diff --git a/.cargo/mutants.toml b/.cargo/mutants.toml
index bca66941d..8ef34de7d 100644
--- a/.cargo/mutants.toml
+++ b/.cargo/mutants.toml
@@ -96,6 +96,17 @@ exclude_re = [
   # `true` there refuses the same values with the same error. The guard stays
   # so the model says what it holds without leaning on the writer behind it.
   'stack-encrypt/src/dynamic/value_frame\.rs:\d+:\d+: replace match guard logical\.admits\(&value\) with true in model$',
+  # A serde visitor's `expecting` writes only the "expected ..." half of a
+  # serde error's message, and no caller of these three reads that message:
+  # a context, statistics and a plan's root are each refused with one fixed
+  # `Reason` (`ContextKind`, `NotStats`, `NotAnObject`), and the plan's
+  # field-level reasons are read from the error's path, so writing nothing
+  # refuses the same input with the same error.
+  'stack-encrypt/src/dynamic/(context|query|record)\.rs:\d+:\d+: replace <impl (Visitor<\x27de> for ContextVisitor|serde::Deserialize<\x27de> for Confidence>::deserialize::<impl serde::de::Visitor<\x27_> for V|Deserialize<\x27de> for PlanWire>::deserialize::<impl Visitor<\x27de> for V)>::expecting -> fmt::Result with Ok\(Default::default\(\)\)$',
+  # The same for the visitor that reads a refused plan's keys back
+  # (`entry_key`): its error is discarded (`.ok()`), so its message is never
+  # read at all.
+  'stack-encrypt/src/dynamic/record\.rs:\d+:\d+: replace entry_key::<impl Deserialize<\x27de> for Keys>::deserialize::<impl Visitor<\x27de> for V>::expecting -> fmt::Result with Ok\(Default::default\(\)\)$',
 ]
 
 # Headroom over the measured baseline before a slow-but-correct mutant is
diff --git a/Cargo.lock b/Cargo.lock
index bac0275fe..b8e275d66 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3236,8 +3236,8 @@ dependencies = [
  "tracing-subscriber",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -3259,7 +3259,7 @@ dependencies = [
  "tempfile",
  "tokio",
  "url",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -3298,12 +3298,13 @@ dependencies = [
  "tokio",
  "trybuild",
  "uuid",
- "vitaminc-aead 0.6.0",
- "vitaminc-encrypt 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-aead-frame",
+ "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -3328,9 +3329,9 @@ dependencies = [
  "proptest",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -3362,8 +3363,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -4128,16 +4129,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -4157,18 +4158,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -4185,9 +4186,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4196,11 +4197,13 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c253055230469c4af4791e902c41ce0ce55069c512249b33cf041dd5c58c517"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
 dependencies = [
- "vitaminc-aead 0.6.0",
+ "serde",
+ "vitaminc-aead 0.6.1",
+ "zeroize",
 ]
 
 [[package]]
@@ -4215,12 +4218,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -4239,56 +4242,56 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "393354b2348eabce0420626fdc7cf70ac779870f82abb566fb491ea19eeea066"
+checksum = "bd361f626e95cbe770b9d012e4a86c43cfefe4aefb3d5b3ed9339a83085bdc53"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda6ec7f852ba8cd7e0ba6e8e7eaa3045e6fb866007c6d7ad6128833d8980f0c"
+checksum = "214b2a9d085924c3bc3c91f3ba74238e8848bf54990e5f48f170c71fbacea07a"
 dependencies = [
  "thiserror 2.0.18",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11de28e524ab1deecedbb023bd328916b6c023e2f52156521ac1df75a689d911"
+checksum = "c2715cca25006b4656223bc932ab4fd7f70d387aa4ec63a4e2ef33aa8cd2b3a5"
 dependencies = [
  "mutants",
  "thiserror 2.0.18",
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
  "vitaminc-normalize",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -4310,9 +4313,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -4321,7 +4324,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.18",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -4338,9 +4341,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -4365,16 +4368,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.18",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -4391,9 +4394,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4418,17 +4421,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 22e8a3d21..0629e45a6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -120,16 +120,15 @@ web-time = "1.1"
 zeroize = { version = "1.8.1", features = ["derive"] }
 # This is needed because lock_api 0.4.6 was breaking things and the branch forces the use of 0.4.12
 temp-env = { git = "https://github.com/cipherstash/temp-env", branch = "main" }
-vitaminc = { version = "0.6.0", features = ["random", "protected", "encrypt"] }
-vitaminc-aead = "0.6.0"
+vitaminc = { version = "0.6.1", features = ["random", "protected", "encrypt"] }
+vitaminc-aead = "0.6.1"
 # The transport frame and ciphertext codec every language binding carries
 # across its FFI boundary. Optional in stack-encrypt (the `dynamic` feature).
-vitaminc-aead-frame = "0.6.0"
-vitaminc-encrypt = "0.6.0"
-vitaminc-hmac = "0.6.0"
-# Not on crates.io yet: the `[patch.crates-io]` block below supplies it.
+vitaminc-aead-frame = "0.6.1"
+vitaminc-encrypt = "0.6.1"
+vitaminc-hmac = "0.6.1"
 # Normalized equality terms (Unicode 16 NFC text, one integer encoding for
 # every width), which `vitaminc-prf`'s `normalize` feature derives over.
-vitaminc-normalize = "0.6.0"
-vitaminc-prf = { version = "0.6.0", features = ["normalize"] }
-vitaminc-protected = "0.6.0"
+vitaminc-normalize = "0.6.1"
+vitaminc-prf = { version = "0.6.1", features = ["normalize"] }
+vitaminc-protected = "0.6.1"
diff --git a/languages/golang/auth/guest/Cargo.lock b/languages/golang/auth/guest/Cargo.lock
index 58ae17c2a..9073d2b3f 100644
--- a/languages/golang/auth/guest/Cargo.lock
+++ b/languages/golang/auth/guest/Cargo.lock
@@ -1847,8 +1847,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -1867,7 +1867,7 @@ dependencies = [
  "stack-profile",
  "tempfile",
  "url",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -1878,9 +1878,9 @@ dependencies = [
  "miette",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -2299,16 +2299,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -2328,18 +2328,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -2356,9 +2356,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2367,11 +2367,11 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c253055230469c4af4791e902c41ce0ce55069c512249b33cf041dd5c58c517"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
 dependencies = [
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
 ]
 
 [[package]]
@@ -2386,12 +2386,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2410,15 +2410,15 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -2441,9 +2441,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2452,7 +2452,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -2469,9 +2469,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2496,16 +2496,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
  "rand 0.10.3",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -2522,9 +2522,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2549,17 +2549,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/languages/golang/encrypt/guest/Cargo.lock b/languages/golang/encrypt/guest/Cargo.lock
index 189086c89..c9d6985fa 100644
--- a/languages/golang/encrypt/guest/Cargo.lock
+++ b/languages/golang/encrypt/guest/Cargo.lock
@@ -2062,8 +2062,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -2082,12 +2082,13 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc-aead 0.6.0",
- "vitaminc-encrypt 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-aead-frame",
+ "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -2117,7 +2118,7 @@ dependencies = [
  "stack-kms",
  "uuid",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2129,9 +2130,9 @@ dependencies = [
  "miette",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -2157,8 +2158,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2627,16 +2628,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -2656,18 +2657,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -2684,9 +2685,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2695,11 +2696,13 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c253055230469c4af4791e902c41ce0ce55069c512249b33cf041dd5c58c517"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
 dependencies = [
- "vitaminc-aead 0.6.0",
+ "serde",
+ "vitaminc-aead 0.6.1",
+ "zeroize",
 ]
 
 [[package]]
@@ -2714,12 +2717,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2738,56 +2741,56 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "393354b2348eabce0420626fdc7cf70ac779870f82abb566fb491ea19eeea066"
+checksum = "bd361f626e95cbe770b9d012e4a86c43cfefe4aefb3d5b3ed9339a83085bdc53"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda6ec7f852ba8cd7e0ba6e8e7eaa3045e6fb866007c6d7ad6128833d8980f0c"
+checksum = "214b2a9d085924c3bc3c91f3ba74238e8848bf54990e5f48f170c71fbacea07a"
 dependencies = [
  "thiserror 2.0.20",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11de28e524ab1deecedbb023bd328916b6c023e2f52156521ac1df75a689d911"
+checksum = "c2715cca25006b4656223bc932ab4fd7f70d387aa4ec63a4e2ef33aa8cd2b3a5"
 dependencies = [
  "mutants",
  "thiserror 2.0.20",
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
  "vitaminc-normalize",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2809,9 +2812,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2820,7 +2823,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -2837,9 +2840,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2864,16 +2867,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
  "rand 0.10.2",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -2890,9 +2893,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2917,17 +2920,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/languages/golang/encrypt/guest/Cargo.toml b/languages/golang/encrypt/guest/Cargo.toml
index 08acd7086..64626710b 100644
--- a/languages/golang/encrypt/guest/Cargo.toml
+++ b/languages/golang/encrypt/guest/Cargo.toml
@@ -47,7 +47,7 @@ eql = ["dep:eql-bindings"]
 # HTTP comes from the host (see `wasm:wasi-check` in the suite root).
 stack-auth = { path = "../../../../packages/stack-auth", default-features = false }
 # `dynamic`: the runtime value model this guest speaks — contexts, index
-# terms and record plans over `FfiValue`, shared with every other binding.
+# terms and record plans read from frames, shared with every other binding.
 stack-encrypt = { path = "../../../../packages/stack-encrypt", default-features = false, features = ["dynamic"] }
 # The guest ABI every guest under bindings/go shares: the allocator and
 # buffer registry (and with them the `se_alloc`/`se_dealloc` exports), the
@@ -66,8 +66,8 @@ zerokms-protocol = "=0.12.31"
 # against (see the comment in packages/stack-encrypt/Cargo.toml). A
 # different version here fails at the `FfiValue: Decrypt` bound, since the
 # aead crate would be duplicated.
-vitaminc-aead-frame = "0.6.0"
-vitaminc-protected = "0.6.0"
+vitaminc-aead-frame = { version = "0.6.1", features = ["serde"] }
+vitaminc-protected = "0.6.1"
 
 futures = { version = "0.3", default-features = false, features = ["executor"] }
 serde = "1"
diff --git a/languages/golang/encrypt/guest/src/abi.rs b/languages/golang/encrypt/guest/src/abi.rs
index 76be06f9b..1cd4ce19a 100644
--- a/languages/golang/encrypt/guest/src/abi.rs
+++ b/languages/golang/encrypt/guest/src/abi.rs
@@ -75,7 +75,6 @@ use std::cell::{Cell, RefCell};
 use std::panic::{catch_unwind, AssertUnwindSafe};
 
 use futures::executor::block_on;
-use stack_encrypt::dynamic::FfiValue;
 use stack_encrypt::{KeysetCipher, StackCipher};
 use stack_guest_abi::abi::{export, input, take_plaintext, wipe_input};
 use stack_guest_abi::buffers;
@@ -111,12 +110,6 @@ thread_local! {
     static SHUT_DOWN: Cell<bool> = const { Cell::new(false) };
 }
 
-/// Decode one codec-encoded input.
-fn decode(bytes: &[u8]) -> Result<FfiValue, u32> {
-    FfiValue::from_frame(bytes)
-        .map_err(|_| malformed("an input is not a value in the transport frame"))
-}
-
 /// Run `f` with the instance's cipher, or report `STATUS_STATE` when there
 /// is none (never initialised, or shut down).
 fn with_cipher<R>(f: impl FnOnce(&GuestCipher) -> Result<R, u32>) -> Result<R, u32> {
@@ -139,7 +132,7 @@ fn with_keyset<R>(
     opts: &[u8],
     f: impl FnOnce(&KeysetCipher<'_, GuestKms>) -> Result<R, u32>,
 ) -> Result<R, u32> {
-    let options = parse_options(decode(opts)?, Side::Mint)?;
+    let options = parse_options(opts, Side::Mint)?;
     with_cipher(|cipher| {
         let keyset = block_on(options.keyset.resolve(cipher))?;
         f(&keyset)
@@ -152,14 +145,14 @@ fn with_scope<R>(
     opts: &[u8],
     f: impl FnOnce(Scope<'_, GuestKms>) -> Result<R, u32>,
 ) -> Result<R, u32> {
-    let options = parse_options(decode(opts)?, Side::Open)?;
+    let options = parse_options(opts, Side::Open)?;
     with_cipher(|cipher| {
         let scope = block_on(scope_for(cipher, &options.keyset))?;
         f(scope)
     })
 }
 
-/// Initialise the instance's cipher from an FFI-codec-encoded config object
+/// Initialise the instance's cipher from a config frame
 /// (see [`crate::config`]). Performs one `load-keyset` round trip through
 /// the host transport for the default keyset, and returns that keyset's id
 /// (16 raw UUID bytes) as the output buffer. The raw config buffer — which
@@ -182,27 +175,36 @@ pub unsafe extern "C" fn se_cipher_init(cfg_ptr: *mut u8, cfg_len: u32) -> u64 {
     export(|| {
         // The pointer/length pair is validated first and on its own: a pair
         // that fails here returns before anything touches the range, which
-        // is `wipe_input`'s precondition. Only a validated buffer is decoded
-        // and, whatever the decode outcome, wiped.
+        // is `wipe_input`'s precondition. Only a validated buffer is parsed
+        // and, whatever the outcome, wiped.
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns and before any wipe of an overlapping range.
         let bytes = unsafe { input(cfg_ptr, cfg_len)? };
-        let decoded = decode(bytes);
-        // The borrow of the raw buffer ends with `decoded` owned; wipe the
-        // buffer now — it holds the client-key hex — before parsing (and
-        // before the init round trip), whatever the decode outcome.
+        // The parser borrows the buffer's strings and owns only what it
+        // builds from them, so the borrow ends here; wipe the buffer now —
+        // it holds the client key — before the init round trip, whatever
+        // the parse outcome.
+        let config = parse_init(bytes);
         unsafe { wipe_input(cfg_ptr, cfg_len) };
-        cipher_init(decoded?)
+        cipher_init(config?)
     })
 }
 
 #[cfg(not(feature = "deterministic-kms"))]
-fn cipher_init(decoded: FfiValue) -> Result<Vec<u8>, u32> {
+use crate::config::{parse_config as parse_init, CipherConfig as InitConfig};
+#[cfg(feature = "deterministic-kms")]
+use crate::deterministic::Seed as InitConfig;
+#[cfg(feature = "deterministic-kms")]
+fn parse_init(bytes: &[u8]) -> Result<InitConfig, u32> {
+    InitConfig::parse(bytes)
+}
+
+#[cfg(not(feature = "deterministic-kms"))]
+fn cipher_init(config: InitConfig) -> Result<Vec<u8>, u32> {
     use crate::host::{HostTokenStrategy, WasiHostConnection};
     use crate::status::STATUS_KMS_TRANSPORT;
     use stack_kms::{ClientOpts, StackKms};
 
-    let config = crate::config::parse_config(decoded).map_err(|e| malformed(e.describe()))?;
     if SHUT_DOWN.with(Cell::get) || CIPHER.with(|c| c.borrow().is_some()) {
         return Err(init_out_of_order());
     }
@@ -246,22 +248,11 @@ fn cipher_init(decoded: FfiValue) -> Result<Vec<u8>, u32> {
 /// endpoint, no token, no network. A test artefact, never shipped; see
 /// [`crate::deterministic`].
 #[cfg(feature = "deterministic-kms")]
-fn cipher_init(decoded: FfiValue) -> Result<Vec<u8>, u32> {
-    use vitaminc_protected::Controlled;
-
-    let not_a_seed = || malformed("the deterministic build's config is a 32-byte seed");
-    let FfiValue::Bytes(seed) = decoded else {
-        return Err(not_a_seed());
-    };
-    let seed: [u8; 32] = seed
-        .risky_ref()
-        .as_slice()
-        .try_into()
-        .map_err(|_| not_a_seed())?;
+fn cipher_init(seed: InitConfig) -> Result<Vec<u8>, u32> {
     if SHUT_DOWN.with(Cell::get) || CIPHER.with(|c| c.borrow().is_some()) {
         return Err(init_out_of_order());
     }
-    let builder = StackCipher::builder().kms(crate::deterministic::DeterministicSource::new(seed));
+    let builder = StackCipher::builder().kms(seed.source());
     install(block_on(builder.init()).map_err(|e| crate::status::fail_error(&e))?)
 }
 
@@ -319,7 +310,7 @@ pub unsafe extern "C" fn se_keyset(sel_ptr: *const u8, sel_len: u32) -> u64 {
     export(|| {
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns and before any wipe of an overlapping range.
-        let selector = parse_selector(decode(unsafe { input(sel_ptr, sel_len)? })?)?;
+        let selector = parse_selector(unsafe { input(sel_ptr, sel_len)? })?;
         if selector == KeysetSelector::Any {
             return Err(malformed(r#"{"any"} is not a keyset"#));
         }
@@ -440,7 +431,7 @@ pub unsafe extern "C" fn se_decrypt_record(
         let record = unsafe { input(rec_ptr, rec_len)? };
         let plan = unsafe { input(plan_ptr, plan_len)? };
         let opts = unsafe { input(opt_ptr, opt_len)? };
-        let expected = parse_options(decode(opts)?, Side::Open)?.context;
+        let expected = parse_options(opts, Side::Open)?.context;
         ops::validate::record_tree(record, plan, expected.as_ref())?;
         with_scope(opts, |scope| {
             block_on(ops::decrypt_record(scope, record, plan, expected))
diff --git a/languages/golang/encrypt/guest/src/config.rs b/languages/golang/encrypt/guest/src/config.rs
index e31f1e7d7..a08f576ce 100644
--- a/languages/golang/encrypt/guest/src/config.rs
+++ b/languages/golang/encrypt/guest/src/config.rs
@@ -1,8 +1,8 @@
 //! Parsing of the `se_cipher_init` configuration.
 //!
-//! The config crosses the boundary as one FFI-codec-encoded
-//! [`FfiValue::Object`] — the same codec every other entry point uses, so
-//! there is no second config format. Recognised keys (all string values):
+//! The config crosses the boundary as one frame object, read by serde
+//! (`vitaminc_aead_frame::serde`), the same format as every other control
+//! message. Recognised keys (all string values):
 //!
 //! | key           | required | meaning |
 //! |---------------|----------|---------|
@@ -17,60 +17,26 @@
 //! Every other keyset is selected per call (see [`crate::options`]). Unknown
 //! keys are rejected — a typo'd optional key must not silently fall back to a
 //! default — so a host still sending `keyset` is told so rather than quietly
-//! encrypting somewhere else.
+//! encrypting somewhere else. A key given twice is refused by the frame.
 //!
-//! The parsed [`FfiValue`] holds the client-key hex inside
-//! `Protected`, which wipes on drop; the raw config *buffer* is wiped by the
-//! ABI layer immediately after decoding (see [`crate::abi`]).
+//! Every string is borrowed from the config buffer, so the only copy of the
+//! client key this parser makes is the [`ClientKey`] it builds. The ABI
+//! layer wipes the buffer as soon as [`parse_config`] returns (see
+//! [`crate::abi`]).
+//!
+//! A refusal is [`STATUS_ENCODING`](crate::status::STATUS_ENCODING), with a
+//! message that names the key at fault and never a value, because the
+//! config holds the client key. An unrecognised key is not named either:
+//! if a value is pasted where a key should be, the unrecognised key *is*
+//! that value.
 
 use std::num::NonZeroUsize;
 
-use stack_encrypt::dynamic::FfiValue;
+use serde::{Deserialize, Deserializer};
+use stack_guest_abi::last_error::malformed;
 use stack_kms::{ClientKey, ZeroKmsEndpoint};
 use uuid::Uuid;
-use zeroize::Zeroizing;
-
-/// A parse failure, carrying which key was at fault. Maps to
-/// `STATUS_ENCODING` at the ABI, and [`describe`](Self::describe) is the
-/// message the host reads through `se_last_error`: the name of the key at
-/// fault crosses the boundary, its value never does.
-#[derive(Debug, PartialEq, Eq)]
-pub enum ConfigError {
-    /// The config was not an object of string values.
-    NotAnObject,
-    /// A required key was absent.
-    Missing(&'static str),
-    /// A key held something other than a string.
-    NotAString(&'static str),
-    /// A key's value failed its own validation (bad UUID, bad hex, bad URL).
-    Invalid(&'static str),
-    /// A key appeared twice. The codec rejects duplicate object keys before
-    /// this parser runs, but `parse_config` is `pub` and takes any
-    /// [`FfiValue`] — last-write-wins on, say, `client_key` must never be
-    /// silent.
-    Duplicate(&'static str),
-    /// A key this version does not recognise.
-    UnknownKey(String),
-}
-
-impl ConfigError {
-    /// Says what was wrong with the config, for the host to read.
-    ///
-    /// The message names the key at fault but never its value, because the
-    /// config holds the client key. An unrecognised key is not named
-    /// either: if a value is pasted where a key should be, the unrecognised
-    /// key *is* that value.
-    pub fn describe(&self) -> String {
-        match self {
-            Self::NotAnObject => "the config is not an object of string values".to_owned(),
-            Self::Missing(key) => format!("the config has no {key}"),
-            Self::NotAString(key) => format!("the config's {key} is not a string"),
-            Self::Invalid(key) => format!("the config's {key} is not valid"),
-            Self::Duplicate(key) => format!("the config gives {key} twice"),
-            Self::UnknownKey(_) => "the config has a key this version does not know".to_owned(),
-        }
-    }
-}
+use vitaminc_aead_frame::serde::from_slice;
 
 /// Everything `se_cipher_init` needs to build the cipher.
 pub struct CipherConfig {
@@ -79,93 +45,93 @@ pub struct CipherConfig {
     pub keyset_cache_size: Option<NonZeroUsize>,
 }
 
-/// Parse a decoded config value. Consumes it so the client-key material has
-/// one owner; the `Protected` payloads are wiped when the strings drop here.
-pub fn parse_config(value: FfiValue) -> Result<CipherConfig, ConfigError> {
-    let FfiValue::Object(entries) = value else {
-        return Err(ConfigError::NotAnObject);
-    };
+/// Parse the config frame a host sent. See the [module docs](self).
+pub fn parse_config(bytes: &[u8]) -> Result<CipherConfig, u32> {
+    read(bytes).map_err(malformed)
+}
 
-    // Every slot is a `Zeroizing<String>`, not just the key one: the
-    // client-key slot *must* wipe on every exit path (any of the `?`s below
-    // can fire while it holds a full encoding of the client root key), and
-    // making one slot special invites the next edit to add an early return
-    // above the wipe. Uniform is cheaper than remembering.
-    let mut client_id: Option<Zeroizing<String>> = None;
-    let mut client_key_encoded: Option<Zeroizing<String>> = None;
-    let mut url: Option<Zeroizing<String>> = None;
-    let mut cache_size: Option<Zeroizing<String>> = None;
+/// [`parse_config`], with the refusal's message.
+fn read(bytes: &[u8]) -> Result<CipherConfig, String> {
+    let wire: Wire<'_> = from_slice(bytes).map_err(|e| format!("the config: {e}"))?;
+    // `from_encoded_v1` is lenient by design: hex in either case *or* the
+    // base64 `secretkey.json` holds, matching every native loader.
+    let client_key = ClientKey::from_encoded_v1(wire.client_id.0, wire.client_key)
+        .map_err(|_| "the config: client_key: a client key that is not valid".to_owned())?;
+    Ok(CipherConfig {
+        client_key,
+        endpoint: wire.zerokms_url.map(|url| url.0),
+        keyset_cache_size: wire.keyset_cache_size.map(|size| size.0),
+    })
+}
 
-    for (key, value) in entries {
-        let slot = match key.as_str() {
-            "client_id" => &mut client_id,
-            "client_key" => &mut client_key_encoded,
-            "zerokms_url" => &mut url,
-            "keyset_cache_size" => &mut cache_size,
-            _ => return Err(ConfigError::UnknownKey(key)),
-        };
-        // The codec already rejects duplicate object keys, so on the ABI
-        // path the slot is always vacant — but this function accepts any
-        // `FfiValue`, so enforce it rather than assume it.
-        if slot.is_some() {
-            return Err(ConfigError::Duplicate(name_of(&key)));
-        }
-        let FfiValue::String(s) = value else {
-            return Err(ConfigError::NotAString(name_of(&key)));
-        };
-        let text = Zeroizing::new(
-            std::str::from_utf8(s.risky_ref())
-                .map_err(|_| ConfigError::NotAString(name_of(&key)))?
-                .to_string(),
-        );
-        *slot = Some(text);
-    }
+/// The config as a host writes it. Each field validates as it reads,
+/// through `TryFrom`. The frame's serde never repeats a `TryFrom` error's
+/// text (it could carry the value), so a refusal names the key and says
+/// only that its value was not accepted; each error here is still a fixed
+/// string, for the reader.
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Wire<'a> {
+    client_id: ClientId,
+    client_key: &'a str,
+    #[serde(default, deserialize_with = "present")]
+    zerokms_url: Option<Url>,
+    #[serde(default, deserialize_with = "present")]
+    keyset_cache_size: Option<CacheSize>,
+}
 
-    let client_id = client_id.ok_or(ConfigError::Missing("client_id"))?;
-    let client_id = Uuid::parse_str(&client_id).map_err(|_| ConfigError::Invalid("client_id"))?;
+/// Absent is `None`. Present, a value must be a string: a null is refused.
+fn present<'de, D: Deserializer<'de>, T: Deserialize<'de>>(d: D) -> Result<Option<T>, D::Error> {
+    T::deserialize(d).map(Some)
+}
 
-    // Lenient by design: `from_encoded_v1` takes hex in either case *or* the
-    // base64 `secretkey.json` holds, matching every native loader. The
-    // `Zeroizing` slot wipes the encoded copy however this returns — the
-    // decoded `FfiValue`'s own copy was consumed above, and the raw input
-    // buffer is the ABI layer's to wipe.
-    let client_key_encoded = client_key_encoded.ok_or(ConfigError::Missing("client_key"))?;
-    let client_key = ClientKey::from_encoded_v1(client_id, &client_key_encoded)
-        .map_err(|_| ConfigError::Invalid("client_key"))?;
+/// A client id: a UUID, as text.
+#[derive(Deserialize)]
+#[serde(try_from = "&str")]
+struct ClientId(Uuid);
 
-    let endpoint = url
-        .map(|u| u.parse().map_err(|_| ConfigError::Invalid("zerokms_url")))
-        .transpose()?;
+impl TryFrom<&str> for ClientId {
+    type Error = &'static str;
 
-    let keyset_cache_size = cache_size
-        .map(|n| {
-            n.parse::<NonZeroUsize>()
-                .map_err(|_| ConfigError::Invalid("keyset_cache_size"))
-        })
-        .transpose()?;
+    fn try_from(text: &str) -> Result<Self, Self::Error> {
+        Uuid::parse_str(text)
+            .map(ClientId)
+            .map_err(|_| "a client id that is not a UUID")
+    }
+}
 
-    Ok(CipherConfig {
-        client_key,
-        endpoint,
-        keyset_cache_size,
-    })
+/// The ZeroKMS endpoint to pin.
+#[derive(Deserialize)]
+#[serde(try_from = "&str")]
+struct Url(ZeroKmsEndpoint);
+
+impl TryFrom<&str> for Url {
+    type Error = &'static str;
+
+    fn try_from(text: &str) -> Result<Self, Self::Error> {
+        text.parse().map(Url).map_err(|_| "a URL that is not valid")
+    }
 }
 
-/// Intern the key name for error reporting (`&'static str` keeps
-/// [`ConfigError`] cheap; unknown keys carry the owned string instead).
-fn name_of(key: &str) -> &'static str {
-    match key {
-        "client_id" => "client_id",
-        "client_key" => "client_key",
-        "zerokms_url" => "zerokms_url",
-        "keyset_cache_size" => "keyset_cache_size",
-        _ => "unknown",
+/// A positive integer, as a decimal string.
+#[derive(Deserialize)]
+#[serde(try_from = "&str")]
+struct CacheSize(NonZeroUsize);
+
+impl TryFrom<&str> for CacheSize {
+    type Error = &'static str;
+
+    fn try_from(text: &str) -> Result<Self, Self::Error> {
+        text.parse()
+            .map(CacheSize)
+            .map_err(|_| "a size that is not a positive decimal integer")
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::test_frame::{frame, obj, s, V};
 
     /// A valid v1 client key for fixtures, minted through the real key type
     /// so the hex exercises the actual `from_hex_v1` decoder.
@@ -178,22 +144,27 @@ mod tests {
         (id, key.to_hex_v1().expect("encode fixture key"))
     }
 
