diff --git a/CHANGELOG.md b/CHANGELOG.md
index 48dd34e..a720b4c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -33,15 +33,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 2. **`Mask(string)` never throws.** It runs the same UTF-8 path as the bytes API and produces the same output for the same text: comments are skipped (never written), trailing commas are accepted, non-ASCII and HTML characters are written unescaped (`RelaxedEscaping`), invalid or cut-off text yields its masked prefix. `Mask(string, out MaskResult, options)` reports the status. The `JsonReaderOptions`, `JsonWriterOptions`, `ignoreNulls` and `ignoreComments` parameters are gone: use `JsonObserverOptions` (`IgnoreNulls`, `Indented`, `MaxDepth`).
 3. **`Read(...)` never throws and returns a `MaskResult`** instead of `void`; `Read(byte[])` became `Read(ReadOnlySpan<byte>)`.
 4. **Every `Mask*` rule masks the whole value whatever its JSON type.** `MaskStr`, `MaskRawValue`, `MaskInt`, `MaskLong`, `MaskDecimal` and `MaskBool` no longer pass a value of another type to the default policy (where `BlockList` exposed it), and no longer descend into an object or array: a container is skipped unread and the function receives `null`. `MaskStr` hands a number or boolean to its function as its literal (`"12.50"`, `"true"`). As these rules now match containers too, a rule written before an `Obj(...)` or `Array(...)` rule for the same name takes precedence over it.
-5. **A string cut by `MaxValueBytes` reports `Truncated`** (with `FailedAtByte` `-1`), not `Masked`. A masking function receives a value longer than `MaxValueBytes` cut to that length.
-6. **Number read rules no longer fail the body:** `ReadInt`, `ReadLong` and `ReadDecimal` receive `null` for a number that does not fit the type, and the token is written unchanged.
+5. **A string cut by `MaxValueBytes` reports `Truncated`** (with `FailedAtByte` `-1`), not `Masked`. The cap applies to values written unmasked only (see 12).
+6. **Number read rules no longer fail the body:** `ReadInt`, `ReadLong` and `ReadDecimal` receive `null` for a number that does not fit the type; the default policy writes the token (see 11).
 7. **`PropertyPath` is a `ref struct` valid only during the call** it is passed to: `GetPropertyName`, `GetPropertyNameReverse`, `Length` and `ToString` remain; its constructor, `MaxLength` and `Dispose` are internal. Custom rules compiled against 1.x must be rebuilt. `ToString` writes array items as `[index]` (`a.b[0].c`, formerly `a.b..c`).
 8. **`JsonWriter` can no longer be derived from outside the library**, `JsonWriter.FromUtf8JsonWriter` and `JsonWriter.Empty` are removed, and `WriteCommentValue` is gone (comments are never written).
 9. **Internal now:** `JsonObserverException`, `PropertyPathMatch`, `JsonPropertyMatchDelegate`, `JsonPropertyPathMatchDelegate`, and the constructors of `JsonObjBuilder`, `JsonArrayBuilder`, `JsonValuePolicyBuilder` and their rule builders (start rules with `Match`).
 10. **A UTF-8 byte order mark at the start of the input is skipped.**
+11. **Read rules no longer decide what is written.** `ReadStr`, `ReadInt`, `ReadLong`, `ReadDecimal`, `ReadBool` and `ReadRaw` hand the value to the context; the next rule on the same match or the default policy writes it, so under `AllowList` a read value is `"***"`, not clear text. Chain `.Unmasked()` to keep it clear, or a mask method to read and mask one match: `Match("ssn").ReadStr(f).MaskAny(MaskTag.Last4)`. A read rule runs wherever it stands among the rules, so `Match("ssn").MaskAny(…).Match("ssn").ReadStr(f)` reads too. `Explain` reports `Read` only for a value read and written unchanged.
+12. **A masking function receives the whole value, and mask output is never cut by `MaxValueBytes`.** A `Last4`-style function sees the real last characters (`***4444`, not the ones at the cap), and `MaskTag.Hash`, a function's result and the `AllowList` stars are written whole, with status `Masked`. A function therefore decodes a long value in full.
 
 ### Fixed
 
+- **`PropMatches.Regex` follows `PropertyNameCaseInsensitive`:** under the default case-insensitive option it now also matches names that differ in case only (`DRiverLicensE` for `^driverLicense$`), as every other matcher does; a `Regex` built with `RegexOptions.IgnoreCase` ignores case under either option. A custom name test can follow the option through the new `PropMatchingStrategy(Func<string?, StringComparison, bool>)` constructor.
+
 - **Rules of an `Obj(...)` inside a property's `Array(...)` now apply** at any depth (`root.Match("lines").Array(l => l.Obj(…))`, and `Array(a => a.Array(b => b.Obj(…)))`). They looked for their names one or more levels too deep, so under `BlockList` those values were written in clear and under `AllowList` the whole item was masked. Only an `Obj(...)` directly under a root `Array(...)` worked.
 - **Relative rules receive `null` like absolute ones:** `MaskStr`, `MaskRawValue`, `MaskInt`, `MaskLong`, `MaskDecimal`, `MaskBool` and the read rules inside `Relative(...)` are called for a JSON `null`, as the rule-kinds table documents; `MaskAny` and `MaskAny(MaskTag)` keep `null` without calling the function.
 
diff --git a/DragoAnt.System.Text.Json.Observer.Tests.Shared/ApiSurfaceTests.cs b/DragoAnt.System.Text.Json.Observer.Tests.Shared/ApiSurfaceTests.cs
index 8b2bd9a..31060f1 100644
--- a/DragoAnt.System.Text.Json.Observer.Tests.Shared/ApiSurfaceTests.cs
+++ b/DragoAnt.System.Text.Json.Observer.Tests.Shared/ApiSurfaceTests.cs
@@ -40,12 +40,12 @@ public void RelativeBuilder_EveryReadRule_KeepsValues()
     {
         var context = new Values();
         var observer = JsonObserver.Obj(JsonObserverValuePolicies<Values>.Relative(b => b
-                .Match("s").ReadStr((v, c) => c.Str = v)
-                .Match("i").ReadInt((v, c) => c.Int = v)
-                .Match("l").ReadLong((v, c) => c.Long = v)
-                .Match("d").ReadDecimal((v, c) => c.Decimal = v)
-                .Match("b").ReadBool((v, c) => c.Bool = v)
-                .Match("r").ReadRaw((v, c) => c.Raw = v)
+                .Match("s").ReadStr((v, c) => c.Str = v).Unmasked()
+                .Match("i").ReadInt((v, c) => c.Int = v).Unmasked()
+                .Match("l").ReadLong((v, c) => c.Long = v).Unmasked()
+                .Match("d").ReadDecimal((v, c) => c.Decimal = v).Unmasked()
+                .Match("b").ReadBool((v, c) => c.Bool = v).Unmasked()
+                .Match("r").ReadRaw((v, c) => c.Raw = v).Unmasked()
                 .Match("m").MaskInt((_, _) => "i")
                 .Match("n").MaskLong((_, _) => "l")
                 .Match("o").MaskDecimal((_, _) => "d")
diff --git a/DragoAnt.System.Text.Json.Observer.Tests.Shared/LeakTests.cs b/DragoAnt.System.Text.Json.Observer.Tests.Shared/LeakTests.cs
new file mode 100644
index 0000000..94e008d
--- /dev/null
+++ b/DragoAnt.System.Text.Json.Observer.Tests.Shared/LeakTests.cs
@@ -0,0 +1,270 @@
+using System.Buffers;
+using System.Text;
+using System.Text.RegularExpressions;
+using DragoAnt.System.Text.Json.Observer.Strategies;
+
+namespace DragoAnt.System.Text.Json.Observer.Tests.Shared;
+
+public abstract class LeakTests
+{
+    private const string Ssn = """{"ssn":"123-45-6789","x":"y"}""";
+
+    private static JsonObserverValueDelegate<Holder> AllowList => JsonObserverValuePolicies<Holder>.AllowList;
+    private static JsonObserverValueDelegate<Holder> BlockList => JsonObserverValuePolicies<Holder>.BlockList;
+    private static JsonObserverValueDelegate<Holder> NullList => JsonObserverValuePolicies<Holder>.NullList;
+
+    [Fact]
+    public void Read_UnderAllowList_WritesTheValueMasked()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").ReadStr(Keep), AllowList).Mask(Ssn, holder)
+            .Should().Be("""{"ssn":"***","x":"***"}""");
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void Read_UnderBlockList_WritesTheValueUnchanged()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").ReadStr(Keep), BlockList).Mask(Ssn, holder)
+            .Should().Be(Ssn);
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void Read_UnderNullList_WritesNull()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").ReadStr(Keep), NullList).Mask(Ssn, holder)
+            .Should().Be("""{"ssn":null,"x":null}""");
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void Read_InRelativePolicy_UnderAllowList_WritesTheValueMasked()
+    {
+        var holder = new Holder();
+        var observer = JsonObserver.Obj<Holder>(JsonObserverValuePolicies<Holder>.Relative(b => b.Match("ssn").ReadStr(Keep)));
+
+        observer.Mask("""{"person":{"ssn":"123-45-6789"}}""", holder).Should().Be("""{"person":{"ssn":"***"}}""");
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void ReadNumber_UnderAllowList_WritesTheValueMasked()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Obj<Holder>(r => r.Match("pin").ReadInt((v, h) => h.Number = v)).Mask("""{"pin":1234}""", holder)
+            .Should().Be("""{"pin":"***"}""");
+        holder.Number.Should().Be(1234);
+    }
+
+    [Fact]
+    public void Read_ThenUnmasked_WritesClearText()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").ReadStr(Keep).Unmasked(), AllowList).Mask(Ssn, holder)
+            .Should().Be("""{"ssn":"123-45-6789","x":"***"}""");
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void Read_ThenMask_OnOneMatch_ReadsAndMasks()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").ReadStr(Keep).MaskAny(MaskTag.Last4), BlockList).Mask(Ssn, holder)
+            .Should().Be("""{"ssn":"***6789","x":"y"}""");
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void Mask_ThenRead_OnOneMatch_ReadsAndMasks()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").MaskAny(MaskTag.Full).Match("ssn").ReadStr(Keep), BlockList).Mask(Ssn, holder)
+            .Should().Be("""{"ssn":"***","x":"y"}""");
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void Read_ThenMask_InRelativePolicy_ReadsAndMasks()
+    {
+        var holder = new Holder();
+        var observer = JsonObserver.Obj<Holder>(JsonObserverValuePolicies<Holder>.Relative(
+            b => b.Match("ssn").ReadStr(Keep).MaskAny(MaskTag.Full), BlockList));
+
+        observer.Mask("""{"person":{"ssn":"123-45-6789","x":"y"}}""", holder).Should().Be("""{"person":{"ssn":"***","x":"y"}}""");
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void ArrayRead_UnderAllowList_WritesTheItemMasked()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Array<Holder>(a => a.ReadStr(Keep)).Mask("""["123-45-6789"]""", holder).Should().Be("""["***"]""");
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void ArrayRead_ThenUnmaskedOrMask_DecidesTheItem()
+    {
+        var unmasked = new Holder();
+        var masked = new Holder();
+
+        JsonObserver.Array<Holder>(a => a.ReadStr(Keep).Unmasked()).Mask("""["123-45-6789"]""", unmasked).Should().Be("""["123-45-6789"]""");
+        JsonObserver.Array<Holder>(a => a.MaskAny(MaskTag.Last4).ReadStr(Keep), BlockList).Mask("""["123-45-6789"]""", masked)
+            .Should().Be("""["***6789"]""");
+        unmasked.Value.Should().Be("123-45-6789");
+        masked.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void Read_ExtractionOnly_StillReads()
+    {
+        var holder = new Holder();
+
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").MaskAny(MaskTag.Full).Match("ssn").ReadStr(Keep)).Read(Ssn, holder)
+            .Status.Should().Be(MaskStatus.Masked);
+        holder.Value.Should().Be("123-45-6789");
+    }
+
+    [Fact]
+    public void Explain_Read_ReportsWhatIsWritten()
+    {
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").ReadStr(Keep), AllowList).Explain("ssn").Outcome
+            .Should().Be(JsonPathOutcome.Masked);
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").ReadStr(Keep).Unmasked(), AllowList).Explain("ssn").Outcome
+            .Should().Be(JsonPathOutcome.Read);
+        JsonObserver.Obj<Holder>(r => r.Match("ssn").ReadStr(Keep).MaskAny(MaskTag.Full), BlockList).Explain("ssn").Outcome
+            .Should().Be(JsonPathOutcome.Masked);
+    }
+
+    public static TheoryData<string> MaskFunctionKinds => ["MaskAny", "MaskStr", "MaskRawValue"];
+
+    [Theory]
+    [MemberData(nameof(MaskFunctionKinds))]
+    public void MaskFunction_UnderValueCap_ReceivesTheWholeValue(string kind)
+    {
+        var observer = JsonObserver.Obj(r => _ = kind switch
+        {
+            "MaskAny" => r.Match("card").MaskAny((s, _) => "***" + s![^4..]),
+            "MaskStr" => r.Match("card").MaskStr((s, _) => "***" + s![^4..]),
+            _ => r.Match("card").MaskRawValue((s, _) => "***" + s![^4..]),
+        });
+
+        observer.Mask("""{"card":"1111222233334444"}""", out var result, new JsonObserverOptions(MaxValueBytes: 8))
+            .Should().Be("""{"card":"***4444"}""");
+        result.Status.Should().Be(MaskStatus.Masked);
+    }
+
+    [Fact]
+    public void MaskFunction_UnderValueCap_ReceivesTheWholeValue_FromSegments()
+    {
+        var observer = JsonObserver.Obj(r => r.Match("card").MaskAny((s, _) => "***" + s![^4..]));
+        var output = new ArrayBufferWriter<byte>();
+
+        var result = observer.Mask(SequenceInputTests.Split("""{"card":"1111222233334444"}"""u8.ToArray(), 3), output,
+            new JsonObserverOptions(MaxValueBytes: 8));
+
+        Encoding.UTF8.GetString(output.WrittenSpan).Should().Be("""{"card":"***4444"}""");
+        result.Status.Should().Be(MaskStatus.Masked);
+    }
+
+    [Fact]
+    public void MaskOutput_LongerThanValueCap_IsNotCut()
+    {
+        var observer = JsonObserver.Obj(r => r.Match("card").MaskAny((_, _) => "replaced-by-a-long-mask"));
+
+        observer.Mask("""{"card":"1"}""", out var result, new JsonObserverOptions(MaxValueBytes: 8))
+            .Should().Be("""{"card":"replaced-by-a-long-mask"}""");
+        result.Status.Should().Be(MaskStatus.Masked);
+    }
+
+    [Fact]
+    public void Hash_UnderValueCap_IsNotCut()
+    {
+        var observer = JsonObserver.Obj(r => r.Match("card").MaskAny(MaskTag.Hash));
+        var options = new JsonObserverOptions(MaxValueBytes: 8, HashKey: "0123456789abcdef0123456789abcdef"u8.ToArray());
+
+        var masked = observer.Mask("""{"card":"1111222233334444"}""", out var result, options)!;
+        var uncapped = observer.Mask("""{"card":"1111222233334444"}""", options with { MaxValueBytes = int.MaxValue });
+
+        masked.Should().Be(uncapped);
+        JsonDocument.Parse(masked).RootElement.GetProperty("card").GetString().Should().StartWith("hash:").And.NotContain("…");
+        result.Status.Should().Be(MaskStatus.Masked);
+    }
+
+    [Fact]
+    public void UnmaskedValue_UnderValueCap_IsStillCut()
+    {
+        JsonObserver.Obj(JsonObserverValuePolicies.BlockList)
+            .Mask("""{"note":"1111222233334444"}""", out var result, new JsonObserverOptions(MaxValueBytes: 8))
+            .Should().Be("""{"note":"11112222…"}""");
+        result.Status.Should().Be(MaskStatus.Truncated);
+    }
+
+    private const string CaseCorpus =
+        """{"driverLicense":"A1","DRiverLicensE":"A2","driverlicense":"A3","driverLicense":"A4","drіverLicense":"A5","drİverLicense":"A6"}""";
+
+    public static TheoryData<string, bool, string> CaseTruthTable => new()
+    {
+        { "Match", true, "A1 A2 A3 A4" },
+        { "Match", false, "A1 A4" },
+        { "Regex", true, "A1 A2 A3 A4" },
+        { "Regex", false, "A1 A4" },
+        { "Function", true, "A1 A2 A3 A4" },
+        { "Function", false, "A1 A4" },
+        { "RelativeRegex", true, "A1 A2 A3 A4" },
+        { "RelativeRegex", false, "A1 A4" },
+    };
+
+    [Theory]
+    [MemberData(nameof(CaseTruthTable))]
+    public void CaseOption_ReachesEveryMatcher(string matcher, bool caseInsensitive, string expectedMasked)
+    {
+        PropMatchingStrategy match = matcher switch
+        {
+            "Match" => "driverLicense",
+            "Function" => new PropMatchingStrategy((name, comparison) => string.Equals(name, "driverLicense", comparison)),
+            _ => PropMatches.Regex(new Regex("^driverLicense$")),
+        };
+        var observer = matcher == "RelativeRegex"
+            ? JsonObserver.Obj(JsonObserverValuePolicies.Relative(b => b.Match(match).MaskAny(MaskTag.Full), JsonObserverValuePolicies.BlockList))
+            : JsonObserver.Obj(r => r.Match(match).MaskAny(MaskTag.Full), JsonObserverValuePolicies.BlockList);
+
+        var output = observer.Mask(CaseCorpus, new JsonObserverOptions(PropertyNameCaseInsensitive: caseInsensitive))!;
+
+        var masked = JsonDocument.Parse(output).RootElement.EnumerateObject()
+            .Select((p, i) => (Key: $"A{i + 1}", Value: p.Value.GetString()))
+            .Where(p => p.Value == "***")
+            .Select(p => p.Key);
+        string.Join(' ', masked).Should().Be(expectedMasked);
+    }
+
+    [Fact]
+    public void Regex_WithExplicitIgnoreCase_StaysCaseInsensitive()
+    {
+        var observer = JsonObserver.Obj(
+            r => r.Match(PropMatches.Regex(new Regex("^token$", RegexOptions.IgnoreCase))).MaskAny(MaskTag.Full),
+            JsonObserverValuePolicies.BlockList);
+
+        observer.Mask("""{"Token":"a"}""", new JsonObserverOptions(PropertyNameCaseInsensitive: false)).Should().Be("""{"Token":"***"}""");
+    }
+
+    private static void Keep(string? value, Holder holder) => holder.Value = value;
+
+    public sealed class Holder
+    {
+        public string? Value { get; set; }
+
+        public int? Number { get; set; }
+    }
+}
diff --git a/DragoAnt.System.Text.Json.Observer.Tests.Shared/LimitsTests.cs b/DragoAnt.System.Text.Json.Observer.Tests.Shared/LimitsTests.cs
index d71f368..3fa1a83 100644
--- a/DragoAnt.System.Text.Json.Observer.Tests.Shared/LimitsTests.cs
+++ b/DragoAnt.System.Text.Json.Observer.Tests.Shared/LimitsTests.cs
@@ -26,20 +26,22 @@ public void MaxValueBytes_NoValueCut_ReportsMasked()
         => BytesApiTests.Mask(Observer, """{"note":"abcde"}""", new JsonObserverOptions(MaxValueBytes: 5)).Result.Status.Should().Be(MaskStatus.Masked);
 
