From b5baedba0110c0c62f61bc08e430d6e57394e370 Mon Sep 17 00:00:00 2001
From: Dan Draper <dan@cipherstash.com>
Date: Mon, 19 Oct 2026 11:11:29 +1100
Subject: [PATCH 1/7] build: take vitaminc 0.6.1, which reads data that is not
 plaintext from a transport frame with serde

vitaminc-aead-frame 0.6.1 adds the serde adapter over the transport frame
(the `serde` feature), which the control messages that follow read and
write through. Every vitaminc requirement moves to 0.6.1 together, as the
release did, and the four lockfiles that resolve vitaminc 0.6 follow.

vitaminc-normalize is on crates.io now, so the comment saying a patch
table supplied it goes.
---
 Cargo.lock                                | 128 +++++++++++-----------
 Cargo.toml                                |  17 ++-
 languages/golang/auth/guest/Cargo.lock    |  94 ++++++++--------
 languages/golang/encrypt/guest/Cargo.lock | 128 +++++++++++-----------
 languages/golang/encrypt/guest/Cargo.toml |   4 +-
 packages/eql/Cargo.lock                   | 118 ++++++++++----------
 packages/stack-encrypt/fuzz/Cargo.lock    | 118 ++++++++++----------
 packages/stack-encrypt/fuzz/Cargo.toml    |   2 +-
 8 files changed, 304 insertions(+), 305 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index bac0275fe..182d8fa55 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3236,8 +3236,8 @@ dependencies = [
  "tracing-subscriber",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -3259,7 +3259,7 @@ dependencies = [
  "tempfile",
  "tokio",
  "url",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -3298,12 +3298,12 @@ dependencies = [
  "tokio",
  "trybuild",
  "uuid",
- "vitaminc-aead 0.6.0",
- "vitaminc-encrypt 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -3328,9 +3328,9 @@ dependencies = [
  "proptest",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -3362,8 +3362,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -4128,16 +4128,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -4157,18 +4157,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -4185,9 +4185,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4196,11 +4196,11 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c253055230469c4af4791e902c41ce0ce55069c512249b33cf041dd5c58c517"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
 dependencies = [
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
 ]
 
 [[package]]
@@ -4215,12 +4215,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -4239,56 +4239,56 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "393354b2348eabce0420626fdc7cf70ac779870f82abb566fb491ea19eeea066"
+checksum = "bd361f626e95cbe770b9d012e4a86c43cfefe4aefb3d5b3ed9339a83085bdc53"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda6ec7f852ba8cd7e0ba6e8e7eaa3045e6fb866007c6d7ad6128833d8980f0c"
+checksum = "214b2a9d085924c3bc3c91f3ba74238e8848bf54990e5f48f170c71fbacea07a"
 dependencies = [
  "thiserror 2.0.18",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11de28e524ab1deecedbb023bd328916b6c023e2f52156521ac1df75a689d911"
+checksum = "c2715cca25006b4656223bc932ab4fd7f70d387aa4ec63a4e2ef33aa8cd2b3a5"
 dependencies = [
  "mutants",
  "thiserror 2.0.18",
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
  "vitaminc-normalize",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -4310,9 +4310,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -4321,7 +4321,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.18",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -4338,9 +4338,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -4365,16 +4365,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.18",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -4391,9 +4391,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4418,17 +4418,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 22e8a3d21..0629e45a6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -120,16 +120,15 @@ web-time = "1.1"
 zeroize = { version = "1.8.1", features = ["derive"] }
 # This is needed because lock_api 0.4.6 was breaking things and the branch forces the use of 0.4.12
 temp-env = { git = "https://github.com/cipherstash/temp-env", branch = "main" }
-vitaminc = { version = "0.6.0", features = ["random", "protected", "encrypt"] }
-vitaminc-aead = "0.6.0"
+vitaminc = { version = "0.6.1", features = ["random", "protected", "encrypt"] }
+vitaminc-aead = "0.6.1"
 # The transport frame and ciphertext codec every language binding carries
 # across its FFI boundary. Optional in stack-encrypt (the `dynamic` feature).
-vitaminc-aead-frame = "0.6.0"
-vitaminc-encrypt = "0.6.0"
-vitaminc-hmac = "0.6.0"
-# Not on crates.io yet: the `[patch.crates-io]` block below supplies it.
+vitaminc-aead-frame = "0.6.1"
+vitaminc-encrypt = "0.6.1"
+vitaminc-hmac = "0.6.1"
 # Normalized equality terms (Unicode 16 NFC text, one integer encoding for
 # every width), which `vitaminc-prf`'s `normalize` feature derives over.
-vitaminc-normalize = "0.6.0"
-vitaminc-prf = { version = "0.6.0", features = ["normalize"] }
-vitaminc-protected = "0.6.0"
+vitaminc-normalize = "0.6.1"
+vitaminc-prf = { version = "0.6.1", features = ["normalize"] }
+vitaminc-protected = "0.6.1"
diff --git a/languages/golang/auth/guest/Cargo.lock b/languages/golang/auth/guest/Cargo.lock
index 58ae17c2a..9073d2b3f 100644
--- a/languages/golang/auth/guest/Cargo.lock
+++ b/languages/golang/auth/guest/Cargo.lock
@@ -1847,8 +1847,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -1867,7 +1867,7 @@ dependencies = [
  "stack-profile",
  "tempfile",
  "url",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -1878,9 +1878,9 @@ dependencies = [
  "miette",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -2299,16 +2299,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -2328,18 +2328,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -2356,9 +2356,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2367,11 +2367,11 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c253055230469c4af4791e902c41ce0ce55069c512249b33cf041dd5c58c517"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
 dependencies = [
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
 ]
 
 [[package]]
@@ -2386,12 +2386,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2410,15 +2410,15 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -2441,9 +2441,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2452,7 +2452,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -2469,9 +2469,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2496,16 +2496,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
  "rand 0.10.3",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -2522,9 +2522,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2549,17 +2549,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/languages/golang/encrypt/guest/Cargo.lock b/languages/golang/encrypt/guest/Cargo.lock
index 189086c89..63f21677a 100644
--- a/languages/golang/encrypt/guest/Cargo.lock
+++ b/languages/golang/encrypt/guest/Cargo.lock
@@ -2062,8 +2062,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -2082,12 +2082,12 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc-aead 0.6.0",
- "vitaminc-encrypt 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -2117,7 +2117,7 @@ dependencies = [
  "stack-kms",
  "uuid",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2129,9 +2129,9 @@ dependencies = [
  "miette",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -2157,8 +2157,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2627,16 +2627,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -2656,18 +2656,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -2684,9 +2684,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2695,11 +2695,11 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c253055230469c4af4791e902c41ce0ce55069c512249b33cf041dd5c58c517"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
 dependencies = [
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
 ]
 
 [[package]]
@@ -2714,12 +2714,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2738,56 +2738,56 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "393354b2348eabce0420626fdc7cf70ac779870f82abb566fb491ea19eeea066"
+checksum = "bd361f626e95cbe770b9d012e4a86c43cfefe4aefb3d5b3ed9339a83085bdc53"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda6ec7f852ba8cd7e0ba6e8e7eaa3045e6fb866007c6d7ad6128833d8980f0c"
+checksum = "214b2a9d085924c3bc3c91f3ba74238e8848bf54990e5f48f170c71fbacea07a"
 dependencies = [
  "thiserror 2.0.20",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11de28e524ab1deecedbb023bd328916b6c023e2f52156521ac1df75a689d911"
+checksum = "c2715cca25006b4656223bc932ab4fd7f70d387aa4ec63a4e2ef33aa8cd2b3a5"
 dependencies = [
  "mutants",
  "thiserror 2.0.20",
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
  "vitaminc-normalize",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2809,9 +2809,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2820,7 +2820,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -2837,9 +2837,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2864,16 +2864,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
  "rand 0.10.2",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -2890,9 +2890,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2917,17 +2917,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/languages/golang/encrypt/guest/Cargo.toml b/languages/golang/encrypt/guest/Cargo.toml
index 08acd7086..8947e7d5d 100644
--- a/languages/golang/encrypt/guest/Cargo.toml
+++ b/languages/golang/encrypt/guest/Cargo.toml
@@ -66,8 +66,8 @@ zerokms-protocol = "=0.12.31"
 # against (see the comment in packages/stack-encrypt/Cargo.toml). A
 # different version here fails at the `FfiValue: Decrypt` bound, since the
 # aead crate would be duplicated.
-vitaminc-aead-frame = "0.6.0"
-vitaminc-protected = "0.6.0"
+vitaminc-aead-frame = "0.6.1"
+vitaminc-protected = "0.6.1"
 
 futures = { version = "0.3", default-features = false, features = ["executor"] }
 serde = "1"
diff --git a/packages/eql/Cargo.lock b/packages/eql/Cargo.lock
index 993b20bbb..12a1ee68a 100644
--- a/packages/eql/Cargo.lock
+++ b/packages/eql/Cargo.lock
@@ -1244,7 +1244,7 @@ dependencies = [
  "stack-kms",
  "tokio",
  "uuid",
- "vitaminc-aead 0.6.0",
+ "vitaminc-aead 0.6.1",
 ]
 
 [[package]]
@@ -4217,8 +4217,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -4237,12 +4237,12 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc-aead 0.6.0",
- "vitaminc-encrypt 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -4277,8 +4277,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -5043,16 +5043,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -5085,18 +5085,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -5113,9 +5113,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5134,12 +5134,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -5172,56 +5172,56 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "393354b2348eabce0420626fdc7cf70ac779870f82abb566fb491ea19eeea066"
+checksum = "bd361f626e95cbe770b9d012e4a86c43cfefe4aefb3d5b3ed9339a83085bdc53"
 dependencies = [
  "hmac 0.13.0",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda6ec7f852ba8cd7e0ba6e8e7eaa3045e6fb866007c6d7ad6128833d8980f0c"
+checksum = "214b2a9d085924c3bc3c91f3ba74238e8848bf54990e5f48f170c71fbacea07a"
 dependencies = [
  "thiserror 2.0.20",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11de28e524ab1deecedbb023bd328916b6c023e2f52156521ac1df75a689d911"
+checksum = "c2715cca25006b4656223bc932ab4fd7f70d387aa4ec63a4e2ef33aa8cd2b3a5"
 dependencies = [
  "mutants",
  "thiserror 2.0.20",
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
  "vitaminc-normalize",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -5258,9 +5258,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -5269,7 +5269,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -5297,9 +5297,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -5338,16 +5338,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -5375,9 +5375,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5418,17 +5418,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/packages/stack-encrypt/fuzz/Cargo.lock b/packages/stack-encrypt/fuzz/Cargo.lock
index cb8b3eaa7..eb8dca476 100644
--- a/packages/stack-encrypt/fuzz/Cargo.lock
+++ b/packages/stack-encrypt/fuzz/Cargo.lock
@@ -2021,8 +2021,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -2041,12 +2041,12 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc-aead 0.6.0",
- "vitaminc-encrypt 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
@@ -2067,7 +2067,7 @@ dependencies = [
  "libfuzzer-sys",
  "stack-encrypt",
  "uuid",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2092,8 +2092,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc 0.6.1",
+ "vitaminc-protected 0.6.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2532,16 +2532,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c6b8dff9bfc94e076fcd5496395958e6c8dddb27605b6504c54123512c7c8e"
+checksum = "ac5c15b6c25efcb9a6111f7108ab8101947a7bf7e9af3ff6d6a73358a1ace0da"
 dependencies = [
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-encrypt 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
- "vitaminc-traits 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-encrypt 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
+ "vitaminc-traits 0.6.1",
 ]
 
 [[package]]
@@ -2561,18 +2561,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcea687f745050d80df32c93fbe7f8d18ed2cc5fb5e029814477dfe31449ec2e"
+checksum = "71b8c5c4ced92545dce5fd7cf04581d08210def174cc81475cf227fa2506c5b7"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-aead-derive 0.6.0",
- "vitaminc-context 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead-derive 0.6.1",
+ "vitaminc-context 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
@@ -2589,9 +2589,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085afc8c77ffadb4c8a93c9c5fa2d897196a36ab38e17c08fe96f8b9c309e05f"
+checksum = "4c546497a972d0f0498f2f8d5f537c514bad82df8662951c63d0c80023808900"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2610,12 +2610,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4d5679e511871da942ba2b29fcb1df198ee2359218bf7f11cfec4fd3dcfeee0"
+checksum = "fa4c4bc2bd9811253eb427657565a45bd4826e2379e93ee1c4d00c808a769882"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2634,56 +2634,56 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061d55dc4084fcc2eaa7334dd28300cd8d321038339a41085b7bf2dc6ccf5d4c"
+checksum = "f0923694602855b33a296d9af473e282e8096c1cfe1b30b8695d3b6651717fc5"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "393354b2348eabce0420626fdc7cf70ac779870f82abb566fb491ea19eeea066"
+checksum = "bd361f626e95cbe770b9d012e4a86c43cfefe4aefb3d5b3ed9339a83085bdc53"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda6ec7f852ba8cd7e0ba6e8e7eaa3045e6fb866007c6d7ad6128833d8980f0c"
+checksum = "214b2a9d085924c3bc3c91f3ba74238e8848bf54990e5f48f170c71fbacea07a"
 dependencies = [
  "thiserror 2.0.18",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.6.0",
- "vitaminc-protected 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11de28e524ab1deecedbb023bd328916b6c023e2f52156521ac1df75a689d911"
+checksum = "c2715cca25006b4656223bc932ab4fd7f70d387aa4ec63a4e2ef33aa8cd2b3a5"
 dependencies = [
  "mutants",
  "thiserror 2.0.18",
- "vitaminc-aead 0.6.0",
- "vitaminc-context 0.6.0",
+ "vitaminc-aead 0.6.1",
+ "vitaminc-context 0.6.1",
  "vitaminc-normalize",
- "vitaminc-protected 0.6.0",
+ "vitaminc-protected 0.6.1",
 ]
 
 [[package]]
@@ -2705,9 +2705,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efe97c67b61fd749b20d84248416a6cc1dc3f024a4695e3f69eee63aee7cb7c2"
+checksum = "b1bb76dd473f5aa89b844f92018ebe3041deb8e5390e7061cca4283d959ff855"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2716,7 +2716,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.18",
- "vitaminc-protected-derive 0.6.0",
+ "vitaminc-protected-derive 0.6.1",
  "zeroize",
 ]
 
@@ -2733,9 +2733,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0483ecfcb3e874d45c9b2dc04d8e5ed55ff453023a9de98fddc4a24b315d9f6"
+checksum = "e7478ed160c019059746e75fc613563dcdcd5266d155a34601d29377a1c4afc3"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2760,16 +2760,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693ae19994e6a79f9839e510220f532daab6f2ab0b4167fdd0d8379a027c653f"
+checksum = "2b477af7c01c3d9ef2647e46952ad3df7f246b3f806b1d4009ee83beecec613a"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.18",
- "vitaminc-protected 0.6.0",
- "vitaminc-random-derives 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random-derives 0.6.1",
  "zeroize",
 ]
 
@@ -2786,9 +2786,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb9ad6bb972f7e1b0889eba0a3ed534afe86dd8e52f197a2de20ebe25ee9e56"
+checksum = "ab5a0de8da428c6789dc067a578a0462e411099721d616736cf29e1622230c35"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2813,17 +2813,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c9f86c930cb4f98eee9288f463a133f01774be039ba05a092f12148b45c430c"
+checksum = "a900f0edcacd49c8557ab54722175869fec66926054a6fbdc53a05069db3c922"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-protected 0.6.0",
- "vitaminc-random 0.6.0",
+ "vitaminc-protected 0.6.1",
+ "vitaminc-random 0.6.1",
  "zeroize",
 ]
 
diff --git a/packages/stack-encrypt/fuzz/Cargo.toml b/packages/stack-encrypt/fuzz/Cargo.toml
index 63378e06c..49a9ff34f 100644
--- a/packages/stack-encrypt/fuzz/Cargo.toml
+++ b/packages/stack-encrypt/fuzz/Cargo.toml
@@ -17,7 +17,7 @@ cargo-fuzz = true
 [dependencies]
 # `Protected`, for the check_record model's passthrough-of-bytes node: the
 # same line stack-encrypt builds on.
-vitaminc-protected = "0.6.0"
+vitaminc-protected = "0.6.1"
 libfuzzer-sys = "0.4"
 # Structure-aware inputs for `check_record` and `plan_build`: the mirror
 # types derive `Arbitrary`, so the fuzzer mutates trees and plans, not bytes.

From 07dc450cf2578860f0cd8db9ac6745edf70cd29b Mon Sep 17 00:00:00 2001
From: Dan Draper <dan@cipherstash.com>
Date: Sun, 18 Oct 2026 19:14:49 +1100
Subject: [PATCH 2/7] refactor(golang): read the call options and keyset
 selector with serde, not FfiValue

The guest decoded a call's options, and a bare keyset selector, into an
FfiValue tree and walked it by hand: about 80 lines of matching variants
and refusing unknown, repeated and wrongly typed keys. They now read
straight from the frame into private serde types
(vitaminc_aead_frame::serde), which convert into the guest's existing
Options and KeysetSelector.

The wire is unchanged: {"keyset": {"default": {}}} and
{"keyset": {"name": "acme"}, "context": "tenants/acme"} read as before.
Each field type validates as it reads (a ZeroKMS name, a 16-byte id, a
plain label), so a parsed value is already the guest's. A null context is
still refused, not read as absent. An unknown key, a missing keyset, an
unknown or doubled tag and a wrong type are all still STATUS_ENCODING,
now with a message that names what was wrong and never the value.

The tests build each input as raw frame bytes, so the repeated-key cases
still reach the parser.

Refs #1252.
---
 languages/golang/encrypt/guest/Cargo.lock     |   2 +
 languages/golang/encrypt/guest/Cargo.toml     |   2 +-
 languages/golang/encrypt/guest/src/abi.rs     |   8 +-
 languages/golang/encrypt/guest/src/options.rs | 331 +++++++++++-------
 languages/golang/encrypt/guest/tests/leak.rs  |   6 +-
 5 files changed, 215 insertions(+), 134 deletions(-)

diff --git a/languages/golang/encrypt/guest/Cargo.lock b/languages/golang/encrypt/guest/Cargo.lock
index 63f21677a..dc8f911d9 100644
--- a/languages/golang/encrypt/guest/Cargo.lock
+++ b/languages/golang/encrypt/guest/Cargo.lock
@@ -2699,7 +2699,9 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
 dependencies = [
+ "serde",
  "vitaminc-aead 0.6.1",
+ "zeroize",
 ]
 
 [[package]]
diff --git a/languages/golang/encrypt/guest/Cargo.toml b/languages/golang/encrypt/guest/Cargo.toml
index 8947e7d5d..c09104f62 100644
--- a/languages/golang/encrypt/guest/Cargo.toml
+++ b/languages/golang/encrypt/guest/Cargo.toml
@@ -66,7 +66,7 @@ zerokms-protocol = "=0.12.31"
 # against (see the comment in packages/stack-encrypt/Cargo.toml). A
 # different version here fails at the `FfiValue: Decrypt` bound, since the
 # aead crate would be duplicated.
-vitaminc-aead-frame = "0.6.1"
+vitaminc-aead-frame = { version = "0.6.1", features = ["serde"] }
 vitaminc-protected = "0.6.1"
 
 futures = { version = "0.3", default-features = false, features = ["executor"] }
diff --git a/languages/golang/encrypt/guest/src/abi.rs b/languages/golang/encrypt/guest/src/abi.rs
index 76be06f9b..c1bad3007 100644
--- a/languages/golang/encrypt/guest/src/abi.rs
+++ b/languages/golang/encrypt/guest/src/abi.rs
@@ -139,7 +139,7 @@ fn with_keyset<R>(
     opts: &[u8],
     f: impl FnOnce(&KeysetCipher<'_, GuestKms>) -> Result<R, u32>,
 ) -> Result<R, u32> {
-    let options = parse_options(decode(opts)?, Side::Mint)?;
+    let options = parse_options(opts, Side::Mint)?;
     with_cipher(|cipher| {
         let keyset = block_on(options.keyset.resolve(cipher))?;
         f(&keyset)
@@ -152,7 +152,7 @@ fn with_scope<R>(
     opts: &[u8],
     f: impl FnOnce(Scope<'_, GuestKms>) -> Result<R, u32>,
 ) -> Result<R, u32> {
-    let options = parse_options(decode(opts)?, Side::Open)?;
+    let options = parse_options(opts, Side::Open)?;
     with_cipher(|cipher| {
         let scope = block_on(scope_for(cipher, &options.keyset))?;
         f(scope)
@@ -319,7 +319,7 @@ pub unsafe extern "C" fn se_keyset(sel_ptr: *const u8, sel_len: u32) -> u64 {
     export(|| {
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns and before any wipe of an overlapping range.
-        let selector = parse_selector(decode(unsafe { input(sel_ptr, sel_len)? })?)?;
+        let selector = parse_selector(unsafe { input(sel_ptr, sel_len)? })?;
         if selector == KeysetSelector::Any {
             return Err(malformed(r#"{"any"} is not a keyset"#));
         }
@@ -440,7 +440,7 @@ pub unsafe extern "C" fn se_decrypt_record(
         let record = unsafe { input(rec_ptr, rec_len)? };
         let plan = unsafe { input(plan_ptr, plan_len)? };
         let opts = unsafe { input(opt_ptr, opt_len)? };
-        let expected = parse_options(decode(opts)?, Side::Open)?.context;
+        let expected = parse_options(opts, Side::Open)?.context;
         ops::validate::record_tree(record, plan, expected.as_ref())?;
         with_scope(opts, |scope| {
             block_on(ops::decrypt_record(scope, record, plan, expected))
diff --git a/languages/golang/encrypt/guest/src/options.rs b/languages/golang/encrypt/guest/src/options.rs
index 569b4d05c..ab2141027 100644
--- a/languages/golang/encrypt/guest/src/options.rs
+++ b/languages/golang/encrypt/guest/src/options.rs
@@ -1,7 +1,7 @@
 //! The per-call options object, and the keyset selector it carries.
 //!
 //! Every export that touches a keyset takes one more codec-encoded
-//! argument: an [`FfiValue::Object`] with one required key, `keyset`, whose
+//! argument: a frame object with one required key, `keyset`, whose
 //! value is a tagged object naming the keyset the call binds to, and on
 //! `se_decrypt_record` one optional key, `context` (below):
 //!
@@ -41,15 +41,14 @@
 //! it is objects, strings, bytes and nothing else, and this module is its
 //! one home. The Go bindings plan points here.
 
-use stack_encrypt::dynamic::FfiValue;
 use stack_encrypt::dynamic::Scope;
 use stack_encrypt::{KeysetCipher, Label, StackCipher};
 use stack_kms::{IdentifiedBy, IndexKeySource};
 use uuid::Uuid;
-use vitaminc_protected::Controlled;
 use zerokms_protocol::Name;
 
 use stack_guest_abi::last_error::malformed;
+use vitaminc_aead_frame::serde::from_slice;
 
 use crate::status::fail_error;
 #[cfg(any(doc, test))]
@@ -88,84 +87,132 @@ pub struct Options {
     pub context: Option<Label>,
 }
 
-/// Parse a decoded options object for `side`. Anything outside the shape in
-/// the [module docs](self) is [`STATUS_ENCODING`].
-pub fn parse_options(value: FfiValue, side: Side) -> Result<Options, u32> {
-    let FfiValue::Object(entries) = value else {
-        return Err(malformed("the options are not an object"));
-    };
-    let mut keyset: Option<KeysetSelector> = None;
-    let mut context: Option<Label> = None;
-    for (key, value) in entries {
-        match key.as_str() {
-            "keyset" if keyset.is_none() => keyset = Some(parse_selector(value)?),
-            "context" if context.is_none() && side == Side::Open => {
-                let FfiValue::String(text) = value else {
-                    return Err(malformed(r#"the "context" option is not a string"#));
-                };
-                // Valid UTF-8 by `Utf8String`'s construction invariant;
-                // checked rather than assumed because this is boundary
-                // code. A context is not secret, so the payload moves out
-                // of its `Protected` rather than being copied and wiped.
-                let text = String::from_utf8(text.into_inner().risky_unwrap())
-                    .map_err(|_| malformed(r#"the "context" option is not UTF-8"#))?;
-                context = Some(
-                    Label::parse(&text)
-                        .map_err(|_| malformed(r#"the "context" option is not a label"#))?,
-                );
-            }
-            _ => {
-                return Err(malformed(
-                    r#"the options have a key other than "keyset" and, when opening, "context", or give one twice"#,
-                ))
-            }
+/// Parse the options frame a host sent for `side`. Anything outside the
+/// shape in the [module docs](self) is [`STATUS_ENCODING`], with a message
+/// that names what was wrong and never a value.
+pub fn parse_options(bytes: &[u8], side: Side) -> Result<Options, u32> {
+    let wire: wire::Options =
+        from_slice(bytes).map_err(|e| malformed(format!("the options: {e}")))?;
+    let keyset = KeysetSelector::from(wire.keyset);
+    if side == Side::Mint {
+        if wire.context.is_some() {
+            return Err(malformed(
+                r#"the "context" option is for decrypting a record only"#,
+            ));
+        }
+        if keyset == KeysetSelector::Any {
+            return Err(malformed(r#"{"any"} names no keyset to encrypt under"#));
         }
     }
-    let keyset = keyset.ok_or_else(|| malformed("the options name no keyset"))?;
-    if side == Side::Mint && keyset == KeysetSelector::Any {
-        return Err(malformed(r#"{"any"} names no keyset to encrypt under"#));
-    }
-    Ok(Options { keyset, context })
+    Ok(Options {
+        keyset,
+        context: wire.context.map(|context| context.0),
+    })
+}
+
+/// Parse a bare keyset selector frame, as `se_keyset` takes it. One
+/// definition, `wire::Selector`, serves this and [`parse_options`].
+pub fn parse_selector(bytes: &[u8]) -> Result<KeysetSelector, u32> {
+    from_slice::<wire::Selector>(bytes)
+        .map(KeysetSelector::from)
+        .map_err(|e| malformed(format!("a keyset selector: {e}")))
 }
 
-/// Parse a keyset selector: a tagged object with exactly one key. Spelled
-/// out here rather than in [`parse_options`] so `se_keyset`, which takes a
-/// bare selector, shares the one definition.
-pub fn parse_selector(value: FfiValue) -> Result<KeysetSelector, u32> {
-    let not_one = || malformed("a keyset selector is not an object with exactly one key");
-    let FfiValue::Object(mut entries) = value else {
-        return Err(not_one());
-    };
-    if entries.len() != 1 {
-        return Err(not_one());
+/// The options and the selector as a host writes them, read straight from
+/// the frame by serde (`vitaminc_aead_frame::serde`). Each field type
+/// validates as it reads, through `TryFrom`, so a parsed value is already
+/// the guest's. A `TryFrom` error is the whole message serde reports, so
+/// each is a fixed string that never repeats the value.
+mod wire {
+    use serde::{Deserialize, Deserializer};
+    use stack_encrypt::Label;
+    use uuid::Uuid;
+    use zerokms_protocol::Name;
+
+    #[derive(Deserialize)]
+    #[serde(deny_unknown_fields)]
+    pub(super) struct Options {
+        pub(super) keyset: Selector,
+        /// Absent is `None`. Present, it must be a label: a null is refused
+        /// like any other non-string, as it always has been.
+        #[serde(default, deserialize_with = "present")]
+        pub(super) context: Option<ContextLabel>,
+    }
+
+    fn present<'de, D: Deserializer<'de>, T: Deserialize<'de>>(
+        d: D,
+    ) -> Result<Option<T>, D::Error> {
+        T::deserialize(d).map(Some)
     }
-    let (tag, value) = entries.pop().ok_or_else(not_one)?;
-    Ok(match (tag.as_str(), value) {
-        ("default", FfiValue::Object(fields)) if fields.is_empty() => KeysetSelector::Default,
-        ("any", FfiValue::Object(fields)) if fields.is_empty() => KeysetSelector::Any,
-        ("name", FfiValue::String(name)) => {
-            // Valid UTF-8 by `Utf8String`'s construction invariant; checked
-            // rather than assumed because this is boundary code. A keyset
-            // name is not secret, so the payload moves out of its
-            // `Protected` rather than being copied and wiped. ZeroKMS's
-            // naming rules apply here, at the boundary, not at resolution.
-            let name = String::from_utf8(name.into_inner().risky_unwrap())
-                .map_err(|_| malformed("a keyset name is not UTF-8"))?;
-            KeysetSelector::Name(
-                Name::try_from(name.as_str())
-                    .map_err(|_| malformed("a keyset name breaks ZeroKMS's naming rules"))?,
-            )
+
+    /// Every variant is spelled; the payload of `default` and `any` is an
+    /// empty object.
+    #[derive(Deserialize)]
+    #[serde(rename_all = "lowercase", deny_unknown_fields)]
+    pub(super) enum Selector {
+        Default {},
+        Any {},
+        Name(KeysetName),
+        Id(KeysetId),
+    }
+
+    impl From<Selector> for super::KeysetSelector {
+        fn from(selector: Selector) -> Self {
+            match selector {
+                Selector::Default {} => Self::Default,
+                Selector::Any {} => Self::Any,
+                Selector::Name(KeysetName(name)) => Self::Name(name),
+                Selector::Id(KeysetId(id)) => Self::Id(id),
+            }
         }
-        ("id", FfiValue::Bytes(bytes)) => KeysetSelector::Id(
-            Uuid::from_slice(bytes.risky_ref())
-                .map_err(|_| malformed("a keyset id is not 16 bytes"))?,
-        ),
-        _ => {
-            return Err(malformed(
-                r#"a keyset selector is not {"default"}, {"any"}, {"name"} or {"id"}"#,
-            ))
+    }
+
+    /// A keyset name, checked against ZeroKMS's naming rules here at the
+    /// boundary, not at resolution.
+    #[derive(Deserialize)]
+    #[serde(try_from = "&str")]
+    pub(super) struct KeysetName(Name);
+
+    impl TryFrom<&str> for KeysetName {
+        type Error = &'static str;
+
+        fn try_from(name: &str) -> Result<Self, Self::Error> {
+            Name::try_from(name)
+                .map(KeysetName)
+                .map_err(|_| "a keyset name that breaks ZeroKMS's naming rules")
         }
-    })
+    }
+
+    /// A keyset id: exactly 16 bytes, a UUID's raw form.
+    #[derive(Deserialize)]
+    #[serde(try_from = "&[u8]")]
+    pub(super) struct KeysetId(Uuid);
+
+    impl TryFrom<&[u8]> for KeysetId {
+        type Error = &'static str;
+
+        fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
+            Uuid::from_slice(bytes)
+                .map(KeysetId)
+                .map_err(|_| "a keyset id that is not 16 bytes")
+        }
+    }
+
+    /// The context a host expects a record's context field to hold: a
+    /// string that parses as a plain label.
+    #[derive(Deserialize)]
+    #[serde(try_from = "&str")]
+    pub(super) struct ContextLabel(pub(super) Label);
+
+    impl TryFrom<&str> for ContextLabel {
+        type Error = &'static str;
+
+        fn try_from(text: &str) -> Result<Self, Self::Error> {
+            Label::parse(text)
+                .map(ContextLabel)
+                .map_err(|_| "a context that is not a plain label")
+        }
+    }
 }
 
 impl KeysetSelector {
@@ -211,47 +258,88 @@ where
 #[cfg(test)]
 mod tests {
     use super::*;
-    use vitaminc_protected::Protected;
-
-    fn obj(entries: Vec<(&str, FfiValue)>) -> FfiValue {
-        FfiValue::Object(
-            entries
-                .into_iter()
-                .map(|(k, v)| (k.to_string(), v))
-                .collect(),
-        )
+    use serde::{Serialize, Serializer};
+    use vitaminc_aead_frame::serde::to_vec;
+
+    /// A test input, written as raw frame bytes: objects by hand, so a test
+    /// can send what no writer would (a repeated key).
+    enum V {
+        Obj(Vec<(&'static str, V)>),
+        Str(String),
+        Bytes(Vec<u8>),
+        U64(u64),
+        Bool(bool),
+        Null,
     }
 
-    fn options(selector: FfiValue) -> FfiValue {
+    struct RawBytes<'a>(&'a [u8]);
+
+    impl Serialize for RawBytes<'_> {
+        fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+            s.serialize_bytes(self.0)
+        }
+    }
+
+    fn frame(v: &V) -> Vec<u8> {
+        let scalar = |r: Result<Vec<u8>, _>| r.expect("a scalar frames");
+        match v {
+            V::Obj(entries) => {
+                let mut out = vec![vitaminc_aead_frame::OBJECT];
+                out.extend_from_slice(&(entries.len() as u32).to_le_bytes());
+                for (key, value) in entries {
+                    out.extend_from_slice(&(key.len() as u32).to_le_bytes());
+                    out.extend_from_slice(key.as_bytes());
+                    out.extend_from_slice(&frame(value));
+                }
+                out
+            }
+            V::Str(text) => scalar(to_vec(text)),
+            V::Bytes(bytes) => scalar(to_vec(&RawBytes(bytes))),
+            V::U64(n) => scalar(to_vec(n)),
+            V::Bool(b) => scalar(to_vec(b)),
+            V::Null => scalar(to_vec(&())),
+        }
+    }
+
+    fn obj(entries: Vec<(&'static str, V)>) -> V {
+        V::Obj(entries)
+    }
+
+    fn options(selector: V) -> V {
         obj(vec![("keyset", selector)])
     }
 
-    fn empty() -> FfiValue {
-        FfiValue::Object(Vec::new())
+    fn empty() -> V {
+        V::Obj(Vec::new())
+    }
+
+    fn selector(v: V) -> Result<KeysetSelector, u32> {
+        parse_selector(&frame(&v))
+    }
+
+    fn opts(v: V, side: Side) -> Result<Options, u32> {
+        parse_options(&frame(&v), side)
     }
 