-    fn obj(entries: Vec<(&str, &str)>) -> FfiValue {
-        FfiValue::Object(
-            entries
-                .into_iter()
-                .map(|(k, v)| (k.to_string(), FfiValue::String(v.into())))
-                .collect(),
-        )
+    fn config(entries: Vec<(&'static str, V)>) -> Result<CipherConfig, String> {
+        read(&frame(&obj(entries)))
+    }
+
+    /// The config's refusal, checked to name neither the client key nor any
+    /// value or unknown key the test sent.
+    fn refused(v: &V, secrets: &[&str]) -> String {
+        let message = read(&frame(v)).err().expect("refused");
+        for secret in secrets {
+            assert!(!message.contains(secret), "{message:?} echoes {secret:?}");
+        }
+        message
     }
 
     #[test]
     fn parses_a_minimal_config() {
         let (id, hex) = client_key_hex();
-        let cfg = parse_config(obj(vec![
-            ("client_id", &id.to_string()),
-            ("client_key", &hex),
-        ]))
+        let cfg = config(vec![
+            ("client_id", s(&id.to_string())),
+            ("client_key", s(&hex)),
+        ])
         .expect("minimal config parses");
         assert_eq!(cfg.client_key.key_id, id);
         assert!(cfg.endpoint.is_none());
@@ -203,28 +174,27 @@ mod tests {
     #[test]
     fn parses_the_keyset_cache_size() {
         let (id, hex) = client_key_hex();
-        let id_s = id.to_string();
-        let cfg = parse_config(obj(vec![
-            ("client_id", &id_s),
-            ("client_key", &hex),
-            ("keyset_cache_size", "16"),
-        ]))
-        .expect("config parses");
+        let with = |size: V| {
+            obj(vec![
+                ("client_id", s(&id.to_string())),
+                ("client_key", s(&hex)),
+                ("keyset_cache_size", size),
+            ])
+        };
+        let cfg = read(&frame(&with(s("16")))).expect("config parses");
         assert_eq!(cfg.keyset_cache_size, NonZeroUsize::new(16));
 
         for bad in ["0", "-1", "sixteen", ""] {
-            assert!(
-                matches!(
-                    parse_config(obj(vec![
-                        ("client_id", &id_s),
-                        ("client_key", &hex),
-                        ("keyset_cache_size", bad),
-                    ])),
-                    Err(ConfigError::Invalid("keyset_cache_size"))
-                ),
+            assert_eq!(
+                refused(&with(s(bad)), &[&hex]),
+                "the config: keyset_cache_size: a value its type does not accept",
                 "{bad:?} must be refused"
             );
         }
+        // A decimal string, not an integer, and not null.
+        for bad in [V::U32(16), V::Null] {
+            assert!(refused(&with(bad), &[&hex]).starts_with("the config: keyset_cache_size: "));
+        }
     }
 
     /// A keyset is not a config key: the default is the server's and a
@@ -235,25 +205,27 @@ mod tests {
     fn a_keyset_key_is_rejected_like_any_other_unknown_key() {
         let (id, hex) = client_key_hex();
         for key in ["keyset", "keyset_id"] {
-            assert!(matches!(
-                parse_config(obj(vec![
-                    ("client_id", &id.to_string()),
-                    ("client_key", &hex),
-                    (key, "users"),
-                ])),
-                Err(ConfigError::UnknownKey(_))
-            ));
+            let message = refused(
+                &obj(vec![
+                    ("client_id", s(&id.to_string())),
+                    ("client_key", s(&hex)),
+                    (key, s("users")),
+                ]),
+                // "keyset" alone is inside the expected `keyset_cache_size`.
+                &[&hex, "users", "keyset_id"],
+            );
+            assert!(message.contains("an unknown key"), "{message}");
         }
     }
 
     #[test]
     fn parses_the_zerokms_url() {
         let (id, hex) = client_key_hex();
-        let cfg = parse_config(obj(vec![
-            ("client_id", &id.to_string()),
-            ("client_key", &hex),
-            ("zerokms_url", "https://zerokms.example.com"),
-        ]))
+        let cfg = config(vec![
+            ("client_id", s(&id.to_string())),
+            ("client_key", s(&hex)),
+            ("zerokms_url", s("https://zerokms.example.com")),
+        ])
         .expect("config parses");
         assert!(cfg.endpoint.is_some());
     }
@@ -266,7 +238,6 @@ mod tests {
         use base64ct::Encoding;
 
         let (id, hex) = client_key_hex();
-        let id_s = id.to_string();
         let bytes = base16ct::lower::decode_vec(&hex).expect("fixture hex");
         let base64 = base64ct::Base64::encode_string(&bytes);
 
@@ -275,8 +246,11 @@ mod tests {
             ("uppercase hex", hex.to_uppercase()),
             ("base64", base64),
         ] {
-            let cfg = parse_config(obj(vec![("client_id", &id_s), ("client_key", &encoded)]))
-                .unwrap_or_else(|e| panic!("{label} must parse, got {e:?}"));
+            let cfg = config(vec![
+                ("client_id", s(&id.to_string())),
+                ("client_key", s(&encoded)),
+            ])
+            .unwrap_or_else(|e| panic!("{label} must parse, got {e}"));
             assert_eq!(cfg.client_key.key_id, id, "{label}");
             assert_eq!(
                 cfg.client_key.to_hex_v1().expect("re-encode"),
@@ -286,57 +260,96 @@ mod tests {
         }
     }
 
+    /// Every refusal names the key at fault and never a value: not the
+    /// client key, not a bad id or URL, not an unknown key.
     #[test]
-    fn rejects_bad_configs() {
+    fn rejects_bad_configs_without_echoing_a_value() {
         let (id, hex) = client_key_hex();
         let id_s = id.to_string();
+        let secrets = [
+            hex.as_str(),
+            "nope",
+            "zerokms_urk",
+            "typo.example",
+            "deadbeef",
+        ];
+        let cases = [
+            (V::Null, "the config: expected "),
+            (
+                V::Arr(vec![s(&id_s), s(&hex)]),
+                "the config: expected struct Wire, found an array",
+            ),
+            (
+                obj(vec![
+                    ("client_id", s(&id_s)),
+                    ("client_key", V::Bytes(hex.clone().into_bytes())),
+                ]),
+                "the config: client_key: expected a borrowed string, found bytes",
+            ),
+            (
+                obj(vec![("client_id", s(&id_s))]),
+                "the config: missing field `client_key`",
+            ),
+            (
+                obj(vec![("client_id", s("nope")), ("client_key", s(&hex))]),
+                "the config: client_id: a value its type does not accept",
+            ),
+            (
+                obj(vec![("client_id", s(&id_s)), ("client_key", V::U64(1))]),
+                "the config: client_key: ",
+            ),
+            (
+                // Valid hex, not a keyset.
+                obj(vec![("client_id", s(&id_s)), ("client_key", s("deadbeef"))]),
+                "the config: client_key: a client key that is not valid",
+            ),
+            (
+                obj(vec![
+                    ("client_id", s(&id_s)),
+                    ("client_key", s(&hex)),
+                    ("zerokms_urk", s("https://typo.example.com")),
+                ]),
+                "the config: an unknown key, ",
+            ),
+            (
+                obj(vec![
+                    ("client_id", s(&id_s)),
+                    ("client_key", s(&hex)),
+                    ("zerokms_url", s("not a url")),
+                ]),
+                "the config: zerokms_url: a value its type does not accept",
+            ),
+            (
+                obj(vec![
+                    ("client_id", s(&id_s)),
+                    ("client_key", s(&hex)),
+                    ("zerokms_url", V::Null),
+                ]),
+                "the config: zerokms_url: ",
+            ),
+        ];
+        for (config, expected) in &cases {
+            let message = refused(config, &secrets);
+            assert!(
+                message.starts_with(expected),
+                "{message:?} is not {expected:?}"
+            );
+        }
+    }
 
-        assert!(matches!(
-            parse_config(FfiValue::Null),
-            Err(ConfigError::NotAnObject)
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![("client_id", &id_s)])),
-            Err(ConfigError::Missing("client_key"))
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![("client_id", "nope"), ("client_key", &hex)])),
-            Err(ConfigError::Invalid("client_id"))
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![
-                ("client_id", &id_s),
-                ("client_key", "deadbeef"), // valid hex, not a keyset
-            ])),
-            Err(ConfigError::Invalid("client_key"))
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![
-                ("client_id", &id_s),
-                ("client_key", &hex),
-                ("zerokms_urk", "https://typo.example.com"),
-            ])),
-            Err(ConfigError::UnknownKey(_))
-        ));
-        // The codec refuses duplicate keys on the ABI path, but this
-        // function is `pub` over any `FfiValue`: a repeated `client_key`
-        // must be an error, never a silent last-write-wins on root key
-        // material.
-        assert!(matches!(
-            parse_config(obj(vec![
-                ("client_id", &id_s),
-                ("client_key", &hex),
-                ("client_key", &hex),
-            ])),
-            Err(ConfigError::Duplicate("client_key"))
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![
-                ("client_id", &id_s),
-                ("client_key", &hex),
-                ("zerokms_url", "not a url"),
-            ])),
-            Err(ConfigError::Invalid("zerokms_url"))
-        ));
+    /// A repeated `client_key` is never a silent last-write-wins on root key
+    /// material: the frame refuses it.
+    #[test]
+    fn a_repeated_key_is_refused() {
+        let (id, hex) = client_key_hex();
+        let message = refused(
+            &obj(vec![
+                ("client_id", s(&id.to_string())),
+                ("client_key", s(&hex)),
+                ("client_key", s(&hex)),
+            ]),
+            &[&hex],
+        );
+        assert!(message.starts_with("the config: "), "{message}");
     }
 }
diff --git a/languages/golang/encrypt/guest/src/deterministic.rs b/languages/golang/encrypt/guest/src/deterministic.rs
index e58a26e74..88a789d51 100644
--- a/languages/golang/encrypt/guest/src/deterministic.rs
+++ b/languages/golang/encrypt/guest/src/deterministic.rs
@@ -11,3 +11,59 @@
 //! binary carries it; the tests read it from disk.
 
 pub use stack_kms::DeterministicSource;
+
+use serde::Deserialize;
+use stack_guest_abi::last_error::malformed;
+use vitaminc_aead_frame::serde::from_slice;
+use zeroize::Zeroize;
+
+/// The `deterministic-kms` build's whole config: the source's 32-byte seed,
+/// a frame holding bytes and nothing else. Wiped when it drops.
+#[derive(Deserialize)]
+#[serde(try_from = "&[u8]")]
+pub struct Seed([u8; 32]);
+
+impl TryFrom<&[u8]> for Seed {
+    type Error = &'static str;
+
+    fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
+        bytes
+            .try_into()
+            .map(Seed)
+            .map_err(|_| "a seed that is not 32 bytes")
+    }
+}
+
+impl Drop for Seed {
+    fn drop(&mut self) {
+        self.0.zeroize();
+    }
+}
+
+impl Seed {
+    /// Read the seed frame the host sent in place of a config.
+    pub fn parse(bytes: &[u8]) -> Result<Self, u32> {
+        from_slice(bytes)
+            .map_err(|_| malformed("the deterministic build's config is a 32-byte seed"))
+    }
+
+    /// The key source this seed drives.
+    pub fn source(&self) -> DeterministicSource {
+        DeterministicSource::new(self.0)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::Seed;
+    use crate::test_frame::{frame, V};
+    use vitaminc_aead_frame::serde::from_slice;
+
+    /// A seed is 32 bytes, and only bytes: 32 characters of text are refused.
+    #[test]
+    fn a_seed_is_32_bytes_never_text() {
+        assert!(from_slice::<Seed>(&frame(&V::Bytes(vec![7; 32]))).is_ok());
+        assert!(from_slice::<Seed>(&frame(&V::Bytes(vec![7; 31]))).is_err());
+        assert!(from_slice::<Seed>(&frame(&V::Str("x".repeat(32)))).is_err());
+    }
+}
diff --git a/languages/golang/encrypt/guest/src/lib.rs b/languages/golang/encrypt/guest/src/lib.rs
index fd25df371..e6ff1b343 100644
--- a/languages/golang/encrypt/guest/src/lib.rs
+++ b/languages/golang/encrypt/guest/src/lib.rs
@@ -96,6 +96,8 @@ pub mod options;
 pub mod response;
 pub mod status;
 pub mod targets;
+#[cfg(test)]
+mod test_frame;
 
 // The ABI's packed u64 results embed 32-bit pointers, its bounds checks
 // read the wasm linear-memory size, and `host` calls imported functions —
diff --git a/languages/golang/encrypt/guest/src/ops.rs b/languages/golang/encrypt/guest/src/ops.rs
index eba53ba34..d0aefcb77 100644
--- a/languages/golang/encrypt/guest/src/ops.rs
+++ b/languages/golang/encrypt/guest/src/ops.rs
@@ -42,17 +42,16 @@
 //! values to verify are read as [`ValueFrame`]s: the frame is checked against
 //! the engine's value model, and the engine walks it, splitting a source into
 //! one frame per field as it goes. A record opens into one frame, which is
-//! the output. Control data (a plan, an options object, query statistics)
-//! carries no secret and is decoded into an [`FfiValue`].
+//! the output. Control data (a plan, a context, an options object, query
+//! statistics) carries no secret and is read from its frame with serde.
 
-use stack_encrypt::dynamic::{self, FfiValue, Scope, ValueFrame};
+use stack_encrypt::dynamic::{self, Scope, ValueFrame};
 use stack_encrypt::sem::MatchOptions;
 use stack_encrypt::target::IndexSpec;
 use stack_encrypt::ErrorPayload;
-use stack_encrypt::{CipherText, Encrypt, KeysetCipher, Label, Node, SealedValue, StackCipherText};
+use stack_encrypt::{CipherText, KeysetCipher, Label, Node, SealedValue, StackCipherText};
 use stack_kms::DataKeySource;
-use vitaminc_aead_frame::{decode_ciphertext, encode_ciphertext, Frame, FrameWriter};
-use vitaminc_protected::Controlled;
+use vitaminc_aead_frame::{decode_ciphertext, encode_ciphertext, Frame};
 use zeroize::Zeroizing;
 
 use stack_guest_abi::last_error;
@@ -87,8 +86,8 @@ type BytesTree = Node<Vec<u8>>;
 ///
 /// The context is one part — a string, bytes, or an `i32`/`i64`/`u32`/`u64`
 /// — or an array of parts, nested as deep as the transport codec allows
-/// ([`MAX_DEPTH`](vitaminc_aead_frame::MAX_DEPTH) levels from the root of the encoded value; deeper
-/// is [`STATUS_ENCODING`] before the context is parsed), exactly as a plan
+/// ([`MAX_DEPTH`](vitaminc_aead_frame::MAX_DEPTH) levels from the root of the frame; deeper
+/// is [`STATUS_ENCODING`] before the context is read), exactly as a plan
 /// field's; [`dynamic::context`] is the one home of that grammar. Shape is identity:
 /// `[x]` is a PAE-framed list and `x` is not, so a probe takes the context
 /// in the shape the field was sealed under — a plan field's context
@@ -106,7 +105,7 @@ where
 {
     // The same proof every stack-encrypt leaf demands: an empty context is
     // `STATUS_ENCODING` here, before any derivation.
-    let context = dynamic::context(decode_value(context)?).map_err(|e| fail_dynamic(&e))?;
+    let context = parse_context(context)?;
     let value = parse_frame(value)?;
     let kind = parse_term(value, kind)?;
     dynamic::term(cipher, value, &kind, context)
@@ -114,6 +113,16 @@ where
         .map_err(|e| fail_dynamic(&e))
 }
 
+/// A term's context: one frame, read by [`dynamic::context`]. Bytes that
+/// are not a frame are refused as every other input's are, before the
+/// context's own grammar.
+fn parse_context(
+    context: &[u8],
+) -> Result<stack_encrypt::NonEmpty<stack_encrypt::ContextPiece<'static>>, u32> {
+    let _ = parse_frame(context)?;
+    dynamic::context(context).map_err(|e| fail_dynamic(&e))
+}
+
 /// The static half of a term: the kind is one of the ABI's table, and the
 /// value is one scalar the index takes ([`IndexSpec::defines`]). Shared by
 /// [`term`] and [`validate::term`] so the ABI refuses exactly what the
@@ -222,7 +231,8 @@ where
 /// Derive the query term for one plan field, an operator and its input
 /// (ADR-0009; ADR-0007, amended 2026-10-16): a codec-encoded input, the
 /// codec-encoded plan, the field's name and the operator's name (both UTF-8)
-/// in, the term's codec-encoded object out ([`dynamic::QueryTerm::to_value`]):
+/// in, the term's codec-encoded object out (the `Serialize` form of
+/// [`dynamic::QueryTerm`]):
 ///
 /// ```text
 /// { "operator": "matches", "fidelity": "probabilistic", "index": "match",
@@ -259,7 +269,7 @@ where
     .map_err(|e| fail_dynamic(&e))?
     .await
     .map_err(|e| fail_error(&e))?;
-    encode_value(term.to_value())
+    encode_answer(&term)
 }
 
 /// Verify a page of decrypted values against a probabilistic query: the
@@ -293,18 +303,17 @@ pub fn verify(
         &resolver(),
     )
     .map_err(|e| fail_dynamic(&e))?;
-    encode_value(FfiValue::Array(
-        verified.into_iter().map(FfiValue::Bool).collect(),
-    ))
+    encode_answer(&verified)
 }
 
 /// How many rows a probabilistic query should fetch for `want` of them to
 /// verify: the term's bytes as [`query_term`] returned them (not a frame),
 /// the codec-encoded statistics
-/// ([`Stats::from_value`](stack_encrypt::op::Stats::from_value)), the plan,
+/// ([`Stats::from_frame`](stack_encrypt::op::Stats::from_frame)), the plan,
 /// the field's name and the operator's name in; the codec-encoded limit out,
 /// an unsigned 64-bit integer or null for no finite fetch
-/// ([`dynamic::limit_to_value`]). Needs no cipher and no key.
+/// ([`Limit::rows`](stack_encrypt::op::Limit::rows)). Needs no cipher and
+/// no key.
 pub fn target_limit(
     term: &[u8],
     stats: &[u8],
@@ -316,11 +325,11 @@ pub fn target_limit(
     let (plan, field, operator) = parse_query(plan, field, operator)?;
     // Statistics are read without a field to hand; the error names the
     // query's, as every other refusal of a query does.
-    let stats = stack_encrypt::op::Stats::from_value(&decode_value(stats)?)
+    let stats = stack_encrypt::op::Stats::from_frame(stats)
         .map_err(|e| fail_dynamic(&e.in_field(field)))?;
     let limit = dynamic::target_limit(&plan, field, operator, term, want, &stats, &resolver())
         .map_err(|e| fail_dynamic(&e))?;
-    encode_value(dynamic::limit_to_value(limit))
+    encode_answer(&limit.rows())
 }
 
 /// The plan, field name and operator a query names: the plan parsed against
@@ -347,11 +356,13 @@ fn parse_query<'f>(
     Ok((plan, field, operator))
 }
 
-/// A codec-encoded plan, parsed against this build's resolver: a target
-/// name this build cannot run is refused here, the same way at every
-/// export that takes a plan.
+/// A plan's frame, parsed against this build's resolver: a target name this
+/// build cannot run is refused here, the same way at every export that
+/// takes a plan. Bytes that are not a frame are refused as every other
+/// input's are, before the plan's own grammar.
 fn parse_plan(plan: &[u8]) -> Result<dynamic::record::Plan, u32> {
-    dynamic::record::plan_with(decode_value(plan)?, &resolver()).map_err(|e| fail_dynamic(&e))
+    let _ = parse_frame(plan)?;
+    dynamic::record::plan_with(plan, &resolver()).map_err(|e| fail_dynamic(&e))
 }
 
 // =============================================================================
@@ -371,8 +382,8 @@ pub fn plan_check(plan: &[u8]) -> Result<(), u32> {
 
 /// The EQL types this build of the engine knows, as a codec-encoded
 /// `{"targets": [...]}`: one entry per type in
-/// [`TargetDescriptor::to_value`](stack_encrypt::dynamic::TargetDescriptor::to_value)'s
-/// wire form, producible or not, with the reason when not. The build
+/// [`TargetDescriptor`](stack_encrypt::dynamic::TargetDescriptor)'s
+/// `Serialize` form, producible or not, with the reason when not. The build
 /// without EQL types lists none, which a generator reads as "no
 /// `encrypt_into` type is available" and refuses the tag; the `eql` build
 /// lists the catalog, and a generator writes `encrypt_into` only for an
@@ -401,22 +412,19 @@ pub fn plan_check(plan: &[u8]) -> Result<(), u32> {
 /// type answers and how far each answer can be trusted.
 pub fn targets() -> Result<Vec<u8>, u32> {
     use stack_encrypt::dynamic::TargetResolver as _;
-    encode_value(FfiValue::Object(vec![(
-        "targets".to_string(),
-        FfiValue::Array(
-            resolver()
-                .targets()
-                .iter()
-                .map(|target| target.to_value())
-                .collect(),
-        ),
-    )]))
+    #[derive(serde::Serialize)]
+    struct Targets {
+        targets: Vec<dynamic::TargetDescriptor>,
+    }
+    encode_answer(&Targets {
+        targets: resolver().targets(),
+    })
 }
 
 /// The operators one field of a codec-encoded plan answers, as a
 /// codec-encoded list: one object per operator, in the order the engine
-/// lists them, each written by
-/// [`dynamic::operator_to_value`]:
+/// lists them, each the `Serialize` form of a
+/// [`dynamic::OperatorEntry`]:
 ///
 /// ```text
 /// [ { "operator": "eq", "fidelity": "exact", "arity": "one", "index": "eq" }, ... ]
@@ -435,12 +443,12 @@ pub fn operators(plan: &[u8], field: &[u8]) -> Result<Vec<u8>, u32> {
         .map_err(|_| last_error::malformed("the field name is not UTF-8"))?;
     let operators =
         dynamic::field_operators(&plan, field, &resolver()).map_err(|e| fail_dynamic(&e))?;
-    encode_value(FfiValue::Array(
-        operators
+    encode_answer(
+        &operators
             .iter()
-            .map(|(operator, index)| dynamic::operator_to_value(*operator, index))
-            .collect(),
-    ))
+            .map(|(operator, index)| dynamic::OperatorEntry::new(*operator, index))
+            .collect::<Vec<_>>(),
+    )
 }
 
 // =============================================================================
@@ -461,9 +469,7 @@ pub mod validate {
     /// non-empty, the kind is one of [`TERM_EQUALITY`] .. [`TERM_OPE`], and
     /// the value is one scalar the index takes ([`IndexSpec::defines`]).
     pub fn term(value: &[u8], context: &[u8], kind: u32) -> Result<(), u32> {
-        dynamic::context(decode_value(context)?)
-            .map(drop)
-            .map_err(|e| fail_dynamic(&e))?;
+        let _ = parse_context(context)?;
         parse_term(parse_frame(value)?, kind).map(drop)
     }
 
@@ -510,11 +516,6 @@ pub mod validate {
 // Codec glue
 // =============================================================================
 
-/// Control data from a frame: a plan, an options object, statistics.
-fn decode_value(bytes: &[u8]) -> Result<FfiValue, u32> {
-    FfiValue::from_frame(bytes).map_err(|_| not_a_frame())
-}
-
 /// Plaintext from a frame: checked against the engine's value model and
 /// held as the frame, in a buffer wiped when it drops. The same frames are
 /// refused as control data's, so a malformed input fails the same way on
@@ -533,7 +534,7 @@ fn checked_plaintext(bytes: &[u8]) -> Result<Frame<'_>, u32> {
 }
 
 /// An opened value as the output buffer: its frame, copied into a buffer
-/// whose capacity is exactly its length (see [`encode_value`]); the frame
+/// whose capacity is exactly its length (see [`encode_tree`]); the frame
 /// is wiped when it drops.
 fn encode_frame(frame: ValueFrame) -> Result<Vec<u8>, u32> {
     let mut out = exact_buffer(Some(frame.risky_ref().len()))?;
@@ -551,23 +552,17 @@ fn not_a_frame() -> u32 {
     last_error::malformed("an input is not a value in the transport frame")
 }
 
-/// Encode a value tree into a buffer whose capacity is exactly its length.
-///
-/// This buffer is plaintext on the decrypt path, and the registry wipes only
-/// the buffer it holds: `register`'s `into_boxed_slice` reallocates a `Vec`
-/// whose capacity exceeds its length, leaving the old allocation unwiped.
-/// The frame writer reserves an upper bound per leaf (a six-byte string
-/// reserves 14 for 11), so writing straight into the exactly sized buffer
-/// can still grow it. It writes into a `Zeroizing` staging buffer instead
-/// (the writer wipes any allocation it replaces), which is copied into an
-/// exactly sized output and then wiped.
-fn encode_value(value: FfiValue) -> Result<Vec<u8>, u32> {
-    let mut staging = Zeroizing::new(exact_buffer(value_encoded_len(&value))?);
-    (&value)
-        .visit(FrameWriter::new(&mut staging))
-        .map_err(|_| STATUS_ENCODING)?;
-    let mut out = exact_buffer(Some(staging.len()))?;
-    out.extend_from_slice(&staging);
+/// One of the engine's answers (a query term, a page of verdicts, a limit, a
+/// catalog), written to its frame by serde, in a buffer whose capacity is
+/// exactly its length. An answer is not plaintext, but the registry's
+/// `into_boxed_slice` would reallocate a buffer with spare capacity, so it
+/// is sized as every other output is. A query term's search tokens are
+/// derived from plaintext, so the staging buffer is wiped once copied.
+fn encode_answer<T: serde::Serialize>(answer: &T) -> Result<Vec<u8>, u32> {
+    let frame =
+        Zeroizing::new(vitaminc_aead_frame::serde::to_vec(answer).map_err(|_| STATUS_ENCODING)?);
+    let mut out = exact_buffer(Some(frame.len()))?;
+    out.extend_from_slice(&frame);
     Ok(out)
 }
 
@@ -584,8 +579,9 @@ fn decode_tree(bytes: &[u8]) -> Result<StackCipherText, u32> {
 }
 
 /// The encode twin of [`decode_tree`]. Passthrough nodes can carry caller
-/// plaintext, so this is sized up front for the same reason
-/// [`encode_value`] is.
+/// plaintext, so this is sized up front: the registry wipes only the buffer
+/// it holds, and `register`'s `into_boxed_slice` reallocates a `Vec` whose
+/// capacity exceeds its length, leaving the old allocation unwiped.
 fn encode_tree(tree: StackCipherText) -> Result<Vec<u8>, u32> {
     let tree = map_leaves(tree, &mut |l: SealedValue| Ok::<_, u32>(l.to_bytes()))?;
     let mut out = exact_buffer(tree_encoded_len(&tree))?;
@@ -635,29 +631,6 @@ fn exact_buffer(len: Option<usize>) -> Result<Vec<u8>, u32> {
     Ok(out)
 }
 
-/// Exact byte length of the frame of `value`. `None` on overflow or on a
-/// length the frame's `u32` lengths cannot express — the encode would fail
-/// on those anyway, so the caller reports an encoding error.
-fn value_encoded_len(value: &FfiValue) -> Option<usize> {
-    // tag byte + fixed payload, or tag + u32 length prefix + payload.
-    let framed = |len: usize| u32::try_from(len).ok().and_then(|_| len.checked_add(5));
-    match value {
-        FfiValue::Null | FfiValue::Undefined | FfiValue::Bool(_) => Some(1),
-        FfiValue::Int32(_) | FfiValue::UInt32(_) | FfiValue::Float32(_) => Some(5),
-        FfiValue::Int64(_) | FfiValue::UInt64(_) | FfiValue::Float64(_) => Some(9),
-        FfiValue::String(s) => framed(s.risky_ref().len()),
-        FfiValue::Bytes(b) => framed(b.risky_ref().len()),
-        FfiValue::Array(items) => items.iter().try_fold(5usize, |acc, item| {
-            acc.checked_add(value_encoded_len(item)?)
-        }),
-        FfiValue::Object(entries) => entries.iter().try_fold(5usize, |acc, (key, value)| {
-            acc.checked_add(framed(key.len())?.checked_sub(1)?)?
-                .checked_add(value_encoded_len(value)?)
-        }),
-        FfiValue::Passthrough(inner) => value_encoded_len(inner)?.checked_add(1),
-    }
-}
-
 /// Exact byte length of the codec's encoding of a ciphertext tree. A
 /// passthrough is its node byte and its frame, written as it is.
 fn tree_encoded_len(tree: &BytesTree) -> Option<usize> {
@@ -680,65 +653,32 @@ fn tree_encoded_len(tree: &BytesTree) -> Option<usize> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use vitaminc_protected::Protected;
-
-    // `value_encoded_len` / `tree_encoded_len` re-derive the frame's and the
-    // codec's arithmetic; neither exports an `encoded_len` of its own, so these
-    // pins are the only thing that fails if the two drift. Drift is not a
-    // cosmetic bug: an undersized reservation makes `encode_value`
-    // reallocate mid-encode, leaving unwiped partial plaintext in the
-    // abandoned allocation — silently.
-
-    fn every_value_shape() -> Vec<FfiValue> {
-        vec![
-            FfiValue::Null,
-            FfiValue::Undefined,
-            FfiValue::Bool(true),
-            FfiValue::Int32(-5),
-            FfiValue::UInt32(5),
-            FfiValue::Float32(1.5),
-            FfiValue::Int64(-9),
-            FfiValue::UInt64(9),
-            FfiValue::Float64(2.5),
-            FfiValue::String("".into()),
-            FfiValue::String("héllo".into()),
-            FfiValue::Bytes(Protected::new(Vec::new())),
-            FfiValue::Bytes(Protected::new(vec![0u8; 300])),
-            FfiValue::Array(Vec::new()),
-            FfiValue::Array(vec![FfiValue::Bool(false), FfiValue::String("x".into())]),
-            FfiValue::Object(Vec::new()),
-            FfiValue::Object(vec![
-                ("a".to_string(), FfiValue::Int32(1)),
-                (
-                    "nested".to_string(),
-                    FfiValue::Object(vec![("b".to_string(), FfiValue::Null)]),
-                ),
-            ]),
-            FfiValue::Passthrough(Box::new(FfiValue::Int64(7))),
-            FfiValue::Passthrough(Box::new(FfiValue::Array(vec![FfiValue::String(
-                "deep".into(),
-            )]))),
-        ]
-    }
+    use stack_encrypt::dynamic::FfiValue;
+    use vitaminc_protected::{Controlled, Protected};
 
-    /// The registry wipes the buffer it is handed, and `into_boxed_slice`
-    /// reallocates one whose capacity exceeds its length, leaving the old
-    /// allocation unwiped. So every encoded output's capacity is its length,
-    /// not only its length the frame's.
-    #[test]
-    fn an_encoded_value_has_no_spare_capacity() {
-        for (i, value) in every_value_shape().into_iter().enumerate() {
-            let out = encode_value(value).expect("encodes");
-            assert_eq!(out.capacity(), out.len(), "shape {i}");
-        }
-    }
+    // `tree_encoded_len` re-derives the codec's arithmetic; the codec exports
+    // no `encoded_len` of its own, so this pin is the only thing that fails if
+    // the two drift. Drift is not a cosmetic bug: an undersized reservation
+    // makes `encode_tree` reallocate mid-encode, leaving unwiped partial
+    // plaintext in the abandoned allocation — silently.
 