     [Fact]
-    public void MaxValueBytes_StrategyOutputCut_ReportsTruncated()
+    public void MaxValueBytes_StrategyOutput_IsNotCut()
     {
         var observer = JsonObserver.Obj(b => b.Match("a").MaskStr((_, _) => new string('x', 100)), BlockList);
 
         var (result, output) = BytesApiTests.Mask(observer, """{"a":"v"}""", new JsonObserverOptions(MaxValueBytes: 4));
 
-        result.Status.Should().Be(MaskStatus.Truncated);
-        output.Should().Be("{\"a\":\"xxxx…\"}");
+        result.Status.Should().Be(MaskStatus.Masked);
+        output.Should().Be($"{{\"a\":\"{new string('x', 100)}\"}}");
     }
 
     [Fact]
-    public void MaxValueBytes_LongStrategyString_SurrogatePairNotSplit()
+    public void MaxValueBytes_LongCustomRuleString_SurrogatePairNotSplit()
     {
-        var observer = JsonObserver.Obj(b => b.Match("a").MaskStr((_, _) => "ab\U0001F600cd"), BlockList);
+        var observer = JsonObserver.Obj(
+            b => b.Match("a").MaskValue((ref Utf8JsonReader _, JsonWriter w, JsonObserveringEmptyContext _, ref PropertyPath _) => w.WriteStringValue("ab\U0001F600cd")),
+            BlockList);
 
         var (_, output) = BytesApiTests.Mask(observer, """{"a":"v"}""", new JsonObserverOptions(MaxValueBytes: 4));
 
@@ -47,23 +49,17 @@ public void MaxValueBytes_LongStrategyString_SurrogatePairNotSplit()
     }
 
     [Fact]
-    public void MaskAny_Strategy_HugeValue_DoesNotDecodeWhole()
+    public void MaskAny_Strategy_HugeValue_ReceivesTheWholeValue()
     {
         var secret = new string('s', 5 * 1024 * 1024);
         var utf8 = Encoding.UTF8.GetBytes($$"""{"password":"{{secret}}","n":1}""");
         var observer = JsonObserver.Obj(Relative(b => b.Match("password").MaskAny((v, _) => v is null ? null : "len:" + v.Length), BlockList));
-        var options = new JsonObserverOptions(MaxValueBytes: 256);
         var output = new ArrayBufferWriter<byte>(1024);
-        observer.Mask(utf8, output, options);
-        output.Clear();
 
-        var before = GC.GetAllocatedBytesForCurrentThread();
-        var result = observer.Mask(utf8, output, options);
-        var allocated = GC.GetAllocatedBytesForCurrentThread() - before;
+        var result = observer.Mask(utf8, output, new JsonObserverOptions(MaxValueBytes: 256));
 
         result.Status.Should().Be(MaskStatus.Masked);
-        Encoding.UTF8.GetString(output.WrittenSpan).Should().Be("""{"password":"len:256","n":1}""");
-        allocated.Should().BeLessThan(64 * 1024);
+        Encoding.UTF8.GetString(output.WrittenSpan).Should().Be($$"""{"password":"len:{{secret.Length}}","n":1}""");
     }
 
     [Fact]
diff --git a/DragoAnt.System.Text.Json.Observer.Tests/RunLeakTests.cs b/DragoAnt.System.Text.Json.Observer.Tests/RunLeakTests.cs
new file mode 100644
index 0000000..4372603
--- /dev/null
+++ b/DragoAnt.System.Text.Json.Observer.Tests/RunLeakTests.cs
@@ -0,0 +1,3 @@
+namespace DragoAnt.System.Text.Json.Observer.Tests;
+
+public sealed class RunLeakTests : Shared.LeakTests;
diff --git a/DragoAnt.System.Text.Json.Observer/BoundedJsonWriter.cs b/DragoAnt.System.Text.Json.Observer/BoundedJsonWriter.cs
index 4e63b3f..af0005e 100644
--- a/DragoAnt.System.Text.Json.Observer/BoundedJsonWriter.cs
+++ b/DragoAnt.System.Text.Json.Observer/BoundedJsonWriter.cs
@@ -88,10 +88,15 @@ private void Start(JsonObserverOptions options)
         _safeDepth = 0;
         Exhausted = false;
         ValuesTruncated = false;
+        MaskOutput = false;
     }
 
     internal override bool Stopped => Exhausted;
 
+    internal override bool MaskOutput { get; set; }
+
+    private int MaxValueBytes => MaskOutput ? int.MaxValue : _maxValueBytes;
+
     private int Length => checked((int)(_writer.BytesCommitted + _writer.BytesPending));
 
     public override void WriteNullValue()
@@ -139,14 +144,14 @@ public override void WriteStringValue(ReadOnlySpan<char> value)
             return;
         }
 
-        if ((long)value.Length * 3 <= _maxValueBytes)
+        if ((long)value.Length * 3 <= MaxValueBytes)
         {
             _writer.WriteStringValue(value);
             Completed();
             return;
         }
 
-        var chars = value[..(int)Math.Min(value.Length, (long)_maxValueBytes + 1)];
+        var chars = value[..(int)Math.Min(value.Length, (long)MaxValueBytes + 1)];
         if (chars.Length < value.Length && char.IsHighSurrogate(chars[^1]))
         {
             chars = chars[..^1];
@@ -156,7 +161,7 @@ public override void WriteStringValue(ReadOnlySpan<char> value)
         try
         {
             var utf8 = encoded.AsSpan(0, Encoding.UTF8.GetBytes(chars, encoded));
-            if (chars.Length < value.Length && utf8.Length <= _maxValueBytes)
+            if (chars.Length < value.Length && utf8.Length <= MaxValueBytes)
             {
                 WriteCut(utf8, utf8.Length);
             }
@@ -178,14 +183,14 @@ public override void WriteStringValue(ReadOnlySpan<byte> utf8Value)
             return;
         }
 
-        if (utf8Value.Length <= _maxValueBytes)
+        if (utf8Value.Length <= MaxValueBytes)
         {
             _writer.WriteStringValue(utf8Value);
             Completed();
             return;
         }
 
-        var cut = _maxValueBytes;
+        var cut = MaxValueBytes;
         while (cut > 0 && (utf8Value[cut] & 0xC0) == 0x80)
         {
             cut--;
@@ -272,7 +277,7 @@ public override void WriteBase64StringValue(ReadOnlySpan<byte> bytes)
         }
 