     #[test]
     fn every_selector_variant_is_spelled() {
         let id = Uuid::from_u128(7);
         assert_eq!(
-            parse_selector(obj(vec![("default", empty())])),
+            selector(obj(vec![("default", empty())])),
             Ok(KeysetSelector::Default)
         );
         assert_eq!(
-            parse_selector(obj(vec![("any", empty())])),
+            selector(obj(vec![("any", empty())])),
             Ok(KeysetSelector::Any)
         );
         assert_eq!(
-            parse_selector(obj(vec![("name", FfiValue::String("acme".into()))])),
+            selector(obj(vec![("name", V::Str("acme".into()))])),
             Ok(KeysetSelector::Name(
                 Name::try_from("acme").ok().expect("valid name")
             ))
         );
         assert_eq!(
-            parse_selector(obj(vec![(
-                "id",
-                FfiValue::Bytes(Protected::new(id.as_bytes().to_vec()))
-            )])),
+            selector(obj(vec![("id", V::Bytes(id.as_bytes().to_vec()))])),
             Ok(KeysetSelector::Id(id))
         );
     }
@@ -260,8 +348,8 @@ mod tests {
     fn a_selector_is_exactly_one_known_tag_with_the_right_payload() {
         for (label, bad) in [
             ("an empty object", empty()),
-            ("a string", FfiValue::String("default".into())),
-            ("null", FfiValue::Null),
+            ("a string", V::Str("default".into())),
+            ("null", V::Null),
             ("an unknown tag", obj(vec![("primary", empty())])),
             (
                 "two tags",
@@ -269,7 +357,7 @@ mod tests {
             ),
             (
                 "default with a payload",
-                obj(vec![("default", FfiValue::Bool(true))]),
+                obj(vec![("default", V::Bool(true))]),
             ),
             (
                 "default with fields",
@@ -277,33 +365,27 @@ mod tests {
             ),
             (
                 "a name that is not a string",
-                obj(vec![("name", FfiValue::UInt64(1))]),
-            ),
-            (
-                "an empty name",
-                obj(vec![("name", FfiValue::String("".into()))]),
+                obj(vec![("name", V::U64(1))]),
             ),
+            ("an empty name", obj(vec![("name", V::Str("".into()))])),
             (
                 "a name past ZeroKMS's 64-byte limit",
-                obj(vec![(
-                    "name",
-                    FfiValue::String("x".repeat(65).as_str().into()),
-                )]),
+                obj(vec![("name", V::Str("x".repeat(65)))]),
             ),
             (
                 "an id that is not 16 bytes",
-                obj(vec![("id", FfiValue::Bytes(Protected::new(vec![1, 2, 3])))]),
+                obj(vec![("id", V::Bytes(vec![1, 2, 3]))]),
             ),
             (
                 "an id as text",
                 obj(vec![(
                     "id",
-                    FfiValue::String("00000000-0000-0000-0000-000000000007".into()),
+                    V::Str("00000000-0000-0000-0000-000000000007".into()),
                 )]),
             ),
         ] {
             assert_eq!(
-                parse_selector(bad).err(),
+                selector(bad).err(),
                 Some(STATUS_ENCODING),
                 "{label} is not a selector and must be refused"
             );
@@ -313,7 +395,7 @@ mod tests {
     #[test]
     fn options_are_one_keyset_key() {
         assert_eq!(
-            parse_options(options(obj(vec![("default", empty())])), Side::Mint),
+            opts(options(obj(vec![("default", empty())])), Side::Mint),
             Ok(Options {
                 keyset: KeysetSelector::Default,
                 context: None,
@@ -321,12 +403,12 @@ mod tests {
         );
         for (label, bad) in [
             ("no keyset", empty()),
-            ("not an object", FfiValue::Null),
+            ("not an object", V::Null),
             (
                 "an unknown key beside it",
                 obj(vec![
                     ("keyset", obj(vec![("default", empty())])),
-                    ("mode", FfiValue::Bool(true)),
+                    ("mode", V::Bool(true)),
                 ]),
             ),
             (
@@ -338,7 +420,7 @@ mod tests {
             ),
         ] {
             assert_eq!(
-                parse_options(bad, Side::Open).err(),
+                opts(bad, Side::Open).err(),
                 Some(STATUS_ENCODING),
                 "{label} must be refused"
             );
@@ -347,14 +429,14 @@ mod tests {
 
     #[test]
     fn an_expected_context_is_an_opening_option_only() {
-        let with = |context: FfiValue| {
+        let with = |context: V| {
             obj(vec![
                 ("keyset", obj(vec![("default", empty())])),
                 ("context", context),
             ])
         };
         assert_eq!(
-            parse_options(with(FfiValue::String("tenants/acme".into())), Side::Open),
+            opts(with(V::Str("tenants/acme".into())), Side::Open),
             Ok(Options {
                 keyset: KeysetSelector::Default,
                 context: Some(Label::parse("tenants/acme").expect("a label")),
@@ -363,28 +445,28 @@ mod tests {
         for (label, bad, side) in [
             (
                 "on the sealing side",
-                with(FfiValue::String("tenants/acme".into())),
+                with(V::Str("tenants/acme".into())),
                 Side::Mint,
             ),
-            ("not a string", with(FfiValue::UInt64(7)), Side::Open),
+            ("not a string", with(V::U64(7)), Side::Open),
             (
                 "not a plain label",
-                with(FfiValue::String("tenants/(acme)".into())),
+                with(V::Str("tenants/(acme)".into())),
                 Side::Open,
             ),
-            ("empty", with(FfiValue::String("".into())), Side::Open),
+            ("empty", with(V::Str("".into())), Side::Open),
             (
                 "given twice",
                 obj(vec![
                     ("keyset", obj(vec![("default", empty())])),
-                    ("context", FfiValue::String("a".into())),
-                    ("context", FfiValue::String("a".into())),
+                    ("context", V::Str("a".into())),
+                    ("context", V::Str("a".into())),
                 ]),
                 Side::Open,
             ),
         ] {
             assert_eq!(
-                parse_options(bad, side).err(),
+                opts(bad, side).err(),
                 Some(STATUS_ENCODING),
                 "{label} must be refused"
             );
@@ -395,15 +477,12 @@ mod tests {
     fn any_is_an_opening_selector_only() {
         let any = || options(obj(vec![("any", empty())]));
         assert_eq!(
-            parse_options(any(), Side::Open),
+            opts(any(), Side::Open),
             Ok(Options {
                 keyset: KeysetSelector::Any,
                 context: None,
             })
         );
-        assert_eq!(
-            parse_options(any(), Side::Mint).err(),
-            Some(STATUS_ENCODING)
-        );
+        assert_eq!(opts(any(), Side::Mint).err(), Some(STATUS_ENCODING));
     }
 }
diff --git a/languages/golang/encrypt/guest/tests/leak.rs b/languages/golang/encrypt/guest/tests/leak.rs
index 64dd85a31..69d7e16f0 100644
--- a/languages/golang/encrypt/guest/tests/leak.rs
+++ b/languages/golang/encrypt/guest/tests/leak.rs
@@ -552,7 +552,7 @@ fn scenarios() -> Vec<(&'static str, FfiValue)> {
         (
             "options that are not an object",
             failure("options", &["stack_guest_abi::malformed_input"], || {
-                parse_options(s(CONTEXT), Side::Open)
+                parse_options(&encode(s(CONTEXT)), Side::Open)
             }),
         ),
         // -- ZeroKMS, through a key source whose answers carry the body ---
@@ -582,7 +582,7 @@ fn scenarios() -> Vec<(&'static str, FfiValue)> {
             "a keyset ZeroKMS does not know",
             failure("keyset", &["stack_kms::keyset_not_found"], || {
                 let options = parse_options(
-                    obj(vec![("keyset", obj(vec![("name", s("tenant"))]))]),
+                    &encode(obj(vec![("keyset", obj(vec![("name", s("tenant"))]))])),
                     Side::Mint,
                 )?;
                 block_on(options.keyset.resolve(&failing)).map(drop)
@@ -832,7 +832,7 @@ fn a_keyset_not_found_carries_its_help_and_request_kind() {
     let failing = failing();
     let error = failure("keyset", &["stack_kms::keyset_not_found"], || {
         let options = parse_options(
-            obj(vec![("keyset", obj(vec![("name", s("tenant"))]))]),
+            &encode(obj(vec![("keyset", obj(vec![("name", s("tenant"))]))])),
             Side::Mint,
         )?;
         block_on(options.keyset.resolve(&failing)).map(drop)

From 3477cc1f8356a284fa6834ba7408d0b720790881 Mon Sep 17 00:00:00 2001
From: Dan Draper <dan@cipherstash.com>
Date: Sun, 18 Oct 2026 19:18:26 +1100
Subject: [PATCH 3/7] refactor(stack-encrypt): read query statistics from a
 frame with serde, not FfiValue

Stats::from_value took an FfiValue tree and matched it by hand.
Stats::from_frame reads the frame a binding sends straight into a private
serde type (vitaminc_aead_frame::serde) and builds the same Stats. The
wire and the rules are unchanged:
- rows is a non-negative integer of any width;
- histogram and confidence may be absent or null;
- a bucket's bits must fit a u32;
- a confidence is a float of either width, never an integer (a small
  Confidence type keeps serde's f64 from accepting one);
- everything else is Reason::NotStats.

The dynamic feature now depends on vitaminc-aead-frame with its serde
feature. The Go guest's se_target_limit passes the stats frame straight
through. The tests send each case as frame bytes, objects written by hand
so the repeated-key case still reaches the reader, and gain an integer
confidence among the refusals.

Refs #1252.
---
 Cargo.lock                                    |   3 +
 languages/golang/encrypt/guest/Cargo.lock     |   1 +
 languages/golang/encrypt/guest/src/ops.rs     |   4 +-
 packages/eql/Cargo.lock                       |  12 ++
 packages/stack-encrypt/CHANGELOG.md           |   2 +-
 packages/stack-encrypt/Cargo.toml             |   5 +-
 packages/stack-encrypt/fuzz/Cargo.lock        |  12 ++
 packages/stack-encrypt/src/dynamic/mod.rs     |   2 +-
 packages/stack-encrypt/src/dynamic/query.rs   | 182 +++++++++++-------
 .../stack-encrypt/tests/fixtures/README.md    |   2 +-
 .../stack-encrypt/tests/query_operators.rs    |   5 +-
 11 files changed, 152 insertions(+), 78 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 182d8fa55..b8e275d66 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3299,6 +3299,7 @@ dependencies = [
  "trybuild",
  "uuid",
  "vitaminc-aead 0.6.1",
+ "vitaminc-aead-frame",
  "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
@@ -4200,7 +4201,9 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
 dependencies = [
+ "serde",
  "vitaminc-aead 0.6.1",
+ "zeroize",
 ]
 
 [[package]]
diff --git a/languages/golang/encrypt/guest/Cargo.lock b/languages/golang/encrypt/guest/Cargo.lock
index dc8f911d9..c9d6985fa 100644
--- a/languages/golang/encrypt/guest/Cargo.lock
+++ b/languages/golang/encrypt/guest/Cargo.lock
@@ -2083,6 +2083,7 @@ dependencies = [
  "thiserror 1.0.69",
  "uuid",
  "vitaminc-aead 0.6.1",
+ "vitaminc-aead-frame",
  "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
diff --git a/languages/golang/encrypt/guest/src/ops.rs b/languages/golang/encrypt/guest/src/ops.rs
index eba53ba34..5f3ebcaa5 100644
--- a/languages/golang/encrypt/guest/src/ops.rs
+++ b/languages/golang/encrypt/guest/src/ops.rs
@@ -301,7 +301,7 @@ pub fn verify(
 /// How many rows a probabilistic query should fetch for `want` of them to
 /// verify: the term's bytes as [`query_term`] returned them (not a frame),
 /// the codec-encoded statistics
-/// ([`Stats::from_value`](stack_encrypt::op::Stats::from_value)), the plan,
+/// ([`Stats::from_frame`](stack_encrypt::op::Stats::from_frame)), the plan,
 /// the field's name and the operator's name in; the codec-encoded limit out,
 /// an unsigned 64-bit integer or null for no finite fetch
 /// ([`dynamic::limit_to_value`]). Needs no cipher and no key.
@@ -316,7 +316,7 @@ pub fn target_limit(
     let (plan, field, operator) = parse_query(plan, field, operator)?;
     // Statistics are read without a field to hand; the error names the
     // query's, as every other refusal of a query does.
-    let stats = stack_encrypt::op::Stats::from_value(&decode_value(stats)?)
+    let stats = stack_encrypt::op::Stats::from_frame(stats)
         .map_err(|e| fail_dynamic(&e.in_field(field)))?;
     let limit = dynamic::target_limit(&plan, field, operator, term, want, &stats, &resolver())
         .map_err(|e| fail_dynamic(&e))?;
diff --git a/packages/eql/Cargo.lock b/packages/eql/Cargo.lock
index 12a1ee68a..87ff02e4b 100644
--- a/packages/eql/Cargo.lock
+++ b/packages/eql/Cargo.lock
@@ -4238,6 +4238,7 @@ dependencies = [
  "thiserror 1.0.69",
  "uuid",
  "vitaminc-aead 0.6.1",
+ "vitaminc-aead-frame",
  "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
@@ -5122,6 +5123,17 @@ dependencies = [
  "syn 3.0.3",
 ]
 
+[[package]]
+name = "vitaminc-aead-frame"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
+dependencies = [
+ "serde",
+ "vitaminc-aead 0.6.1",
+ "zeroize",
+]
+
 [[package]]
 name = "vitaminc-context"
 version = "0.5.1"
diff --git a/packages/stack-encrypt/CHANGELOG.md b/packages/stack-encrypt/CHANGELOG.md
index fe2276ef0..1eed247f6 100644
--- a/packages/stack-encrypt/CHANGELOG.md
+++ b/packages/stack-encrypt/CHANGELOG.md
@@ -42,7 +42,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `Reason::OperatorNotAnswered`; `check_query` refuses the same without a
   cipher. `dynamic::verify` checks a page of decrypted values against a
   probabilistic query and `dynamic::target_limit` sizes its fetch from the
-  term's bytes and `Stats` (`Stats::from_value` reads their wire form), by
+  term's bytes and `Stats` (`Stats::from_frame` reads their wire form), by
   the code the typed `MatchQuery` runs, with the field's own match options;
   neither uses a key. The catalog entry of an EQL type
   (`TargetDescriptor::to_value`) lists the operators the engine answers for
diff --git a/packages/stack-encrypt/Cargo.toml b/packages/stack-encrypt/Cargo.toml
index f7b45ef5d..9531bc714 100644
--- a/packages/stack-encrypt/Cargo.toml
+++ b/packages/stack-encrypt/Cargo.toml
@@ -39,6 +39,9 @@ vitaminc-hmac = { workspace = true }
 vitaminc-normalize = { workspace = true }
 vitaminc-prf = { workspace = true }
 vitaminc-protected = { workspace = true }
+# `dynamic` only: serde over the transport frame, which reads a binding's
+# control data (statistics, options, a plan) into typed messages.
+vitaminc-aead-frame = { workspace = true, optional = true, features = ["serde"] }
 serde = { workspace = true }
 # `Descriptor`: the base64 rendering of a non-textual context for ZeroKMS.
 base64ct = { version = "1.7", features = ["alloc"] }
@@ -64,7 +67,7 @@ http = ["dep:stack-auth", "stack-auth/http", "stack-kms/http"]
 # `stack_encrypt::dynamic`: encrypt and decrypt values whose types are known
 # only at runtime, as an FFI binding's are. Off by default — it is only of
 # use to a binding author. Its transport frames are vitaminc-aead's own.
-dynamic = []
+dynamic = ["dep:vitaminc-aead-frame"]
 # `stack_encrypt::kms::FakeDataKeySource`: the in-memory key source for tests
 # with no ZeroKMS, so a caller's dev-dependency on stack-encrypt is enough and
 # no direct stack-kms dependency has to agree with this crate's.
diff --git a/packages/stack-encrypt/fuzz/Cargo.lock b/packages/stack-encrypt/fuzz/Cargo.lock
index eb8dca476..46ebdef16 100644
--- a/packages/stack-encrypt/fuzz/Cargo.lock
+++ b/packages/stack-encrypt/fuzz/Cargo.lock
@@ -2042,6 +2042,7 @@ dependencies = [
  "thiserror 1.0.69",
  "uuid",
  "vitaminc-aead 0.6.1",
+ "vitaminc-aead-frame",
  "vitaminc-encrypt 0.6.1",
  "vitaminc-hmac",
  "vitaminc-normalize",
@@ -2598,6 +2599,17 @@ dependencies = [
  "syn 3.0.3",
 ]
 
+[[package]]
+name = "vitaminc-aead-frame"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35992a269bcaa5b201f1938e54bfbf167bfa6fe975d83cbdbdb54c2a363c5ef"
+dependencies = [
+ "serde",
+ "vitaminc-aead 0.6.1",
+ "zeroize",
+]
+
 [[package]]
 name = "vitaminc-context"
 version = "0.5.1"
diff --git a/packages/stack-encrypt/src/dynamic/mod.rs b/packages/stack-encrypt/src/dynamic/mod.rs
index c65dad12c..eb6bf0f98 100644
--- a/packages/stack-encrypt/src/dynamic/mod.rs
+++ b/packages/stack-encrypt/src/dynamic/mod.rs
@@ -588,7 +588,7 @@ reasons! {
         /// The term is not one the field's index derives for the operator.
         NotAQueryTerm => "not_a_query_term", "the term is not one the field's index derives for the operator";
         /// Statistics are not a row count with an optional histogram and
-        /// confidence ([`Stats::from_value`](crate::op::Stats::from_value)).
+        /// confidence ([`Stats::from_frame`](crate::op::Stats::from_frame)).
         NotStats => "not_stats", "the statistics are not a row count with an optional histogram and confidence";
     }
 }
diff --git a/packages/stack-encrypt/src/dynamic/query.rs b/packages/stack-encrypt/src/dynamic/query.rs
index e283c9b21..8f4daa01e 100644
--- a/packages/stack-encrypt/src/dynamic/query.rs
+++ b/packages/stack-encrypt/src/dynamic/query.rs
@@ -58,8 +58,8 @@
 //! # Wire format
 //!
 //! An operator is its [`name`](OpSpec::name). A query term is the object
-//! [`QueryTerm::to_value`] writes, the statistics the object
-//! [`Stats::from_value`] reads, and a limit the value
+//! [`QueryTerm::to_value`] writes, the statistics the frame object
+//! [`Stats::from_frame`] reads, and a limit the value
 //! [`limit_to_value`] writes; each is documented where it is written.
 //!
 //! [`Probabilistic::verify`]: crate::op::Probabilistic::verify
@@ -946,7 +946,7 @@ fn twin_query_bits(term: &[u8], options: &MatchOptions) -> Option<usize> {
 }
 
 impl Stats {
-    /// Read statistics from their wire form, an object:
+    /// Read statistics from their wire form, a frame object:
     ///
     /// | key | value |
     /// |---|---|
@@ -954,71 +954,60 @@ impl Stats {
     /// | `histogram` | optional, or null: a list of `[bits, rows]` pairs of integers, a measured histogram of the stored filters' set-bit counts ([`Stats::measured`]); absent, the declared prior ([`Stats::declared`]) |
     /// | `confidence` | optional, or null: a float, the confidence to target instead of 99% ([`Stats::with_confidence`]) |
     ///
-    /// Integers are read at any width and must not be negative.
+    /// Integers are read at any width up to 64 bits and must not be
+    /// negative; `bits` must fit a `u32`. A confidence is a float of either
+    /// width, never an integer.
     ///
     /// # Errors
     ///
-    /// [`Error::Source`] with [`Reason::NotStats`] for anything else: not an
-    /// object, no `rows`, a key given twice or not one of the three, or a
-    /// value of another type.
-    pub fn from_value(value: &FfiValue) -> Result<Self, Error> {
-        let refused = || Error::bad_source(Reason::NotStats);
-        let FfiValue::Object(entries) = value else {
-            return Err(refused());
+    /// [`Error::Source`] with [`Reason::NotStats`] for anything else: not a
+    /// frame, not an object, no `rows`, a key given twice or not one of the
+    /// three, or a value of another type.
+    pub fn from_frame(bytes: &[u8]) -> Result<Self, Error> {
+        let wire: StatsWire = vitaminc_aead_frame::serde::from_slice(bytes)
+            .map_err(|_| Error::bad_source(Reason::NotStats))?;
+        let stats = match wire.histogram {
+            Some(histogram) => Stats::measured(wire.rows, histogram),
+            None => Stats::declared(wire.rows),
         };
-        let mut seen: Vec<&str> = Vec::with_capacity(entries.len());
-        let (mut rows, mut histogram, mut confidence) = (None, None, None);
-        for (key, value) in entries {
-            if seen.contains(&key.as_str()) {
-                return Err(refused());
-            }
-            seen.push(key);
-            match (key.as_str(), value) {
-                ("histogram" | "confidence", FfiValue::Null) => {}
-                ("rows", rows_value) => rows = Some(unsigned(rows_value).ok_or_else(refused)?),
-                ("histogram", FfiValue::Array(buckets)) => {
-                    histogram = Some(
-                        buckets
-                            .iter()
-                            .map(|bucket| match bucket {
-                                FfiValue::Array(pair) => match pair.as_slice() {
-                                    [bits, rows] => Some((
-                                        u32::try_from(unsigned(bits)?).ok()?,
-                                        unsigned(rows)?,
-                                    )),
-                                    _ => None,
-                                },
-                                _ => None,
-                            })
-                            .collect::<Option<Vec<(u32, u64)>>>()
-                            .ok_or_else(refused)?,
-                    );
-                }
-                ("confidence", FfiValue::Float64(c)) => confidence = Some(*c),
-                ("confidence", FfiValue::Float32(c)) => confidence = Some(f64::from(*c)),
-                _ => return Err(refused()),
-            }
-        }
-        let rows = rows.ok_or_else(refused)?;
-        let stats = match histogram {
-            Some(histogram) => Stats::measured(rows, histogram),
-            None => Stats::declared(rows),
-        };
-        Ok(match confidence {
-            Some(confidence) => stats.with_confidence(confidence),
+        Ok(match wire.confidence {
+            Some(Confidence(confidence)) => stats.with_confidence(confidence),
             None => stats,
         })
     }
 }
 
-/// A non-negative integer of any width.
-fn unsigned(value: &FfiValue) -> Option<u64> {
-    match value {
-        FfiValue::Int32(v) => u64::try_from(*v).ok(),
-        FfiValue::Int64(v) => u64::try_from(*v).ok(),
-        FfiValue::UInt32(v) => Some(u64::from(*v)),
-        FfiValue::UInt64(v) => Some(*v),
-        _ => None,
+/// [`Stats`] as a binding writes it ([`Stats::from_frame`]).
+#[derive(serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+struct StatsWire {
+    rows: u64,
+    #[serde(default)]
+    histogram: Option<Vec<(u32, u64)>>,
+    #[serde(default)]
+    confidence: Option<Confidence>,
+}
+
+/// A confidence: a float of either width. serde's own `f64` would also take
+/// an integer, which the wire form refuses.
+struct Confidence(f64);
+
+impl<'de> serde::Deserialize<'de> for Confidence {
+    fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        struct V;
+        impl serde::de::Visitor<'_> for V {
+            type Value = Confidence;
+            fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                f.write_str("a float")
+            }
+            fn visit_f32<E>(self, v: f32) -> Result<Confidence, E> {
+                Ok(Confidence(f64::from(v)))
+            }
+            fn visit_f64<E>(self, v: f64) -> Result<Confidence, E> {
+                Ok(Confidence(v))
+            }
+        }
+        d.deserialize_any(V)
     }
 }
 
@@ -1031,6 +1020,29 @@ pub fn limit_to_value(limit: Limit) -> FfiValue {
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    /// Statistics as a binding sends them: `value` written as frame bytes,
+    /// objects by hand so a test can send a repeated key, which no frame
+    /// writer would.
+    fn stats_frame(value: &FfiValue) -> Result<Stats, Error> {
+        fn raw(value: &FfiValue, out: &mut Vec<u8>) {
+            match value {
+                FfiValue::Object(entries) => {
+                    out.push(vitaminc_aead::frame::OBJECT);
+                    out.extend_from_slice(&(entries.len() as u32).to_le_bytes());
+                    for (key, value) in entries {
+                        out.extend_from_slice(&(key.len() as u32).to_le_bytes());
+                        out.extend_from_slice(key.as_bytes());
+                        raw(value, out);
+                    }
+                }
+                other => out.extend_from_slice(other.to_frame().expect("frames").risky_ref()),
+            }
+        }
+        let mut bytes = Vec::new();
+        raw(value, &mut bytes);
+        Stats::from_frame(&bytes)
+    }
     use crate::dynamic::{record, NoTargets, TargetError};
     use crate::op::{self, Probabilistic as _};
     use crate::sem::MatchTerms;
@@ -1772,11 +1784,11 @@ mod tests {
             FfiValue::Array(vec![FfiValue::UInt32(bits), FfiValue::UInt64(rows)])
         };
         assert_eq!(
-            Stats::from_value(&object(vec![("rows", FfiValue::UInt64(9))])).unwrap(),
+            stats_frame(&object(vec![("rows", FfiValue::UInt64(9))])).unwrap(),
             Stats::declared(9)
         );
         assert_eq!(
-            Stats::from_value(&object(vec![
+            stats_frame(&object(vec![
                 ("rows", FfiValue::Int64(9)),
                 ("histogram", FfiValue::Null),
                 ("confidence", FfiValue::Null),
@@ -1785,7 +1797,7 @@ mod tests {
             Stats::declared(9)
         );
         assert_eq!(
-            Stats::from_value(&object(vec![
+            stats_frame(&object(vec![
                 ("histogram", FfiValue::Array(vec![pair(3, 4), pair(5, 6)])),
                 ("confidence", FfiValue::Float64(0.9)),
                 ("rows", FfiValue::UInt32(10)),
@@ -1795,6 +1807,18 @@ mod tests {
         );
         for (what, bad) in [
             ("not an object", FfiValue::UInt64(9)),
+            (
+                "an array by position",
+                FfiValue::Array(vec![FfiValue::UInt64(9)]),
+            ),
+            (
+                "every key by position",
+                FfiValue::Array(vec![
+                    FfiValue::UInt64(9),
+                    FfiValue::Array(vec![pair(3, 4)]),
+                    FfiValue::Float64(0.5),
+                ]),
+            ),
             ("no rows", object(vec![])),
             ("null rows", object(vec![("rows", FfiValue::Null)])),
             ("negative rows", object(vec![("rows", FfiValue::Int64(-1))])),
@@ -1840,8 +1864,15 @@ mod tests {
                     ("confidence", text("high")),
                 ]),
             ),
+            (
+                "confidence as an integer",
+                object(vec![
+                    ("rows", FfiValue::UInt64(1)),
+                    ("confidence", FfiValue::UInt64(1)),
+                ]),
+            ),
         ] {
-            let error = Stats::from_value(&bad).unwrap_err();
+            let error = stats_frame(&bad).unwrap_err();
             assert_eq!(reason_of(&error), (None, Some(Reason::NotStats)), "{what}");
         }
     }
@@ -2054,14 +2085,23 @@ mod tests {
 
     #[test]
     fn a_count_is_read_at_any_width_and_never_negative() {
-        assert_eq!(unsigned(&FfiValue::Int32(7)), Some(7));
-        assert_eq!(unsigned(&FfiValue::Int64(7)), Some(7));
-        assert_eq!(unsigned(&FfiValue::UInt32(7)), Some(7));
-        assert_eq!(unsigned(&FfiValue::UInt64(7)), Some(7));
-        assert_eq!(unsigned(&FfiValue::Int32(-7)), None);
-        assert_eq!(unsigned(&FfiValue::Int64(-7)), None);
-        assert_eq!(unsigned(&FfiValue::Float64(7.0)), None);
-        let confidence = Stats::from_value(&FfiValue::Object(vec![
+        let rows = |value: FfiValue| stats_frame(&FfiValue::Object(vec![("rows".into(), value)]));
+        for value in [
+            FfiValue::Int32(7),
+            FfiValue::Int64(7),
+            FfiValue::UInt32(7),
+            FfiValue::UInt64(7),
+        ] {
+            assert_eq!(rows(value).unwrap(), Stats::declared(7));
+        }
+        for value in [
+            FfiValue::Int32(-7),
+            FfiValue::Int64(-7),
+            FfiValue::Float64(7.0),
+        ] {
+            assert!(rows(value).is_err());
+        }
+        let confidence = stats_frame(&FfiValue::Object(vec![
             ("rows".into(), FfiValue::Int32(3)),
             ("confidence".into(), FfiValue::Float32(0.5)),
         ]))
diff --git a/packages/stack-encrypt/tests/fixtures/README.md b/packages/stack-encrypt/tests/fixtures/README.md
index 27fb9f2ab..4fedec2eb 100644
--- a/packages/stack-encrypt/tests/fixtures/README.md
+++ b/packages/stack-encrypt/tests/fixtures/README.md
@@ -135,7 +135,7 @@ file changes only when a derivation does: regenerate it with
   boolean `verify` answers for each, which is what the typed `MatchQuery`
   answers.
 - **`target_limit`.** A match term's bytes, the statistics in the wire form
-  `Stats::from_value` reads (an absent histogram is the declared prior), and
+  `Stats::from_frame` reads (an absent histogram is the declared prior), and
   the limit, null when no finite fetch can be promised, which is what the
   typed `MatchQuery` answers.
 
diff --git a/packages/stack-encrypt/tests/query_operators.rs b/packages/stack-encrypt/tests/query_operators.rs
index d8e133690..7241454ed 100644
--- a/packages/stack-encrypt/tests/query_operators.rs
+++ b/packages/stack-encrypt/tests/query_operators.rs
@@ -276,7 +276,10 @@ async fn derived() -> Json {
         };
         let typed = typed_match(&cipher, input).await;
         for (stats_json, stats) in stats_cases() {
-            let read = Stats::from_value(&ffi_of_json(&stats_json)).expect("stats read");
+            let read = Stats::from_frame(vitaminc_protected::Controlled::risky_ref(
+                &ffi_of_json(&stats_json).to_frame().expect("frames"),
+            ))
+            .expect("stats read");
             assert_eq!(read, stats, "the wire form reads as the typed stats");
             let limit =
                 dynamic::target_limit(&plan, "name", OpSpec::Matches, bytes, 10, &read, &NoTargets)

From a668f9bf911828215b458a612af18a9e1807a28b Mon Sep 17 00:00:00 2001
From: Dan Draper <dan@cipherstash.com>
Date: Sun, 18 Oct 2026 20:32:00 +1100
Subject: [PATCH 4/7] refactor(golang): read the cipher config and the test
 seed with serde, not FfiValue

The guest decoded the se_cipher_init buffer into an FfiValue tree, wiped
the buffer, then matched the tree by hand. It now reads the frame straight
into a private serde type (vitaminc_aead_frame::serde) and builds the
CipherConfig before the buffer is wiped. Every string is borrowed from the
buffer, so the only copy of the client key the parser makes is the
ClientKey itself; the FfiValue's own copy of the key is gone.

Each key validates as it reads, through a try_from newtype with a fixed
message: client_id is a UUID, zerokms_url an endpoint, keyset_cache_size a
positive decimal string. An optional key that is null is refused, as
before. A refusal names the key at fault and never a value, and an unknown
key is not named. The messages are now serde's, with the key on the path
("the config: client_id: a client id that is not a UUID"), and the status
is STATUS_ENCODING as before. ConfigError is gone.

The deterministic build's seed is a Seed type read from bytes, 32 of them,
and wiped on drop. The tests send frames written by hand through a shared
test builder, and check that no refusal repeats the client key or any
value it was sent.