+    /// The registry wipes the buffer it is handed, and `into_boxed_slice`
+    /// reallocates one whose capacity exceeds its length. So every answer's
+    /// capacity is its length.
     #[test]
-    fn value_encoded_len_matches_the_codec_exactly() {
-        for (i, value) in every_value_shape().into_iter().enumerate() {
-            let expected = value_encoded_len(&value).expect("encodable shape");
-            let out = value.to_frame().expect("frame encode");
-            assert_eq!(out.risky_ref().len(), expected, "shape {i}");
+    fn an_encoded_answer_has_no_spare_capacity() {
+        let entries = [
+            dynamic::OperatorEntry::new(dynamic::OpSpec::Eq, &IndexSpec::Equality),
+            dynamic::OperatorEntry::new(dynamic::OpSpec::Between, &IndexSpec::Ope),
+        ];
+        for out in [
+            encode_answer(&vec![true, false, true]),
+            encode_answer(&Some(11u64)),
+            encode_answer(&None::<u64>),
+            encode_answer(&entries),
+        ] {
+            let out = out.expect("encodes");
+            assert_eq!(out.capacity(), out.len());
         }
     }
 
@@ -824,7 +764,7 @@ mod tests {
     #[test]
     fn targets_lists_what_this_build_holds_in_the_wire_shape() {
         let out = targets().expect("encodes");
-        let FfiValue::Object(entries) = decode_value(&out).expect("decodes") else {
+        let FfiValue::Object(entries) = FfiValue::from_frame(&out).expect("decodes") else {
             panic!("an object");
         };
         assert_eq!(entries.len(), 1);
@@ -947,7 +887,7 @@ mod tests {
         validate::record_tree(&sealed, &plan, None).expect("the tree fits");
         let opened =
             block_on(decrypt_record(Scope::Client(&cipher), &sealed, &plan, None)).expect("opens");
-        let FfiValue::Object(values) = decode_value(&opened).expect("a value") else {
+        let FfiValue::Object(values) = FfiValue::from_frame(&opened).expect("a value") else {
             panic!("an object")
         };
         assert!(
@@ -960,7 +900,7 @@ mod tests {
         let probe = encoded(text("alice@example.com"));
         validate::query_term(&probe, &plan, b"email", b"eq").expect("a target field answers eq");
         let term = block_on(query_term(&keyset, &probe, &plan, b"email", b"eq")).expect("derives");
-        let FfiValue::Object(term) = decode_value(&term).expect("a value") else {
+        let FfiValue::Object(term) = FfiValue::from_frame(&term).expect("a value") else {
             panic!("a query term is an object")
         };
         assert!(
diff --git a/languages/golang/encrypt/guest/src/options.rs b/languages/golang/encrypt/guest/src/options.rs
index 569b4d05c..d3bb9f5fb 100644
--- a/languages/golang/encrypt/guest/src/options.rs
+++ b/languages/golang/encrypt/guest/src/options.rs
@@ -1,7 +1,7 @@
 //! The per-call options object, and the keyset selector it carries.
 //!
 //! Every export that touches a keyset takes one more codec-encoded
-//! argument: an [`FfiValue::Object`] with one required key, `keyset`, whose
+//! argument: a frame object with one required key, `keyset`, whose
 //! value is a tagged object naming the keyset the call binds to, and on
 //! `se_decrypt_record` one optional key, `context` (below):
 //!
@@ -41,15 +41,14 @@
 //! it is objects, strings, bytes and nothing else, and this module is its
 //! one home. The Go bindings plan points here.
 
-use stack_encrypt::dynamic::FfiValue;
 use stack_encrypt::dynamic::Scope;
 use stack_encrypt::{KeysetCipher, Label, StackCipher};
 use stack_kms::{IdentifiedBy, IndexKeySource};
 use uuid::Uuid;
-use vitaminc_protected::Controlled;
 use zerokms_protocol::Name;
 
 use stack_guest_abi::last_error::malformed;
+use vitaminc_aead_frame::serde::from_slice;
 
 use crate::status::fail_error;
 #[cfg(any(doc, test))]
@@ -88,84 +87,133 @@ pub struct Options {
     pub context: Option<Label>,
 }
 
-/// Parse a decoded options object for `side`. Anything outside the shape in
-/// the [module docs](self) is [`STATUS_ENCODING`].
-pub fn parse_options(value: FfiValue, side: Side) -> Result<Options, u32> {
-    let FfiValue::Object(entries) = value else {
-        return Err(malformed("the options are not an object"));
-    };
-    let mut keyset: Option<KeysetSelector> = None;
-    let mut context: Option<Label> = None;
-    for (key, value) in entries {
-        match key.as_str() {
-            "keyset" if keyset.is_none() => keyset = Some(parse_selector(value)?),
-            "context" if context.is_none() && side == Side::Open => {
-                let FfiValue::String(text) = value else {
-                    return Err(malformed(r#"the "context" option is not a string"#));
-                };
-                // Valid UTF-8 by `Utf8String`'s construction invariant;
-                // checked rather than assumed because this is boundary
-                // code. A context is not secret, so the payload moves out
-                // of its `Protected` rather than being copied and wiped.
-                let text = String::from_utf8(text.into_inner().risky_unwrap())
-                    .map_err(|_| malformed(r#"the "context" option is not UTF-8"#))?;
-                context = Some(
-                    Label::parse(&text)
-                        .map_err(|_| malformed(r#"the "context" option is not a label"#))?,
-                );
-            }
-            _ => {
-                return Err(malformed(
-                    r#"the options have a key other than "keyset" and, when opening, "context", or give one twice"#,
-                ))
-            }
+/// Parse the options frame a host sent for `side`. Anything outside the
+/// shape in the [module docs](self) is [`STATUS_ENCODING`], with a message
+/// that names what was wrong and never a value.
+pub fn parse_options(bytes: &[u8], side: Side) -> Result<Options, u32> {
+    let wire: wire::Options =
+        from_slice(bytes).map_err(|e| malformed(format!("the options: {e}")))?;
+    let keyset = KeysetSelector::from(wire.keyset);
+    if side == Side::Mint {
+        if wire.context.is_some() {
+            return Err(malformed(
+                r#"the "context" option is for decrypting a record only"#,
+            ));
+        }
+        if keyset == KeysetSelector::Any {
+            return Err(malformed(r#"{"any"} names no keyset to encrypt under"#));
         }
     }
-    let keyset = keyset.ok_or_else(|| malformed("the options name no keyset"))?;
-    if side == Side::Mint && keyset == KeysetSelector::Any {
-        return Err(malformed(r#"{"any"} names no keyset to encrypt under"#));
-    }
-    Ok(Options { keyset, context })
+    Ok(Options {
+        keyset,
+        context: wire.context.map(|context| context.0),
+    })
 }
 
-/// Parse a keyset selector: a tagged object with exactly one key. Spelled
-/// out here rather than in [`parse_options`] so `se_keyset`, which takes a
-/// bare selector, shares the one definition.
-pub fn parse_selector(value: FfiValue) -> Result<KeysetSelector, u32> {
-    let not_one = || malformed("a keyset selector is not an object with exactly one key");
-    let FfiValue::Object(mut entries) = value else {
-        return Err(not_one());
-    };
-    if entries.len() != 1 {
-        return Err(not_one());
+/// Parse a bare keyset selector frame, as `se_keyset` takes it. One
+/// definition, `wire::Selector`, serves this and [`parse_options`].
+pub fn parse_selector(bytes: &[u8]) -> Result<KeysetSelector, u32> {
+    from_slice::<wire::Selector>(bytes)
+        .map(KeysetSelector::from)
+        .map_err(|e| malformed(format!("a keyset selector: {e}")))
+}
+
+/// The options and the selector as a host writes them, read straight from
+/// the frame by serde (`vitaminc_aead_frame::serde`). Each field type
+/// validates as it reads, through `TryFrom`, so a parsed value is already
+/// the guest's. The frame's serde never repeats a `TryFrom` error's text,
+/// so a refusal names the key and says only that its value was not
+/// accepted; each error here is still a fixed string, for the reader.
+mod wire {
+    use serde::{Deserialize, Deserializer};
+    use stack_encrypt::Label;
+    use uuid::Uuid;
+    use zerokms_protocol::Name;
+
+    #[derive(Deserialize)]
+    #[serde(deny_unknown_fields)]
+    pub(super) struct Options {
+        pub(super) keyset: Selector,
+        /// Absent is `None`. Present, it must be a label: a null is refused
+        /// like any other non-string, as it always has been.
+        #[serde(default, deserialize_with = "present")]
+        pub(super) context: Option<ContextLabel>,
+    }
+
+    fn present<'de, D: Deserializer<'de>, T: Deserialize<'de>>(
+        d: D,
+    ) -> Result<Option<T>, D::Error> {
+        T::deserialize(d).map(Some)
+    }
+
+    /// Every variant is spelled; the payload of `default` and `any` is an
+    /// empty object.
+    #[derive(Deserialize)]
+    #[serde(rename_all = "lowercase", deny_unknown_fields)]
+    pub(super) enum Selector {
+        Default {},
+        Any {},
+        Name(KeysetName),
+        Id(KeysetId),
     }
-    let (tag, value) = entries.pop().ok_or_else(not_one)?;
-    Ok(match (tag.as_str(), value) {
-        ("default", FfiValue::Object(fields)) if fields.is_empty() => KeysetSelector::Default,
-        ("any", FfiValue::Object(fields)) if fields.is_empty() => KeysetSelector::Any,
-        ("name", FfiValue::String(name)) => {
-            // Valid UTF-8 by `Utf8String`'s construction invariant; checked
-            // rather than assumed because this is boundary code. A keyset
-            // name is not secret, so the payload moves out of its
-            // `Protected` rather than being copied and wiped. ZeroKMS's
-            // naming rules apply here, at the boundary, not at resolution.
-            let name = String::from_utf8(name.into_inner().risky_unwrap())
-                .map_err(|_| malformed("a keyset name is not UTF-8"))?;
-            KeysetSelector::Name(
-                Name::try_from(name.as_str())
-                    .map_err(|_| malformed("a keyset name breaks ZeroKMS's naming rules"))?,
-            )
+
+    impl From<Selector> for super::KeysetSelector {
+        fn from(selector: Selector) -> Self {
+            match selector {
+                Selector::Default {} => Self::Default,
+                Selector::Any {} => Self::Any,
+                Selector::Name(KeysetName(name)) => Self::Name(name),
+                Selector::Id(KeysetId(id)) => Self::Id(id),
+            }
         }
-        ("id", FfiValue::Bytes(bytes)) => KeysetSelector::Id(
-            Uuid::from_slice(bytes.risky_ref())
-                .map_err(|_| malformed("a keyset id is not 16 bytes"))?,
-        ),
-        _ => {
-            return Err(malformed(
-                r#"a keyset selector is not {"default"}, {"any"}, {"name"} or {"id"}"#,
-            ))
+    }
+
+    /// A keyset name, checked against ZeroKMS's naming rules here at the
+    /// boundary, not at resolution.
+    #[derive(Deserialize)]
+    #[serde(try_from = "&str")]
+    pub(super) struct KeysetName(Name);
+
+    impl TryFrom<&str> for KeysetName {
+        type Error = &'static str;
+
+        fn try_from(name: &str) -> Result<Self, Self::Error> {
+            Name::try_from(name)
+                .map(KeysetName)
+                .map_err(|_| "a keyset name that breaks ZeroKMS's naming rules")
         }
-    })
+    }
+
+    /// A keyset id: exactly 16 bytes, a UUID's raw form.
+    #[derive(Deserialize)]
+    #[serde(try_from = "&[u8]")]
+    pub(super) struct KeysetId(Uuid);
+
+    impl TryFrom<&[u8]> for KeysetId {
+        type Error = &'static str;
+
+        fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
+            Uuid::from_slice(bytes)
+                .map(KeysetId)
+                .map_err(|_| "a keyset id that is not 16 bytes")
+        }
+    }
+
+    /// The context a host expects a record's context field to hold: a
+    /// string that parses as a plain label.
+    #[derive(Deserialize)]
+    #[serde(try_from = "&str")]
+    pub(super) struct ContextLabel(pub(super) Label);
+
+    impl TryFrom<&str> for ContextLabel {
+        type Error = &'static str;
+
+        fn try_from(text: &str) -> Result<Self, Self::Error> {
+            Label::parse(text)
+                .map(ContextLabel)
+                .map_err(|_| "a context that is not a plain label")
+        }
+    }
 }
 
 impl KeysetSelector {
@@ -211,47 +259,39 @@ where
 #[cfg(test)]
 mod tests {
     use super::*;
-    use vitaminc_protected::Protected;
-
-    fn obj(entries: Vec<(&str, FfiValue)>) -> FfiValue {
-        FfiValue::Object(
-            entries
-                .into_iter()
-                .map(|(k, v)| (k.to_string(), v))
-                .collect(),
-        )
-    }
+    use crate::test_frame::{empty, frame, obj, V};
 
-    fn options(selector: FfiValue) -> FfiValue {
+    fn options(selector: V) -> V {
         obj(vec![("keyset", selector)])
     }
 
-    fn empty() -> FfiValue {
-        FfiValue::Object(Vec::new())
+    fn selector(v: V) -> Result<KeysetSelector, u32> {
+        parse_selector(&frame(&v))
+    }
+
+    fn opts(v: V, side: Side) -> Result<Options, u32> {
+        parse_options(&frame(&v), side)
     }
 
     #[test]
     fn every_selector_variant_is_spelled() {
         let id = Uuid::from_u128(7);
         assert_eq!(
-            parse_selector(obj(vec![("default", empty())])),
+            selector(obj(vec![("default", empty())])),
             Ok(KeysetSelector::Default)
         );
         assert_eq!(
-            parse_selector(obj(vec![("any", empty())])),
+            selector(obj(vec![("any", empty())])),
             Ok(KeysetSelector::Any)
         );
         assert_eq!(
-            parse_selector(obj(vec![("name", FfiValue::String("acme".into()))])),
+            selector(obj(vec![("name", V::Str("acme".into()))])),
             Ok(KeysetSelector::Name(
                 Name::try_from("acme").ok().expect("valid name")
             ))
         );
         assert_eq!(
-            parse_selector(obj(vec![(
-                "id",
-                FfiValue::Bytes(Protected::new(id.as_bytes().to_vec()))
-            )])),
+            selector(obj(vec![("id", V::Bytes(id.as_bytes().to_vec()))])),
             Ok(KeysetSelector::Id(id))
         );
     }
@@ -260,8 +300,8 @@ mod tests {
     fn a_selector_is_exactly_one_known_tag_with_the_right_payload() {
         for (label, bad) in [
             ("an empty object", empty()),
-            ("a string", FfiValue::String("default".into())),
-            ("null", FfiValue::Null),
+            ("a string", V::Str("default".into())),
+            ("null", V::Null),
             ("an unknown tag", obj(vec![("primary", empty())])),
             (
                 "two tags",
@@ -269,7 +309,7 @@ mod tests {
             ),
             (
                 "default with a payload",
-                obj(vec![("default", FfiValue::Bool(true))]),
+                obj(vec![("default", V::Bool(true))]),
             ),
             (
                 "default with fields",
@@ -277,43 +317,57 @@ mod tests {
             ),
             (
                 "a name that is not a string",
-                obj(vec![("name", FfiValue::UInt64(1))]),
-            ),
-            (
-                "an empty name",
-                obj(vec![("name", FfiValue::String("".into()))]),
+                obj(vec![("name", V::U64(1))]),
             ),
+            ("an empty name", obj(vec![("name", V::Str("".into()))])),
             (
                 "a name past ZeroKMS's 64-byte limit",
-                obj(vec![(
-                    "name",
-                    FfiValue::String("x".repeat(65).as_str().into()),
-                )]),
+                obj(vec![("name", V::Str("x".repeat(65)))]),
             ),
             (
                 "an id that is not 16 bytes",
-                obj(vec![("id", FfiValue::Bytes(Protected::new(vec![1, 2, 3])))]),
+                obj(vec![("id", V::Bytes(vec![1, 2, 3]))]),
+            ),
+            (
+                "a 16-byte id sent as text",
+                obj(vec![("id", V::Str("0123456789abcdef".into()))]),
+            ),
+            (
+                "a name sent as bytes",
+                obj(vec![("name", V::Bytes(b"acme".to_vec()))]),
+            ),
+            (
+                "a selector sent as an array",
+                V::Arr(vec![obj(vec![("name", V::Str("acme".into()))])]),
             ),
             (
                 "an id as text",
                 obj(vec![(
                     "id",
-                    FfiValue::String("00000000-0000-0000-0000-000000000007".into()),
+                    V::Str("00000000-0000-0000-0000-000000000007".into()),
                 )]),
             ),
         ] {
             assert_eq!(
-                parse_selector(bad).err(),
+                selector(bad).err(),
                 Some(STATUS_ENCODING),
                 "{label} is not a selector and must be refused"
             );
         }
     }
 
+    /// Options sent as an array are refused: the frame reads them only from
+    /// an object, never by position.
+    #[test]
+    fn options_sent_as_an_array_are_refused() {
+        let positional = V::Arr(vec![obj(vec![("name", V::Str("acme".into()))])]);
+        assert_eq!(opts(positional, Side::Open), Err(STATUS_ENCODING));
+    }
+
     #[test]
     fn options_are_one_keyset_key() {
         assert_eq!(
-            parse_options(options(obj(vec![("default", empty())])), Side::Mint),
+            opts(options(obj(vec![("default", empty())])), Side::Mint),
             Ok(Options {
                 keyset: KeysetSelector::Default,
                 context: None,
@@ -321,12 +375,12 @@ mod tests {
         );
         for (label, bad) in [
             ("no keyset", empty()),
-            ("not an object", FfiValue::Null),
+            ("not an object", V::Null),
             (
                 "an unknown key beside it",
                 obj(vec![
                     ("keyset", obj(vec![("default", empty())])),
-                    ("mode", FfiValue::Bool(true)),
+                    ("mode", V::Bool(true)),
                 ]),
             ),
             (
@@ -338,7 +392,7 @@ mod tests {
             ),
         ] {
             assert_eq!(
-                parse_options(bad, Side::Open).err(),
+                opts(bad, Side::Open).err(),
                 Some(STATUS_ENCODING),
                 "{label} must be refused"
             );
@@ -347,14 +401,14 @@ mod tests {
 
     #[test]
     fn an_expected_context_is_an_opening_option_only() {
-        let with = |context: FfiValue| {
+        let with = |context: V| {
             obj(vec![
                 ("keyset", obj(vec![("default", empty())])),
                 ("context", context),
             ])
         };
         assert_eq!(
-            parse_options(with(FfiValue::String("tenants/acme".into())), Side::Open),
+            opts(with(V::Str("tenants/acme".into())), Side::Open),
             Ok(Options {
                 keyset: KeysetSelector::Default,
                 context: Some(Label::parse("tenants/acme").expect("a label")),
@@ -363,28 +417,28 @@ mod tests {
         for (label, bad, side) in [
             (
                 "on the sealing side",
-                with(FfiValue::String("tenants/acme".into())),
+                with(V::Str("tenants/acme".into())),
                 Side::Mint,
             ),
-            ("not a string", with(FfiValue::UInt64(7)), Side::Open),
+            ("not a string", with(V::U64(7)), Side::Open),
             (
                 "not a plain label",
-                with(FfiValue::String("tenants/(acme)".into())),
+                with(V::Str("tenants/(acme)".into())),
                 Side::Open,
             ),
-            ("empty", with(FfiValue::String("".into())), Side::Open),
+            ("empty", with(V::Str("".into())), Side::Open),
             (
                 "given twice",
                 obj(vec![
                     ("keyset", obj(vec![("default", empty())])),
-                    ("context", FfiValue::String("a".into())),
-                    ("context", FfiValue::String("a".into())),
+                    ("context", V::Str("a".into())),
+                    ("context", V::Str("a".into())),
                 ]),
                 Side::Open,
             ),
         ] {
             assert_eq!(
-                parse_options(bad, side).err(),
+                opts(bad, side).err(),
                 Some(STATUS_ENCODING),
                 "{label} must be refused"
             );
@@ -395,15 +449,12 @@ mod tests {
     fn any_is_an_opening_selector_only() {
         let any = || options(obj(vec![("any", empty())]));
         assert_eq!(
-            parse_options(any(), Side::Open),
+            opts(any(), Side::Open),
             Ok(Options {
                 keyset: KeysetSelector::Any,
                 context: None,
             })
         );
-        assert_eq!(
-            parse_options(any(), Side::Mint).err(),
-            Some(STATUS_ENCODING)
-        );
+        assert_eq!(opts(any(), Side::Mint).err(), Some(STATUS_ENCODING));
     }
 }
diff --git a/languages/golang/encrypt/guest/src/test_frame.rs b/languages/golang/encrypt/guest/src/test_frame.rs
new file mode 100644
index 000000000..f18ee4d5a
--- /dev/null
+++ b/languages/golang/encrypt/guest/src/test_frame.rs
@@ -0,0 +1,74 @@
+//! Frames written by hand for tests: objects entry by entry, so a test can
+//! send what no writer would (a repeated key, an integer of any width).
+
+use serde::{Serialize, Serializer};
+use vitaminc_aead_frame::serde::to_vec;
+
+/// A test input, written as raw frame bytes by [`frame`].
+pub(crate) enum V {
+    Obj(Vec<(&'static str, V)>),
+    Arr(Vec<V>),
+    Str(String),
+    Bytes(Vec<u8>),
+    U32(u32),
+    U64(u64),
+    Bool(bool),
+    Null,
+}
+
+struct RawBytes<'a>(&'a [u8]);
+
+impl Serialize for RawBytes<'_> {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_bytes(self.0)
+    }
+}
+
+/// The frame bytes of `v`.
+pub(crate) fn frame(v: &V) -> Vec<u8> {
+    let scalar = |r: Result<Vec<u8>, _>| r.expect("a scalar frames");
+    let container = |tag: u8, len: usize| {
+        let mut out = vec![tag];
+        out.extend_from_slice(&u32::try_from(len).expect("short").to_le_bytes());
+        out
+    };
+    match v {
+        V::Obj(entries) => {
+            let mut out = container(vitaminc_aead_frame::OBJECT, entries.len());
+            for (key, value) in entries {
+                out.extend_from_slice(&u32::try_from(key.len()).expect("short").to_le_bytes());
+                out.extend_from_slice(key.as_bytes());
+                out.extend_from_slice(&frame(value));
+            }
+            out
+        }
+        V::Arr(items) => {
+            let mut out = container(vitaminc_aead_frame::ARRAY, items.len());
+            for item in items {
+                out.extend_from_slice(&frame(item));
+            }
+            out
+        }
+        V::Str(text) => scalar(to_vec(text)),
+        V::Bytes(bytes) => scalar(to_vec(&RawBytes(bytes))),
+        V::U32(n) => scalar(to_vec(n)),
+        V::U64(n) => scalar(to_vec(n)),
+        V::Bool(b) => scalar(to_vec(b)),
+        V::Null => scalar(to_vec(&())),
+    }
+}
+
+/// An object of `entries`, in order.
+pub(crate) fn obj(entries: Vec<(&'static str, V)>) -> V {
+    V::Obj(entries)
+}
+
+/// An empty object.
+pub(crate) fn empty() -> V {
+    V::Obj(Vec::new())
+}
+
+/// A string.
+pub(crate) fn s(text: &str) -> V {
+    V::Str(text.to_owned())
+}
diff --git a/languages/golang/encrypt/guest/tests/leak.rs b/languages/golang/encrypt/guest/tests/leak.rs
index 64dd85a31..1c9557be9 100644
--- a/languages/golang/encrypt/guest/tests/leak.rs
+++ b/languages/golang/encrypt/guest/tests/leak.rs
@@ -27,7 +27,7 @@ use stack_encrypt::{CipherText, Descriptor, Node, PassthroughFrame, StackCipher}
 use stack_encrypt_guest::options::{parse_options, Side};
 use stack_encrypt_guest::status::fail_error;
 use stack_encrypt_guest::{config, ops};
-use stack_guest_abi::{call, last_error};
+use stack_guest_abi::call;
 use stack_kms::{
     DataKey, DataKeySource, DataKeyWithTag, FakeDataKeySource, GenerateKeyError,
     GenerateKeyPayload, IndexKeySource, LoadKeysetError, RetrieveKeyError, RetrieveKeyPayload,
@@ -552,7 +552,7 @@ fn scenarios() -> Vec<(&'static str, FfiValue)> {
         (
             "options that are not an object",
             failure("options", &["stack_guest_abi::malformed_input"], || {
-                parse_options(s(CONTEXT), Side::Open)
+                parse_options(&encode(s(CONTEXT)), Side::Open)
             }),
         ),
         // -- ZeroKMS, through a key source whose answers carry the body ---
@@ -582,7 +582,7 @@ fn scenarios() -> Vec<(&'static str, FfiValue)> {
             "a keyset ZeroKMS does not know",
             failure("keyset", &["stack_kms::keyset_not_found"], || {
                 let options = parse_options(
-                    obj(vec![("keyset", obj(vec![("name", s("tenant"))]))]),
+                    &encode(obj(vec![("keyset", obj(vec![("name", s("tenant"))]))])),
                     Side::Mint,
                 )?;
                 block_on(options.keyset.resolve(&failing)).map(drop)
@@ -619,17 +619,13 @@ fn scenarios() -> Vec<(&'static str, FfiValue)> {
                     ("client_id", s("6a1b8c6e-6f3a-4e43-9a3b-2f0f6f8b1c2d")),
                     ("client_key", s(CLIENT_KEY)),
                 ]);
-                config::parse_config(config)
-                    .map(drop)
-                    .map_err(|e| last_error::malformed(e.describe()))
+                config::parse_config(&encode(config)).map(drop)
             }),
         ),
         (
             "a config key this version does not know",
             failure("config key", &["stack_guest_abi::malformed_input"], || {
-                config::parse_config(obj(vec![(CLIENT_KEY, s(CLIENT_KEY))]))
-                    .map(drop)
-                    .map_err(|e| last_error::malformed(e.describe()))
+                config::parse_config(&encode(obj(vec![(CLIENT_KEY, s(CLIENT_KEY))]))).map(drop)
             }),
         ),
         // -- an error no native path raises, recorded the same way ---------
@@ -832,7 +828,7 @@ fn a_keyset_not_found_carries_its_help_and_request_kind() {
     let failing = failing();
     let error = failure("keyset", &["stack_kms::keyset_not_found"], || {
         let options = parse_options(
-            obj(vec![("keyset", obj(vec![("name", s("tenant"))]))]),
+            &encode(obj(vec![("keyset", obj(vec![("name", s("tenant"))]))])),
             Side::Mint,
         )?;
         block_on(options.keyset.resolve(&failing)).map(drop)
diff --git a/languages/golang/encrypt/memory_test.go b/languages/golang/encrypt/memory_test.go
index 6be1561b5..50b009626 100644
--- a/languages/golang/encrypt/memory_test.go
+++ b/languages/golang/encrypt/memory_test.go
@@ -236,12 +236,17 @@ func TestRequireLockedMemoryFailsTheCallThatCannotGrow(t *testing.T) {
 // same way, but the guest cannot report it: its allocator aborts, the trap
 // closes the module, and the client is closed with it, its keys wiped.
 // The call still fails with ErrMemoryLock naming the refusal, and the
-// client is ErrState from then on. Provoked by staging a config the guest
-// must copy while decoding, with the refusal installed after the staging.
+// client is ErrState from then on. Provoked by staging a config whose
+// client key the guest must decode into a buffer of its own (the parser
+// borrows every other string from the staged config), with the refusal
+// installed after the staging.
 func TestRequireLockedMemoryClosesTheClientOnARefusedInternalGrowth(t *testing.T) {
 	ctx := context.Background()
 	c := strictClient(t)
-	cfg := initConfig{clientID: strings.Repeat("a", 2<<20), clientKey: NewClientKey([]byte("00"))}
+	cfg := initConfig{
+		clientID:  "6a1b8c6e-6f3a-4e43-9a3b-2f0f6f8b1c2d",
+		clientKey: NewClientKey([]byte(strings.Repeat("00", 2<<20))),
+	}
 	encoded, err := encodeConfig(cfg)
 	if err != nil {
 		t.Fatal(err)
diff --git a/packages/eql/Cargo.lock b/packages/eql/Cargo.lock
index 993b20bbb..87ff02e4b 100644
--- a/packages/eql/Cargo.lock
+++ b/packages/eql/Cargo.lock
@@ -1244,7 +1244,7 @@ dependencies = [
  "stack-kms",
  "tokio",
  "uuid",
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
 ]
 