         var length = Base64.GetMaxEncodedToUtf8Length(bytes.Length);
-        if (length <= _maxValueBytes)
+        if (length <= MaxValueBytes)
         {
             _writer.WriteBase64StringValue(bytes);
             Completed();
diff --git a/DragoAnt.System.Text.Json.Observer/Builders/JsonArrayBuilder.cs b/DragoAnt.System.Text.Json.Observer/Builders/JsonArrayBuilder.cs
index e5f5d66..c12f71d 100644
--- a/DragoAnt.System.Text.Json.Observer/Builders/JsonArrayBuilder.cs
+++ b/DragoAnt.System.Text.Json.Observer/Builders/JsonArrayBuilder.cs
@@ -56,7 +56,7 @@ public JsonArrayBuilder<TContext> MaskStr(StringMaskingStrategy<TContext> strate
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadStr"/>
     public JsonArrayBuilder<TContext> ReadStr(Action<string?, TContext> strategy)
-        => Read(JsonObserverItem<TContext>.ReadStr(strategy, _builderDefaultValuePolicy), RuleText.ReadStr);
+        => Read(JsonObserverItem<TContext>.ReadStr(strategy), RuleText.ReadStr);
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskInt"/>
     public JsonArrayBuilder<TContext> MaskInt(Func<int?, TContext, string?> strategy)
@@ -64,7 +64,7 @@ public JsonArrayBuilder<TContext> MaskInt(Func<int?, TContext, string?> strategy
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadInt"/>
     public JsonArrayBuilder<TContext> ReadInt(Action<int?, TContext> strategy)
-        => Read(JsonObserverItem<TContext>.ReadInt(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadInt"));
+        => Read(JsonObserverItem<TContext>.ReadInt(strategy), RuleText.ReadNumber("ReadInt"));
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskLong"/>
     public JsonArrayBuilder<TContext> MaskLong(Func<long?, TContext, string?> strategy)
@@ -72,7 +72,7 @@ public JsonArrayBuilder<TContext> MaskLong(Func<long?, TContext, string?> strate
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadLong"/>
     public JsonArrayBuilder<TContext> ReadLong(Action<long?, TContext> strategy)
-        => Read(JsonObserverItem<TContext>.ReadLong(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadLong"));
+        => Read(JsonObserverItem<TContext>.ReadLong(strategy), RuleText.ReadNumber("ReadLong"));
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskDecimal"/>
     public JsonArrayBuilder<TContext> MaskDecimal(Func<decimal?, TContext, string?> strategy)
@@ -80,7 +80,7 @@ public JsonArrayBuilder<TContext> MaskDecimal(Func<decimal?, TContext, string?>
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadDecimal"/>
     public JsonArrayBuilder<TContext> ReadDecimal(Action<decimal?, TContext> strategy)
-        => Read(JsonObserverItem<TContext>.ReadDecimal(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadDecimal"));
+        => Read(JsonObserverItem<TContext>.ReadDecimal(strategy), RuleText.ReadNumber("ReadDecimal"));
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskBool"/>
     public JsonArrayBuilder<TContext> MaskBool(Func<bool?, TContext, string?> strategy)
@@ -88,7 +88,7 @@ public JsonArrayBuilder<TContext> MaskBool(Func<bool?, TContext, string?> strate
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadBool"/>
     public JsonArrayBuilder<TContext> ReadBool(Action<bool?, TContext> strategy)
-        => Read(JsonObserverItem<TContext>.ReadBool(strategy, _builderDefaultValuePolicy), RuleText.ReadBool);
+        => Read(JsonObserverItem<TContext>.ReadBool(strategy), RuleText.ReadBool);
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskAny(Func{string, TContext, string})"/>
     public JsonArrayBuilder<TContext> MaskAny(Func<string?, TContext, string?> strategy)
@@ -108,7 +108,7 @@ public JsonArrayBuilder<TContext> MaskRawValue(Func<string?, TContext, string?>
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadRaw"/>
     public JsonArrayBuilder<TContext> ReadRaw(Action<string?, TContext> strategy)
-        => Read(JsonObserverItem<TContext>.ReadRaw(strategy, _builderDefaultValuePolicy), RuleText.ReadRaw);
+        => Read(JsonObserverItem<TContext>.ReadRaw(strategy), RuleText.ReadRaw);
 
     /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskValue(JsonObserverValueDelegate{TContext})"/>
     public JsonArrayBuilder<TContext> MaskValue(JsonObserverValueDelegate<TContext> policy) =>
@@ -135,8 +135,14 @@ internal JsonArrayBuilder<TContext> MaskWhole(JsonObserverDelegate<TContext> pol
 
     internal static (JsonObserverDelegate<TContext> Delegate, RuleSet<TContext> Set) Build(JsonArrayBuilder<TContext> builder) => builder.Build();
 
-    private JsonArrayBuilder<TContext> Read(JsonObserverDelegate<TContext> policy, string action) =>
-        Add(type => type.IsValueToken(), policy, new RuleInfo<TContext>(ValueItem, action, JsonPathOutcome.Read));
+    private JsonArrayBuilder<TContext> Read(JsonObserverItem<TContext>.ReadValue read, string action)
+    {
+        _policies.Add(JsonObserverItem<TContext>.Read(
+            (int _, ref PropertyPath _, JsonTokenType type) => (type.IsValueToken(), 1),
+            read,
+            new RuleInfo<TContext>(ValueItem, action, JsonPathOutcome.Read)));
+        return this;
+    }
 
     private (JsonObserverDelegate<TContext>, RuleSet<TContext>) Build()
     {
diff --git a/DragoAnt.System.Text.Json.Observer/Builders/JsonObjBuilder.cs b/DragoAnt.System.Text.Json.Observer/Builders/JsonObjBuilder.cs
index 58dd4f4..3868fa4 100644
--- a/DragoAnt.System.Text.Json.Observer/Builders/JsonObjBuilder.cs
+++ b/DragoAnt.System.Text.Json.Observer/Builders/JsonObjBuilder.cs
@@ -44,7 +44,16 @@ private JsonObjBuilder<TContext> AddAny(JsonPropertyPathMatchDelegate propNameMa
         Add((int depth, ref PropertyPath path, JsonTokenType _) => propNameMatch(depth, ref path), policy, info);
 
     private JsonObjBuilder<TContext> AddValue(JsonPropertyPathMatchDelegate propNameMatch, JsonObserverDelegate<TContext> policy, RuleInfo<TContext> info) =>
-        Add((int depth, ref PropertyPath path, JsonTokenType type) =>
+        Add(ValueMatch(propNameMatch), policy, info);
+
+    private JsonObjBuilder<TContext> AddRead(JsonPropertyPathMatchDelegate propNameMatch, JsonObserverItem<TContext>.ReadValue read, RuleInfo<TContext> info)
+    {
+        _policies.Add(JsonObserverItem<TContext>.Read(ValueMatch(propNameMatch), read, info));
+        return this;
+    }
+
+    private static JsonPropertyMatchDelegate ValueMatch(JsonPropertyPathMatchDelegate propNameMatch) =>
+        (int depth, ref PropertyPath path, JsonTokenType type) =>
         {
             var (success, propDepth) = propNameMatch(depth, ref path);
 
@@ -54,7 +63,7 @@ private JsonObjBuilder<TContext> AddValue(JsonPropertyPathMatchDelegate propName
             }
 
             return (true, propDepth);
-        }, policy, info);
+        };
 
     private JsonObjBuilder<TContext> Add(JsonPropertyMatchDelegate propMatch, JsonObserverDelegate<TContext> policy, RuleInfo<TContext> info)
     {
@@ -90,40 +99,40 @@ public JsonObjBuilder<TContext> MaskStr(StringMaskingStrategy<TContext> strategy
             MaskWhole(JsonObserverItem<TContext>.ApplyStringPolicy(strategy, strategy.Constant), RuleText.Strategy("MaskStr", strategy.Constant));
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadStr"/>
-        public JsonObjBuilder<TContext> ReadStr(Action<string?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadStr(strategy, _builderDefaultValuePolicy), RuleText.ReadStr);
+        public ReadRuleBuilder ReadStr(Action<string?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadStr(strategy), RuleText.ReadStr);
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskInt"/>
         public JsonObjBuilder<TContext> MaskInt(Func<int?, TContext, string?> strategy)
             => MaskWhole(JsonObserverItem<TContext>.ApplyIntPolicy(strategy), "MaskInt(function)");
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadInt"/>
-        public JsonObjBuilder<TContext> ReadInt(Action<int?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadInt(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadInt"));
+        public ReadRuleBuilder ReadInt(Action<int?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadInt(strategy), RuleText.ReadNumber("ReadInt"));
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskLong"/>
         public JsonObjBuilder<TContext> MaskLong(Func<long?, TContext, string?> strategy)
             => MaskWhole(JsonObserverItem<TContext>.ApplyLongPolicy(strategy), "MaskLong(function)");
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadLong"/>
-        public JsonObjBuilder<TContext> ReadLong(Action<long?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadLong(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadLong"));
+        public ReadRuleBuilder ReadLong(Action<long?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadLong(strategy), RuleText.ReadNumber("ReadLong"));
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskDecimal"/>
         public JsonObjBuilder<TContext> MaskDecimal(Func<decimal?, TContext, string?> strategy)
             => MaskWhole(JsonObserverItem<TContext>.ApplyDecimalPolicy(strategy), "MaskDecimal(function)");
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadDecimal"/>
-        public JsonObjBuilder<TContext> ReadDecimal(Action<decimal?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadDecimal(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadDecimal"));
+        public ReadRuleBuilder ReadDecimal(Action<decimal?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadDecimal(strategy), RuleText.ReadNumber("ReadDecimal"));
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskBool"/>
         public JsonObjBuilder<TContext> MaskBool(Func<bool?, TContext, string?> strategy)
             => MaskWhole(JsonObserverItem<TContext>.ApplyBoolPolicy(strategy), "MaskBool(function)");
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadBool"/>
-        public JsonObjBuilder<TContext> ReadBool(Action<bool?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadBool(strategy, _builderDefaultValuePolicy), RuleText.ReadBool);
+        public ReadRuleBuilder ReadBool(Action<bool?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadBool(strategy), RuleText.ReadBool);
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskAny(Func{string, TContext, string})"/>
         public JsonObjBuilder<TContext> MaskAny(Func<string?, TContext, string?> strategy)
@@ -142,8 +151,8 @@ public JsonObjBuilder<TContext> MaskRawValue(Func<string?, TContext, string?> st
             => MaskWhole(JsonObserverItem<TContext>.ApplyRawPolicy(strategy), "MaskRawValue(function)");
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.ReadRaw"/>
-        public JsonObjBuilder<TContext> ReadRaw(Action<string?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadRaw(strategy, _builderDefaultValuePolicy), RuleText.ReadRaw);
+        public ReadRuleBuilder ReadRaw(Action<string?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadRaw(strategy), RuleText.ReadRaw);
 
         /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskValue(JsonObserverValueDelegate{TContext})"/>
         public JsonObjBuilder<TContext> MaskValue(JsonObserverValueDelegate<TContext> policy) =>
@@ -208,8 +217,8 @@ public JsonObjBuilder<TContext> Array(JsonObserverDelegate<TContext> policy) =>
         internal JsonObjBuilder<TContext> MaskWhole(JsonObserverDelegate<TContext> policy, string action)
             => _builder.AddAny(_propNameMatch.AbsoluteMatch, policy, Info(action, JsonPathOutcome.Masked));
 
-        private JsonObjBuilder<TContext> Read(JsonObserverDelegate<TContext> policy, string action)
-            => _builder.AddValue(_propNameMatch.AbsoluteMatch, policy, Info(action, JsonPathOutcome.Read));
+        private ReadRuleBuilder Read(JsonObserverItem<TContext>.ReadValue read, string action)
+            => new(this, _builder.AddRead(_propNameMatch.AbsoluteMatch, read, Info(action, JsonPathOutcome.Read)));
 
         private JsonObjBuilder<TContext> Container(JsonTokenType container, JsonObserverDelegate<TContext> policy, RuleInfo<TContext> info)
         {
@@ -230,4 +239,74 @@ private JsonObjBuilder<TContext> Container(JsonTokenType container, JsonObserver
         private RuleInfo<TContext> Info(string action, JsonPathOutcome outcome, RuleSet<TContext>? child = null) =>
             new(_propNameMatch.Describe(), action, outcome, child);
     }
+
+    /// <summary>
+    /// A read rule just added. A read rule does not decide what is written: the default policy writes the value unless
+    /// <see cref="Unmasked"/> or a mask method is chained here, which applies to the same match. <see cref="Match(PropMatchingStrategy)"/>
+    /// starts the next rule.
+    /// </summary>
+    public readonly ref struct ReadRuleBuilder
+    {
+        private readonly PropertyMaskingStrategyBuilder _rule;
+        private readonly JsonObjBuilder<TContext> _builder;
+
+        internal ReadRuleBuilder(PropertyMaskingStrategyBuilder rule, JsonObjBuilder<TContext> builder)
+        {
+            _rule = rule;
+            _builder = builder;
+        }
+
+        /// <inheritdoc cref="JsonObjBuilder{TContext}.Match(PropMatchingStrategy)"/>
+        public PropertyMaskingStrategyBuilder Match(PropMatchingStrategy match) => _builder.Match(match);
+
+        /// <inheritdoc cref="JsonObjBuilder{TContext}.Match(PropMatchingStrategy[])"/>
+        public PropertyMaskingStrategyBuilder Match(params PropMatchingStrategy[] match) => _builder.Match(match);
+
+        /// <summary>
+        /// Writes the read value unchanged instead of through the default policy.
+        /// </summary>
+        public JsonObjBuilder<TContext> Unmasked() => _rule.Unmasked();
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskStr(Func{string, TContext, string})"/>
+        public JsonObjBuilder<TContext> MaskStr(Func<string?, TContext, string?> strategy) => _rule.MaskStr(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskStr(StringMaskingStrategy{TContext})"/>
+        public JsonObjBuilder<TContext> MaskStr(StringMaskingStrategy<TContext> strategy) => _rule.MaskStr(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskInt"/>
+        public JsonObjBuilder<TContext> MaskInt(Func<int?, TContext, string?> strategy) => _rule.MaskInt(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskLong"/>
+        public JsonObjBuilder<TContext> MaskLong(Func<long?, TContext, string?> strategy) => _rule.MaskLong(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskDecimal"/>
+        public JsonObjBuilder<TContext> MaskDecimal(Func<decimal?, TContext, string?> strategy) => _rule.MaskDecimal(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskBool"/>
+        public JsonObjBuilder<TContext> MaskBool(Func<bool?, TContext, string?> strategy) => _rule.MaskBool(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskAny(Func{string, TContext, string})"/>
+        public JsonObjBuilder<TContext> MaskAny(Func<string?, TContext, string?> strategy) => _rule.MaskAny(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskAny(StringMaskingStrategy{TContext})"/>
+        public JsonObjBuilder<TContext> MaskAny(StringMaskingStrategy<TContext> strategy) => _rule.MaskAny(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskAny(MaskTag)"/>
+        public JsonObjBuilder<TContext> MaskAny(MaskTag tag) => _rule.MaskAny(tag);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskRawValue"/>
+        public JsonObjBuilder<TContext> MaskRawValue(Func<string?, TContext, string?> strategy) => _rule.MaskRawValue(strategy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskValue(JsonObserverValueDelegate{TContext})"/>
+        public JsonObjBuilder<TContext> MaskValue(JsonObserverValueDelegate<TContext> policy) => _rule.MaskValue(policy);
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.PropertyMaskingStrategyBuilder.MaskValue(JsonObserverDelegate{TContext})"/>
+        public JsonObjBuilder<TContext> MaskValue(JsonObserverDelegate<TContext> policy) => _rule.MaskValue(policy);
+
+        /// <summary>
+        /// The rules added so far, to keep adding to them.
+        /// </summary>
+        /// <param name="rule">The read rule just added.</param>
+        public static implicit operator JsonObjBuilder<TContext>(ReadRuleBuilder rule) => rule._builder;
+    }
 }
diff --git a/DragoAnt.System.Text.Json.Observer/Builders/JsonValuePolicyBuilder.cs b/DragoAnt.System.Text.Json.Observer/Builders/JsonValuePolicyBuilder.cs
index 5977a37..35687c5 100644
--- a/DragoAnt.System.Text.Json.Observer/Builders/JsonValuePolicyBuilder.cs
+++ b/DragoAnt.System.Text.Json.Observer/Builders/JsonValuePolicyBuilder.cs
@@ -41,7 +41,18 @@ private JsonValuePolicyBuilder<TContext> AddAnyProp(JsonPropertyPathMatchDelegat
 
     private JsonValuePolicyBuilder<TContext> AddValueProp(JsonPropertyPathMatchDelegate propNameMatch, JsonObserverDelegate<TContext> policy, RuleInfo<TContext> info)
     {
-        var item = new JsonObserverItem<TContext>((int depth, ref PropertyPath path, JsonTokenType type) =>
+        _policies.Add(new JsonObserverItem<TContext>(ValueMatch(propNameMatch), policy) { Info = info });
+        return this;
+    }
+
+    private JsonValuePolicyBuilder<TContext> AddReadProp(JsonPropertyPathMatchDelegate propNameMatch, JsonObserverItem<TContext>.ReadValue read, RuleInfo<TContext> info)
+    {
+        _policies.Add(JsonObserverItem<TContext>.Read(ValueMatch(propNameMatch), read, info));
+        return this;
+    }
+
+    private static JsonPropertyMatchDelegate ValueMatch(JsonPropertyPathMatchDelegate propNameMatch) =>
+        (int depth, ref PropertyPath path, JsonTokenType type) =>
         {
             var (success, nextDepth) = propNameMatch(depth, ref path);
 