Refs #1252.
---
 languages/golang/encrypt/guest/src/abi.rs     |  51 +-
 languages/golang/encrypt/guest/src/config.rs  | 441 +++++++++---------
 .../golang/encrypt/guest/src/deterministic.rs |  56 +++
 languages/golang/encrypt/guest/src/lib.rs     |   2 +
 languages/golang/encrypt/guest/src/options.rs |  76 +--
 .../golang/encrypt/guest/src/test_frame.rs    |  74 +++
 languages/golang/encrypt/guest/tests/leak.rs  |  10 +-
 languages/golang/encrypt/memory_test.go       |  11 +-
 8 files changed, 415 insertions(+), 306 deletions(-)
 create mode 100644 languages/golang/encrypt/guest/src/test_frame.rs

diff --git a/languages/golang/encrypt/guest/src/abi.rs b/languages/golang/encrypt/guest/src/abi.rs
index c1bad3007..1cd4ce19a 100644
--- a/languages/golang/encrypt/guest/src/abi.rs
+++ b/languages/golang/encrypt/guest/src/abi.rs
@@ -75,7 +75,6 @@ use std::cell::{Cell, RefCell};
 use std::panic::{catch_unwind, AssertUnwindSafe};
 
 use futures::executor::block_on;
-use stack_encrypt::dynamic::FfiValue;
 use stack_encrypt::{KeysetCipher, StackCipher};
 use stack_guest_abi::abi::{export, input, take_plaintext, wipe_input};
 use stack_guest_abi::buffers;
@@ -111,12 +110,6 @@ thread_local! {
     static SHUT_DOWN: Cell<bool> = const { Cell::new(false) };
 }
 
-/// Decode one codec-encoded input.
-fn decode(bytes: &[u8]) -> Result<FfiValue, u32> {
-    FfiValue::from_frame(bytes)
-        .map_err(|_| malformed("an input is not a value in the transport frame"))
-}
-
 /// Run `f` with the instance's cipher, or report `STATUS_STATE` when there
 /// is none (never initialised, or shut down).
 fn with_cipher<R>(f: impl FnOnce(&GuestCipher) -> Result<R, u32>) -> Result<R, u32> {
@@ -159,7 +152,7 @@ fn with_scope<R>(
     })
 }
 
-/// Initialise the instance's cipher from an FFI-codec-encoded config object
+/// Initialise the instance's cipher from a config frame
 /// (see [`crate::config`]). Performs one `load-keyset` round trip through
 /// the host transport for the default keyset, and returns that keyset's id
 /// (16 raw UUID bytes) as the output buffer. The raw config buffer — which
@@ -182,27 +175,36 @@ pub unsafe extern "C" fn se_cipher_init(cfg_ptr: *mut u8, cfg_len: u32) -> u64 {
     export(|| {
         // The pointer/length pair is validated first and on its own: a pair
         // that fails here returns before anything touches the range, which
-        // is `wipe_input`'s precondition. Only a validated buffer is decoded
-        // and, whatever the decode outcome, wiped.
+        // is `wipe_input`'s precondition. Only a validated buffer is parsed
+        // and, whatever the outcome, wiped.
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns and before any wipe of an overlapping range.
         let bytes = unsafe { input(cfg_ptr, cfg_len)? };
-        let decoded = decode(bytes);
-        // The borrow of the raw buffer ends with `decoded` owned; wipe the
-        // buffer now — it holds the client-key hex — before parsing (and
-        // before the init round trip), whatever the decode outcome.
+        // The parser borrows the buffer's strings and owns only what it
+        // builds from them, so the borrow ends here; wipe the buffer now —
+        // it holds the client key — before the init round trip, whatever
+        // the parse outcome.
+        let config = parse_init(bytes);
         unsafe { wipe_input(cfg_ptr, cfg_len) };
-        cipher_init(decoded?)
+        cipher_init(config?)
     })
 }
 
 #[cfg(not(feature = "deterministic-kms"))]
-fn cipher_init(decoded: FfiValue) -> Result<Vec<u8>, u32> {
+use crate::config::{parse_config as parse_init, CipherConfig as InitConfig};
+#[cfg(feature = "deterministic-kms")]
+use crate::deterministic::Seed as InitConfig;
+#[cfg(feature = "deterministic-kms")]
+fn parse_init(bytes: &[u8]) -> Result<InitConfig, u32> {
+    InitConfig::parse(bytes)
+}
+
+#[cfg(not(feature = "deterministic-kms"))]
+fn cipher_init(config: InitConfig) -> Result<Vec<u8>, u32> {
     use crate::host::{HostTokenStrategy, WasiHostConnection};
     use crate::status::STATUS_KMS_TRANSPORT;
     use stack_kms::{ClientOpts, StackKms};
 
-    let config = crate::config::parse_config(decoded).map_err(|e| malformed(e.describe()))?;
     if SHUT_DOWN.with(Cell::get) || CIPHER.with(|c| c.borrow().is_some()) {
         return Err(init_out_of_order());
     }
@@ -246,22 +248,11 @@ fn cipher_init(decoded: FfiValue) -> Result<Vec<u8>, u32> {
 /// endpoint, no token, no network. A test artefact, never shipped; see
 /// [`crate::deterministic`].
 #[cfg(feature = "deterministic-kms")]
-fn cipher_init(decoded: FfiValue) -> Result<Vec<u8>, u32> {
-    use vitaminc_protected::Controlled;
-
-    let not_a_seed = || malformed("the deterministic build's config is a 32-byte seed");
-    let FfiValue::Bytes(seed) = decoded else {
-        return Err(not_a_seed());
-    };
-    let seed: [u8; 32] = seed
-        .risky_ref()
-        .as_slice()
-        .try_into()
-        .map_err(|_| not_a_seed())?;
+fn cipher_init(seed: InitConfig) -> Result<Vec<u8>, u32> {
     if SHUT_DOWN.with(Cell::get) || CIPHER.with(|c| c.borrow().is_some()) {
         return Err(init_out_of_order());
     }
-    let builder = StackCipher::builder().kms(crate::deterministic::DeterministicSource::new(seed));
+    let builder = StackCipher::builder().kms(seed.source());
     install(block_on(builder.init()).map_err(|e| crate::status::fail_error(&e))?)
 }
 
diff --git a/languages/golang/encrypt/guest/src/config.rs b/languages/golang/encrypt/guest/src/config.rs
index e31f1e7d7..a08f576ce 100644
--- a/languages/golang/encrypt/guest/src/config.rs
+++ b/languages/golang/encrypt/guest/src/config.rs
@@ -1,8 +1,8 @@
 //! Parsing of the `se_cipher_init` configuration.
 //!
-//! The config crosses the boundary as one FFI-codec-encoded
-//! [`FfiValue::Object`] — the same codec every other entry point uses, so
-//! there is no second config format. Recognised keys (all string values):
+//! The config crosses the boundary as one frame object, read by serde
+//! (`vitaminc_aead_frame::serde`), the same format as every other control
+//! message. Recognised keys (all string values):
 //!
 //! | key           | required | meaning |
 //! |---------------|----------|---------|
@@ -17,60 +17,26 @@
 //! Every other keyset is selected per call (see [`crate::options`]). Unknown
 //! keys are rejected — a typo'd optional key must not silently fall back to a
 //! default — so a host still sending `keyset` is told so rather than quietly
-//! encrypting somewhere else.
+//! encrypting somewhere else. A key given twice is refused by the frame.
 //!
-//! The parsed [`FfiValue`] holds the client-key hex inside
-//! `Protected`, which wipes on drop; the raw config *buffer* is wiped by the
-//! ABI layer immediately after decoding (see [`crate::abi`]).
+//! Every string is borrowed from the config buffer, so the only copy of the
+//! client key this parser makes is the [`ClientKey`] it builds. The ABI
+//! layer wipes the buffer as soon as [`parse_config`] returns (see
+//! [`crate::abi`]).
+//!
+//! A refusal is [`STATUS_ENCODING`](crate::status::STATUS_ENCODING), with a
+//! message that names the key at fault and never a value, because the
+//! config holds the client key. An unrecognised key is not named either:
+//! if a value is pasted where a key should be, the unrecognised key *is*
+//! that value.
 
 use std::num::NonZeroUsize;
 
-use stack_encrypt::dynamic::FfiValue;
+use serde::{Deserialize, Deserializer};
+use stack_guest_abi::last_error::malformed;
 use stack_kms::{ClientKey, ZeroKmsEndpoint};
 use uuid::Uuid;
-use zeroize::Zeroizing;
-
-/// A parse failure, carrying which key was at fault. Maps to
-/// `STATUS_ENCODING` at the ABI, and [`describe`](Self::describe) is the
-/// message the host reads through `se_last_error`: the name of the key at
-/// fault crosses the boundary, its value never does.
-#[derive(Debug, PartialEq, Eq)]
-pub enum ConfigError {
-    /// The config was not an object of string values.
-    NotAnObject,
-    /// A required key was absent.
-    Missing(&'static str),
-    /// A key held something other than a string.
-    NotAString(&'static str),
-    /// A key's value failed its own validation (bad UUID, bad hex, bad URL).
-    Invalid(&'static str),
-    /// A key appeared twice. The codec rejects duplicate object keys before
-    /// this parser runs, but `parse_config` is `pub` and takes any
-    /// [`FfiValue`] — last-write-wins on, say, `client_key` must never be
-    /// silent.
-    Duplicate(&'static str),
-    /// A key this version does not recognise.
-    UnknownKey(String),
-}
-
-impl ConfigError {
-    /// Says what was wrong with the config, for the host to read.
-    ///
-    /// The message names the key at fault but never its value, because the
-    /// config holds the client key. An unrecognised key is not named
-    /// either: if a value is pasted where a key should be, the unrecognised
-    /// key *is* that value.
-    pub fn describe(&self) -> String {
-        match self {
-            Self::NotAnObject => "the config is not an object of string values".to_owned(),
-            Self::Missing(key) => format!("the config has no {key}"),
-            Self::NotAString(key) => format!("the config's {key} is not a string"),
-            Self::Invalid(key) => format!("the config's {key} is not valid"),
-            Self::Duplicate(key) => format!("the config gives {key} twice"),
-            Self::UnknownKey(_) => "the config has a key this version does not know".to_owned(),
-        }
-    }
-}
+use vitaminc_aead_frame::serde::from_slice;
 
 /// Everything `se_cipher_init` needs to build the cipher.
 pub struct CipherConfig {
@@ -79,93 +45,93 @@ pub struct CipherConfig {
     pub keyset_cache_size: Option<NonZeroUsize>,
 }
 
-/// Parse a decoded config value. Consumes it so the client-key material has
-/// one owner; the `Protected` payloads are wiped when the strings drop here.
-pub fn parse_config(value: FfiValue) -> Result<CipherConfig, ConfigError> {
-    let FfiValue::Object(entries) = value else {
-        return Err(ConfigError::NotAnObject);
-    };
+/// Parse the config frame a host sent. See the [module docs](self).
+pub fn parse_config(bytes: &[u8]) -> Result<CipherConfig, u32> {
+    read(bytes).map_err(malformed)
+}
 
-    // Every slot is a `Zeroizing<String>`, not just the key one: the
-    // client-key slot *must* wipe on every exit path (any of the `?`s below
-    // can fire while it holds a full encoding of the client root key), and
-    // making one slot special invites the next edit to add an early return
-    // above the wipe. Uniform is cheaper than remembering.
-    let mut client_id: Option<Zeroizing<String>> = None;
-    let mut client_key_encoded: Option<Zeroizing<String>> = None;
-    let mut url: Option<Zeroizing<String>> = None;
-    let mut cache_size: Option<Zeroizing<String>> = None;
+/// [`parse_config`], with the refusal's message.
+fn read(bytes: &[u8]) -> Result<CipherConfig, String> {
+    let wire: Wire<'_> = from_slice(bytes).map_err(|e| format!("the config: {e}"))?;
+    // `from_encoded_v1` is lenient by design: hex in either case *or* the
+    // base64 `secretkey.json` holds, matching every native loader.
+    let client_key = ClientKey::from_encoded_v1(wire.client_id.0, wire.client_key)
+        .map_err(|_| "the config: client_key: a client key that is not valid".to_owned())?;
+    Ok(CipherConfig {
+        client_key,
+        endpoint: wire.zerokms_url.map(|url| url.0),
+        keyset_cache_size: wire.keyset_cache_size.map(|size| size.0),
+    })
+}
 
-    for (key, value) in entries {
-        let slot = match key.as_str() {
-            "client_id" => &mut client_id,
-            "client_key" => &mut client_key_encoded,
-            "zerokms_url" => &mut url,
-            "keyset_cache_size" => &mut cache_size,
-            _ => return Err(ConfigError::UnknownKey(key)),
-        };
-        // The codec already rejects duplicate object keys, so on the ABI
-        // path the slot is always vacant — but this function accepts any
-        // `FfiValue`, so enforce it rather than assume it.
-        if slot.is_some() {
-            return Err(ConfigError::Duplicate(name_of(&key)));
-        }
-        let FfiValue::String(s) = value else {
-            return Err(ConfigError::NotAString(name_of(&key)));
-        };
-        let text = Zeroizing::new(
-            std::str::from_utf8(s.risky_ref())
-                .map_err(|_| ConfigError::NotAString(name_of(&key)))?
-                .to_string(),
-        );
-        *slot = Some(text);
-    }
+/// The config as a host writes it. Each field validates as it reads,
+/// through `TryFrom`. The frame's serde never repeats a `TryFrom` error's
+/// text (it could carry the value), so a refusal names the key and says
+/// only that its value was not accepted; each error here is still a fixed
+/// string, for the reader.
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Wire<'a> {
+    client_id: ClientId,
+    client_key: &'a str,
+    #[serde(default, deserialize_with = "present")]
+    zerokms_url: Option<Url>,
+    #[serde(default, deserialize_with = "present")]
+    keyset_cache_size: Option<CacheSize>,
+}
 
-    let client_id = client_id.ok_or(ConfigError::Missing("client_id"))?;
-    let client_id = Uuid::parse_str(&client_id).map_err(|_| ConfigError::Invalid("client_id"))?;
+/// Absent is `None`. Present, a value must be a string: a null is refused.
+fn present<'de, D: Deserializer<'de>, T: Deserialize<'de>>(d: D) -> Result<Option<T>, D::Error> {
+    T::deserialize(d).map(Some)
+}
 
-    // Lenient by design: `from_encoded_v1` takes hex in either case *or* the
-    // base64 `secretkey.json` holds, matching every native loader. The
-    // `Zeroizing` slot wipes the encoded copy however this returns — the
-    // decoded `FfiValue`'s own copy was consumed above, and the raw input
-    // buffer is the ABI layer's to wipe.
-    let client_key_encoded = client_key_encoded.ok_or(ConfigError::Missing("client_key"))?;
-    let client_key = ClientKey::from_encoded_v1(client_id, &client_key_encoded)
-        .map_err(|_| ConfigError::Invalid("client_key"))?;
+/// A client id: a UUID, as text.
+#[derive(Deserialize)]
+#[serde(try_from = "&str")]
+struct ClientId(Uuid);
 
-    let endpoint = url
-        .map(|u| u.parse().map_err(|_| ConfigError::Invalid("zerokms_url")))
-        .transpose()?;
+impl TryFrom<&str> for ClientId {
+    type Error = &'static str;
 
-    let keyset_cache_size = cache_size
-        .map(|n| {
-            n.parse::<NonZeroUsize>()
-                .map_err(|_| ConfigError::Invalid("keyset_cache_size"))
-        })
-        .transpose()?;
+    fn try_from(text: &str) -> Result<Self, Self::Error> {
+        Uuid::parse_str(text)
+            .map(ClientId)
+            .map_err(|_| "a client id that is not a UUID")
+    }
+}
 
-    Ok(CipherConfig {
-        client_key,
-        endpoint,
-        keyset_cache_size,
-    })
+/// The ZeroKMS endpoint to pin.
+#[derive(Deserialize)]
+#[serde(try_from = "&str")]
+struct Url(ZeroKmsEndpoint);
+
+impl TryFrom<&str> for Url {
+    type Error = &'static str;
+
+    fn try_from(text: &str) -> Result<Self, Self::Error> {
+        text.parse().map(Url).map_err(|_| "a URL that is not valid")
+    }
 }
 
-/// Intern the key name for error reporting (`&'static str` keeps
-/// [`ConfigError`] cheap; unknown keys carry the owned string instead).
-fn name_of(key: &str) -> &'static str {
-    match key {
-        "client_id" => "client_id",
-        "client_key" => "client_key",
-        "zerokms_url" => "zerokms_url",
-        "keyset_cache_size" => "keyset_cache_size",
-        _ => "unknown",
+/// A positive integer, as a decimal string.
+#[derive(Deserialize)]
+#[serde(try_from = "&str")]
+struct CacheSize(NonZeroUsize);
+
+impl TryFrom<&str> for CacheSize {
+    type Error = &'static str;
+
+    fn try_from(text: &str) -> Result<Self, Self::Error> {
+        text.parse()
+            .map(CacheSize)
+            .map_err(|_| "a size that is not a positive decimal integer")
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::test_frame::{frame, obj, s, V};
 
     /// A valid v1 client key for fixtures, minted through the real key type
     /// so the hex exercises the actual `from_hex_v1` decoder.
@@ -178,22 +144,27 @@ mod tests {
         (id, key.to_hex_v1().expect("encode fixture key"))
     }
 
-    fn obj(entries: Vec<(&str, &str)>) -> FfiValue {
-        FfiValue::Object(
-            entries
-                .into_iter()
-                .map(|(k, v)| (k.to_string(), FfiValue::String(v.into())))
-                .collect(),
-        )
+    fn config(entries: Vec<(&'static str, V)>) -> Result<CipherConfig, String> {
+        read(&frame(&obj(entries)))
+    }
+
+    /// The config's refusal, checked to name neither the client key nor any
+    /// value or unknown key the test sent.
+    fn refused(v: &V, secrets: &[&str]) -> String {
+        let message = read(&frame(v)).err().expect("refused");
+        for secret in secrets {
+            assert!(!message.contains(secret), "{message:?} echoes {secret:?}");
+        }
+        message
     }
 
     #[test]
     fn parses_a_minimal_config() {
         let (id, hex) = client_key_hex();
-        let cfg = parse_config(obj(vec![
-            ("client_id", &id.to_string()),
-            ("client_key", &hex),
-        ]))
+        let cfg = config(vec![
+            ("client_id", s(&id.to_string())),
+            ("client_key", s(&hex)),
+        ])
         .expect("minimal config parses");
         assert_eq!(cfg.client_key.key_id, id);
         assert!(cfg.endpoint.is_none());
@@ -203,28 +174,27 @@ mod tests {
     #[test]
     fn parses_the_keyset_cache_size() {
         let (id, hex) = client_key_hex();
-        let id_s = id.to_string();
-        let cfg = parse_config(obj(vec![
-            ("client_id", &id_s),
-            ("client_key", &hex),
-            ("keyset_cache_size", "16"),
-        ]))
-        .expect("config parses");
+        let with = |size: V| {
+            obj(vec![
+                ("client_id", s(&id.to_string())),
+                ("client_key", s(&hex)),
+                ("keyset_cache_size", size),
+            ])
+        };
+        let cfg = read(&frame(&with(s("16")))).expect("config parses");
         assert_eq!(cfg.keyset_cache_size, NonZeroUsize::new(16));
 
         for bad in ["0", "-1", "sixteen", ""] {
-            assert!(
-                matches!(
-                    parse_config(obj(vec![
-                        ("client_id", &id_s),
-                        ("client_key", &hex),
-                        ("keyset_cache_size", bad),
-                    ])),
-                    Err(ConfigError::Invalid("keyset_cache_size"))
-                ),
+            assert_eq!(
+                refused(&with(s(bad)), &[&hex]),
+                "the config: keyset_cache_size: a value its type does not accept",
                 "{bad:?} must be refused"
             );
         }
+        // A decimal string, not an integer, and not null.
+        for bad in [V::U32(16), V::Null] {
+            assert!(refused(&with(bad), &[&hex]).starts_with("the config: keyset_cache_size: "));
+        }
     }
 
     /// A keyset is not a config key: the default is the server's and a
@@ -235,25 +205,27 @@ mod tests {
     fn a_keyset_key_is_rejected_like_any_other_unknown_key() {
         let (id, hex) = client_key_hex();
         for key in ["keyset", "keyset_id"] {
-            assert!(matches!(
-                parse_config(obj(vec![
-                    ("client_id", &id.to_string()),
-                    ("client_key", &hex),
-                    (key, "users"),
-                ])),
-                Err(ConfigError::UnknownKey(_))
-            ));
+            let message = refused(
+                &obj(vec![
+                    ("client_id", s(&id.to_string())),
+                    ("client_key", s(&hex)),
+                    (key, s("users")),
+                ]),
+                // "keyset" alone is inside the expected `keyset_cache_size`.
+                &[&hex, "users", "keyset_id"],
+            );
+            assert!(message.contains("an unknown key"), "{message}");
         }
     }
 
     #[test]
     fn parses_the_zerokms_url() {
         let (id, hex) = client_key_hex();
-        let cfg = parse_config(obj(vec![
-            ("client_id", &id.to_string()),
-            ("client_key", &hex),
-            ("zerokms_url", "https://zerokms.example.com"),
-        ]))
+        let cfg = config(vec![
+            ("client_id", s(&id.to_string())),
+            ("client_key", s(&hex)),
+            ("zerokms_url", s("https://zerokms.example.com")),
+        ])
         .expect("config parses");
         assert!(cfg.endpoint.is_some());
     }
@@ -266,7 +238,6 @@ mod tests {
         use base64ct::Encoding;
 
         let (id, hex) = client_key_hex();
-        let id_s = id.to_string();
         let bytes = base16ct::lower::decode_vec(&hex).expect("fixture hex");
         let base64 = base64ct::Base64::encode_string(&bytes);
 
@@ -275,8 +246,11 @@ mod tests {
             ("uppercase hex", hex.to_uppercase()),
             ("base64", base64),
         ] {
-            let cfg = parse_config(obj(vec![("client_id", &id_s), ("client_key", &encoded)]))
-                .unwrap_or_else(|e| panic!("{label} must parse, got {e:?}"));
+            let cfg = config(vec![
+                ("client_id", s(&id.to_string())),
+                ("client_key", s(&encoded)),
+            ])
+            .unwrap_or_else(|e| panic!("{label} must parse, got {e}"));
             assert_eq!(cfg.client_key.key_id, id, "{label}");
             assert_eq!(
                 cfg.client_key.to_hex_v1().expect("re-encode"),
@@ -286,57 +260,96 @@ mod tests {
         }
     }
 
+    /// Every refusal names the key at fault and never a value: not the
+    /// client key, not a bad id or URL, not an unknown key.
     #[test]
-    fn rejects_bad_configs() {
+    fn rejects_bad_configs_without_echoing_a_value() {
         let (id, hex) = client_key_hex();
         let id_s = id.to_string();
+        let secrets = [
+            hex.as_str(),
+            "nope",
+            "zerokms_urk",
+            "typo.example",
+            "deadbeef",
+        ];
+        let cases = [
+            (V::Null, "the config: expected "),
+            (
+                V::Arr(vec![s(&id_s), s(&hex)]),
+                "the config: expected struct Wire, found an array",
+            ),
+            (
+                obj(vec![
+                    ("client_id", s(&id_s)),
+                    ("client_key", V::Bytes(hex.clone().into_bytes())),
+                ]),
+                "the config: client_key: expected a borrowed string, found bytes",
+            ),
+            (
+                obj(vec![("client_id", s(&id_s))]),
+                "the config: missing field `client_key`",
+            ),
+            (
+                obj(vec![("client_id", s("nope")), ("client_key", s(&hex))]),
+                "the config: client_id: a value its type does not accept",
+            ),
+            (
+                obj(vec![("client_id", s(&id_s)), ("client_key", V::U64(1))]),
+                "the config: client_key: ",
+            ),
+            (
+                // Valid hex, not a keyset.
+                obj(vec![("client_id", s(&id_s)), ("client_key", s("deadbeef"))]),
+                "the config: client_key: a client key that is not valid",
+            ),
+            (
+                obj(vec![
+                    ("client_id", s(&id_s)),
+                    ("client_key", s(&hex)),
+                    ("zerokms_urk", s("https://typo.example.com")),
+                ]),
+                "the config: an unknown key, ",
+            ),
+            (
+                obj(vec![
+                    ("client_id", s(&id_s)),
+                    ("client_key", s(&hex)),
+                    ("zerokms_url", s("not a url")),
+                ]),
+                "the config: zerokms_url: a value its type does not accept",
+            ),
+            (
+                obj(vec![
+                    ("client_id", s(&id_s)),
+                    ("client_key", s(&hex)),
+                    ("zerokms_url", V::Null),
+                ]),
+                "the config: zerokms_url: ",
+            ),
+        ];
+        for (config, expected) in &cases {
+            let message = refused(config, &secrets);
+            assert!(
+                message.starts_with(expected),
+                "{message:?} is not {expected:?}"
+            );
+        }
+    }
 
-        assert!(matches!(
-            parse_config(FfiValue::Null),
-            Err(ConfigError::NotAnObject)
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![("client_id", &id_s)])),
-            Err(ConfigError::Missing("client_key"))
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![("client_id", "nope"), ("client_key", &hex)])),
-            Err(ConfigError::Invalid("client_id"))
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![
-                ("client_id", &id_s),
-                ("client_key", "deadbeef"), // valid hex, not a keyset
-            ])),
-            Err(ConfigError::Invalid("client_key"))
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![
-                ("client_id", &id_s),
-                ("client_key", &hex),
-                ("zerokms_urk", "https://typo.example.com"),
-            ])),
-            Err(ConfigError::UnknownKey(_))
-        ));
-        // The codec refuses duplicate keys on the ABI path, but this
-        // function is `pub` over any `FfiValue`: a repeated `client_key`
-        // must be an error, never a silent last-write-wins on root key
-        // material.
-        assert!(matches!(
-            parse_config(obj(vec![
-                ("client_id", &id_s),
-                ("client_key", &hex),
-                ("client_key", &hex),
-            ])),
-            Err(ConfigError::Duplicate("client_key"))
-        ));
-        assert!(matches!(
-            parse_config(obj(vec![
-                ("client_id", &id_s),
-                ("client_key", &hex),
-                ("zerokms_url", "not a url"),
-            ])),
-            Err(ConfigError::Invalid("zerokms_url"))
-        ));
+    /// A repeated `client_key` is never a silent last-write-wins on root key
+    /// material: the frame refuses it.
+    #[test]
+    fn a_repeated_key_is_refused() {
+        let (id, hex) = client_key_hex();
+        let message = refused(
+            &obj(vec![
+                ("client_id", s(&id.to_string())),
+                ("client_key", s(&hex)),
+                ("client_key", s(&hex)),
+            ]),
+            &[&hex],
+        );
+        assert!(message.starts_with("the config: "), "{message}");
     }
 }
diff --git a/languages/golang/encrypt/guest/src/deterministic.rs b/languages/golang/encrypt/guest/src/deterministic.rs
index e58a26e74..88a789d51 100644
--- a/languages/golang/encrypt/guest/src/deterministic.rs
+++ b/languages/golang/encrypt/guest/src/deterministic.rs
@@ -11,3 +11,59 @@
 //! binary carries it; the tests read it from disk.
 
 pub use stack_kms::DeterministicSource;
+
+use serde::Deserialize;
+use stack_guest_abi::last_error::malformed;
+use vitaminc_aead_frame::serde::from_slice;
+use zeroize::Zeroize;
+
+/// The `deterministic-kms` build's whole config: the source's 32-byte seed,
+/// a frame holding bytes and nothing else. Wiped when it drops.
+#[derive(Deserialize)]
+#[serde(try_from = "&[u8]")]
+pub struct Seed([u8; 32]);
+
+impl TryFrom<&[u8]> for Seed {
+    type Error = &'static str;
+
+    fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
+        bytes
+            .try_into()
+            .map(Seed)
+            .map_err(|_| "a seed that is not 32 bytes")
+    }
+}
+
+impl Drop for Seed {
+    fn drop(&mut self) {
+        self.0.zeroize();
+    }
+}
+
+impl Seed {
+    /// Read the seed frame the host sent in place of a config.
+    pub fn parse(bytes: &[u8]) -> Result<Self, u32> {
+        from_slice(bytes)
+            .map_err(|_| malformed("the deterministic build's config is a 32-byte seed"))
+    }
+
+    /// The key source this seed drives.
+    pub fn source(&self) -> DeterministicSource {
+        DeterministicSource::new(self.0)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::Seed;
+    use crate::test_frame::{frame, V};
+    use vitaminc_aead_frame::serde::from_slice;
+
+    /// A seed is 32 bytes, and only bytes: 32 characters of text are refused.
+    #[test]
+    fn a_seed_is_32_bytes_never_text() {
+        assert!(from_slice::<Seed>(&frame(&V::Bytes(vec![7; 32]))).is_ok());
+        assert!(from_slice::<Seed>(&frame(&V::Bytes(vec![7; 31]))).is_err());
+        assert!(from_slice::<Seed>(&frame(&V::Str("x".repeat(32)))).is_err());
+    }
+}
diff --git a/languages/golang/encrypt/guest/src/lib.rs b/languages/golang/encrypt/guest/src/lib.rs
index fd25df371..e6ff1b343 100644
--- a/languages/golang/encrypt/guest/src/lib.rs
+++ b/languages/golang/encrypt/guest/src/lib.rs
@@ -96,6 +96,8 @@ pub mod options;
 pub mod response;
 pub mod status;
 pub mod targets;
+#[cfg(test)]
+mod test_frame;
 
 // The ABI's packed u64 results embed 32-bit pointers, its bounds checks
 // read the wasm linear-memory size, and `host` calls imported functions —
diff --git a/languages/golang/encrypt/guest/src/options.rs b/languages/golang/encrypt/guest/src/options.rs
index ab2141027..d3bb9f5fb 100644
--- a/languages/golang/encrypt/guest/src/options.rs
+++ b/languages/golang/encrypt/guest/src/options.rs
@@ -121,8 +121,9 @@ pub fn parse_selector(bytes: &[u8]) -> Result<KeysetSelector, u32> {
 /// The options and the selector as a host writes them, read straight from
 /// the frame by serde (`vitaminc_aead_frame::serde`). Each field type
 /// validates as it reads, through `TryFrom`, so a parsed value is already
-/// the guest's. A `TryFrom` error is the whole message serde reports, so
-/// each is a fixed string that never repeats the value.
+/// the guest's. The frame's serde never repeats a `TryFrom` error's text,
+/// so a refusal names the key and says only that its value was not
+/// accepted; each error here is still a fixed string, for the reader.
 mod wire {
     use serde::{Deserialize, Deserializer};
     use stack_encrypt::Label;
@@ -258,61 +259,12 @@ where
 #[cfg(test)]
 mod tests {
     use super::*;
-    use serde::{Serialize, Serializer};
-    use vitaminc_aead_frame::serde::to_vec;
-
-    /// A test input, written as raw frame bytes: objects by hand, so a test
-    /// can send what no writer would (a repeated key).
-    enum V {
-        Obj(Vec<(&'static str, V)>),
-        Str(String),
-        Bytes(Vec<u8>),
-        U64(u64),
-        Bool(bool),
-        Null,
-    }
-
-    struct RawBytes<'a>(&'a [u8]);
-
-    impl Serialize for RawBytes<'_> {
-        fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
-            s.serialize_bytes(self.0)
-        }
-    }
-
-    fn frame(v: &V) -> Vec<u8> {
-        let scalar = |r: Result<Vec<u8>, _>| r.expect("a scalar frames");
-        match v {
-            V::Obj(entries) => {
-                let mut out = vec![vitaminc_aead_frame::OBJECT];
-                out.extend_from_slice(&(entries.len() as u32).to_le_bytes());
-                for (key, value) in entries {
-                    out.extend_from_slice(&(key.len() as u32).to_le_bytes());
-                    out.extend_from_slice(key.as_bytes());
-                    out.extend_from_slice(&frame(value));
-                }
-                out
-            }
-            V::Str(text) => scalar(to_vec(text)),
-            V::Bytes(bytes) => scalar(to_vec(&RawBytes(bytes))),
-            V::U64(n) => scalar(to_vec(n)),
-            V::Bool(b) => scalar(to_vec(b)),
-            V::Null => scalar(to_vec(&())),
-        }
-    }
-
-    fn obj(entries: Vec<(&'static str, V)>) -> V {
-        V::Obj(entries)
-    }
+    use crate::test_frame::{empty, frame, obj, V};
 
     fn options(selector: V) -> V {
         obj(vec![("keyset", selector)])
     }
 
-    fn empty() -> V {
-        V::Obj(Vec::new())
-    }
-
     fn selector(v: V) -> Result<KeysetSelector, u32> {
         parse_selector(&frame(&v))
     }
@@ -376,6 +328,18 @@ mod tests {
                 "an id that is not 16 bytes",
                 obj(vec![("id", V::Bytes(vec![1, 2, 3]))]),
             ),
+            (
+                "a 16-byte id sent as text",
+                obj(vec![("id", V::Str("0123456789abcdef".into()))]),
+            ),
+            (
+                "a name sent as bytes",
+                obj(vec![("name", V::Bytes(b"acme".to_vec()))]),
+            ),
+            (
+                "a selector sent as an array",
+                V::Arr(vec![obj(vec![("name", V::Str("acme".into()))])]),
+            ),
             (
                 "an id as text",
                 obj(vec![(
@@ -392,6 +356,14 @@ mod tests {
         }
     }
 
+    /// Options sent as an array are refused: the frame reads them only from
+    /// an object, never by position.
+    #[test]
+    fn options_sent_as_an_array_are_refused() {
+        let positional = V::Arr(vec![obj(vec![("name", V::Str("acme".into()))])]);
+        assert_eq!(opts(positional, Side::Open), Err(STATUS_ENCODING));
+    }
+
     #[test]
     fn options_are_one_keyset_key() {
         assert_eq!(
diff --git a/languages/golang/encrypt/guest/src/test_frame.rs b/languages/golang/encrypt/guest/src/test_frame.rs
new file mode 100644
index 000000000..f18ee4d5a
--- /dev/null
+++ b/languages/golang/encrypt/guest/src/test_frame.rs
@@ -0,0 +1,74 @@
+//! Frames written by hand for tests: objects entry by entry, so a test can
+//! send what no writer would (a repeated key, an integer of any width).
+
+use serde::{Serialize, Serializer};
+use vitaminc_aead_frame::serde::to_vec;
+
+/// A test input, written as raw frame bytes by [`frame`].
+pub(crate) enum V {
+    Obj(Vec<(&'static str, V)>),
+    Arr(Vec<V>),
+    Str(String),
+    Bytes(Vec<u8>),
+    U32(u32),
+    U64(u64),
+    Bool(bool),
+    Null,
+}
+
+struct RawBytes<'a>(&'a [u8]);
+
+impl Serialize for RawBytes<'_> {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_bytes(self.0)
+    }
+}
+
+/// The frame bytes of `v`.
+pub(crate) fn frame(v: &V) -> Vec<u8> {
+    let scalar = |r: Result<Vec<u8>, _>| r.expect("a scalar frames");
+    let container = |tag: u8, len: usize| {
+        let mut out = vec![tag];
+        out.extend_from_slice(&u32::try_from(len).expect("short").to_le_bytes());
+        out
+    };
+    match v {
+        V::Obj(entries) => {
+            let mut out = container(vitaminc_aead_frame::OBJECT, entries.len());
+            for (key, value) in entries {
+                out.extend_from_slice(&u32::try_from(key.len()).expect("short").to_le_bytes());
+                out.extend_from_slice(key.as_bytes());
+                out.extend_from_slice(&frame(value));
+            }
+            out
+        }
+        V::Arr(items) => {
+            let mut out = container(vitaminc_aead_frame::ARRAY, items.len());
+            for item in items {
+                out.extend_from_slice(&frame(item));
+            }
+            out
+        }
+        V::Str(text) => scalar(to_vec(text)),
+        V::Bytes(bytes) => scalar(to_vec(&RawBytes(bytes))),
+        V::U32(n) => scalar(to_vec(n)),
+        V::U64(n) => scalar(to_vec(n)),
+        V::Bool(b) => scalar(to_vec(b)),
+        V::Null => scalar(to_vec(&())),
+    }
+}
+
+/// An object of `entries`, in order.
+pub(crate) fn obj(entries: Vec<(&'static str, V)>) -> V {
+    V::Obj(entries)
+}
+
+/// An empty object.
+pub(crate) fn empty() -> V {
+    V::Obj(Vec::new())
+}
+
+/// A string.
+pub(crate) fn s(text: &str) -> V {
+    V::Str(text.to_owned())
+}
diff --git a/languages/golang/encrypt/guest/tests/leak.rs b/languages/golang/encrypt/guest/tests/leak.rs
index 69d7e16f0..1c9557be9 100644
--- a/languages/golang/encrypt/guest/tests/leak.rs
+++ b/languages/golang/encrypt/guest/tests/leak.rs
@@ -27,7 +27,7 @@ use stack_encrypt::{CipherText, Descriptor, Node, PassthroughFrame, StackCipher}
 use stack_encrypt_guest::options::{parse_options, Side};
 use stack_encrypt_guest::status::fail_error;
 use stack_encrypt_guest::{config, ops};
-use stack_guest_abi::{call, last_error};
+use stack_guest_abi::call;
 use stack_kms::{
     DataKey, DataKeySource, DataKeyWithTag, FakeDataKeySource, GenerateKeyError,
     GenerateKeyPayload, IndexKeySource, LoadKeysetError, RetrieveKeyError, RetrieveKeyPayload,
@@ -619,17 +619,13 @@ fn scenarios() -> Vec<(&'static str, FfiValue)> {
                     ("client_id", s("6a1b8c6e-6f3a-4e43-9a3b-2f0f6f8b1c2d")),
                     ("client_key", s(CLIENT_KEY)),
                 ]);
-                config::parse_config(config)
-                    .map(drop)
-                    .map_err(|e| last_error::malformed(e.describe()))
+                config::parse_config(&encode(config)).map(drop)
             }),
         ),
         (
             "a config key this version does not know",
             failure("config key", &["stack_guest_abi::malformed_input"], || {
-                config::parse_config(obj(vec![(CLIENT_KEY, s(CLIENT_KEY))]))
-                    .map(drop)
-                    .map_err(|e| last_error::malformed(e.describe()))
+                config::parse_config(&encode(obj(vec![(CLIENT_KEY, s(CLIENT_KEY))]))).map(drop)
             }),
         ),
         // -- an error no native path raises, recorded the same way ---------
diff --git a/languages/golang/encrypt/memory_test.go b/languages/golang/encrypt/memory_test.go
index 6be1561b5..50b009626 100644
--- a/languages/golang/encrypt/memory_test.go
+++ b/languages/golang/encrypt/memory_test.go
@@ -236,12 +236,17 @@ func TestRequireLockedMemoryFailsTheCallThatCannotGrow(t *testing.T) {
 // same way, but the guest cannot report it: its allocator aborts, the trap
 // closes the module, and the client is closed with it, its keys wiped.
 // The call still fails with ErrMemoryLock naming the refusal, and the
-// client is ErrState from then on. Provoked by staging a config the guest
-// must copy while decoding, with the refusal installed after the staging.
+// client is ErrState from then on. Provoked by staging a config whose
+// client key the guest must decode into a buffer of its own (the parser
+// borrows every other string from the staged config), with the refusal
+// installed after the staging.
 func TestRequireLockedMemoryClosesTheClientOnARefusedInternalGrowth(t *testing.T) {
 	ctx := context.Background()
 	c := strictClient(t)
-	cfg := initConfig{clientID: strings.Repeat("a", 2<<20), clientKey: NewClientKey([]byte("00"))}
+	cfg := initConfig{
+		clientID:  "6a1b8c6e-6f3a-4e43-9a3b-2f0f6f8b1c2d",
+		clientKey: NewClientKey([]byte(strings.Repeat("00", 2<<20))),
+	}
 	encoded, err := encodeConfig(cfg)
 	if err != nil {
 		t.Fatal(err)

From da7ca7515fcc39341f2d0f0665eeb14e4dac8ac9 Mon Sep 17 00:00:00 2001
From: Dan Draper <dan@cipherstash.com>
Date: Sun, 18 Oct 2026 20:38:34 +1100
Subject: [PATCH 5/7] refactor(stack-encrypt): read a context from its frame
 with serde, not FfiValue

dynamic::context took an FfiValue tree and matched it by hand. It now takes
the context's frame bytes and reads them with one small serde visitor
(vitaminc_aead_frame::serde) into the same ContextPiece tree, proven
non-empty by the same rule. A visitor rather than a derive: an untagged
enum buffers the value through serde's content type, which lets a text
variant take bytes and reads an integer at whichever variant's width it
fits first, and a context's text, bytes and integer width are its
identity.

