diff --git a/Cargo.lock b/Cargo.lock
index e14762064..e69dd133d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -556,16 +556,16 @@ dependencies = [
 
 [[package]]
 name = "clww-ore"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b95747f5724666cb973b2ca0659e10b6083c11f99877c4727b4c9f534a591c74"
+checksum = "9527fcb65fbebc5a8f8987063c171bb37bb37fb628de1293e07c1b6e0a21a24f"
 dependencies = [
  "blake3",
  "hex",
  "subtle",
  "thiserror 1.0.69",
  "vitaminc-ore",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -1519,7 +1519,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.5",
  "tokio",
  "tower-service",
  "tracing",
@@ -2299,9 +2299,9 @@ checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "ore-rs"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bd65962ec1409c09d20e1e016f4fe1b4ae2e2e58dba38c155538b2c0801a185"
+checksum = "b274b7a0bf081d51815ccc7b20fa3b023e5769e3446fe4de1e8e8044a4413201"
 dependencies = [
  "aes",
  "block-modes",
@@ -2311,12 +2311,12 @@ dependencies = [
  "rand 0.10.1",
  "subtle-ng",
  "thiserror 1.0.69",
- "vitaminc-context 0.8.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-hmac",
  "vitaminc-ore",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -2542,7 +2542,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.5",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -2581,7 +2581,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.5",
  "tracing",
  "windows-sys 0.52.0",
 ]
@@ -3361,8 +3361,8 @@ dependencies = [
  "tracing-subscriber",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -3384,7 +3384,7 @@ dependencies = [
  "tempfile",
  "tokio",
  "url",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -3433,15 +3433,15 @@ dependencies = [
  "tokio",
  "trybuild",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-aead 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-aead 0.9.0",
  "vitaminc-aead-frame",
- "vitaminc-encrypt 0.8.0",
+ "vitaminc-encrypt 0.9.0",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-ore",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -3467,9 +3467,9 @@ dependencies = [
  "proptest",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.8.0",
+ "vitaminc-aead 0.9.0",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -3502,8 +3502,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -4265,16 +4265,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea37168a603d605732d0bf0672586139ab91736f767d7b85e173c84dcee19054"
+checksum = "e7aa53d696a9e1af61b36a60b92cc0dde7421f8f58787333d3c425a176af241c"
 dependencies = [
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-encrypt 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
- "vitaminc-traits 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-encrypt 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
+ "vitaminc-traits 0.9.0",
 ]
 
 [[package]]
@@ -4294,9 +4294,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9bb97fd543ee6a2b168e257ec69d0d274a775b1eaa3f856b5ac2941b01891c1"
+checksum = "efba1dac1efc04ffc09cba49e343e0fe656c88c32472a4206f2a6df284add33d"
 dependencies = [
  "bytes",
  "chrono",
@@ -4304,10 +4304,10 @@ dependencies = [
  "rust_decimal",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-aead-derive 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead-derive 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -4324,9 +4324,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0845a44c07ddc882ed47a0e92e04fc83496220f054b589ad0cbd215c5009e5b7"
+checksum = "a3c6575dac7701e578b375d16a0b693294d73847ed275c9b9962cf20c423ea10"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4335,13 +4335,13 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0299777255171712a296d59164691dc1e93d10bddaab6e248fede1790dfd2e"
+checksum = "ba4a3e8a2057ce32724b0d42f71e87ee348d13c818fc54a16c443b86c4fe8d9a"
 dependencies = [
  "serde",
- "vitaminc-aead 0.8.0",
- "zeroize",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -4356,12 +4356,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a630079ba2d50680ee5048addd430eda30613559809dd6d383551e6d3d299826"
+checksum = "5b407b3127be198a8da7d4d914c11215e1eae1b467cdf89eca8a7a296055e863"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -4380,72 +4380,72 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db45e073f92ae8ca27f8fe14270bc34c75e767559c2347098dacca95180d1ddd"
+checksum = "7fa0a3493624afd1490085448d6d09d22bf061954e9ab0db08837f423db3a58d"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5fa0ae8bbad85ae30fb5c91b0b72b694d59bf2c2c1e7ad799eda66fdbd67e7c"
+checksum = "ada61349172294efe0a71bf2af367969b4e196437b46c20c688aaf15f692bc2d"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5a2d8875e0b8b35b7a4f9dd698bbd13c989837cea564b5a4cbb5371b78fa937"
+checksum = "f1d354f4ee3764be072eb02f4f8db79ed0ed467a7c6d9f2c6143823867bde347"
 dependencies = [
  "thiserror 2.0.18",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
 name = "vitaminc-ore"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05518b4d35cb0c592dad59afb11b8e883ea252449b9ae47ff5ddeff0ed49f75"
+checksum = "9a812b8e245352094c3c2113312cf86d0804b83f1e315bacd15571cd01703c8b"
 dependencies = [
  "thiserror 2.0.18",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-normalize",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916688478273ca3e5c6805b355534ce9263688391cd4ab23b08bef760039d325"
+checksum = "d1703452d837ef964ec1f20cc601265857245d72ac14426276d49c3106dd39b3"
 dependencies = [
  "mutants",
  "thiserror 2.0.18",
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-normalize",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -4467,9 +4467,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6edc22562a9bbff0ba9704a2c43670b2c7cb1637524c045c3ba6436ed00917f"
+checksum = "67a44502e43de42fbd95c12a35efbaea903eedcc7a3922fceacea93054f44485"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -4478,7 +4478,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.18",
- "vitaminc-protected-derive 0.8.0",
+ "vitaminc-protected-derive 0.9.1",
  "zeroize",
 ]
 
@@ -4495,9 +4495,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cce3a7d0ce6f57c0e82345f20e87f3737cccd3a70aec2a2ab49f68a3a5e24a"
+checksum = "f4315341c559af17bd773e8b4e32125a2025d7fbe3e31cbae49120ee1dcab02e"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -4522,16 +4522,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb253f783ce6f31a55a92f5a9f0526109b8caa6a465edb94244fd344a078c11"
+checksum = "71e32850b739b58a7064b50eb3db655de323f57f21c1fe74d5ccd4d308560563"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.18",
- "vitaminc-protected 0.8.0",
- "vitaminc-random-derives 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random-derives 0.9.0",
  "zeroize",
 ]
 
@@ -4548,9 +4548,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0b3615936d6dded4b775856f4b0fa229d745d183f0b3754ac80035f16c27d9"
+checksum = "1863fe02de3945047dc9094d3cadbde06becafa49aa95d5e475bf903c8d83981"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4575,17 +4575,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9098ee4b13446ef959583ee2f3c384df571b453179104f7b4960ffddf65ee9"
+checksum = "a715ef503b1b41801a6c23e9756ed3d5a1201fa632609bccfa2a7a41ab5386cf"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -4843,7 +4843,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index d3234daee..7dec61963 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -82,15 +82,15 @@ cts-common = { version = "0.43.0", default-features = false }
 zerokms-protocol = "0.12.31"
 recipher = "=0.3.1"
 # The two order-preserving schemes Stack Encrypt's order terms encrypt
-# through. Both implement vitaminc-ore's `OrderScheme` against vitaminc 0.8:
+# through. Both implement vitaminc-ore's `OrderScheme` against vitaminc 0.9:
 # `clww-ore` (cllw-ore renamed) for CLWW ORE and OPE, and ore-rs's
 # `BlockOre` for block ORE, which routes a value to its 6-bit fixed-width
 # engine (up to ten bytes) or its chained one (wider, or variable length),
 # the terms EQL v4's `_ord_ore` domains store.
 # vitaminc is a plain dependency of both from here, not a feature. Both are
 # pinned exactly: a new release can change every stored order term.
-clww-ore = { version = "=0.6.0", default-features = false }
-ore-rs = { version = "=0.10.0", default-features = false }
+clww-ore = { version = "=0.7.0", default-features = false }
+ore-rs = { version = "=0.11.0", default-features = false }
 
 # External dependencies, with the suite's feature lists.
 base64 = "0.22.0"
@@ -139,18 +139,18 @@ web-time = "1.1"
 zeroize = { version = "1.8.1", features = ["derive"] }
 # This is needed because lock_api 0.4.6 was breaking things and the branch forces the use of 0.4.12
 temp-env = { git = "https://github.com/cipherstash/temp-env", branch = "main" }
-vitaminc = { version = "0.8.0", features = ["random", "protected", "encrypt"] }
-vitaminc-aead = "0.8.0"
+vitaminc = { version = "0.9.0", features = ["random", "protected", "encrypt"] }
+vitaminc-aead = "0.9.0"
 # The transport frame and ciphertext codec every language binding carries
 # across its FFI boundary. Optional in stack-encrypt (the `dynamic` feature).
-vitaminc-aead-frame = "0.8.0"
-vitaminc-encrypt = "0.8.0"
-vitaminc-hmac = "0.8.0"
+vitaminc-aead-frame = "0.9.0"
+vitaminc-encrypt = "0.9.0"
+vitaminc-hmac = "0.9.0"
 # Normalized equality terms (Unicode 16 NFC text, one integer encoding for
 # every width), which `vitaminc-prf`'s `normalize` feature derives over.
-vitaminc-normalize = "0.8.0"
+vitaminc-normalize = "0.9.0"
 # The text order key: the system ADR-0002's fold, pinned to Unicode 16,
 # which text ORE and OPE terms are derived over (ADR-0009).
-vitaminc-ore = "0.8.0"
-vitaminc-prf = { version = "0.8.0", features = ["normalize"] }
-vitaminc-protected = "0.8.0"
+vitaminc-ore = "0.9.0"
+vitaminc-prf = { version = "0.9.0", features = ["normalize"] }
+vitaminc-protected = "0.9.1"
diff --git a/conformance/stack-encrypt/coverage.md b/conformance/stack-encrypt/coverage.md
index 39b356b78..ce3f4c4f4 100644
--- a/conformance/stack-encrypt/coverage.md
+++ b/conformance/stack-encrypt/coverage.md
@@ -129,6 +129,18 @@ The [lifecycle contract](lifecycle-contract.md) enrolls native pending/KMS tests
 heap observations, guest ABI cleanup, Go cancellation/memory tests and public SDK
 diagnostics. New probes cover unpolled and in-flight drops, provider failure,
 cleanup after a late authenticated type failure, and chunk concurrency/drop.
+The owned `Vec<S>` to `Vec<T>` conversion is enrolled under the same
+requirements. The conversion's tests cover:
+
+- dropping a collection before it is polled
+- dropping a collection while its key request is running
+- one logical batch of key requests for each collection, and none for an
+  empty collection
+- wiping the source `Vec` through its guard
+- wiping the elements already decrypted, when a later element fails
+
+The owned conversion is a native Rust API. Go reaches batching through its
+record interface, and the runtime profile covers that interface.
 Existing runtime/read/context vectors retain their provider-call counters.
 
