Opt-in strict finite factory: refuse start > end as written, translated to the bare PostgreSQL constructor #429

Summary

CreateFinite returns the empty range when start > end. That's right for computed bounds: "from the later start to the earlier end" should be empty when the inputs don't overlap. But it's silent for swapped arguments or a bad row (To < From), and the empty range then flows into Contains and Overlaps as a plausible false. The literal parser has refused inverted bounds since 10.0.0 (#114), as PostgreSQL's range_in does. The factory has no opt-in way to do the same.

Add an opt-in strict finite factory that refuses start > end, and leave CreateFinite as it is.

Proposal

• The rule is the parser's (RangeFormat.Finite): compare the bounds as written, before a discrete type closes them. Only start > end is refused. (1,2) over integers and [x,x) stay a legitimate Empty. That keeps "inverted" (probably a bug) apart from "empty once the bounds are closed" (a correct answer).

• Shape of the API, still to decide:

  • a throwing factory (name open, e.g. CreateFiniteStrict or CreateFiniteOrThrow) that throws ArgumentException naming both bounds; and/or
  • TryCreateFinite(start, end, startInclusive, endInclusive, out TRange range), returning false only for inverted bounds.

  Only the throwing one can be translated: an out parameter can't appear in an expression tree, so TryCreateFinite would be client-only.

• EF translation: the throwing factory becomes PostgreSQL's bare range constructor, daterange(lower, upper, '[]'), without the CASE WHEN lower <= upper guard that GuardedFiniteRangeConstructor adds for CreateFinite. PostgreSQL then raises range lower bound must be less than or equal to range upper bound, so memory and the server both refuse. Rule (c) still applies: NULL over a NULL element (NullOverNullElement).

• Every range type gets it: the eight core types and the four NodaTime ones. YearMonthRange (a month-aligned daterange) and the custom store types (timerange, float8range, float4range) need their constructor behaviour measured, not assumed.

Open questions

• Does it go on IRangeFactory<TRange,T>? CreateFinite is abstract static there. A new abstract static member breaks anyone implementing the interface outside the library. A static virtual member with a default implementation built on CreateFinite plus the comparison doesn't, and gives generic code the strict path too.
• Which exception: ArgumentException (it's an argument check), or ArgumentOutOfRangeException on end?
• The float types already throw ArgumentException for NaN or an infinity as a bound. The strict factory keeps that check.

Done when

• Each range type has the strict factory, and a test reverting the check shows the test fails (AGENTS.md, workflow step 4).
• A live integration test on PostgreSQL 16 and 18 shows the translated factory raising the error for inverted column values, matching memory, and building the same range as CreateFinite otherwise. Covers every element type, NULL elements and the domain extremes.
• The new public members have a claim in test/oracles/claims.json (OracleSurfaceCoverageTests).
• docs/ranges.md and docs/efcore.md say when to use which factory, with an example, and the changelogs have their rows.
• Lands on main first, then cherry-picked with -x into release/10.x as a 10.x minor (it's an addition, not breaking).

Not in scope: changing CreateFinite's own answer. That would turn a value into an exception (breaking) and penalise the computed-bounds idiom it exists for.