One deliberate change: an integer is read at the width the frame carries,
and only i32, i64, u32 and u64 are contexts. The FfiValue decoder widened
an 8- or 16-bit integer to 32 bits, so a u8 7 was read as the u32 7 context,
a different identity from the Rust u8 context of the same value. Both are
now Reason::ContextKind, as are 128-bit integers and bytes that are not one
frame. The Go SDK writes only the four widths.

The Go guest's se_term checks the context is a frame, then hands its bytes
to dynamic::context. The plan parser re-frames each field's context until
the plan itself is read with serde. Tests build frames from FfiValue
through a shared test helper, and gain the width and not-a-frame cases.

Refs #1252.
---
 languages/golang/encrypt/guest/src/ops.rs     |  20 +-
 packages/stack-encrypt/CHANGELOG.md           |  19 +-
 packages/stack-encrypt/src/dynamic/context.rs | 291 +++++++++++++-----
 packages/stack-encrypt/src/dynamic/mod.rs     |   6 +-
 packages/stack-encrypt/src/dynamic/query.rs   |  34 +-
 packages/stack-encrypt/src/dynamic/record.rs  |  14 +-
 packages/stack-encrypt/src/dynamic/term.rs    |  35 ++-
 .../stack-encrypt/src/dynamic/test_frame.rs   |  37 +++
 packages/stack-encrypt/tests/value_kinds.rs   |   7 +-
 9 files changed, 330 insertions(+), 133 deletions(-)
 create mode 100644 packages/stack-encrypt/src/dynamic/test_frame.rs

diff --git a/languages/golang/encrypt/guest/src/ops.rs b/languages/golang/encrypt/guest/src/ops.rs
index 5f3ebcaa5..c56859844 100644
--- a/languages/golang/encrypt/guest/src/ops.rs
+++ b/languages/golang/encrypt/guest/src/ops.rs
@@ -87,8 +87,8 @@ type BytesTree = Node<Vec<u8>>;
 ///
 /// The context is one part — a string, bytes, or an `i32`/`i64`/`u32`/`u64`
 /// — or an array of parts, nested as deep as the transport codec allows
-/// ([`MAX_DEPTH`](vitaminc_aead_frame::MAX_DEPTH) levels from the root of the encoded value; deeper
-/// is [`STATUS_ENCODING`] before the context is parsed), exactly as a plan
+/// ([`MAX_DEPTH`](vitaminc_aead_frame::MAX_DEPTH) levels from the root of the frame; deeper
+/// is [`STATUS_ENCODING`] before the context is read), exactly as a plan
 /// field's; [`dynamic::context`] is the one home of that grammar. Shape is identity:
 /// `[x]` is a PAE-framed list and `x` is not, so a probe takes the context
 /// in the shape the field was sealed under — a plan field's context
@@ -106,7 +106,7 @@ where
 {
     // The same proof every stack-encrypt leaf demands: an empty context is
     // `STATUS_ENCODING` here, before any derivation.
-    let context = dynamic::context(decode_value(context)?).map_err(|e| fail_dynamic(&e))?;
+    let context = parse_context(context)?;
     let value = parse_frame(value)?;
     let kind = parse_term(value, kind)?;
     dynamic::term(cipher, value, &kind, context)
@@ -114,6 +114,16 @@ where
         .map_err(|e| fail_dynamic(&e))
 }
 
+/// A term's context: one frame, read by [`dynamic::context`]. Bytes that
+/// are not a frame are refused as every other input's are, before the
+/// context's own grammar.
+fn parse_context(
+    context: &[u8],
+) -> Result<stack_encrypt::NonEmpty<stack_encrypt::ContextPiece<'static>>, u32> {
+    let _ = parse_frame(context)?;
+    dynamic::context(context).map_err(|e| fail_dynamic(&e))
+}
+
 /// The static half of a term: the kind is one of the ABI's table, and the
 /// value is one scalar the index takes ([`IndexSpec::defines`]). Shared by
 /// [`term`] and [`validate::term`] so the ABI refuses exactly what the
@@ -461,9 +471,7 @@ pub mod validate {
     /// non-empty, the kind is one of [`TERM_EQUALITY`] .. [`TERM_OPE`], and
     /// the value is one scalar the index takes ([`IndexSpec::defines`]).
     pub fn term(value: &[u8], context: &[u8], kind: u32) -> Result<(), u32> {
-        dynamic::context(decode_value(context)?)
-            .map(drop)
-            .map_err(|e| fail_dynamic(&e))?;
+        let _ = parse_context(context)?;
         parse_term(parse_frame(value)?, kind).map(drop)
     }
 
diff --git a/packages/stack-encrypt/CHANGELOG.md b/packages/stack-encrypt/CHANGELOG.md
index 1eed247f6..9e857217a 100644
--- a/packages/stack-encrypt/CHANGELOG.md
+++ b/packages/stack-encrypt/CHANGELOG.md
@@ -246,11 +246,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `TargetResolver::encrypt` and `query` take a `ValueFrame`, and
     `decrypt` resolves to one.
 
-  `FfiValue` stays, as the tree of a binding's control data (plans,
-  contexts, options, statistics, configuration, the engine's answers).
-  Control data is not plaintext, but a configuration carries credentials
-  (a client key, a test build's seed), so its text and bytes leaves stay
-  `Protected`.
+  `FfiValue` stays for now, in the control data not yet read with serde
+  (see the next entry).
   Ciphertexts, terms and the cross-language fixtures are byte for byte what
   they were. The Go guest decodes plaintext as `ValueFrame`s and returns an
   opened record's frame as it is. Copies of an opened string that remain in
@@ -265,6 +262,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   and `verify` under an allocator that fails the test on any freed block
   still holding plaintext.
 
+- **A binding's control data is read from its frame with serde, not
+  decoded into an `FfiValue`** (`dynamic` feature). Each message is a typed
+  value read straight from the frame bytes by `vitaminc_aead_frame::serde`,
+  so no tree is built and every message refuses an unknown key, a repeated
+  key or a wrong type the same way:
+  - `dynamic::context` takes the context's frame bytes. An integer is read
+    at the width the frame carries, and only `i32`, `i64`, `u32` and `u64`
+    are contexts: an 8- or 16-bit integer, which was widened to 32 bits
+    before, and a 128-bit one are `Reason::ContextKind`, as are bytes that
+    are not one frame.
+  - `Stats::from_frame` replaces `Stats::from_value`.
+
 - **A match value with no tokens is stored as the empty filter, so
   `KeysetCipher::match_terms` is no longer a query.** In 0.2.0 the same call
   served write time and query time, and refused text that cuts no token
diff --git a/packages/stack-encrypt/src/dynamic/context.rs b/packages/stack-encrypt/src/dynamic/context.rs
index 160c4a15b..0fed9ba6f 100644
--- a/packages/stack-encrypt/src/dynamic/context.rs
+++ b/packages/stack-encrypt/src/dynamic/context.rs
@@ -1,18 +1,19 @@
-//! An [`FfiValue`] read as an encryption context. See [`context`](context()).
+//! A context read from a binding's frame. See [`context`](context()).
 
 use std::borrow::Cow;
+use std::fmt;
 
-use super::FfiValue;
-use vitaminc_protected::Controlled;
+use serde::de::{self, Deserializer, SeqAccess, Unexpected, Visitor};
+use serde::Deserialize;
 
 use super::{Error, Reason};
 use crate::{ContextPiece, NonEmpty};
 
-/// A context arrives from a binding as a value and becomes a [`ContextPiece`]
-/// tree: vitaminc's runtime form of a context, and the *identity* of one.
-/// vitaminc's law (pinned there by quickcheck over every built-in context
-/// type) is that a context's two derivations each equal the same derivation
-/// of its parts view:
+/// A context arrives from a binding as a frame and becomes a
+/// [`ContextPiece`] tree: vitaminc's runtime form of a context, and the
+/// *identity* of one. vitaminc's law (pinned there by quickcheck over every
+/// built-in context type) is that a context's two derivations each equal the
+/// same derivation of its parts view:
 ///
 /// ```text
 /// x.into_aad()         == x.into_context().into_aad()
@@ -35,13 +36,15 @@ use crate::{ContextPiece, NonEmpty};
 /// ```
 ///
 /// A bare string is one text part. An array is a list, and may nest as deep
-/// as the transport codec allows
+/// as the transport frame allows
 /// ([`MAX_DEPTH`](vitaminc_aead::frame::MAX_DEPTH) levels, counted
-/// from the root of the encoded value); a deeper value is refused by the
-/// codec before this module sees it. Text and bytes with the same content
-/// are distinct contexts (UTF-8 versus bytes typed leaves) — the same
-/// distinction the Rust types make. Booleans, floats, null, undefined,
-/// objects and passthroughs are not contexts.
+/// from the root of the frame); a deeper frame is refused before it is
+/// read. Text and bytes with the same content are distinct contexts (UTF-8
+/// versus bytes typed leaves) — the same distinction the Rust types make.
+/// An integer's width is part of its identity, so it is read at the width
+/// the frame carries, and only the four widths above are contexts.
+/// Booleans, floats, null, objects, other integer widths, a scalar with a
+/// logical type and passthroughs are not contexts.
 ///
 /// # Which Rust contexts a list spells
 ///
@@ -70,67 +73,125 @@ use crate::{ContextPiece, NonEmpty};
 /// context:
 ///
 /// ```
-/// use stack_encrypt::dynamic::{context, FfiValue};
+/// use stack_encrypt::dynamic::context;
 /// use stack_encrypt::{nonempty, IntoAad};
 ///
-/// let parsed = context(FfiValue::Array(vec![
-///     FfiValue::Array(vec![
-///         FfiValue::String("users".into()),
-///         FfiValue::String("age".into()),
-///     ]),
-///     FfiValue::UInt64(7),
-/// ]))?;
+/// // `[["users", "age"], 7u64]`, as a binding writes it.
+/// let frame = vitaminc_aead_frame::serde::to_vec(&(("users", "age"), 7u64))?;
+/// let parsed = context(&frame)?;
 /// let typed = nonempty!("users").with("age").with(7u64);
 /// assert_eq!(
 ///     parsed.into_inner().into_aad().as_bytes(),
 ///     typed.into_aad().as_bytes()
 /// );
-/// # Ok::<(), stack_encrypt::dynamic::Error>(())
+/// # Ok::<(), Box<dyn std::error::Error>>(())
 /// ```
 ///
 /// # Errors
 ///
 /// [`Error::Context`] for anything outside the shape above
-/// ([`Reason::ContextKind`], [`Reason::ContextNotUtf8`]), and for a context
-/// that renders empty ([`Reason::EmptyContext`]). It names no field: the
-/// caller that knows the field names it ([`Error::in_field`]).
-pub fn context(value: FfiValue) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
-    NonEmpty::new(piece_of(value)?).map_err(|_| Error::bad_context(Reason::EmptyContext))
+/// ([`Reason::ContextKind`]), including bytes that are not one frame, and
+/// for a context that renders empty ([`Reason::EmptyContext`]). It names no
+/// field: the caller that knows the field names it ([`Error::in_field`]).
+pub fn context(frame: &[u8]) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+    let Context(piece) = vitaminc_aead_frame::serde::from_slice(frame)
+        .map_err(|_| Error::bad_context(Reason::ContextKind))?;
+    non_empty(piece)
 }
 
-fn piece_of(value: FfiValue) -> Result<ContextPiece<'static>, Error> {
-    Ok(match value {
-        // Valid UTF-8 by `Utf8String`'s construction invariant; checked
-        // rather than assumed because this is boundary code. The payload
-        // moves out of its `Protected` rather than being copied: a context
-        // is not secret, and the copy would only be wiped and freed.
-        FfiValue::String(s) => ContextPiece::Text(Cow::Owned(
-            String::from_utf8(s.into_inner().risky_unwrap())
-                .map_err(|_| Error::bad_context(Reason::ContextNotUtf8))?,
-        )),
-        FfiValue::Bytes(bytes) => ContextPiece::Bytes(Cow::Owned(bytes.risky_unwrap())),
-        FfiValue::Int32(v) => ContextPiece::I32(v),
-        FfiValue::Int64(v) => ContextPiece::I64(v),
-        FfiValue::UInt32(v) => ContextPiece::U32(v),
-        FfiValue::UInt64(v) => ContextPiece::U64(v),
-        // Nesting depth is bounded by the codec's `MAX_DEPTH` before the
-        // value reaches here.
-        FfiValue::Array(items) => ContextPiece::List(
-            items
-                .into_iter()
-                .map(piece_of)
-                .collect::<Result<Vec<_>, Error>>()?,
-        ),
-        FfiValue::Null
-        | FfiValue::Undefined
-        | FfiValue::Bool(_)
-        | FfiValue::Float32(_)
-        | FfiValue::Float64(_)
-        | FfiValue::Object(_)
-        | FfiValue::Passthrough(_) => return Err(Error::bad_context(Reason::ContextKind)),
-    })
+/// A context tree, proven non-empty by vitaminc's rule.
+pub(super) fn non_empty(
+    piece: ContextPiece<'static>,
+) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+    NonEmpty::new(piece).map_err(|_| Error::bad_context(Reason::EmptyContext))
 }
 
+/// One context as serde reads it from a frame (see [`context`](context())).
+/// A visitor rather than a derive: an untagged enum would buffer the value
+/// through serde's own content type, which lets a text variant take bytes,
+/// and would read an integer at whichever variant's width it fits first.
+pub(super) struct Context(pub(super) ContextPiece<'static>);
+
+impl<'de> Deserialize<'de> for Context {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        d.deserialize_any(ContextVisitor).map(Context)
+    }
+}
+
+struct ContextVisitor;
+
+impl<'de> Visitor<'de> for ContextVisitor {
+    type Value = ContextPiece<'static>;
+
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("a context: a string, bytes, an i32, i64, u32 or u64, or a list of contexts")
+    }
+
+    fn visit_str<E>(self, text: &str) -> Result<Self::Value, E> {
+        Ok(ContextPiece::Text(Cow::Owned(text.to_owned())))
+    }
+
+    fn visit_bytes<E>(self, bytes: &[u8]) -> Result<Self::Value, E> {
+        Ok(ContextPiece::Bytes(Cow::Owned(bytes.to_vec())))
+    }
+
+    fn visit_i32<E>(self, v: i32) -> Result<Self::Value, E> {
+        Ok(ContextPiece::I32(v))
+    }
+
+    fn visit_i64<E>(self, v: i64) -> Result<Self::Value, E> {
+        Ok(ContextPiece::I64(v))
+    }
+
+    fn visit_u32<E>(self, v: u32) -> Result<Self::Value, E> {
+        Ok(ContextPiece::U32(v))
+    }
+
+    fn visit_u64<E>(self, v: u64) -> Result<Self::Value, E> {
+        Ok(ContextPiece::U64(v))
+    }
+
+    // serde forwards the narrow widths to the 64-bit methods by default,
+    // which would read a `u8` as a `u64` context: a different identity.
+    fn visit_i8<E: de::Error>(self, v: i8) -> Result<Self::Value, E> {
+        Err(E::invalid_type(Unexpected::Signed(v.into()), &self))
+    }
+
+    fn visit_i16<E: de::Error>(self, v: i16) -> Result<Self::Value, E> {
+        Err(E::invalid_type(Unexpected::Signed(v.into()), &self))
+    }
+
+    fn visit_u8<E: de::Error>(self, v: u8) -> Result<Self::Value, E> {
+        Err(E::invalid_type(Unexpected::Unsigned(v.into()), &self))
+    }
+
+    fn visit_u16<E: de::Error>(self, v: u16) -> Result<Self::Value, E> {
+        Err(E::invalid_type(Unexpected::Unsigned(v.into()), &self))
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, mut seq: A) -> Result<Self::Value, A::Error> {
+        let mut parts = Vec::with_capacity(reserved(seq.size_hint()));
+        while let Some(Context(part)) = seq.next_element()? {
+            parts.push(part);
+        }
+        Ok(ContextPiece::List(parts))
+    }
+}
+
+/// How many elements to reserve room for before reading a list or an
+/// object a control frame declares `hint` of. The hint is the count the frame
+/// declares, which nothing has checked against the bytes that follow: a few
+/// bytes can declare four billion elements, which would abort the guest on
+/// allocation. So at most [`RESERVED`] are reserved, and a longer list grows as
+/// it is read.
+pub(super) fn reserved(hint: Option<usize>) -> usize {
+    hint.unwrap_or(0).min(RESERVED)
+}
+
+/// The most elements [`reserved`] reserves room for: more than a context or
+/// a plan holds in practice.
+const RESERVED: usize = 64;
+
 /// A view of a context tree that borrows its text and bytes, so a context
 /// parsed and proven once can be handed to every output of every row without
 /// copying the payloads. Integers are copied (they are the payload); the
@@ -163,13 +224,21 @@ pub fn borrowed<'b>(piece: &'b ContextPiece<'_>) -> ContextPiece<'b> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::dynamic::test_frame::frame_of;
+    use crate::dynamic::FfiValue;
     use crate::{nonempty, Descriptor, IntoAad, IntoPrfContext};
+    use vitaminc_aead_frame::serde::to_vec;
     use vitaminc_protected::Protected;
 
     fn s(value: &str) -> FfiValue {
         FfiValue::String(value.into())
     }
 
+    /// The context `value` spells, read from its frame.
+    fn ctx(value: FfiValue) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+        context(&frame_of(&value))
+    }
+
     /// `borrowed` is a view, so it must be the same context for every
     /// variant: one list holding each integer width, each byte-bearing
     /// piece, and a nested list is its own borrowed view. A variant this
@@ -217,7 +286,7 @@ mod tests {
 
     #[test]
     fn a_bare_string_is_the_flat_context() {
-        let parsed = context(s("users/age")).expect("flat context");
+        let parsed = ctx(s("users/age")).expect("flat context");
         assert_eq!(
             parsed.get(),
             &ContextPiece::Text(Cow::Borrowed("users/age")),
@@ -232,7 +301,7 @@ mod tests {
 
     #[test]
     fn a_list_encodes_as_the_tuple_on_both_sides() {
-        let parsed = context(FfiValue::Array(vec![s("users/age"), FfiValue::UInt64(7)]))
+        let parsed = ctx(FfiValue::Array(vec![s("users/age"), FfiValue::UInt64(7)]))
             .expect("extended context");
         let tuple = nonempty!("users/age").with(7u64);
         assert_eq!(
@@ -249,7 +318,7 @@ mod tests {
 
     #[test]
     fn a_list_renders_the_descriptor_the_tuple_does() {
-        let parsed = context(FfiValue::Array(vec![s("users"), s("age")])).expect("a pair");
+        let parsed = ctx(FfiValue::Array(vec![s("users"), s("age")])).expect("a pair");
         assert_eq!(
             Descriptor::of(parsed.into_inner()).as_str(),
             "users/age",
@@ -260,7 +329,7 @@ mod tests {
             "users/age",
             "the tuple renders the same descriptor"
         );
-        let parsed = context(FfiValue::Array(vec![
+        let parsed = ctx(FfiValue::Array(vec![
             FfiValue::Array(vec![s("users"), s("age")]),
             FfiValue::UInt64(7),
         ]))
@@ -278,7 +347,7 @@ mod tests {
 
     #[test]
     fn a_nested_list_encodes_as_the_nested_tuple() {
-        let parsed = context(FfiValue::Array(vec![
+        let parsed = ctx(FfiValue::Array(vec![
             s("users/age"),
             FfiValue::Array(vec![s("t"), FfiValue::Int32(-3)]),
         ]))
@@ -299,7 +368,7 @@ mod tests {
     /// The borrowed view is the same context as the owned tree.
     #[test]
     fn the_borrowed_view_encodes_as_the_owned_tree() {
-        let parsed = context(FfiValue::Array(vec![
+        let parsed = ctx(FfiValue::Array(vec![
             s("users/age"),
             FfiValue::Array(vec![
                 FfiValue::Bytes(Protected::new(b"k".to_vec())),
@@ -328,13 +397,13 @@ mod tests {
     #[test]
     fn a_left_nested_list_is_the_with_chain() {
         let chain = nonempty!("a").with(7u64).with("eu");
-        let nested = context(FfiValue::Array(vec![
+        let nested = ctx(FfiValue::Array(vec![
             FfiValue::Array(vec![s("a"), FfiValue::UInt64(7)]),
             s("eu"),
         ]))
         .expect("nested")
         .into_inner();
-        let flat = context(FfiValue::Array(vec![s("a"), FfiValue::UInt64(7), s("eu")]))
+        let flat = ctx(FfiValue::Array(vec![s("a"), FfiValue::UInt64(7), s("eu")]))
             .expect("flat")
             .into_inner();
         assert_eq!(
@@ -363,7 +432,7 @@ mod tests {
     /// (vitaminc 0.4.0 made the `Option` PRF context follow its parts view).
     #[test]
     fn a_one_element_list_is_some() {
-        let list = context(FfiValue::Array(vec![FfiValue::UInt64(7)]))
+        let list = ctx(FfiValue::Array(vec![FfiValue::UInt64(7)]))
             .expect("list")
             .into_inner();
         let some = Some(7u64);
@@ -386,8 +455,8 @@ mod tests {
 
     #[test]
     fn a_one_element_list_is_not_the_bare_part() {
-        let list = context(FfiValue::Array(vec![s("a")])).expect("list");
-        let bare = context(s("a")).expect("bare");
+        let list = ctx(FfiValue::Array(vec![s("a")])).expect("list");
+        let bare = ctx(s("a")).expect("bare");
         assert_ne!(
             list.clone().into_inner().into_aad().as_bytes(),
             bare.clone().into_inner().into_aad().as_bytes(),
@@ -404,8 +473,8 @@ mod tests {
     /// on both sides (vitaminc 0.5; before it they shared AAD bytes).
     #[test]
     fn text_and_bytes_are_distinct_contexts_on_both_sides() {
-        let text = context(s("ab")).expect("text").into_inner();
-        let bytes = context(FfiValue::Bytes(Protected::new(b"ab".to_vec())))
+        let text = ctx(s("ab")).expect("text").into_inner();
+        let bytes = ctx(FfiValue::Bytes(Protected::new(b"ab".to_vec())))
             .expect("bytes")
             .into_inner();
         assert_ne!(
@@ -433,7 +502,7 @@ mod tests {
             ),
         ] {
             assert!(
-                matches!(context(empty), Err(Error::Context { .. })),
+                matches!(ctx(empty), Err(Error::Context { .. })),
                 "{label} is empty by the tuple rule and must be refused"
             );
         }
@@ -449,7 +518,7 @@ mod tests {
             ),
         ] {
             assert!(
-                context(non_empty).is_ok(),
+                ctx(non_empty).is_ok(),
                 "{label} carries bytes and must be accepted"
             );
         }
@@ -473,9 +542,81 @@ mod tests {
             ),
         ] {
             assert!(
-                matches!(context(bad), Err(Error::Context { .. })),
+                matches!(ctx(bad), Err(Error::Context { .. })),
                 "{label} is not a context and must be refused"
             );
         }
     }
+
+    /// An integer's width is its identity, so only the four widths a
+    /// context takes are read, each at its own width; the others are
+    /// refused rather than widened.
+    #[test]
+    fn an_integer_is_read_at_its_own_width() {
+        let read = |frame: Vec<u8>| context(&frame).map(NonEmpty::into_inner);
+        assert_eq!(read(to_vec(&7i32).unwrap()).unwrap(), ContextPiece::I32(7));
+        assert_eq!(read(to_vec(&7i64).unwrap()).unwrap(), ContextPiece::I64(7));
+        assert_eq!(read(to_vec(&7u32).unwrap()).unwrap(), ContextPiece::U32(7));
+        assert_eq!(read(to_vec(&7u64).unwrap()).unwrap(), ContextPiece::U64(7));
+        for (label, frame) in [
+            ("an i8", to_vec(&7i8).unwrap()),
+            ("an i16", to_vec(&7i16).unwrap()),
+            ("a u8", to_vec(&7u8).unwrap()),
+            ("a u16", to_vec(&7u16).unwrap()),
+            ("an i128", to_vec(&7i128).unwrap()),
+            ("a u128", to_vec(&7u128).unwrap()),
+            ("a u8 in a list", to_vec(&("users", 7u8)).unwrap()),
+        ] {
+            assert!(
+                matches!(
+                    read(frame),
+                    Err(Error::Context {
+                        reason: Reason::ContextKind,
+                        ..
+                    })
+                ),
+                "{label} is not a context"
+            );
+        }
+    }
+
+    /// What a frame declares is reserved only up to a bound, whatever it
+    /// declares.
+    #[test]
+    fn a_declared_count_reserves_at_most_the_bound() {
+        assert_eq!(reserved(None), 0);
+        assert_eq!(reserved(Some(3)), 3);
+        assert_eq!(reserved(Some(RESERVED)), RESERVED);
+        assert_eq!(reserved(Some(u32::MAX as usize)), RESERVED);
+    }
+
+    /// A list that declares more parts than its frame holds is refused
+    /// when the parts run out, without reserving room for the count it
+    /// declared: four billion parts would abort the guest on allocation.
+    #[test]
+    fn a_list_that_declares_more_parts_than_it_holds_is_refused() {
+        let mut bytes = vec![vitaminc_aead::frame::ARRAY];
+        bytes.extend_from_slice(&u32::MAX.to_le_bytes());
+        assert!(matches!(
+            context(&bytes),
+            Err(Error::Context {
+                reason: Reason::ContextKind,
+                ..
+            })
+        ));
+    }
+
+    /// Bytes that are not one frame are not a context.
+    #[test]
+    fn bytes_that_are_not_a_frame_are_refused() {
+        for bytes in [&[][..], &[0xff, 1, 2], &to_vec(&"a").unwrap()[..2]] {
+            assert!(matches!(
+                context(bytes),
+                Err(Error::Context {
+                    reason: Reason::ContextKind,
+                    ..
+                })
+            ));
+        }
+    }
 }
diff --git a/packages/stack-encrypt/src/dynamic/mod.rs b/packages/stack-encrypt/src/dynamic/mod.rs
index eb6bf0f98..e8d4eb016 100644
--- a/packages/stack-encrypt/src/dynamic/mod.rs
+++ b/packages/stack-encrypt/src/dynamic/mod.rs
@@ -91,6 +91,8 @@ mod query;
 pub mod record;
 mod target;
 mod term;
+#[cfg(test)]
+mod test_frame;
 mod value_frame;
 
 use std::fmt;
@@ -484,7 +486,9 @@ reasons! {
         /// A context value is of a kind a context cannot hold: a boolean,
         /// float, null, object or passthrough.
         ContextKind => "context_kind", "a boolean, float, null, object or passthrough cannot be a context";
-        /// A context string is not UTF-8.
+        /// A context string is not UTF-8. No longer produced: a frame's
+        /// text is UTF-8 by construction. Kept so a binding that switches on
+        /// it still compiles.
         ContextNotUtf8 => "context_not_utf8", "a context string is not UTF-8";
         /// A context renders empty.
         EmptyContext => "empty_context", "the context renders empty";
diff --git a/packages/stack-encrypt/src/dynamic/query.rs b/packages/stack-encrypt/src/dynamic/query.rs
index 8f4daa01e..b2e38afc8 100644
--- a/packages/stack-encrypt/src/dynamic/query.rs
+++ b/packages/stack-encrypt/src/dynamic/query.rs
@@ -1021,27 +1021,9 @@ pub fn limit_to_value(limit: Limit) -> FfiValue {
 mod tests {
     use super::*;
 
-    /// Statistics as a binding sends them: `value` written as frame bytes,
-    /// objects by hand so a test can send a repeated key, which no frame
-    /// writer would.
+    /// Statistics as a binding sends them.
     fn stats_frame(value: &FfiValue) -> Result<Stats, Error> {
-        fn raw(value: &FfiValue, out: &mut Vec<u8>) {
-            match value {
-                FfiValue::Object(entries) => {
-                    out.push(vitaminc_aead::frame::OBJECT);
-                    out.extend_from_slice(&(entries.len() as u32).to_le_bytes());
-                    for (key, value) in entries {
-                        out.extend_from_slice(&(key.len() as u32).to_le_bytes());
-                        out.extend_from_slice(key.as_bytes());
-                        raw(value, out);
-                    }
-                }
-                other => out.extend_from_slice(other.to_frame().expect("frames").risky_ref()),
-            }
-        }
-        let mut bytes = Vec::new();
-        raw(value, &mut bytes);
-        Stats::from_frame(&bytes)
+        Stats::from_frame(&crate::dynamic::test_frame::frame_of(value))
     }
     use crate::dynamic::{record, NoTargets, TargetError};
     use crate::op::{self, Probabilistic as _};
@@ -1649,8 +1631,10 @@ mod tests {
             tokenizer: crate::sem::Tokenizer::Ngram { length: 0 },
             ..MatchOptions::default()
         };
-        let context = crate::dynamic::context(FfiValue::Array(vec![text("users"), text("name")]))
-            .expect("context");
+        let context = crate::dynamic::context(
+            &vitaminc_aead_frame::serde::to_vec(&("users", "name")).expect("frames"),
+        )
+        .expect("context");
         let field = FieldPlan::new(
             "name",
             context,
@@ -1964,8 +1948,10 @@ mod tests {
 
         let stored = |value: &ValueFrame, name: &'static str| {
             let keyset = &keyset;
-            let ctx = super::super::context(FfiValue::Array(vec![text("users"), text(name)]))
-                .expect("context");
+            let ctx = super::super::context(
+                &vitaminc_aead_frame::serde::to_vec(&("users", name)).expect("frames"),
+            )
+            .expect("context");
             let value = value.clone();
             async move {
                 super::super::term(keyset, &value, &IndexSpec::Equality, ctx)
diff --git a/packages/stack-encrypt/src/dynamic/record.rs b/packages/stack-encrypt/src/dynamic/record.rs
index e634e5bfc..7ca5bf9e6 100644
--- a/packages/stack-encrypt/src/dynamic/record.rs
+++ b/packages/stack-encrypt/src/dynamic/record.rs
@@ -1100,7 +1100,12 @@ pub fn plan_with(
         for (key, value) in spec {
             match key.as_str() {
                 "context" if context.is_none() => {
-                    context = Some(super::context(value).map_err(|error| error.in_field(&name))?);
+                    let frame = value
+                        .to_frame()
+                        .map_err(|_| Error::bad_context(Reason::ContextKind).in_field(&name))?;
+                    context = Some(
+                        super::context(frame.risky_ref()).map_err(|error| error.in_field(&name))?,
+                    );
                 }
                 "target" if target.is_none() => {
                     let FfiValue::String(s) = &value else {
@@ -2172,7 +2177,7 @@ mod tests {
     use vitaminc_aead::frame::MAX_DEPTH;
     use vitaminc_protected::{Controlled, Protected};
 
-    use crate::dynamic::{context, term};
+    use crate::dynamic::term;
     use crate::plan::pick;
     use crate::sem::EqualityTerm;
     use crate::target::{AeadContext, DecryptInto, EncryptFrom};
@@ -2250,6 +2255,11 @@ mod tests {
         FfiValue::String(value.into())
     }
 