 This adds required execution and explicit observation limits; it removes no
diff --git a/conformance/stack-encrypt/lifecycle-contract.md b/conformance/stack-encrypt/lifecycle-contract.md
index 2cf10ab12..7186846f7 100644
--- a/conformance/stack-encrypt/lifecycle-contract.md
+++ b/conformance/stack-encrypt/lifecycle-contract.md
@@ -10,13 +10,13 @@ process. Python and TypeScript are explicitly not enrolled.
 
 | Requirement | Native evidence | Go evidence and limits |
 |---|---|---|
-| `lifecycle-ownership-v1` | Actual record operations release fulfilment captures exactly once on success, provider failure and unpolled drop; an unpolled encrypt or decrypt makes no key request. Zipped fulfilments do not share key material. | Client keys are consumed/redacted; explicit close and unreachable-client cleanup release guest memory; calls on a closed client fail. GC cleanup is eventual, so callers should close explicitly. |
-| `lifecycle-cancellation-v1` | Dropping an encrypt future paused in key generation, or a decrypt future paused in key retrieval, drops the provider future and operation captures; subsequent work on the cipher succeeds. Guest ABI abort spends the handle and drops the operation. | Cancellation before a call sends no request; cancellation between steps or during token fetch leaves unrelated operations usable. A guest step that overruns cancellation closes the client. Discarded late output is wiped. |
-| `lifecycle-partial-output-v1` | A batch with a valid first row and a later authenticated type mismatch releases its decoded prefix without marked heap residue. Existing context cases reject late authentication failures without returning partial output. | Generated and raw batch APIs return no partial rows on failure; interrupted HTTP bodies fail; cancelled output is wiped. SDK conversion diagnostics contain no decrypted values. This does not assert erasure of partially populated caller-owned Go objects. |
-| `lifecycle-buffer-cleanup-v1` | The existing allocator observer checks selected write/read/JSON parse paths and has a negative control. Guest ABI tests check buffer-registry cleanup, error-buffer release and protected text drop. | Request bodies survive until their owner closes them, then wipe; refused requests wipe; heap growth wipes abandoned backing arrays; guest runtime close releases memory. Post-encryption memory scans are supplementary observations. |
+| `lifecycle-ownership-v1` | Actual record operations and owned `Vec<S>` to `Vec<T>` conversions release fulfilment captures exactly once on success, provider failure and unpolled drop; an unpolled encrypt or decrypt makes no key request. Zipped fulfilments do not share key material. | Client keys are consumed/redacted; explicit close and unreachable-client cleanup release guest memory; calls on a closed client fail. GC cleanup is eventual, so callers should close explicitly. |
+| `lifecycle-cancellation-v1` | Dropping an encrypt future paused in key generation, or a decrypt future paused in key retrieval, drops the provider future and operation captures, for a record operation or an owned collection; subsequent work on the cipher succeeds. Guest ABI abort spends the handle and drops the operation. | Cancellation before a call sends no request; cancellation between steps or during token fetch leaves unrelated operations usable. A guest step that overruns cancellation closes the client. Discarded late output is wiped. |
+| `lifecycle-partial-output-v1` | A batch with a valid first row and a later authenticated type mismatch releases its decoded prefix without marked heap residue. Tests check this for the dynamic record path and for the owned `Vec<Ciphertext>` to `Vec<String>` conversion. For owned collections, drop witnesses are test values that record whether they were wiped. They show that the prefix is wiped, not leaked, after a late failure or an element's panic. Existing context cases reject late authentication failures without returning partial output. | Generated and raw batch APIs return no partial rows on failure; interrupted HTTP bodies fail; cancelled output is wiped. SDK conversion diagnostics contain no decrypted values. This does not assert erasure of partially populated caller-owned Go objects. |
+| `lifecycle-buffer-cleanup-v1` | The existing allocator observer checks selected write/read/JSON parse paths and has a negative control. One of those paths encrypts an owned `Vec<String>` collection through its guard. Drop witnesses show that an owned collection's source is wiped before its pending request is returned. That includes a refused context, and a context conversion that panics. Guest ABI tests check buffer-registry cleanup, error-buffer release and protected text drop. | Request bodies survive until their owner closes them, then wipe; refused requests wipe; heap growth wipes abandoned backing arrays; guest runtime close releases memory. Post-encryption memory scans are supplementary observations. |
 | `lifecycle-diagnostics-v1` | Guest errors discard untrusted foreign cause messages; failed/successful exports do not hand over stale diagnostics. | Structured errors remain available after failures; SDK errors and redacted display/logging expose types or fields rather than plaintext values. |
 | `lifecycle-validation-before-io-v1` | Existing runtime/read/context cases count provider calls. Wrong shape, independently detectable context mismatch and oversized descriptors fail before key I/O; lazy assembly stops after local failure. | Host refusals happen before entering the guest, and shared runtime/read cases exercise the uninitialised guest's preflight boundary. Go does not yet expose native provider counters. |
-| `lifecycle-logical-batching-v1` | Instrumented `DataKeySource` calls establish one logical generation batch, retrieval grouping by keyset, descriptor ordering and no work for empty batches. | Go uses the same engine, but this profile does not claim independently instrumented Go key-request counts. |
+| `lifecycle-logical-batching-v1` | Instrumented `DataKeySource` calls establish one logical generation batch, retrieval grouping by keyset, descriptor ordering and no work for empty batches, for record operations and for an owned `Vec<S>` collection of any length, including an empty one. | Go uses the same engine, but this profile does not claim independently instrumented Go key-request counts. |
 | `lifecycle-provider-chunks-v1` | The actual KMS chunking helper preserves order, handles a final short chunk, fails the whole call on a chunk error, bounds in-flight chunks and releases their futures on cancellation. | This is a native algorithm observation, not a measurement of live HTTP request counts. |
 
 The drop witnesses belong to fulfilment closures and provider futures in real
@@ -59,7 +59,12 @@ These entries in the index are limitations, not successful requirements:
   sealing frame by backtrace and reports excluded frees. It scrubs stack residue
   before observing heap frees; it does not prove stack erasure. Its JSON query
   paths use borrowed/static path text because owned path copies have separate
-  cleanup limitations. The lifecycle runner preserves the observer's output.
+  cleanup limitations. The observer only scans blocks that are freed, so it
+  misses plaintext that is leaked and never freed. For the owned `Vec<S>`
+  conversion, the drop witnesses in `packages/stack-encrypt/tests/collections.rs`
+  record the wipe itself. A test there fails if a source or a decrypted prefix
+  is leaked. The lifecycle
+  runner preserves the observer's output.
 - **`caller-owned-host-values` — outside the guarantee.** Caller-owned strings,
   bytes, objects, returned plaintext, aliases and copies remain the caller's
   responsibility. Ownership transfer or protected borrowing must be stated by
diff --git a/conformance/stack-encrypt/v1/lifecycle-v1.enrollment.json b/conformance/stack-encrypt/v1/lifecycle-v1.enrollment.json
index 12b35f883..b9a0e39d6 100644
--- a/conformance/stack-encrypt/v1/lifecycle-v1.enrollment.json
+++ b/conformance/stack-encrypt/v1/lifecycle-v1.enrollment.json
@@ -27,6 +27,14 @@
       "binary": "heap_hygiene",
       "success_output": "immediate"
     },
+    "collections": {
+      "language": "rust",
+      "lane": "fast",
+      "workspace": ".",
+      "package": "stack-encrypt",
+      "features": ["--all-features"],
+      "binary": "collections"
+    },
     "runtime": {
       "language": "rust",
       "lane": "fast",
@@ -90,7 +98,9 @@
         "lifecycle": [
           "dropping_unpolled_work_releases_captures_without_key_io",
           "dropping_unpolled_decrypt_releases_captures_without_key_io",
-          "success_and_provider_failure_release_captures_once"
+          "success_and_provider_failure_release_captures_once",
+          "dropping_an_unpolled_owned_column_releases_captures_without_key_io",
+          "an_owned_column_is_one_logical_batch_and_releases_captures_once"
         ],
         "pending": [
           "target::pending::tests::zipped_fulfilments_never_share_key_material"
@@ -108,7 +118,8 @@
       "evidence": {
         "lifecycle": [
           "cancelling_in_flight_work_drops_provider_and_captures",
-          "cancelling_in_flight_decrypt_drops_provider_and_captures"
+          "cancelling_in_flight_decrypt_drops_provider_and_captures",
+          "cancelling_an_owned_column_in_flight_drops_provider_and_captures"
         ],
         "guest-abi": [
           "step::tests::an_aborted_operation_is_dropped_and_its_handle_spent",
@@ -127,7 +138,14 @@
     {
       "id": "lifecycle-partial-output-v1",
       "evidence": {
-        "heap": ["a_late_read_type_failure_leaves_no_plaintext_on_the_heap"],
+        "heap": [
+          "a_late_read_type_failure_leaves_no_plaintext_on_the_heap",
+          "a_late_type_failure_in_an_owned_column_leaves_no_plaintext_on_the_heap"
+        ],
+        "collections": [
+          "a_late_element_failure_wipes_the_plaintext_recovered_before_it",
+          "a_panicking_element_conversion_wipes_the_plaintext_recovered_before_it"
+        ],
         "contexts": ["shared_context_boundaries"],
         "go": [
           "TestContextBoundaries",
@@ -142,10 +160,16 @@
       "evidence": {
         "heap": [
           "a_record_encrypted_from_a_value_frame_leaves_no_plaintext_on_the_heap",
+          "an_owned_column_encrypted_leaves_no_plaintext_on_the_heap",
           "a_record_decrypted_with_a_nested_field_leaves_no_plaintext_on_the_heap",
           "a_json_document_read_from_a_frame_leaves_no_plaintext_on_the_heap",
           "the_spy_sees_an_unwiped_free"
         ],
+        "collections": [
+          "owned_elements_are_wiped_before_the_pending_is_returned",
+          "owned_elements_are_wiped_when_the_context_is_refused",
+          "owned_elements_are_guarded_during_context_conversion"
+        ],
         "guest-abi": [
           "buffers::tests::wipe_all_leaves_no_live_buffer",
           "last_error::tests::clearing_wipes_and_frees_the_registered_buffer",
@@ -205,6 +229,10 @@
       "id": "lifecycle-logical-batching-v1",
       "evidence": {
         "runtime": ["shared_record_runtime_profile"],
+        "lifecycle": [
+          "an_owned_column_is_one_logical_batch_and_releases_captures_once",
+          "an_empty_owned_column_makes_no_provider_call"
+        ],
         "pending": [
           "target::pending::tests::one_pending_asking_for_many_keys_is_one_call",
           "target::pending::tests::all_merges_a_column_into_one_call_preserving_order",
diff --git a/languages/golang/auth/guest/Cargo.lock b/languages/golang/auth/guest/Cargo.lock
index 95eb9372e..b8bc8eb21 100644
--- a/languages/golang/auth/guest/Cargo.lock
+++ b/languages/golang/auth/guest/Cargo.lock
@@ -633,7 +633,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1613,7 +1613,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1807,8 +1807,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.1",
+ "vitaminc-protected 0.9.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -1828,7 +1828,7 @@ dependencies = [
  "tempfile",
  "tokio",
  "url",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -1839,9 +1839,9 @@ dependencies = [
  "miette",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.8.0",
+ "vitaminc-aead 0.9.1",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -1925,7 +1925,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.5",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2260,16 +2260,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea37168a603d605732d0bf0672586139ab91736f767d7b85e173c84dcee19054"
+checksum = "f849264db2d0cc82e8e17e2c4172368d4627d0d383087415a99f9b6299252f11"
 dependencies = [
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-encrypt 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
- "vitaminc-traits 0.8.0",
+ "vitaminc-aead 0.9.1",
+ "vitaminc-context 0.9.1",
+ "vitaminc-encrypt 0.9.1",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.1",
+ "vitaminc-traits 0.9.1",
 ]
 
 [[package]]
@@ -2289,18 +2289,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9bb97fd543ee6a2b168e257ec69d0d274a775b1eaa3f856b5ac2941b01891c1"
+checksum = "56725963f5e40788904814a648ad32e2a8697c9ff870699eff8d843fd4c0ee31"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead-derive 0.9.1",
+ "vitaminc-context 0.9.1",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.1",
  "zeroize",
 ]
 
@@ -2317,9 +2317,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0845a44c07ddc882ed47a0e92e04fc83496220f054b589ad0cbd215c5009e5b7"
+checksum = "106cba4ea0ea260d150ef3a2905b908cac8e3aebbf484d290371c3bd48cb3943"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2328,11 +2328,11 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0299777255171712a296d59164691dc1e93d10bddaab6e248fede1790dfd2e"
+checksum = "5f0ee8c7746c0fd8a6efad989b0248646d32f9ce8e45c9631f8c56b760983cd8"
 dependencies = [
- "vitaminc-aead 0.8.0",
+ "vitaminc-aead 0.9.1",
 ]
 
 [[package]]
@@ -2347,12 +2347,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a630079ba2d50680ee5048addd430eda30613559809dd6d383551e6d3d299826"
+checksum = "366b12603130fe196b300d372b49196f1314a5ba94ab67e63fd0130fc319768b"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2371,15 +2371,15 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db45e073f92ae8ca27f8fe14270bc34c75e767559c2347098dacca95180d1ddd"
+checksum = "a95db3fd733fc76ee11401604d5673782a3d2f5a047b3a3f49d56ca90b027d0e"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead 0.9.1",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.1",
  "zeroize",
 ]
 
@@ -2402,9 +2402,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6edc22562a9bbff0ba9704a2c43670b2c7cb1637524c045c3ba6436ed00917f"
+checksum = "67a44502e43de42fbd95c12a35efbaea903eedcc7a3922fceacea93054f44485"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2413,7 +2413,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.8.0",
+ "vitaminc-protected-derive 0.9.1",
  "zeroize",
 ]
 