@@ -51,10 +62,7 @@ private JsonValuePolicyBuilder<TContext> AddValueProp(JsonPropertyPathMatchDeleg
             }
 
             return (true, nextDepth);
-        }, policy) { Info = info };
-        _policies.Add(item);
-        return this;
-    }
+        };
 
     private JsonObserverDelegate<TContext> Build() => JsonObserverItem<TContext>.ApplyValuePolicy([.. _policies], _builderDefaultValuePolicy);
 
@@ -80,8 +88,8 @@ internal PropertyMaskingStrategyBuilder(
         /// <summary>
         /// Masks the whole value with <paramref name="strategy"/>, whatever its JSON type: a string arrives decoded,
         /// a number or boolean as its JSON literal (<c>"12.50"</c>, <c>"true"</c>), <c>null</c> as <c>null</c>, and an object
-        /// or array is skipped unread and arrives as <c>null</c>. A value longer than
-        /// <see cref="JsonObserverOptions.MaxValueBytes"/> arrives cut to that length.
+        /// or array is skipped unread and arrives as <c>null</c>. The strategy receives the whole value and its result is not cut by
+        /// <see cref="JsonObserverOptions.MaxValueBytes"/>.
         /// </summary>
         /// <param name="strategy">Returns the replacement string; <c>null</c> writes <c>null</c>.</param>
         public JsonValuePolicyBuilder<TContext> MaskStr(Func<string?, TContext, string?> strategy)
@@ -90,8 +98,8 @@ public JsonValuePolicyBuilder<TContext> MaskStr(Func<string?, TContext, string?>
         /// <summary>
         /// Masks the whole value with <paramref name="strategy"/>, whatever its JSON type: a string arrives decoded,
         /// a number or boolean as its JSON literal (<c>"12.50"</c>, <c>"true"</c>), <c>null</c> as <c>null</c>, and an object
-        /// or array is skipped unread and arrives as <c>null</c>. A value longer than
-        /// <see cref="JsonObserverOptions.MaxValueBytes"/> arrives cut to that length.
+        /// or array is skipped unread and arrives as <c>null</c>. The strategy receives the whole value and its result is not cut by
+        /// <see cref="JsonObserverOptions.MaxValueBytes"/>.
         /// </summary>
         /// <param name="strategy">
         /// Replacement: a constant string, a <see cref="global::System.Text.RegularExpressions.Regex"/> whose matches become <c>*</c>,
@@ -101,12 +109,13 @@ public JsonValuePolicyBuilder<TContext> MaskStr(StringMaskingStrategy<TContext>
             => MaskWhole(JsonObserverItem<TContext>.ApplyStringPolicy(strategy, strategy.Constant), RuleText.Strategy("MaskStr", strategy.Constant));
 
         /// <summary>
-        /// Hands a string or <c>null</c> value to <paramref name="strategy"/> and writes it unchanged.
-        /// A value of another type is not read and gets the default policy.
+        /// Hands a string or <c>null</c> value to <paramref name="strategy"/>; a value of another type is not read.
+        /// Reading does not decide the output: the default policy writes the value unless <see cref="ReadRuleBuilder.Unmasked"/>
+        /// or a mask method is chained, or another rule writes the same match.
         /// </summary>
         /// <param name="strategy">Receives the decoded value and the context.</param>
-        public JsonValuePolicyBuilder<TContext> ReadStr(Action<string?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadStr(strategy, _builderDefaultValuePolicy), RuleText.ReadStr);
+        public ReadRuleBuilder ReadStr(Action<string?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadStr(strategy), RuleText.ReadStr);
 
         /// <summary>
         /// Masks the whole value with <paramref name="strategy"/>, whatever its JSON type. The strategy receives the number
@@ -118,12 +127,13 @@ public JsonValuePolicyBuilder<TContext> MaskInt(Func<int?, TContext, string?> st
             => MaskWhole(JsonObserverItem<TContext>.ApplyIntPolicy(strategy), "MaskInt(function)");
 
         /// <summary>
-        /// Hands a number or <c>null</c> value to <paramref name="strategy"/> and writes it unchanged; a number that does not
-        /// fit <see cref="int"/> arrives as <c>null</c>. A value of another type is not read and gets the default policy.
+        /// Hands a number or <c>null</c> value to <paramref name="strategy"/>; a number that does not fit <see cref="int"/>
+        /// arrives as <c>null</c>, and a value of another type is not read. Reading does not decide the output: the default policy writes the value unless <see cref="ReadRuleBuilder.Unmasked"/>
+        /// or a mask method is chained, or another rule writes the same match.
         /// </summary>
         /// <param name="strategy">Receives the value and the context.</param>
-        public JsonValuePolicyBuilder<TContext> ReadInt(Action<int?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadInt(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadInt"));
+        public ReadRuleBuilder ReadInt(Action<int?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadInt(strategy), RuleText.ReadNumber("ReadInt"));
 
         /// <summary>
         /// Masks the whole value with <paramref name="strategy"/>, whatever its JSON type. The strategy receives the number
@@ -135,12 +145,13 @@ public JsonValuePolicyBuilder<TContext> MaskLong(Func<long?, TContext, string?>
             => MaskWhole(JsonObserverItem<TContext>.ApplyLongPolicy(strategy), "MaskLong(function)");
 
         /// <summary>
-        /// Hands a number or <c>null</c> value to <paramref name="strategy"/> and writes it unchanged; a number that does not
-        /// fit <see cref="long"/> arrives as <c>null</c>. A value of another type is not read and gets the default policy.
+        /// Hands a number or <c>null</c> value to <paramref name="strategy"/>; a number that does not fit <see cref="long"/>
+        /// arrives as <c>null</c>, and a value of another type is not read. Reading does not decide the output: the default policy writes the value unless <see cref="ReadRuleBuilder.Unmasked"/>
+        /// or a mask method is chained, or another rule writes the same match.
         /// </summary>
         /// <param name="strategy">Receives the value and the context.</param>
-        public JsonValuePolicyBuilder<TContext> ReadLong(Action<long?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadLong(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadLong"));
+        public ReadRuleBuilder ReadLong(Action<long?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadLong(strategy), RuleText.ReadNumber("ReadLong"));
 
         /// <summary>
         /// Masks the whole value with <paramref name="strategy"/>, whatever its JSON type. The strategy receives the number
@@ -152,12 +163,13 @@ public JsonValuePolicyBuilder<TContext> MaskDecimal(Func<decimal?, TContext, str
             => MaskWhole(JsonObserverItem<TContext>.ApplyDecimalPolicy(strategy), "MaskDecimal(function)");
 
         /// <summary>
-        /// Hands a number or <c>null</c> value to <paramref name="strategy"/> and writes it unchanged; a number out of the
-        /// <see cref="decimal"/> range arrives as <c>null</c>. A value of another type is not read and gets the default policy.
+        /// Hands a number or <c>null</c> value to <paramref name="strategy"/>; a number out of the <see cref="decimal"/> range
+        /// arrives as <c>null</c>, and a value of another type is not read. Reading does not decide the output: the default policy writes the value unless <see cref="ReadRuleBuilder.Unmasked"/>
+        /// or a mask method is chained, or another rule writes the same match.
         /// </summary>
         /// <param name="strategy">Receives the value, parsed with the invariant culture, and the context.</param>
-        public JsonValuePolicyBuilder<TContext> ReadDecimal(Action<decimal?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadDecimal(strategy, _builderDefaultValuePolicy), RuleText.ReadNumber("ReadDecimal"));
+        public ReadRuleBuilder ReadDecimal(Action<decimal?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadDecimal(strategy), RuleText.ReadNumber("ReadDecimal"));
 
         /// <summary>
         /// Masks the whole value with <paramref name="strategy"/>, whatever its JSON type. The strategy receives
@@ -168,18 +180,19 @@ public JsonValuePolicyBuilder<TContext> MaskBool(Func<bool?, TContext, string?>
             => MaskWhole(JsonObserverItem<TContext>.ApplyBoolPolicy(strategy), "MaskBool(function)");
 
         /// <summary>
-        /// Hands a boolean or <c>null</c> value to <paramref name="strategy"/> and writes it unchanged.
-        /// A value of another type is not read and gets the default policy.
+        /// Hands a boolean or <c>null</c> value to <paramref name="strategy"/>; a value of another type is not read.
+        /// Reading does not decide the output: the default policy writes the value unless <see cref="ReadRuleBuilder.Unmasked"/>
+        /// or a mask method is chained, or another rule writes the same match.
         /// </summary>
         /// <param name="strategy">Receives the value and the context.</param>
-        public JsonValuePolicyBuilder<TContext> ReadBool(Action<bool?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadBool(strategy, _builderDefaultValuePolicy), RuleText.ReadBool);
+        public ReadRuleBuilder ReadBool(Action<bool?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadBool(strategy), RuleText.ReadBool);
 
         /// <summary>
         /// Masks the whole value with <paramref name="strategy"/>, whatever its JSON type: a string arrives decoded,
         /// a number or boolean as its JSON literal, and an object or array is skipped unread and arrives as <c>null</c>.
-        /// A <c>null</c> value stays <c>null</c> without calling the strategy. A value longer than
-        /// <see cref="JsonObserverOptions.MaxValueBytes"/> arrives cut to that length.
+        /// A <c>null</c> value stays <c>null</c> without calling the strategy. The strategy receives the whole value and its result is not cut by
+        /// <see cref="JsonObserverOptions.MaxValueBytes"/>.
         /// </summary>
         /// <param name="strategy">Returns the replacement string; <c>null</c> writes <c>null</c>.</param>
         public JsonValuePolicyBuilder<TContext> MaskAny(Func<string?, TContext, string?> strategy)
@@ -188,8 +201,8 @@ public JsonValuePolicyBuilder<TContext> MaskAny(Func<string?, TContext, string?>
         /// <summary>
         /// Masks the whole value with <paramref name="strategy"/>, whatever its JSON type: a string arrives decoded,
         /// a number or boolean as its JSON literal, and an object or array is skipped unread and arrives as <c>null</c>.
-        /// A <c>null</c> value stays <c>null</c> without calling the strategy. A value longer than
-        /// <see cref="JsonObserverOptions.MaxValueBytes"/> arrives cut to that length.
+        /// A <c>null</c> value stays <c>null</c> without calling the strategy. The strategy receives the whole value and its result is not cut by
+        /// <see cref="JsonObserverOptions.MaxValueBytes"/>.
         /// </summary>
         /// <param name="strategy">
         /// Replacement: a constant string, a <see cref="global::System.Text.RegularExpressions.Regex"/> whose matches become <c>*</c>,
@@ -215,12 +228,13 @@ public JsonValuePolicyBuilder<TContext> MaskRawValue(Func<string?, TContext, str
             => MaskWhole(JsonObserverItem<TContext>.ApplyRawPolicy(strategy), "MaskRawValue(function)");
 
         /// <summary>
-        /// Hands a string, number, boolean or <c>null</c> value to <paramref name="strategy"/> as its raw JSON text and writes
-        /// it unchanged. An object or array is not read and gets the default policy.
+        /// Hands a string, number, boolean or <c>null</c> value to <paramref name="strategy"/> as its raw JSON text; an object
+        /// or array is not read. Reading does not decide the output: the default policy writes the value unless <see cref="ReadRuleBuilder.Unmasked"/>
+        /// or a mask method is chained, or another rule writes the same match.
         /// </summary>
         /// <param name="strategy">Receives the raw text (a string without quotes, escapes kept) and the context.</param>
-        public JsonValuePolicyBuilder<TContext> ReadRaw(Action<string?, TContext> strategy)
-            => Read(JsonObserverItem<TContext>.ReadRaw(strategy, _builderDefaultValuePolicy), RuleText.ReadRaw);
+        public ReadRuleBuilder ReadRaw(Action<string?, TContext> strategy)
+            => Read(JsonObserverItem<TContext>.ReadRaw(strategy), RuleText.ReadRaw);
 
         /// <summary>
         /// Writes the value of the matched property unchanged. Applies to strings, numbers, booleans and <c>null</c>;
@@ -262,8 +276,8 @@ public JsonValuePolicyBuilder<TContext> MaskValue(JsonObserverDelegate<TContext>
         internal JsonValuePolicyBuilder<TContext> MaskWhole(JsonObserverDelegate<TContext> policy, string action)
             => _builder.AddAnyProp(Match, policy, Info(action, JsonPathOutcome.Masked));
 