+    /// The context `value` spells, read from its frame as a binding sends it.
+    fn context(value: FfiValue) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+        crate::dynamic::context(&crate::dynamic::test_frame::frame_of(&value))
+    }
+
     fn obj(entries: Vec<(&str, FfiValue)>) -> FfiValue {
         FfiValue::Object(
             entries
diff --git a/packages/stack-encrypt/src/dynamic/term.rs b/packages/stack-encrypt/src/dynamic/term.rs
index e89896bd7..c9f6f7632 100644
--- a/packages/stack-encrypt/src/dynamic/term.rs
+++ b/packages/stack-encrypt/src/dynamic/term.rs
@@ -267,14 +267,12 @@ fn integer<T: TryFrom<u64>>(value: &FfiValue) -> Result<T, Error> {
 ///     .await?;
 /// let keyset = cipher.default_keyset();
 ///
-/// let ctx = context(FfiValue::Array(vec![
-///     FfiValue::String("users".into()),
-///     FfiValue::String("age".into()),
-/// ]))?;
+/// // `["users", "age"]`, as a binding writes it.
+/// let ctx = context(&vitaminc_aead_frame::serde::to_vec(&("users", "age"))?)?;
 /// let probe = term(&keyset, &FfiValue::UInt32(34), &IndexSpec::Equality, ctx.clone()).await?;
 /// let typed = keyset.equality_term(34u32, ctx).await?;
 /// assert_eq!(probe, typed.into_bytes().to_vec());
-/// # Ok::<(), stack_encrypt::dynamic::Error>(())
+/// # Ok::<(), Box<dyn std::error::Error>>(())
 /// # }).unwrap();
 /// ```
 ///
@@ -806,7 +804,7 @@ mod tests {
     async fn match_text_with_no_tokens_is_refused_as_a_query_and_stored_empty() {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
-        let ctx = context(s("users/bio")).expect("context");
+        let ctx = ctx("users/bio");
         for text in ["", "  ", "hi"] {
             let refused = term(&keyset, &s(text), &default_match(), ctx.clone()).await;
             assert!(
@@ -842,7 +840,7 @@ mod tests {
     async fn a_match_query_under_invalid_options_is_refused_not_tokenised() {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
-        let ctx = context(s("users/bio")).expect("context");
+        let ctx = ctx("users/bio");
         let zero = IndexSpec::Match(MatchOptions {
             tokenizer: Tokenizer::Ngram { length: 0 },
             ..MatchOptions::default()
@@ -896,6 +894,11 @@ mod tests {
         IndexSpec::Match(MatchOptions::default())
     }
 
+    /// A one-part context, read from its frame as a binding sends it.
+    fn ctx(label: &str) -> NonEmpty<crate::ContextPiece<'static>> {
+        context(&vitaminc_aead_frame::serde::to_vec(&label).expect("frames")).expect("context")
+    }
+
     fn s(value: &str) -> FfiValue {
         FfiValue::String(value.into())
     }
@@ -951,7 +954,7 @@ mod tests {
         async fn derives_the_bytes_the_typed_path_derives() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let ks = &keyset;
             let dynamic = |value: FfiValue, kind: IndexSpec| {
                 let ctx = ctx.clone();
@@ -1028,7 +1031,7 @@ mod tests {
         async fn equality_is_one_term_per_number_and_per_nfc_string() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let eq = |value: FfiValue| {
                 let ctx = ctx.clone();
                 let keyset = &keyset;
@@ -1078,7 +1081,7 @@ mod tests {
         async fn a_frame_derives_the_terms_its_value_does() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let derive = |frame: Vec<u8>, kind: IndexSpec| {
                 let ctx = ctx.clone();
                 let keyset = &keyset;
@@ -1186,7 +1189,7 @@ mod tests {
         async fn equality_follows_vitaminc_for_decimals_and_timestamps() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let eq = |value: ValueFrame| {
                 let ctx = ctx.clone();
                 let keyset = &keyset;
@@ -1269,7 +1272,7 @@ mod tests {
         async fn term_is_error_term_naming_the_kind() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let refused = [
                 ("a bool", FfiValue::Bool(true), IndexSpec::Equality),
                 ("a bool", FfiValue::Bool(true), default_match()),
@@ -1296,7 +1299,7 @@ mod tests {
         async fn a_decimal_date_or_timestamp_has_no_order_term_yet() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             for leaf in [decimal(150, 2), date(19_782), instant(7)] {
                 for kind in [IndexSpec::Ore, IndexSpec::Ope] {
                     assert!(!kind.defines(&leaf), "{kind}");
@@ -1318,7 +1321,7 @@ mod tests {
         async fn text_that_does_not_normalize_is_refused_when_derived() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             for kind in [IndexSpec::Equality, default_match()] {
                 let unassigned = s("a\u{378}b");
                 assert!(kind.defines(&unassigned), "{kind} takes text");
@@ -1343,7 +1346,7 @@ mod tests {
         async fn term_is_error_term_naming_the_kind() {
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let not_scalars = [
                 ("null", FfiValue::Null),
                 ("undefined", FfiValue::Undefined),
@@ -1626,7 +1629,7 @@ mod tests {
             }
             let cipher = cipher().await;
             let keyset = cipher.default_keyset();
-            let ctx = context(s("users/x")).expect("context");
+            let ctx = ctx("users/x");
             let text = || s("Alice Smith");
             let wide = term(
                 &keyset,
diff --git a/packages/stack-encrypt/src/dynamic/test_frame.rs b/packages/stack-encrypt/src/dynamic/test_frame.rs
new file mode 100644
index 000000000..283691cf7
--- /dev/null
+++ b/packages/stack-encrypt/src/dynamic/test_frame.rs
@@ -0,0 +1,37 @@
+//! Test inputs as a binding sends them: an [`FfiValue`] written as frame
+//! bytes, objects and arrays by hand so a test can send a repeated key,
+//! which no frame writer would.
+
+use vitaminc_protected::Controlled;
+
+use super::FfiValue;
+
+/// The frame bytes of `value`.
+pub(crate) fn frame_of(value: &FfiValue) -> Vec<u8> {
+    let mut out = Vec::new();
+    write(value, &mut out);
+    out
+}
+
+fn write(value: &FfiValue, out: &mut Vec<u8>) {
+    let count = |len: usize| u32::try_from(len).expect("short").to_le_bytes();
+    match value {
+        FfiValue::Object(entries) => {
+            out.push(vitaminc_aead::frame::OBJECT);
+            out.extend_from_slice(&count(entries.len()));
+            for (key, value) in entries {
+                out.extend_from_slice(&count(key.len()));
+                out.extend_from_slice(key.as_bytes());
+                write(value, out);
+            }
+        }
+        FfiValue::Array(items) => {
+            out.push(vitaminc_aead::frame::ARRAY);
+            out.extend_from_slice(&count(items.len()));
+            for item in items {
+                write(item, out);
+            }
+        }
+        other => out.extend_from_slice(other.to_frame().expect("frames").risky_ref()),
+    }
+}
diff --git a/packages/stack-encrypt/tests/value_kinds.rs b/packages/stack-encrypt/tests/value_kinds.rs
index 8f4a72f82..37f62b176 100644
--- a/packages/stack-encrypt/tests/value_kinds.rs
+++ b/packages/stack-encrypt/tests/value_kinds.rs
@@ -378,10 +378,9 @@ async fn every_new_kind_seals_opens_and_queries_as_the_typed_path() {
             "{} eq: the query is the stored term",
             kind.field
         );
-        let ctx = context(FfiValue::Array(vec![
-            FfiValue::String("value_kinds".into()),
-            FfiValue::String(kind.field.into()),
-        ]))
+        let ctx = context(
+            &vitaminc_aead_frame::serde::to_vec(&("value_kinds", kind.field)).expect("frames"),
+        )
         .expect("context");
         let typed_eq = keyset
             .equality_term(kind.value, ctx.clone())

From 381a4c71c0c90886944182ba56b24da437fad666 Mon Sep 17 00:00:00 2001
From: Dan Draper <dan@cipherstash.com>
Date: Sun, 18 Oct 2026 20:50:13 +1100
Subject: [PATCH 6/7] refactor(stack-encrypt): read a record plan from its
 frame with serde, not FfiValue

record::plan and plan_with took an FfiValue tree and walked it by hand:
the object, each field spec's keys, the outputs list, each index's wire
form and a match index's options. They now take the plan's frame bytes
and read them with serde (vitaminc_aead_frame::serde). One small visitor
reads the top-level map, to tell the reserved "context_field" key from a
field's name; everything below it is derived:
- a field spec is a deny_unknown_fields struct, with exactly one of
  "outputs" and "target" checked in TryFrom, and a present key that is
  null refused through a three-line `present` helper;
- an output is an externally tagged enum, so "match", {"match": null} and
  {"match": {...}} are one variant, Match(Option<MatchWire>);
- match options default field by field and are checked against the
  scheme's bounds in TryFrom;
- a "type" is a try_from newtype over ValueKind's names;
- a field's context is the context visitor's.

Every Reason a plan was refused with is kept: plan_refusal reads the field
from the error's path and the reason from where in the field it happened,
or from the reason a field's own rule gave. Two changes, both from the
frame: a key, field or match option given twice is refused by the frame
before the plan is read, as NotAnObject naming no field (RepeatedKey and
DuplicateField before); and a missing index payload and a null one mean
the same, so {"eq": null} is a bare "eq".

IndexSpec::from_frame replaces IndexSpec::from_value, and
Output::from_value is gone. The Go guest checks a plan is a frame, then
hands its bytes over. Unit tests build plans from FfiValue through the
shared test helper, and integration tests write them as JSON serialised
straight to frame bytes; the fuzz target sends each plan as its frame.

Refs #1252.
---
 .cargo/mutants.toml                           |  11 +
 languages/golang/encrypt/guest/Cargo.toml     |   2 +-
 languages/golang/encrypt/guest/src/ops.rs     |  25 +-
 packages/stack-encrypt/CHANGELOG.md           |   9 +
 .../fuzz/fuzz_targets/check_record.rs         |   7 +-
 packages/stack-encrypt/src/dynamic/mod.rs     |  12 +-
 packages/stack-encrypt/src/dynamic/query.rs   |  49 +-
 packages/stack-encrypt/src/dynamic/record.rs  | 652 +++++++++++++-----
 packages/stack-encrypt/src/dynamic/term.rs    | 185 +++--
 packages/stack-encrypt/tests/heap_hygiene.rs  |   9 +-
 .../stack-encrypt/tests/query_operators.rs    |   7 +-
 .../stack-encrypt/tests/record_lowering.rs    |  26 +-
 packages/stack-encrypt/tests/stored_rows.rs   |  22 +-
 packages/stack-encrypt/tests/value_kinds.rs   |  11 +-
 14 files changed, 679 insertions(+), 348 deletions(-)

diff --git a/.cargo/mutants.toml b/.cargo/mutants.toml
index bca66941d..8ef34de7d 100644
--- a/.cargo/mutants.toml
+++ b/.cargo/mutants.toml
@@ -96,6 +96,17 @@ exclude_re = [
   # `true` there refuses the same values with the same error. The guard stays
   # so the model says what it holds without leaning on the writer behind it.
   'stack-encrypt/src/dynamic/value_frame\.rs:\d+:\d+: replace match guard logical\.admits\(&value\) with true in model$',
+  # A serde visitor's `expecting` writes only the "expected ..." half of a
+  # serde error's message, and no caller of these three reads that message:
+  # a context, statistics and a plan's root are each refused with one fixed
+  # `Reason` (`ContextKind`, `NotStats`, `NotAnObject`), and the plan's
+  # field-level reasons are read from the error's path, so writing nothing
+  # refuses the same input with the same error.
+  'stack-encrypt/src/dynamic/(context|query|record)\.rs:\d+:\d+: replace <impl (Visitor<\x27de> for ContextVisitor|serde::Deserialize<\x27de> for Confidence>::deserialize::<impl serde::de::Visitor<\x27_> for V|Deserialize<\x27de> for PlanWire>::deserialize::<impl Visitor<\x27de> for V)>::expecting -> fmt::Result with Ok\(Default::default\(\)\)$',
+  # The same for the visitor that reads a refused plan's keys back
+  # (`entry_key`): its error is discarded (`.ok()`), so its message is never
+  # read at all.
+  'stack-encrypt/src/dynamic/record\.rs:\d+:\d+: replace entry_key::<impl Deserialize<\x27de> for Keys>::deserialize::<impl Visitor<\x27de> for V>::expecting -> fmt::Result with Ok\(Default::default\(\)\)$',
 ]
 
 # Headroom over the measured baseline before a slow-but-correct mutant is
diff --git a/languages/golang/encrypt/guest/Cargo.toml b/languages/golang/encrypt/guest/Cargo.toml
index c09104f62..64626710b 100644
--- a/languages/golang/encrypt/guest/Cargo.toml
+++ b/languages/golang/encrypt/guest/Cargo.toml
@@ -47,7 +47,7 @@ eql = ["dep:eql-bindings"]
 # HTTP comes from the host (see `wasm:wasi-check` in the suite root).
 stack-auth = { path = "../../../../packages/stack-auth", default-features = false }
 # `dynamic`: the runtime value model this guest speaks — contexts, index
-# terms and record plans over `FfiValue`, shared with every other binding.
+# terms and record plans read from frames, shared with every other binding.
 stack-encrypt = { path = "../../../../packages/stack-encrypt", default-features = false, features = ["dynamic"] }
 # The guest ABI every guest under bindings/go shares: the allocator and
 # buffer registry (and with them the `se_alloc`/`se_dealloc` exports), the
diff --git a/languages/golang/encrypt/guest/src/ops.rs b/languages/golang/encrypt/guest/src/ops.rs
index c56859844..182f06969 100644
--- a/languages/golang/encrypt/guest/src/ops.rs
+++ b/languages/golang/encrypt/guest/src/ops.rs
@@ -42,8 +42,8 @@
 //! values to verify are read as [`ValueFrame`]s: the frame is checked against
 //! the engine's value model, and the engine walks it, splitting a source into
 //! one frame per field as it goes. A record opens into one frame, which is
-//! the output. Control data (a plan, an options object, query statistics)
-//! carries no secret and is decoded into an [`FfiValue`].
+//! the output. Control data (a plan, a context, an options object, query
+//! statistics) carries no secret and is read from its frame with serde.
 
 use stack_encrypt::dynamic::{self, FfiValue, Scope, ValueFrame};
 use stack_encrypt::sem::MatchOptions;
@@ -357,11 +357,13 @@ fn parse_query<'f>(
     Ok((plan, field, operator))
 }
 
-/// A codec-encoded plan, parsed against this build's resolver: a target
-/// name this build cannot run is refused here, the same way at every
-/// export that takes a plan.
+/// A plan's frame, parsed against this build's resolver: a target name this
+/// build cannot run is refused here, the same way at every export that
+/// takes a plan. Bytes that are not a frame are refused as every other
+/// input's are, before the plan's own grammar.
 fn parse_plan(plan: &[u8]) -> Result<dynamic::record::Plan, u32> {
-    dynamic::record::plan_with(decode_value(plan)?, &resolver()).map_err(|e| fail_dynamic(&e))
+    let _ = parse_frame(plan)?;
+    dynamic::record::plan_with(plan, &resolver()).map_err(|e| fail_dynamic(&e))
 }
 
 // =============================================================================
@@ -518,11 +520,6 @@ pub mod validate {
 // Codec glue
 // =============================================================================
 
-/// Control data from a frame: a plan, an options object, statistics.
-fn decode_value(bytes: &[u8]) -> Result<FfiValue, u32> {
-    FfiValue::from_frame(bytes).map_err(|_| not_a_frame())
-}
-
 /// Plaintext from a frame: checked against the engine's value model and
 /// held as the frame, in a buffer wiped when it drops. The same frames are
 /// refused as control data's, so a malformed input fails the same way on
@@ -832,7 +829,7 @@ mod tests {
     #[test]
     fn targets_lists_what_this_build_holds_in_the_wire_shape() {
         let out = targets().expect("encodes");
-        let FfiValue::Object(entries) = decode_value(&out).expect("decodes") else {
+        let FfiValue::Object(entries) = FfiValue::from_frame(&out).expect("decodes") else {
             panic!("an object");
         };
         assert_eq!(entries.len(), 1);
@@ -955,7 +952,7 @@ mod tests {
         validate::record_tree(&sealed, &plan, None).expect("the tree fits");
         let opened =
             block_on(decrypt_record(Scope::Client(&cipher), &sealed, &plan, None)).expect("opens");
-        let FfiValue::Object(values) = decode_value(&opened).expect("a value") else {
+        let FfiValue::Object(values) = FfiValue::from_frame(&opened).expect("a value") else {
             panic!("an object")
         };
         assert!(
@@ -968,7 +965,7 @@ mod tests {
         let probe = encoded(text("alice@example.com"));
         validate::query_term(&probe, &plan, b"email", b"eq").expect("a target field answers eq");
         let term = block_on(query_term(&keyset, &probe, &plan, b"email", b"eq")).expect("derives");
-        let FfiValue::Object(term) = decode_value(&term).expect("a value") else {
+        let FfiValue::Object(term) = FfiValue::from_frame(&term).expect("a value") else {
             panic!("a query term is an object")
         };
         assert!(
diff --git a/packages/stack-encrypt/CHANGELOG.md b/packages/stack-encrypt/CHANGELOG.md
index 9e857217a..253abf543 100644
--- a/packages/stack-encrypt/CHANGELOG.md
+++ b/packages/stack-encrypt/CHANGELOG.md
@@ -272,6 +272,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     are contexts: an 8- or 16-bit integer, which was widened to 32 bits
     before, and a 128-bit one are `Reason::ContextKind`, as are bytes that
     are not one frame.
+  - `record::plan` and `record::plan_with` take the plan's frame bytes.
+    `IndexSpec::from_frame` replaces `IndexSpec::from_value`, and
+    `Output::from_value` is gone. Each `Reason` a plan was refused with is
+    unchanged, with two exceptions: a key, a field or a match option given
+    twice is refused by the frame before the plan is read, as
+    `Reason::NotAnObject` naming no field (it was `RepeatedKey` or
+    `DuplicateField`), and so are bytes that are not one frame. An index's
+    payload may be missing or null alike: `{"match": null}` is a bare
+    `"match"`, and `{"eq": null}` a bare `"eq"`.
   - `Stats::from_frame` replaces `Stats::from_value`.
 
 - **A match value with no tokens is stored as the empty filter, so
diff --git a/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs b/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
index a7dac6f2a..d16cb6f37 100644
--- a/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
+++ b/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
@@ -401,7 +401,12 @@ fuzz_target!(|case: Case| {
     let Case { plan: spec, record } = case;
     // The plan parser is fuzzed for panics only: its rules are a separate
     // model, and a plan that does not parse has no record to check.
-    let Ok(plan) = plan_with(spec.into_value(), &Fixed) else {
+    // The plan crosses as a binding sends it, as frame bytes; a spec the
+    // frame cannot carry is no plan.
+    let Ok(frame) = spec.into_value().to_frame() else {
+        return;
+    };
+    let Ok(plan) = plan_with(frame.risky_ref(), &Fixed) else {
         if trace {
             eprintln!("verdict: plan refused");
         }
diff --git a/packages/stack-encrypt/src/dynamic/mod.rs b/packages/stack-encrypt/src/dynamic/mod.rs
index e8d4eb016..2efc38fe3 100644
--- a/packages/stack-encrypt/src/dynamic/mod.rs
+++ b/packages/stack-encrypt/src/dynamic/mod.rs
@@ -21,12 +21,13 @@
 //! indexed by walking its frame into the encrypting sink and the term
 //! derivers; and a record opens straight into a frame (vitaminc ADR 0001: a
 //! value describes itself once, and sinks consume it). A binding's control
-//! data (a plan, a context, options, a configuration, whose credentials are
-//! secret) is an [`FfiValue`] tree, with its text and bytes wiped.
+//! data (a plan, a context, query statistics) is read from its frame by
+//! serde (`vitaminc_aead_frame::serde`) into a typed message, with no tree
+//! built.
 //!
 //! # What is here
 //!
-//! * [`context`](context()) — an [`FfiValue`] read as an encryption context.
+//! * [`context`](context()) — a frame read as an encryption context.
 //! * [`ValueFrame`] — the engine's plaintext for a value whose type is known
 //!   only at run time, and the value model it holds.
 //! * [`term`](term()) — one index term for a value, derived at the one
@@ -159,8 +160,9 @@ impl<K> fmt::Debug for Scope<'_, K> {
     }
 }
 
-/// The UTF-8 inside a string leaf. Valid by `Utf8String`'s construction
-/// invariant; checked rather than assumed because this is boundary code.
+/// The UTF-8 inside a string leaf, for tests. Valid by `Utf8String`'s
+/// construction invariant; checked rather than assumed.
+#[cfg(test)]
 fn utf8(s: &Utf8String) -> Option<&str> {
     std::str::from_utf8(s.risky_ref()).ok()
 }
diff --git a/packages/stack-encrypt/src/dynamic/query.rs b/packages/stack-encrypt/src/dynamic/query.rs
index b2e38afc8..9b843994d 100644
--- a/packages/stack-encrypt/src/dynamic/query.rs
+++ b/packages/stack-encrypt/src/dynamic/query.rs
@@ -473,24 +473,18 @@ fn answers(
 /// with [`operator_to_value`].
 ///
 /// ```
-/// use stack_encrypt::dynamic::{field_operators, record, FfiValue, NoTargets, OpSpec};
+/// use stack_encrypt::dynamic::{field_operators, record, NoTargets, OpSpec};
 /// use stack_encrypt::target::IndexSpec;
 ///
-/// let text = |s: &str| FfiValue::String(s.into());
-/// let plan = record::plan(FfiValue::Object(vec![(
-///     "age".into(),
-///     FfiValue::Object(vec![
-///         ("context".into(), FfiValue::Array(vec![text("users"), text("age")])),
-///         ("outputs".into(), FfiValue::Array(vec![text("c"), text("eq"), text("ore")])),
-///         ("type".into(), text("uint32")),
-///     ]),
-/// )]))?;
+/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+///     "age": { "context": ["users", "age"], "outputs": ["c", "eq", "ore"], "type": "uint32" },
+/// }))?)?;
 ///
 /// let operators = field_operators(&plan, "age", &NoTargets)?;
 /// assert_eq!(operators[0], (OpSpec::Eq, IndexSpec::Equality));
 /// assert_eq!(operators[1], (OpSpec::Lt, IndexSpec::Ore));
 /// assert_eq!(operators.len(), 6, "eq, the four comparisons and between");
-/// # Ok::<(), stack_encrypt::dynamic::Error>(())
+/// # Ok::<(), Box<dyn std::error::Error>>(())
 /// ```
 ///
 /// # Errors
@@ -699,15 +693,9 @@ pub fn check_query(
 /// # tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(async {
 /// let cipher = StackCipher::builder().kms(FakeDataKeySource::new()).init().await?;
 /// let keyset = cipher.default_keyset();
-/// let text = |s: &str| FfiValue::String(s.into());
-/// let plan = record::plan(FfiValue::Object(vec![(
-///     "age".into(),
-///     FfiValue::Object(vec![
-///         ("context".into(), FfiValue::Array(vec![text("users"), text("age")])),
-///         ("outputs".into(), FfiValue::Array(vec![text("c"), text("ore")])),
-///         ("type".into(), text("uint32")),
-///     ]),
-/// )]))?;
+/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+///     "age": { "context": ["users", "age"], "outputs": ["c", "ore"], "type": "uint32" },
+/// }))?)?;
 ///
 /// let term = query_term(&keyset, &plan, "age", OpSpec::Lt, FfiValue::UInt32(40), &NoTargets)?.await?;
 ///
@@ -1020,6 +1008,7 @@ pub fn limit_to_value(limit: Limit) -> FfiValue {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::dynamic::test_frame::frame_of;
 
     /// Statistics as a binding sends them.
     fn stats_frame(value: &FfiValue) -> Result<Stats, Error> {
@@ -1071,14 +1060,14 @@ mod tests {
             "match".into(),
             FfiValue::Object(vec![("downcase".into(), FfiValue::Bool(false))]),
         )]);
-        record::plan(FfiValue::Object(vec![
+        record::plan(&frame_of(&FfiValue::Object(vec![
             field("email", "string", vec![text("c"), text("eq")]),
             field("name", "string", vec![text("c"), text("match")]),
             field("age", "uint32", vec![text("c"), text("ope"), text("ore")]),
             field("score", "int64", vec![text("ope")]),
             field("nickname", "string", vec![text("c"), text("ore")]),
             field("handle", "string", vec![text("c"), case_sensitive]),
-        ]))
+        ])))
         .expect("the plan parses")
     }
 
@@ -1471,11 +1460,11 @@ mod tests {
                 ]),
             )
         };
-        let plan = record::plan(FfiValue::Object(vec![
+        let plan = record::plan(&frame_of(&FfiValue::Object(vec![
             ("context_field".into(), text("tenant")),
             one("tenant", "string", "passthrough"),
             one("email", "string", "eq"),
-        ]))
+        ])))
         .unwrap();
         let error = query_term(&keyset, &plan, "email", OpSpec::Eq, text("a"), &NoTargets)
             .map(drop)
@@ -1872,13 +1861,13 @@ mod tests {
         use vitaminc_aead::plaintext::{Int, Logical, Physical, Raw, TimeUnit};
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
-        let plan = record::plan(FfiValue::Object(vec![
+        let plan = record::plan(&frame_of(&FfiValue::Object(vec![
             field("tiny", "int8", vec![text("c"), text("ore")]),
             field("huge", "int128", vec![text("c"), text("ope")]),
             field("day", "date", vec![text("c"), text("eq")]),
             field("at", "timestamp", vec![text("c"), text("eq")]),
             field("price", "decimal", vec![text("c"), text("eq")]),
-        ]))
+        ])))
         .expect("the plan parses");
         let frame = |ty: Option<Logical>, value: Physical<'_>| {
             ValueFrame::of(Raw(ty, value)).expect("a value")
@@ -2380,7 +2369,7 @@ mod tests {
 
     fn match_type_plan() -> Plan {
         record::plan_with(
-            FfiValue::Object(vec![(
+            &frame_of(&FfiValue::Object(vec![(
                 "name".into(),
                 FfiValue::Object(vec![
                     (
@@ -2389,7 +2378,7 @@ mod tests {
                     ),
                     ("target".into(), text("Some")),
                 ]),
-            )]),
+            )])),
             &MatchType,
         )
         .unwrap()
@@ -2559,7 +2548,7 @@ mod tests {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
         let plan = record::plan_with(
-            FfiValue::Object(vec![(
+            &frame_of(&FfiValue::Object(vec![(
                 "email".into(),
                 FfiValue::Object(vec![
                     (
@@ -2568,7 +2557,7 @@ mod tests {
                     ),
                     ("target".into(), text("Some")),
                 ]),
-            )]),
+            )])),
             &OneType,
         )
         .unwrap();
diff --git a/packages/stack-encrypt/src/dynamic/record.rs b/packages/stack-encrypt/src/dynamic/record.rs
index 7ca5bf9e6..50bc0fac7 100644
--- a/packages/stack-encrypt/src/dynamic/record.rs
+++ b/packages/stack-encrypt/src/dynamic/record.rs
@@ -140,6 +140,12 @@
 //! that a round-trip invariant rather than data loss.
 
 use super::value_frame::{split_rows, FieldFault, SourceRow, SourceRows};
+use std::fmt;
+
+use serde::de::{Deserializer, MapAccess, Visitor};
+use serde::Deserialize;
+
+use super::term::{IndexWire, MatchWire};
 use super::{FfiValue, ValueFrame, ValueKind};
 use vitaminc_aead::frame::{Frame, FrameWriter};
 use vitaminc_aead::plaintext::{Logical, MapSink, Physical, SeqSink, Sink};
@@ -147,7 +153,7 @@ use vitaminc_aead::{DecodeError, Encrypt};
 use vitaminc_protected::{Controlled, Protected};
 
 use super::{
-    not_admitted, utf8, Error, NoTargets, Reason, Scope, TargetError, TargetResolver, TermBytes,
+    not_admitted, Error, NoTargets, Reason, Scope, TargetError, TargetResolver, TermBytes,
 };
 use crate::plan::{FieldValues, FieldsBuilder, Opens, Runs};
 use crate::target::{CallerContext, DeclaredContext, Decryption, Encrypted, IndexSpec};
@@ -182,8 +188,7 @@ pub enum Output {
 impl Output {
     /// The output a bare key names, or `None` for a key that is not one. A
     /// `"match"` key names the match index under default options; a plan
-    /// spells other options in the object form [`from_value`](Self::from_value)
-    /// reads.
+    /// spells other options in the object form (see [`plan`]).
     pub fn parse(s: &str) -> Option<Self> {
         match s {
             "c" => Some(Output::Ciphertext),
@@ -192,20 +197,6 @@ impl Output {
         }
     }
 
-    /// Read one entry of a plan's `"outputs"` list: `"c"`, `"passthrough"`,
-    /// or an index in its wire form ([`IndexSpec::from_value`]; see [`plan`]).
-    ///
-    /// # Errors
-    ///
-    /// [`Error::Plan`] for anything else.
-    pub fn from_value(value: &FfiValue) -> Result<Self, Error> {
-        match value {
-            FfiValue::String(s) if utf8(s) == Some("c") => Ok(Output::Ciphertext),
-            FfiValue::String(s) if utf8(s) == Some("passthrough") => Ok(Output::Passthrough),
-            _ => IndexSpec::from_value(value).map(Output::Term),
-        }
-    }
-
     /// The map key this output rides under.
     pub fn key(&self) -> &'static str {
         match self {
@@ -916,21 +907,22 @@ fn declare<K: 'static>(
     }
 }
 
-/// Read a record plan from a decoded value, for a build without EQL types:
+/// Read a record plan from its frame, for a build without EQL types:
 /// [`plan_with`] under [`NoTargets`], so a field that names a `"target"` is
 /// refused ([`TargetError::NoTargets`]).
 ///
 /// # Errors
 ///
 /// As [`plan_with`].
-pub fn plan(value: FfiValue) -> Result<Plan, Error> {
-    plan_with(value, &NoTargets)
+pub fn plan(frame: &[u8]) -> Result<Plan, Error> {
+    plan_with(frame, &NoTargets)
 }
 