 [[package]]
@@ -4217,8 +4217,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -4237,12 +4237,13 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc-aead 0.6.0",
- "vitaminc-encrypt 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-aead-frame",
+ "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -4277,8 +4278,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -5043,16 +5044,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -5085,18 +5086,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -5113,15 +5114,26 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 3.0.3",
 ]
 
+[[package]]
+name = "vitaminc-aead-frame"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
+dependencies = [
+ "serde",
+ "vitaminc-aead 0.6.1",
+ "zeroize",
+]
+
 [[package]]
 name = "vitaminc-context"
 version = "0.5.1"
@@ -5134,12 +5146,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -5172,56 +5184,56 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "393354b2348eabce0420626fdc7cf70ac779870f82abb566fb491ea19eeea066"
+checksum = "bd361f626e95cbe770b9d012e4a86c43cfefe4aefb3d5b3ed9339a83085bdc53"
 dependencies = [
  "hmac 0.13.0",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda6ec7f852ba8cd7e0ba6e8e7eaa3045e6fb866007c6d7ad6128833d8980f0c"
+checksum = "214b2a9d085924c3bc3c91f3ba74238e8848bf54990e5f48f170c71fbacea07a"
 dependencies = [
  "thiserror 2.0.20",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11de28e524ab1deecedbb023bd328916b6c023e2f52156521ac1df75a689d911"
+checksum = "c2715cca25006b4656223bc932ab4fd7f70d387aa4ec63a4e2ef33aa8cd2b3a5"
 dependencies = [
  "mutants",
  "thiserror 2.0.20",
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
  "vitaminc-normalize",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -5258,9 +5270,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -5269,7 +5281,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -5297,9 +5309,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -5338,16 +5350,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -5375,9 +5387,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5418,17 +5430,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/packages/stack-encrypt/CHANGELOG.md b/packages/stack-encrypt/CHANGELOG.md
index fe2276ef0..619324319 100644
--- a/packages/stack-encrypt/CHANGELOG.md
+++ b/packages/stack-encrypt/CHANGELOG.md
@@ -42,10 +42,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `Reason::OperatorNotAnswered`; `check_query` refuses the same without a
   cipher. `dynamic::verify` checks a page of decrypted values against a
   probabilistic query and `dynamic::target_limit` sizes its fetch from the
-  term's bytes and `Stats` (`Stats::from_value` reads their wire form), by
+  term's bytes and `Stats` (`Stats::from_frame` reads their wire form), by
   the code the typed `MatchQuery` runs, with the field's own match options;
   neither uses a key. The catalog entry of an EQL type
-  (`TargetDescriptor::to_value`) lists the operators the engine answers for
+  (a serialized `TargetDescriptor`) lists the operators the engine answers for
   it, each with its fidelity (`dynamic::Fidelity`), arity and index
   (`TargetDescriptor::operators`).
 - **An EQL type with a match index answers `matches` through its twin.**
@@ -62,7 +62,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   field of a data plan answers, each with the index that answers it: what
   `query_term` derives a term for on that field and nothing else, for a
   field declared with indexes as for one that names an EQL type.
-  `dynamic::operator_to_value` writes one entry in the catalog's wire form.
+  `dynamic::OperatorEntry` is one entry in the catalog's wire form.
   A generator asks this before the program runs, so it writes one query
   method per operator and holds no copy of the table.
 - **A query names an operator, not an index.**
@@ -160,8 +160,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   output form, `dynamic::record::plan_with` reads `{"context": [...],
   "target": "TextEq", "type"?: ...}` — the two forms are exclusive — and
   resolves the name through a `dynamic::TargetResolver` the host installs:
-  the EQL types a build holds (`targets()`, serializable as
-  `TargetDescriptor::to_value()` for a guest's `se_targets` export) and how
+  the EQL types a build holds (`targets()`, each a `Serialize`
+  `TargetDescriptor` for a guest's `se_targets` export) and how
   to run one. `encrypt_with` zips the type's own `Pending` into the record's,
   so a record with target fields is still one ZeroKMS request, and stores
   the EQL value's JSON bytes under the field's `"eql"` key
@@ -246,11 +246,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `TargetResolver::encrypt` and `query` take a `ValueFrame`, and
     `decrypt` resolves to one.
 
-  `FfiValue` stays, as the tree of a binding's control data (plans,
-  contexts, options, statistics, configuration, the engine's answers).
-  Control data is not plaintext, but a configuration carries credentials
-  (a client key, a test build's seed), so its text and bytes leaves stay
-  `Protected`.
+  `FfiValue` stays for now, in the control data not yet read with serde
+  (see the next entry).
   Ciphertexts, terms and the cross-language fixtures are byte for byte what
   they were. The Go guest decodes plaintext as `ValueFrame`s and returns an
   opened record's frame as it is. Copies of an opened string that remain in
@@ -265,6 +262,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   and `verify` under an allocator that fails the test on any freed block
   still holding plaintext.
 
+- **A binding's control data is read from its frame with serde, not
+  decoded into an `FfiValue`** (`dynamic` feature). Each message is a typed
+  value read straight from the frame bytes by `vitaminc_aead_frame::serde`,
+  so no tree is built and every message refuses an unknown key, a repeated
+  key or a wrong type the same way:
+  - `dynamic::context` takes the context's frame bytes. An integer is read
+    at the width the frame carries, and only `i32`, `i64`, `u32` and `u64`
+    are contexts: an 8- or 16-bit integer, which was widened to 32 bits
+    before, and a 128-bit one are `Reason::ContextKind`, as are bytes that
+    are not one frame.
+  - `record::plan` and `record::plan_with` take the plan's frame bytes.
+    `IndexSpec::from_frame` replaces `IndexSpec::from_value`, and
+    `Output::from_value` is gone. Each `Reason` a plan was refused with is
+    unchanged, with two exceptions: a key, a field or a match option given
+    twice is refused by the frame before the plan is read, as
+    `Reason::NotAnObject` naming no field (it was `RepeatedKey` or
+    `DuplicateField`), and so are bytes that are not one frame. An index's
+    payload may be missing or null alike: `{"match": null}` is a bare
+    `"match"`, and `{"eq": null}` a bare `"eq"`.
+  - `Stats::from_frame` replaces `Stats::from_value`.
+  - The engine's answers are `Serialize`, written to a frame by serde,
+    byte for byte what the `FfiValue` encoders wrote (pinned in the tests):
+    `QueryTerm`, `TargetDescriptor` and `IndexSpec` replace their
+    `to_value`, `OperatorEntry::new` replaces `operator_to_value`, and
+    `Limit::rows` replaces `limit_to_value` (`None` writes null).
+
 - **A match value with no tokens is stored as the empty filter, so
   `KeysetCipher::match_terms` is no longer a query.** In 0.2.0 the same call
   served write time and query time, and refused text that cuts no token
diff --git a/packages/stack-encrypt/Cargo.toml b/packages/stack-encrypt/Cargo.toml
index f7b45ef5d..9531bc714 100644
--- a/packages/stack-encrypt/Cargo.toml
+++ b/packages/stack-encrypt/Cargo.toml
@@ -39,6 +39,9 @@ vitaminc-hmac = { workspace = true }
 vitaminc-normalize = { workspace = true }
 vitaminc-prf = { workspace = true }
 vitaminc-protected = { workspace = true }
+# `dynamic` only: serde over the transport frame, which reads a binding's
+# control data (statistics, options, a plan) into typed messages.
+vitaminc-aead-frame = { workspace = true, optional = true, features = ["serde"] }
 serde = { workspace = true }
 # `Descriptor`: the base64 rendering of a non-textual context for ZeroKMS.
 base64ct = { version = "1.7", features = ["alloc"] }
@@ -64,7 +67,7 @@ http = ["dep:stack-auth", "stack-auth/http", "stack-kms/http"]
 # `stack_encrypt::dynamic`: encrypt and decrypt values whose types are known
 # only at runtime, as an FFI binding's are. Off by default — it is only of
 # use to a binding author. Its transport frames are vitaminc-aead's own.
-dynamic = []
+dynamic = ["dep:vitaminc-aead-frame"]
 # `stack_encrypt::kms::FakeDataKeySource`: the in-memory key source for tests
 # with no ZeroKMS, so a caller's dev-dependency on stack-encrypt is enough and
 # no direct stack-kms dependency has to agree with this crate's.
diff --git a/packages/stack-encrypt/fuzz/Cargo.lock b/packages/stack-encrypt/fuzz/Cargo.lock
index cb8b3eaa7..46ebdef16 100644
--- a/packages/stack-encrypt/fuzz/Cargo.lock
+++ b/packages/stack-encrypt/fuzz/Cargo.lock
@@ -2021,8 +2021,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -2041,12 +2041,13 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc-aead 0.6.0",
- "vitaminc-encrypt 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-aead-frame",
+ "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -2067,7 +2068,7 @@ dependencies = [
  "libfuzzer-sys",
  "stack-encrypt",
  "uuid",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2092,8 +2093,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2532,16 +2533,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -2561,18 +2562,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -2589,15 +2590,26 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 3.0.3",
 ]
 
+[[package]]
+name = "vitaminc-aead-frame"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
+dependencies = [
+ "serde",
+ "vitaminc-aead 0.6.1",
+ "zeroize",
+]
+
 [[package]]
 name = "vitaminc-context"
 version = "0.5.1"
@@ -2610,12 +2622,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2634,56 +2646,56 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "393354b2348eabce0420626fdc7cf70ac779870f82abb566fb491ea19eeea066"
+checksum = "bd361f626e95cbe770b9d012e4a86c43cfefe4aefb3d5b3ed9339a83085bdc53"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda6ec7f852ba8cd7e0ba6e8e7eaa3045e6fb866007c6d7ad6128833d8980f0c"
+checksum = "214b2a9d085924c3bc3c91f3ba74238e8848bf54990e5f48f170c71fbacea07a"
 dependencies = [
  "thiserror 2.0.18",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11de28e524ab1deecedbb023bd328916b6c023e2f52156521ac1df75a689d911"
+checksum = "c2715cca25006b4656223bc932ab4fd7f70d387aa4ec63a4e2ef33aa8cd2b3a5"
 dependencies = [
  "mutants",
  "thiserror 2.0.18",
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
  "vitaminc-normalize",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2705,9 +2717,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2716,7 +2728,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.18",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -2733,9 +2745,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2760,16 +2772,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.18",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -2786,9 +2798,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2813,17 +2825,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/packages/stack-encrypt/fuzz/Cargo.toml b/packages/stack-encrypt/fuzz/Cargo.toml
index 63378e06c..49a9ff34f 100644
--- a/packages/stack-encrypt/fuzz/Cargo.toml
+++ b/packages/stack-encrypt/fuzz/Cargo.toml
@@ -17,7 +17,7 @@ cargo-fuzz = true
 [dependencies]
 # `Protected`, for the check_record model's passthrough-of-bytes node: the
 # same line stack-encrypt builds on.
-vitaminc-protected = "0.6.0"
+vitaminc-protected = "0.6.1"
 libfuzzer-sys = "0.4"
 # Structure-aware inputs for `check_record` and `plan_build`: the mirror
 # types derive `Arbitrary`, so the fuzzer mutates trees and plans, not bytes.
diff --git a/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs b/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
index a7dac6f2a..d16cb6f37 100644
--- a/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
+++ b/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
@@ -401,7 +401,12 @@ fuzz_target!(|case: Case| {
     let Case { plan: spec, record } = case;
     // The plan parser is fuzzed for panics only: its rules are a separate
     // model, and a plan that does not parse has no record to check.
-    let Ok(plan) = plan_with(spec.into_value(), &Fixed) else {
+    // The plan crosses as a binding sends it, as frame bytes; a spec the
+    // frame cannot carry is no plan.
+    let Ok(frame) = spec.into_value().to_frame() else {
+        return;
+    };
+    let Ok(plan) = plan_with(frame.risky_ref(), &Fixed) else {
         if trace {
             eprintln!("verdict: plan refused");
         }
diff --git a/packages/stack-encrypt/src/dynamic/context.rs b/packages/stack-encrypt/src/dynamic/context.rs
index 160c4a15b..0fed9ba6f 100644
--- a/packages/stack-encrypt/src/dynamic/context.rs
+++ b/packages/stack-encrypt/src/dynamic/context.rs
@@ -1,18 +1,19 @@
-//! An [`FfiValue`] read as an encryption context. See [`context`](context()).
+//! A context read from a binding's frame. See [`context`](context()).
 
 use std::borrow::Cow;
+use std::fmt;
 
-use super::FfiValue;
-use vitaminc_protected::Controlled;
+use serde::de::{self, Deserializer, SeqAccess, Unexpected, Visitor};
+use serde::Deserialize;
 
 use super::{Error, Reason};
 use crate::{ContextPiece, NonEmpty};
 
-/// A context arrives from a binding as a value and becomes a [`ContextPiece`]
-/// tree: vitaminc's runtime form of a context, and the *identity* of one.
-/// vitaminc's law (pinned there by quickcheck over every built-in context
-/// type) is that a context's two derivations each equal the same derivation
-/// of its parts view:
+/// A context arrives from a binding as a frame and becomes a
+/// [`ContextPiece`] tree: vitaminc's runtime form of a context, and the
+/// *identity* of one. vitaminc's law (pinned there by quickcheck over every
+/// built-in context type) is that a context's two derivations each equal the
+/// same derivation of its parts view:
 ///
 /// ```text
 /// x.into_aad()         == x.into_context().into_aad()
@@ -35,13 +36,15 @@ use crate::{ContextPiece, NonEmpty};
 /// ```
 ///
 /// A bare string is one text part. An array is a list, and may nest as deep
-/// as the transport codec allows
+/// as the transport frame allows
 /// ([`MAX_DEPTH`](vitaminc_aead::frame::MAX_DEPTH) levels, counted
-/// from the root of the encoded value); a deeper value is refused by the
-/// codec before this module sees it. Text and bytes with the same content
-/// are distinct contexts (UTF-8 versus bytes typed leaves) — the same
-/// distinction the Rust types make. Booleans, floats, null, undefined,
-/// objects and passthroughs are not contexts.
+/// from the root of the frame); a deeper frame is refused before it is
+/// read. Text and bytes with the same content are distinct contexts (UTF-8
+/// versus bytes typed leaves) — the same distinction the Rust types make.
+/// An integer's width is part of its identity, so it is read at the width
+/// the frame carries, and only the four widths above are contexts.
+/// Booleans, floats, null, objects, other integer widths, a scalar with a
+/// logical type and passthroughs are not contexts.
 ///
 /// # Which Rust contexts a list spells
 ///
@@ -70,67 +73,125 @@ use crate::{ContextPiece, NonEmpty};
 /// context:
 ///
 /// ```
-/// use stack_encrypt::dynamic::{context, FfiValue};
+/// use stack_encrypt::dynamic::context;
 /// use stack_encrypt::{nonempty, IntoAad};
 ///
-/// let parsed = context(FfiValue::Array(vec![
-///     FfiValue::Array(vec![
-///         FfiValue::String("users".into()),
-///         FfiValue::String("age".into()),
-///     ]),
-///     FfiValue::UInt64(7),
-/// ]))?;
+/// // `[["users", "age"], 7u64]`, as a binding writes it.
+/// let frame = vitaminc_aead_frame::serde::to_vec(&(("users", "age"), 7u64))?;
+/// let parsed = context(&frame)?;
 /// let typed = nonempty!("users").with("age").with(7u64);
 /// assert_eq!(
 ///     parsed.into_inner().into_aad().as_bytes(),
 ///     typed.into_aad().as_bytes()
 /// );
-/// # Ok::<(), stack_encrypt::dynamic::Error>(())
+/// # Ok::<(), Box<dyn std::error::Error>>(())
 /// ```
 ///
 /// # Errors
 ///
 /// [`Error::Context`] for anything outside the shape above
-/// ([`Reason::ContextKind`], [`Reason::ContextNotUtf8`]), and for a context
-/// that renders empty ([`Reason::EmptyContext`]). It names no field: the
-/// caller that knows the field names it ([`Error::in_field`]).
-pub fn context(value: FfiValue) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
-    NonEmpty::new(piece_of(value)?).map_err(|_| Error::bad_context(Reason::EmptyContext))
+/// ([`Reason::ContextKind`]), including bytes that are not one frame, and
+/// for a context that renders empty ([`Reason::EmptyContext`]). It names no
+/// field: the caller that knows the field names it ([`Error::in_field`]).
+pub fn context(frame: &[u8]) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+    let Context(piece) = vitaminc_aead_frame::serde::from_slice(frame)
+        .map_err(|_| Error::bad_context(Reason::ContextKind))?;
+    non_empty(piece)
 }
 
-fn piece_of(value: FfiValue) -> Result<ContextPiece<'static>, Error> {
-    Ok(match value {
-        // Valid UTF-8 by `Utf8String`'s construction invariant; checked
-        // rather than assumed because this is boundary code. The payload
-        // moves out of its `Protected` rather than being copied: a context
-        // is not secret, and the copy would only be wiped and freed.
-        FfiValue::String(s) => ContextPiece::Text(Cow::Owned(
-            String::from_utf8(s.into_inner().risky_unwrap())
-                .map_err(|_| Error::bad_context(Reason::ContextNotUtf8))?,
-        )),
-        FfiValue::Bytes(bytes) => ContextPiece::Bytes(Cow::Owned(bytes.risky_unwrap())),
-        FfiValue::Int32(v) => ContextPiece::I32(v),
-        FfiValue::Int64(v) => ContextPiece::I64(v),
-        FfiValue::UInt32(v) => ContextPiece::U32(v),
-        FfiValue::UInt64(v) => ContextPiece::U64(v),
-        // Nesting depth is bounded by the codec's `MAX_DEPTH` before the
-        // value reaches here.
-        FfiValue::Array(items) => ContextPiece::List(
-            items
-                .into_iter()
-                .map(piece_of)
-                .collect::<Result<Vec<_>, Error>>()?,
-        ),
-        FfiValue::Null
-        | FfiValue::Undefined
-        | FfiValue::Bool(_)
-        | FfiValue::Float32(_)
-        | FfiValue::Float64(_)
-        | FfiValue::Object(_)
-        | FfiValue::Passthrough(_) => return Err(Error::bad_context(Reason::ContextKind)),
-    })
+/// A context tree, proven non-empty by vitaminc's rule.
+pub(super) fn non_empty(
+    piece: ContextPiece<'static>,
+) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+    NonEmpty::new(piece).map_err(|_| Error::bad_context(Reason::EmptyContext))
 }
 
+/// One context as serde reads it from a frame (see [`context`](context())).
+/// A visitor rather than a derive: an untagged enum would buffer the value
+/// through serde's own content type, which lets a text variant take bytes,
+/// and would read an integer at whichever variant's width it fits first.
+pub(super) struct Context(pub(super) ContextPiece<'static>);
+
+impl<'de> Deserialize<'de> for Context {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        d.deserialize_any(ContextVisitor).map(Context)
+    }
+}
+
+struct ContextVisitor;
+
+impl<'de> Visitor<'de> for ContextVisitor {
+    type Value = ContextPiece<'static>;
+
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("a context: a string, bytes, an i32, i64, u32 or u64, or a list of contexts")
+    }
+
+    fn visit_str<E>(self, text: &str) -> Result<Self::Value, E> {
+        Ok(ContextPiece::Text(Cow::Owned(text.to_owned())))
+    }
+
+    fn visit_bytes<E>(self, bytes: &[u8]) -> Result<Self::Value, E> {
+        Ok(ContextPiece::Bytes(Cow::Owned(bytes.to_vec())))
+    }
+
+    fn visit_i32<E>(self, v: i32) -> Result<Self::Value, E> {
+        Ok(ContextPiece::I32(v))
+    }
+
+    fn visit_i64<E>(self, v: i64) -> Result<Self::Value, E> {
+        Ok(ContextPiece::I64(v))
+    }
+
+    fn visit_u32<E>(self, v: u32) -> Result<Self::Value, E> {
+        Ok(ContextPiece::U32(v))
+    }
+
+    fn visit_u64<E>(self, v: u64) -> Result<Self::Value, E> {
+        Ok(ContextPiece::U64(v))
+    }
+
+    // serde forwards the narrow widths to the 64-bit methods by default,
+    // which would read a `u8` as a `u64` context: a different identity.
+    fn visit_i8<E: de::Error>(self, v: i8) -> Result<Self::Value, E> {
+        Err(E::invalid_type(Unexpected::Signed(v.into()), &self))
+    }
+
+    fn visit_i16<E: de::Error>(self, v: i16) -> Result<Self::Value, E> {
+        Err(E::invalid_type(Unexpected::Signed(v.into()), &self))
+    }
+
+    fn visit_u8<E: de::Error>(self, v: u8) -> Result<Self::Value, E> {
+        Err(E::invalid_type(Unexpected::Unsigned(v.into()), &self))
+    }
+
+    fn visit_u16<E: de::Error>(self, v: u16) -> Result<Self::Value, E> {
+        Err(E::invalid_type(Unexpected::Unsigned(v.into()), &self))
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, mut seq: A) -> Result<Self::Value, A::Error> {
+        let mut parts = Vec::with_capacity(reserved(seq.size_hint()));
+        while let Some(Context(part)) = seq.next_element()? {
+            parts.push(part);
+        }
+        Ok(ContextPiece::List(parts))
+    }
+}
+
+/// How many elements to reserve room for before reading a list or an
+/// object a control frame declares `hint` of. The hint is the count the frame
+/// declares, which nothing has checked against the bytes that follow: a few
+/// bytes can declare four billion elements, which would abort the guest on
+/// allocation. So at most [`RESERVED`] are reserved, and a longer list grows as
+/// it is read.
+pub(super) fn reserved(hint: Option<usize>) -> usize {
+    hint.unwrap_or(0).min(RESERVED)
+}
+
+/// The most elements [`reserved`] reserves room for: more than a context or
+/// a plan holds in practice.
+const RESERVED: usize = 64;
+
 /// A view of a context tree that borrows its text and bytes, so a context
 /// parsed and proven once can be handed to every output of every row without
 /// copying the payloads. Integers are copied (they are the payload); the
@@ -163,13 +224,21 @@ pub fn borrowed<'b>(piece: &'b ContextPiece<'_>) -> ContextPiece<'b> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::dynamic::test_frame::frame_of;
+    use crate::dynamic::FfiValue;
     use crate::{nonempty, Descriptor, IntoAad, IntoPrfContext};
+    use vitaminc_aead_frame::serde::to_vec;
     use vitaminc_protected::Protected;
 
     fn s(value: &str) -> FfiValue {
         FfiValue::String(value.into())
     }
 
+    /// The context `value` spells, read from its frame.
+    fn ctx(value: FfiValue) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+        context(&frame_of(&value))
+    }
+
     /// `borrowed` is a view, so it must be the same context for every
     /// variant: one list holding each integer width, each byte-bearing
     /// piece, and a nested list is its own borrowed view. A variant this
@@ -217,7 +286,7 @@ mod tests {
 
     #[test]
     fn a_bare_string_is_the_flat_context() {
-        let parsed = context(s("users/age")).expect("flat context");
+        let parsed = ctx(s("users/age")).expect("flat context");
         assert_eq!(
             parsed.get(),
             &ContextPiece::Text(Cow::Borrowed("users/age")),
@@ -232,7 +301,7 @@ mod tests {
 
     #[test]
     fn a_list_encodes_as_the_tuple_on_both_sides() {
-        let parsed = context(FfiValue::Array(vec![s("users/age"), FfiValue::UInt64(7)]))
+        let parsed = ctx(FfiValue::Array(vec![s("users/age"), FfiValue::UInt64(7)]))
             .expect("extended context");
         let tuple = nonempty!("users/age").with(7u64);
         assert_eq!(
@@ -249,7 +318,7 @@ mod tests {
 
     #[test]
     fn a_list_renders_the_descriptor_the_tuple_does() {
-        let parsed = context(FfiValue::Array(vec![s("users"), s("age")])).expect("a pair");
+        let parsed = ctx(FfiValue::Array(vec![s("users"), s("age")])).expect("a pair");
         assert_eq!(
             Descriptor::of(parsed.into_inner()).as_str(),
             "users/age",
@@ -260,7 +329,7 @@ mod tests {
             "users/age",
             "the tuple renders the same descriptor"
         );
-        let parsed = context(FfiValue::Array(vec![
+        let parsed = ctx(FfiValue::Array(vec![
             FfiValue::Array(vec![s("users"), s("age")]),
             FfiValue::UInt64(7),
         ]))
@@ -278,7 +347,7 @@ mod tests {
 
     #[test]
     fn a_nested_list_encodes_as_the_nested_tuple() {
-        let parsed = context(FfiValue::Array(vec![
+        let parsed = ctx(FfiValue::Array(vec![
             s("users/age"),
             FfiValue::Array(vec![s("t"), FfiValue::Int32(-3)]),
         ]))
@@ -299,7 +368,7 @@ mod tests {
     /// The borrowed view is the same context as the owned tree.
     #[test]
     fn the_borrowed_view_encodes_as_the_owned_tree() {
-        let parsed = context(FfiValue::Array(vec![
+        let parsed = ctx(FfiValue::Array(vec![
             s("users/age"),
             FfiValue::Array(vec![
                 FfiValue::Bytes(Protected::new(b"k".to_vec())),
@@ -328,13 +397,13 @@ mod tests {
     #[test]
     fn a_left_nested_list_is_the_with_chain() {
         let chain = nonempty!("a").with(7u64).with("eu");
-        let nested = context(FfiValue::Array(vec![
+        let nested = ctx(FfiValue::Array(vec![
             FfiValue::Array(vec![s("a"), FfiValue::UInt64(7)]),
             s("eu"),
         ]))
         .expect("nested")
         .into_inner();
-        let flat = context(FfiValue::Array(vec![s("a"), FfiValue::UInt64(7), s("eu")]))
+        let flat = ctx(FfiValue::Array(vec![s("a"), FfiValue::UInt64(7), s("eu")]))
             .expect("flat")
             .into_inner();
         assert_eq!(
@@ -363,7 +432,7 @@ mod tests {
     /// (vitaminc 0.4.0 made the `Option` PRF context follow its parts view).
     #[test]
     fn a_one_element_list_is_some() {
-        let list = context(FfiValue::Array(vec![FfiValue::UInt64(7)]))
+        let list = ctx(FfiValue::Array(vec![FfiValue::UInt64(7)]))
             .expect("list")
             .into_inner();
         let some = Some(7u64);
@@ -386,8 +455,8 @@ mod tests {
 