-        private JsonValuePolicyBuilder<TContext> Read(JsonObserverDelegate<TContext> policy, string action)
-            => Value(policy, action, JsonPathOutcome.Read);
+        private ReadRuleBuilder Read(JsonObserverItem<TContext>.ReadValue read, string action)
+            => new(this, _builder.AddReadProp(Match, read, Info(action, JsonPathOutcome.Read)));
 
         private JsonValuePolicyBuilder<TContext> Value(JsonObserverDelegate<TContext> policy, string action, JsonPathOutcome outcome)
             => _builder.AddValueProp(Match, policy, Info(action, outcome));
@@ -272,4 +286,71 @@ private JsonValuePolicyBuilder<TContext> Value(JsonObserverDelegate<TContext> po
 
         private RuleInfo<TContext> Info(string action, JsonPathOutcome outcome) => new(_propNameMatch.Describe(), action, outcome);
     }
+
+    /// <summary>
+    /// A read rule just added. A read rule does not decide what is written: the default policy writes the value unless
+    /// <see cref="Unmasked"/> or a mask method is chained here, which applies to the same match. <see cref="Match"/>
+    /// starts the next rule.
+    /// </summary>
+    public readonly ref struct ReadRuleBuilder
+    {
+        private readonly PropertyMaskingStrategyBuilder _rule;
+        private readonly JsonValuePolicyBuilder<TContext> _builder;
+
+        internal ReadRuleBuilder(PropertyMaskingStrategyBuilder rule, JsonValuePolicyBuilder<TContext> builder)
+        {
+            _rule = rule;
+            _builder = builder;
+        }
+
+        /// <inheritdoc cref="JsonValuePolicyBuilder{TContext}.Match"/>
+        public PropertyMaskingStrategyBuilder Match(params PropMatchingStrategy[] match) => _builder.Match(match);
+
+        /// <summary>
+        /// Writes the read value unchanged instead of through the default policy.
+        /// </summary>
+        public JsonValuePolicyBuilder<TContext> Unmasked() => _rule.Unmasked();
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskStr(Func{string, TContext, string})"/>
+        public JsonValuePolicyBuilder<TContext> MaskStr(Func<string?, TContext, string?> strategy) => _rule.MaskStr(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskStr(StringMaskingStrategy{TContext})"/>
+        public JsonValuePolicyBuilder<TContext> MaskStr(StringMaskingStrategy<TContext> strategy) => _rule.MaskStr(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskInt"/>
+        public JsonValuePolicyBuilder<TContext> MaskInt(Func<int?, TContext, string?> strategy) => _rule.MaskInt(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskLong"/>
+        public JsonValuePolicyBuilder<TContext> MaskLong(Func<long?, TContext, string?> strategy) => _rule.MaskLong(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskDecimal"/>
+        public JsonValuePolicyBuilder<TContext> MaskDecimal(Func<decimal?, TContext, string?> strategy) => _rule.MaskDecimal(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskBool"/>
+        public JsonValuePolicyBuilder<TContext> MaskBool(Func<bool?, TContext, string?> strategy) => _rule.MaskBool(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskAny(Func{string, TContext, string})"/>
+        public JsonValuePolicyBuilder<TContext> MaskAny(Func<string?, TContext, string?> strategy) => _rule.MaskAny(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskAny(StringMaskingStrategy{TContext})"/>
+        public JsonValuePolicyBuilder<TContext> MaskAny(StringMaskingStrategy<TContext> strategy) => _rule.MaskAny(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskAny(MaskTag)"/>
+        public JsonValuePolicyBuilder<TContext> MaskAny(MaskTag tag) => _rule.MaskAny(tag);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskRawValue"/>
+        public JsonValuePolicyBuilder<TContext> MaskRawValue(Func<string?, TContext, string?> strategy) => _rule.MaskRawValue(strategy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskValue(JsonObserverValueDelegate{TContext})"/>
+        public JsonValuePolicyBuilder<TContext> MaskValue(JsonObserverValueDelegate<TContext> policy) => _rule.MaskValue(policy);
+
+        /// <inheritdoc cref="PropertyMaskingStrategyBuilder.MaskValue(JsonObserverDelegate{TContext})"/>
+        public JsonValuePolicyBuilder<TContext> MaskValue(JsonObserverDelegate<TContext> policy) => _rule.MaskValue(policy);
+
+        /// <summary>
+        /// The rules added so far, to keep adding to them.
+        /// </summary>
+        /// <param name="rule">The read rule just added.</param>
+        public static implicit operator JsonValuePolicyBuilder<TContext>(ReadRuleBuilder rule) => rule._builder;
+    }
 }
diff --git a/DragoAnt.System.Text.Json.Observer/Builders/RuleText.cs b/DragoAnt.System.Text.Json.Observer/Builders/RuleText.cs
index 68134aa..d2c6aeb 100644
--- a/DragoAnt.System.Text.Json.Observer/Builders/RuleText.cs
+++ b/DragoAnt.System.Text.Json.Observer/Builders/RuleText.cs
@@ -9,12 +9,11 @@ internal static class RuleText
 {
     public const string Unmasked = "Unmasked()";
     public const string CustomValue = "MaskValue(custom rule)";
-    public const string ReadStr = "ReadStr (a string or null is read and written as is; another type gets the default policy)";
-    public const string ReadBool = "ReadBool (a boolean or null is read and written as is; another type gets the default policy)";
-    public const string ReadRaw = "ReadRaw (a scalar is read and written as is; an object or array gets the default policy)";
+    public const string ReadStr = "ReadStr (a string or null is read)";
+    public const string ReadBool = "ReadBool (a boolean or null is read)";
+    public const string ReadRaw = "ReadRaw (a scalar is read)";
 
-    public static string ReadNumber(string method) =>
-        $"{method} (a number or null is read and written as is; another type gets the default policy)";
+    public static string ReadNumber(string method) => $"{method} (a number or null is read)";
 
     public static string Strategy(string method, string? constant) =>
         constant is null ? $"{method}(function)" : $"{method}(\"{constant}\")";
diff --git a/DragoAnt.System.Text.Json.Observer/JsonObserverItem.cs b/DragoAnt.System.Text.Json.Observer/JsonObserverItem.cs
index 980860b..015b7a2 100644
--- a/DragoAnt.System.Text.Json.Observer/JsonObserverItem.cs
+++ b/DragoAnt.System.Text.Json.Observer/JsonObserverItem.cs
@@ -94,87 +94,81 @@ public static (JsonObserverDelegate<TContext> Delegate, RuleSet<TContext> Set) A
         return JsonArrayBuilder<TContext>.Build(builder);
     }
 
-    public static JsonObserverDelegate<TContext> ReadStr(Action<string?, TContext> read, JsonObserverValueDelegate<TContext>? valuePolicy) =>
-        ApplyReadPolicy(
-            (ref Utf8JsonReader reader, TContext context) => read(reader.TokenType is Null ? null : reader.GetString(), context),
-            static type => type is JsonTokenType.String or Null,
-            valuePolicy);
-
-    public static JsonObserverDelegate<TContext> ReadInt(Action<int?, TContext> read, JsonObserverValueDelegate<TContext>? valuePolicy) =>
-        ApplyReadPolicy(
-            (ref Utf8JsonReader reader, TContext context) => read(reader.TokenType is Number && reader.TryGetInt32(out var v) ? v : null, context),
-            static type => type is Number or Null,
-            valuePolicy);
-
-    public static JsonObserverDelegate<TContext> ReadLong(Action<long?, TContext> read, JsonObserverValueDelegate<TContext>? valuePolicy) =>
-        ApplyReadPolicy(
-            (ref Utf8JsonReader reader, TContext context) => read(reader.TokenType is Number && reader.TryGetInt64(out var v) ? v : null, context),
-            static type => type is Number or Null,
-            valuePolicy);
-
-    public static JsonObserverDelegate<TContext> ReadDecimal(Action<decimal?, TContext> read, JsonObserverValueDelegate<TContext>? valuePolicy) =>
-        ApplyReadPolicy(
-            (ref Utf8JsonReader reader, TContext context) => read(reader.TokenType is Number && reader.TryGetDecimal(out var v) ? v : null, context),
-            static type => type is Number or Null,
-            valuePolicy);
-
-    public static JsonObserverDelegate<TContext> ReadBool(Action<bool?, TContext> read, JsonObserverValueDelegate<TContext>? valuePolicy) =>
-        ApplyReadPolicy(
-            (ref Utf8JsonReader reader, TContext context) => read(reader.TokenType is Null ? null : reader.GetBoolean(), context),
-            static type => type is True or False or Null,
-            valuePolicy);
-
-    public static JsonObserverDelegate<TContext> ReadRaw(Action<string?, TContext> read, JsonObserverValueDelegate<TContext>? valuePolicy) =>
-        ApplyReadPolicy(
-            (ref Utf8JsonReader reader, TContext context) =>
-                read(reader.HasValueSequence ? Encoding.UTF8.GetString(reader.ValueSequence) : Encoding.UTF8.GetString(reader.ValueSpan), context),
-            static type => type is JsonTokenType.String or Number or True or False or Null,
-            valuePolicy);
-
-    private delegate void ReadValue(ref Utf8JsonReader reader, TContext context);
-
     /// <summary>
-    /// Hands the value to <paramref name="read"/> and writes the token back unchanged.
+    /// What the rule reads; <c>null</c> for a rule that writes the value.
     /// </summary>
-    private static JsonObserverDelegate<TContext> ApplyReadPolicy(
-        ReadValue read,
-        Func<JsonTokenType, bool> accepts,
-        JsonObserverValueDelegate<TContext>? valuePolicy)
-    {
-        return (
-            ref Utf8JsonReader reader,
-            JsonWriter writer,
-            TContext context,
-            int _,
-            ref PropertyPath propPath,
-            JsonObserverValueDelegate<TContext> defaultValuePolicy) =>
+    public ReadValue? Reader { get; init; }
+
+    public static ReadValue ReadStr(Action<string?, TContext> read) =>
+        (ref Utf8JsonReader reader, TContext context) =>
         {
-            var tokenType = reader.TokenType;
-            if (!accepts(tokenType))
+            if (reader.TokenType is JsonTokenType.String or Null)
             {
-                (valuePolicy ?? defaultValuePolicy).Invoke(ref reader, writer, context, ref propPath);
-                return;
+                read(reader.TokenType is Null ? null : reader.GetString(), context);
             }
+        };
 
-            read(ref reader, context);
-            switch (tokenType)
+    public static ReadValue ReadInt(Action<int?, TContext> read) =>
+        (ref Utf8JsonReader reader, TContext context) =>
+        {
+            if (reader.TokenType is Number or Null)
             {
-                case Null:
-                    writer.WriteNullValue();
-                    break;
-                case JsonTokenType.String:
-                    writer.CopyStringValue(ref reader);
-                    break;
-                case True:
-                case False:
-                    writer.WriteBooleanValue(tokenType is True);
-                    break;
-                default:
-                    writer.CopyRawValue(ref reader);
-                    break;
+                read(reader.TokenType is Number && reader.TryGetInt32(out var v) ? v : null, context);
             }
         };
-    }
+
+    public static ReadValue ReadLong(Action<long?, TContext> read) =>
+        (ref Utf8JsonReader reader, TContext context) =>
+        {
+            if (reader.TokenType is Number or Null)
+            {
+                read(reader.TokenType is Number && reader.TryGetInt64(out var v) ? v : null, context);
+            }
+        };
+
+    public static ReadValue ReadDecimal(Action<decimal?, TContext> read) =>
+        (ref Utf8JsonReader reader, TContext context) =>
+        {
+            if (reader.TokenType is Number or Null)
+            {
+                read(reader.TokenType is Number && reader.TryGetDecimal(out var v) ? v : null, context);
+            }
+        };
+
+    public static ReadValue ReadBool(Action<bool?, TContext> read) =>
+        (ref Utf8JsonReader reader, TContext context) =>
+        {
+            if (reader.TokenType is True or False or Null)
+            {
+                read(reader.TokenType is Null ? null : reader.GetBoolean(), context);
+            }
+        };
+
+    public static ReadValue ReadRaw(Action<string?, TContext> read) =>
+        (ref Utf8JsonReader reader, TContext context) =>
+        {
+            if (reader.TokenType is JsonTokenType.String or Number or True or False or Null)
+            {
+                read(reader.HasValueSequence ? Encoding.UTF8.GetString(reader.ValueSequence) : Encoding.UTF8.GetString(reader.ValueSpan), context);
+            }
+        };
+
+    internal delegate void ReadValue(ref Utf8JsonReader reader, TContext context);
+
+    /// <summary>
+    /// A read rule: hands the value to <paramref name="read"/> and leaves the writing to the next matching rule or the default policy.
+    /// </summary>
+    public static JsonObserverItem<TContext> Read(JsonPropertyMatchDelegate propMatch, ReadValue read, RuleInfo<TContext> info) =>
+        new(propMatch, WriteByDefault) { Reader = read, Info = info };
+
+    private static void WriteByDefault(
+        ref Utf8JsonReader reader,
+        JsonWriter writer,
+        TContext context,
+        int _,
+        ref PropertyPath propPath,
+        JsonObserverValueDelegate<TContext> defaultValuePolicy) =>
+        defaultValuePolicy(ref reader, writer, context, ref propPath);
 
     /// <summary>
     /// Masks a value of any JSON type with the call's <see cref="Utf8MaskStrategy"/>; a container is skipped.
@@ -207,8 +201,8 @@ public static JsonObserverDelegate<TContext> ApplyTagPolicy(MaskTag tag)
     public static JsonObserverDelegate<TContext> ApplyAnyPolicy(Func<string?, TContext, string?> maskingRule, string? constant = null) =>
         ApplyMaskPolicy(
             constant is not null
-                ? (ref Utf8JsonReader _, TContext _, int _) => constant
-                : (ref Utf8JsonReader reader, TContext context, int maxBytes) => maskingRule(ScalarText(ref reader, maxBytes, decode: true), context),
+                ? (ref Utf8JsonReader _, TContext _) => constant
+                : (ref Utf8JsonReader reader, TContext context) => maskingRule(ScalarText(ref reader, decode: true), context),
             keepNull: true);
 