-/// Read a record plan from a decoded value, resolving each target field's
-/// name through `resolver`.
+/// Read a record plan from its frame, resolving each target field's name
+/// through `resolver`.
 ///
-/// The plan is an [`FfiValue::Object`]:
+/// The plan is a frame object, read by serde
+/// (`vitaminc_aead_frame::serde`):
 ///
 /// ```text
 /// { <field>: { "context": <context>, "outputs": [ "c" | "passthrough" | <index>, ... ], "type": <type> }, ... }
@@ -975,7 +967,7 @@ pub fn plan(value: FfiValue) -> Result<Plan, Error> {
 /// a power of two in `32..=65536`, a zero n-gram length), is refused. The
 /// other three indexes have no options and no object form. A field names
 /// each output key at most once, so it carries at most one match index.
-/// [`IndexSpec::to_value`] writes this form and [`IndexSpec::from_value`]
+/// [`IndexSpec::to_value`] writes this form and [`IndexSpec::from_frame`]
 /// reads it. `"passthrough"` is a field's only output when it has it.
 ///
 /// [`MatchOptions::default`]: crate::sem::MatchOptions::default
@@ -1002,31 +994,19 @@ pub fn plan(value: FfiValue) -> Result<Plan, Error> {
 /// # Examples
 ///
 /// ```
-/// use stack_encrypt::dynamic::{record, FfiValue, NoTargets, Output};
+/// use stack_encrypt::dynamic::{record, NoTargets, Output};
 /// use stack_encrypt::target::IndexSpec;
 ///
-/// // As a binding would decode it from its caller: seal `age` under the
-/// // label users/age and index it for equality.
-/// let plan = record::plan_with(FfiValue::Object(vec![(
-///     "age".to_string(),
-///     FfiValue::Object(vec![
-///         (
-///             "context".to_string(),
-///             FfiValue::Array(vec![
-///                 FfiValue::String("users".into()),
-///                 FfiValue::String("age".into()),
-///             ]),
-///         ),
-///         (
-///             "outputs".to_string(),
-///             FfiValue::Array(vec![
-///                 FfiValue::String("c".into()),
-///                 FfiValue::String("eq".into()),
-///             ]),
-///         ),
-///         ("type".to_string(), FfiValue::String("uint32".into())),
-///     ]),
-/// )]), &NoTargets)?;
+/// // As a binding sends it: seal `age` under the label users/age and index
+/// // it for equality.
+/// let frame = vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+///     "age": {
+///         "context": ["users", "age"],
+///         "outputs": ["c", "eq"],
+///         "type": "uint32",
+///     },
+/// }))?;
+/// let plan = record::plan_with(&frame, &NoTargets)?;
 ///
 /// assert_eq!(plan.fields().len(), 1);
 /// assert_eq!(plan.fields()[0].name(), "age");
@@ -1035,134 +1015,291 @@ pub fn plan(value: FfiValue) -> Result<Plan, Error> {
 ///     plan.fields()[0].outputs(),
 ///     [Output::Ciphertext, Output::Term(IndexSpec::Equality)]
 /// );
-/// # Ok::<(), stack_encrypt::dynamic::Error>(())
+/// # Ok::<(), Box<dyn std::error::Error>>(())
 /// ```
 ///
 /// # Errors
 ///
-/// [`Error::Plan`] for a plan that is not an object of field specs, an
-/// empty plan, a field named twice, a spec with a key other than
-/// `"context"`, `"outputs"`, `"target"` and `"type"` or with one given
-/// twice, missing `"context"`, having neither `"outputs"` nor `"target"`
-/// or having both, an output list that is not a list of outputs (above),
-/// is empty, names an output key twice or names `"passthrough"` beside
-/// another output, a `"target"` that is not a non-empty string, a `"type"`
-/// that is not a string naming a [`ValueKind`], a type that does not admit
-/// one of the field's index outputs, a context that is not a label of at
-/// least two segments (optionally extended), fields under different
-/// contexts or extensions, or a plan the builder refuses ([`Plan::new`]);
-/// with `"context_field"`, a value that is not a string, given twice,
-/// naming no field of the plan, or a plan [`Plan::with_context_field`]
-/// refuses. [`Error::UntypedIndex`], naming the field, for a field with a
-/// term output and no `"type"`. [`Error::Context`] for a `"context"` that
-/// is present but is not a context at all, or renders empty.
-/// [`Error::Target`] for a target the resolver refuses ([`Plan::new_with`]).
-///
-/// The transport codec refuses duplicate object keys before a binding's
-/// value reaches here, but an [`FfiValue`] can be built with them directly
-/// and this is a public parser, so it refuses them itself rather than
-/// letting the last one win.
-pub fn plan_with(
-    value: FfiValue,
-    resolver: &(impl TargetResolver + ?Sized),
-) -> Result<Plan, Error> {
-    let FfiValue::Object(entries) = value else {
-        return Err(Error::bad_plan(Reason::NotAnObject));
-    };
-    let mut fields: Vec<FieldPlan> = Vec::with_capacity(entries.len());
-    let mut context_field: Option<String> = None;
-    for (name, spec) in entries {
-        if name == "context_field" {
-            // Reserved: the plan-level key, never a field. A second one, or
-            // one that is not a string, is refused rather than read as a
-            // field spec.
-            if context_field.is_some() {
-                return Err(Error::bad_plan(Reason::RepeatedKey));
-            }
-            let FfiValue::String(s) = &spec else {
-                return Err(Error::bad_plan(Reason::ContextField));
-            };
-            let s = utf8(s).ok_or(Error::bad_plan(Reason::ContextField))?;
-            context_field = Some(s.to_owned());
-            continue;
-        }
-        let refuse = |reason| Error::Plan {
+/// [`Error::Plan`] for a plan that is not an object of field specs
+/// (including bytes that are not one frame, which is how a field or key
+/// given twice is refused: the frame refuses it), an empty plan, a spec with
+/// a key other than `"context"`, `"outputs"`, `"target"` and `"type"`,
+/// missing `"context"`, having neither `"outputs"` nor `"target"` or having
+/// both, an output list that is not a list of outputs (above), is empty,
+/// names an output key twice or names `"passthrough"` beside another
+/// output, a `"target"` that is not a non-empty string, a `"type"` that is
+/// not a string naming a [`ValueKind`], a type that does not admit one of
+/// the field's index outputs, a context that is not a label of at least two
+/// segments (optionally extended), fields under different contexts or
+/// extensions, or a plan the builder refuses ([`Plan::new`]); with
+/// `"context_field"`, a value that is not a string, naming no field of the
+/// plan, or a plan [`Plan::with_context_field`] refuses.
+/// [`Error::UntypedIndex`], naming the field, for a field with a term output
+/// and no `"type"`. [`Error::Context`] for a `"context"` that is present but
+/// is not a context at all, or renders empty. [`Error::Target`] for a
+/// target the resolver refuses ([`Plan::new_with`]).
+pub fn plan_with(frame: &[u8], resolver: &(impl TargetResolver + ?Sized)) -> Result<Plan, Error> {
+    let wire: PlanWire =
+        vitaminc_aead_frame::serde::from_slice(frame).map_err(|e| plan_refusal(&e, frame))?;
+    let mut fields: Vec<FieldPlan> = Vec::with_capacity(wire.fields.len());
+    for (name, spec) in wire.fields {
+        let spec = FieldSpec::try_from(spec).map_err(|reason| Error::Plan {
             field: Some(name.clone()),
             reason,
+        })?;
+        let context = super::context::non_empty(spec.context.0).map_err(|e| e.in_field(&name))?;
+        let field = match spec.what {
+            What::Outputs(outputs) => FieldPlan::new(name, context, outputs)?,
+            What::Target(target) => FieldPlan::with_target(name, context, target)?,
         };
-        let FfiValue::Object(spec) = spec else {
-            return Err(refuse(Reason::NotAnObject));
-        };
-        let mut context: Option<NonEmpty<ContextPiece<'static>>> = None;
-        let mut outputs: Option<Vec<Output>> = None;
-        let mut target: Option<String> = None;
-        let mut field_type: Option<ValueKind> = None;
-        for (key, value) in spec {
-            match key.as_str() {
-                "context" if context.is_none() => {
-                    let frame = value
-                        .to_frame()
-                        .map_err(|_| Error::bad_context(Reason::ContextKind).in_field(&name))?;
-                    context = Some(
-                        super::context(frame.risky_ref()).map_err(|error| error.in_field(&name))?,
-                    );
-                }
-                "target" if target.is_none() => {
-                    let FfiValue::String(s) = &value else {
-                        return Err(refuse(Reason::InvalidTarget));
-                    };
-                    target = Some(
-                        utf8(s)
-                            .ok_or_else(|| refuse(Reason::InvalidTarget))?
-                            .to_owned(),
-                    );
-                }
-                "outputs" if outputs.is_none() => {
-                    let FfiValue::Array(items) = value else {
-                        return Err(refuse(Reason::OutputsNotList));
-                    };
-                    let parsed = items
-                        .iter()
-                        .map(Output::from_value)
-                        .collect::<Result<Vec<_>, _>>()
-                        .map_err(|error| error.in_field(&name))?;
-                    outputs = Some(parsed);
-                }
-                "type" if field_type.is_none() => {
-                    let FfiValue::String(s) = &value else {
-                        return Err(refuse(Reason::UnknownType));
-                    };
-                    let kind = utf8(s).ok_or_else(|| refuse(Reason::UnknownType))?;
-                    field_type = Some(kind.parse().map_err(|_| refuse(Reason::UnknownType))?);
-                }
-                // One of the four given twice.
-                "context" | "target" | "outputs" | "type" => {
-                    return Err(refuse(Reason::RepeatedKey))
-                }
-                _ => return Err(refuse(Reason::UnknownKey)),
-            }
-        }
-        let context = context.ok_or_else(|| refuse(Reason::MissingContext))?;
-        // One form or the other: a field with both, or neither, is refused.
-        let field = match (outputs, target) {
-            (Some(outputs), None) => FieldPlan::new(name, context, outputs)?,
-            (None, Some(target)) => FieldPlan::with_target(name, context, target)?,
-            (Some(_), Some(_)) => return Err(refuse(Reason::OutputsWithTarget)),
-            (None, None) => return Err(refuse(Reason::MissingOutputs)),
-        };
-        fields.push(match field_type {
-            Some(field_type) => field.with_type(field_type)?,
+        fields.push(match spec.field_type {
+            Some(KindName(field_type)) => field.with_type(field_type)?,
             None => field,
         });
     }
     // The whole-plan rules are the constructors', so a parsed plan and a
     // hand-built one are refused alike.
-    match context_field {
+    match wire.context_field {
         Some(name) => Plan::with_context_field(name, fields),
         None => Plan::new_with(fields, resolver),
     }
 }
 
+/// A plan as a binding writes it: an object of field specs, in order, with
+/// one reserved key beside them, `"context_field"`. A visitor only to tell
+/// that key from a field's name; every value below it is derived.
+struct PlanWire {
+    context_field: Option<String>,
+    fields: Vec<(String, FieldSpecWire)>,
+}
+
+impl<'de> Deserialize<'de> for PlanWire {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        struct V;
+        impl<'de> Visitor<'de> for V {
+            type Value = PlanWire;
+            fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                f.write_str("a plan: an object of field specs")
+            }
+            fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<PlanWire, A::Error> {
+                let mut plan = PlanWire {
+                    context_field: None,
+                    fields: Vec::with_capacity(super::context::reserved(map.size_hint())),
+                };
+                while let Some(name) = map.next_key::<&'de str>()? {
+                    if name == CONTEXT_FIELD {
+                        plan.context_field = Some(map.next_value()?);
+                    } else {
+                        plan.fields.push((name.to_owned(), map.next_value()?));
+                    }
+                }
+                Ok(plan)
+            }
+        }
+        d.deserialize_map(V)
+    }
+}
+
+/// The key of the `position`th entry of the object `frame` holds, or `None`
+/// when it is not an object of that many entries.
+fn entry_key(frame: &[u8], position: usize) -> Option<String> {
+    struct Keys(Vec<String>);
+    impl<'de> Deserialize<'de> for Keys {
+        fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+            struct V;
+            impl<'de> Visitor<'de> for V {
+                type Value = Keys;
+                fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                    f.write_str("an object")
+                }
+                fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<Keys, A::Error> {
+                    let mut keys = Vec::new();
+                    while let Some(key) = map.next_key::<&'de str>()? {
+                        let _: serde::de::IgnoredAny = map.next_value()?;
+                        keys.push(key.to_owned());
+                    }
+                    Ok(Keys(keys))
+                }
+            }
+            d.deserialize_map(V)
+        }
+    }
+    vitaminc_aead_frame::serde::from_slice::<Keys>(frame)
+        .ok()?
+        .0
+        .into_iter()
+        .nth(position)
+}
+
+/// The keys a field's spec reads ([`FieldSpecWire`]).
+const SPEC_KEYS: [&str; 4] = ["context", "outputs", "target", "type"];
+
+/// The keys of the spec `field` holds in the plan `frame`, or `None` when
+/// that spec is not an object (or the plan is not one frame of unique keys).
+fn spec_keys(frame: &[u8], field: &str) -> Option<Vec<String>> {
+    #[derive(Deserialize)]
+    #[serde(untagged)]
+    enum Spec {
+        Object(std::collections::BTreeMap<String, serde::de::IgnoredAny>),
+        Other(serde::de::IgnoredAny),
+    }
+    match vitaminc_aead_frame::serde::from_slice::<std::collections::BTreeMap<String, Spec>>(frame)
+        .ok()?
+        .remove(field)?
+    {
+        Spec::Object(keys) => Some(keys.into_keys().collect()),
+        Spec::Other(_) => None,
+    }
+}
+
+/// The plan-level key naming the field a plan takes its context from.
+const CONTEXT_FIELD: &str = "context_field";
+
+/// One field's spec: a context, and exactly one of `"outputs"` and
+/// `"target"` (checked in `TryFrom`, once the field's name is known, so the
+/// refusal names it), and optionally a `"type"`. A key that is present must
+/// hold its kind of value: a null is refused.
+struct FieldSpec {
+    context: super::context::Context,
+    what: What,
+    field_type: Option<KindName>,
+}
+
+enum What {
+    Outputs(Vec<Output>),
+    Target(String),
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct FieldSpecWire {
+    context: super::context::Context,
+    #[serde(default, deserialize_with = "present")]
+    outputs: Option<Vec<OutputWire>>,
+    #[serde(default, deserialize_with = "present")]
+    target: Option<String>,
+    #[serde(default, deserialize_with = "present", rename = "type")]
+    field_type: Option<KindName>,
+}
+
+impl TryFrom<FieldSpecWire> for FieldSpec {
+    type Error = Reason;
+
+    fn try_from(wire: FieldSpecWire) -> Result<Self, Reason> {
+        let what = match (wire.outputs, wire.target) {
+            (Some(outputs), None) => What::Outputs(outputs.into_iter().map(Output::from).collect()),
+            (None, Some(target)) => What::Target(target),
+            (Some(_), Some(_)) => return Err(Reason::OutputsWithTarget),
+            (None, None) => return Err(Reason::MissingOutputs),
+        };
+        Ok(FieldSpec {
+            context: wire.context,
+            what,
+            field_type: wire.field_type,
+        })
+    }
+}
+
+/// Absent is `None`. Present, a value must be of its kind: a null is
+/// refused, as any other value of the wrong kind is.
+fn present<'de, D: Deserializer<'de>, T: Deserialize<'de>>(d: D) -> Result<Option<T>, D::Error> {
+    T::deserialize(d).map(Some)
+}
+
+/// One entry of a field's `"outputs"`: `"c"`, `"passthrough"`, or an index
+/// in its wire form ([`IndexSpec`'s docs](IndexSpec#wire-form)).
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+enum OutputWire {
+    #[serde(rename = "c")]
+    Ciphertext,
+    Passthrough,
+    Eq,
+    Match(Option<MatchWire>),
+    Ore,
+    Ope,
+}
+
+impl From<OutputWire> for Output {
+    fn from(output: OutputWire) -> Self {
+        let index = match output {
+            OutputWire::Ciphertext => return Output::Ciphertext,
+            OutputWire::Passthrough => return Output::Passthrough,
+            OutputWire::Eq => IndexWire::Eq,
+            OutputWire::Match(options) => IndexWire::Match(options),
+            OutputWire::Ore => IndexWire::Ore,
+            OutputWire::Ope => IndexWire::Ope,
+        };
+        Output::Term(index.into())
+    }
+}
+
+/// A `"type"`: the name of a [`ValueKind`].
+#[derive(Deserialize)]
+#[serde(try_from = "&str")]
+struct KindName(ValueKind);
+
+impl TryFrom<&str> for KindName {
+    type Error = Reason;
+
+    fn try_from(name: &str) -> Result<Self, Reason> {
+        name.parse().map(KindName).map_err(|_| Reason::UnknownType)
+    }
+}
+
+/// The parser's refusal of a plan the frame reader refused: the field from
+/// the error's path, and the reason from where in the field it happened,
+/// or from the reason a field's own rule gave.
+fn plan_refusal(error: &vitaminc_aead_frame::serde::Error, frame: &[u8]) -> Error {
+    use vitaminc_aead_frame::serde::PathSegment::{Entry, Key};
+
+    let path = error.path();
+    // A plan's keys are the host's, so the adapter places an error under one
+    // by its position, never its text; the field is read back from the
+    // frame that was refused.
+    let field = match path.first() {
+        Some(Entry(position)) => entry_key(frame, *position),
+        _ => None,
+    };
+    let Some(field) = field else {
+        // The root: not an object, or not one frame.
+        return Error::bad_plan(Reason::NotAnObject);
+    };
+    let field = &field;
+    if field == CONTEXT_FIELD {
+        return Error::bad_plan(Reason::ContextField);
+    }
+    let reason = match path.get(1) {
+        Some(Key(key)) if key == "context" => {
+            return Error::bad_context(Reason::ContextKind).in_field(field)
+        }
+        Some(Key(key)) if key == "outputs" && path.len() == 2 => Reason::OutputsNotList,
+        Some(Key(key)) if key == "outputs" => Reason::UnknownOutput,
+        Some(Key(key)) if key == "target" => Reason::InvalidTarget,
+        // `"type"`: the one other key a spec reads, and so the only other
+        // key an error inside a spec's value is placed under (an unknown
+        // key is never on the path).
+        Some(_) => Reason::UnknownType,
+        // The spec itself: a key it does not know, a missing context, or not
+        // an object at all. Read from the spec's own keys, not the error's
+        // wording, so a reworded message cannot change the reason. An object
+        // of known keys refused at its own level lacks its context: a value
+        // under a key is refused under that key, a repeated key is not an
+        // object, and the outputs-or-target rule is checked after parsing.
+        None => match spec_keys(frame, field) {
+            Some(keys) if keys.iter().any(|key| !SPEC_KEYS.contains(&key.as_str())) => {
+                Reason::UnknownKey
+            }
+            Some(_) => Reason::MissingContext,
+            None => Reason::NotAnObject,
+        },
+    };
+    Error::Plan {
+        field: Some(field.clone()),
+        reason,
+    }
+}
+
 /// Encrypt a record — or a batch of records — per a plan.
 ///
 /// `source` is a map of `{ field: value }` (one record), or a sequence of
@@ -1203,26 +1340,9 @@ pub fn plan_with(
 /// let keyset = cipher.default_keyset();
 ///
 /// // Seal `age` under users/age with an equality term beside it.
-/// let plan = record::plan(FfiValue::Object(vec![(
-///     "age".to_string(),
-///     FfiValue::Object(vec![
-///         (
-///             "context".to_string(),
-///             FfiValue::Array(vec![
-///                 FfiValue::String("users".into()),
-///                 FfiValue::String("age".into()),
-///             ]),
-///         ),
-///         (
-///             "outputs".to_string(),
-///             FfiValue::Array(vec![
-///                 FfiValue::String("c".into()),
-///                 FfiValue::String("eq".into()),
-///             ]),
-///         ),
-///         ("type".to_string(), FfiValue::String("uint32".into())),
-///     ]),
-/// )]))?;
+/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+///     "age": { "context": ["users", "age"], "outputs": ["c", "eq"], "type": "uint32" },
+/// }))?)?;
 ///
 /// // The row as a binding hands it over: one transport frame.
 /// let row = FfiValue::Object(vec![("age".to_string(), FfiValue::UInt32(34))]);
@@ -2177,7 +2297,7 @@ mod tests {
     use vitaminc_aead::frame::MAX_DEPTH;
     use vitaminc_protected::{Controlled, Protected};
 
-    use crate::dynamic::term;
+    use crate::dynamic::{term, utf8};
     use crate::plan::pick;
     use crate::sem::EqualityTerm;
     use crate::target::{AeadContext, DecryptInto, EncryptFrom};
@@ -2260,6 +2380,19 @@ mod tests {
         crate::dynamic::context(&crate::dynamic::test_frame::frame_of(&value))
     }
 
+    /// The plan `value` spells, read from its frame as a binding sends it.
+    fn plan(value: FfiValue) -> Result<Plan, Error> {
+        super::plan(&crate::dynamic::test_frame::frame_of(&value))
+    }
+
+    /// [`plan`], under `resolver`.
+    fn plan_with(
+        value: FfiValue,
+        resolver: &(impl TargetResolver + ?Sized),
+    ) -> Result<Plan, Error> {
+        super::plan_with(&crate::dynamic::test_frame::frame_of(&value), resolver)
+    }
+
     fn obj(entries: Vec<(&str, FfiValue)>) -> FfiValue {
         FfiValue::Object(
             entries
@@ -2496,6 +2629,48 @@ mod tests {
     mod given_a_plan_value {
         use super::*;
 
+        /// A spec, or its match options, sent as an array is refused as
+        /// not an object: the frame reads a struct only from an object,
+        /// never by position.
+        #[test]
+        /// A plan that declares more fields than its frame holds is refused
+        /// when they run out, without reserving room for the count it declared:
+        /// four billion fields would abort the guest on allocation.
+        fn a_plan_that_declares_more_fields_than_it_holds_is_refused() {
+            let mut bytes = vec![vitaminc_aead::frame::OBJECT];
+            bytes.extend_from_slice(&u32::MAX.to_le_bytes());
+            assert!(crate::dynamic::record::plan(&bytes).is_err());
+        }
+
+        #[test]
+        fn a_spec_or_its_options_sent_as_an_array_is_not_an_object() {
+            let as_array = FfiValue::Array(vec![
+                FfiValue::Array(vec![s("users"), s("age")]),
+                strings(&["ciphertext"]),
+            ]);
+            for spec in [as_array, FfiValue::Array(vec![FfiValue::Null])] {
+                let error = plan(obj(vec![("age", spec)])).expect_err("refused");
+                assert_eq!(error.field(), Some("age"), "{error}");
+                assert_eq!(error.reason(), Some(Reason::NotAnObject), "{error}");
+            }
+            let positional = obj(vec![(
+                "match",
+                FfiValue::Array(vec![
+                    s("standard"),
+                    FfiValue::Bool(true),
+                    FfiValue::UInt32(3),
+                    FfiValue::UInt32(256),
+                ]),
+            )]);
+            let spec = obj(vec![
+                ("context", FfiValue::Array(vec![s("users"), s("nick")])),
+                ("outputs", FfiValue::Array(vec![positional])),
+            ]);
+            let error = plan(obj(vec![("nick", spec)])).expect_err("refused");
+            assert_eq!(error.field(), Some("nick"), "{error}");
+            assert_eq!(error.reason(), Some(Reason::UnknownOutput), "{error}");
+        }
+
         #[test]
         fn parses_each_field_in_order_with_its_label_and_outputs() {
             let plan = the_plan();
@@ -6424,6 +6599,111 @@ mod tests {
             obj(vec![("age", obj(spec))])
         }
 
+        /// A key that is present must hold its kind of value: a null is
+        /// refused as that key's reason, never read as absent.
+        #[test]
+        fn a_null_is_refused_as_its_key() {
+            use Reason::*;
+            let cases: Vec<(&str, FfiValue, Option<&str>, Reason, &str)> = vec![
+                (
+                    "a null context",
+                    age(vec![
+                        ("context", FfiValue::Null),
+                        ("outputs", strings(&["c"])),
+                    ]),
+                    Some("age"),
+                    ContextKind,
+                    "Context",
+                ),
+                (
+                    "null outputs",
+                    age(vec![("context", label("age")), ("outputs", FfiValue::Null)]),
+                    Some("age"),
+                    OutputsNotList,
+                    "Plan",
+                ),
+                (
+                    "a null target",
+                    age(vec![("context", label("age")), ("target", FfiValue::Null)]),
+                    Some("age"),
+                    InvalidTarget,
+                    "Plan",
+                ),
+                (
+                    "a null type",
+                    age(vec![
+                        ("context", label("age")),
+                        ("outputs", strings(&["c"])),
+                        ("type", FfiValue::Null),
+                    ]),
+                    Some("age"),
+                    UnknownType,
+                    "Plan",
+                ),
+                (
+                    "a null context field",
+                    obj(vec![
+                        ("context_field", FfiValue::Null),
+                        ("age", spec(label("age"), &["c"])),
+                    ]),
+                    None,
+                    ContextField,
+                    "Plan",
+                ),
+                (
+                    "a spec that is null",
+                    obj(vec![("age", FfiValue::Null)]),
+                    Some("age"),
+                    NotAnObject,
+                    "Plan",
+                ),
+            ];
+            for (what, value, field, reason, variant) in cases {
+                let error = refused_plan(value);
+                assert!(
+                    !matches!(error, Error::UntypedIndex { .. }),
+                    "{what}: {error}"
+                );
+                expect(&error, variant, field, reason);
+            }
+        }
+
+        /// An index's payload may be missing or null alike: a bare
+        /// `"match"`, `{"match": null}` and `{"match": {}}` are each the
+        /// match index under the default options, and `{"eq": null}` is the
+        /// bare `"eq"`.
+        #[test]
+        fn a_missing_or_null_index_payload_is_the_default() {
+            let outputs = |output: FfiValue| {
+                let plan = plan(age(vec![
+                    ("context", label("age")),
+                    ("outputs", FfiValue::Array(vec![output])),
+                    ("type", s("string")),
+                ]))
+                .expect("the plan parses");
+                plan.fields()[0].outputs().to_vec()
+            };
+            let default_match = vec![Output::Term(IndexSpec::Match(
+                crate::sem::MatchOptions::default(),
+            ))];
+            assert_eq!(outputs(s("match")), default_match);
+            assert_eq!(outputs(obj(vec![("match", FfiValue::Null)])), default_match);
+            assert_eq!(outputs(obj(vec![("match", obj(vec![]))])), default_match);
+            assert_eq!(
+                outputs(obj(vec![("eq", FfiValue::Null)])),
+                vec![Output::Term(IndexSpec::Equality)]
+            );
+        }
+
+        /// Bytes that are not one frame are not a plan.
+        #[test]
+        fn bytes_that_are_not_a_frame_are_not_a_plan() {
+            for bytes in [&[][..], &[0xff, 1, 2]] {
+                let error = super::super::plan(bytes).expect_err("refused");
+                expect(&error, "Plan", None, Reason::NotAnObject);
+            }
+        }
+
         #[test]
         fn a_malformed_plan() {
             use Reason::*;
@@ -6448,6 +6728,8 @@ mod tests {
                     UnknownKey,
                     "Plan",
                 ),
+                // A key given twice anywhere is refused by the frame before
+                // the plan is read, so it names no field.
                 (
                     "a key given twice",
                     age(vec![
@@ -6455,8 +6737,8 @@ mod tests {
                         ("context", label("age")),
                         ("outputs", strings(&["c"])),
                     ]),
-                    Some("age"),
-                    RepeatedKey,
+                    None,
+                    NotAnObject,
                     "Plan",
                 ),
                 (
@@ -6594,8 +6876,8 @@ mod tests {
                         ("age".to_string(), spec(label("age"), &["c"])),
                         ("age".to_string(), spec(label("age"), &["c"])),
                     ]),
-                    Some("age"),
-                    DuplicateField,
+                    None,
+                    NotAnObject,
                     "Plan",
                 ),
                 (
@@ -6638,8 +6920,8 @@ mod tests {
                         ),
                         ("type", s("string")),
                     ]),
-                    Some("age"),
-                    RepeatedKey,
+                    None,
+                    NotAnObject,
                     "Plan",
                 ),
             ];
diff --git a/packages/stack-encrypt/src/dynamic/term.rs b/packages/stack-encrypt/src/dynamic/term.rs
index c9f6f7632..a8e80c824 100644
--- a/packages/stack-encrypt/src/dynamic/term.rs
+++ b/packages/stack-encrypt/src/dynamic/term.rs
@@ -41,7 +41,9 @@ use vitaminc_aead::plaintext::{
 use vitaminc_normalize::{domain_of, normalize, NormalizeError};
 use zeroize::Zeroizing;
 
-use super::{utf8, Error, Reason};
+use serde::Deserialize;
+
+use super::{Error, Reason};
 use crate::sem::{
     CllwOpeEncrypt, CllwOreEncrypt, DefaultMatch, MatchOptions, QueryTokens, TermError, Tokenizer,
 };
@@ -88,31 +90,25 @@ impl IndexSpec {
         })
     }
 
-    /// Read an index from its wire form (see the [type docs](Self#wire-form)).
+    /// Read an index from its wire form's frame (see the
+    /// [type docs](Self#wire-form)).
     ///
     /// # Errors
     ///
     /// [`Error::Plan`] ([`Reason::UnknownOutput`]) for a value that is
     /// neither an index key nor a match options object, or whose options are
-    /// unknown, mistyped or out of bounds; [`Reason::RepeatedKey`] for an
-    /// option given twice. It names no field: the plan parser names it.
-    pub fn from_value(value: &FfiValue) -> Result<Self, Error> {
-        let unknown = || Error::bad_plan(Reason::UnknownOutput);
-        match value {
-            FfiValue::String(s) => Self::parse(utf8(s).ok_or_else(unknown)?).ok_or_else(unknown),
-            FfiValue::Object(entries) => match entries.as_slice() {
-                [(key, FfiValue::Object(options))] if key == "match" => {
-                    Ok(IndexSpec::Match(match_options(options)?))
-                }
-                _ => Err(unknown()),
-            },
-            _ => Err(unknown()),
-        }
+    /// unknown, mistyped or out of bounds, and for bytes that are not one
+    /// frame (an option given twice is refused by the frame). It names no
+    /// field: the plan parser names it.
+    pub fn from_frame(frame: &[u8]) -> Result<Self, Error> {
+        vitaminc_aead_frame::serde::from_slice::<IndexWire>(frame)
+            .map(IndexSpec::from)
+            .map_err(|_| Error::bad_plan(Reason::UnknownOutput))
     }
 
     /// Write this index in its wire form (see the [type docs](Self#wire-form)):
     /// the key, or for a match index under non-default options, the object
-    /// carrying all four of them. [`from_value`](Self::from_value) reads it
+    /// carrying all four of them. [`from_frame`](Self::from_frame) reads it
     /// back to an equal index.
     pub fn to_value(&self) -> FfiValue {
         match self {
@@ -198,53 +194,92 @@ fn ordered(value: &Physical<'_>) -> bool {
     }
 }
 
-/// The options object of a match index's wire form: each key at most once,
-/// each defaulting, and the whole checked against the scheme's bounds.
-fn match_options(entries: &[(String, FfiValue)]) -> Result<MatchOptions, Error> {
-    let unknown = || Error::bad_plan(Reason::UnknownOutput);
-    let mut options = MatchOptions::default();
-    let mut seen: Vec<&str> = Vec::with_capacity(entries.len());
-    for (key, value) in entries {
-        if seen.contains(&key.as_str()) {
-            return Err(Error::bad_plan(Reason::RepeatedKey));
+/// An index in its wire form, as serde reads it from a frame (see
+/// [`IndexSpec`'s docs](IndexSpec#wire-form)): a key, or for a match index a
+/// one-entry object mapping `"match"` to its options. A bare `"match"`, and
+/// `{"match": null}`, are the default options.
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub(super) enum IndexWire {
+    Eq,
+    Match(Option<MatchWire>),
+    Ore,
+    Ope,
+}
+
+impl From<IndexWire> for IndexSpec {
+    fn from(index: IndexWire) -> Self {
+        match index {
+            IndexWire::Eq => IndexSpec::Equality,
+            IndexWire::Match(options) => IndexSpec::Match(options.map(|o| o.0).unwrap_or_default()),
+            IndexWire::Ore => IndexSpec::Ore,
+            IndexWire::Ope => IndexSpec::Ope,
         }
-        seen.push(key);
-        match (key.as_str(), value) {
-            ("tokenizer", FfiValue::String(s)) if utf8(s) == Some("standard") => {
-                options.tokenizer = Tokenizer::Standard;
-            }
-            ("tokenizer", FfiValue::Object(tokenizer)) => match tokenizer.as_slice() {
-                [(name, length)] if name == "ngram" => {
-                    options.tokenizer = Tokenizer::Ngram {
-                        length: integer(length)?,
-                    };
-                }
-                _ => return Err(unknown()),
+    }
+}
+
+/// A match index's options object: each option optional, defaulting to
+/// [`MatchOptions::default`]'s, and the whole checked against the match
+/// scheme's bounds.
+#[derive(Deserialize)]
+#[serde(try_from = "MatchOptionsWire")]
+pub(super) struct MatchWire(pub(super) MatchOptions);
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields, default)]
+struct MatchOptionsWire {
+    tokenizer: TokenizerWire,
+    downcase: bool,
+    k: usize,
+    m: u32,
+}
+
+impl Default for MatchOptionsWire {
+    fn default() -> Self {
+        let MatchOptions {
+            tokenizer,
+            downcase,
+            k,
+            m,
+        } = MatchOptions::default();
+        Self {
+            tokenizer: match tokenizer {
+                Tokenizer::Standard => TokenizerWire::Standard,
+                Tokenizer::Ngram { length } => TokenizerWire::Ngram(length),
             },
-            ("downcase", FfiValue::Bool(downcase)) => options.downcase = *downcase,
-            ("k", k) => options.k = integer(k)?,
-            ("m", m) => options.m = integer(m)?,
-            _ => return Err(unknown()),
+            downcase,
+            k,
+            m,
         }
     }
-    if options.validate().is_err() {
-        return Err(unknown());
-    }
-    Ok(options)
 }
 
-/// A non-negative integer leaf of any width, as the target type, or
-/// [`Error::Plan`] ([`Reason::UnknownOutput`]: it is a match option).
-fn integer<T: TryFrom<u64>>(value: &FfiValue) -> Result<T, Error> {
-    let wide = match value {
-        FfiValue::Int32(v) => u64::try_from(*v).ok(),
-        FfiValue::Int64(v) => u64::try_from(*v).ok(),
-        FfiValue::UInt32(v) => Some(u64::from(*v)),
-        FfiValue::UInt64(v) => Some(*v),
-        _ => None,
-    };
-    wide.and_then(|v| T::try_from(v).ok())
-        .ok_or(Error::bad_plan(Reason::UnknownOutput))
+/// `"standard"`, or `{"ngram": <length>}`.
+#[derive(Deserialize)]
+#[serde(rename_all = "lowercase")]
+enum TokenizerWire {
+    Standard,
+    Ngram(usize),
+}
+
+impl TryFrom<MatchOptionsWire> for MatchWire {
+    type Error = &'static str;
+
+    fn try_from(wire: MatchOptionsWire) -> Result<Self, Self::Error> {
+        let options = MatchOptions {
+            tokenizer: match wire.tokenizer {
+                TokenizerWire::Standard => Tokenizer::Standard,
+                TokenizerWire::Ngram(length) => Tokenizer::Ngram { length },
+            },
+            downcase: wire.downcase,
+            k: wire.k,
+            m: wire.m,
+        };
+        options
+            .validate()
+            .map(|_| MatchWire(options))
+            .map_err(|_| "match options the match scheme refuses")
+    }
 }
 
 /// Derive one index term's frozen byte encoding.
@@ -703,6 +738,7 @@ impl Index<ValueFrame> for IndexSpec {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::dynamic::utf8;
     use crate::dynamic::{context, Output};
     use crate::sem::TermError;
     use crate::{nonempty, StackCipher};
@@ -894,6 +930,11 @@ mod tests {
         IndexSpec::Match(MatchOptions::default())
     }
 
+    /// An index read from the frame of its wire form, as a plan carries it.
+    fn index_of(value: &FfiValue) -> Result<IndexSpec, Error> {
+        IndexSpec::from_frame(&crate::dynamic::test_frame::frame_of(value))
+    }
+
     /// A one-part context, read from its frame as a binding sends it.
     fn ctx(label: &str) -> NonEmpty<crate::ContextPiece<'static>> {
         context(&vitaminc_aead_frame::serde::to_vec(&label).expect("frames")).expect("context")
@@ -1428,7 +1469,7 @@ mod tests {
                     "{spec} writes as its bare key"
                 );
                 assert_eq!(
-                    IndexSpec::from_value(&wire).expect("reads back"),
+                    index_of(&wire).expect("reads back"),
                     spec,
                     "{spec} reads back from its key"
                 );
@@ -1474,7 +1515,7 @@ mod tests {
                     "{options:?} is not the default, so it writes as an object"
                 );
                 assert_eq!(
-                    IndexSpec::from_value(&wire).expect("reads back"),
+                    index_of(&wire).expect("reads back"),
                     spec,
                     "{options:?} round-trips"
                 );
@@ -1502,7 +1543,7 @@ mod tests {
                 ]),
             )]);
             assert_eq!(
-                IndexSpec::from_value(&wire).expect("reads"),
+                index_of(&wire).expect("reads"),
                 IndexSpec::Match(MatchOptions {
                     tokenizer: crate::sem::Tokenizer::Ngram { length: 4 },
                     k: 5,
@@ -1519,7 +1560,7 @@ mod tests {
                 ]),
             )]);
             assert_eq!(
-                IndexSpec::from_value(&wire).expect("reads"),
+                index_of(&wire).expect("reads"),
                 IndexSpec::Match(MatchOptions {
                     tokenizer: crate::sem::Tokenizer::Standard,
                     downcase: false,
@@ -1530,7 +1571,7 @@ mod tests {
             // An empty options object is the defaults, and reads as the
             // bare key does.
             assert_eq!(
-                IndexSpec::from_value(&obj(vec![("match", obj(vec![]))])).expect("reads"),
+                index_of(&obj(vec![("match", obj(vec![]))])).expect("reads"),
                 default_match()
             );
         }
@@ -1597,12 +1638,10 @@ mod tests {
                 ),
             ];
             for (label, wire) in refused {
-                let error = IndexSpec::from_value(&wire).expect_err(label);
-                let reason = if label == "an option twice" {
-                    Reason::RepeatedKey
-                } else {
-                    Reason::UnknownOutput
-                };
+                let error = index_of(&wire).expect_err(label);
+                // An option given twice is refused by the frame, and reads
+                // as any other malformed index.
+                let reason = Reason::UnknownOutput;
                 assert!(
                     matches!(error, Error::Plan { field: None, .. }),
                     "{label}: {error:?}"
@@ -1657,6 +1696,10 @@ mod tests {
 #[cfg(test)]
 mod wire_form {
     use super::*;
+
+    fn index_of(value: &FfiValue) -> Result<IndexSpec, Error> {
+        IndexSpec::from_frame(&crate::dynamic::test_frame::frame_of(value))
+    }
     use crate::sem::{MatchConfig, Tokenizer};
     use crate::target::{Equality, Index, Match, Ope, Ore};
 