@@ -2430,9 +2430,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cce3a7d0ce6f57c0e82345f20e87f3737cccd3a70aec2a2ab49f68a3a5e24a"
+checksum = "f4315341c559af17bd773e8b4e32125a2025d7fbe3e31cbae49120ee1dcab02e"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2457,16 +2457,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb253f783ce6f31a55a92f5a9f0526109b8caa6a465edb94244fd344a078c11"
+checksum = "7d08020da35051b10daddaa0f85fbb15f084723dfc4abce8c080bda24867a5a0"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
  "rand 0.10.3",
  "thiserror 2.0.20",
- "vitaminc-protected 0.8.0",
- "vitaminc-random-derives 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random-derives 0.9.1",
  "zeroize",
 ]
 
@@ -2483,9 +2483,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0b3615936d6dded4b775856f4b0fa229d745d183f0b3754ac80035f16c27d9"
+checksum = "76e17e2cfead782db61ef778257853c7c5ff27ad1aee5f323b6461d9d166ee82"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2510,17 +2510,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9098ee4b13446ef959583ee2f3c384df571b453179104f7b4960ffddf65ee9"
+checksum = "bf1a88df9b1a6530127462338ea47a1b65b8879f8ac9123ea5b7aa5ba1c5c9fd"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.1",
  "zeroize",
 ]
 
diff --git a/languages/golang/auth/guest/Cargo.toml b/languages/golang/auth/guest/Cargo.toml
index e3fd3cca4..4db8c3855 100644
--- a/languages/golang/auth/guest/Cargo.toml
+++ b/languages/golang/auth/guest/Cargo.toml
@@ -50,7 +50,7 @@ tempfile = "3"
 # Native stack-auth refreshes run in a Tokio task, including with a mock transport.
 tokio = { version = "1.47.1", default-features = false, features = ["macros", "rt"] }
 # `Controlled::risky_ref`, to read a codec value back in the tests.
-vitaminc-protected = "0.8.0"
+vitaminc-protected = "0.9.1"
 
 [profile.release]
 # Smaller .wasm; the guest is IO-bound on the FFI copy and the file reads,
diff --git a/languages/golang/encrypt/guest/Cargo.lock b/languages/golang/encrypt/guest/Cargo.lock
index 81cbcb3c3..9c2cc2d59 100644
--- a/languages/golang/encrypt/guest/Cargo.lock
+++ b/languages/golang/encrypt/guest/Cargo.lock
@@ -357,16 +357,16 @@ dependencies = [
 
 [[package]]
 name = "clww-ore"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b95747f5724666cb973b2ca0659e10b6083c11f99877c4727b4c9f534a591c74"
+checksum = "9527fcb65fbebc5a8f8987063c171bb37bb37fb628de1293e07c1b6e0a21a24f"
 dependencies = [
  "blake3",
  "hex",
  "subtle",
  "thiserror 1.0.69",
  "vitaminc-ore",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -752,7 +752,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1458,9 +1458,9 @@ dependencies = [
 
 [[package]]
 name = "ore-rs"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bd65962ec1409c09d20e1e016f4fe1b4ae2e2e58dba38c155538b2c0801a185"
+checksum = "b274b7a0bf081d51815ccc7b20fa3b023e5769e3446fe4de1e8e8044a4413201"
 dependencies = [
  "aes",
  "block-modes",
@@ -1470,12 +1470,12 @@ dependencies = [
  "rand 0.10.2",
  "subtle-ng",
  "thiserror 1.0.69",
- "vitaminc-context 0.8.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-hmac",
  "vitaminc-ore",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -2110,8 +2110,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -2136,15 +2136,15 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-aead 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-aead 0.9.0",
  "vitaminc-aead-frame",
- "vitaminc-encrypt 0.8.0",
+ "vitaminc-encrypt 0.9.0",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-ore",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -2184,9 +2184,9 @@ dependencies = [
  "miette",
  "serde_json",
  "thiserror 1.0.69",
- "vitaminc-aead 0.8.0",
+ "vitaminc-aead 0.9.0",
  "vitaminc-aead-frame",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -2212,8 +2212,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2688,16 +2688,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea37168a603d605732d0bf0672586139ab91736f767d7b85e173c84dcee19054"
+checksum = "e7aa53d696a9e1af61b36a60b92cc0dde7421f8f58787333d3c425a176af241c"
 dependencies = [
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-encrypt 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
- "vitaminc-traits 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-encrypt 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
+ "vitaminc-traits 0.9.0",
 ]
 
 [[package]]
@@ -2717,18 +2717,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9bb97fd543ee6a2b168e257ec69d0d274a775b1eaa3f856b5ac2941b01891c1"
+checksum = "efba1dac1efc04ffc09cba49e343e0fe656c88c32472a4206f2a6df284add33d"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead-derive 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -2745,9 +2745,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0845a44c07ddc882ed47a0e92e04fc83496220f054b589ad0cbd215c5009e5b7"
+checksum = "a3c6575dac7701e578b375d16a0b693294d73847ed275c9b9962cf20c423ea10"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2756,13 +2756,13 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0299777255171712a296d59164691dc1e93d10bddaab6e248fede1790dfd2e"
+checksum = "ba4a3e8a2057ce32724b0d42f71e87ee348d13c818fc54a16c443b86c4fe8d9a"
 dependencies = [
  "serde",
- "vitaminc-aead 0.8.0",
- "zeroize",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2777,12 +2777,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a630079ba2d50680ee5048addd430eda30613559809dd6d383551e6d3d299826"
+checksum = "5b407b3127be198a8da7d4d914c11215e1eae1b467cdf89eca8a7a296055e863"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2801,72 +2801,72 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db45e073f92ae8ca27f8fe14270bc34c75e767559c2347098dacca95180d1ddd"
+checksum = "7fa0a3493624afd1490085448d6d09d22bf061954e9ab0db08837f423db3a58d"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5fa0ae8bbad85ae30fb5c91b0b72b694d59bf2c2c1e7ad799eda66fdbd67e7c"
+checksum = "ada61349172294efe0a71bf2af367969b4e196437b46c20c688aaf15f692bc2d"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5a2d8875e0b8b35b7a4f9dd698bbd13c989837cea564b5a4cbb5371b78fa937"
+checksum = "f1d354f4ee3764be072eb02f4f8db79ed0ed467a7c6d9f2c6143823867bde347"
 dependencies = [
  "thiserror 2.0.20",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
 name = "vitaminc-ore"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05518b4d35cb0c592dad59afb11b8e883ea252449b9ae47ff5ddeff0ed49f75"
+checksum = "9a812b8e245352094c3c2113312cf86d0804b83f1e315bacd15571cd01703c8b"
 dependencies = [
  "thiserror 2.0.20",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-normalize",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916688478273ca3e5c6805b355534ce9263688391cd4ab23b08bef760039d325"
+checksum = "d1703452d837ef964ec1f20cc601265857245d72ac14426276d49c3106dd39b3"
 dependencies = [
  "mutants",
  "thiserror 2.0.20",
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-normalize",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2888,9 +2888,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6edc22562a9bbff0ba9704a2c43670b2c7cb1637524c045c3ba6436ed00917f"
+checksum = "67a44502e43de42fbd95c12a35efbaea903eedcc7a3922fceacea93054f44485"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2899,7 +2899,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.8.0",
+ "vitaminc-protected-derive 0.9.1",
  "zeroize",
 ]
 
@@ -2916,9 +2916,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cce3a7d0ce6f57c0e82345f20e87f3737cccd3a70aec2a2ab49f68a3a5e24a"
+checksum = "f4315341c559af17bd773e8b4e32125a2025d7fbe3e31cbae49120ee1dcab02e"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2943,16 +2943,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb253f783ce6f31a55a92f5a9f0526109b8caa6a465edb94244fd344a078c11"
+checksum = "71e32850b739b58a7064b50eb3db655de323f57f21c1fe74d5ccd4d308560563"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
  "rand 0.10.2",
  "thiserror 2.0.20",
- "vitaminc-protected 0.8.0",
- "vitaminc-random-derives 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random-derives 0.9.0",
  "zeroize",
 ]
 
@@ -2969,9 +2969,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0b3615936d6dded4b775856f4b0fa229d745d183f0b3754ac80035f16c27d9"
+checksum = "1863fe02de3945047dc9094d3cadbde06becafa49aa95d5e475bf903c8d83981"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2996,17 +2996,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9098ee4b13446ef959583ee2f3c384df571b453179104f7b4960ffddf65ee9"
+checksum = "a715ef503b1b41801a6c23e9756ed3d5a1201fa632609bccfa2a7a41ab5386cf"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -3093,7 +3093,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/languages/golang/encrypt/guest/src/abi.rs b/languages/golang/encrypt/guest/src/abi.rs
index fd539231b..8fad3f7af 100644
--- a/languages/golang/encrypt/guest/src/abi.rs
+++ b/languages/golang/encrypt/guest/src/abi.rs
@@ -90,7 +90,7 @@ use std::cell::{Cell, RefCell};
 use std::panic::{catch_unwind, AssertUnwindSafe};
 use std::rc::Rc;
 
-use stack_encrypt::StackCipher;
+use stack_encrypt::{Controlled as _, StackCipher};
 use stack_guest_abi::abi::{export, input, take_plaintext, wipe_input};
 use stack_guest_abi::buffers;
 use stack_guest_abi::call;
@@ -99,7 +99,7 @@ use stack_guest_abi::status::STATUS_NEEDS_IO;
 use stack_guest_abi::step::{self, Operation, Step};
 
 use crate::io;
-use crate::ops;
+use crate::ops::{self, Bytes};
 use crate::options::{parse_options, parse_selector, scope_for, KeysetSelector, Side};
 #[cfg(not(feature = "deterministic-kms"))]
 use crate::status::STATUS_INTERNAL;
@@ -418,7 +418,7 @@ pub unsafe extern "C" fn se_term(
         let value = unsafe { take_plaintext(val_ptr, val_len)? };
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns and before any wipe of an overlapping range.
-        let context = unsafe { input(ctx_ptr, ctx_len)? }.to_vec();
+        let context = Bytes::new(unsafe { input(ctx_ptr, ctx_len)? }.to_vec());
         let opts = unsafe { input(opt_ptr, opt_len)? };
         ops::validate::term(&value, &context, kind)?;
         let options = parse_options(opts, Side::Mint)?;
@@ -453,7 +453,7 @@ pub unsafe extern "C" fn se_encrypt_record(
         let source = unsafe { take_plaintext(src_ptr, src_len)? };
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns and before any wipe of an overlapping range.
-        let plan = unsafe { input(plan_ptr, plan_len)? }.to_vec();
+        let plan = Bytes::new(unsafe { input(plan_ptr, plan_len)? }.to_vec());
         let opts = unsafe { input(opt_ptr, opt_len)? };
         ops::validate::record(&source, &plan)?;
         let options = parse_options(opts, Side::Mint)?;
@@ -494,7 +494,7 @@ pub unsafe extern "C" fn se_decrypt_record(
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns and before any wipe of an overlapping range.
         let record = unsafe { input(rec_ptr, rec_len)? }.to_vec();
-        let plan = unsafe { input(plan_ptr, plan_len)? }.to_vec();
+        let plan = Bytes::new(unsafe { input(plan_ptr, plan_len)? }.to_vec());
         let opts = unsafe { input(opt_ptr, opt_len)? };
         let options = parse_options(opts, Side::Open)?;
         ops::validate::record_tree(&record, &plan, options.context.as_ref())?;
@@ -520,8 +520,8 @@ pub unsafe extern "C" fn se_plan_check(plan_ptr: *const u8, plan_len: u32) -> u6
     export(|| {
         // SAFETY: a host-owned range the export was handed; the borrow ends
         // before it returns.
-        let plan = unsafe { input(plan_ptr, plan_len)? };
-        ops::plan_check(plan).map(|()| Vec::new())
+        let plan = Bytes::new(unsafe { input(plan_ptr, plan_len)? }.to_vec());
+        ops::plan_check(&plan).map(|()| Vec::new())
     })
 }
 
