docs(stack): spike confirms information_schema reports domain_name for EQL v3 columns

udt_name is the base type (jsonb) for domain columns, so the v2
eql_v2_encrypted detection cannot be adapted by swapping the compared
string. domain_name is unqualified; domain_schema is separate.

Also records that the stock postgres-eql:17-2.3.1 image carries no
public.* domains, so live introspection tests must apply the branch's
install SQL.

Author: tobyhede

docs/superpowers/specs/2026-07-09-supabase-v3-introspection-design.md

@@ -72,10 +72,31 @@ does not.
 ### 1. Load the type
 
 Every v3 domain is `CREATE DOMAIN public.<name> AS jsonb`. For a domain column,
-`information_schema.columns` populates `domain_schema` and `domain_name`; the
-`data_type` column reports the *base* type. This is why the v2 detection —
-`udt_name === 'eql_v2_encrypted'` in `packages/cli/src/commands/init/lib/introspect.ts:88`
-— does not carry over: `eql_v2_encrypted` is a composite type, not a domain.
+`information_schema.columns` populates `domain_schema` and `domain_name`; both
+`data_type` and `udt_name` report the *base* type.
+
+Measured against Postgres 17 (spike, 2026-07-09):
+
+| column | `data_type` | `udt_name` | `domain_schema` | `domain_name` |
+|---|---|---|---|---|
+| `id serial` | integer | int4 | — | — |
+| `email spike.text_search` | jsonb | jsonb | spike | text_search |
+| `note text` | text | text | — | — |
+| `meta jsonb` | jsonb | jsonb | — | — |
+
+Three consequences:
+
+- **`domain_name` is unqualified**, with `domain_schema` returned separately.
+- **`udt_name` is `jsonb`**, so the v2 detection
+  (`udt_name === 'eql_v2_encrypted'`,
+  `packages/cli/src/commands/init/lib/introspect.ts:88`) cannot be adapted by
+  swapping the compared string — it would compare against `jsonb` forever.
+  `eql_v2_encrypted` has `typtype = 'c'` (composite), which is why it surfaces
+  in `udt_name`; domains surface in `domain_name`.
+- **A plain `jsonb` column has `domain_name` NULL**, so encrypted and
+  unencrypted jsonb columns are cleanly distinguishable. A domain carrying a
+  `CHECK` constraint — as every EQL domain does — reports identically to one
+  without.
 
 ```sql
 SELECT c.table_name, c.column_name, c.domain_name
@@ -87,13 +108,6 @@ WHERE c.table_schema = 'public'
 ORDER BY c.table_name, c.ordinal_position
 ```
 
-**Verify this first.** Postgres' exact reporting of `data_type` / `udt_name` /
-`domain_name` for a domain-over-jsonb column is asserted, not measured. The
-first implementation task is a live-Postgres test pinning the shape of these
-rows for a `public.text_search` column. If `domain_name` is not populated as
-expected, the query changes to `pg_catalog` (`pg_attribute` → `pg_type` where
-`typtype = 'd'`) and the rest of this design is unaffected.
-
 Plaintext columns are retained, not filtered out. This buys three things:
 
 - `from('unknown_table')` throws rather than silently passing through.
@@ -340,9 +354,16 @@ encryptedSupabaseV3(url, key, { schemas? })
   `columns.ts`. Rows → `EncryptedTable[]` grouping. Verification: match,
   wrong-domain, missing column, missing table. Declared-over-synthesized
   override, including that a declared `TextSearch` retains its tuner options.
-- **Live Postgres** — the shape of `information_schema.columns` for a domain
-  column (the assumption flagged in §1). Introspection against a table with
-  mixed encrypted and plaintext columns.
+- **Live Postgres** — introspection against a table with mixed encrypted and
+  plaintext columns, asserting the domain→builder round-trip.
+
+  **Setup dependency.** The compose image (`postgres-eql:17-2.3.1`,
+  `local/docker-compose.yml`) reports `eql_v3.version()` as `DEV` but contains
+  **zero domains** in `public` — the concrete-domain surface is absent. The 47
+  domains exist only after applying this branch's
+  `packages/cli/src/sql/cipherstash-encrypt-v3.sql`. Live introspection tests
+  must apply that SQL first, as the existing v3 pg tests do; they cannot run
+  against the stock image.
 - **Wire encoding** — existing `supabase-v3-builder.test.ts` mock-client tests
   continue to pass unchanged, with the builder constructed from a synthesized
   table rather than a declared one.