@@ -1684,7 +1727,7 @@ mod wire_form {
         ];
         for spec in specs {
             assert_eq!(
-                IndexSpec::from_value(&spec.to_value()).expect("reads back"),
+                index_of(&spec.to_value()).expect("reads back"),
                 spec,
                 "{spec:?} survives the data form"
             );
@@ -1696,7 +1739,7 @@ mod wire_form {
         let spec = Index::<String>::spec(&Match);
         assert!(matches!(
             spec.to_value(),
-            FfiValue::String(key) if super::utf8(&key) == Some("match")
+            FfiValue::String(key) if crate::dynamic::utf8(&key) == Some("match")
         ));
     }
 
diff --git a/packages/stack-encrypt/tests/heap_hygiene.rs b/packages/stack-encrypt/tests/heap_hygiene.rs
index c4a6a8a53..467f09f4e 100644
--- a/packages/stack-encrypt/tests/heap_hygiene.rs
+++ b/packages/stack-encrypt/tests/heap_hygiene.rs
@@ -152,11 +152,11 @@ fn spec(field: &str, outputs: &[&str], ty: Option<&str>) -> (String, FfiValue) {
 }
 
 fn plan() -> record::Plan {
-    record::plan(FfiValue::Object(vec![
+    record::plan(&ffi_frame(&FfiValue::Object(vec![
         spec("email", &["c", "eq", "match", "ore"], Some("string")),
         spec("doc", &["c"], None),
         spec("id", &["passthrough"], None),
-    ]))
+    ])))
     .unwrap()
 }
 
@@ -302,3 +302,8 @@ fn the_spy_sees_an_unwiped_free() {
     let text = marked("control");
     watched("control", || drop(text));
 }
+
+/// A plan as frame bytes: what a binding sends.
+fn ffi_frame(value: &FfiValue) -> Vec<u8> {
+    vitaminc_protected::Controlled::risky_unwrap(value.to_frame().expect("frames"))
+}
diff --git a/packages/stack-encrypt/tests/query_operators.rs b/packages/stack-encrypt/tests/query_operators.rs
index 7241454ed..5c735c7f9 100644
--- a/packages/stack-encrypt/tests/query_operators.rs
+++ b/packages/stack-encrypt/tests/query_operators.rs
@@ -70,6 +70,11 @@ fn stats_cases() -> Vec<(Json, Stats)> {
     ]
 }
 
+/// A plan written as JSON, as frame bytes: what a binding sends.
+fn frame_of_json(value: &Json) -> Vec<u8> {
+    vitaminc_aead_frame::serde::to_vec(value).expect("frames")
+}
+
 fn ffi_of_json(value: &Json) -> FfiValue {
     match value {
         Json::Null => FfiValue::Null,
@@ -226,7 +231,7 @@ async fn data_term(
 async fn derived() -> Json {
     let cipher = deterministic_cipher(SEED).await;
     let keyset = cipher.default_keyset();
-    let plan = record::plan(ffi_of_json(&plan_json())).expect("the plan parses");
+    let plan = record::plan(&frame_of_json(&plan_json())).expect("the plan parses");
 
     let mut terms = Vec::new();
     for (field, operator, input) in queries() {
diff --git a/packages/stack-encrypt/tests/record_lowering.rs b/packages/stack-encrypt/tests/record_lowering.rs
index 1fc56483f..a3afef24a 100644
--- a/packages/stack-encrypt/tests/record_lowering.rs
+++ b/packages/stack-encrypt/tests/record_lowering.rs
@@ -91,19 +91,9 @@ fn plaintext_json() -> Json {
 
 // ---- JSON <-> FfiValue, for the subset the fixture uses --------------------
 
-fn ffi_of_json(value: &Json) -> FfiValue {
-    match value {
-        Json::String(s) => FfiValue::String(s.as_str().into()),
-        Json::Array(items) => FfiValue::Array(items.iter().map(ffi_of_json).collect()),
-        Json::Object(entries) => FfiValue::Object(
-            entries
-                .iter()
-                .map(|(k, v)| (k.clone(), ffi_of_json(v)))
-                .collect(),
-        ),
-        Json::Number(n) => FfiValue::UInt64(n.as_u64().expect("a non-negative integer")),
-        other => panic!("the fixture does not use {other}"),
-    }
+/// A plan written as JSON, as frame bytes: what a binding sends.
+fn frame_of_json(value: &Json) -> Vec<u8> {
+    vitaminc_aead_frame::serde::to_vec(value).expect("frames")
 }
 
 /// The plaintext as the binding sends it: each field at the kind the plan
@@ -403,7 +393,7 @@ async fn open_lowered(
 #[tokio::test]
 async fn the_chain_and_the_lowering_are_one_engine_today() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&data_plan_json())).expect("the data plan parses");
+    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("the data plan parses");
 
     let typed = json_of_record(seal_typed(&cipher).await);
     let lowered = json_of_record(seal_lowered(&cipher, &plan).await);
@@ -433,7 +423,7 @@ async fn the_chain_and_the_lowering_are_one_engine_today() {
 #[tokio::test]
 async fn the_committed_fixture_opens_both_ways() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&data_plan_json())).expect("the data plan parses");
+    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("the data plan parses");
     let path = fixture_path();
 
     if std::env::var_os("STACK_ENCRYPT_UPDATE_FIXTURES").is_some() {
@@ -708,7 +698,7 @@ async fn open_note_lowered(
 #[tokio::test]
 async fn the_chain_and_the_lowering_agree_on_a_context_field_today() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&note_plan_json())).expect("the data plan parses");
+    let plan = record::plan(&frame_of_json(&note_plan_json())).expect("the data plan parses");
     assert_eq!(plan.context_field(), Some("tenant"));
 
     let typed = json_of_record(seal_note_typed(&cipher).await);
@@ -755,7 +745,7 @@ async fn the_chain_and_the_lowering_agree_on_a_context_field_today() {
 #[tokio::test]
 async fn the_committed_context_field_case_opens_both_ways() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&note_plan_json())).expect("the data plan parses");
+    let plan = record::plan(&frame_of_json(&note_plan_json())).expect("the data plan parses");
     let path = fixture_path();
 
     if std::env::var_os("STACK_ENCRYPT_UPDATE_FIXTURES").is_some() {
@@ -827,7 +817,7 @@ async fn the_committed_context_field_case_opens_both_ways() {
 #[tokio::test]
 async fn the_fixture_records_are_bound_to_their_labels() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(ffi_of_json(&data_plan_json())).expect("plan");
+    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("plan");
     let sealed = seal_lowered(&cipher, &plan).await;
     let CipherText::Map(mut fields) = sealed else {
         panic!("a map");
diff --git a/packages/stack-encrypt/tests/stored_rows.rs b/packages/stack-encrypt/tests/stored_rows.rs
index 7695279a8..817728773 100644
--- a/packages/stack-encrypt/tests/stored_rows.rs
+++ b/packages/stack-encrypt/tests/stored_rows.rs
@@ -25,7 +25,7 @@ use std::path::PathBuf;
 use common::{deterministic_cipher, DeterministicSource};
 use serde_json::{json, Map, Value as Json};
 use stack_encrypt::dynamic::record::{self, Plan as DataPlan};
-use stack_encrypt::dynamic::{admits, FfiValue, Scope, ValueFrame, ValueKind};
+use stack_encrypt::dynamic::{admits, Scope, ValueFrame, ValueKind};
 use stack_encrypt::target::IndexSpec;
 use stack_encrypt::StackCipherText as Node;
 use stack_encrypt::{
@@ -146,25 +146,13 @@ fn skeleton(json: &Json) -> Json {
 
 // ---- a plan as JSON ---------------------------------------------------------
 
-/// A plan in the fixture as the value a binding sends.
-fn ffi_of_json(value: &Json) -> FfiValue {
-    match value {
-        Json::String(text) => FfiValue::String(text.as_str().into()),
-        Json::Bool(b) => FfiValue::Bool(*b),
-        Json::Number(n) => FfiValue::UInt64(n.as_u64().expect("a non-negative integer")),
-        Json::Array(items) => FfiValue::Array(items.iter().map(ffi_of_json).collect()),
-        Json::Object(entries) => FfiValue::Object(
-            entries
-                .iter()
-                .map(|(key, value)| (key.clone(), ffi_of_json(value)))
-                .collect(),
-        ),
-        Json::Null => FfiValue::Null,
-    }
+/// A plan written as JSON, as frame bytes: what a binding sends.
+fn frame_of_json(value: &Json) -> Vec<u8> {
+    vitaminc_aead_frame::serde::to_vec(value).expect("frames")
 }
 
 fn plan_of(json: &Json) -> DataPlan {
-    record::plan(ffi_of_json(json)).expect("the frozen plan parses")
+    record::plan(&frame_of_json(json)).expect("the frozen plan parses")
 }
 
 // ---- sealing and opening ----------------------------------------------------
diff --git a/packages/stack-encrypt/tests/value_kinds.rs b/packages/stack-encrypt/tests/value_kinds.rs
index 37f62b176..3f3008a30 100644
--- a/packages/stack-encrypt/tests/value_kinds.rs
+++ b/packages/stack-encrypt/tests/value_kinds.rs
@@ -192,7 +192,7 @@ fn data_plan() -> DataPlan {
             )
         })
         .collect();
-    record::plan(FfiValue::Object(fields)).expect("the data plan parses")
+    record::plan(&ffi_frame(&FfiValue::Object(fields))).expect("the data plan parses")
 }
 
 /// The source as a binding hands it over: one frame, a map of the fields in
@@ -444,7 +444,7 @@ async fn a_value_of_another_width_is_refused_when_sealed() {
         "an int32 is not an int8: {:?}",
         refused.err()
     );
-    let ore_on_a_date = record::plan(FfiValue::Object(vec![(
+    let ore_on_a_date = record::plan(&ffi_frame(&FfiValue::Object(vec![(
         "day".into(),
         FfiValue::Object(vec![
             (
@@ -460,7 +460,7 @@ async fn a_value_of_another_width_is_refused_when_sealed() {
             ),
             ("type".into(), FfiValue::String("date".into())),
         ]),
-    )]));
+    )])));
     assert!(matches!(
         ore_on_a_date,
         Err(Error::Plan {
@@ -552,3 +552,8 @@ async fn the_committed_fixture_opens_and_its_terms_are_todays() {
         assert_eq!(json!(hex(&term)), entry["term"], "{field}: today's");
     }
 }
+
+/// A plan as frame bytes: what a binding sends.
+fn ffi_frame(value: &FfiValue) -> Vec<u8> {
+    vitaminc_protected::Controlled::risky_unwrap(value.to_frame().expect("frames"))
+}

From 42c8486da111a46f2282fe160fa77f7ad53df0d6 Mon Sep 17 00:00:00 2001
From: Dan Draper <dan@cipherstash.com>
Date: Sun, 18 Oct 2026 21:01:13 +1100
Subject: [PATCH 7/7] refactor(stack-encrypt): write the engine's answers with
 serde, not FfiValue

The engine's answers to a binding were built as FfiValue trees and then
framed: a query term (QueryTerm::to_value), a catalog entry
(TargetDescriptor::to_value and operator_to_value), an index's wire form
(IndexSpec::to_value) and a limit (limit_to_value). Each is now written
straight to its frame by serde (vitaminc_aead_frame::serde), through a
derived wire struct:
- QueryTerm, TargetDescriptor and IndexSpec implement Serialize;
- OperatorEntry::new(operator, index) is one catalog entry, Serialize;
- a limit is Limit::rows(), an Option<u64>, so None writes null.

The bytes are the same. Before the old encoders were deleted, a test wrote
every index under default and non-default match options, every operator
entry, query terms with and without a domain and as a range, four limits,
three pages of verdicts and four catalog entries both ways and compared
them; the bytes it recorded are now pinned in wire_bytes, so a change to
any answer's frame fails there.

The Go guest writes each answer with encode_answer, which sizes its
buffer exactly as every other output is, and builds {"targets": [...]}
and the verify page from derived types. Its decode_value, encode_value
and value_encoded_len are gone with the last FfiValue control message.
Tests that inspect an answer read it back from its frame.

Refs #1252.
---
 languages/golang/encrypt/guest/src/ops.rs     | 193 ++++------
 packages/stack-encrypt/CHANGELOG.md           |  13 +-
 packages/stack-encrypt/src/dynamic/mod.rs     |  13 +-
 packages/stack-encrypt/src/dynamic/query.rs   | 332 ++++++++++++++----
 packages/stack-encrypt/src/dynamic/record.rs  |  19 +-
 packages/stack-encrypt/src/dynamic/target.rs  |  93 ++---
 packages/stack-encrypt/src/dynamic/term.rs    | 101 ++++--
 .../stack-encrypt/src/dynamic/test_frame.rs   |   7 +
 8 files changed, 481 insertions(+), 290 deletions(-)

diff --git a/languages/golang/encrypt/guest/src/ops.rs b/languages/golang/encrypt/guest/src/ops.rs
index 182f06969..d0aefcb77 100644
--- a/languages/golang/encrypt/guest/src/ops.rs
+++ b/languages/golang/encrypt/guest/src/ops.rs
@@ -45,14 +45,13 @@
 //! the output. Control data (a plan, a context, an options object, query
 //! statistics) carries no secret and is read from its frame with serde.
 
-use stack_encrypt::dynamic::{self, FfiValue, Scope, ValueFrame};
+use stack_encrypt::dynamic::{self, Scope, ValueFrame};
 use stack_encrypt::sem::MatchOptions;
 use stack_encrypt::target::IndexSpec;
 use stack_encrypt::ErrorPayload;
-use stack_encrypt::{CipherText, Encrypt, KeysetCipher, Label, Node, SealedValue, StackCipherText};
+use stack_encrypt::{CipherText, KeysetCipher, Label, Node, SealedValue, StackCipherText};
 use stack_kms::DataKeySource;
-use vitaminc_aead_frame::{decode_ciphertext, encode_ciphertext, Frame, FrameWriter};
-use vitaminc_protected::Controlled;
+use vitaminc_aead_frame::{decode_ciphertext, encode_ciphertext, Frame};
 use zeroize::Zeroizing;
 
 use stack_guest_abi::last_error;
@@ -232,7 +231,8 @@ where
 /// Derive the query term for one plan field, an operator and its input
 /// (ADR-0009; ADR-0007, amended 2026-10-16): a codec-encoded input, the
 /// codec-encoded plan, the field's name and the operator's name (both UTF-8)
-/// in, the term's codec-encoded object out ([`dynamic::QueryTerm::to_value`]):
+/// in, the term's codec-encoded object out (the `Serialize` form of
+/// [`dynamic::QueryTerm`]):
 ///
 /// ```text
 /// { "operator": "matches", "fidelity": "probabilistic", "index": "match",
@@ -269,7 +269,7 @@ where
     .map_err(|e| fail_dynamic(&e))?
     .await
     .map_err(|e| fail_error(&e))?;
-    encode_value(term.to_value())
+    encode_answer(&term)
 }
 
 /// Verify a page of decrypted values against a probabilistic query: the
@@ -303,9 +303,7 @@ pub fn verify(
         &resolver(),
     )
     .map_err(|e| fail_dynamic(&e))?;
-    encode_value(FfiValue::Array(
-        verified.into_iter().map(FfiValue::Bool).collect(),
-    ))
+    encode_answer(&verified)
 }
 
 /// How many rows a probabilistic query should fetch for `want` of them to
@@ -314,7 +312,8 @@ pub fn verify(
 /// ([`Stats::from_frame`](stack_encrypt::op::Stats::from_frame)), the plan,
 /// the field's name and the operator's name in; the codec-encoded limit out,
 /// an unsigned 64-bit integer or null for no finite fetch
-/// ([`dynamic::limit_to_value`]). Needs no cipher and no key.
+/// ([`Limit::rows`](stack_encrypt::op::Limit::rows)). Needs no cipher and
+/// no key.
 pub fn target_limit(
     term: &[u8],
     stats: &[u8],
@@ -330,7 +329,7 @@ pub fn target_limit(
         .map_err(|e| fail_dynamic(&e.in_field(field)))?;
     let limit = dynamic::target_limit(&plan, field, operator, term, want, &stats, &resolver())
         .map_err(|e| fail_dynamic(&e))?;
-    encode_value(dynamic::limit_to_value(limit))
+    encode_answer(&limit.rows())
 }
 
 /// The plan, field name and operator a query names: the plan parsed against
@@ -383,8 +382,8 @@ pub fn plan_check(plan: &[u8]) -> Result<(), u32> {
 
 /// The EQL types this build of the engine knows, as a codec-encoded
 /// `{"targets": [...]}`: one entry per type in
-/// [`TargetDescriptor::to_value`](stack_encrypt::dynamic::TargetDescriptor::to_value)'s
-/// wire form, producible or not, with the reason when not. The build
+/// [`TargetDescriptor`](stack_encrypt::dynamic::TargetDescriptor)'s
+/// `Serialize` form, producible or not, with the reason when not. The build
 /// without EQL types lists none, which a generator reads as "no
 /// `encrypt_into` type is available" and refuses the tag; the `eql` build
 /// lists the catalog, and a generator writes `encrypt_into` only for an
@@ -413,22 +412,19 @@ pub fn plan_check(plan: &[u8]) -> Result<(), u32> {
 /// type answers and how far each answer can be trusted.
 pub fn targets() -> Result<Vec<u8>, u32> {
     use stack_encrypt::dynamic::TargetResolver as _;
-    encode_value(FfiValue::Object(vec![(
-        "targets".to_string(),
-        FfiValue::Array(
-            resolver()
-                .targets()
-                .iter()
-                .map(|target| target.to_value())
-                .collect(),
-        ),
-    )]))
+    #[derive(serde::Serialize)]
+    struct Targets {
+        targets: Vec<dynamic::TargetDescriptor>,
+    }
+    encode_answer(&Targets {
+        targets: resolver().targets(),
+    })
 }
 
 /// The operators one field of a codec-encoded plan answers, as a
 /// codec-encoded list: one object per operator, in the order the engine
-/// lists them, each written by
-/// [`dynamic::operator_to_value`]:
+/// lists them, each the `Serialize` form of a
+/// [`dynamic::OperatorEntry`]:
 ///
 /// ```text
 /// [ { "operator": "eq", "fidelity": "exact", "arity": "one", "index": "eq" }, ... ]
@@ -447,12 +443,12 @@ pub fn operators(plan: &[u8], field: &[u8]) -> Result<Vec<u8>, u32> {
         .map_err(|_| last_error::malformed("the field name is not UTF-8"))?;
     let operators =
         dynamic::field_operators(&plan, field, &resolver()).map_err(|e| fail_dynamic(&e))?;
-    encode_value(FfiValue::Array(
-        operators
+    encode_answer(
+        &operators
             .iter()
-            .map(|(operator, index)| dynamic::operator_to_value(*operator, index))
-            .collect(),
-    ))
+            .map(|(operator, index)| dynamic::OperatorEntry::new(*operator, index))
+            .collect::<Vec<_>>(),
+    )
 }
 
 // =============================================================================
@@ -538,7 +534,7 @@ fn checked_plaintext(bytes: &[u8]) -> Result<Frame<'_>, u32> {
 }
 
 /// An opened value as the output buffer: its frame, copied into a buffer
-/// whose capacity is exactly its length (see [`encode_value`]); the frame
+/// whose capacity is exactly its length (see [`encode_tree`]); the frame
 /// is wiped when it drops.
 fn encode_frame(frame: ValueFrame) -> Result<Vec<u8>, u32> {
     let mut out = exact_buffer(Some(frame.risky_ref().len()))?;
@@ -556,23 +552,17 @@ fn not_a_frame() -> u32 {
     last_error::malformed("an input is not a value in the transport frame")
 }
 
-/// Encode a value tree into a buffer whose capacity is exactly its length.
-///
-/// This buffer is plaintext on the decrypt path, and the registry wipes only
-/// the buffer it holds: `register`'s `into_boxed_slice` reallocates a `Vec`
-/// whose capacity exceeds its length, leaving the old allocation unwiped.
-/// The frame writer reserves an upper bound per leaf (a six-byte string
-/// reserves 14 for 11), so writing straight into the exactly sized buffer
-/// can still grow it. It writes into a `Zeroizing` staging buffer instead
-/// (the writer wipes any allocation it replaces), which is copied into an
-/// exactly sized output and then wiped.
-fn encode_value(value: FfiValue) -> Result<Vec<u8>, u32> {
-    let mut staging = Zeroizing::new(exact_buffer(value_encoded_len(&value))?);
-    (&value)
-        .visit(FrameWriter::new(&mut staging))
-        .map_err(|_| STATUS_ENCODING)?;
-    let mut out = exact_buffer(Some(staging.len()))?;
-    out.extend_from_slice(&staging);
+/// One of the engine's answers (a query term, a page of verdicts, a limit, a
+/// catalog), written to its frame by serde, in a buffer whose capacity is
+/// exactly its length. An answer is not plaintext, but the registry's
+/// `into_boxed_slice` would reallocate a buffer with spare capacity, so it
+/// is sized as every other output is. A query term's search tokens are
+/// derived from plaintext, so the staging buffer is wiped once copied.
+fn encode_answer<T: serde::Serialize>(answer: &T) -> Result<Vec<u8>, u32> {
+    let frame =
+        Zeroizing::new(vitaminc_aead_frame::serde::to_vec(answer).map_err(|_| STATUS_ENCODING)?);
+    let mut out = exact_buffer(Some(frame.len()))?;
+    out.extend_from_slice(&frame);
     Ok(out)
 }
 
@@ -589,8 +579,9 @@ fn decode_tree(bytes: &[u8]) -> Result<StackCipherText, u32> {
 }
 
 /// The encode twin of [`decode_tree`]. Passthrough nodes can carry caller
-/// plaintext, so this is sized up front for the same reason
-/// [`encode_value`] is.
+/// plaintext, so this is sized up front: the registry wipes only the buffer
+/// it holds, and `register`'s `into_boxed_slice` reallocates a `Vec` whose
+/// capacity exceeds its length, leaving the old allocation unwiped.
 fn encode_tree(tree: StackCipherText) -> Result<Vec<u8>, u32> {
     let tree = map_leaves(tree, &mut |l: SealedValue| Ok::<_, u32>(l.to_bytes()))?;
     let mut out = exact_buffer(tree_encoded_len(&tree))?;
@@ -640,29 +631,6 @@ fn exact_buffer(len: Option<usize>) -> Result<Vec<u8>, u32> {
     Ok(out)
 }
 
-/// Exact byte length of the frame of `value`. `None` on overflow or on a
-/// length the frame's `u32` lengths cannot express — the encode would fail
-/// on those anyway, so the caller reports an encoding error.
-fn value_encoded_len(value: &FfiValue) -> Option<usize> {
-    // tag byte + fixed payload, or tag + u32 length prefix + payload.
-    let framed = |len: usize| u32::try_from(len).ok().and_then(|_| len.checked_add(5));
-    match value {
-        FfiValue::Null | FfiValue::Undefined | FfiValue::Bool(_) => Some(1),
-        FfiValue::Int32(_) | FfiValue::UInt32(_) | FfiValue::Float32(_) => Some(5),
-        FfiValue::Int64(_) | FfiValue::UInt64(_) | FfiValue::Float64(_) => Some(9),
-        FfiValue::String(s) => framed(s.risky_ref().len()),
-        FfiValue::Bytes(b) => framed(b.risky_ref().len()),
-        FfiValue::Array(items) => items.iter().try_fold(5usize, |acc, item| {
-            acc.checked_add(value_encoded_len(item)?)
-        }),
-        FfiValue::Object(entries) => entries.iter().try_fold(5usize, |acc, (key, value)| {
-            acc.checked_add(framed(key.len())?.checked_sub(1)?)?
-                .checked_add(value_encoded_len(value)?)
-        }),
-        FfiValue::Passthrough(inner) => value_encoded_len(inner)?.checked_add(1),
-    }
-}
-
 /// Exact byte length of the codec's encoding of a ciphertext tree. A
 /// passthrough is its node byte and its frame, written as it is.
 fn tree_encoded_len(tree: &BytesTree) -> Option<usize> {
@@ -685,65 +653,32 @@ fn tree_encoded_len(tree: &BytesTree) -> Option<usize> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use vitaminc_protected::Protected;
-
-    // `value_encoded_len` / `tree_encoded_len` re-derive the frame's and the
-    // codec's arithmetic; neither exports an `encoded_len` of its own, so these
-    // pins are the only thing that fails if the two drift. Drift is not a
-    // cosmetic bug: an undersized reservation makes `encode_value`
-    // reallocate mid-encode, leaving unwiped partial plaintext in the
-    // abandoned allocation — silently.
-
-    fn every_value_shape() -> Vec<FfiValue> {
-        vec![
-            FfiValue::Null,
-            FfiValue::Undefined,
-            FfiValue::Bool(true),
-            FfiValue::Int32(-5),
-            FfiValue::UInt32(5),
-            FfiValue::Float32(1.5),
-            FfiValue::Int64(-9),
-            FfiValue::UInt64(9),
-            FfiValue::Float64(2.5),
-            FfiValue::String("".into()),
-            FfiValue::String("héllo".into()),
-            FfiValue::Bytes(Protected::new(Vec::new())),
-            FfiValue::Bytes(Protected::new(vec![0u8; 300])),
-            FfiValue::Array(Vec::new()),
-            FfiValue::Array(vec![FfiValue::Bool(false), FfiValue::String("x".into())]),
-            FfiValue::Object(Vec::new()),
-            FfiValue::Object(vec![
-                ("a".to_string(), FfiValue::Int32(1)),
-                (
-                    "nested".to_string(),
-                    FfiValue::Object(vec![("b".to_string(), FfiValue::Null)]),
-                ),
-            ]),
-            FfiValue::Passthrough(Box::new(FfiValue::Int64(7))),
-            FfiValue::Passthrough(Box::new(FfiValue::Array(vec![FfiValue::String(
-                "deep".into(),
-            )]))),
-        ]
-    }
+    use stack_encrypt::dynamic::FfiValue;
+    use vitaminc_protected::{Controlled, Protected};
 
-    /// The registry wipes the buffer it is handed, and `into_boxed_slice`
-    /// reallocates one whose capacity exceeds its length, leaving the old
-    /// allocation unwiped. So every encoded output's capacity is its length,
-    /// not only its length the frame's.
-    #[test]
-    fn an_encoded_value_has_no_spare_capacity() {
-        for (i, value) in every_value_shape().into_iter().enumerate() {
-            let out = encode_value(value).expect("encodes");
-            assert_eq!(out.capacity(), out.len(), "shape {i}");
-        }
-    }
+    // `tree_encoded_len` re-derives the codec's arithmetic; the codec exports
+    // no `encoded_len` of its own, so this pin is the only thing that fails if
+    // the two drift. Drift is not a cosmetic bug: an undersized reservation
+    // makes `encode_tree` reallocate mid-encode, leaving unwiped partial
+    // plaintext in the abandoned allocation — silently.
 
+    /// The registry wipes the buffer it is handed, and `into_boxed_slice`
+    /// reallocates one whose capacity exceeds its length. So every answer's
+    /// capacity is its length.
     #[test]
-    fn value_encoded_len_matches_the_codec_exactly() {
-        for (i, value) in every_value_shape().into_iter().enumerate() {
-            let expected = value_encoded_len(&value).expect("encodable shape");
-            let out = value.to_frame().expect("frame encode");
-            assert_eq!(out.risky_ref().len(), expected, "shape {i}");
+    fn an_encoded_answer_has_no_spare_capacity() {
+        let entries = [
+            dynamic::OperatorEntry::new(dynamic::OpSpec::Eq, &IndexSpec::Equality),
+            dynamic::OperatorEntry::new(dynamic::OpSpec::Between, &IndexSpec::Ope),
+        ];
+        for out in [
+            encode_answer(&vec![true, false, true]),
+            encode_answer(&Some(11u64)),
+            encode_answer(&None::<u64>),
+            encode_answer(&entries),
+        ] {
+            let out = out.expect("encodes");
+            assert_eq!(out.capacity(), out.len());
         }
     }
 
diff --git a/packages/stack-encrypt/CHANGELOG.md b/packages/stack-encrypt/CHANGELOG.md
index 253abf543..619324319 100644
--- a/packages/stack-encrypt/CHANGELOG.md
+++ b/packages/stack-encrypt/CHANGELOG.md
@@ -45,7 +45,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   term's bytes and `Stats` (`Stats::from_frame` reads their wire form), by
   the code the typed `MatchQuery` runs, with the field's own match options;
   neither uses a key. The catalog entry of an EQL type
-  (`TargetDescriptor::to_value`) lists the operators the engine answers for
+  (a serialized `TargetDescriptor`) lists the operators the engine answers for
   it, each with its fidelity (`dynamic::Fidelity`), arity and index
   (`TargetDescriptor::operators`).
 - **An EQL type with a match index answers `matches` through its twin.**
@@ -62,7 +62,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   field of a data plan answers, each with the index that answers it: what
   `query_term` derives a term for on that field and nothing else, for a
   field declared with indexes as for one that names an EQL type.
-  `dynamic::operator_to_value` writes one entry in the catalog's wire form.
+  `dynamic::OperatorEntry` is one entry in the catalog's wire form.
   A generator asks this before the program runs, so it writes one query
   method per operator and holds no copy of the table.
 - **A query names an operator, not an index.**
@@ -160,8 +160,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   output form, `dynamic::record::plan_with` reads `{"context": [...],
   "target": "TextEq", "type"?: ...}` — the two forms are exclusive — and
   resolves the name through a `dynamic::TargetResolver` the host installs:
-  the EQL types a build holds (`targets()`, serializable as
-  `TargetDescriptor::to_value()` for a guest's `se_targets` export) and how
+  the EQL types a build holds (`targets()`, each a `Serialize`
+  `TargetDescriptor` for a guest's `se_targets` export) and how
   to run one. `encrypt_with` zips the type's own `Pending` into the record's,
   so a record with target fields is still one ZeroKMS request, and stores
   the EQL value's JSON bytes under the field's `"eql"` key
@@ -282,6 +282,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     payload may be missing or null alike: `{"match": null}` is a bare
     `"match"`, and `{"eq": null}` a bare `"eq"`.
   - `Stats::from_frame` replaces `Stats::from_value`.
+  - The engine's answers are `Serialize`, written to a frame by serde,
+    byte for byte what the `FfiValue` encoders wrote (pinned in the tests):
+    `QueryTerm`, `TargetDescriptor` and `IndexSpec` replace their
+    `to_value`, `OperatorEntry::new` replaces `operator_to_value`, and
+    `Limit::rows` replaces `limit_to_value` (`None` writes null).
 