@@ -557,7 +557,7 @@ pub unsafe extern "C" fn se_query_term(
         let value = unsafe { take_plaintext(val_ptr, val_len)? };
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns and before any wipe of an overlapping range.
-        let plan = unsafe { input(plan_ptr, plan_len)? }.to_vec();
+        let plan = Bytes::new(unsafe { input(plan_ptr, plan_len)? }.to_vec());
         let field = unsafe { input(field_ptr, field_len)? }.to_vec();
         let operator = unsafe { input(op_ptr, op_len)? }.to_vec();
         let opts = unsafe { input(opt_ptr, opt_len)? };
@@ -599,10 +599,10 @@ pub unsafe extern "C" fn se_json_open(
     export(|| {
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns.
-        let rows = unsafe { input(rows_ptr, rows_len)? }.to_vec();
-        let plan = unsafe { input(plan_ptr, plan_len)? }.to_vec();
+        let rows = Bytes::new(unsafe { input(rows_ptr, rows_len)? }.to_vec());
+        let plan = Bytes::new(unsafe { input(plan_ptr, plan_len)? }.to_vec());
         let field = unsafe { input(field_ptr, field_len)? }.to_vec();
-        let request = unsafe { input(req_ptr, req_len)? }.to_vec();
+        let request = Bytes::new(unsafe { input(req_ptr, req_len)? }.to_vec());
         let opts = unsafe { input(opt_ptr, opt_len)? };
         ops::validate::json_open(&rows, &plan, &field, &request)?;
         let options = parse_options(opts, Side::Mint)?;
@@ -647,10 +647,10 @@ pub unsafe extern "C" fn se_verify(
         let (query, values) = (query?, values?);
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns.
-        let plan = unsafe { input(plan_ptr, plan_len)? };
+        let plan = Bytes::new(unsafe { input(plan_ptr, plan_len)? }.to_vec());
         let field = unsafe { input(field_ptr, field_len)? };
         let operator = unsafe { input(op_ptr, op_len)? };
-        ops::verify(query.as_slice(), values.as_slice(), plan, field, operator)
+        ops::verify(&query, &values, &plan, field, operator)
     })
 }
 
@@ -682,11 +682,11 @@ pub unsafe extern "C" fn se_target_limit(
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before it returns.
         let term = unsafe { input(term_ptr, term_len)? };
-        let stats = unsafe { input(stats_ptr, stats_len)? };
-        let plan = unsafe { input(plan_ptr, plan_len)? };
+        let stats = Bytes::new(unsafe { input(stats_ptr, stats_len)? }.to_vec());
+        let plan = Bytes::new(unsafe { input(plan_ptr, plan_len)? }.to_vec());
         let field = unsafe { input(field_ptr, field_len)? };
         let operator = unsafe { input(op_ptr, op_len)? };
-        ops::target_limit(term, stats, plan, field, operator, want)
+        ops::target_limit(term, &stats, &plan, field, operator, want)
     })
 }
 
@@ -717,9 +717,9 @@ pub unsafe extern "C" fn se_operators(
     export(|| {
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // before they return.
-        let plan = unsafe { input(plan_ptr, plan_len)? };
+        let plan = Bytes::new(unsafe { input(plan_ptr, plan_len)? }.to_vec());
         let field = unsafe { input(field_ptr, field_len)? };
-        ops::operators(plan, field)
+        ops::operators(&plan, field)
     })
 }
 
@@ -753,7 +753,7 @@ pub extern "C" fn se_io() -> u64 {
 pub unsafe extern "C" fn se_resume(handle: u64, resp_ptr: *mut u8, resp_len: u32) -> u64 {
     export(|| {
         let bytes = unsafe { take_plaintext(resp_ptr, resp_len) };
-        let responses = bytes.and_then(|bytes| io::decode_responses(&bytes));
+        let responses = bytes.and_then(|bytes| io::decode_responses(bytes.risky_ref()));
         let responses = responses.inspect_err(|_| {
             let _ = step::abort(handle);
         })?;
diff --git a/languages/golang/encrypt/guest/src/io.rs b/languages/golang/encrypt/guest/src/io.rs
index 29206fd83..dad3a6e63 100644
--- a/languages/golang/encrypt/guest/src/io.rs
+++ b/languages/golang/encrypt/guest/src/io.rs
@@ -29,6 +29,7 @@
 
 use serde::{Deserialize, Serialize, Serializer};
 use stack_encrypt::dynamic::frame::serde::{from_slice, to_vec};
+use stack_encrypt::{Buffer, Controlled as _};
 use stack_guest_abi::last_error::malformed;
 use stack_guest_abi::step::{Request, Response};
 use zeroize::Zeroizing;
@@ -63,14 +64,24 @@ pub fn encode_step(handle: u64, requests: &[Request]) -> Result<Vec<u8>, u32> {
             })
             .collect(),
     };
-    let frame = Zeroizing::new(to_vec(&wire).map_err(|_| STATUS_ENCODING)?);
-    // Sized exactly, as every output is: the registry would otherwise
-    // reallocate a buffer with spare capacity and leave the old one unwiped.
+    // A `Buffer`, which wipes on drop and as it grows.
+    let frame = to_vec(&wire).map_err(|_| STATUS_ENCODING)?;
+    to_host(&frame)
+        .ok_or_else(|| stack_guest_abi::last_error::internal("no memory for a step's requests"))
+}
+
+/// A finished frame, copied into the output buffer the host reads.
+///
+/// This is where a frame's bytes leave the guest, so this is the one place
+/// the guest reads a `Buffer` through `risky_ref`. The `Buffer` is still
+/// wiped when it drops. The copy is sized exactly, as every output is: the
+/// registry would otherwise reallocate a buffer with spare capacity, and
+/// leave the old one unwiped. `None` means the copy could not be allocated.
+pub(crate) fn to_host(frame: &Buffer) -> Option<Vec<u8>> {
     let mut out = Vec::new();
-    out.try_reserve_exact(frame.len())
-        .map_err(|_| stack_guest_abi::last_error::internal("no memory for a step's requests"))?;
-    out.extend_from_slice(&frame);
-    Ok(out)
+    out.try_reserve_exact(frame.len()).ok()?;
+    out.extend_from_slice(frame.risky_ref());
+    Some(out)
 }
 
 /// The responses the host handed `se_resume`, copied out of its buffer into
diff --git a/languages/golang/encrypt/guest/src/ops.rs b/languages/golang/encrypt/guest/src/ops.rs
index 3b2c65e25..4389d901c 100644
--- a/languages/golang/encrypt/guest/src/ops.rs
+++ b/languages/golang/encrypt/guest/src/ops.rs
@@ -50,9 +50,11 @@ use stack_encrypt::dynamic::{self, Scope, ValueFrame};
 use stack_encrypt::sem::MatchOptions;
 use stack_encrypt::target::IndexSpec;
 use stack_encrypt::ErrorPayload;
-use stack_encrypt::{CipherText, KeysetCipher, Label, Node, SealedValue, StackCipherText};
+use stack_encrypt::{
+    AsProtectedRef, CipherText, Controlled, KeysetCipher, Label, Node, Protected, ProtectedRef,
+    SealedValue, StackCipherText,
+};
 use stack_kms::{DataKeySource, IndexKeySource};
-use zeroize::Zeroizing;
 
 use stack_guest_abi::last_error;
 
@@ -73,6 +75,12 @@ pub const TERM_OPE: u32 = 4;
 /// encoding — the shape that crosses the FFI codec.
 type BytesTree = Node<Vec<u8>>;
 
+/// An input frame the host handed over: a plan, a context, statistics, or
+/// plaintext. The export takes it into a guest buffer, and this wipes it
+/// when it drops. Plaintext moves in from the host's buffer, which
+/// [`take_plaintext`](stack_guest_abi::abi::take_plaintext) wipes at once.
+pub type Bytes = Protected<Vec<u8>>;
+
 // =============================================================================
 // Terms
 // =============================================================================
@@ -96,8 +104,8 @@ type BytesTree = Node<Vec<u8>>;
 /// extended context.
 pub async fn term<K>(
     cipher: &KeysetCipher<'_, K>,
-    value: &[u8],
-    context: &[u8],
+    value: &Bytes,
+    context: &Bytes,
     kind: u32,
 ) -> Result<Vec<u8>, u32>
 where
@@ -117,10 +125,10 @@ where
 /// are not a frame are refused as every other input's are, before the
 /// context's own grammar.
 fn parse_context(
-    context: &[u8],
+    context: &Bytes,
 ) -> Result<stack_encrypt::NonEmpty<stack_encrypt::ContextPiece<'static>>, u32> {
     let _ = parse_frame(context)?;
-    dynamic::context(context).map_err(|e| fail_dynamic(&e))
+    dynamic::context(lend(context)).map_err(|e| fail_dynamic(&e))
 }
 
 /// The static half of a term: the kind is one of the ABI's table, and the
@@ -174,8 +182,8 @@ fn parse_term(value: Frame<'_>, kind: u32) -> Result<IndexSpec, u32> {
 /// [`dynamic::record`]'s to state.
 pub async fn encrypt_record<K>(
     cipher: &KeysetCipher<'_, K>,
-    source: &[u8],
-    plan: &[u8],
+    source: &Bytes,
+    plan: &Bytes,
 ) -> Result<Vec<u8>, u32>
 where
     K: DataKeySource + IndexKeySource + Sync + 'static,
@@ -209,7 +217,7 @@ where
 pub async fn decrypt_record<K>(
     scope: Scope<'_, K>,
     record: &[u8],
-    plan: &[u8],
+    plan: &Bytes,
     expected: Option<Label>,
 ) -> Result<Vec<u8>, u32>
 where
@@ -253,8 +261,8 @@ where
 /// `text_array` (a subtree read's tokens). No data key is minted.
 pub async fn query_term<K>(
     cipher: &KeysetCipher<'_, K>,
-    input: &[u8],
-    plan: &[u8],
+    input: &Bytes,
+    plan: &Bytes,
     field: &[u8],
     operator: &[u8],
 ) -> Result<Vec<u8>, u32>
@@ -289,10 +297,10 @@ where
 /// request for every row.
 pub async fn json_open<K>(
     keyset: &KeysetCipher<'_, K>,
-    rows: &[u8],
-    plan: &[u8],
+    rows: &Bytes,
+    plan: &Bytes,
     field: &[u8],
-    request: &[u8],
+    request: &Bytes,
 ) -> Result<Vec<u8>, u32>
 where
     K: DataKeySource + IndexKeySource + Sync + 'static,
@@ -320,9 +328,9 @@ where
 /// they are plaintext, so no term carries them. A null value is `false`.
 /// Needs no cipher and no key.
 pub fn verify(
-    input: &[u8],
-    values: &[u8],
-    plan: &[u8],
+    input: &Bytes,
+    values: &Bytes,
+    plan: &Bytes,
     field: &[u8],
     operator: &[u8],
 ) -> Result<Vec<u8>, u32> {
@@ -356,8 +364,8 @@ pub fn verify(
 /// no key.
 pub fn target_limit(
     term: &[u8],
-    stats: &[u8],
-    plan: &[u8],
+    stats: &Bytes,
+    plan: &Bytes,
     field: &[u8],
     operator: &[u8],
     want: u64,
@@ -365,7 +373,7 @@ pub fn target_limit(
     let (plan, field, operator) = parse_query(plan, field, operator)?;
     // Statistics are read without a field to hand; the error names the
     // query's, as every other refusal of a query does.
-    let stats = stack_encrypt::op::Stats::from_frame(stats)
+    let stats = stack_encrypt::op::Stats::from_frame(lend(stats))
         .map_err(|e| fail_dynamic(&e.in_field(field)))?;
     let limit = dynamic::target_limit(&plan, field, operator, term, want, &stats, &resolver())
         .map_err(|e| fail_dynamic(&e))?;
@@ -374,7 +382,7 @@ pub fn target_limit(
 
