stack-encrypt: verify a Matches query's rows after decrypt (Probabilistic) #1183

Background

ADR-0009 decision 4 says a query term that can return false positives implements Probabilistic, and decision 5 says the library supplies the predicate that decides, after decrypt, whether a returned row is a real match. A Bloom match is that kind of term: a row whose filter happens to hold every bit of the query passes @@ without containing the needle.

Problem

Nothing in stack-encrypt can tell a caller whether a row a Matches query returned really contains the needle. A caller who wants ten real matches has no way to drop the false positives.

Proposal

• A Probabilistic trait in stack_encrypt::op with verify(&self, value) -> bool (decision 4). It is infallible: every failure is a non-match.
• MatchQuery<O> keeps the needle's tokens, as the index tokenised them, so verify cannot disagree with what was stored. The tokens never appear in Debug and are zeroized on drop.
• MatchQuery<O>: Probabilistic, where verify tokenises the value with the index's own tokenizer and case folding and checks that every needle token occurs in it.
• Supports<Matches<C>, S> requires Query: Probabilistic (decision 2), so an index cannot claim an inexact operator without saying how its answer is checked.
• EqualityTerm does not implement Probabilistic, so verify on an exact term is a compile error.
• ADR-0009's code matches the trait this ships.
• Tests: verify accepts every true match, rejects a planted Bloom false positive found under a small filter, agrees with case folding, and a Debug of the query names no token.

Related

• Depends on stack-encrypt: name the operator, not the index, in a query (Eq and Matches) #1182.
• Tracking: implement ADR-0009, operator-typed query terms for Stack Encrypt #1178: tracks ADR-0009.