %}
 --! @file v3/scalars/{{ family_name }}/query_{{ family_name }}_range_types.sql
 --! @brief Range query-operand domains for {{ family_name }}: the operand of `{{ schema }}.between`.
 --! @note A range holds both bounds of one `BETWEEN` as one value:
@@ -17,9 +18,14 @@
 --! @note EQL version {{ eql_version }} only: the `-- ONLY EQL VERSION:` line above keeps this
 --!       file out of every other version's installer.
 --! @note Like every query operand, a range lives in `{{ schema }}`, not `public`,
---!       and holds no ciphertext `c`. The client refuses a range whose low
---!       bound is above its high bound; one that reaches the database anyway
---!       matches no row.
+--!       and holds no ciphertext `c`. A range whose low bound is above its
+--!       high bound matches no row, as with SQL `BETWEEN`; the SQL does not
+--!       reorder the bounds.{% if ore_ranges %}
+--! @note On an install without the ORE operator class (a non-superuser
+--!       install, on Supabase for instance), the ORE range domain is disabled
+--!       as the single-bound ORE domains are: a value cast to it raises
+--!       `feature_not_supported`, naming the OPE range. See
+--!       `v3/scalars/ore_fallback.sql`.{% endif %}
 
 DO $$
 BEGIN
@@ -47,3 +53,29 @@ BEGIN
 {% endfor -%}
 END
 $$;
+{%- if ore_ranges %}
+
+-- Without the default btree operator class on {{ internal_schema }}.ore_block_256
+-- (the installer skips it on insufficient_privilege), ore_fallback.sql has
+-- created {{ internal_schema }}.ore_domain_unavailable and poisoned the
+-- single-bound ORE domains. It cannot reach this ORE range, which exists in
+-- EQL v4 only, so the same NOT VALID poison CHECK is added here.
+DO $do$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_catalog.pg_opclass c
+    JOIN pg_catalog.pg_am am ON am.oid = c.opcmethod
+    WHERE am.amname = 'btree'
+      AND c.opcdefault
+      AND c.opcintype = '{{ internal_schema }}.ore_block_256'::pg_catalog.regtype
+  ) THEN
+    RETURN;
+  END IF;
+{% for e in ore_ranges %}
+  ALTER DOMAIN {{ e.name }} ADD CONSTRAINT eql_ore_unavailable
+    CHECK ({{ internal_schema }}.ore_domain_unavailable(VALUE, '{{ e.name_literal }}', '{{ e.alternatives }}')) NOT VALID;
+{%- endfor %}
+END;
+$do$;
+{%- endif %}