     #[test]
     fn a_one_element_list_is_not_the_bare_part() {
-        let list = context(FfiValue::Array(vec![s("a")])).expect("list");
-        let bare = context(s("a")).expect("bare");
+        let list = ctx(FfiValue::Array(vec![s("a")])).expect("list");
+        let bare = ctx(s("a")).expect("bare");
         assert_ne!(
             list.clone().into_inner().into_aad().as_bytes(),
             bare.clone().into_inner().into_aad().as_bytes(),
@@ -404,8 +473,8 @@ mod tests {
     /// on both sides (vitaminc 0.5; before it they shared AAD bytes).
     #[test]
     fn text_and_bytes_are_distinct_contexts_on_both_sides() {
-        let text = context(s("ab")).expect("text").into_inner();
-        let bytes = context(FfiValue::Bytes(Protected::new(b"ab".to_vec())))
+        let text = ctx(s("ab")).expect("text").into_inner();
+        let bytes = ctx(FfiValue::Bytes(Protected::new(b"ab".to_vec())))
             .expect("bytes")
             .into_inner();
         assert_ne!(
@@ -433,7 +502,7 @@ mod tests {
             ),
         ] {
             assert!(
-                matches!(context(empty), Err(Error::Context { .. })),
+                matches!(ctx(empty), Err(Error::Context { .. })),
                 "{label} is empty by the tuple rule and must be refused"
             );
         }
@@ -449,7 +518,7 @@ mod tests {
             ),
         ] {
             assert!(
-                context(non_empty).is_ok(),
+                ctx(non_empty).is_ok(),
                 "{label} carries bytes and must be accepted"
             );
         }
@@ -473,9 +542,81 @@ mod tests {
             ),
         ] {
             assert!(
-                matches!(context(bad), Err(Error::Context { .. })),
+                matches!(ctx(bad), Err(Error::Context { .. })),
                 "{label} is not a context and must be refused"
             );
         }
     }
+
+    /// An integer's width is its identity, so only the four widths a
+    /// context takes are read, each at its own width; the others are
+    /// refused rather than widened.
+    #[test]
+    fn an_integer_is_read_at_its_own_width() {
+        let read = |frame: Vec<u8>| context(&frame).map(NonEmpty::into_inner);
+        assert_eq!(read(to_vec(&7i32).unwrap()).unwrap(), ContextPiece::I32(7));
+        assert_eq!(read(to_vec(&7i64).unwrap()).unwrap(), ContextPiece::I64(7));
+        assert_eq!(read(to_vec(&7u32).unwrap()).unwrap(), ContextPiece::U32(7));
+        assert_eq!(read(to_vec(&7u64).unwrap()).unwrap(), ContextPiece::U64(7));
+        for (label, frame) in [
+            ("an i8", to_vec(&7i8).unwrap()),
+            ("an i16", to_vec(&7i16).unwrap()),
+            ("a u8", to_vec(&7u8).unwrap()),
+            ("a u16", to_vec(&7u16).unwrap()),
+            ("an i128", to_vec(&7i128).unwrap()),
+            ("a u128", to_vec(&7u128).unwrap()),
+            ("a u8 in a list", to_vec(&("users", 7u8)).unwrap()),
+        ] {
+            assert!(
+                matches!(
+                    read(frame),
+                    Err(Error::Context {
+                        reason: Reason::ContextKind,
+                        ..
+                    })
+                ),
+                "{label} is not a context"
+            );
+        }
+    }
+
+    /// What a frame declares is reserved only up to a bound, whatever it
+    /// declares.
+    #[test]
+    fn a_declared_count_reserves_at_most_the_bound() {
+        assert_eq!(reserved(None), 0);
+        assert_eq!(reserved(Some(3)), 3);
+        assert_eq!(reserved(Some(RESERVED)), RESERVED);
+        assert_eq!(reserved(Some(u32::MAX as usize)), RESERVED);
+    }
+
+    /// A list that declares more parts than its frame holds is refused
+    /// when the parts run out, without reserving room for the count it
+    /// declared: four billion parts would abort the guest on allocation.
+    #[test]
+    fn a_list_that_declares_more_parts_than_it_holds_is_refused() {
+        let mut bytes = vec![vitaminc_aead::frame::ARRAY];
+        bytes.extend_from_slice(&u32::MAX.to_le_bytes());
+        assert!(matches!(
+            context(&bytes),
+            Err(Error::Context {
+                reason: Reason::ContextKind,
+                ..
+            })
+        ));
+    }
+
+    /// Bytes that are not one frame are not a context.
+    #[test]
+    fn bytes_that_are_not_a_frame_are_refused() {
+        for bytes in [&[][..], &[0xff, 1, 2], &to_vec(&"a").unwrap()[..2]] {
+            assert!(matches!(
+                context(bytes),
+                Err(Error::Context {
+                    reason: Reason::ContextKind,
+                    ..
+                })
+            ));
+        }
+    }
 }
diff --git a/packages/stack-encrypt/src/dynamic/mod.rs b/packages/stack-encrypt/src/dynamic/mod.rs
index c65dad12c..307c2612d 100644
--- a/packages/stack-encrypt/src/dynamic/mod.rs
+++ b/packages/stack-encrypt/src/dynamic/mod.rs
@@ -21,12 +21,13 @@
 //! indexed by walking its frame into the encrypting sink and the term
 //! derivers; and a record opens straight into a frame (vitaminc ADR 0001: a
 //! value describes itself once, and sinks consume it). A binding's control
-//! data (a plan, a context, options, a configuration, whose credentials are
-//! secret) is an [`FfiValue`] tree, with its text and bytes wiped.
+//! data (a plan, a context, query statistics) is read from its frame by
+//! serde (`vitaminc_aead_frame::serde`) into a typed message, with no tree
+//! built.
 //!
 //! # What is here
 //!
-//! * [`context`](context()) — an [`FfiValue`] read as an encryption context.
+//! * [`context`](context()) — a frame read as an encryption context.
 //! * [`ValueFrame`] — the engine's plaintext for a value whose type is known
 //!   only at run time, and the value model it holds.
 //! * [`term`](term()) — one index term for a value, derived at the one
@@ -91,6 +92,8 @@ mod query;
 pub mod record;
 mod target;
 mod term;
+#[cfg(test)]
+mod test_frame;
 mod value_frame;
 
 use std::fmt;
@@ -108,8 +111,8 @@ pub use ffi_value::{
 };
 pub use kind::{admits, not_admitted, read};
 pub use query::{
-    check_query, field_operators, limit_to_value, operator_to_value, query_term, target_limit,
-    verify, Fidelity, OpSpec, Operand, QueryTerm,
+    check_query, field_operators, query_term, target_limit, verify, Fidelity, OpSpec, Operand,
+    OperatorEntry, QueryTerm,
 };
 pub use record::{FieldPlan, Output, Plan};
 pub use target::{NoTargets, TargetDescriptor, TargetError, TargetResolver};
@@ -157,12 +160,22 @@ impl<K> fmt::Debug for Scope<'_, K> {
     }
 }
 
-/// The UTF-8 inside a string leaf. Valid by `Utf8String`'s construction
-/// invariant; checked rather than assumed because this is boundary code.
+/// The UTF-8 inside a string leaf, for tests. Valid by `Utf8String`'s
+/// construction invariant; checked rather than assumed.
+#[cfg(test)]
 fn utf8(s: &Utf8String) -> Option<&str> {
     std::str::from_utf8(s.risky_ref()).ok()
 }
 
+/// Bytes, written as a frame's bytes leaf rather than a list of integers.
+struct WireBytes<'a>(&'a [u8]);
+
+impl serde::Serialize for WireBytes<'_> {
+    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_bytes(self.0)
+    }
+}
+
 /// What went wrong in a dynamic operation.
 ///
 /// The split that matters to a caller is malformed input versus something
@@ -484,7 +497,9 @@ reasons! {
         /// A context value is of a kind a context cannot hold: a boolean,
         /// float, null, object or passthrough.
         ContextKind => "context_kind", "a boolean, float, null, object or passthrough cannot be a context";
-        /// A context string is not UTF-8.
+        /// A context string is not UTF-8. No longer produced: a frame's
+        /// text is UTF-8 by construction. Kept so a binding that switches on
+        /// it still compiles.
         ContextNotUtf8 => "context_not_utf8", "a context string is not UTF-8";
         /// A context renders empty.
         EmptyContext => "empty_context", "the context renders empty";
@@ -588,7 +603,7 @@ reasons! {
         /// The term is not one the field's index derives for the operator.
         NotAQueryTerm => "not_a_query_term", "the term is not one the field's index derives for the operator";
         /// Statistics are not a row count with an optional histogram and
-        /// confidence ([`Stats::from_value`](crate::op::Stats::from_value)).
+        /// confidence ([`Stats::from_frame`](crate::op::Stats::from_frame)).
         NotStats => "not_stats", "the statistics are not a row count with an optional histogram and confidence";
     }
 }
diff --git a/packages/stack-encrypt/src/dynamic/query.rs b/packages/stack-encrypt/src/dynamic/query.rs
index e283c9b21..daff8f1fa 100644
--- a/packages/stack-encrypt/src/dynamic/query.rs
+++ b/packages/stack-encrypt/src/dynamic/query.rs
@@ -17,7 +17,7 @@
 //!   the field does not answer as it refuses a value of the wrong type, with
 //!   [`Error::Source`] naming the field.
 //! - [`field_operators`] lists the operators a plan field answers, each with
-//!   the index that answers it ([`operator_to_value`] writes one): what a
+//!   the index that answers it ([`OperatorEntry`] is one's wire form): what a
 //!   generator asks before the program runs, so it writes one query method
 //!   per operator the engine answers and holds no copy of the table.
 //! - [`verify`] and [`target_limit`] are a probabilistic term's two
@@ -58,13 +58,18 @@
 //! # Wire format
 //!
 //! An operator is its [`name`](OpSpec::name). A query term is the object
-//! [`QueryTerm::to_value`] writes, the statistics the object
-//! [`Stats::from_value`] reads, and a limit the value
-//! [`limit_to_value`] writes; each is documented where it is written.
+//! [`QueryTerm`] serializes to, the statistics the frame object
+//! [`Stats::from_frame`] reads, and a limit [`Limit::rows`]: an unsigned
+//! 64-bit integer, or null for no finite fetch. Each answer is written to a
+//! frame by serde (`vitaminc_aead_frame::serde`) and documented on its
+//! type.
 //!
 //! [`Probabilistic::verify`]: crate::op::Probabilistic::verify
 //! [`Probabilistic::target_limit`]: crate::op::Probabilistic::target_limit
 
+use serde::{Serialize, Serializer};
+
+use super::WireBytes;
 use std::cmp::Ordering;
 use std::fmt;
 
@@ -75,7 +80,7 @@ use super::term::OneScalar;
 use super::term::{derive, Use};
 use super::value_frame::Parts;
 use super::ValueKind;
-use super::{admits, read, Error, FfiValue, Reason, TargetDescriptor, TargetResolver, ValueFrame};
+use super::{admits, read, Error, Reason, TargetDescriptor, TargetResolver, ValueFrame};
 use crate::op::{Limit, Stats};
 use crate::sem::{match_limit, MatchOptions, QueryTokens, TermError};
 use crate::target::IndexSpec;
@@ -304,6 +309,46 @@ pub enum Operand {
     },
 }
 
+/// The term in its wire form: an object with every key present, an
+/// absent value null.
+///
+/// | key | value |
+/// |---|---|
+/// | `operator` | string: the [operator's name](OpSpec::name), `"matches"` |
+/// | `fidelity` | string: `"exact"` or `"probabilistic"` ([`Fidelity::name`]) |
+/// | `index` | string: the [key](IndexSpec::key) of the index that answers, `"match"` |
+/// | `domain` | string or null: the query value's PostgreSQL domain, for a field that names an EQL type |
+/// | `term` | bytes: the term, or for `between` a list of two byte strings, the low bound's term then the high's |
+impl Serialize for QueryTerm {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        #[derive(Serialize)]
+        struct Wire<'a> {
+            operator: &'static str,
+            fidelity: &'static str,
+            index: &'static str,
+            domain: Option<&'a str>,
+            term: Term<'a>,
+        }
+        #[derive(Serialize)]
+        #[serde(untagged)]
+        enum Term<'a> {
+            One(WireBytes<'a>),
+            Range([WireBytes<'a>; 2]),
+        }
+        Wire {
+            operator: self.operator.name(),
+            fidelity: self.fidelity().name(),
+            index: self.index.key(),
+            domain: self.domain.as_deref(),
+            term: match &self.operand {
+                Operand::One(term) => Term::One(WireBytes(term)),
+                Operand::Range { lo, hi } => Term::Range([WireBytes(lo), WireBytes(hi)]),
+            },
+        }
+        .serialize(s)
+    }
+}
+
 impl QueryTerm {
     /// The operator the term answers.
     pub fn operator(&self) -> OpSpec {
@@ -330,45 +375,6 @@ impl QueryTerm {
     pub fn operand(&self) -> &Operand {
         &self.operand
     }
-
-    /// The term in its wire form: an object with every key present, an
-    /// absent value null.
-    ///
-    /// | key | value |
-    /// |---|---|
-    /// | `operator` | string: the [operator's name](OpSpec::name), `"matches"` |
-    /// | `fidelity` | string: `"exact"` or `"probabilistic"` ([`Fidelity::name`]) |
-    /// | `index` | string: the [key](IndexSpec::key) of the index that answers, `"match"` |
-    /// | `domain` | string or null: the query value's PostgreSQL domain, for a field that names an EQL type |
-    /// | `term` | bytes: the term, or for `between` a list of two byte strings, the low bound's term then the high's |
-    pub fn to_value(&self) -> FfiValue {
-        let bytes = |b: &[u8]| FfiValue::Bytes(vitaminc_protected::Protected::new(b.to_vec()));
-        let term = match &self.operand {
-            Operand::One(term) => bytes(term),
-            Operand::Range { lo, hi } => FfiValue::Array(vec![bytes(lo), bytes(hi)]),
-        };
-        FfiValue::Object(vec![
-            (
-                "operator".to_owned(),
-                FfiValue::String(self.operator.name().into()),
-            ),
-            (
-                "fidelity".to_owned(),
-                FfiValue::String(self.fidelity().name().into()),
-            ),
-            (
-                "index".to_owned(),
-                FfiValue::String(self.index.key().into()),
-            ),
-            (
-                "domain".to_owned(),
-                self.domain
-                    .as_deref()
-                    .map_or(FfiValue::Null, |domain| FfiValue::String(domain.into())),
-            ),
-            ("term".to_owned(), term),
-        ])
-    }
 }
 
 /// The field a query is about, and the index that answers its operator.
@@ -470,27 +476,21 @@ fn answers(
 /// answers what the type's [`TargetDescriptor::operators`] lists; a field
 /// with no declared kind answers none. The context does not matter, so a
 /// plan whose context is a field of each record is taken. Write each entry
-/// with [`operator_to_value`].
+/// as an [`OperatorEntry`].
 ///
 /// ```
-/// use stack_encrypt::dynamic::{field_operators, record, FfiValue, NoTargets, OpSpec};
+/// use stack_encrypt::dynamic::{field_operators, record, NoTargets, OpSpec};
 /// use stack_encrypt::target::IndexSpec;
 ///
-/// let text = |s: &str| FfiValue::String(s.into());
-/// let plan = record::plan(FfiValue::Object(vec![(
-///     "age".into(),
-///     FfiValue::Object(vec![
-///         ("context".into(), FfiValue::Array(vec![text("users"), text("age")])),
-///         ("outputs".into(), FfiValue::Array(vec![text("c"), text("eq"), text("ore")])),
-///         ("type".into(), text("uint32")),
-///     ]),
-/// )]))?;
+/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+///     "age": { "context": ["users", "age"], "outputs": ["c", "eq", "ore"], "type": "uint32" },
+/// }))?)?;
 ///
 /// let operators = field_operators(&plan, "age", &NoTargets)?;
 /// assert_eq!(operators[0], (OpSpec::Eq, IndexSpec::Equality));
 /// assert_eq!(operators[1], (OpSpec::Lt, IndexSpec::Ore));
 /// assert_eq!(operators.len(), 6, "eq, the four comparisons and between");
-/// # Ok::<(), stack_encrypt::dynamic::Error>(())
+/// # Ok::<(), Box<dyn std::error::Error>>(())
 /// ```
 ///
 /// # Errors
@@ -515,17 +515,24 @@ pub fn field_operators(
 /// | `fidelity` | string: `exact` or `probabilistic` ([`Fidelity::name`]) |
 /// | `arity` | string: `one`, or `pair` for an operator whose input is two values, low then high |
 /// | `index` | string: the [key](IndexSpec::key) of the index that answers it, `eq` |
-pub fn operator_to_value(operator: OpSpec, index: &IndexSpec) -> FfiValue {
-    let text = |s: &str| FfiValue::String(s.into());
-    FfiValue::Object(vec![
-        ("operator".to_owned(), text(operator.name())),
-        ("fidelity".to_owned(), text(operator.fidelity().name())),
-        (
-            "arity".to_owned(),
-            text(if operator.takes_pair() { "pair" } else { "one" }),
-        ),
-        ("index".to_owned(), text(index.key())),
-    ])
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize)]
+pub struct OperatorEntry {
+    operator: &'static str,
+    fidelity: &'static str,
+    arity: &'static str,
+    index: &'static str,
+}
+
+impl OperatorEntry {
+    /// The entry for `operator`, answered by `index`.
+    pub fn new(operator: OpSpec, index: &IndexSpec) -> Self {
+        Self {
+            operator: operator.name(),
+            fidelity: operator.fidelity().name(),
+            arity: if operator.takes_pair() { "pair" } else { "one" },
+            index: index.key(),
+        }
+    }
 }
 
 /// Refuse a plan whose context is a field of each record: a term derives
@@ -699,15 +706,9 @@ pub fn check_query(
 /// # tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(async {
 /// let cipher = StackCipher::builder().kms(FakeDataKeySource::new()).init().await?;
 /// let keyset = cipher.default_keyset();
-/// let text = |s: &str| FfiValue::String(s.into());
-/// let plan = record::plan(FfiValue::Object(vec![(
-///     "age".into(),
-///     FfiValue::Object(vec![
-///         ("context".into(), FfiValue::Array(vec![text("users"), text("age")])),
-///         ("outputs".into(), FfiValue::Array(vec![text("c"), text("ore")])),
-///         ("type".into(), text("uint32")),
-///     ]),
-/// )]))?;
+/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+///     "age": { "context": ["users", "age"], "outputs": ["c", "ore"], "type": "uint32" },
+/// }))?)?;
 ///
 /// let term = query_term(&keyset, &plan, "age", OpSpec::Lt, FfiValue::UInt32(40), &NoTargets)?.await?;
 ///
@@ -946,7 +947,7 @@ fn twin_query_bits(term: &[u8], options: &MatchOptions) -> Option<usize> {
 }
 
 impl Stats {
-    /// Read statistics from their wire form, an object:
+    /// Read statistics from their wire form, a frame object:
     ///
     /// | key | value |
     /// |---|---|
@@ -954,83 +955,77 @@ impl Stats {
     /// | `histogram` | optional, or null: a list of `[bits, rows]` pairs of integers, a measured histogram of the stored filters' set-bit counts ([`Stats::measured`]); absent, the declared prior ([`Stats::declared`]) |
     /// | `confidence` | optional, or null: a float, the confidence to target instead of 99% ([`Stats::with_confidence`]) |
     ///
-    /// Integers are read at any width and must not be negative.
+    /// Integers are read at any width up to 64 bits and must not be
+    /// negative; `bits` must fit a `u32`. A confidence is a float of either
+    /// width, never an integer.
     ///
     /// # Errors
     ///
-    /// [`Error::Source`] with [`Reason::NotStats`] for anything else: not an
-    /// object, no `rows`, a key given twice or not one of the three, or a
-    /// value of another type.
-    pub fn from_value(value: &FfiValue) -> Result<Self, Error> {
-        let refused = || Error::bad_source(Reason::NotStats);
-        let FfiValue::Object(entries) = value else {
-            return Err(refused());
-        };
-        let mut seen: Vec<&str> = Vec::with_capacity(entries.len());
-        let (mut rows, mut histogram, mut confidence) = (None, None, None);
-        for (key, value) in entries {
-            if seen.contains(&key.as_str()) {
-                return Err(refused());
-            }
-            seen.push(key);
-            match (key.as_str(), value) {
-                ("histogram" | "confidence", FfiValue::Null) => {}
-                ("rows", rows_value) => rows = Some(unsigned(rows_value).ok_or_else(refused)?),
-                ("histogram", FfiValue::Array(buckets)) => {
-                    histogram = Some(
-                        buckets
-                            .iter()
-                            .map(|bucket| match bucket {
-                                FfiValue::Array(pair) => match pair.as_slice() {
-                                    [bits, rows] => Some((
-                                        u32::try_from(unsigned(bits)?).ok()?,
-                                        unsigned(rows)?,
-                                    )),
-                                    _ => None,
-                                },
-                                _ => None,
-                            })
-                            .collect::<Option<Vec<(u32, u64)>>>()
-                            .ok_or_else(refused)?,
-                    );
-                }
-                ("confidence", FfiValue::Float64(c)) => confidence = Some(*c),
-                ("confidence", FfiValue::Float32(c)) => confidence = Some(f64::from(*c)),
-                _ => return Err(refused()),
-            }
-        }
-        let rows = rows.ok_or_else(refused)?;
-        let stats = match histogram {
-            Some(histogram) => Stats::measured(rows, histogram),
-            None => Stats::declared(rows),
+    /// [`Error::Source`] with [`Reason::NotStats`] for anything else: not a
+    /// frame, not an object, no `rows`, a key given twice or not one of the
+    /// three, or a value of another type.
+    pub fn from_frame(bytes: &[u8]) -> Result<Self, Error> {
+        let wire: StatsWire = vitaminc_aead_frame::serde::from_slice(bytes)
+            .map_err(|_| Error::bad_source(Reason::NotStats))?;
+        let stats = match wire.histogram {
+            Some(histogram) => Stats::measured(wire.rows, histogram),
+            None => Stats::declared(wire.rows),
         };
-        Ok(match confidence {
-            Some(confidence) => stats.with_confidence(confidence),
+        Ok(match wire.confidence {
+            Some(Confidence(confidence)) => stats.with_confidence(confidence),
             None => stats,
         })
     }
 }
 
-/// A non-negative integer of any width.
-fn unsigned(value: &FfiValue) -> Option<u64> {
-    match value {
-        FfiValue::Int32(v) => u64::try_from(*v).ok(),
-        FfiValue::Int64(v) => u64::try_from(*v).ok(),
-        FfiValue::UInt32(v) => Some(u64::from(*v)),
-        FfiValue::UInt64(v) => Some(*v),
-        _ => None,
-    }
+/// [`Stats`] as a binding writes it ([`Stats::from_frame`]).
+#[derive(serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+struct StatsWire {
+    rows: u64,
+    #[serde(default)]
+    histogram: Option<Vec<(u32, u64)>>,
+    #[serde(default)]
+    confidence: Option<Confidence>,
 }
 
-/// A limit in its wire form: the rows to fetch as an unsigned 64-bit
-/// integer, or null for [`Limit::Unbounded`].
-pub fn limit_to_value(limit: Limit) -> FfiValue {
-    limit.rows().map_or(FfiValue::Null, FfiValue::UInt64)
+/// A confidence: a float of either width. serde's own `f64` would also take
+/// an integer, which the wire form refuses.
+struct Confidence(f64);
+
+impl<'de> serde::Deserialize<'de> for Confidence {
+    fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        struct V;
+        impl serde::de::Visitor<'_> for V {
+            type Value = Confidence;
+            fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                f.write_str("a float")
+            }
+            fn visit_f32<E>(self, v: f32) -> Result<Confidence, E> {
+                Ok(Confidence(f64::from(v)))
+            }
+            fn visit_f64<E>(self, v: f64) -> Result<Confidence, E> {
+                Ok(Confidence(v))
+            }
+        }
+        d.deserialize_any(V)
+    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::dynamic::test_frame::{frame_of, value_of};
+    use crate::dynamic::FfiValue;
+
+    fn operator_value(operator: OpSpec, index: &IndexSpec) -> FfiValue {
+        value_of(&OperatorEntry::new(operator, index))
+    }
+
+    /// Statistics as a binding sends them.
+    fn stats_frame(value: &FfiValue) -> Result<Stats, Error> {
+        Stats::from_frame(&crate::dynamic::test_frame::frame_of(value))
+    }
     use crate::dynamic::{record, NoTargets, TargetError};
     use crate::op::{self, Probabilistic as _};
     use crate::sem::MatchTerms;
@@ -1077,14 +1072,14 @@ mod tests {
             "match".into(),
             FfiValue::Object(vec![("downcase".into(), FfiValue::Bool(false))]),
         )]);
-        record::plan(FfiValue::Object(vec![
+        record::plan(&frame_of(&FfiValue::Object(vec![
             field("email", "string", vec![text("c"), text("eq")]),
             field("name", "string", vec![text("c"), text("match")]),
             field("age", "uint32", vec![text("c"), text("ope"), text("ore")]),
             field("score", "int64", vec![text("ope")]),
             field("nickname", "string", vec![text("c"), text("ore")]),
             field("handle", "string", vec![text("c"), case_sensitive]),
-        ]))
+        ])))
         .expect("the plan parses")
     }
 
@@ -1477,11 +1472,11 @@ mod tests {
                 ]),
             )
         };
-        let plan = record::plan(FfiValue::Object(vec![
+        let plan = record::plan(&frame_of(&FfiValue::Object(vec![
             ("context_field".into(), text("tenant")),
             one("tenant", "string", "passthrough"),
             one("email", "string", "eq"),
-        ]))
+        ])))
         .unwrap();
         let error = query_term(&keyset, &plan, "email", OpSpec::Eq, text("a"), &NoTargets)
             .map(drop)
@@ -1637,8 +1632,10 @@ mod tests {
             tokenizer: crate::sem::Tokenizer::Ngram { length: 0 },
             ..MatchOptions::default()
         };
-        let context = crate::dynamic::context(FfiValue::Array(vec![text("users"), text("name")]))
-            .expect("context");
+        let context = crate::dynamic::context(
+            &vitaminc_aead_frame::serde::to_vec(&("users", "name")).expect("frames"),
+        )
+        .expect("context");
         let field = FieldPlan::new(
             "name",
             context,
@@ -1772,11 +1769,11 @@ mod tests {
             FfiValue::Array(vec![FfiValue::UInt32(bits), FfiValue::UInt64(rows)])
         };
         assert_eq!(
-            Stats::from_value(&object(vec![("rows", FfiValue::UInt64(9))])).unwrap(),
+            stats_frame(&object(vec![("rows", FfiValue::UInt64(9))])).unwrap(),
             Stats::declared(9)
         );
         assert_eq!(
-            Stats::from_value(&object(vec![
+            stats_frame(&object(vec![
                 ("rows", FfiValue::Int64(9)),
                 ("histogram", FfiValue::Null),
                 ("confidence", FfiValue::Null),
@@ -1785,7 +1782,7 @@ mod tests {
             Stats::declared(9)
         );
         assert_eq!(
-            Stats::from_value(&object(vec![
+            stats_frame(&object(vec![
                 ("histogram", FfiValue::Array(vec![pair(3, 4), pair(5, 6)])),
                 ("confidence", FfiValue::Float64(0.9)),
                 ("rows", FfiValue::UInt32(10)),
@@ -1795,6 +1792,18 @@ mod tests {
         );
         for (what, bad) in [
             ("not an object", FfiValue::UInt64(9)),
+            (
+                "an array by position",
+                FfiValue::Array(vec![FfiValue::UInt64(9)]),
+            ),
+            (
+                "every key by position",
+                FfiValue::Array(vec![
+                    FfiValue::UInt64(9),
+                    FfiValue::Array(vec![pair(3, 4)]),
+                    FfiValue::Float64(0.5),
+                ]),
+            ),
             ("no rows", object(vec![])),
             ("null rows", object(vec![("rows", FfiValue::Null)])),
             ("negative rows", object(vec![("rows", FfiValue::Int64(-1))])),
@@ -1840,8 +1849,15 @@ mod tests {
                     ("confidence", text("high")),
                 ]),
             ),
+            (
+                "confidence as an integer",
+                object(vec![
+                    ("rows", FfiValue::UInt64(1)),
+                    ("confidence", FfiValue::UInt64(1)),
+                ]),
+            ),
         ] {
-            let error = Stats::from_value(&bad).unwrap_err();
+            let error = stats_frame(&bad).unwrap_err();
             assert_eq!(reason_of(&error), (None, Some(Reason::NotStats)), "{what}");
         }
     }
@@ -1857,13 +1873,13 @@ mod tests {
         use vitaminc_aead::plaintext::{Int, Logical, Physical, Raw, TimeUnit};
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
-        let plan = record::plan(FfiValue::Object(vec![
+        let plan = record::plan(&frame_of(&FfiValue::Object(vec![
             field("tiny", "int8", vec![text("c"), text("ore")]),
             field("huge", "int128", vec![text("c"), text("ope")]),
             field("day", "date", vec![text("c"), text("eq")]),
             field("at", "timestamp", vec![text("c"), text("eq")]),
             field("price", "decimal", vec![text("c"), text("eq")]),
-        ]))
+        ])))
         .expect("the plan parses");
         let frame = |ty: Option<Logical>, value: Physical<'_>| {
             ValueFrame::of(Raw(ty, value)).expect("a value")
@@ -1933,8 +1949,10 @@ mod tests {
 
         let stored = |value: &ValueFrame, name: &'static str| {
             let keyset = &keyset;
-            let ctx = super::super::context(FfiValue::Array(vec![text("users"), text(name)]))
-                .expect("context");
+            let ctx = super::super::context(
+                &vitaminc_aead_frame::serde::to_vec(&("users", name)).expect("frames"),
+            )
+            .expect("context");
             let value = value.clone();
             async move {
                 super::super::term(keyset, &value, &IndexSpec::Equality, ctx)
@@ -2054,14 +2072,23 @@ mod tests {
 