 /// A plan and one of its fields' names: the plan parsed against this
 /// build's resolver, and the field's name UTF-8.
-fn parse_field<'f>(plan: &[u8], field: &'f [u8]) -> Result<(dynamic::record::Plan, &'f str), u32> {
+fn parse_field<'f>(plan: &Bytes, field: &'f [u8]) -> Result<(dynamic::record::Plan, &'f str), u32> {
     let plan = parse_plan(plan)?;
     let field = std::str::from_utf8(field)
         .map_err(|_| last_error::malformed("the field name is not UTF-8"))?;
@@ -386,7 +394,7 @@ fn parse_field<'f>(plan: &[u8], field: &'f [u8]) -> Result<(dynamic::record::Pla
 /// unknown operator is refused naming the field, as an operator the field
 /// does not answer is.
 fn parse_query<'f>(
-    plan: &[u8],
+    plan: &Bytes,
     field: &'f [u8],
     operator: &[u8],
 ) -> Result<(dynamic::record::Plan, &'f str, dynamic::OpSpec), u32> {
@@ -407,9 +415,9 @@ fn parse_query<'f>(
 /// build cannot run is refused here, the same way at every export that
 /// takes a plan. Bytes that are not a frame are refused as every other
 /// input's are, before the plan's own grammar.
-fn parse_plan(plan: &[u8]) -> Result<dynamic::record::Plan, u32> {
+fn parse_plan(plan: &Bytes) -> Result<dynamic::record::Plan, u32> {
     let _ = parse_frame(plan)?;
-    dynamic::record::plan_with(plan, &resolver()).map_err(|e| fail_dynamic(&e))
+    dynamic::record::plan_with(lend(plan), &resolver()).map_err(|e| fail_dynamic(&e))
 }
 
 // =============================================================================
@@ -423,7 +431,7 @@ fn parse_plan(plan: &[u8]) -> Result<dynamic::record::Plan, u32> {
 /// [`STATUS_ENCODING`]. The Go generator (`stashgen`) asks this for every
 /// declaration it writes, so it holds no copy of the engine's rules; it
 /// asks one field at a time to name the field that failed.
-pub fn plan_check(plan: &[u8]) -> Result<(), u32> {
+pub fn plan_check(plan: &Bytes) -> Result<(), u32> {
     parse_plan(plan).map(drop)
 }
 
@@ -484,7 +492,7 @@ pub fn targets() -> Result<Vec<u8>, u32> {
 /// writes and generates one query method per entry, so it holds no copy of
 /// which index answers which operator. A field the plan does not have is
 /// [`STATUS_ENCODING`]. Needs no cipher.
-pub fn operators(plan: &[u8], field: &[u8]) -> Result<Vec<u8>, u32> {
+pub fn operators(plan: &Bytes, field: &[u8]) -> Result<Vec<u8>, u32> {
     let plan = parse_plan(plan)?;
     let field = std::str::from_utf8(field)
         .map_err(|_| last_error::malformed("the field name is not UTF-8"))?;
@@ -515,7 +523,7 @@ pub mod validate {
     /// A term's inputs, as [`term`] takes them: the context decodes and is
     /// non-empty, the kind is one of [`TERM_EQUALITY`] .. [`TERM_OPE`], and
     /// the value is one scalar the index takes ([`IndexSpec::defines`]).
-    pub fn term(value: &[u8], context: &[u8], kind: u32) -> Result<(), u32> {
+    pub fn term(value: &Bytes, context: &Bytes, kind: u32) -> Result<(), u32> {
         let _ = parse_context(context)?;
         parse_term(parse_frame(value)?, kind).map(drop)
     }
@@ -524,7 +532,7 @@ pub mod validate {
     /// the plan decodes and parses (every field's context non-empty, every
     /// output known), and the source fits it (shape, field set, each value
     /// against its field's outputs).
-    pub fn record(source: &[u8], plan: &[u8]) -> Result<(), u32> {
+    pub fn record(source: &Bytes, plan: &Bytes) -> Result<(), u32> {
         let plan = parse_plan(plan)?;
         dynamic::record::check_source(checked_plaintext(source)?, &plan)
             .map_err(|e| fail_dynamic(&e))
@@ -535,7 +543,12 @@ pub mod validate {
     /// the engine knows and the field answers, and the input reads as the
     /// field's kind and passes the refusals the typed path makes before a
     /// term exists ([`dynamic::check_query`]).
-    pub fn query_term(input: &[u8], plan: &[u8], field: &[u8], operator: &[u8]) -> Result<(), u32> {
+    pub fn query_term(
+        input: &Bytes,
+        plan: &Bytes,
+        field: &[u8],
+        operator: &[u8],
+    ) -> Result<(), u32> {
         let (plan, field, operator) = parse_query(plan, field, operator)?;
         dynamic::check_query(
             &plan,
@@ -550,7 +563,7 @@ pub mod validate {
     /// A read's inputs, as [`json_open`](super::json_open) takes them: the
     /// plan parses, the field stores a document, and the request and rows
     /// are the read's ([`dynamic::check_json_open`]).
-    pub fn json_open(rows: &[u8], plan: &[u8], field: &[u8], request: &[u8]) -> Result<(), u32> {
+    pub fn json_open(rows: &Bytes, plan: &Bytes, field: &[u8], request: &Bytes) -> Result<(), u32> {
         let (plan, field) = parse_field(plan, field)?;
         dynamic::check_json_open(
             &plan,
@@ -567,7 +580,7 @@ pub mod validate {
     /// ciphertext-bearing field has a `"c"` node that is not a passthrough,
     /// and a stored context field is the `expected` one, when the host
     /// names one.
-    pub fn record_tree(record: &[u8], plan: &[u8], expected: Option<&Label>) -> Result<(), u32> {
+    pub fn record_tree(record: &[u8], plan: &Bytes, expected: Option<&Label>) -> Result<(), u32> {
         let plan = parse_plan(plan)?;
         dynamic::record::check_record(decode_tree(record)?, &plan, expected)
             .map_err(|e| fail_dynamic(&e))
@@ -582,17 +595,17 @@ pub mod validate {
 /// held as the frame, in a buffer wiped when it drops. The same frames are
 /// refused as control data's, so a malformed input fails the same way on
 /// every path.
-fn decode_plaintext(bytes: &[u8]) -> Result<ValueFrame, u32> {
-    ValueFrame::from_bytes(bytes).map_err(|_| not_a_frame())
+fn decode_plaintext(bytes: &Bytes) -> Result<ValueFrame, u32> {
+    ValueFrame::from_bytes(lend(bytes)).map_err(|_| not_a_frame())
 }
 
 /// Plaintext checked as [`decode_plaintext`] checks it, and walked in place
-/// from the host's buffer: for a source or an input that is walked once,
-/// where a frame of its own would be one more copy of the plaintext. The
-/// record split copies each field into its own wiped frame, and a query's
-/// input is read straight into its term.
-fn checked_plaintext(bytes: &[u8]) -> Result<Frame<'_>, u32> {
-    ValueFrame::check(bytes).map_err(|_| not_a_frame())
+/// from the buffer the export took it into: for a source or an input that
+/// is walked once, where a frame of its own would be one more copy of the
+/// plaintext. The record split copies each field into its own wiped frame,
+/// and a query's input is read straight into its term.
+fn checked_plaintext(bytes: &Bytes) -> Result<Frame<'_>, u32> {
+    ValueFrame::check(lend(bytes)).map_err(|_| not_a_frame())
 }
 
 /// An opened value as the output buffer: its frame, copied into a buffer
@@ -606,8 +619,18 @@ fn encode_frame(frame: ValueFrame) -> Result<Vec<u8>, u32> {
 
 /// One frame, parsed and checked but not decoded: what a term's value is
 /// walked from, in place.
-fn parse_frame(bytes: &[u8]) -> Result<Frame<'_>, u32> {
-    Frame::parse(bytes).map_err(|_| not_a_frame())
+///
+/// This is the one place the guest reads an input's bytes itself:
+/// vitaminc's frame parser takes a slice. Everywhere else an input is lent
+/// to a reader ([`lend`]).
+fn parse_frame(bytes: &Bytes) -> Result<Frame<'_>, u32> {
+    Frame::parse(bytes.risky_ref()).map_err(|_| not_a_frame())
+}
+
+/// An input lent to one of stack-encrypt's frame readers. The bytes stay in
+/// the export's [`Bytes`], which wipes them when it drops.
+fn lend(bytes: &Bytes) -> ProtectedRef<'_, [u8]> {
+    bytes.as_protected_ref().as_deref()
 }
 
 fn not_a_frame() -> u32 {
@@ -621,12 +644,10 @@ fn not_a_frame() -> u32 {
 /// is sized as every other output is. A query term's search tokens are
 /// derived from plaintext, so the staging buffer is wiped once copied.
 fn encode_answer<T: serde::Serialize>(answer: &T) -> Result<Vec<u8>, u32> {
-    let frame = Zeroizing::new(
-        stack_encrypt::dynamic::frame::serde::to_vec(answer).map_err(|_| STATUS_ENCODING)?,
-    );
-    let mut out = exact_buffer(Some(frame.len()))?;
-    out.extend_from_slice(&frame);
-    Ok(out)
+    // A `Buffer`, which wipes on drop and as it grows.
+    let frame =
+        stack_encrypt::dynamic::frame::serde::to_vec(answer).map_err(|_| STATUS_ENCODING)?;
+    crate::io::to_host(&frame).ok_or(STATUS_INTERNAL)
 }
 
 fn decode_tree(bytes: &[u8]) -> Result<StackCipherText, u32> {
@@ -716,7 +737,7 @@ fn tree_encoded_len(tree: &BytesTree) -> Option<usize> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::support::Tree;
+    use crate::support::{protect, Tree};
     use stack_encrypt::Controlled;
 
     // `tree_encoded_len` re-derives the codec's arithmetic; the codec exports
@@ -870,7 +891,11 @@ mod tests {
     fn a_plan_naming_a_target_is_accepted_exactly_by_the_eql_build() {
         let plan = target_plan();
         if crate::targets::HOLDS_EQL {
-            assert_eq!(plan_check(&plan), Ok(()), "the eql build runs TextEq");
+            assert_eq!(
+                plan_check(&protect(&plan)),
+                Ok(()),
+                "the eql build runs TextEq"
+            );
             // A type the engine cannot produce, and one that does not exist,
             // are refused at plan_check.
             for name in ["Json", "Nope"] {
@@ -881,11 +906,15 @@ mod tests {
                         ("target", text(name)),
                     ]),
                 )]));
-                assert_eq!(plan_check(&refused), Err(STATUS_ENCODING), "{name}");
+                assert_eq!(
+                    plan_check(&protect(&refused)),
+                    Err(STATUS_ENCODING),
+                    "{name}"
+                );
             }
         } else {
             assert_eq!(
-                plan_check(&plan),
+                plan_check(&protect(&plan)),
                 Err(STATUS_ENCODING),
                 "the build without EQL types refuses a target name"
             );
@@ -907,8 +936,9 @@ mod tests {
             ("email", text("alice@example.com")),
             ("notes", text("likes cats")),
         ]));
-        validate::record(&source, &plan).expect("the source fits");
-        let sealed = block_on(encrypt_record(&keyset, &source, &plan)).expect("seals");
+        validate::record(&protect(&source), &protect(&plan)).expect("the source fits");
+        let sealed =
+            block_on(encrypt_record(&keyset, &protect(&source), &protect(&plan))).expect("seals");
 
         // The stored tree carries the EQL JSON under "eql": the v4 envelope
         // with the column as its i and a stack-encrypt ciphertext.
@@ -938,9 +968,14 @@ mod tests {
         assert_eq!(eql["hm"].as_str().unwrap().len(), 64);
 