     /// <summary>
@@ -217,8 +211,8 @@ constant is not null
     public static JsonObserverDelegate<TContext> ApplyStringPolicy(Func<string?, TContext, string?> maskingRule, string? constant = null) =>
         ApplyMaskPolicy(
             constant is not null
-                ? (ref Utf8JsonReader _, TContext _, int _) => constant
-                : (ref Utf8JsonReader reader, TContext context, int maxBytes) => maskingRule(ScalarText(ref reader, maxBytes, decode: true), context),
+                ? (ref Utf8JsonReader _, TContext _) => constant
+                : (ref Utf8JsonReader reader, TContext context) => maskingRule(ScalarText(ref reader, decode: true), context),
             keepNull: false);
 
     /// <summary>
@@ -226,7 +220,7 @@ constant is not null
     /// </summary>
     public static JsonObserverDelegate<TContext> ApplyRawPolicy(Func<string?, TContext, string?> maskingRule) =>
         ApplyMaskPolicy(
-            (ref Utf8JsonReader reader, TContext context, int maxBytes) => maskingRule(ScalarText(ref reader, maxBytes, decode: false), context),
+            (ref Utf8JsonReader reader, TContext context) => maskingRule(ScalarText(ref reader, decode: false), context),
             keepNull: false);
 
     /// <summary>
@@ -234,7 +228,7 @@ public static JsonObserverDelegate<TContext> ApplyRawPolicy(Func<string?, TConte
     /// </summary>
     public static JsonObserverDelegate<TContext> ApplyBoolPolicy(Func<bool?, TContext, string?> maskingRule) =>
         ApplyMaskPolicy(
-            (ref Utf8JsonReader reader, TContext context, int _) => maskingRule(reader.TokenType switch
+            (ref Utf8JsonReader reader, TContext context) => maskingRule(reader.TokenType switch
             {
                 True => true,
                 False => false,
@@ -247,7 +241,7 @@ public static JsonObserverDelegate<TContext> ApplyBoolPolicy(Func<bool?, TContex
     /// </summary>
     public static JsonObserverDelegate<TContext> ApplyIntPolicy(Func<int?, TContext, string?> maskingRule) =>
         ApplyMaskPolicy(
-            (ref Utf8JsonReader reader, TContext context, int _) =>
+            (ref Utf8JsonReader reader, TContext context) =>
                 maskingRule(reader.TokenType is Number && reader.TryGetInt32(out var value) ? value : null, context),
             keepNull: false);
 
@@ -256,7 +250,7 @@ public static JsonObserverDelegate<TContext> ApplyIntPolicy(Func<int?, TContext,
     /// </summary>
     public static JsonObserverDelegate<TContext> ApplyLongPolicy(Func<long?, TContext, string?> maskingRule) =>
         ApplyMaskPolicy(
-            (ref Utf8JsonReader reader, TContext context, int _) =>
+            (ref Utf8JsonReader reader, TContext context) =>
                 maskingRule(reader.TokenType is Number && reader.TryGetInt64(out var value) ? value : null, context),
             keepNull: false);
 
@@ -265,11 +259,11 @@ public static JsonObserverDelegate<TContext> ApplyLongPolicy(Func<long?, TContex
     /// </summary>
     public static JsonObserverDelegate<TContext> ApplyDecimalPolicy(Func<decimal?, TContext, string?> maskingRule) =>
         ApplyMaskPolicy(
-            (ref Utf8JsonReader reader, TContext context, int _) =>
+            (ref Utf8JsonReader reader, TContext context) =>
                 maskingRule(reader.TokenType is Number && reader.TryGetDecimal(out var value) ? value : null, context),
             keepNull: false);
 
-    private delegate string? MaskToken(ref Utf8JsonReader reader, TContext context, int maxValueBytes);
+    private delegate string? MaskToken(ref Utf8JsonReader reader, TContext context);
 
     /// <summary>
     /// Writes the function's replacement for the current value whatever its type, then moves past it; a container is never read.
@@ -290,14 +284,16 @@ private static JsonObserverDelegate<TContext> ApplyMaskPolicy(MaskToken mask, bo
                 return;
             }
 
-            var result = mask(ref reader, context, writer.Options.MaxValueBytes);
+            var result = mask(ref reader, context);
             if (result is null)
             {
                 writer.WriteNullValue();
             }
             else
             {
+                writer.MaskOutput = true;
                 writer.WriteStringValue(result);
+                writer.MaskOutput = false;
             }
 
             if (reader.TokenType is StartObject or StartArray && !reader.TrySkip())
@@ -308,9 +304,9 @@ private static JsonObserverDelegate<TContext> ApplyMaskPolicy(MaskToken mask, bo
     }
 
     /// <summary>
-    /// Text of a string, number or boolean token, at most <paramref name="maxBytes"/> UTF-8 bytes of it; <c>null</c> for anything else.
+    /// The whole text of a string, number or boolean token; <c>null</c> for anything else.
     /// </summary>
-    private static string? ScalarText(ref Utf8JsonReader reader, int maxBytes, bool decode)
+    private static string? ScalarText(ref Utf8JsonReader reader, bool decode)
     {
         if (reader.TokenType is not (JsonTokenType.String or Number or True or False))
         {
@@ -323,7 +319,7 @@ private static JsonObserverDelegate<TContext> ApplyMaskPolicy(MaskToken mask, bo
             var buffer = ArrayPool<byte>.Shared.Rent(length);
             try
             {
-                return Utf8Prefix(buffer.AsSpan(0, reader.CopyString(buffer)), maxBytes);
+                return Encoding.UTF8.GetString(buffer.AsSpan(0, reader.CopyString(buffer)));
             }
             finally
             {
@@ -331,29 +327,7 @@ private static JsonObserverDelegate<TContext> ApplyMaskPolicy(MaskToken mask, bo
             }
         }
 
-        if (!reader.HasValueSequence)
-        {
-            return Utf8Prefix(reader.ValueSpan, maxBytes);
-        }
-
-        var sequence = reader.ValueSequence;
-        return Utf8Prefix(sequence.Slice(0, Math.Min(sequence.Length, (long)maxBytes + 4)).ToArray(), maxBytes);
-    }
-
-    private static string Utf8Prefix(ReadOnlySpan<byte> utf8, int maxBytes)
-    {
-        if (utf8.Length > maxBytes)
-        {
-            var cut = Math.Max(maxBytes, 0);
-            while (cut > 0 && (utf8[cut] & 0xC0) == 0x80)
-            {
-                cut--;
-            }
-
-            utf8 = utf8[..cut];
-        }
-
-        return Encoding.UTF8.GetString(utf8);
+        return reader.HasValueSequence ? Encoding.UTF8.GetString(reader.ValueSequence) : Encoding.UTF8.GetString(reader.ValueSpan);
     }
 
     /// <summary>
@@ -364,6 +338,7 @@ private static string Utf8Prefix(ReadOnlySpan<byte> utf8, int maxBytes)
     public static JsonObserverDelegate<TContext> ApplyValuePolicy(JsonObserverItem<TContext>[] policies, JsonObserverValueDelegate<TContext>? valuePolicy)
     {
         var defaultPolicy = GetApplyDefaultPolicy(valuePolicy, UnknownContainers.Create(policies));
+        var lastReader = LastReader(policies);
 
         return (
             ref Utf8JsonReader reader,
@@ -381,6 +356,11 @@ public static JsonObserverDelegate<TContext> ApplyValuePolicy(JsonObserverItem<T
                 case False:
                 case Null:
                     var tokenType = reader.TokenType;
+                    if (lastReader >= 0)
+                    {
+                        RunReads(policies, lastReader, depth, ref propPath, ref reader, context);
+                    }
+
                     var (matchPolicy, nextDepth) = MatchPolicy(policies, depth, ref propPath, tokenType);
                     if (matchPolicy is not null)
                     {
@@ -415,6 +395,7 @@ private static JsonObserverDelegate<TContext> ApplyObjPolicy(
         UnknownContainers unknown)
     {
         var defaultPolicy = GetApplyDefaultPolicy(valuePolicy, unknown);
+        var lastReader = LastReader(policies);
 
         return (
             ref Utf8JsonReader reader,
@@ -455,6 +436,10 @@ private static JsonObserverDelegate<TContext> ApplyObjPolicy(
                         }
 
                         var tokenType = reader.TokenType;
+                        if (lastReader >= 0)
+                        {
+                            RunReads(policies, lastReader, depth, ref propPath, ref reader, context);
+                        }
 
                         var (matchPolicy, nextDepth) = MatchPolicy(policies, depth, ref propPath, tokenType);
 
@@ -496,6 +481,7 @@ private static JsonObserverDelegate<TContext> ApplyArrayPolicy(
         UnknownContainers unknown)
     {
         var defaultPolicy = GetApplyDefaultPolicy(valuePolicy, unknown);
+        var lastReader = LastReader(policies);
 
         return (
             ref Utf8JsonReader reader,
@@ -535,6 +521,11 @@ private static JsonObserverDelegate<TContext> ApplyArrayPolicy(
                         var tokenType = reader.TokenType;
 
                         propPath.AddArrayItem(index++);
+                        if (lastReader >= 0)
+                        {
+                            RunReads(policies, lastReader, depth, ref propPath, ref reader, context);
+                        }
+
                         var (matchPolicy, nextDepth) = MatchPolicy(policies, depth, ref propPath, tokenType);
 
                         if (matchPolicy is not null)
@@ -619,6 +610,11 @@ internal static (JsonObserverItem<TContext>?, int depth) MatchPolicy(
     {
         foreach (var policyItem in policies)
         {
+            if (policyItem.Reader is not null)
+            {
+                continue;
+            }
+
             var (success, nextDepth) = policyItem.Match(depth, ref path, tokenType);
             if (!success)
             {
@@ -631,7 +627,35 @@ internal static (JsonObserverItem<TContext>?, int depth) MatchPolicy(
         return (null, depth);
     }
 
-    private (bool success, int depth) Match(int depth, ref PropertyPath propPath, JsonTokenType token) => propMatch(depth, ref propPath, token);
+    /// <summary>
+    /// Index of the last read rule, or <c>-1</c> when there is none, so that a pass without read rules skips <see cref="RunReads"/>.
+    /// </summary>
+    internal static int LastReader(JsonObserverItem<TContext>[] policies) =>
+        global::System.Array.FindLastIndex(policies, static p => p.Reader is not null);
+
+    /// <summary>
+    /// Runs every read rule up to <paramref name="lastReader"/> that matches the current value, wherever it stands
+    /// relative to the rule that writes the value.
+    /// </summary>
+    internal static void RunReads(
+        JsonObserverItem<TContext>[] policies,
+        int lastReader,
+        int depth,
+        ref PropertyPath path,
+        ref Utf8JsonReader reader,
+        TContext context)
+    {
+        for (var i = 0; i <= lastReader; i++)
+        {
+            var policyItem = policies[i];
+            if (policyItem.Reader is not null && policyItem.Match(depth, ref path, reader.TokenType).success)
+            {
+                policyItem.Reader(ref reader, context);
+            }
+        }
+    }
+
+    internal (bool success, int depth) Match(int depth, ref PropertyPath propPath, JsonTokenType token) => propMatch(depth, ref propPath, token);
 
     internal void Apply(
         ref Utf8JsonReader reader,
diff --git a/DragoAnt.System.Text.Json.Observer/JsonObserverOptions.cs b/DragoAnt.System.Text.Json.Observer/JsonObserverOptions.cs
index c1a2664..63d76cb 100644
--- a/DragoAnt.System.Text.Json.Observer/JsonObserverOptions.cs
+++ b/DragoAnt.System.Text.Json.Observer/JsonObserverOptions.cs
@@ -8,7 +8,7 @@ namespace DragoAnt.System.Text.Json.Observer;
 /// <param name="MaxOutputBytes">Output size limit in UTF-8 bytes; when reached the output is closed and the status is <see cref="MaskStatus.Truncated"/>.</param>
 /// <param name="MaxValueBytes">
 /// Longest string value written, in UTF-8 bytes; a longer one is cut, ends with an ellipsis and makes the status <see cref="MaskStatus.Truncated"/>.
-/// A rule's masking function also receives a longer value cut to this length.
+/// It applies to values written unmasked: a masking function receives the whole value, and mask output, a hash included, is never cut.
 /// </param>
 /// <param name="MaxDepth">Deepest nesting accepted; a deeper payload is <see cref="MaskStatus.Invalid"/>.</param>
 /// <param name="RelaxedEscaping">Write non-ASCII and HTML-sensitive characters unescaped, which keeps logs readable.</param>
diff --git a/DragoAnt.System.Text.Json.Observer/JsonObserverValuePolicies.cs b/DragoAnt.System.Text.Json.Observer/JsonObserverValuePolicies.cs
index c726c92..26d310a 100644
--- a/DragoAnt.System.Text.Json.Observer/JsonObserverValuePolicies.cs
+++ b/DragoAnt.System.Text.Json.Observer/JsonObserverValuePolicies.cs
@@ -158,7 +158,9 @@ public static void AllowList(ref Utf8JsonReader reader, JsonWriter writer, TCont
             case Number:
             case True:
             case False:
+                writer.MaskOutput = true;
                 writer.WriteStringValue("***"u8);
+                writer.MaskOutput = false;
                 break;
             case Null:
                 writer.WriteNullValue();
@@ -177,10 +179,14 @@ public static void LegacyAllowList(ref Utf8JsonReader reader, JsonWriter writer,
         switch (reader.TokenType)
         {
             case JsonTokenType.String:
+                writer.MaskOutput = true;
                 writer.WriteStringValue("#str#*****");
+                writer.MaskOutput = false;
                 break;
             case Number:
+                writer.MaskOutput = true;
                 writer.WriteStringValue("#number#*****");
+                writer.MaskOutput = false;
                 break;
             case True:
                 writer.WriteBooleanValue(true);
diff --git a/DragoAnt.System.Text.Json.Observer/JsonWriter.cs b/DragoAnt.System.Text.Json.Observer/JsonWriter.cs
index cfc4084..ddaf480 100644
--- a/DragoAnt.System.Text.Json.Observer/JsonWriter.cs
+++ b/DragoAnt.System.Text.Json.Observer/JsonWriter.cs
@@ -124,6 +124,15 @@ private protected JsonWriter()
     /// </summary>
     internal virtual bool Stopped => false;
 