     #[test]
     fn a_count_is_read_at_any_width_and_never_negative() {
-        assert_eq!(unsigned(&FfiValue::Int32(7)), Some(7));
-        assert_eq!(unsigned(&FfiValue::Int64(7)), Some(7));
-        assert_eq!(unsigned(&FfiValue::UInt32(7)), Some(7));
-        assert_eq!(unsigned(&FfiValue::UInt64(7)), Some(7));
-        assert_eq!(unsigned(&FfiValue::Int32(-7)), None);
-        assert_eq!(unsigned(&FfiValue::Int64(-7)), None);
-        assert_eq!(unsigned(&FfiValue::Float64(7.0)), None);
-        let confidence = Stats::from_value(&FfiValue::Object(vec![
+        let rows = |value: FfiValue| stats_frame(&FfiValue::Object(vec![("rows".into(), value)]));
+        for value in [
+            FfiValue::Int32(7),
+            FfiValue::Int64(7),
+            FfiValue::UInt32(7),
+            FfiValue::UInt64(7),
+        ] {
+            assert_eq!(rows(value).unwrap(), Stats::declared(7));
+        }
+        for value in [
+            FfiValue::Int32(-7),
+            FfiValue::Int64(-7),
+            FfiValue::Float64(7.0),
+        ] {
+            assert!(rows(value).is_err());
+        }
+        let confidence = stats_frame(&FfiValue::Object(vec![
             ("rows".into(), FfiValue::Int32(3)),
             ("confidence".into(), FfiValue::Float32(0.5)),
         ]))
@@ -2072,10 +2099,10 @@ mod tests {
     #[test]
     fn a_limit_is_its_rows_or_null() {
         assert!(matches!(
-            limit_to_value(Limit::Rows(11)),
+            value_of(&Limit::Rows(11).rows()),
             FfiValue::UInt64(11)
         ));
-        assert!(matches!(limit_to_value(Limit::Unbounded), FfiValue::Null));
+        assert!(matches!(value_of(&Limit::Unbounded.rows()), FfiValue::Null));
     }
 
     #[tokio::test]
@@ -2090,7 +2117,7 @@ mod tests {
         )
         .await
         .unwrap();
-        let FfiValue::Object(entries) = term.to_value() else {
+        let FfiValue::Object(entries) = value_of(&term) else {
             panic!("an object");
         };
         let keys: Vec<&str> = entries.iter().map(|(k, _)| k.as_str()).collect();
@@ -2176,7 +2203,7 @@ mod tests {
     #[test]
     fn a_targets_operators_are_listed_in_its_wire_form() {
         let FfiValue::Object(entries) =
-            descriptor(Some(ValueKind::Int64), &["ore"], true, true).to_value()
+            value_of(&descriptor(Some(ValueKind::Int64), &["ore"], true, true))
         else {
             panic!("an object");
         };
@@ -2276,7 +2303,7 @@ mod tests {
 
     #[test]
     fn an_operator_is_written_with_every_key_in_order() {
-        let FfiValue::Object(entries) = operator_to_value(OpSpec::Between, &IndexSpec::Ope) else {
+        let FfiValue::Object(entries) = operator_value(OpSpec::Between, &IndexSpec::Ope) else {
             panic!("an object");
         };
         let entries: Vec<(&str, &[u8])> = entries
@@ -2296,7 +2323,7 @@ mod tests {
             ]
         );
         let FfiValue::Object(entries) =
-            operator_to_value(OpSpec::Matches, &IndexSpec::Match(MatchOptions::default()))
+            operator_value(OpSpec::Matches, &IndexSpec::Match(MatchOptions::default()))
         else {
             panic!("an object");
         };
@@ -2354,7 +2381,7 @@ mod tests {
 
     fn match_type_plan() -> Plan {
         record::plan_with(
-            FfiValue::Object(vec![(
+            &frame_of(&FfiValue::Object(vec![(
                 "name".into(),
                 FfiValue::Object(vec![
                     (
@@ -2363,7 +2390,7 @@ mod tests {
                     ),
                     ("target".into(), text("Some")),
                 ]),
-            )]),
+            )])),
             &MatchType,
         )
         .unwrap()
@@ -2533,7 +2560,7 @@ mod tests {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
         let plan = record::plan_with(
-            FfiValue::Object(vec![(
+            &frame_of(&FfiValue::Object(vec![(
                 "email".into(),
                 FfiValue::Object(vec![
                     (
@@ -2542,7 +2569,7 @@ mod tests {
                     ),
                     ("target".into(), text("Some")),
                 ]),
-            )]),
+            )])),
             &OneType,
         )
         .unwrap();
@@ -2583,3 +2610,185 @@ mod tests {
         );
     }
 }
+
+/// The engine's answers, pinned byte for byte: these are the frames the
+/// FfiValue encoders wrote before the answers were written by serde, and a
+/// binding reads them.
+#[cfg(test)]
+mod wire_bytes {
+    use super::*;
+    use crate::sem::{MatchOptions, Tokenizer};
+    use vitaminc_aead_frame::serde::to_vec;
+
+    fn hex<T: Serialize>(value: &T) -> String {
+        to_vec(value)
+            .expect("frames")
+            .iter()
+            .map(|b| format!("{b:02x}"))
+            .collect()
+    }
+
+    fn indexes() -> Vec<IndexSpec> {
+        vec![
+            IndexSpec::Equality,
+            IndexSpec::Match(MatchOptions::default()),
+            IndexSpec::Match(MatchOptions {
+                tokenizer: Tokenizer::Standard,
+                downcase: false,
+                k: 4,
+                m: 512,
+            }),
+            IndexSpec::Match(MatchOptions {
+                tokenizer: Tokenizer::Ngram { length: 4 },
+                ..MatchOptions::default()
+            }),
+            IndexSpec::Ore,
+            IndexSpec::Ope,
+        ]
+    }
+
+    fn descriptor(
+        kind: Option<ValueKind>,
+        indexes: &[&str],
+        query: bool,
+        producible: bool,
+    ) -> TargetDescriptor {
+        TargetDescriptor::new(
+            "Some",
+            "some",
+            "",
+            kind,
+            "public.some",
+            indexes.iter().map(|i| (*i).to_owned()).collect(),
+            query.then(|| "SomeQuery".to_owned()),
+            query.then(|| "eql_v3.query_some".to_owned()),
+            producible,
+            (!producible).then(|| "not yet".to_owned()),
+        )
+    }
+
+    /// Every index, and every operator entry under it; three query terms,
+    /// one a range and one with a domain; four limits; three pages of
+    /// verdicts; four catalog entries.
+    #[test]
+    fn every_answer_writes_its_pinned_bytes() {
+        let mut written = Vec::new();
+        for index in indexes() {
+            written.push(hex(&index));
+            for op in OpSpec::ALL {
+                written.push(hex(&OperatorEntry::new(op, &index)));
+            }
+        }
+        for term in [
+            QueryTerm {
+                operator: OpSpec::Eq,
+                index: IndexSpec::Equality,
+                domain: None,
+                operand: Operand::One(vec![1, 2, 3]),
+            },
+            QueryTerm {
+                operator: OpSpec::Between,
+                index: IndexSpec::Ope,
+                domain: Some("eql_v4.query_int".to_owned()),
+                operand: Operand::Range {
+                    lo: vec![4],
+                    hi: vec![5, 6],
+                },
+            },
+            QueryTerm {
+                operator: OpSpec::Matches,
+                index: IndexSpec::Match(MatchOptions::default()),
+                domain: None,
+                operand: Operand::One(Vec::new()),
+            },
+        ] {
+            written.push(hex(&term));
+        }
+        for limit in [
+            Limit::Rows(0),
+            Limit::Rows(11),
+            Limit::Rows(u64::MAX),
+            Limit::Unbounded,
+        ] {
+            written.push(hex(&limit.rows()));
+        }
+        for page in [vec![], vec![true], vec![true, false, true]] {
+            written.push(hex(&page));
+        }
+        for target in [
+            descriptor(Some(ValueKind::String), &["eq", "match"], true, true),
+            descriptor(Some(ValueKind::String), &["eq", "match"], true, true)
+                .with_match_options(MatchOptions::default()),
+            descriptor(Some(ValueKind::Int64), &["ore"], true, true),
+            descriptor(None, &[], false, false),
+        ] {
+            written.push(hex(&target));
+        }
+        assert_eq!(written, PINNED);
+    }
+
+    const PINNED: [&str; 62] = [
+        "0a020000006571",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "0a050000006d61746368",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f101000000050000006d61746368f10400000009000000746f6b656e697a65720a080000007374616e6461726408000000646f776e6361736502010000006b070400000000000000010000006d070002000000000000",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f101000000050000006d61746368f10400000009000000746f6b656e697a6572f101000000050000006e6772616d07040000000000000008000000646f776e6361736503010000006b070300000000000000010000006d070001000000000000",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "0a030000006f7265",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "0a030000006f7065",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f105000000080000006f70657261746f720a02000000657108000000666964656c6974790a05000000657861637405000000696e6465780a02000000657106000000646f6d61696e00040000007465726d0b03000000010203",
+        "f105000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a05000000657861637405000000696e6465780a030000006f706506000000646f6d61696e0a1000000065716c5f76342e71756572795f696e74040000007465726df0020000000b01000000040b020000000506",
+        "f105000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c697374696305000000696e6465780a050000006d6174636806000000646f6d61696e00040000007465726d0b00000000",
+        "070000000000000000",
+        "070b00000000000000",
+        "07ffffffffffffffff",
+        "00",
+        "f000000000",
+        "f00100000003",
+        "f003000000030203",
+        "f10b000000040000006e616d650a04000000536f6d650600000066616d696c790a04000000736f6d65060000007375666669780a0000000009000000706c61696e746578740a06000000737472696e670a00000073716c5f646f6d61696e0a0b0000007075626c69632e736f6d6507000000696e6465786573f0020000000a0200000065710a050000006d617463680500000071756572790a09000000536f6d6551756572791000000071756572795f73716c5f646f6d61696e0a1100000065716c5f76332e71756572795f736f6d650a00000070726f64756369626c650306000000726561736f6e00090000006f70657261746f7273f001000000f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f10b000000040000006e616d650a04000000536f6d650600000066616d696c790a04000000736f6d65060000007375666669780a0000000009000000706c61696e746578740a06000000737472696e670a00000073716c5f646f6d61696e0a0b0000007075626c69632e736f6d6507000000696e6465786573f0020000000a0200000065710a050000006d617463680500000071756572790a09000000536f6d6551756572791000000071756572795f73716c5f646f6d61696e0a1100000065716c5f76332e71756572795f736f6d650a00000070726f64756369626c650306000000726561736f6e00090000006f70657261746f7273f002000000f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f10b000000040000006e616d650a04000000536f6d650600000066616d696c790a04000000736f6d65060000007375666669780a0000000009000000706c61696e746578740a05000000696e7436340a00000073716c5f646f6d61696e0a0b0000007075626c69632e736f6d6507000000696e6465786573f0010000000a030000006f72650500000071756572790a09000000536f6d6551756572791000000071756572795f73716c5f646f6d61696e0a1100000065716c5f76332e71756572795f736f6d650a00000070726f64756369626c650306000000726561736f6e00090000006f70657261746f7273f004000000f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f10b000000040000006e616d650a04000000536f6d650600000066616d696c790a04000000736f6d65060000007375666669780a0000000009000000706c61696e74657874000a00000073716c5f646f6d61696e0a0b0000007075626c69632e736f6d6507000000696e6465786573f000000000050000007175657279001000000071756572795f73716c5f646f6d61696e000a00000070726f64756369626c650206000000726561736f6e0a070000006e6f7420796574090000006f70657261746f7273f000000000",
+    ];
+}
diff --git a/packages/stack-encrypt/src/dynamic/record.rs b/packages/stack-encrypt/src/dynamic/record.rs
index e634e5bfc..b79f98815 100644
--- a/packages/stack-encrypt/src/dynamic/record.rs
+++ b/packages/stack-encrypt/src/dynamic/record.rs
@@ -140,6 +140,12 @@
 //! that a round-trip invariant rather than data loss.
 
 use super::value_frame::{split_rows, FieldFault, SourceRow, SourceRows};
+use std::fmt;
+
+use serde::de::{Deserializer, MapAccess, Visitor};
+use serde::Deserialize;
+
+use super::term::{IndexWire, MatchWire};
 use super::{FfiValue, ValueFrame, ValueKind};
 use vitaminc_aead::frame::{Frame, FrameWriter};
 use vitaminc_aead::plaintext::{Logical, MapSink, Physical, SeqSink, Sink};
@@ -147,7 +153,7 @@ use vitaminc_aead::{DecodeError, Encrypt};
 use vitaminc_protected::{Controlled, Protected};
 
 use super::{
-    not_admitted, utf8, Error, NoTargets, Reason, Scope, TargetError, TargetResolver, TermBytes,
+    not_admitted, Error, NoTargets, Reason, Scope, TargetError, TargetResolver, TermBytes,
 };
 use crate::plan::{FieldValues, FieldsBuilder, Opens, Runs};
 use crate::target::{CallerContext, DeclaredContext, Decryption, Encrypted, IndexSpec};
@@ -182,8 +188,7 @@ pub enum Output {
 impl Output {
     /// The output a bare key names, or `None` for a key that is not one. A
     /// `"match"` key names the match index under default options; a plan
-    /// spells other options in the object form [`from_value`](Self::from_value)
-    /// reads.
+    /// spells other options in the object form (see [`plan`]).
     pub fn parse(s: &str) -> Option<Self> {
         match s {
             "c" => Some(Output::Ciphertext),
@@ -192,20 +197,6 @@ impl Output {
         }
     }
 
-    /// Read one entry of a plan's `"outputs"` list: `"c"`, `"passthrough"`,
-    /// or an index in its wire form ([`IndexSpec::from_value`]; see [`plan`]).
-    ///
-    /// # Errors
-    ///
-    /// [`Error::Plan`] for anything else.
-    pub fn from_value(value: &FfiValue) -> Result<Self, Error> {
-        match value {
-            FfiValue::String(s) if utf8(s) == Some("c") => Ok(Output::Ciphertext),
-            FfiValue::String(s) if utf8(s) == Some("passthrough") => Ok(Output::Passthrough),
-            _ => IndexSpec::from_value(value).map(Output::Term),
-        }
-    }
-
     /// The map key this output rides under.
     pub fn key(&self) -> &'static str {
         match self {
@@ -916,21 +907,22 @@ fn declare<K: 'static>(
     }
 }
 
-/// Read a record plan from a decoded value, for a build without EQL types:
+/// Read a record plan from its frame, for a build without EQL types:
 /// [`plan_with`] under [`NoTargets`], so a field that names a `"target"` is
 /// refused ([`TargetError::NoTargets`]).
 ///
 /// # Errors
 ///
 /// As [`plan_with`].
-pub fn plan(value: FfiValue) -> Result<Plan, Error> {
-    plan_with(value, &NoTargets)
+pub fn plan(frame: &[u8]) -> Result<Plan, Error> {
+    plan_with(frame, &NoTargets)
 }
 
-/// Read a record plan from a decoded value, resolving each target field's
-/// name through `resolver`.
+/// Read a record plan from its frame, resolving each target field's name
+/// through `resolver`.
 ///
-/// The plan is an [`FfiValue::Object`]:
+/// The plan is a frame object, read by serde
+/// (`vitaminc_aead_frame::serde`):
 ///
 /// ```text
 /// { <field>: { "context": <context>, "outputs": [ "c" | "passthrough" | <index>, ... ], "type": <type> }, ... }
@@ -975,7 +967,7 @@ pub fn plan(value: FfiValue) -> Result<Plan, Error> {
 /// a power of two in `32..=65536`, a zero n-gram length), is refused. The
 /// other three indexes have no options and no object form. A field names
 /// each output key at most once, so it carries at most one match index.
-/// [`IndexSpec::to_value`] writes this form and [`IndexSpec::from_value`]
+/// [`IndexSpec`] serializes to this form and [`IndexSpec::from_frame`]
 /// reads it. `"passthrough"` is a field's only output when it has it.
 ///
 /// [`MatchOptions::default`]: crate::sem::MatchOptions::default
@@ -1002,31 +994,19 @@ pub fn plan(value: FfiValue) -> Result<Plan, Error> {
 /// # Examples
 ///
 /// ```
-/// use stack_encrypt::dynamic::{record, FfiValue, NoTargets, Output};
+/// use stack_encrypt::dynamic::{record, NoTargets, Output};
 /// use stack_encrypt::target::IndexSpec;
 ///
-/// // As a binding would decode it from its caller: seal `age` under the
-/// // label users/age and index it for equality.
-/// let plan = record::plan_with(FfiValue::Object(vec![(
-///     "age".to_string(),
-///     FfiValue::Object(vec![
-///         (
-///             "context".to_string(),
-///             FfiValue::Array(vec![
-///                 FfiValue::String("users".into()),
-///                 FfiValue::String("age".into()),
-///             ]),
-///         ),
-///         (
-///             "outputs".to_string(),
-///             FfiValue::Array(vec![
-///                 FfiValue::String("c".into()),
-///                 FfiValue::String("eq".into()),
-///             ]),
-///         ),
-///         ("type".to_string(), FfiValue::String("uint32".into())),
-///     ]),
-/// )]), &NoTargets)?;
+/// // As a binding sends it: seal `age` under the label users/age and index
+/// // it for equality.
+/// let frame = vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+///     "age": {
+///         "context": ["users", "age"],
+///         "outputs": ["c", "eq"],
+///         "type": "uint32",
+///     },
+/// }))?;
+/// let plan = record::plan_with(&frame, &NoTargets)?;
 ///
 /// assert_eq!(plan.fields().len(), 1);
 /// assert_eq!(plan.fields()[0].name(), "age");
@@ -1035,129 +1015,291 @@ pub fn plan(value: FfiValue) -> Result<Plan, Error> {
 ///     plan.fields()[0].outputs(),
 ///     [Output::Ciphertext, Output::Term(IndexSpec::Equality)]
 /// );
-/// # Ok::<(), stack_encrypt::dynamic::Error>(())
+/// # Ok::<(), Box<dyn std::error::Error>>(())
 /// ```
 ///
 /// # Errors
 ///
-/// [`Error::Plan`] for a plan that is not an object of field specs, an
-/// empty plan, a field named twice, a spec with a key other than
-/// `"context"`, `"outputs"`, `"target"` and `"type"` or with one given
-/// twice, missing `"context"`, having neither `"outputs"` nor `"target"`
-/// or having both, an output list that is not a list of outputs (above),
-/// is empty, names an output key twice or names `"passthrough"` beside
-/// another output, a `"target"` that is not a non-empty string, a `"type"`
-/// that is not a string naming a [`ValueKind`], a type that does not admit
-/// one of the field's index outputs, a context that is not a label of at
-/// least two segments (optionally extended), fields under different
-/// contexts or extensions, or a plan the builder refuses ([`Plan::new`]);
-/// with `"context_field"`, a value that is not a string, given twice,
-/// naming no field of the plan, or a plan [`Plan::with_context_field`]
-/// refuses. [`Error::UntypedIndex`], naming the field, for a field with a
-/// term output and no `"type"`. [`Error::Context`] for a `"context"` that
-/// is present but is not a context at all, or renders empty.
-/// [`Error::Target`] for a target the resolver refuses ([`Plan::new_with`]).
-///
-/// The transport codec refuses duplicate object keys before a binding's
-/// value reaches here, but an [`FfiValue`] can be built with them directly
-/// and this is a public parser, so it refuses them itself rather than
-/// letting the last one win.
-pub fn plan_with(
-    value: FfiValue,
-    resolver: &(impl TargetResolver + ?Sized),
-) -> Result<Plan, Error> {
-    let FfiValue::Object(entries) = value else {
-        return Err(Error::bad_plan(Reason::NotAnObject));
-    };
-    let mut fields: Vec<FieldPlan> = Vec::with_capacity(entries.len());
-    let mut context_field: Option<String> = None;
-    for (name, spec) in entries {
-        if name == "context_field" {
-            // Reserved: the plan-level key, never a field. A second one, or
-            // one that is not a string, is refused rather than read as a
-            // field spec.
-            if context_field.is_some() {
-                return Err(Error::bad_plan(Reason::RepeatedKey));
-            }
-            let FfiValue::String(s) = &spec else {
-                return Err(Error::bad_plan(Reason::ContextField));
-            };
-            let s = utf8(s).ok_or(Error::bad_plan(Reason::ContextField))?;
-            context_field = Some(s.to_owned());
-            continue;
-        }
-        let refuse = |reason| Error::Plan {
+/// [`Error::Plan`] for a plan that is not an object of field specs
+/// (including bytes that are not one frame, which is how a field or key
+/// given twice is refused: the frame refuses it), an empty plan, a spec with
+/// a key other than `"context"`, `"outputs"`, `"target"` and `"type"`,
+/// missing `"context"`, having neither `"outputs"` nor `"target"` or having
+/// both, an output list that is not a list of outputs (above), is empty,
+/// names an output key twice or names `"passthrough"` beside another
+/// output, a `"target"` that is not a non-empty string, a `"type"` that is
+/// not a string naming a [`ValueKind`], a type that does not admit one of
+/// the field's index outputs, a context that is not a label of at least two
+/// segments (optionally extended), fields under different contexts or
+/// extensions, or a plan the builder refuses ([`Plan::new`]); with
+/// `"context_field"`, a value that is not a string, naming no field of the
+/// plan, or a plan [`Plan::with_context_field`] refuses.
+/// [`Error::UntypedIndex`], naming the field, for a field with a term output
+/// and no `"type"`. [`Error::Context`] for a `"context"` that is present but
+/// is not a context at all, or renders empty. [`Error::Target`] for a
+/// target the resolver refuses ([`Plan::new_with`]).
+pub fn plan_with(frame: &[u8], resolver: &(impl TargetResolver + ?Sized)) -> Result<Plan, Error> {
+    let wire: PlanWire =
+        vitaminc_aead_frame::serde::from_slice(frame).map_err(|e| plan_refusal(&e, frame))?;
+    let mut fields: Vec<FieldPlan> = Vec::with_capacity(wire.fields.len());
+    for (name, spec) in wire.fields {
+        let spec = FieldSpec::try_from(spec).map_err(|reason| Error::Plan {
             field: Some(name.clone()),
             reason,
+        })?;
+        let context = super::context::non_empty(spec.context.0).map_err(|e| e.in_field(&name))?;
+        let field = match spec.what {
+            What::Outputs(outputs) => FieldPlan::new(name, context, outputs)?,
+            What::Target(target) => FieldPlan::with_target(name, context, target)?,
         };
-        let FfiValue::Object(spec) = spec else {
-            return Err(refuse(Reason::NotAnObject));
-        };
-        let mut context: Option<NonEmpty<ContextPiece<'static>>> = None;
-        let mut outputs: Option<Vec<Output>> = None;
-        let mut target: Option<String> = None;
-        let mut field_type: Option<ValueKind> = None;
-        for (key, value) in spec {
-            match key.as_str() {
-                "context" if context.is_none() => {
-                    context = Some(super::context(value).map_err(|error| error.in_field(&name))?);
-                }
-                "target" if target.is_none() => {
-                    let FfiValue::String(s) = &value else {
-                        return Err(refuse(Reason::InvalidTarget));
-                    };
-                    target = Some(
-                        utf8(s)
-                            .ok_or_else(|| refuse(Reason::InvalidTarget))?
-                            .to_owned(),
-                    );
-                }
-                "outputs" if outputs.is_none() => {
-                    let FfiValue::Array(items) = value else {
-                        return Err(refuse(Reason::OutputsNotList));
-                    };
-                    let parsed = items
-                        .iter()
-                        .map(Output::from_value)
-                        .collect::<Result<Vec<_>, _>>()
-                        .map_err(|error| error.in_field(&name))?;
-                    outputs = Some(parsed);
-                }
-                "type" if field_type.is_none() => {
-                    let FfiValue::String(s) = &value else {
-                        return Err(refuse(Reason::UnknownType));
-                    };
-                    let kind = utf8(s).ok_or_else(|| refuse(Reason::UnknownType))?;
-                    field_type = Some(kind.parse().map_err(|_| refuse(Reason::UnknownType))?);
-                }
-                // One of the four given twice.
-                "context" | "target" | "outputs" | "type" => {
-                    return Err(refuse(Reason::RepeatedKey))
-                }
-                _ => return Err(refuse(Reason::UnknownKey)),
-            }
-        }
-        let context = context.ok_or_else(|| refuse(Reason::MissingContext))?;
-        // One form or the other: a field with both, or neither, is refused.
-        let field = match (outputs, target) {
-            (Some(outputs), None) => FieldPlan::new(name, context, outputs)?,
-            (None, Some(target)) => FieldPlan::with_target(name, context, target)?,
-            (Some(_), Some(_)) => return Err(refuse(Reason::OutputsWithTarget)),
-            (None, None) => return Err(refuse(Reason::MissingOutputs)),
-        };
-        fields.push(match field_type {
-            Some(field_type) => field.with_type(field_type)?,
+        fields.push(match spec.field_type {
+            Some(KindName(field_type)) => field.with_type(field_type)?,
             None => field,
         });
     }
     // The whole-plan rules are the constructors', so a parsed plan and a
     // hand-built one are refused alike.
-    match context_field {
+    match wire.context_field {
         Some(name) => Plan::with_context_field(name, fields),
         None => Plan::new_with(fields, resolver),
     }
 }
 