         // Opens back through the EQL type's own decryption.
-        validate::record_tree(&sealed, &plan, None).expect("the tree fits");
-        let opened =
-            block_on(decrypt_record(Scope::Client(&cipher), &sealed, &plan, None)).expect("opens");
+        validate::record_tree(&sealed, &protect(&plan), None).expect("the tree fits");
+        let opened = block_on(decrypt_record(
+            Scope::Client(&cipher),
+            &sealed,
+            &protect(&plan),
+            None,
+        ))
+        .expect("opens");
         let Tree::Object(values) = Tree::from_frame(&opened).expect("a value") else {
             panic!("an object")
         };
@@ -950,8 +985,16 @@ mod tests {
         // The eq query's term is the type's query value, and it matches the
         // stored term.
         let probe = encoded(text("alice@example.com"));
-        validate::query_term(&probe, &plan, b"email", b"eq").expect("a target field answers eq");
-        let term = block_on(query_term(&keyset, &probe, &plan, b"email", b"eq")).expect("derives");
+        validate::query_term(&protect(&probe), &protect(&plan), b"email", b"eq")
+            .expect("a target field answers eq");
+        let term = block_on(query_term(
+            &keyset,
+            &protect(&probe),
+            &protect(&plan),
+            b"email",
+            b"eq",
+        ))
+        .expect("derives");
         let Tree::Object(term) = Tree::from_frame(&term).expect("a value") else {
             panic!("a query term is an object")
         };
@@ -973,15 +1016,20 @@ mod tests {
         // A query on a sealed field, an unknown field, or a wrong kind is
         // refused at validation.
         assert_eq!(
-            validate::query_term(&probe, &plan, b"notes", b"eq"),
+            validate::query_term(&protect(&probe), &protect(&plan), b"notes", b"eq"),
             Err(STATUS_ENCODING)
         );
         assert_eq!(
-            validate::query_term(&probe, &plan, b"nope", b"eq"),
+            validate::query_term(&protect(&probe), &protect(&plan), b"nope", b"eq"),
             Err(STATUS_ENCODING)
         );
         assert_eq!(
-            validate::query_term(&encoded(Tree::UInt32(1)), &plan, b"email", b"eq"),
+            validate::query_term(
+                &protect(&encoded(Tree::UInt32(1))),
+                &protect(&plan),
+                b"email",
+                b"eq"
+            ),
             Err(STATUS_ENCODING)
         );
     }
@@ -1017,10 +1065,16 @@ mod tests {
         };
 
         let accepted = input("$.country == $v && exists($.tags[*])");
-        validate::query_term(&accepted, &plan, b"profile", b"match")
+        validate::query_term(&protect(&accepted), &protect(&plan), b"profile", b"match")
             .expect("a field answers match");
-        let term =
-            block_on(query_term(&keyset, &accepted, &plan, b"profile", b"match")).expect("derives");
+        let term = block_on(query_term(
+            &keyset,
+            &protect(&accepted),
+            &protect(&plan),
+            b"profile",
+            b"match",
+        ))
+        .expect("derives");
         let Tree::Object(term) = Tree::from_frame(&term).expect("a value") else {
             panic!("a query term is an object")
         };
@@ -1034,11 +1088,17 @@ mod tests {
 
         let refused = input(r#"$.country like_regex "n""#);
         assert_eq!(
-            validate::query_term(&refused, &plan, b"profile", b"match"),
+            validate::query_term(&protect(&refused), &protect(&plan), b"profile", b"match"),
             Err(STATUS_ENCODING)
         );
         assert_eq!(
-            block_on(query_term(&keyset, &refused, &plan, b"profile", b"match")),
+            block_on(query_term(
+                &keyset,
+                &protect(&refused),
+                &protect(&plan),
+                b"profile",
+                b"match"
+            )),
             Err(STATUS_ENCODING)
         );
     }
diff --git a/languages/golang/encrypt/guest/src/targets.rs b/languages/golang/encrypt/guest/src/targets.rs
index c61b7083e..539c47e4c 100644
--- a/languages/golang/encrypt/guest/src/targets.rs
+++ b/languages/golang/encrypt/guest/src/targets.rs
@@ -181,6 +181,8 @@ fn convert(error: eql_bindings::encryption::targets::TargetError) -> TargetError
 #[cfg(test)]
 mod tests {
     use super::*;
+    #[cfg(feature = "eql")]
+    use stack_encrypt::AsProtectedRef as _;
 
     #[cfg(not(feature = "eql"))]
     #[test]
@@ -321,7 +323,7 @@ mod tests {
                 }
             });
             let frame = dynamic::frame::serde::to_vec(&wire).expect("plan frame");
-            let plan = record::plan_with(&frame, &resolver()).expect("plan");
+            let plan = record::plan_with(frame.as_protected_ref(), &resolver()).expect("plan");
             dynamic::field_operators(&plan, "profile", &resolver())
                 .expect("operators")
                 .into_iter()
diff --git a/languages/golang/encrypt/guest/src/test_frame.rs b/languages/golang/encrypt/guest/src/test_frame.rs
index 58e492663..3f4693ae9 100644
--- a/languages/golang/encrypt/guest/src/test_frame.rs
+++ b/languages/golang/encrypt/guest/src/test_frame.rs
@@ -27,7 +27,9 @@ impl Serialize for RawBytes<'_> {
 
 /// The frame bytes of `v`.
 pub(crate) fn frame(v: &V) -> Vec<u8> {
-    let scalar = |r: Result<Vec<u8>, _>| r.expect("a scalar frames");
+    let scalar = |r: Result<stack_encrypt::Buffer, _>| {
+        stack_encrypt::Controlled::risky_unwrap(r.expect("a scalar frames"))
+    };
     let container = |tag: u8, len: usize| {
         let mut out = vec![tag];
         out.extend_from_slice(&u32::try_from(len).expect("short").to_le_bytes());
diff --git a/languages/golang/encrypt/guest/tests/leak.rs b/languages/golang/encrypt/guest/tests/leak.rs
index ffc2aa9d5..bdab8edc9 100644
--- a/languages/golang/encrypt/guest/tests/leak.rs
+++ b/languages/golang/encrypt/guest/tests/leak.rs
@@ -36,7 +36,7 @@ use stack_kms::{
     DataKey, DataKeySource, DataKeyWithTag, FakeDataKeySource, GenerateKeyError,
     GenerateKeyPayload, IndexKeySource, LoadKeysetError, RetrieveKeyError, RetrieveKeyPayload,
 };
-use support::Tree;
+use support::{protect, Tree};
 use uuid::Uuid;
 use zerokms_protocol::{IdentifiedBy, UnverifiedContext, ViturRequestError};
 
@@ -193,8 +193,8 @@ fn row(email: &str) -> Tree {
 fn sealed(cipher: &StackCipher<FakeDataKeySource>, plan: &[u8]) -> Vec<u8> {
     block_on(ops::encrypt_record(
         &cipher.default_keyset(),
-        &encode(row(PLAINTEXT)),
-        plan,
+        &protect(&encode(row(PLAINTEXT))),
+        &protect(plan),
     ))
     .expect("seal")
 }
@@ -310,8 +310,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 let context = [&[0xff][..], CONTEXT.as_bytes()].concat();
                 block_on(ops::term(
                     &keyset,
-                    &encode(s(PLAINTEXT)),
-                    &context,
+                    &protect(&encode(s(PLAINTEXT))),
+                    &protect(&context),
                     ops::TERM_EQUALITY,
                 ))
             }),
@@ -321,8 +321,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("context kind", &["stack_encrypt::dynamic_context"], || {
                 block_on(ops::term(
                     &keyset,
-                    &encode(s(PLAINTEXT)),
-                    &encode(Tree::Bool(true)),
+                    &protect(&encode(s(PLAINTEXT))),
+                    &protect(&encode(Tree::Bool(true))),
                     ops::TERM_EQUALITY,
                 ))
             }),
@@ -335,8 +335,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 || {
                     block_on(ops::term(
                         &keyset,
-                        &encode(Tree::Bool(true)),
-                        &encode(s(CONTEXT)),
+                        &protect(&encode(Tree::Bool(true))),
+                        &protect(&encode(s(CONTEXT))),
                         ops::TERM_EQUALITY,
                     ))
                 },
@@ -347,8 +347,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("kind", &["stack_guest_abi::malformed_input"], || {
                 block_on(ops::term(
                     &keyset,
-                    &encode(s(PLAINTEXT)),
-                    &encode(s(CONTEXT)),
+                    &protect(&encode(s(PLAINTEXT))),
+                    &protect(&encode(s(CONTEXT))),
                     99,
                 ))
             }),
@@ -358,8 +358,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("empty match", &["stack_encrypt::empty_term_text"], || {
                 block_on(ops::term(
                     &keyset,
-                    &encode(s("  ")),
-                    &encode(s(CONTEXT)),
+                    &protect(&encode(s("  "))),
+                    &protect(&encode(s(CONTEXT))),
                     ops::TERM_MATCH,
                 ))
             }),
@@ -368,34 +368,34 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
         (
             "a plan that is not codec bytes",
             failure("plan bytes", &["stack_guest_abi::malformed_input"], || {
-                ops::plan_check(CONTEXT.as_bytes())
+                ops::plan_check(&protect(CONTEXT.as_bytes()))
             }),
         ),
         (
             "a plan field context of a kind no context has",
             failure("plan context", &["stack_encrypt::dynamic_context"], || {
-                ops::plan_check(&encode(obj(vec![(
+                ops::plan_check(&protect(&encode(obj(vec![(
                     "email",
                     field(Tree::Bool(true), &["c"], None),
-                )])))
+                )]))))
             }),
         ),
         (
             "an indexed field with no type",
             failure("untyped", &["stack_encrypt::dynamic_untyped_index"], || {
-                ops::plan_check(&encode(obj(vec![(
+                ops::plan_check(&protect(&encode(obj(vec![(
                     "email",
                     field(label("email"), &["eq"], None),
-                )])))
+                )]))))
             }),
         ),
         (
             "an output that is not one",
             failure("output", &["stack_encrypt::dynamic_plan"], || {
-                ops::plan_check(&encode(obj(vec![(
+                ops::plan_check(&protect(&encode(obj(vec![(
                     "email",
                     field(extended("email", CONTEXT), &["zz"], None),
-                )])))
+                )]))))
             }),
         ),
         (
@@ -408,10 +408,10 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                     &["stack_encrypt::target_none"]
                 },
                 || {
-                    ops::plan_check(&encode(obj(vec![(
+                    ops::plan_check(&protect(&encode(obj(vec![(
                         "email",
                         obj(vec![("context", label("email")), ("target", s("Nope"))]),
-                    )])))
+                    )]))))
                 },
             ),
         ),
@@ -425,8 +425,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 )]));
                 block_on(ops::encrypt_record(
                     &keyset,
-                    &encode(obj(vec![("age", s(PLAINTEXT))])),
-                    &plan,
+                    &protect(&encode(obj(vec![("age", s(PLAINTEXT))]))),
+                    &protect(&plan),
                 ))
             }),
         ),
@@ -439,8 +439,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                     let source = obj(vec![("email", Tree::Passthrough(Box::new(s(PLAINTEXT))))]);
                     block_on(ops::encrypt_record(
                         &keyset,
-                        &encode(source),
-                        &plan_under(label("email")),
+                        &protect(&encode(source)),
+                        &protect(&plan_under(label("email"))),
                     ))
                 },
             ),
@@ -453,8 +453,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 || {
                     block_on(ops::encrypt_record(
                         &keyset,
-                        &encode(row(PLAINTEXT)),
-                        &plan_under(extended("email", &long_context)),
+                        &protect(&encode(row(PLAINTEXT))),
+                        &protect(&plan_under(extended("email", &long_context))),
                     ))
                 },
             ),
@@ -468,7 +468,7 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                     block_on(ops::decrypt_record(
                         Scope::Client(&cipher),
                         CIPHERTEXT,
-                        &plan_under(label("email")),
+                        &protect(&plan_under(label("email"))),
                         None,
                     ))
                 },
@@ -481,7 +481,7 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 block_on(ops::decrypt_record(
                     Scope::Client(&cipher),
                     &record,
-                    &plan_under(label("email")),
+                    &protect(&plan_under(label("email"))),
                     None,
                 ))
             }),
@@ -496,7 +496,7 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                     block_on(ops::decrypt_record(
                         Scope::Client(&cipher),
                         &record,
-                        &plan_under(label("email")),
+                        &protect(&plan_under(label("email"))),
                         None,
                     ))
                 },
@@ -513,7 +513,7 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 block_on(ops::decrypt_record(
                     Scope::Client(&cipher),
                     &record,
-                    &plan,
+                    &protect(&plan),
                     None,
                 ))
             }),
@@ -525,7 +525,7 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 block_on(ops::decrypt_record(
                     Scope::Client(&cipher),
                     &record,
-                    &plan_under(extended("email", CONTEXT)),
+                    &protect(&plan_under(extended("email", CONTEXT))),
                     None,
                 ))
             }),
@@ -540,7 +540,7 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 block_on(ops::decrypt_record(
                     Scope::Keyset(globex),
                     &record,
-                    &plan_under(label("email")),
+                    &protect(&plan_under(label("email"))),
                     None,
                 ))
             }),
@@ -558,8 +558,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("generate", &["stack_kms::generate_key_failed"], || {
                 block_on(ops::encrypt_record(
                     &failing.default_keyset(),
-                    &encode(row(PLAINTEXT)),
-                    &plan_under(label("email")),
+                    &protect(&encode(row(PLAINTEXT))),
+                    &protect(&plan_under(label("email"))),
                 ))
             }),
         ),
@@ -570,7 +570,7 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
                 block_on(ops::decrypt_record(
                     Scope::Client(&failing),
                     &record,
-                    &plan_under(label("email")),
+                    &protect(&plan_under(label("email"))),
                     None,
                 ))
             }),
@@ -654,8 +654,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("not answered", source, || {
                 block_on(ops::query_term(
                     &keyset,
-                    &encode(s(PLAINTEXT)),
-                    &plan_under(label("email")),
+                    &protect(&encode(s(PLAINTEXT))),
+                    &protect(&plan_under(label("email"))),
                     b"email",
                     b"lt",
                 ))
@@ -666,8 +666,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("query input", source, || {
                 block_on(ops::query_term(
                     &keyset,
-                    &encode(marker()),
-                    &plan_under(label("email")),
+                    &protect(&encode(marker())),
+                    &protect(&plan_under(label("email"))),
                     b"email",
                     b"eq",
                 ))
@@ -678,8 +678,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("unknown operator", source, || {
                 block_on(ops::query_term(
                     &keyset,
-                    &encode(s(PLAINTEXT)),
-                    &plan_under(label("email")),
+                    &protect(&encode(s(PLAINTEXT))),
+                    &protect(&plan_under(label("email"))),
                     b"email",
                     PLAINTEXT.as_bytes(),
                 ))
@@ -689,9 +689,9 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             "verifying an exact operator",
             failure("verify exact", source, || {
                 ops::verify(
-                    &encode(s(PLAINTEXT)),
-                    &encode(Tree::Array(vec![s(PLAINTEXT)])),
-                    &plan_under(label("email")),
+                    &protect(&encode(s(PLAINTEXT))),
+                    &protect(&encode(Tree::Array(vec![s(PLAINTEXT)]))),
+                    &protect(&plan_under(label("email"))),
                     b"email",
                     b"eq",
                 )
@@ -701,9 +701,9 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             "verifying a value of another type",
             failure("verify value", source, || {
                 ops::verify(
-                    &encode(s(PLAINTEXT)),
-                    &encode(Tree::Array(vec![marker()])),
-                    &match_plan(),
+                    &protect(&encode(s(PLAINTEXT))),
+                    &protect(&encode(Tree::Array(vec![marker()]))),
+                    &protect(&match_plan()),
                     b"name",
                     b"matches",
                 )
@@ -714,8 +714,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("limit term", source, || {
                 ops::target_limit(
                     PLAINTEXT.as_bytes(),
-                    &encode(obj(vec![("rows", Tree::UInt64(1))])),
-                    &match_plan(),
+                    &protect(&encode(obj(vec![("rows", Tree::UInt64(1))]))),
+                    &protect(&match_plan()),
                     b"name",
                     b"matches",
                     10,
@@ -727,8 +727,8 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             failure("limit stats", source, || {
                 ops::target_limit(
                     &[1, 0],
-                    &encode(obj(vec![("rows", s(PLAINTEXT))])),
-                    &match_plan(),
+                    &protect(&encode(obj(vec![("rows", s(PLAINTEXT))]))),
+                    &protect(&match_plan()),
                     b"name",
                     b"matches",
                     10,
@@ -758,7 +758,7 @@ fn scenarios() -> Vec<(&'static str, Tree)> {
             block_on(ops::decrypt_record(
                 Scope::Client(&cipher),
                 &record,
-                &plan,
+                &protect(&plan),
                 None,
             ))
         }),
@@ -873,7 +873,7 @@ fn a_foreign_keyset_carries_both_keyset_ids() {
         block_on(ops::decrypt_record(
             Scope::Keyset(globex),
             &record,
-            &plan_under(label("email")),
+            &protect(&plan_under(label("email"))),
             None,
         ))
     });
diff --git a/languages/golang/encrypt/guest/tests/native_ops.rs b/languages/golang/encrypt/guest/tests/native_ops.rs
index eb475761f..1c1e920ae 100644
--- a/languages/golang/encrypt/guest/tests/native_ops.rs
+++ b/languages/golang/encrypt/guest/tests/native_ops.rs
@@ -35,7 +35,7 @@ use stack_kms::{
     DataKey, DataKeySource, DataKeyWithTag, FakeDataKeySource, GenerateKeyPayload, IndexKeySource,
     RetrieveKeyPayload,
 };
-use support::Tree;
+use support::{protect, Tree};
 use uuid::Uuid;
 use zerokms_protocol::{IdentifiedBy, UnverifiedContext};
 