 - **A match value with no tokens is stored as the empty filter, so
   `KeysetCipher::match_terms` is no longer a query.** In 0.2.0 the same call
diff --git a/packages/stack-encrypt/src/dynamic/mod.rs b/packages/stack-encrypt/src/dynamic/mod.rs
index 2efc38fe3..307c2612d 100644
--- a/packages/stack-encrypt/src/dynamic/mod.rs
+++ b/packages/stack-encrypt/src/dynamic/mod.rs
@@ -111,8 +111,8 @@ pub use ffi_value::{
 };
 pub use kind::{admits, not_admitted, read};
 pub use query::{
-    check_query, field_operators, limit_to_value, operator_to_value, query_term, target_limit,
-    verify, Fidelity, OpSpec, Operand, QueryTerm,
+    check_query, field_operators, query_term, target_limit, verify, Fidelity, OpSpec, Operand,
+    OperatorEntry, QueryTerm,
 };
 pub use record::{FieldPlan, Output, Plan};
 pub use target::{NoTargets, TargetDescriptor, TargetError, TargetResolver};
@@ -167,6 +167,15 @@ fn utf8(s: &Utf8String) -> Option<&str> {
     std::str::from_utf8(s.risky_ref()).ok()
 }
 
+/// Bytes, written as a frame's bytes leaf rather than a list of integers.
+struct WireBytes<'a>(&'a [u8]);
+
+impl serde::Serialize for WireBytes<'_> {
+    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_bytes(self.0)
+    }
+}
+
 /// What went wrong in a dynamic operation.
 ///
 /// The split that matters to a caller is malformed input versus something
diff --git a/packages/stack-encrypt/src/dynamic/query.rs b/packages/stack-encrypt/src/dynamic/query.rs
index 9b843994d..daff8f1fa 100644
--- a/packages/stack-encrypt/src/dynamic/query.rs
+++ b/packages/stack-encrypt/src/dynamic/query.rs
@@ -17,7 +17,7 @@
 //!   the field does not answer as it refuses a value of the wrong type, with
 //!   [`Error::Source`] naming the field.
 //! - [`field_operators`] lists the operators a plan field answers, each with
-//!   the index that answers it ([`operator_to_value`] writes one): what a
+//!   the index that answers it ([`OperatorEntry`] is one's wire form): what a
 //!   generator asks before the program runs, so it writes one query method
 //!   per operator the engine answers and holds no copy of the table.
 //! - [`verify`] and [`target_limit`] are a probabilistic term's two
@@ -58,13 +58,18 @@
 //! # Wire format
 //!
 //! An operator is its [`name`](OpSpec::name). A query term is the object
-//! [`QueryTerm::to_value`] writes, the statistics the frame object
-//! [`Stats::from_frame`] reads, and a limit the value
-//! [`limit_to_value`] writes; each is documented where it is written.
+//! [`QueryTerm`] serializes to, the statistics the frame object
+//! [`Stats::from_frame`] reads, and a limit [`Limit::rows`]: an unsigned
+//! 64-bit integer, or null for no finite fetch. Each answer is written to a
+//! frame by serde (`vitaminc_aead_frame::serde`) and documented on its
+//! type.
 //!
 //! [`Probabilistic::verify`]: crate::op::Probabilistic::verify
 //! [`Probabilistic::target_limit`]: crate::op::Probabilistic::target_limit
 
+use serde::{Serialize, Serializer};
+
+use super::WireBytes;
 use std::cmp::Ordering;
 use std::fmt;
 
@@ -75,7 +80,7 @@ use super::term::OneScalar;
 use super::term::{derive, Use};
 use super::value_frame::Parts;
 use super::ValueKind;
-use super::{admits, read, Error, FfiValue, Reason, TargetDescriptor, TargetResolver, ValueFrame};
+use super::{admits, read, Error, Reason, TargetDescriptor, TargetResolver, ValueFrame};
 use crate::op::{Limit, Stats};
 use crate::sem::{match_limit, MatchOptions, QueryTokens, TermError};
 use crate::target::IndexSpec;
@@ -304,6 +309,46 @@ pub enum Operand {
     },
 }
 
+/// The term in its wire form: an object with every key present, an
+/// absent value null.
+///
+/// | key | value |
+/// |---|---|
+/// | `operator` | string: the [operator's name](OpSpec::name), `"matches"` |
+/// | `fidelity` | string: `"exact"` or `"probabilistic"` ([`Fidelity::name`]) |
+/// | `index` | string: the [key](IndexSpec::key) of the index that answers, `"match"` |
+/// | `domain` | string or null: the query value's PostgreSQL domain, for a field that names an EQL type |
+/// | `term` | bytes: the term, or for `between` a list of two byte strings, the low bound's term then the high's |
+impl Serialize for QueryTerm {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        #[derive(Serialize)]
+        struct Wire<'a> {
+            operator: &'static str,
+            fidelity: &'static str,
+            index: &'static str,
+            domain: Option<&'a str>,
+            term: Term<'a>,
+        }
+        #[derive(Serialize)]
+        #[serde(untagged)]
+        enum Term<'a> {
+            One(WireBytes<'a>),
+            Range([WireBytes<'a>; 2]),
+        }
+        Wire {
+            operator: self.operator.name(),
+            fidelity: self.fidelity().name(),
+            index: self.index.key(),
+            domain: self.domain.as_deref(),
+            term: match &self.operand {
+                Operand::One(term) => Term::One(WireBytes(term)),
+                Operand::Range { lo, hi } => Term::Range([WireBytes(lo), WireBytes(hi)]),
+            },
+        }
+        .serialize(s)
+    }
+}
+
 impl QueryTerm {
     /// The operator the term answers.
     pub fn operator(&self) -> OpSpec {
@@ -330,45 +375,6 @@ impl QueryTerm {
     pub fn operand(&self) -> &Operand {
         &self.operand
     }
-
-    /// The term in its wire form: an object with every key present, an
-    /// absent value null.
-    ///
-    /// | key | value |
-    /// |---|---|
-    /// | `operator` | string: the [operator's name](OpSpec::name), `"matches"` |
-    /// | `fidelity` | string: `"exact"` or `"probabilistic"` ([`Fidelity::name`]) |
-    /// | `index` | string: the [key](IndexSpec::key) of the index that answers, `"match"` |
-    /// | `domain` | string or null: the query value's PostgreSQL domain, for a field that names an EQL type |
-    /// | `term` | bytes: the term, or for `between` a list of two byte strings, the low bound's term then the high's |
-    pub fn to_value(&self) -> FfiValue {
-        let bytes = |b: &[u8]| FfiValue::Bytes(vitaminc_protected::Protected::new(b.to_vec()));
-        let term = match &self.operand {
-            Operand::One(term) => bytes(term),
-            Operand::Range { lo, hi } => FfiValue::Array(vec![bytes(lo), bytes(hi)]),
-        };
-        FfiValue::Object(vec![
-            (
-                "operator".to_owned(),
-                FfiValue::String(self.operator.name().into()),
-            ),
-            (
-                "fidelity".to_owned(),
-                FfiValue::String(self.fidelity().name().into()),
-            ),
-            (
-                "index".to_owned(),
-                FfiValue::String(self.index.key().into()),
-            ),
-            (
-                "domain".to_owned(),
-                self.domain
-                    .as_deref()
-                    .map_or(FfiValue::Null, |domain| FfiValue::String(domain.into())),
-            ),
-            ("term".to_owned(), term),
-        ])
-    }
 }
 
 /// The field a query is about, and the index that answers its operator.
@@ -470,7 +476,7 @@ fn answers(
 /// answers what the type's [`TargetDescriptor::operators`] lists; a field
 /// with no declared kind answers none. The context does not matter, so a
 /// plan whose context is a field of each record is taken. Write each entry
-/// with [`operator_to_value`].
+/// as an [`OperatorEntry`].
 ///
 /// ```
 /// use stack_encrypt::dynamic::{field_operators, record, NoTargets, OpSpec};
@@ -509,17 +515,24 @@ pub fn field_operators(
 /// | `fidelity` | string: `exact` or `probabilistic` ([`Fidelity::name`]) |
 /// | `arity` | string: `one`, or `pair` for an operator whose input is two values, low then high |
 /// | `index` | string: the [key](IndexSpec::key) of the index that answers it, `eq` |
-pub fn operator_to_value(operator: OpSpec, index: &IndexSpec) -> FfiValue {
-    let text = |s: &str| FfiValue::String(s.into());
-    FfiValue::Object(vec![
-        ("operator".to_owned(), text(operator.name())),
-        ("fidelity".to_owned(), text(operator.fidelity().name())),
-        (
-            "arity".to_owned(),
-            text(if operator.takes_pair() { "pair" } else { "one" }),
-        ),
-        ("index".to_owned(), text(index.key())),
-    ])
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize)]
+pub struct OperatorEntry {
+    operator: &'static str,
+    fidelity: &'static str,
+    arity: &'static str,
+    index: &'static str,
+}
+
+impl OperatorEntry {
+    /// The entry for `operator`, answered by `index`.
+    pub fn new(operator: OpSpec, index: &IndexSpec) -> Self {
+        Self {
+            operator: operator.name(),
+            fidelity: operator.fidelity().name(),
+            arity: if operator.takes_pair() { "pair" } else { "one" },
+            index: index.key(),
+        }
+    }
 }
 
 /// Refuse a plan whose context is a field of each record: a term derives
@@ -999,16 +1012,15 @@ impl<'de> serde::Deserialize<'de> for Confidence {
     }
 }
 
-/// A limit in its wire form: the rows to fetch as an unsigned 64-bit
-/// integer, or null for [`Limit::Unbounded`].
-pub fn limit_to_value(limit: Limit) -> FfiValue {
-    limit.rows().map_or(FfiValue::Null, FfiValue::UInt64)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::dynamic::test_frame::frame_of;
+    use crate::dynamic::test_frame::{frame_of, value_of};
+    use crate::dynamic::FfiValue;
+
+    fn operator_value(operator: OpSpec, index: &IndexSpec) -> FfiValue {
+        value_of(&OperatorEntry::new(operator, index))
+    }
 
     /// Statistics as a binding sends them.
     fn stats_frame(value: &FfiValue) -> Result<Stats, Error> {
@@ -2087,10 +2099,10 @@ mod tests {
     #[test]
     fn a_limit_is_its_rows_or_null() {
         assert!(matches!(
-            limit_to_value(Limit::Rows(11)),
+            value_of(&Limit::Rows(11).rows()),
             FfiValue::UInt64(11)
         ));
-        assert!(matches!(limit_to_value(Limit::Unbounded), FfiValue::Null));
+        assert!(matches!(value_of(&Limit::Unbounded.rows()), FfiValue::Null));
     }
 
     #[tokio::test]
@@ -2105,7 +2117,7 @@ mod tests {
         )
         .await
         .unwrap();
-        let FfiValue::Object(entries) = term.to_value() else {
+        let FfiValue::Object(entries) = value_of(&term) else {
             panic!("an object");
         };
         let keys: Vec<&str> = entries.iter().map(|(k, _)| k.as_str()).collect();
@@ -2191,7 +2203,7 @@ mod tests {
     #[test]
     fn a_targets_operators_are_listed_in_its_wire_form() {
         let FfiValue::Object(entries) =
-            descriptor(Some(ValueKind::Int64), &["ore"], true, true).to_value()
+            value_of(&descriptor(Some(ValueKind::Int64), &["ore"], true, true))
         else {
             panic!("an object");
         };
@@ -2291,7 +2303,7 @@ mod tests {
 
     #[test]
     fn an_operator_is_written_with_every_key_in_order() {
-        let FfiValue::Object(entries) = operator_to_value(OpSpec::Between, &IndexSpec::Ope) else {
+        let FfiValue::Object(entries) = operator_value(OpSpec::Between, &IndexSpec::Ope) else {
             panic!("an object");
         };
         let entries: Vec<(&str, &[u8])> = entries
@@ -2311,7 +2323,7 @@ mod tests {
             ]
         );
         let FfiValue::Object(entries) =
-            operator_to_value(OpSpec::Matches, &IndexSpec::Match(MatchOptions::default()))
+            operator_value(OpSpec::Matches, &IndexSpec::Match(MatchOptions::default()))
         else {
             panic!("an object");
         };
@@ -2598,3 +2610,185 @@ mod tests {
         );
     }
 }
+
+/// The engine's answers, pinned byte for byte: these are the frames the
+/// FfiValue encoders wrote before the answers were written by serde, and a
+/// binding reads them.
+#[cfg(test)]
+mod wire_bytes {
+    use super::*;
+    use crate::sem::{MatchOptions, Tokenizer};
+    use vitaminc_aead_frame::serde::to_vec;
+
+    fn hex<T: Serialize>(value: &T) -> String {
+        to_vec(value)
+            .expect("frames")
+            .iter()
+            .map(|b| format!("{b:02x}"))
+            .collect()
+    }
+
+    fn indexes() -> Vec<IndexSpec> {
+        vec![
+            IndexSpec::Equality,
+            IndexSpec::Match(MatchOptions::default()),
+            IndexSpec::Match(MatchOptions {
+                tokenizer: Tokenizer::Standard,
+                downcase: false,
+                k: 4,
+                m: 512,
+            }),
+            IndexSpec::Match(MatchOptions {
+                tokenizer: Tokenizer::Ngram { length: 4 },
+                ..MatchOptions::default()
+            }),
+            IndexSpec::Ore,
+            IndexSpec::Ope,
+        ]
+    }
+
+    fn descriptor(
+        kind: Option<ValueKind>,
+        indexes: &[&str],
+        query: bool,
+        producible: bool,
+    ) -> TargetDescriptor {
+        TargetDescriptor::new(
+            "Some",
+            "some",
+            "",
+            kind,
+            "public.some",
+            indexes.iter().map(|i| (*i).to_owned()).collect(),
+            query.then(|| "SomeQuery".to_owned()),
+            query.then(|| "eql_v3.query_some".to_owned()),
+            producible,
+            (!producible).then(|| "not yet".to_owned()),
+        )
+    }
+
+    /// Every index, and every operator entry under it; three query terms,
+    /// one a range and one with a domain; four limits; three pages of
+    /// verdicts; four catalog entries.
+    #[test]
+    fn every_answer_writes_its_pinned_bytes() {
+        let mut written = Vec::new();
+        for index in indexes() {
+            written.push(hex(&index));
+            for op in OpSpec::ALL {
+                written.push(hex(&OperatorEntry::new(op, &index)));
+            }
+        }
+        for term in [
+            QueryTerm {
+                operator: OpSpec::Eq,
+                index: IndexSpec::Equality,
+                domain: None,
+                operand: Operand::One(vec![1, 2, 3]),
+            },
+            QueryTerm {
+                operator: OpSpec::Between,
+                index: IndexSpec::Ope,
+                domain: Some("eql_v4.query_int".to_owned()),
+                operand: Operand::Range {
+                    lo: vec![4],
+                    hi: vec![5, 6],
+                },
+            },
+            QueryTerm {
+                operator: OpSpec::Matches,
+                index: IndexSpec::Match(MatchOptions::default()),
+                domain: None,
+                operand: Operand::One(Vec::new()),
+            },
+        ] {
+            written.push(hex(&term));
+        }
+        for limit in [
+            Limit::Rows(0),
+            Limit::Rows(11),
+            Limit::Rows(u64::MAX),
+            Limit::Unbounded,
+        ] {
+            written.push(hex(&limit.rows()));
+        }
+        for page in [vec![], vec![true], vec![true, false, true]] {
+            written.push(hex(&page));
+        }
+        for target in [
+            descriptor(Some(ValueKind::String), &["eq", "match"], true, true),
+            descriptor(Some(ValueKind::String), &["eq", "match"], true, true)
+                .with_match_options(MatchOptions::default()),
+            descriptor(Some(ValueKind::Int64), &["ore"], true, true),
+            descriptor(None, &[], false, false),
+        ] {
+            written.push(hex(&target));
+        }
+        assert_eq!(written, PINNED);
+    }
+
+    const PINNED: [&str; 62] = [
+        "0a020000006571",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a020000006571",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "0a050000006d61746368",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f101000000050000006d61746368f10400000009000000746f6b656e697a65720a080000007374616e6461726408000000646f776e6361736502010000006b070400000000000000010000006d070002000000000000",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f101000000050000006d61746368f10400000009000000746f6b656e697a6572f101000000050000006e6772616d07040000000000000008000000646f776e6361736503010000006b070300000000000000010000006d070001000000000000",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a050000006d61746368",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "0a030000006f7265",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a030000006f7265",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "0a030000006f7065",
+        "f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a0500000065786163740500000061726974790a040000007061697205000000696e6465780a030000006f7065",
+        "f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a030000006f7065",
+        "f105000000080000006f70657261746f720a02000000657108000000666964656c6974790a05000000657861637405000000696e6465780a02000000657106000000646f6d61696e00040000007465726d0b03000000010203",
+        "f105000000080000006f70657261746f720a070000006265747765656e08000000666964656c6974790a05000000657861637405000000696e6465780a030000006f706506000000646f6d61696e0a1000000065716c5f76342e71756572795f696e74040000007465726df0020000000b01000000040b020000000506",
+        "f105000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c697374696305000000696e6465780a050000006d6174636806000000646f6d61696e00040000007465726d0b00000000",
+        "070000000000000000",
+        "070b00000000000000",
+        "07ffffffffffffffff",
+        "00",
+        "f000000000",
+        "f00100000003",
+        "f003000000030203",
+        "f10b000000040000006e616d650a04000000536f6d650600000066616d696c790a04000000736f6d65060000007375666669780a0000000009000000706c61696e746578740a06000000737472696e670a00000073716c5f646f6d61696e0a0b0000007075626c69632e736f6d6507000000696e6465786573f0020000000a0200000065710a050000006d617463680500000071756572790a09000000536f6d6551756572791000000071756572795f73716c5f646f6d61696e0a1100000065716c5f76332e71756572795f736f6d650a00000070726f64756369626c650306000000726561736f6e00090000006f70657261746f7273f001000000f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571",
+        "f10b000000040000006e616d650a04000000536f6d650600000066616d696c790a04000000736f6d65060000007375666669780a0000000009000000706c61696e746578740a06000000737472696e670a00000073716c5f646f6d61696e0a0b0000007075626c69632e736f6d6507000000696e6465786573f0020000000a0200000065710a050000006d617463680500000071756572790a09000000536f6d6551756572791000000071756572795f73716c5f646f6d61696e0a1100000065716c5f76332e71756572795f736f6d650a00000070726f64756369626c650306000000726561736f6e00090000006f70657261746f7273f002000000f104000000080000006f70657261746f720a02000000657108000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a020000006571f104000000080000006f70657261746f720a070000006d61746368657308000000666964656c6974790a0d00000070726f626162696c69737469630500000061726974790a030000006f6e6505000000696e6465780a050000006d61746368",
+        "f10b000000040000006e616d650a04000000536f6d650600000066616d696c790a04000000736f6d65060000007375666669780a0000000009000000706c61696e746578740a05000000696e7436340a00000073716c5f646f6d61696e0a0b0000007075626c69632e736f6d6507000000696e6465786573f0010000000a030000006f72650500000071756572790a09000000536f6d6551756572791000000071756572795f73716c5f646f6d61696e0a1100000065716c5f76332e71756572795f736f6d650a00000070726f64756369626c650306000000726561736f6e00090000006f70657261746f7273f004000000f104000000080000006f70657261746f720a020000006c7408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265f104000000080000006f70657261746f720a030000006c746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265f104000000080000006f70657261746f720a02000000677408000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265f104000000080000006f70657261746f720a0300000067746508000000666964656c6974790a0500000065786163740500000061726974790a030000006f6e6505000000696e6465780a030000006f7265",
+        "f10b000000040000006e616d650a04000000536f6d650600000066616d696c790a04000000736f6d65060000007375666669780a0000000009000000706c61696e74657874000a00000073716c5f646f6d61696e0a0b0000007075626c69632e736f6d6507000000696e6465786573f000000000050000007175657279001000000071756572795f73716c5f646f6d61696e000a00000070726f64756369626c650206000000726561736f6e0a070000006e6f7420796574090000006f70657261746f7273f000000000",
+    ];
+}
diff --git a/packages/stack-encrypt/src/dynamic/record.rs b/packages/stack-encrypt/src/dynamic/record.rs
index 50bc0fac7..b79f98815 100644
--- a/packages/stack-encrypt/src/dynamic/record.rs
+++ b/packages/stack-encrypt/src/dynamic/record.rs
@@ -967,7 +967,7 @@ pub fn plan(frame: &[u8]) -> Result<Plan, Error> {
 /// a power of two in `32..=65536`, a zero n-gram length), is refused. The
 /// other three indexes have no options and no object form. A field names
 /// each output key at most once, so it carries at most one match index.
-/// [`IndexSpec::to_value`] writes this form and [`IndexSpec::from_frame`]
+/// [`IndexSpec`] serializes to this form and [`IndexSpec::from_frame`]
 /// reads it. `"passthrough"` is a field's only output when it has it.
 ///
 /// [`MatchOptions::default`]: crate::sem::MatchOptions::default
@@ -3194,11 +3194,10 @@ mod tests {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
         fn wide() -> FfiValue {
-            IndexSpec::Match(crate::sem::MatchOptions {
+            crate::dynamic::test_frame::value_of(&IndexSpec::Match(crate::sem::MatchOptions {
                 k: 6,
                 ..crate::sem::MatchOptions::default()
-            })
-            .to_value()
+            }))
         }
         // Each case is refused for the missing type and nothing else: the
         // refusal is the variant that names the field, and the same spec
@@ -3628,7 +3627,9 @@ mod tests {
                     ("context", label("nick")),
                     (
                         "outputs",
-                        FfiValue::Array(vec![IndexSpec::Match(options.clone()).to_value()]),
+                        FfiValue::Array(vec![crate::dynamic::test_frame::value_of(
+                            &IndexSpec::Match(options.clone()),
+                        )]),
                     ),
                     ("type", s("string")),
                 ]),
@@ -5369,7 +5370,13 @@ mod tests {
                     "f",
                     obj(vec![
                         ("context", label("f")),
-                        ("outputs", FfiValue::Array(vec![s("c"), kind.to_value()])),
+                        (
+                            "outputs",
+                            FfiValue::Array(vec![
+                                s("c"),
+                                crate::dynamic::test_frame::value_of(&kind),
+                            ]),
+                        ),
                         ("type", s(ty)),
                     ]),
                 )]))
diff --git a/packages/stack-encrypt/src/dynamic/target.rs b/packages/stack-encrypt/src/dynamic/target.rs
index f32465da3..d734e11ee 100644
--- a/packages/stack-encrypt/src/dynamic/target.rs
+++ b/packages/stack-encrypt/src/dynamic/target.rs
@@ -18,7 +18,7 @@
 //!
 //! # Wire format
 //!
-//! [`TargetDescriptor::to_value`] is the entry a guest's `se_targets` export
+//! A [`TargetDescriptor`], serialized, is the entry a guest's `se_targets` export
 //! lists for each type; the keys are fixed on [`TargetDescriptor`], in the
 //! crate that owns the data grammar, and `eql-bindings` is tested to spell
 //! its table the same way.
@@ -27,8 +27,8 @@
 
 use std::fmt;
 
-use super::query::{operator_to_value, target_operators};
-use super::{FfiValue, OpSpec, ValueFrame, ValueKind};
+use super::query::target_operators;
+use super::{OpSpec, ValueFrame, ValueKind};
 
 use crate::sem::MatchOptions;
 use crate::{KeysetCipher, Label, Pending, StackCipher};
@@ -37,7 +37,7 @@ use crate::{KeysetCipher, Label, Pending, StackCipher};
 ///
 /// # Wire format
 ///
-/// [`to_value`](Self::to_value) is the entry a guest's `se_targets` export
+/// The descriptor, serialized (it is `Serialize`), is the entry a guest's `se_targets` export
 /// lists for each type, so a generator can ask the engine it embeds which
 /// EQL types it holds. Every key is always present; an absent value is
 /// null, never a missing key.
@@ -103,6 +103,43 @@ pub struct TargetDescriptor {
     pub match_options: Option<MatchOptions>,
 }
 
+/// The descriptor in its wire form: the object a guest's `se_targets`
+/// lists, every key present (see [the type's wire format](TargetDescriptor#wire-format)).
+impl serde::Serialize for TargetDescriptor {
+    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        #[derive(serde::Serialize)]
+        struct Wire<'a> {
+            name: &'a str,
+            family: &'a str,
+            suffix: &'a str,
+            plaintext: Option<&'static str>,
+            sql_domain: &'a str,
+            indexes: &'a [String],
+            query: Option<&'a str>,
+            query_sql_domain: Option<&'a str>,
+            producible: bool,
+            reason: Option<&'a str>,
+            operators: Vec<super::OperatorEntry>,
+        }
+        serde::Serialize::serialize(
+            &Wire {
+                name: &self.name,
+                family: &self.family,
+                suffix: &self.suffix,
+                plaintext: self.plaintext.map(ValueKind::name),
+                sql_domain: &self.sql_domain,
+                indexes: &self.indexes,
+                query: self.query.as_deref(),
+                query_sql_domain: self.query_sql_domain.as_deref(),
+                producible: self.producible,
+                reason: self.reason.as_deref(),
+                operators: self.operator_entries(),
+            },
+            s,
+        )
+    }
+}
+
 impl TargetDescriptor {
     /// A descriptor with every field given. The one constructor, so a host
     /// cannot leave a wire field out.
@@ -145,42 +182,13 @@ impl TargetDescriptor {
         self
     }
 
-    /// The descriptor in its wire form: the object a guest's `se_targets`
-    /// lists, every key present (see [the type's wire format](Self#wire-format)).
-    pub fn to_value(&self) -> FfiValue {
-        let text = |s: &str| FfiValue::String(s.into());
-        let optional = |s: &Option<String>| s.as_deref().map_or(FfiValue::Null, text);
-        FfiValue::Object(vec![
-            ("name".to_string(), text(&self.name)),
-            ("family".to_string(), text(&self.family)),
-            ("suffix".to_string(), text(&self.suffix)),
-            (
-                "plaintext".to_string(),
-                self.plaintext
-                    .map_or(FfiValue::Null, |kind| text(kind.name())),
-            ),
-            ("sql_domain".to_string(), text(&self.sql_domain)),
-            (
-                "indexes".to_string(),
-                FfiValue::Array(self.indexes.iter().map(|k| text(k)).collect()),
-            ),
-            ("query".to_string(), optional(&self.query)),
-            (
-                "query_sql_domain".to_string(),
-                optional(&self.query_sql_domain),
-            ),
-            ("producible".to_string(), FfiValue::Bool(self.producible)),
-            ("reason".to_string(), optional(&self.reason)),
-            (
-                "operators".to_string(),
-                FfiValue::Array(
-                    target_operators(self)
-                        .iter()
-                        .map(|(op, index)| operator_to_value(*op, index))
-                        .collect(),
-                ),
-            ),
-        ])
+    /// The entries of [`operators`](Self::operators), each with the index
+    /// that answers it, as the wire form lists them.
+    fn operator_entries(&self) -> Vec<super::OperatorEntry> {
+        target_operators(self)
+            .iter()
+            .map(|(op, index)| super::OperatorEntry::new(*op, index))
+            .collect()
     }
 
     /// The operators the engine answers for a field that names this type,
@@ -582,6 +590,7 @@ impl fmt::Display for TargetDescriptor {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::dynamic::FfiValue;
 
     fn text_eq() -> TargetDescriptor {
         TargetDescriptor::new(
@@ -651,7 +660,7 @@ mod tests {
 
     #[test]
     fn the_wire_form_has_every_key_in_order_with_null_for_absent() {
-        let FfiValue::Object(entries) = text_eq().to_value() else {
+        let FfiValue::Object(entries) = crate::dynamic::test_frame::value_of(&text_eq()) else {
             panic!("an object");
         };
         let keys: Vec<&str> = entries.iter().map(|(k, _)| k.as_str()).collect();
@@ -681,7 +690,7 @@ mod tests {
         let mut unspecified = text_eq();
         unspecified.plaintext = None;
         unspecified.query = None;
-        let FfiValue::Object(entries) = unspecified.to_value() else {
+        let FfiValue::Object(entries) = crate::dynamic::test_frame::value_of(&unspecified) else {
             panic!("an object");
         };
         assert!(matches!(&entries[3].1, FfiValue::Null));
diff --git a/packages/stack-encrypt/src/dynamic/term.rs b/packages/stack-encrypt/src/dynamic/term.rs
index a8e80c824..1aea4a077 100644
--- a/packages/stack-encrypt/src/dynamic/term.rs
+++ b/packages/stack-encrypt/src/dynamic/term.rs
@@ -33,7 +33,7 @@
 use std::convert::Infallible;
 use std::marker::PhantomData;
 
-use super::{FfiValue, ValueFrame};
+use super::ValueFrame;
 use stack_kms::DataKeySource;
 use vitaminc_aead::plaintext::{
     Error as SinkError, Float, Int, Logical, MapSink, Physical, SeqSink, Sink, SourceError,
@@ -41,7 +41,7 @@ use vitaminc_aead::plaintext::{
 use vitaminc_normalize::{domain_of, normalize, NormalizeError};
 use zeroize::Zeroizing;
 
-use serde::Deserialize;
+use serde::{Deserialize, Serialize, Serializer};
 
 use super::{Error, Reason};
 use crate::sem::{
@@ -74,9 +74,10 @@ use crate::{Encrypt, IntoPrfContext, KeysetCipher, NonEmpty};
 /// `[32, 65536]`, a non-zero n-gram length) are refused. The other three
 /// indexes have no options and no object form.
 ///
-/// [`to_value`](Self::to_value) writes the string whenever the options are
-/// the defaults and the object, with all four options, otherwise, so a
-/// default plan is byte-for-byte what it was before options had a wire form.
+/// Serialized (it is `Serialize`), an index writes the string whenever the
+/// options are the defaults and the object, with all four options,
+/// otherwise, so a default plan is byte-for-byte what it was before options
+/// had a wire form.
 impl IndexSpec {
     /// The index a bare key names, under default options, or `None` for a
     /// string that is not an index key.
@@ -106,34 +107,6 @@ impl IndexSpec {
             .map_err(|_| Error::bad_plan(Reason::UnknownOutput))
     }
 
-    /// Write this index in its wire form (see the [type docs](Self#wire-form)):
-    /// the key, or for a match index under non-default options, the object
-    /// carrying all four of them. [`from_frame`](Self::from_frame) reads it
-    /// back to an equal index.
-    pub fn to_value(&self) -> FfiValue {
-        match self {
-            IndexSpec::Match(options) if *options != MatchOptions::default() => {
-                let tokenizer = match options.tokenizer {
-                    Tokenizer::Standard => FfiValue::String("standard".into()),
-                    Tokenizer::Ngram { length } => FfiValue::Object(vec![(
-                        "ngram".to_string(),
-                        FfiValue::UInt64(length as u64),
-                    )]),
-                };
-                FfiValue::Object(vec![(
-                    "match".to_string(),
-                    FfiValue::Object(vec![
-                        ("tokenizer".to_string(), tokenizer),
-                        ("downcase".to_string(), FfiValue::Bool(options.downcase)),
-                        ("k".to_string(), FfiValue::UInt64(options.k as u64)),
-                        ("m".to_string(), FfiValue::UInt64(u64::from(options.m))),
-                    ]),
-                )])
-            }
-            _ => FfiValue::String(self.key().into()),
-        }
-    }
-
     /// Whether the scheme defines this index's term for `value`: whether it
     /// is one scalar the index takes. Equality takes every scalar vitaminc
     /// gives an equality domain (an integer, a float, text, bytes, and a
@@ -194,6 +167,53 @@ fn ordered(value: &Physical<'_>) -> bool {
     }
 }
 
+/// An index in its wire form: its key, or for a match index under options
+/// other than the defaults, a one-entry object mapping `"match"` to all four
+/// of them (see [`IndexSpec`'s docs](IndexSpec#wire-form)).
+impl Serialize for IndexSpec {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        #[derive(Serialize)]
+        #[serde(rename_all = "lowercase")]
+        enum Out {
+            Eq,
+            #[serde(rename = "match")]
+            DefaultMatch,
+            Match(MatchOut),
+            Ore,
+            Ope,
+        }
+        #[derive(Serialize)]
+        struct MatchOut {
+            tokenizer: TokenizerOut,
+            downcase: bool,
+            k: u64,
+            m: u64,
+        }
+        #[derive(Serialize)]
+        #[serde(rename_all = "lowercase")]
+        enum TokenizerOut {
+            Standard,
+            Ngram(u64),
+        }
+        match self {
+            IndexSpec::Equality => Out::Eq,
+            IndexSpec::Match(options) if *options == MatchOptions::default() => Out::DefaultMatch,
+            IndexSpec::Match(options) => Out::Match(MatchOut {
+                tokenizer: match options.tokenizer {
+                    Tokenizer::Standard => TokenizerOut::Standard,
+                    Tokenizer::Ngram { length } => TokenizerOut::Ngram(length as u64),
+                },
+                downcase: options.downcase,
+                k: options.k as u64,
+                m: u64::from(options.m),
+            }),
+            IndexSpec::Ore => Out::Ore,
+            IndexSpec::Ope => Out::Ope,
+        }
+        .serialize(s)
+    }
+}
+
 /// An index in its wire form, as serde reads it from a frame (see
 /// [`IndexSpec`'s docs](IndexSpec#wire-form)): a key, or for a match index a
 /// one-entry object mapping `"match"` to its options. A bare `"match"`, and
@@ -739,6 +759,7 @@ impl Index<ValueFrame> for IndexSpec {
 mod tests {
     use super::*;
     use crate::dynamic::utf8;
+    use crate::dynamic::FfiValue;
     use crate::dynamic::{context, Output};
     use crate::sem::TermError;
     use crate::{nonempty, StackCipher};
@@ -1463,7 +1484,7 @@ mod tests {
                 IndexSpec::Ore,
                 IndexSpec::Ope,
             ] {
-                let wire = spec.to_value();
+                let wire = crate::dynamic::test_frame::value_of(&spec);
                 assert!(
                     matches!(&wire, FfiValue::String(k) if utf8(k) == Some(spec.key())),
                     "{spec} writes as its bare key"
@@ -1509,7 +1530,7 @@ mod tests {
             ];
             for options in cases {
                 let spec = IndexSpec::Match(options.clone());
-                let wire = spec.to_value();
+                let wire = crate::dynamic::test_frame::value_of(&spec);
                 assert!(
                     matches!(&wire, FfiValue::Object(_)),
                     "{options:?} is not the default, so it writes as an object"
@@ -1696,6 +1717,7 @@ mod tests {
 #[cfg(test)]
 mod wire_form {
     use super::*;
+    use crate::dynamic::FfiValue;
 
     fn index_of(value: &FfiValue) -> Result<IndexSpec, Error> {
         IndexSpec::from_frame(&crate::dynamic::test_frame::frame_of(value))
@@ -1727,7 +1749,7 @@ mod wire_form {
         ];
         for spec in specs {
             assert_eq!(
-                index_of(&spec.to_value()).expect("reads back"),
+                index_of(&crate::dynamic::test_frame::value_of(&spec)).expect("reads back"),
                 spec,
                 "{spec:?} survives the data form"
             );
@@ -1738,7 +1760,7 @@ mod wire_form {
     fn a_default_match_index_is_the_bare_match_key() {
         let spec = Index::<String>::spec(&Match);
         assert!(matches!(
-            spec.to_value(),
+            crate::dynamic::test_frame::value_of(&spec),
             FfiValue::String(key) if crate::dynamic::utf8(&key) == Some("match")
         ));
     }
@@ -1748,7 +1770,10 @@ mod wire_form {
         let spec = Index::<String>::spec(&Match::<Words>::new());
         assert_eq!(spec, IndexSpec::Match(Words::options()));
         assert!(
-            matches!(spec.to_value(), FfiValue::Object(_)),
+            matches!(
+                crate::dynamic::test_frame::value_of(&spec),
+                FfiValue::Object(_)
+            ),
             "non-default options are written, not dropped"
         );
     }
diff --git a/packages/stack-encrypt/src/dynamic/test_frame.rs b/packages/stack-encrypt/src/dynamic/test_frame.rs
index 283691cf7..2aa266e72 100644
--- a/packages/stack-encrypt/src/dynamic/test_frame.rs
+++ b/packages/stack-encrypt/src/dynamic/test_frame.rs
@@ -6,6 +6,13 @@ use vitaminc_protected::Controlled;
 
 use super::FfiValue;
 
+/// What a binding reads back from an answer the engine writes: its frame,
+/// decoded.
+pub(crate) fn value_of<T: serde::Serialize>(answer: &T) -> FfiValue {
+    let frame = vitaminc_aead_frame::serde::to_vec(answer).expect("frames");
+    FfiValue::from_frame(&frame).expect("a value")
+}
+
 /// The frame bytes of `value`.
 pub(crate) fn frame_of(value: &FfiValue) -> Vec<u8> {
     let mut out = Vec::new();