+/// A plan as a binding writes it: an object of field specs, in order, with
+/// one reserved key beside them, `"context_field"`. A visitor only to tell
+/// that key from a field's name; every value below it is derived.
+struct PlanWire {
+    context_field: Option<String>,
+    fields: Vec<(String, FieldSpecWire)>,
+}
+
+impl<'de> Deserialize<'de> for PlanWire {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        struct V;
+        impl<'de> Visitor<'de> for V {
+            type Value = PlanWire;
+            fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                f.write_str("a plan: an object of field specs")
+            }
+            fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<PlanWire, A::Error> {
+                let mut plan = PlanWire {
+                    context_field: None,
+                    fields: Vec::with_capacity(super::context::reserved(map.size_hint())),
+                };
+                while let Some(name) = map.next_key::<&'de str>()? {
+                    if name == CONTEXT_FIELD {
+                        plan.context_field = Some(map.next_value()?);
+                    } else {
+                        plan.fields.push((name.to_owned(), map.next_value()?));
+                    }
+                }
+                Ok(plan)
+            }
+        }
+        d.deserialize_map(V)
+    }
+}
+
+/// The key of the `position`th entry of the object `frame` holds, or `None`
+/// when it is not an object of that many entries.
+fn entry_key(frame: &[u8], position: usize) -> Option<String> {
+    struct Keys(Vec<String>);
+    impl<'de> Deserialize<'de> for Keys {
+        fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+            struct V;
+            impl<'de> Visitor<'de> for V {
+                type Value = Keys;
+                fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                    f.write_str("an object")
+                }
+                fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<Keys, A::Error> {
+                    let mut keys = Vec::new();
+                    while let Some(key) = map.next_key::<&'de str>()? {
+                        let _: serde::de::IgnoredAny = map.next_value()?;
+                        keys.push(key.to_owned());
+                    }
+                    Ok(Keys(keys))
+                }
+            }
+            d.deserialize_map(V)
+        }
+    }
+    vitaminc_aead_frame::serde::from_slice::<Keys>(frame)
+        .ok()?
+        .0
+        .into_iter()
+        .nth(position)
+}
+
+/// The keys a field's spec reads ([`FieldSpecWire`]).
+const SPEC_KEYS: [&str; 4] = ["context", "outputs", "target", "type"];
+
+/// The keys of the spec `field` holds in the plan `frame`, or `None` when
+/// that spec is not an object (or the plan is not one frame of unique keys).
+fn spec_keys(frame: &[u8], field: &str) -> Option<Vec<String>> {
+    #[derive(Deserialize)]
+    #[serde(untagged)]
+    enum Spec {
+        Object(std::collections::BTreeMap<String, serde::de::IgnoredAny>),
+        Other(serde::de::IgnoredAny),
+    }
+    match vitaminc_aead_frame::serde::from_slice::<std::collections::BTreeMap<String, Spec>>(frame)
+        .ok()?
+        .remove(field)?
+    {
+        Spec::Object(keys) => Some(keys.into_keys().collect()),
+        Spec::Other(_) => None,
+    }
+}
+
+/// The plan-level key naming the field a plan takes its context from.
+const CONTEXT_FIELD: &str = "context_field";
+
+/// One field's spec: a context, and exactly one of `"outputs"` and
+/// `"target"` (checked in `TryFrom`, once the field's name is known, so the
+/// refusal names it), and optionally a `"type"`. A key that is present must
+/// hold its kind of value: a null is refused.
+struct FieldSpec {
+    context: super::context::Context,
+    what: What,
+    field_type: Option<KindName>,
+}
+
+enum What {
+    Outputs(Vec<Output>),
+    Target(String),
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct FieldSpecWire {
+    context: super::context::Context,
+    #[serde(default, deserialize_with = "present")]
+    outputs: Option<Vec<OutputWire>>,
+    #[serde(default, deserialize_with = "present")]
+    target: Option<String>,
+    #[serde(default, deserialize_with = "present", rename = "type")]
+    field_type: Option<KindName>,
+}
+
+impl TryFrom<FieldSpecWire> for FieldSpec {
+    type Error = Reason;
+
+    fn try_from(wire: FieldSpecWire) -> Result<Self, Reason> {
+        let what = match (wire.outputs, wire.target) {
+            (Some(outputs), None) => What::Outputs(outputs.into_iter().map(Output::from).collect()),
+            (None, Some(target)) => What::Target(target),
+            (Some(_), Some(_)) => return Err(Reason::OutputsWithTarget),
+            (None, None) => return Err(Reason::MissingOutputs),
+        };
+        Ok(FieldSpec {
+            context: wire.context,
+            what,
+            field_type: wire.field_type,
+        })
+    }
+}
+
+/// Absent is `None`. Present, a value must be of its kind: a null is
+/// refused, as any other value of the wrong kind is.
+fn present<'de, D: Deserializer<'de>, T: Deserialize<'de>>(d: D) -> Result<Option<T>, D::Error> {
+    T::deserialize(d).map(Some)
+}
+
+/// One entry of a field's `"outputs"`: `"c"`, `"passthrough"`, or an index
+/// in its wire form ([`IndexSpec`'s docs](IndexSpec#wire-form)).
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+enum OutputWire {
+    #[serde(rename = "c")]
+    Ciphertext,
+    Passthrough,
+    Eq,
+    Match(Option<MatchWire>),
+    Ore,
+    Ope,
+}
+
+impl From<OutputWire> for Output {
+    fn from(output: OutputWire) -> Self {
+        let index = match output {
+            OutputWire::Ciphertext => return Output::Ciphertext,
+            OutputWire::Passthrough => return Output::Passthrough,
+            OutputWire::Eq => IndexWire::Eq,
+            OutputWire::Match(options) => IndexWire::Match(options),
+            OutputWire::Ore => IndexWire::Ore,
+            OutputWire::Ope => IndexWire::Ope,
+        };
+        Output::Term(index.into())
+    }
+}
+
+/// A `"type"`: the name of a [`ValueKind`].
+#[derive(Deserialize)]
+#[serde(try_from = "&str")]
+struct KindName(ValueKind);
+
+impl TryFrom<&str> for KindName {
+    type Error = Reason;
+
+    fn try_from(name: &str) -> Result<Self, Reason> {
+        name.parse().map(KindName).map_err(|_| Reason::UnknownType)
+    }
+}
+
+/// The parser's refusal of a plan the frame reader refused: the field from
+/// the error's path, and the reason from where in the field it happened,
+/// or from the reason a field's own rule gave.
+fn plan_refusal(error: &vitaminc_aead_frame::serde::Error, frame: &[u8]) -> Error {
+    use vitaminc_aead_frame::serde::PathSegment::{Entry, Key};
+
+    let path = error.path();
+    // A plan's keys are the host's, so the adapter places an error under one
+    // by its position, never its text; the field is read back from the
+    // frame that was refused.
+    let field = match path.first() {
+        Some(Entry(position)) => entry_key(frame, *position),
+        _ => None,
+    };
+    let Some(field) = field else {
+        // The root: not an object, or not one frame.
+        return Error::bad_plan(Reason::NotAnObject);
+    };
+    let field = &field;
+    if field == CONTEXT_FIELD {
+        return Error::bad_plan(Reason::ContextField);
+    }
+    let reason = match path.get(1) {
+        Some(Key(key)) if key == "context" => {
+            return Error::bad_context(Reason::ContextKind).in_field(field)
+        }
+        Some(Key(key)) if key == "outputs" && path.len() == 2 => Reason::OutputsNotList,
+        Some(Key(key)) if key == "outputs" => Reason::UnknownOutput,
+        Some(Key(key)) if key == "target" => Reason::InvalidTarget,
+        // `"type"`: the one other key a spec reads, and so the only other
+        // key an error inside a spec's value is placed under (an unknown
+        // key is never on the path).
+        Some(_) => Reason::UnknownType,
+        // The spec itself: a key it does not know, a missing context, or not
+        // an object at all. Read from the spec's own keys, not the error's
+        // wording, so a reworded message cannot change the reason. An object
+        // of known keys refused at its own level lacks its context: a value
+        // under a key is refused under that key, a repeated key is not an
+        // object, and the outputs-or-target rule is checked after parsing.
+        None => match spec_keys(frame, field) {
+            Some(keys) if keys.iter().any(|key| !SPEC_KEYS.contains(&key.as_str())) => {
+                Reason::UnknownKey
+            }
+            Some(_) => Reason::MissingContext,
+            None => Reason::NotAnObject,
+        },
+    };
+    Error::Plan {
+        field: Some(field.clone()),
+        reason,
+    }
+}
+
 /// Encrypt a record — or a batch of records — per a plan.
 ///
 /// `source` is a map of `{ field: value }` (one record), or a sequence of
@@ -1198,26 +1340,9 @@ pub fn plan_with(
 /// let keyset = cipher.default_keyset();
 ///
 /// // Seal `age` under users/age with an equality term beside it.
-/// let plan = record::plan(FfiValue::Object(vec![(
-///     "age".to_string(),
-///     FfiValue::Object(vec![
-///         (
-///             "context".to_string(),
-///             FfiValue::Array(vec![
-///                 FfiValue::String("users".into()),
-///                 FfiValue::String("age".into()),
-///             ]),
-///         ),
-///         (
-///             "outputs".to_string(),
-///             FfiValue::Array(vec![
-///                 FfiValue::String("c".into()),
-///                 FfiValue::String("eq".into()),
-///             ]),
-///         ),
-///         ("type".to_string(), FfiValue::String("uint32".into())),
-///     ]),
-/// )]))?;
+/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+///     "age": { "context": ["users", "age"], "outputs": ["c", "eq"], "type": "uint32" },
+/// }))?)?;
 ///
 /// // The row as a binding hands it over: one transport frame.
 /// let row = FfiValue::Object(vec![("age".to_string(), FfiValue::UInt32(34))]);
@@ -2172,7 +2297,7 @@ mod tests {
     use vitaminc_aead::frame::MAX_DEPTH;
     use vitaminc_protected::{Controlled, Protected};
 
-    use crate::dynamic::{context, term};
+    use crate::dynamic::{term, utf8};
     use crate::plan::pick;
     use crate::sem::EqualityTerm;
     use crate::target::{AeadContext, DecryptInto, EncryptFrom};
@@ -2250,6 +2375,24 @@ mod tests {
         FfiValue::String(value.into())
     }
 
+    /// The context `value` spells, read from its frame as a binding sends it.
+    fn context(value: FfiValue) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+        crate::dynamic::context(&crate::dynamic::test_frame::frame_of(&value))
+    }
+
+    /// The plan `value` spells, read from its frame as a binding sends it.
+    fn plan(value: FfiValue) -> Result<Plan, Error> {
+        super::plan(&crate::dynamic::test_frame::frame_of(&value))
+    }
+
+    /// [`plan`], under `resolver`.
+    fn plan_with(
+        value: FfiValue,
+        resolver: &(impl TargetResolver + ?Sized),
+    ) -> Result<Plan, Error> {
+        super::plan_with(&crate::dynamic::test_frame::frame_of(&value), resolver)
+    }
+
     fn obj(entries: Vec<(&str, FfiValue)>) -> FfiValue {
         FfiValue::Object(
             entries
@@ -2486,6 +2629,48 @@ mod tests {
     mod given_a_plan_value {
         use super::*;
 
+        /// A spec, or its match options, sent as an array is refused as
+        /// not an object: the frame reads a struct only from an object,
+        /// never by position.
+        #[test]
+        /// A plan that declares more fields than its frame holds is refused
+        /// when they run out, without reserving room for the count it declared:
+        /// four billion fields would abort the guest on allocation.
+        fn a_plan_that_declares_more_fields_than_it_holds_is_refused() {
+            let mut bytes = vec![vitaminc_aead::frame::OBJECT];
+            bytes.extend_from_slice(&u32::MAX.to_le_bytes());
+            assert!(crate::dynamic::record::plan(&bytes).is_err());
+        }
+
+        #[test]
+        fn a_spec_or_its_options_sent_as_an_array_is_not_an_object() {
+            let as_array = FfiValue::Array(vec![
+                FfiValue::Array(vec![s("users"), s("age")]),
+                strings(&["ciphertext"]),
+            ]);
+            for spec in [as_array, FfiValue::Array(vec![FfiValue::Null])] {
+                let error = plan(obj(vec![("age", spec)])).expect_err("refused");
+                assert_eq!(error.field(), Some("age"), "{error}");
+                assert_eq!(error.reason(), Some(Reason::NotAnObject), "{error}");
+            }
+            let positional = obj(vec![(
+                "match",
+                FfiValue::Array(vec![
+                    s("standard"),
+                    FfiValue::Bool(true),
+                    FfiValue::UInt32(3),
+                    FfiValue::UInt32(256),
+                ]),
+            )]);
+            let spec = obj(vec![
+                ("context", FfiValue::Array(vec![s("users"), s("nick")])),
+                ("outputs", FfiValue::Array(vec![positional])),
+            ]);
+            let error = plan(obj(vec![("nick", spec)])).expect_err("refused");
+            assert_eq!(error.field(), Some("nick"), "{error}");
+            assert_eq!(error.reason(), Some(Reason::UnknownOutput), "{error}");
+        }
+
         #[test]
         fn parses_each_field_in_order_with_its_label_and_outputs() {
             let plan = the_plan();
@@ -3009,11 +3194,10 @@ mod tests {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
         fn wide() -> FfiValue {
-            IndexSpec::Match(crate::sem::MatchOptions {
+            crate::dynamic::test_frame::value_of(&IndexSpec::Match(crate::sem::MatchOptions {
                 k: 6,
                 ..crate::sem::MatchOptions::default()
-            })
-            .to_value()
+            }))
         }
         // Each case is refused for the missing type and nothing else: the
         // refusal is the variant that names the field, and the same spec
@@ -3443,7 +3627,9 @@ mod tests {
                     ("context", label("nick")),
                     (
                         "outputs",
-                        FfiValue::Array(vec![IndexSpec::Match(options.clone()).to_value()]),
+                        FfiValue::Array(vec![crate::dynamic::test_frame::value_of(
+                            &IndexSpec::Match(options.clone()),
+                        )]),
                     ),
                     ("type", s("string")),
                 ]),
@@ -5184,7 +5370,13 @@ mod tests {
                     "f",
                     obj(vec![
                         ("context", label("f")),
-                        ("outputs", FfiValue::Array(vec![s("c"), kind.to_value()])),
+                        (
+                            "outputs",
+                            FfiValue::Array(vec![
+                                s("c"),
+                                crate::dynamic::test_frame::value_of(&kind),
+                            ]),
+                        ),
                         ("type", s(ty)),
                     ]),
                 )]))
@@ -6414,6 +6606,111 @@ mod tests {
             obj(vec![("age", obj(spec))])
         }
 
+        /// A key that is present must hold its kind of value: a null is
+        /// refused as that key's reason, never read as absent.
+        #[test]
+        fn a_null_is_refused_as_its_key() {
+            use Reason::*;
+            let cases: Vec<(&str, FfiValue, Option<&str>, Reason, &str)> = vec![
+                (
+                    "a null context",
+                    age(vec![
+                        ("context", FfiValue::Null),
+                        ("outputs", strings(&["c"])),
+                    ]),
+                    Some("age"),
+                    ContextKind,
+                    "Context",
+                ),
+                (
+                    "null outputs",
+                    age(vec![("context", label("age")), ("outputs", FfiValue::Null)]),
+                    Some("age"),
+                    OutputsNotList,
+                    "Plan",
+                ),
+                (
+                    "a null target",
+                    age(vec![("context", label("age")), ("target", FfiValue::Null)]),
+                    Some("age"),
+                    InvalidTarget,
+                    "Plan",
+                ),
+                (
+                    "a null type",
+                    age(vec![
+                        ("context", label("age")),
+                        ("outputs", strings(&["c"])),
+                        ("type", FfiValue::Null),
+                    ]),
+                    Some("age"),
+                    UnknownType,
+                    "Plan",
+                ),
+                (
+                    "a null context field",
+                    obj(vec![
+                        ("context_field", FfiValue::Null),
+                        ("age", spec(label("age"), &["c"])),
+                    ]),
+                    None,
+                    ContextField,
+                    "Plan",
+                ),
+                (
+                    "a spec that is null",
+                    obj(vec![("age", FfiValue::Null)]),
+                    Some("age"),
+                    NotAnObject,
+                    "Plan",
+                ),
+            ];
+            for (what, value, field, reason, variant) in cases {
+                let error = refused_plan(value);
+                assert!(
+                    !matches!(error, Error::UntypedIndex { .. }),
+                    "{what}: {error}"
+                );
+                expect(&error, variant, field, reason);
+            }
+        }
+
+        /// An index's payload may be missing or null alike: a bare
+        /// `"match"`, `{"match": null}` and `{"match": {}}` are each the
+        /// match index under the default options, and `{"eq": null}` is the
+        /// bare `"eq"`.
+        #[test]
+        fn a_missing_or_null_index_payload_is_the_default() {
+            let outputs = |output: FfiValue| {
+                let plan = plan(age(vec![
+                    ("context", label("age")),
+                    ("outputs", FfiValue::Array(vec![output])),
+                    ("type", s("string")),
+                ]))
+                .expect("the plan parses");
+                plan.fields()[0].outputs().to_vec()
+            };
+            let default_match = vec![Output::Term(IndexSpec::Match(
+                crate::sem::MatchOptions::default(),
+            ))];
+            assert_eq!(outputs(s("match")), default_match);
+            assert_eq!(outputs(obj(vec![("match", FfiValue::Null)])), default_match);
+            assert_eq!(outputs(obj(vec![("match", obj(vec![]))])), default_match);
+            assert_eq!(
+                outputs(obj(vec![("eq", FfiValue::Null)])),
+                vec![Output::Term(IndexSpec::Equality)]
+            );
+        }
+
+        /// Bytes that are not one frame are not a plan.
+        #[test]
+        fn bytes_that_are_not_a_frame_are_not_a_plan() {
+            for bytes in [&[][..], &[0xff, 1, 2]] {
+                let error = super::super::plan(bytes).expect_err("refused");
+                expect(&error, "Plan", None, Reason::NotAnObject);
+            }
+        }
+
         #[test]
         fn a_malformed_plan() {
             use Reason::*;
@@ -6438,6 +6735,8 @@ mod tests {
                     UnknownKey,
                     "Plan",
                 ),
+                // A key given twice anywhere is refused by the frame before
+                // the plan is read, so it names no field.
                 (
                     "a key given twice",
                     age(vec![
@@ -6445,8 +6744,8 @@ mod tests {
                         ("context", label("age")),
                         ("outputs", strings(&["c"])),
                     ]),
-                    Some("age"),
-                    RepeatedKey,
+                    None,
+                    NotAnObject,
                     "Plan",
                 ),
                 (
@@ -6584,8 +6883,8 @@ mod tests {
                         ("age".to_string(), spec(label("age"), &["c"])),
                         ("age".to_string(), spec(label("age"), &["c"])),
                     ]),
-                    Some("age"),
-                    DuplicateField,
+                    None,
+                    NotAnObject,
                     "Plan",
                 ),
                 (
@@ -6628,8 +6927,8 @@ mod tests {
                         ),
                         ("type", s("string")),
                     ]),
-                    Some("age"),
-                    RepeatedKey,
+                    None,
+                    NotAnObject,
                     "Plan",
                 ),
             ];
diff --git a/packages/stack-encrypt/src/dynamic/target.rs b/packages/stack-encrypt/src/dynamic/target.rs
index f32465da3..d734e11ee 100644
--- a/packages/stack-encrypt/src/dynamic/target.rs
+++ b/packages/stack-encrypt/src/dynamic/target.rs
@@ -18,7 +18,7 @@
 //!
 //! # Wire format
 //!
-//! [`TargetDescriptor::to_value`] is the entry a guest's `se_targets` export
+//! A [`TargetDescriptor`], serialized, is the entry a guest's `se_targets` export
 //! lists for each type; the keys are fixed on [`TargetDescriptor`], in the
 //! crate that owns the data grammar, and `eql-bindings` is tested to spell
 //! its table the same way.
@@ -27,8 +27,8 @@
 
 use std::fmt;
 
-use super::query::{operator_to_value, target_operators};
-use super::{FfiValue, OpSpec, ValueFrame, ValueKind};
+use super::query::target_operators;
+use super::{OpSpec, ValueFrame, ValueKind};
 
 use crate::sem::MatchOptions;
 use crate::{KeysetCipher, Label, Pending, StackCipher};
@@ -37,7 +37,7 @@ use crate::{KeysetCipher, Label, Pending, StackCipher};
 ///
 /// # Wire format
 ///
-/// [`to_value`](Self::to_value) is the entry a guest's `se_targets` export
+/// The descriptor, serialized (it is `Serialize`), is the entry a guest's `se_targets` export
 /// lists for each type, so a generator can ask the engine it embeds which
 /// EQL types it holds. Every key is always present; an absent value is
 /// null, never a missing key.
@@ -103,6 +103,43 @@ pub struct TargetDescriptor {
     pub match_options: Option<MatchOptions>,
 }
 
+/// The descriptor in its wire form: the object a guest's `se_targets`
+/// lists, every key present (see [the type's wire format](TargetDescriptor#wire-format)).
+impl serde::Serialize for TargetDescriptor {
+    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        #[derive(serde::Serialize)]
+        struct Wire<'a> {
+            name: &'a str,
+            family: &'a str,
+            suffix: &'a str,
+            plaintext: Option<&'static str>,
+            sql_domain: &'a str,
+            indexes: &'a [String],
+            query: Option<&'a str>,
+            query_sql_domain: Option<&'a str>,
+            producible: bool,
+            reason: Option<&'a str>,
+            operators: Vec<super::OperatorEntry>,
+        }
+        serde::Serialize::serialize(
+            &Wire {
+                name: &self.name,
+                family: &self.family,
+                suffix: &self.suffix,
+                plaintext: self.plaintext.map(ValueKind::name),
+                sql_domain: &self.sql_domain,
+                indexes: &self.indexes,
+                query: self.query.as_deref(),
+                query_sql_domain: self.query_sql_domain.as_deref(),
+                producible: self.producible,
+                reason: self.reason.as_deref(),
+                operators: self.operator_entries(),
+            },
+            s,
+        )
+    }
+}
+
 impl TargetDescriptor {
     /// A descriptor with every field given. The one constructor, so a host
     /// cannot leave a wire field out.
@@ -145,42 +182,13 @@ impl TargetDescriptor {
         self
     }
 
-    /// The descriptor in its wire form: the object a guest's `se_targets`
-    /// lists, every key present (see [the type's wire format](Self#wire-format)).
-    pub fn to_value(&self) -> FfiValue {
-        let text = |s: &str| FfiValue::String(s.into());
-        let optional = |s: &Option<String>| s.as_deref().map_or(FfiValue::Null, text);
-        FfiValue::Object(vec![
-            ("name".to_string(), text(&self.name)),
-            ("family".to_string(), text(&self.family)),
-            ("suffix".to_string(), text(&self.suffix)),
-            (
-                "plaintext".to_string(),
-                self.plaintext
-                    .map_or(FfiValue::Null, |kind| text(kind.name())),
-            ),
-            ("sql_domain".to_string(), text(&self.sql_domain)),
-            (
-                "indexes".to_string(),
-                FfiValue::Array(self.indexes.iter().map(|k| text(k)).collect()),
-            ),
-            ("query".to_string(), optional(&self.query)),
-            (
-                "query_sql_domain".to_string(),
-                optional(&self.query_sql_domain),
-            ),
-            ("producible".to_string(), FfiValue::Bool(self.producible)),
-            ("reason".to_string(), optional(&self.reason)),
-            (
-                "operators".to_string(),
-                FfiValue::Array(
-                    target_operators(self)
-                        .iter()
-                        .map(|(op, index)| operator_to_value(*op, index))
-                        .collect(),
-                ),
-            ),
-        ])
+    /// The entries of [`operators`](Self::operators), each with the index
+    /// that answers it, as the wire form lists them.
+    fn operator_entries(&self) -> Vec<super::OperatorEntry> {
+        target_operators(self)
+            .iter()
+            .map(|(op, index)| super::OperatorEntry::new(*op, index))
+            .collect()
     }
 
     /// The operators the engine answers for a field that names this type,
@@ -582,6 +590,7 @@ impl fmt::Display for TargetDescriptor {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::dynamic::FfiValue;
 
     fn text_eq() -> TargetDescriptor {
         TargetDescriptor::new(
@@ -651,7 +660,7 @@ mod tests {
 
     #[test]
     fn the_wire_form_has_every_key_in_order_with_null_for_absent() {
-        let FfiValue::Object(entries) = text_eq().to_value() else {
+        let FfiValue::Object(entries) = crate::dynamic::test_frame::value_of(&text_eq()) else {
             panic!("an object");
         };
         let keys: Vec<&str> = entries.iter().map(|(k, _)| k.as_str()).collect();
@@ -681,7 +690,7 @@ mod tests {
         let mut unspecified = text_eq();
         unspecified.plaintext = None;
         unspecified.query = None;
-        let FfiValue::Object(entries) = unspecified.to_value() else {
+        let FfiValue::Object(entries) = crate::dynamic::test_frame::value_of(&unspecified) else {
             panic!("an object");
         };
         assert!(matches!(&entries[3].1, FfiValue::Null));
diff --git a/packages/stack-encrypt/src/dynamic/term.rs b/packages/stack-encrypt/src/dynamic/term.rs
index e89896bd7..1aea4a077 100644
--- a/packages/stack-encrypt/src/dynamic/term.rs
+++ b/packages/stack-encrypt/src/dynamic/term.rs
@@ -33,7 +33,7 @@
 use std::convert::Infallible;
 use std::marker::PhantomData;
 
-use super::{FfiValue, ValueFrame};
+use super::ValueFrame;
 use stack_kms::DataKeySource;
 use vitaminc_aead::plaintext::{
     Error as SinkError, Float, Int, Logical, MapSink, Physical, SeqSink, Sink, SourceError,
@@ -41,7 +41,9 @@ use vitaminc_aead::plaintext::{
 use vitaminc_normalize::{domain_of, normalize, NormalizeError};
 use zeroize::Zeroizing;
 
-use super::{utf8, Error, Reason};
+use serde::{Deserialize, Serialize, Serializer};
+
+use super::{Error, Reason};
 use crate::sem::{
     CllwOpeEncrypt, CllwOreEncrypt, DefaultMatch, MatchOptions, QueryTokens, TermError, Tokenizer,
 };
@@ -72,9 +74,10 @@ use crate::{Encrypt, IntoPrfContext, KeysetCipher, NonEmpty};
 /// `[32, 65536]`, a non-zero n-gram length) are refused. The other three
 /// indexes have no options and no object form.
 ///
-/// [`to_value`](Self::to_value) writes the string whenever the options are
-/// the defaults and the object, with all four options, otherwise, so a
-/// default plan is byte-for-byte what it was before options had a wire form.
+/// Serialized (it is `Serialize`), an index writes the string whenever the
+/// options are the defaults and the object, with all four options,
+/// otherwise, so a default plan is byte-for-byte what it was before options
+/// had a wire form.
 impl IndexSpec {
     /// The index a bare key names, under default options, or `None` for a
     /// string that is not an index key.
@@ -88,54 +91,20 @@ impl IndexSpec {
         })
     }
 
-    /// Read an index from its wire form (see the [type docs](Self#wire-form)).
+    /// Read an index from its wire form's frame (see the
+    /// [type docs](Self#wire-form)).
     ///
     /// # Errors
     ///
     /// [`Error::Plan`] ([`Reason::UnknownOutput`]) for a value that is
     /// neither an index key nor a match options object, or whose options are
-    /// unknown, mistyped or out of bounds; [`Reason::RepeatedKey`] for an
-    /// option given twice. It names no field: the plan parser names it.
-    pub fn from_value(value: &FfiValue) -> Result<Self, Error> {
-        let unknown = || Error::bad_plan(Reason::UnknownOutput);
-        match value {
-            FfiValue::String(s) => Self::parse(utf8(s).ok_or_else(unknown)?).ok_or_else(unknown),
-            FfiValue::Object(entries) => match entries.as_slice() {
-                [(key, FfiValue::Object(options))] if key == "match" => {
-                    Ok(IndexSpec::Match(match_options(options)?))
-                }
-                _ => Err(unknown()),
-            },
-            _ => Err(unknown()),
-        }
-    }
-
-    /// Write this index in its wire form (see the [type docs](Self#wire-form)):
-    /// the key, or for a match index under non-default options, the object
-    /// carrying all four of them. [`from_value`](Self::from_value) reads it
-    /// back to an equal index.
-    pub fn to_value(&self) -> FfiValue {
-        match self {
-            IndexSpec::Match(options) if *options != MatchOptions::default() => {
-                let tokenizer = match options.tokenizer {
-                    Tokenizer::Standard => FfiValue::String("standard".into()),
-                    Tokenizer::Ngram { length } => FfiValue::Object(vec![(
-                        "ngram".to_string(),
-                        FfiValue::UInt64(length as u64),
-                    )]),
-                };
-                FfiValue::Object(vec![(
-                    "match".to_string(),
-                    FfiValue::Object(vec![
-                        ("tokenizer".to_string(), tokenizer),
-                        ("downcase".to_string(), FfiValue::Bool(options.downcase)),
-                        ("k".to_string(), FfiValue::UInt64(options.k as u64)),
-                        ("m".to_string(), FfiValue::UInt64(u64::from(options.m))),
-                    ]),
-                )])
-            }
-            _ => FfiValue::String(self.key().into()),
-        }
+    /// unknown, mistyped or out of bounds, and for bytes that are not one
+    /// frame (an option given twice is refused by the frame). It names no
+    /// field: the plan parser names it.
+    pub fn from_frame(frame: &[u8]) -> Result<Self, Error> {
+        vitaminc_aead_frame::serde::from_slice::<IndexWire>(frame)
+            .map(IndexSpec::from)
+            .map_err(|_| Error::bad_plan(Reason::UnknownOutput))
     }
 
     /// Whether the scheme defines this index's term for `value`: whether it
@@ -198,53 +167,139 @@ fn ordered(value: &Physical<'_>) -> bool {
     }
 }
 