@@ -240,8 +240,8 @@ fn guest_terms_match_the_native_sem_derivations() {
 
     let eq = block_on(ops::term(
         &cipher.default_keyset(),
-        &encode(Tree::UInt32(42)),
-        &ctx,
+        &protect(&encode(Tree::UInt32(42))),
+        &protect(&ctx),
         TERM_EQUALITY,
     ))
     .expect("eq term");
@@ -255,8 +255,8 @@ fn guest_terms_match_the_native_sem_derivations() {
 
     let ore = block_on(ops::term(
         &cipher.default_keyset(),
-        &encode(Tree::UInt32(42)),
-        &ctx,
+        &protect(&encode(Tree::UInt32(42))),
+        &protect(&ctx),
         TERM_ORE,
     ))
     .expect("ore term");
@@ -270,8 +270,8 @@ fn guest_terms_match_the_native_sem_derivations() {
 
     let ope = block_on(ops::term(
         &cipher.default_keyset(),
-        &encode(Tree::UInt32(42)),
-        &ctx,
+        &protect(&encode(Tree::UInt32(42))),
+        &protect(&ctx),
         TERM_OPE,
     ))
     .expect("ope term");
@@ -285,8 +285,8 @@ fn guest_terms_match_the_native_sem_derivations() {
 
     let m = block_on(ops::term(
         &cipher.default_keyset(),
-        &encode(s("alice smith")),
-        &encode(s("users/name")),
+        &protect(&encode(s("alice smith"))),
+        &protect(&encode(s("users/name"))),
         TERM_MATCH,
     ))
     .expect("match term");
@@ -302,15 +302,15 @@ fn guest_terms_match_the_native_sem_derivations() {
     // them apart even when their raw bytes are equal.
     let eq_text = block_on(ops::term(
         &cipher.default_keyset(),
-        &encode(s("ab")),
-        &encode(s("f")),
+        &protect(&encode(s("ab"))),
+        &protect(&encode(s("f"))),
         TERM_EQUALITY,
     ))
     .expect("text term");
     let eq_bytes = block_on(ops::term(
         &cipher.default_keyset(),
-        &encode(Tree::Bytes(b"ab".to_vec())),
-        &encode(s("f")),
+        &protect(&encode(Tree::Bytes(b"ab".to_vec()))),
+        &protect(&encode(s("f"))),
         TERM_EQUALITY,
     ))
     .expect("bytes term");
@@ -334,8 +334,8 @@ fn guest_terms_match_the_native_sem_derivations() {
     // one marker byte, eight bytes a plaintext byte.
     let ore_s = block_on(ops::term(
         &cipher.default_keyset(),
-        &encode(s("alice")),
-        &encode(s("users/name")),
+        &protect(&encode(s("alice"))),
+        &protect(&encode(s("users/name"))),
         TERM_ORE,
     ))
     .expect("string ore");
@@ -367,8 +367,8 @@ fn unsupported_term_inputs_are_encoding_errors() {
         assert_eq!(
             block_on(ops::term(
                 &cipher.default_keyset(),
-                &encode(value),
-                &ctx,
+                &protect(&encode(value)),
+                &protect(&ctx),
                 kind
             )),
             Err(STATUS_ENCODING),
@@ -378,8 +378,8 @@ fn unsupported_term_inputs_are_encoding_errors() {
     assert_eq!(
         block_on(ops::term(
             &cipher.default_keyset(),
-            &encode(Tree::UInt32(1)),
-            &encode(s("")),
+            &protect(&encode(Tree::UInt32(1))),
+            &protect(&encode(s(""))),
             TERM_EQUALITY
         )),
         Err(STATUS_ENCODING),
@@ -397,8 +397,8 @@ fn unsupported_term_inputs_are_encoding_errors() {
         assert_eq!(
             block_on(ops::term(
                 &cipher.default_keyset(),
-                &encode(Tree::UInt32(1)),
-                &context,
+                &protect(&encode(Tree::UInt32(1))),
+                &protect(&context),
                 TERM_EQUALITY
             )),
             Err(STATUS_ENCODING),
@@ -422,8 +422,8 @@ fn a_record_batch_encrypts_in_one_call_and_round_trips() {
 
     let record = block_on(ops::encrypt_record(
         &cipher.default_keyset(),
-        &source,
-        &plan(),
+        &protect(&source),
+        &protect(&plan()),
     ))
     .expect("encrypt records");
     // Three rows, two ciphertext fields each: still exactly one call.
@@ -432,7 +432,7 @@ fn a_record_batch_encrypts_in_one_call_and_round_trips() {
     let pt = block_on(ops::decrypt_record(
         Scope::Client(&cipher),
         &record,
-        &plan(),
+        &protect(&plan()),
         None,
     ))
     .expect("decrypt records");
@@ -462,8 +462,8 @@ fn a_forged_passthrough_ciphertext_slot_is_rejected_not_decrypted() {
     let source = encode(row(29, "alice smith"));
     let record = block_on(ops::encrypt_record(
         &cipher.default_keyset(),
-        &source,
-        &plan(),
+        &protect(&source),
+        &protect(&plan()),
     ))
     .expect("encrypt record");
 
@@ -489,7 +489,7 @@ fn a_forged_passthrough_ciphertext_slot_is_rejected_not_decrypted() {
         block_on(ops::decrypt_record(
             Scope::Client(&cipher),
             &forged,
-            &plan(),
+            &protect(&plan()),
             None
         )),
         Err(STATUS_ENCODING),
@@ -520,8 +520,8 @@ fn a_passthrough_source_value_is_refused_a_ciphertext_slot() {
         assert_eq!(
             block_on(ops::encrypt_record(
                 &cipher.default_keyset(),
-                &source,
-                &plan
+                &protect(&source),
+                &protect(&plan)
             )),
             Err(STATUS_ENCODING)
         );
@@ -533,8 +533,8 @@ fn record_terms_equal_the_native_derivations_and_probe_them() {
     let cipher = cipher();
     let record = block_on(ops::encrypt_record(
         &cipher.default_keyset(),
-        &encode(row(34, "alice smith")),
-        &plan(),
+        &protect(&encode(row(34, "alice smith"))),
+        &protect(&plan()),
     ))
     .expect("encrypt record");
 
@@ -621,8 +621,8 @@ fn a_structured_plan_context_seals_what_the_native_extended_context_does() {
     let cipher = cipher();
     let record = block_on(ops::encrypt_record(
         &cipher.default_keyset(),
-        &encode(row(34, "alice smith")),
-        &extended_plan(),
+        &protect(&encode(row(34, "alice smith"))),
+        &protect(&extended_plan()),
     ))
     .expect("encrypt record");
 