+    /// <summary>
+    /// The strings written now replace a value, so <see cref="JsonObserverOptions.MaxValueBytes"/> does not cut them.
+    /// </summary>
+    internal virtual bool MaskOutput
+    {
+        get => false;
+        set { }
+    }
+
     internal void CopyStringValue(ref Utf8JsonReader reader)
     {
         if (ReferenceEquals(this, Empty))
@@ -278,6 +287,12 @@ internal sealed class IgnoreNullsJsonWriter : JsonWriter, IDisposable
 
     internal override bool Stopped => _inner.Stopped;
 
+    internal override bool MaskOutput
+    {
+        get => _inner.MaskOutput;
+        set => _inner.MaskOutput = value;
+    }
+
     public override void WriteNullValue()
     {
         if (_count > 0 && _pending[_count - 1].Kind == Kind.Name)
diff --git a/DragoAnt.System.Text.Json.Observer/RuleExplainer.cs b/DragoAnt.System.Text.Json.Observer/RuleExplainer.cs
index 04c5298..519266b 100644
--- a/DragoAnt.System.Text.Json.Observer/RuleExplainer.cs
+++ b/DragoAnt.System.Text.Json.Observer/RuleExplainer.cs
@@ -34,6 +34,12 @@ protected override (JsonPathOutcome Outcome, string Rule, string Action) Explain
                 var token = TokenAt(segments, i, valueKind);
                 var last = i == segments.Count - 1;
                 var (item, nextDepth) = JsonObserverItem<TContext>.MatchPolicy(items, depth, ref path, token);
+                var reads = last ? ReadsAt(items, depth, ref path, token) : [];
+                foreach (var read in reads)
+                {
+                    steps.Add($"{at}: {read.Match} → {read.Action}");
+                }
+
                 if (item is not null)
                 {
                     var info = item.Info;
@@ -42,7 +48,7 @@ protected override (JsonPathOutcome Outcome, string Rule, string Action) Explain
                     {
                         var (outcome, action) = last ? Resolve(info, token) : (info.Outcome, $"{info.Action} on the whole {Container(token)}");
                         steps.Add($"{at}: {info.Match} → {action}");
-                        return (outcome, string.Join(" > ", chain), action);
+                        return WithReads((outcome, string.Join(" > ", chain), action), chain.GetRange(0, chain.Count - 1), reads);
                     }
 
                     steps.Add($"{at}: {info.Match} → {info.Action}");
@@ -69,7 +75,7 @@ protected override (JsonPathOutcome Outcome, string Rule, string Action) Explain
                     continue;
                 }
 
-                return DefaultPolicy(effective, ref path, token, at, steps);
+                return WithReads(DefaultPolicy(effective, ref path, token, at, steps), chain, reads);
             }
 
             throw new InvalidOperationException("Unreachable: the last segment always returns.");
@@ -89,16 +95,22 @@ private static (JsonPathOutcome, string, string) DefaultPolicy(
     {
         if (policy.Target is RelativeValuePolicy<TContext> relative)
         {
+            var reads = ReadsAt(relative.Items, 0, ref path, token);
+            foreach (var read in reads)
+            {
+                steps.Add($"{at}: relative {read.Match} → {read.Action}");
+            }
+
             var (item, _) = JsonObserverItem<TContext>.MatchPolicy(relative.Items, 0, ref path, token);
             if (item is not null)
             {
                 var (relativeOutcome, relativeAction) = Resolve(item.Info, token);
                 steps.Add($"{at}: relative {item.Info.Match} → {relativeAction}");
-                return (relativeOutcome, $"relative {item.Info.Match}", relativeAction);
+                return WithReads((relativeOutcome, $"relative {item.Info.Match}", relativeAction), ["relative"], reads);
             }
 
             steps.Add($"{at}: no relative rule");
-            return DefaultPolicy(relative.DefaultValuePolicy, ref path, token, at, steps);
+            return WithReads(DefaultPolicy(relative.DefaultValuePolicy, ref path, token, at, steps), ["relative"], reads);
         }
 
         var name = KnownPolicyName(policy);
@@ -123,6 +135,39 @@ private static (JsonPathOutcome, string, string) DefaultPolicy(
         return (outcome, rule, action);
     }
 
+    private static List<RuleInfo<TContext>> ReadsAt(JsonObserverItem<TContext>[] items, int depth, ref PropertyPath path, JsonTokenType token)
+    {
+        List<RuleInfo<TContext>> reads = [];
+        foreach (var item in items)
+        {
+            if (item.Reader is not null && item.Match(depth, ref path, token).success)
+            {
+                reads.Add(item.Info);
+            }
+        }
+
+        return reads;
+    }
+
+    /// <summary>
+    /// A value that read rules hand to the context is still written by the rule or policy that decided the result.
+    /// </summary>
+    private static (JsonPathOutcome, string, string) WithReads(
+        (JsonPathOutcome Outcome, string Rule, string Action) written,
+        List<string> chain,
+        List<RuleInfo<TContext>> reads)
+    {
+        if (reads.Count == 0)
+        {
+            return written;
+        }
+
+        var readRules = string.Join(" + ", reads.Select(r => string.Join(" > ", chain.Append(r.Match))));
+        var readActions = string.Join("; ", reads.Select(r => r.Action));
+        var outcome = written.Outcome is JsonPathOutcome.Unchanged ? JsonPathOutcome.Read : written.Outcome;
+        return (outcome, $"{readRules} + {written.Rule}", $"{readActions}; {written.Action}");
+    }
+
     private static string? KnownPolicyName(JsonObserverValueDelegate<TContext> policy)
     {
         var declaring = policy.Method.DeclaringType;
diff --git a/DragoAnt.System.Text.Json.Observer/Strategies/NameMatcher.cs b/DragoAnt.System.Text.Json.Observer/Strategies/NameMatcher.cs
index cd7f396..bc945c7 100644
--- a/DragoAnt.System.Text.Json.Observer/Strategies/NameMatcher.cs
+++ b/DragoAnt.System.Text.Json.Observer/Strategies/NameMatcher.cs
@@ -1,4 +1,5 @@
 using System.Text;
+using System.Text.RegularExpressions;
 
 namespace DragoAnt.System.Text.Json.Observer.Strategies;
 
@@ -30,11 +31,31 @@ private protected static StringComparison ComparisonOf(ref PropertyPath path) =>
 
     public static NameMatcher OneOf(string[] names) => new OneOfNameMatcher(names);
 
-    internal sealed class FuncNameMatcher(Func<string?, bool> match, string? description = null) : NameMatcher
+    internal sealed class FuncNameMatcher(Func<string?, StringComparison, bool> match, string? description = null) : NameMatcher
     {
+        public FuncNameMatcher(Func<string?, bool> match, string? description = null)
+            : this((name, _) => match(name), description)
+        {
+        }
+
         public override string Describe() => description ?? "custom name test";
 
-        public override bool MatchString(string? name, StringComparison comparison) => match(name);
+        public override bool MatchString(string? name, StringComparison comparison) => match(name, comparison);
+    }
+
+    /// <summary>
+    /// A regular expression; a case-insensitive call also matches names that differ in case only.
+    /// </summary>
+    internal sealed class RegexNameMatcher(Regex regex) : NameMatcher
+    {
+        private readonly Regex _ignoreCase = (regex.Options & RegexOptions.IgnoreCase) != 0
+            ? regex
+            : new Regex(regex.ToString(), regex.Options | RegexOptions.IgnoreCase | RegexOptions.CultureInvariant, regex.MatchTimeout);
+
+        public override string Describe() => $"Regex(/{regex}/)";
+
+        public override bool MatchString(string? name, StringComparison comparison) =>
+            name is not null && (comparison == StringComparison.Ordinal ? regex : _ignoreCase).IsMatch(name);
     }
 
     /// <summary>
diff --git a/DragoAnt.System.Text.Json.Observer/Strategies/PropMatches.cs b/DragoAnt.System.Text.Json.Observer/Strategies/PropMatches.cs
index 862f6c5..ea5b4fb 100644
--- a/DragoAnt.System.Text.Json.Observer/Strategies/PropMatches.cs
+++ b/DragoAnt.System.Text.Json.Observer/Strategies/PropMatches.cs
@@ -26,10 +26,12 @@ public static class PropMatches
     public static PropMatchingStrategy Contains(string value) => new(NameMatcher.Contains(value));
 
     /// <summary>
-    /// Matches property name by regular expression.
+    /// Matches property name by regular expression. Like the other tests it follows
+    /// <see cref="JsonObserverOptions.PropertyNameCaseInsensitive"/>: by default a name that differs in case only also matches.
+    /// A regular expression built with <see cref="RegexOptions.IgnoreCase"/> ignores case under either option.
     /// </summary>
     /// <param name="regex">Property name regular expression.</param>
-    public static PropMatchingStrategy Regex(Regex regex) => new(new NameMatcher.FuncNameMatcher(v => v is not null && regex.IsMatch(v), $"Regex(/{regex}/)"));
+    public static PropMatchingStrategy Regex(Regex regex) => new(new NameMatcher.RegexNameMatcher(regex));
 
     /// <summary>
     /// Matches property by full name equality.
diff --git a/DragoAnt.System.Text.Json.Observer/Strategies/PropMatchingStrategy.cs b/DragoAnt.System.Text.Json.Observer/Strategies/PropMatchingStrategy.cs
index 2deb61b..c6d7812 100644
--- a/DragoAnt.System.Text.Json.Observer/Strategies/PropMatchingStrategy.cs
+++ b/DragoAnt.System.Text.Json.Observer/Strategies/PropMatchingStrategy.cs
@@ -8,7 +8,8 @@ public readonly struct PropMatchingStrategy
     private readonly NameMatcher? _matcher;
 
     /// <summary>
-    /// Matches property names with a custom test; the name is decoded to a <see cref="string"/> for it.
+    /// Matches property names with a custom test; the name is decoded to a <see cref="string"/> for it. The test decides
+    /// case on its own; the overload that takes a <see cref="StringComparison"/> follows <see cref="JsonObserverOptions.PropertyNameCaseInsensitive"/>.
     /// </summary>
     /// <param name="strategy">Name test; receives <c>null</c> for an array item.</param>
     public PropMatchingStrategy(Func<string?, bool> strategy)
@@ -16,6 +17,19 @@ public PropMatchingStrategy(Func<string?, bool> strategy)
         _matcher = new NameMatcher.FuncNameMatcher(strategy);
     }
 
+    /// <summary>
+    /// Matches property names with a custom test that honours <see cref="JsonObserverOptions.PropertyNameCaseInsensitive"/>;
+    /// the name is decoded to a <see cref="string"/> for it.
+    /// </summary>
+    /// <param name="strategy">
+    /// Name test; receives <c>null</c> for an array item, and <see cref="StringComparison.OrdinalIgnoreCase"/> or
+    /// <see cref="StringComparison.Ordinal"/> as the call's case option.
+    /// </param>
+    public PropMatchingStrategy(Func<string?, StringComparison, bool> strategy)
+    {
+        _matcher = new NameMatcher.FuncNameMatcher(strategy);
+    }
+
     internal PropMatchingStrategy(NameMatcher matcher)
     {
         _matcher = matcher;
diff --git a/DragoAnt.System.Text.Json.Observer/TagMasking.cs b/DragoAnt.System.Text.Json.Observer/TagMasking.cs
index b71f918..e8fd816 100644
--- a/DragoAnt.System.Text.Json.Observer/TagMasking.cs
+++ b/DragoAnt.System.Text.Json.Observer/TagMasking.cs
@@ -11,6 +11,19 @@ internal static class TagMasking
     /// Writes the strategy's replacement for the current value and moves past it; a container is never read.
     /// </summary>
     public static void Mask(ref Utf8JsonReader reader, JsonWriter writer, MaskTag tag, ref PropertyPath propPath)
+    {
+        writer.MaskOutput = true;
+        try
+        {
+            MaskValue(ref reader, writer, tag, ref propPath);
+        }
+        finally
+        {
+            writer.MaskOutput = false;
+        }
+    }
+
+    private static void MaskValue(ref Utf8JsonReader reader, JsonWriter writer, MaskTag tag, ref PropertyPath propPath)
     {
         var options = writer.Options;
         var strategy = options.MaskStrategy ?? Utf8MaskStrategy.Default;
diff --git a/README.md b/README.md
index 5b1b4de..17910be 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ Build an observer once (a `static readonly` field) and share it: it is thread-sa
 
 ### Mask or extract
 
-**Mask** rules (`MaskAny`, `MaskStr`, …) replace a value. **Read** rules (`ReadStr`, `ReadInt`, …) hand a value to a context object and write it unchanged. One observer can do both in the same pass:
+**Mask** rules (`MaskAny`, `MaskStr`, …) replace a value. **Read** rules (`ReadStr`, `ReadInt`, …) hand a value to a context object; they do not decide what is written, so the default policy writes the value unless `.Unmasked()` or a mask method is chained on the read (`Match("ssn").ReadStr(f).MaskAny(MaskTag.Last4)`). One observer can do both in the same pass:
 
 ```csharp
 using DragoAnt.System.Text.Json.Observer;
@@ -94,7 +94,7 @@ Console.WriteLine(JsonObserver.Obj(NullList).Mask(json));
 
 ### Absolute and relative rules
 
-**Absolute** rules follow the path from the root, one `Match` per level or several names in one `Match`. **Relative** rules (inside `Relative(...)`) match the end of a property's path at any depth. Names match case-insensitively; `PropMatches.StartsWith`, `EndsWith`, `Contains`, `OneOf` and `Regex` test a name differently. The first rule that matches wins.
+**Absolute** rules follow the path from the root, one `Match` per level or several names in one `Match`. **Relative** rules (inside `Relative(...)`) match the end of a property's path at any depth. Names match case-insensitively; `PropMatches.StartsWith`, `EndsWith`, `Contains`, `OneOf` and `Regex` test a name differently and follow the same case option. The first rule that writes a value wins; read rules run on every match.
 