-/// The options object of a match index's wire form: each key at most once,
-/// each defaulting, and the whole checked against the scheme's bounds.
-fn match_options(entries: &[(String, FfiValue)]) -> Result<MatchOptions, Error> {
-    let unknown = || Error::bad_plan(Reason::UnknownOutput);
-    let mut options = MatchOptions::default();
-    let mut seen: Vec<&str> = Vec::with_capacity(entries.len());
-    for (key, value) in entries {
-        if seen.contains(&key.as_str()) {
-            return Err(Error::bad_plan(Reason::RepeatedKey));
+/// An index in its wire form: its key, or for a match index under options
+/// other than the defaults, a one-entry object mapping `"match"` to all four
+/// of them (see [`IndexSpec`'s docs](IndexSpec#wire-form)).
+impl Serialize for IndexSpec {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        #[derive(Serialize)]
+        #[serde(rename_all = "lowercase")]
+        enum Out {
+            Eq,
+            #[serde(rename = "match")]
+            DefaultMatch,
+            Match(MatchOut),
+            Ore,
+            Ope,
         }
-        seen.push(key);
-        match (key.as_str(), value) {
-            ("tokenizer", FfiValue::String(s)) if utf8(s) == Some("standard") => {
-                options.tokenizer = Tokenizer::Standard;
-            }
-            ("tokenizer", FfiValue::Object(tokenizer)) => match tokenizer.as_slice() {
-                [(name, length)] if name == "ngram" => {
-                    options.tokenizer = Tokenizer::Ngram {
-                        length: integer(length)?,
-                    };
-                }
-                _ => return Err(unknown()),
-            },
-            ("downcase", FfiValue::Bool(downcase)) => options.downcase = *downcase,
-            ("k", k) => options.k = integer(k)?,
-            ("m", m) => options.m = integer(m)?,
-            _ => return Err(unknown()),
+        #[derive(Serialize)]
+        struct MatchOut {
+            tokenizer: TokenizerOut,
+            downcase: bool,
+            k: u64,
+            m: u64,
+        }
+        #[derive(Serialize)]
+        #[serde(rename_all = "lowercase")]
+        enum TokenizerOut {
+            Standard,
+            Ngram(u64),
+        }
+        match self {
+            IndexSpec::Equality => Out::Eq,
+            IndexSpec::Match(options) if *options == MatchOptions::default() => Out::DefaultMatch,
+            IndexSpec::Match(options) => Out::Match(MatchOut {
+                tokenizer: match options.tokenizer {
+                    Tokenizer::Standard => TokenizerOut::Standard,
+                    Tokenizer::Ngram { length } => TokenizerOut::Ngram(length as u64),
+                },
+                downcase: options.downcase,
+                k: options.k as u64,
+                m: u64::from(options.m),
+            }),
+            IndexSpec::Ore => Out::Ore,
+            IndexSpec::Ope => Out::Ope,
+        }
+        .serialize(s)
+    }
+}
+
+/// An index in its wire form, as serde reads it from a frame (see
+/// [`IndexSpec`'s docs](IndexSpec#wire-form)): a key, or for a match index a
+/// one-entry object mapping `"match"` to its options. A bare `"match"`, and
+/// `{"match": null}`, are the default options.
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub(super) enum IndexWire {
+    Eq,
+    Match(Option<MatchWire>),
+    Ore,
+    Ope,
+}
+
+impl From<IndexWire> for IndexSpec {
+    fn from(index: IndexWire) -> Self {
+        match index {
+            IndexWire::Eq => IndexSpec::Equality,
+            IndexWire::Match(options) => IndexSpec::Match(options.map(|o| o.0).unwrap_or_default()),
+            IndexWire::Ore => IndexSpec::Ore,
+            IndexWire::Ope => IndexSpec::Ope,
         }
     }
-    if options.validate().is_err() {
-        return Err(unknown());
+}
+
+/// A match index's options object: each option optional, defaulting to
+/// [`MatchOptions::default`]'s, and the whole checked against the match
+/// scheme's bounds.
+#[derive(Deserialize)]
+#[serde(try_from = "MatchOptionsWire")]
+pub(super) struct MatchWire(pub(super) MatchOptions);
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields, default)]
+struct MatchOptionsWire {
+    tokenizer: TokenizerWire,
+    downcase: bool,
+    k: usize,
+    m: u32,
+}
+
+impl Default for MatchOptionsWire {
+    fn default() -> Self {
+        let MatchOptions {
+            tokenizer,
+            downcase,
+            k,
+            m,
+        } = MatchOptions::default();
+        Self {
+            tokenizer: match tokenizer {
+                Tokenizer::Standard => TokenizerWire::Standard,
+                Tokenizer::Ngram { length } => TokenizerWire::Ngram(length),
+            },
+            downcase,
+            k,
+            m,
+        }
     }
-    Ok(options)
 }
 
-/// A non-negative integer leaf of any width, as the target type, or
-/// [`Error::Plan`] ([`Reason::UnknownOutput`]: it is a match option).
-fn integer<T: TryFrom<u64>>(value: &FfiValue) -> Result<T, Error> {
-    let wide = match value {
-        FfiValue::Int32(v) => u64::try_from(*v).ok(),
-        FfiValue::Int64(v) => u64::try_from(*v).ok(),
-        FfiValue::UInt32(v) => Some(u64::from(*v)),
-        FfiValue::UInt64(v) => Some(*v),
-        _ => None,
-    };
-    wide.and_then(|v| T::try_from(v).ok())
-        .ok_or(Error::bad_plan(Reason::UnknownOutput))
+/// `"standard"`, or `{"ngram": <length>}`.
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+enum TokenizerWire {
+    Standard,
+    Ngram(usize),
+}
+
+impl TryFrom<MatchOptionsWire> for MatchWire {
+    type Error = &'static str;
+
+    fn try_from(wire: MatchOptionsWire) -> Result<Self, Self::Error> {
+        let options = MatchOptions {
+            tokenizer: match wire.tokenizer {
+                TokenizerWire::Standard => Tokenizer::Standard,
+                TokenizerWire::Ngram(length) => Tokenizer::Ngram { length },
+            },
+            downcase: wire.downcase,
+            k: wire.k,
+            m: wire.m,
+        };
+        options
+            .validate()
+            .map(|_| MatchWire(options))
+            .map_err(|_| "match options the match scheme refuses")
+    }
 }
 
 /// Derive one index term's frozen byte encoding.
@@ -267,14 +322,12 @@ fn integer<T: TryFrom<u64>>(value: &FfiValue) -> Result<T, Error> {
 ///     .await?;
 /// let keyset = cipher.default_keyset();
 ///
-/// let ctx = context(FfiValue::Array(vec![
-///     FfiValue::String("users".into()),
-///     FfiValue::String("age".into()),
-/// ]))?;
+/// // `["users", "age"]`, as a binding writes it.
+/// let ctx = context(&vitaminc_aead_frame::serde::to_vec(&("users", "age"))?)?;
 /// let probe = term(&keyset, &FfiValue::UInt32(34), &IndexSpec::Equality, ctx.clone()).await?;
 /// let typed = keyset.equality_term(34u32, ctx).await?;
 /// assert_eq!(probe, typed.into_bytes().to_vec());
-/// # Ok::<(), stack_encrypt::dynamic::Error>(())
+/// # Ok::<(), Box<dyn std::error::Error>>(())
 /// # }).unwrap();
 /// ```
 ///
@@ -705,6 +758,8 @@ impl Index<ValueFrame> for IndexSpec {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::dynamic::utf8;
+    use crate::dynamic::FfiValue;
     use crate::dynamic::{context, Output};
     use crate::sem::TermError;
     use crate::{nonempty, StackCipher};
@@ -806,7 +861,7 @@ mod tests {
     async fn match_text_with_no_tokens_is_refused_as_a_query_and_stored_empty() {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
-        let ctx = context(s("users/bio")).expect("context");
+        let ctx = ctx("users/bio");
         for text in ["", "  ", "hi"] {
             let refused = term(&keyset, &s(text), &default_match(), ctx.clone()).await;
             assert!(
@@ -842,7 +897,7 @@ mod tests {
     async fn a_match_query_under_invalid_options_is_refused_not_tokenised() {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
-        let ctx = context(s("users/bio")).expect("context");
+        let ctx = ctx("users/bio");
         let zero = IndexSpec::Match(MatchOptions {
             tokenizer: Tokenizer::Ngram { length: 0 },
             ..MatchOptions::default()
@@ -896,6 +951,16 @@ mod tests {
         IndexSpec::Match(MatchOptions::default())
     }
 
+    /// An index read from the frame of its wire form, as a plan carries it.
+    fn index_of(value: &FfiValue) -> Result<IndexSpec, Error> {
+        IndexSpec::from_frame(&crate::dynamic::test_frame::frame_of(value))
+    }
+
+    /// A one-part context, read from its frame as a binding sends it.
+    fn ctx(label: &str) -> NonEmpty<crate::ContextPiece<'static>> {
+        context(&vitaminc_aead_frame::serde::to_vec(&label).expect("frames")).expect("context")
+    }
+
     fn s(value: &str) -> FfiValue {
         FfiValue::String(value.into())
     }
@@ -951,7 +1016,7 @@ mod tests {
         async fn derives_the_bytes_the_typed_path_derives() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let ks = &keyset;
             let dynamic = |value: FfiValue, kind: IndexSpec| {
                 let ctx = ctx.clone();
@@ -1028,7 +1093,7 @@ mod tests {
         async fn equality_is_one_term_per_number_and_per_nfc_string() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let eq = |value: FfiValue| {
                 let ctx = ctx.clone();
                 let keyset = &keyset;
@@ -1078,7 +1143,7 @@ mod tests {
         async fn a_frame_derives_the_terms_its_value_does() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let derive = |frame: Vec<u8>, kind: IndexSpec| {
                 let ctx = ctx.clone();
                 let keyset = &keyset;
@@ -1186,7 +1251,7 @@ mod tests {
         async fn equality_follows_vitaminc_for_decimals_and_timestamps() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let eq = |value: ValueFrame| {
                 let ctx = ctx.clone();
                 let keyset = &keyset;
@@ -1269,7 +1334,7 @@ mod tests {
         async fn term_is_error_term_naming_the_kind() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let refused = [
                 ("a bool", FfiValue::Bool(true), IndexSpec::Equality),
                 ("a bool", FfiValue::Bool(true), default_match()),
@@ -1296,7 +1361,7 @@ mod tests {
         async fn a_decimal_date_or_timestamp_has_no_order_term_yet() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             for leaf in [decimal(150, 2), date(19_782), instant(7)] {
                 for kind in [IndexSpec::Ore, IndexSpec::Ope] {
                     assert!(!kind.defines(&leaf), "{kind}");
@@ -1318,7 +1383,7 @@ mod tests {
         async fn text_that_does_not_normalize_is_refused_when_derived() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             for kind in [IndexSpec::Equality, default_match()] {
                 let unassigned = s("a\u{378}b");
                 assert!(kind.defines(&unassigned), "{kind} takes text");
@@ -1343,7 +1408,7 @@ mod tests {
         async fn term_is_error_term_naming_the_kind() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let not_scalars = [
                 ("null", FfiValue::Null),
                 ("undefined", FfiValue::Undefined),
@@ -1419,13 +1484,13 @@ mod tests {
                 IndexSpec::Ore,
                 IndexSpec::Ope,
             ] {
-                let wire = spec.to_value();
+                let wire = crate::dynamic::test_frame::value_of(&spec);
                 assert!(
                     matches!(&wire, FfiValue::String(k) if utf8(k) == Some(spec.key())),
                     "{spec} writes as its bare key"
                 );
                 assert_eq!(
-                    IndexSpec::from_value(&wire).expect("reads back"),
+                    index_of(&wire).expect("reads back"),
                     spec,
                     "{spec} reads back from its key"
                 );
@@ -1465,13 +1530,13 @@ mod tests {
             ];
             for options in cases {
                 let spec = IndexSpec::Match(options.clone());
-                let wire = spec.to_value();
+                let wire = crate::dynamic::test_frame::value_of(&spec);
                 assert!(
                     matches!(&wire, FfiValue::Object(_)),
                     "{options:?} is not the default, so it writes as an object"
                 );
                 assert_eq!(
-                    IndexSpec::from_value(&wire).expect("reads back"),
+                    index_of(&wire).expect("reads back"),
                     spec,
                     "{options:?} round-trips"
                 );
@@ -1499,7 +1564,7 @@ mod tests {
                 ]),
             )]);
             assert_eq!(
-                IndexSpec::from_value(&wire).expect("reads"),
+                index_of(&wire).expect("reads"),
                 IndexSpec::Match(MatchOptions {
                     tokenizer: crate::sem::Tokenizer::Ngram { length: 4 },
                     k: 5,
@@ -1516,7 +1581,7 @@ mod tests {
                 ]),
             )]);
             assert_eq!(
-                IndexSpec::from_value(&wire).expect("reads"),
+                index_of(&wire).expect("reads"),
                 IndexSpec::Match(MatchOptions {
                     tokenizer: crate::sem::Tokenizer::Standard,
                     downcase: false,
@@ -1527,7 +1592,7 @@ mod tests {
             // An empty options object is the defaults, and reads as the
             // bare key does.
             assert_eq!(
-                IndexSpec::from_value(&obj(vec![("match", obj(vec![]))])).expect("reads"),
+                index_of(&obj(vec![("match", obj(vec![]))])).expect("reads"),
                 default_match()
             );
         }
@@ -1594,12 +1659,10 @@ mod tests {
                 ),
             ];
             for (label, wire) in refused {
-                let error = IndexSpec::from_value(&wire).expect_err(label);
-                let reason = if label == "an option twice" {
-                    Reason::RepeatedKey
-                } else {
-                    Reason::UnknownOutput
-                };
+                let error = index_of(&wire).expect_err(label);
+                // An option given twice is refused by the frame, and reads
+                // as any other malformed index.
+                let reason = Reason::UnknownOutput;
                 assert!(
                     matches!(error, Error::Plan { field: None, .. }),
                     "{label}: {error:?}"
@@ -1626,7 +1689,7 @@ mod tests {
             }
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let text = || s("Alice Smith");
             let wide = term(
                 &keyset,
@@ -1654,6 +1717,11 @@ mod tests {
 #[cfg(test)]
 mod wire_form {
     use super::*;
+    use crate::dynamic::FfiValue;
+
+    fn index_of(value: &FfiValue) -> Result<IndexSpec, Error> {
+        IndexSpec::from_frame(&crate::dynamic::test_frame::frame_of(value))
+    }
     use crate::sem::{MatchConfig, Tokenizer};
     use crate::target::{Equality, Index, Match, Ope, Ore};
 
@@ -1681,7 +1749,7 @@ mod wire_form {
         ];
         for spec in specs {
             assert_eq!(
-                IndexSpec::from_value(&spec.to_value()).expect("reads back"),
+                index_of(&crate::dynamic::test_frame::value_of(&spec)).expect("reads back"),
                 spec,
                 "{spec:?} survives the data form"
             );
@@ -1692,8 +1760,8 @@ mod wire_form {
     fn a_default_match_index_is_the_bare_match_key() {
         let spec = Index::<String>::spec(&Match);
         assert!(matches!(
-            spec.to_value(),
-            FfiValue::String(key) if super::utf8(&key) == Some("match")
+            crate::dynamic::test_frame::value_of(&spec),
+            FfiValue::String(key) if crate::dynamic::utf8(&key) == Some("match")
         ));
     }
 
@@ -1702,7 +1770,10 @@ mod wire_form {
         let spec = Index::<String>::spec(&Match::<Words>::new());
         assert_eq!(spec, IndexSpec::Match(Words::options()));
         assert!(
-            matches!(spec.to_value(), FfiValue::Object(_)),
+            matches!(
+                crate::dynamic::test_frame::value_of(&spec),
+                FfiValue::Object(_)
+            ),
             "non-default options are written, not dropped"
         );
     }
diff --git a/packages/stack-encrypt/src/dynamic/test_frame.rs b/packages/stack-encrypt/src/dynamic/test_frame.rs
new file mode 100644
index 000000000..2aa266e72
--- /dev/null
+++ b/packages/stack-encrypt/src/dynamic/test_frame.rs
@@ -0,0 +1,44 @@
+//! Test inputs as a binding sends them: an [`FfiValue`] written as frame
+//! bytes, objects and arrays by hand so a test can send a repeated key,
+//! which no frame writer would.
+
+use vitaminc_protected::Controlled;
+
+use super::FfiValue;
+
+/// What a binding reads back from an answer the engine writes: its frame,
+/// decoded.
+pub(crate) fn value_of<T: serde::Serialize>(answer: &T) -> FfiValue {
+    let frame = vitaminc_aead_frame::serde::to_vec(answer).expect("frames");
+    FfiValue::from_frame(&frame).expect("a value")
+}
+
+/// The frame bytes of `value`.
+pub(crate) fn frame_of(value: &FfiValue) -> Vec<u8> {
+    let mut out = Vec::new();
+    write(value, &mut out);
+    out
+}
+
+fn write(value: &FfiValue, out: &mut Vec<u8>) {
+    let count = |len: usize| u32::try_from(len).expect("short").to_le_bytes();
+    match value {
+        FfiValue::Object(entries) => {
+            out.push(vitaminc_aead::frame::OBJECT);
+            out.extend_from_slice(&count(entries.len()));
+            for (key, value) in entries {
+                out.extend_from_slice(&count(key.len()));
+                out.extend_from_slice(key.as_bytes());
+                write(value, out);
+            }
+        }
+        FfiValue::Array(items) => {
+            out.push(vitaminc_aead::frame::ARRAY);
+            out.extend_from_slice(&count(items.len()));
+            for item in items {
+                write(item, out);
+            }
+        }
+        other => out.extend_from_slice(other.to_frame().expect("frames").risky_ref()),
+    }
+}
diff --git a/packages/stack-encrypt/tests/fixtures/README.md b/packages/stack-encrypt/tests/fixtures/README.md
index 27fb9f2ab..4fedec2eb 100644
--- a/packages/stack-encrypt/tests/fixtures/README.md
+++ b/packages/stack-encrypt/tests/fixtures/README.md
@@ -135,7 +135,7 @@ file changes only when a derivation does: regenerate it with
   boolean `verify` answers for each, which is what the typed `MatchQuery`
   answers.
 - **`target_limit`.** A match term's bytes, the statistics in the wire form
-  `Stats::from_value` reads (an absent histogram is the declared prior), and
+  `Stats::from_frame` reads (an absent histogram is the declared prior), and
   the limit, null when no finite fetch can be promised, which is what the
   typed `MatchQuery` answers.
 
diff --git a/packages/stack-encrypt/tests/heap_hygiene.rs b/packages/stack-encrypt/tests/heap_hygiene.rs
index c4a6a8a53..467f09f4e 100644
--- a/packages/stack-encrypt/tests/heap_hygiene.rs
+++ b/packages/stack-encrypt/tests/heap_hygiene.rs
@@ -152,11 +152,11 @@ fn spec(field: &str, outputs: &[&str], ty: Option<&str>) -> (String, FfiValue) {
 }
 
 fn plan() -> record::Plan {
-    record::plan(FfiValue::Object(vec![
+    record::plan(&ffi_frame(&FfiValue::Object(vec![
         spec("email", &["c", "eq", "match", "ore"], Some("string")),
         spec("doc", &["c"], None),
         spec("id", &["passthrough"], None),
-    ]))
+    ])))
     .unwrap()
 }
 
@@ -302,3 +302,8 @@ fn the_spy_sees_an_unwiped_free() {
     let text = marked("control");
     watched("control", || drop(text));
 }
+
+/// A plan as frame bytes: what a binding sends.
+fn ffi_frame(value: &FfiValue) -> Vec<u8> {
+    vitaminc_protected::Controlled::risky_unwrap(value.to_frame().expect("frames"))
+}
diff --git a/packages/stack-encrypt/tests/query_operators.rs b/packages/stack-encrypt/tests/query_operators.rs
index d8e133690..5c735c7f9 100644
--- a/packages/stack-encrypt/tests/query_operators.rs
+++ b/packages/stack-encrypt/tests/query_operators.rs
@@ -70,6 +70,11 @@ fn stats_cases() -> Vec<(Json, Stats)> {
     ]
 }
 
+/// A plan written as JSON, as frame bytes: what a binding sends.
+fn frame_of_json(value: &Json) -> Vec<u8> {
+    vitaminc_aead_frame::serde::to_vec(value).expect("frames")
+}
+
 fn ffi_of_json(value: &Json) -> FfiValue {
     match value {
         Json::Null => FfiValue::Null,
@@ -226,7 +231,7 @@ async fn data_term(
 async fn derived() -> Json {
     let cipher = deterministic_cipher(SEED).await;
     let keyset = cipher.default_keyset();
-    let plan = record::plan(ffi_of_json(&plan_json())).expect("the plan parses");
+    let plan = record::plan(&frame_of_json(&plan_json())).expect("the plan parses");
 
     let mut terms = Vec::new();
     for (field, operator, input) in queries() {
@@ -276,7 +281,10 @@ async fn derived() -> Json {
         };
         let typed = typed_match(&cipher, input).await;
         for (stats_json, stats) in stats_cases() {
-            let read = Stats::from_value(&ffi_of_json(&stats_json)).expect("stats read");
+            let read = Stats::from_frame(vitaminc_protected::Controlled::risky_ref(
+                &ffi_of_json(&stats_json).to_frame().expect("frames"),
+            ))
+            .expect("stats read");
             assert_eq!(read, stats, "the wire form reads as the typed stats");
             let limit =
                 dynamic::target_limit(&plan, "name", OpSpec::Matches, bytes, 10, &read, &NoTargets)
diff --git a/packages/stack-encrypt/tests/record_lowering.rs b/packages/stack-encrypt/tests/record_lowering.rs
index 1fc56483f..a3afef24a 100644
--- a/packages/stack-encrypt/tests/record_lowering.rs
+++ b/packages/stack-encrypt/tests/record_lowering.rs
@@ -91,19 +91,9 @@ fn plaintext_json() -> Json {
 
 // ---- JSON <-> FfiValue, for the subset the fixture uses --------------------
 
-fn ffi_of_json(value: &Json) -> FfiValue {
-    match value {
-        Json::String(s) => FfiValue::String(s.as_str().into()),
-        Json::Array(items) => FfiValue::Array(items.iter().map(ffi_of_json).collect()),
-        Json::Object(entries) => FfiValue::Object(
-            entries
-                .iter()
-                .map(|(k, v)| (k.clone(), ffi_of_json(v)))
-                .collect(),
-        ),
-        Json::Number(n) => FfiValue::UInt64(n.as_u64().expect("a non-negative integer")),
-        other => panic!("the fixture does not use {other}"),
-    }
+/// A plan written as JSON, as frame bytes: what a binding sends.
+fn frame_of_json(value: &Json) -> Vec<u8> {
+    vitaminc_aead_frame::serde::to_vec(value).expect("frames")
 }
 
 /// The plaintext as the binding sends it: each field at the kind the plan
@@ -403,7 +393,7 @@ async fn open_lowered(
 #[tokio::test]
 async fn the_chain_and_the_lowering_are_one_engine_today() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&data_plan_json())).expect("the data plan parses");
+    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("the data plan parses");
 
     let typed = json_of_record(seal_typed(&cipher).await);
     let lowered = json_of_record(seal_lowered(&cipher, &plan).await);
@@ -433,7 +423,7 @@ async fn the_chain_and_the_lowering_are_one_engine_today() {
 #[tokio::test]
 async fn the_committed_fixture_opens_both_ways() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&data_plan_json())).expect("the data plan parses");
+    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("the data plan parses");
     let path = fixture_path();
 
     if std::env::var_os("STACK_ENCRYPT_UPDATE_FIXTURES").is_some() {
@@ -708,7 +698,7 @@ async fn open_note_lowered(
 #[tokio::test]
 async fn the_chain_and_the_lowering_agree_on_a_context_field_today() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&note_plan_json())).expect("the data plan parses");
+    let plan = record::plan(&frame_of_json(&note_plan_json())).expect("the data plan parses");
     assert_eq!(plan.context_field(), Some("tenant"));
 
     let typed = json_of_record(seal_note_typed(&cipher).await);
@@ -755,7 +745,7 @@ async fn the_chain_and_the_lowering_agree_on_a_context_field_today() {
 #[tokio::test]
 async fn the_committed_context_field_case_opens_both_ways() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&note_plan_json())).expect("the data plan parses");
+    let plan = record::plan(&frame_of_json(&note_plan_json())).expect("the data plan parses");
     let path = fixture_path();
 
     if std::env::var_os("STACK_ENCRYPT_UPDATE_FIXTURES").is_some() {
@@ -827,7 +817,7 @@ async fn the_committed_context_field_case_opens_both_ways() {
 #[tokio::test]
 async fn the_fixture_records_are_bound_to_their_labels() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&data_plan_json())).expect("plan");
+    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("plan");
     let sealed = seal_lowered(&cipher, &plan).await;
     let CipherText::Map(mut fields) = sealed else {
         panic!("a map");
diff --git a/packages/stack-encrypt/tests/stored_rows.rs b/packages/stack-encrypt/tests/stored_rows.rs
index 7695279a8..817728773 100644
--- a/packages/stack-encrypt/tests/stored_rows.rs
+++ b/packages/stack-encrypt/tests/stored_rows.rs
@@ -25,7 +25,7 @@ use std::path::PathBuf;
 use common::{deterministic_cipher, DeterministicSource};
 use serde_json::{json, Map, Value as Json};
 use stack_encrypt::dynamic::record::{self, Plan as DataPlan};
-use stack_encrypt::dynamic::{admits, FfiValue, Scope, ValueFrame, ValueKind};
+use stack_encrypt::dynamic::{admits, Scope, ValueFrame, ValueKind};
 use stack_encrypt::target::IndexSpec;
 use stack_encrypt::StackCipherText as Node;
 use stack_encrypt::{
@@ -146,25 +146,13 @@ fn skeleton(json: &Json) -> Json {
 
 // ---- a plan as JSON ---------------------------------------------------------
 
-/// A plan in the fixture as the value a binding sends.
-fn ffi_of_json(value: &Json) -> FfiValue {
-    match value {
-        Json::String(text) => FfiValue::String(text.as_str().into()),
-        Json::Bool(b) => FfiValue::Bool(*b),
-        Json::Number(n) => FfiValue::UInt64(n.as_u64().expect("a non-negative integer")),
-        Json::Array(items) => FfiValue::Array(items.iter().map(ffi_of_json).collect()),
-        Json::Object(entries) => FfiValue::Object(
-            entries
-                .iter()
-                .map(|(key, value)| (key.clone(), ffi_of_json(value)))
-                .collect(),
-        ),
-        Json::Null => FfiValue::Null,
-    }
+/// A plan written as JSON, as frame bytes: what a binding sends.
+fn frame_of_json(value: &Json) -> Vec<u8> {
+    vitaminc_aead_frame::serde::to_vec(value).expect("frames")
 }
 
 fn plan_of(json: &Json) -> DataPlan {
-    record::plan(ffi_of_json(json)).expect("the frozen plan parses")
+    record::plan(&frame_of_json(json)).expect("the frozen plan parses")
 }
 
 // ---- sealing and opening ----------------------------------------------------
diff --git a/packages/stack-encrypt/tests/value_kinds.rs b/packages/stack-encrypt/tests/value_kinds.rs
index 8f4a72f82..3f3008a30 100644
--- a/packages/stack-encrypt/tests/value_kinds.rs
+++ b/packages/stack-encrypt/tests/value_kinds.rs
@@ -192,7 +192,7 @@ fn data_plan() -> DataPlan {
             )
         })
         .collect();
-    record::plan(FfiValue::Object(fields)).expect("the data plan parses")
+    record::plan(&ffi_frame(&FfiValue::Object(fields))).expect("the data plan parses")
 }
 
 /// The source as a binding hands it over: one frame, a map of the fields in
@@ -378,10 +378,9 @@ async fn every_new_kind_seals_opens_and_queries_as_the_typed_path() {
             "{} eq: the query is the stored term",
             kind.field
         );
-        let ctx = context(FfiValue::Array(vec![
-            FfiValue::String("value_kinds".into()),
-            FfiValue::String(kind.field.into()),
-        ]))
+        let ctx = context(
+            &vitaminc_aead_frame::serde::to_vec(&("value_kinds", kind.field)).expect("frames"),
+        )
         .expect("context");
         let typed_eq = keyset
             .equality_term(kind.value, ctx.clone())
@@ -445,7 +444,7 @@ async fn a_value_of_another_width_is_refused_when_sealed() {
         "an int32 is not an int8: {:?}",
         refused.err()
     );
-    let ore_on_a_date = record::plan(FfiValue::Object(vec![(
+    let ore_on_a_date = record::plan(&ffi_frame(&FfiValue::Object(vec![(
         "day".into(),
         FfiValue::Object(vec![
             (
@@ -461,7 +460,7 @@ async fn a_value_of_another_width_is_refused_when_sealed() {
             ),
             ("type".into(), FfiValue::String("date".into())),
         ]),
-    )]));
+    )])));
     assert!(matches!(
         ore_on_a_date,
         Err(Error::Plan {
@@ -553,3 +552,8 @@ async fn the_committed_fixture_opens_and_its_terms_are_todays() {
         assert_eq!(json!(hex(&term)), entry["term"], "{field}: today's");
     }
 }
+
+/// A plan as frame bytes: what a binding sends.
+fn ffi_frame(value: &FfiValue) -> Vec<u8> {
+    vitaminc_protected::Controlled::risky_unwrap(value.to_frame().expect("frames"))
+}