 ```csharp
 using DragoAnt.System.Text.Json.Observer;
@@ -131,9 +131,9 @@ Every `Mask*` rule masks the **whole value whatever its JSON type** — a sensit
 | `MaskBool` | `true` / `false`, otherwise `null` | the function receives `null` |
 | `MaskAny(MaskTag)` | — the call's `Utf8MaskStrategy` writes `Full` `"***"`, `Last4` `"***1234"` (shorter than 8 characters: `"***"`), `Hash` `"hash:…"` or `Omit` `null` | stays `null` |
 | `Unmasked()` | — writes a string, number, boolean or `null` unchanged | |
-| `ReadStr` / `ReadInt` / `ReadLong` / `ReadDecimal` / `ReadBool` / `ReadRaw` | hands the value to the context and writes it unchanged; a number that does not fit arrives as `null` | |
+| `ReadStr` / `ReadInt` / `ReadLong` / `ReadDecimal` / `ReadBool` / `ReadRaw` | hands the value to the context; the default policy writes it unless `.Unmasked()` or a mask method follows on the same match; a number that does not fit arrives as `null` | |
 
-The table holds for absolute and relative rules alike. A strategy is a constant string, a `Regex` whose matches become `*`, or a function of the value and the context; a `null` result writes `null`. A value longer than `MaxValueBytes` reaches the function cut to that length. `Hash` uses `JsonObserverOptions.HashKey`, or a random key per process when it is empty.
+The table holds for absolute and relative rules alike. A strategy is a constant string, a `Regex` whose matches become `*`, or a function of the value and the context; a `null` result writes `null`. The function receives the whole value, and what it returns is never cut by `MaxValueBytes`, which limits values written unmasked only. `Hash` uses `JsonObserverOptions.HashKey`, or a random key per process when it is empty.
 
 ### Custom mask strategies
 
@@ -274,13 +274,13 @@ Console.WriteLine($"{result.Status} {Encoding.UTF8.GetString(output.WrittenSpan)
 | Option | Default | Effect |
 | --- | --- | --- |
 | `MaxOutputBytes` | unlimited | output limit; when reached the output is closed and the status is `Truncated` |
-| `MaxValueBytes` | unlimited | longest string written; a longer one is cut, ends with `…`, and the status is `Truncated` |
+| `MaxValueBytes` | unlimited | longest string written unmasked; a longer one is cut, ends with `…`, and the status is `Truncated`; mask output is never cut |
 | `MaxDepth` | 64 | deeper nesting is `Invalid` |
 | `RelaxedEscaping` | `true` | non-ASCII and HTML characters are written unescaped |
 | `HashKey`, `MaskStrategy` | random per process, built-in | used by `MaskTag` rules |
 | `IgnoreNulls` | `false` | drops `null` properties and items, and objects and arrays left empty by that |
 | `Indented` | `false` | indented output |
-| `PropertyNameCaseInsensitive` | `true` | match rule names and shapes ignoring case; pass the serializer's setting to match names as deserialization does |
+| `PropertyNameCaseInsensitive` | `true` | match rule names, `PropMatches` tests (`Regex` included) and shapes ignoring case; pass the serializer's setting to match names as deserialization does |
 
 Input may contain comments and trailing commas; a UTF-8 byte order mark is skipped. Comments are not written.
 
diff --git a/skills/json-observer-masking/SKILL.md b/skills/json-observer-masking/SKILL.md
index 9a3c1b1..7f8b870 100644
--- a/skills/json-observer-masking/SKILL.md
+++ b/skills/json-observer-masking/SKILL.md
@@ -40,7 +40,7 @@ Console.WriteLine(masker.Mask("""{"user":"alice","password":"s3cret","card":{"nu
 1. **Build once, share everywhere.** An observer is immutable and thread-safe; keep it in a `static readonly` field. Building one per call costs far more than masking.
 2. **The default policy is `AllowList`.** A factory without a policy, and `Relative(rules)` without its second argument, write every string, number **and boolean** no rule names as `"***"` (`null` stays). Pass `BlockList` to keep unnamed values.
 3. **Absolute vs relative.** Rules on a builder (`Obj(root => root.Match("order").Obj(…))`) follow the path from the root. Rules inside `Relative(…)` match the **end** of a path at any depth: `Match("card", "number")` hits every `…card.number`. An **array item is one path level**, so reach `{"lines":[{"qty":…}]}` with `Match("lines", anyItem, "qty")` where `anyItem = new PropMatchingStrategy(_ => true)`. The first rule that matches wins.
-4. **Names match exactly and case-insensitively.** Use `PropMatches.EndsWith/StartsWith/Contains/OneOf/Regex` for anything else.
+4. **Names match exactly and case-insensitively.** Use `PropMatches.EndsWith/StartsWith/Contains/OneOf/Regex` for anything else; they follow the same case option.
 5. **Prefer `MaskAny` for secrets.** Every `Mask*` rule masks the whole value whatever its JSON type (a number, a boolean, an object), but `MaskAny` keeps `null` as `null` without calling your function, while `MaskStr` passes `null` to it.
 6. **Tags for standard masks:** `MaskAny(MaskTag.Full)` → `"***"`, `Last4` → `"***1111"` (shorter than 8 characters → `"***"`), `Hash` → `"hash:<16 hex>"`, `Omit` → `null`. Set `JsonObserverOptions.HashKey` for hashes that correlate across processes; the default key is random per process.
 7. **Never throws, always safe.** Both APIs return the masked prefix of cut-off or invalid input, closed into valid JSON, and never write a masked value in clear. `MaskStatus` is `Masked`, `Truncated`, `Invalid` or `NotJson` (empty output: empty input, or a root that is not an object or array).
diff --git a/skills/json-observer-masking/examples.md b/skills/json-observer-masking/examples.md
index e37fc59..e445e32 100644
--- a/skills/json-observer-masking/examples.md
+++ b/skills/json-observer-masking/examples.md
@@ -264,7 +264,7 @@ Console.WriteLine(JsonObserver.FromShape(shape).Mask("""
 
 ## Extract values while masking
 
-`JsonObserver.Obj<TContext>(...)` adds `Read*` rules that hand a value to a context object and write it unchanged. The context-aware policies live in `JsonObserverValuePolicies<TContext>`. `Mask(json, context)` masks and extracts in one pass; `Read(json, context)` only extracts and returns a `MaskResult`.
+`JsonObserver.Obj<TContext>(...)` adds `Read*` rules that hand a value to a context object. A read rule does not decide what is written: the default policy writes the value (here `BlockList`, so unchanged) unless `.Unmasked()` or a mask method is chained on the read, as in `Match("ssn").ReadStr(f).MaskAny(MaskTag.Last4)`. The context-aware policies live in `JsonObserverValuePolicies<TContext>`. `Mask(json, context)` masks and extracts in one pass; `Read(json, context)` only extracts and returns a `MaskResult`.
 
 ```csharp
 using DragoAnt.System.Text.Json.Observer;
@@ -297,4 +297,4 @@ sealed class OrderInfo
 }
 ```
 
-A number that does not fit the read type (a fraction for `ReadInt`, a 30-digit integer) reaches the callback as `null`; the token is still written unchanged.
+A number that does not fit the read type (a fraction for `ReadInt`, a 30-digit integer) reaches the callback as `null`; the default policy still writes the token.
diff --git a/skills/json-observer-masking/migrating-from-1x.md b/skills/json-observer-masking/migrating-from-1x.md
index 4e83c20..250ec42 100644
--- a/skills/json-observer-masking/migrating-from-1x.md
+++ b/skills/json-observer-masking/migrating-from-1x.md
@@ -79,11 +79,11 @@ Console.WriteLine(observer.Mask("""{"cvv":123,"address":{"street":"Main 1"}}""")
 
 ## 5. A string cut by `MaxValueBytes` reports `Truncated`
 
-It used to report success. `FailedAtByte` is -1 in that case (the whole document was read). Masking functions now receive such a value cut to `MaxValueBytes`.
+It used to report success. `FailedAtByte` is -1 in that case (the whole document was read). The cap applies to values written unmasked only: see 12.
 
 ## 6. Number read rules no longer fail the body
 
-`ReadInt`, `ReadLong` and `ReadDecimal` receive `null` for a number that does not fit, and the token is written unchanged.
+`ReadInt`, `ReadLong` and `ReadDecimal` receive `null` for a number that does not fit; the default policy writes the token.
 
 ## 7. `PropertyPath` is a `ref struct`
 
@@ -99,6 +99,35 @@ It cannot be derived from outside; `JsonWriter.FromUtf8JsonWriter`, `JsonWriter.
 
 ## 10. A UTF-8 byte order mark is skipped
 
+## 11. Read rules no longer decide what is written
+
+A `Read*` rule used to write its value unchanged, even under `AllowList`. It now only hands the value to the context; the next rule on the same match or the default policy writes it. Where you relied on clear text, chain `.Unmasked()`; to read and mask one value, chain a mask method on the read:
+
+```csharp
+using DragoAnt.System.Text.Json.Observer;
+using DragoAnt.System.Text.Json.Observer.Strategies;
+
+var observer = JsonObserver.Obj<Person>(root => root
+    .Match("id").ReadInt((id, p) => p.Id = id).Unmasked()
+    .Match("ssn").ReadStr((ssn, p) => p.Ssn = ssn).MaskAny(MaskTag.Last4));
+var person = new Person();
+Console.WriteLine(observer.Mask("""{"id":7,"ssn":"123-45-6789","name":"Kim"}""", person));
+Console.WriteLine($"{person.Id} {person.Ssn}");
+// Output:
+// {"id":7,"ssn":"***6789","name":"***"}
+// 7 123-45-6789
+
+sealed class Person
+{
+    public int? Id { get; set; }
+    public string? Ssn { get; set; }
+}
+```
+
+## 12. Masking functions receive the whole value
+
+A masking function used to receive a value longer than `MaxValueBytes` cut to that length, so a `Last4`-style function printed digits from the middle; a hash was cut too. The function now receives the whole value, and mask output is never cut: `MaxValueBytes` limits values written unmasked only.
+
 ## New in 2.0, worth adopting while you migrate
 
 - The UTF-8 API with a reused `IBufferWriter<byte>` ([recipes.md](./recipes.md#hot-path-utf-8-api)).
diff --git a/skills/json-observer-masking/pitfalls.md b/skills/json-observer-masking/pitfalls.md
index 5ac10ef..587580d 100644
--- a/skills/json-observer-masking/pitfalls.md
+++ b/skills/json-observer-masking/pitfalls.md
@@ -28,7 +28,7 @@ Check, in order:
 1. **The rule is absolute, the field is nested.** `JsonObserver.Obj(root => root.Match("password")…)` only matches a top-level `password`. Use `Relative(...)` to match at any depth.
 2. **The name differs.** Matching is exact (case-insensitive): `password` does not match `newPassword` or `passwd`. Use `PropMatches.Contains("password")` or `PropMatches.OneOf(...)`.
 3. **The path crosses an array.** An array item is a path level: `Match("users", "password")` does not reach `{"users":[{"password":…}]}`. Use a single name in `Relative(...)`, or `Match("users", AnyItem, "password")` with `AnyItem = new PropMatchingStrategy(_ => true)`.
-4. **The value is not a string and the rule only reads.** `Read*` rules write the value unchanged; use a `Mask*` rule.
+4. **The rule only reads.** A `Read*` rule leaves the writing to the default policy, which under `BlockList` writes the value unchanged; chain a mask method on the read (`ReadStr(f).MaskAny(MaskTag.Full)`) or use a `Mask*` rule.
 
 ```csharp
 using DragoAnt.System.Text.Json.Observer;
@@ -104,9 +104,9 @@ Console.WriteLine($"[{any.Mask("[1]", out var r3)}] {r3.Status}");
 
 **Cause:** values shorter than 8 characters are masked fully, so a short value is not narrowed down. Booleans, objects and arrays are always `"***"`.
 
-## A masking function sees a shortened value
+## A masking function is slow on huge values
 
-**Cause:** `MaxValueBytes` also cuts the value handed to a function. The result reports `Truncated`.
+**Cause:** a masking function receives the whole value, decoded to a `string`, whatever `MaxValueBytes` says; the cap limits values written unmasked only. Prefer `MaskAny(MaskTag…)` or a constant for fields that can be huge: they never decode the value to a `string`.
 
 ## Building an observer per call
 
diff --git a/skills/json-observer-masking/recipes.md b/skills/json-observer-masking/recipes.md
index 3fc75a1..16b9692 100644
--- a/skills/json-observer-masking/recipes.md
+++ b/skills/json-observer-masking/recipes.md
@@ -117,7 +117,7 @@ A value that is cut never leaks: a string being written when the input ends is d
 | Option | Default | Effect |
 | --- | --- | --- |
 | `MaxOutputBytes` | unlimited | output cap in UTF-8 bytes; reaching it closes the output → `Truncated` |
-| `MaxValueBytes` | unlimited | longest string written; a longer one is cut and ends with `…` → `Truncated`; masking functions also receive the cut value |
+| `MaxValueBytes` | unlimited | longest string written unmasked; a longer one is cut and ends with `…` → `Truncated`; masking functions receive the whole value and their output is never cut |
 | `MaxDepth` | 64 | deeper nesting → `Invalid` |
 | `RelaxedEscaping` | `true` | non-ASCII and HTML characters written unescaped |
 | `HashKey` | random per process | key of `MaskTag.Hash` |