@@ -652,8 +652,8 @@ fn a_structured_plan_context_seals_what_the_native_extended_context_does() {
 
     let guest_probe = block_on(ops::term(
         &cipher.default_keyset(),
-        &encode(Tree::UInt32(34)),
-        &encode(extended("age")),
+        &protect(&encode(Tree::UInt32(34))),
+        &protect(&encode(extended("age"))),
         TERM_EQUALITY,
     ))
     .expect("guest probe");
@@ -709,7 +709,7 @@ fn a_natively_sealed_field_under_an_extended_context_opens_through_a_plan() {
     let opened = block_on(ops::decrypt_record(
         Scope::Client(&cipher),
         &record,
-        &plan_with(extended("age")),
+        &protect(&plan_with(extended("age"))),
         None,
     ))
     .expect("open through the plan");
@@ -722,7 +722,7 @@ fn a_natively_sealed_field_under_an_extended_context_opens_through_a_plan() {
         block_on(ops::decrypt_record(
             Scope::Client(&cipher),
             &record,
-            &plan_with(label("age")),
+            &protect(&plan_with(label("age"))),
             None
         )),
         Err(STATUS_AUTH),
@@ -756,8 +756,8 @@ fn a_structured_plan_context_is_validated_at_parse() {
         assert_eq!(
             block_on(ops::encrypt_record(
                 &cipher.default_keyset(),
-                &source,
-                &plan_with(bad)
+                &protect(&source),
+                &protect(&plan_with(bad))
             )),
             Err(STATUS_ENCODING),
             "a plan context of {label} must be refused at parse"
@@ -773,14 +773,14 @@ fn a_structured_plan_context_is_validated_at_parse() {
     // Go `Context.With("")` extends one.
     let sealed = block_on(ops::encrypt_record(
         &cipher.default_keyset(),
-        &source,
-        &plan_with(Tree::Array(vec![label("f"), s("")])),
+        &protect(&source),
+        &protect(&plan_with(Tree::Array(vec![label("f"), s("")]))),
     ))
     .expect("a label extended by an empty part is never empty");
     assert!(block_on(ops::decrypt_record(
         Scope::Client(&cipher),
         &sealed,
-        &plan_with(Tree::Array(vec![label("f"), s("")])),
+        &protect(&plan_with(Tree::Array(vec![label("f"), s("")]))),
         None
     ))
     .is_ok());
@@ -796,8 +796,8 @@ fn record_shape_violations_are_encoding_errors() {
     assert_eq!(
         block_on(ops::encrypt_record(
             &cipher.default_keyset(),
-            &missing,
-            &plan()
+            &protect(&missing),
+            &protect(&plan())
         )),
         Err(STATUS_ENCODING)
     );
@@ -810,8 +810,8 @@ fn record_shape_violations_are_encoding_errors() {
     assert_eq!(
         block_on(ops::encrypt_record(
             &cipher.default_keyset(),
-            &extra,
-            &plan()
+            &protect(&extra),
+            &protect(&plan())
         )),
         Err(STATUS_ENCODING)
     );
@@ -823,8 +823,8 @@ fn record_shape_violations_are_encoding_errors() {
     assert_eq!(
         block_on(ops::encrypt_record(
             &cipher.default_keyset(),
-            &nested,
-            &plan()
+            &protect(&nested),
+            &protect(&plan())
         )),
         Err(STATUS_ENCODING),
         "a term-indexed field must be a scalar"
@@ -858,8 +858,8 @@ fn record_shape_violations_are_encoding_errors() {
         assert_eq!(
             block_on(ops::encrypt_record(
                 &cipher.default_keyset(),
-                &encode(obj(vec![("f", Tree::UInt32(1))])),
-                &encode(bad_plan),
+                &protect(&encode(obj(vec![("f", Tree::UInt32(1))]))),
+                &protect(&encode(bad_plan)),
             )),
             Err(STATUS_ENCODING)
         );
@@ -891,8 +891,8 @@ fn an_empty_plan_context_is_refused_before_anything_is_sealed() {
     assert_eq!(
         block_on(ops::encrypt_record(
             &cipher.default_keyset(),
-            &source,
-            &bad_plan
+            &protect(&source),
+            &protect(&bad_plan)
         )),
         Err(STATUS_ENCODING)
     );
@@ -905,7 +905,7 @@ fn an_empty_plan_context_is_refused_before_anything_is_sealed() {
         block_on(ops::decrypt_record(
             Scope::Client(&cipher),
             &source,
-            &bad_plan,
+            &protect(&bad_plan),
             None
         )),
         Err(STATUS_ENCODING)
@@ -923,14 +923,14 @@ fn an_empty_plan_context_is_refused_before_anything_is_sealed() {
     )]));
     let sealed = block_on(ops::encrypt_record(
         &cipher.default_keyset(),
-        &source,
-        &odd_plan,
+        &protect(&source),
+        &protect(&odd_plan),
     ))
     .expect("encrypt");
     let opened = block_on(ops::decrypt_record(
         Scope::Client(&cipher),
         &sealed,
-        &odd_plan,
+        &protect(&odd_plan),
         None,
     ))
     .expect("decrypt");
@@ -963,14 +963,14 @@ fn a_mixed_keyset_record_batch_opens_through_any_one_call_per_keyset() {
     // side and reads them back as one batch.
     let acme_rows = block_on(ops::encrypt_record(
         &acme,
-        &encode(row(29, "alice smith")),
-        &plan(),
+        &protect(&encode(row(29, "alice smith"))),
+        &protect(&plan()),
     ))
     .expect("encrypt acme row");
     let globex_rows = block_on(ops::encrypt_record(
         &globex,
-        &encode(row(34, "bob jones")),
-        &plan(),
+        &protect(&encode(row(34, "bob jones"))),
+        &protect(&plan()),
     ))
     .expect("encrypt globex row");
     let batch = {
@@ -989,7 +989,7 @@ fn a_mixed_keyset_record_batch_opens_through_any_one_call_per_keyset() {
     let pt = block_on(ops::decrypt_record(
         Scope::Client(&cipher),
         &batch,
-        &plan(),
+        &protect(&plan()),
         None,
     ))
     .expect("any opens the mixed batch");
@@ -1008,7 +1008,7 @@ fn a_mixed_keyset_record_batch_opens_through_any_one_call_per_keyset() {
         block_on(ops::decrypt_record(
             Scope::Keyset(acme),
             &batch,
-            &plan(),
+            &protect(&plan()),
             None
         )),
         Err(STATUS_FOREIGN_KEYSET)
@@ -1027,15 +1027,15 @@ fn terms_derive_under_the_selected_keyset() {
 
     let acme_term = block_on(ops::term(
         &acme,
-        &encode(Tree::UInt32(42)),
-        &ctx,
+        &protect(&encode(Tree::UInt32(42))),
+        &protect(&ctx),
         TERM_EQUALITY,
     ))
     .expect("acme term");
     let globex_term = block_on(ops::term(
         &globex,
-        &encode(Tree::UInt32(42)),
-        &ctx,
+        &protect(&encode(Tree::UInt32(42))),
+        &protect(&ctx),
         TERM_EQUALITY,
     ))
     .expect("globex term");
@@ -1072,12 +1072,17 @@ fn term_validation_refuses_what_the_term_op_refuses() {
     ] {
         let value = encode(value);
         assert_eq!(
-            ops::validate::term(&value, &ctx, kind),
+            ops::validate::term(&protect(&value), &protect(&ctx), kind),
             Err(STATUS_ENCODING),
             "{label} must be refused by validation"
         );
         assert_eq!(
-            block_on(ops::term(&cipher.default_keyset(), &value, &ctx, kind)),
+            block_on(ops::term(
+                &cipher.default_keyset(),
+                &protect(&value),
+                &protect(&ctx),
+                kind
+            )),
             Err(STATUS_ENCODING),
             "{label} must be refused by the op too"
         );
@@ -1088,7 +1093,11 @@ fn term_validation_refuses_what_the_term_op_refuses() {
         ("raw bytes for a context", b"f".to_vec()),
     ] {
         assert_eq!(
-            ops::validate::term(&encode(Tree::UInt32(1)), &context, TERM_EQUALITY),
+            ops::validate::term(
+                &protect(&encode(Tree::UInt32(1))),
+                &protect(&context),
+                TERM_EQUALITY
+            ),
             Err(STATUS_ENCODING),
             "{label} must be refused by validation"
         );
@@ -1106,7 +1115,10 @@ fn term_validation_refuses_what_the_term_op_refuses() {
         (Tree::Int32(-1), TERM_OPE),
         (s("x"), TERM_ORE),
     ] {
-        assert_eq!(ops::validate::term(&encode(value), &ctx, kind), Ok(()));
+        assert_eq!(
+            ops::validate::term(&protect(&encode(value)), &protect(&ctx), kind),
+            Ok(())
+        );
     }
 }
 
@@ -1148,15 +1160,15 @@ fn record_validation_refuses_what_encrypt_record_refuses() {
     ] {
         let source = encode(source);
         assert_eq!(
-            ops::validate::record(&source, &plan),
+            ops::validate::record(&protect(&source), &protect(&plan)),
             Err(STATUS_ENCODING),
             "{label} must be refused by validation"
         );
         assert_eq!(
             block_on(ops::encrypt_record(
                 &cipher.default_keyset(),
-                &source,
-                &plan
+                &protect(&source),
+                &protect(&plan)
             )),
             Err(STATUS_ENCODING),
             "{label} must be refused by the op too"
@@ -1171,19 +1183,28 @@ fn record_validation_refuses_what_encrypt_record_refuses() {
         Tree::Passthrough(Box::new(Tree::UInt32(29))),
     )]));
     assert_eq!(
-        ops::validate::record(&passthrough, &ct_only),
+        ops::validate::record(&protect(&passthrough), &protect(&ct_only)),
         Err(STATUS_ENCODING)
     );
 
     // A malformed plan is refused with a well-formed source.
     assert_eq!(
-        ops::validate::record(&encode(row(1, "a")), &encode(obj(vec![]))),
+        ops::validate::record(
+            &protect(&encode(row(1, "a"))),
+            &protect(&encode(obj(vec![])))
+        ),
         Err(STATUS_ENCODING)
     );
 
-    assert_eq!(ops::validate::record(&encode(row(1, "a")), &plan), Ok(()));
     assert_eq!(
-        ops::validate::record(&encode(Tree::Array(vec![row(1, "a"), row(2, "b")])), &plan),
+        ops::validate::record(&protect(&encode(row(1, "a"))), &protect(&plan)),
+        Ok(())
+    );
+    assert_eq!(
+        ops::validate::record(
+            &protect(&encode(Tree::Array(vec![row(1, "a"), row(2, "b")]))),
+            &protect(&plan)
+        ),
         Ok(())
     );
     assert_eq!(cipher.kms().generate_calls.load(Ordering::SeqCst), 0);
@@ -1195,11 +1216,14 @@ fn record_tree_validation_refuses_what_decrypt_record_refuses() {
     let plan = plan();
     let record = block_on(ops::encrypt_record(
         &cipher.default_keyset(),
-        &encode(row(29, "alice")),
-        &plan,
+        &protect(&encode(row(29, "alice"))),
+        &protect(&plan),
     ))
     .expect("encrypt record");
-    assert_eq!(ops::validate::record_tree(&record, &plan, None), Ok(()));
+    assert_eq!(
+        ops::validate::record_tree(&record, &protect(&plan), None),
+        Ok(())
+    );
 
     type Node = stack_encrypt::Node<Vec<u8>>;
     // The tree is not `Clone`; every variant decodes the record afresh.
@@ -1254,7 +1278,7 @@ fn record_tree_validation_refuses_what_decrypt_record_refuses() {
     ] {
         let tree = re_encode(tree);
         assert_eq!(
-            ops::validate::record_tree(&tree, &plan, None),
+            ops::validate::record_tree(&tree, &protect(&plan), None),
             Err(STATUS_ENCODING),
             "{label} must be refused by validation"
         );
@@ -1262,7 +1286,7 @@ fn record_tree_validation_refuses_what_decrypt_record_refuses() {
             block_on(ops::decrypt_record(
                 Scope::Client(&cipher),
                 &tree,
-                &plan,
+                &protect(&plan),
                 None
             )),
             Err(STATUS_ENCODING),
@@ -1281,8 +1305,8 @@ fn record_tree_validation_refuses_what_decrypt_record_refuses() {
 /// declaration it writes.
 #[test]
 fn plan_check_answers_without_a_cipher() {
-    assert_eq!(ops::plan_check(&plan()), Ok(()));
-    assert_eq!(ops::plan_check(&extended_plan()), Ok(()));
+    assert_eq!(ops::plan_check(&protect(&plan())), Ok(()));
+    assert_eq!(ops::plan_check(&protect(&extended_plan())), Ok(()));
 
     // match over an integer: a type that does not admit one of its indexes.
     let bad_index = encode(obj(vec![(
@@ -1293,7 +1317,7 @@ fn plan_check_answers_without_a_cipher() {
             ("type", s("uint32")),
         ]),
     )]));
-    assert_eq!(ops::plan_check(&bad_index), Err(STATUS_ENCODING));
+    assert_eq!(ops::plan_check(&protect(&bad_index)), Err(STATUS_ENCODING));
 
     // an indexed field with no declared type: every term derives from one
     // declared kind, so the plan is refused before any value arrives.
@@ -1304,7 +1328,10 @@ fn plan_check_answers_without_a_cipher() {
             ("outputs", Tree::Array(vec![s("c"), s("eq")])),
         ]),
     )]));
-    assert_eq!(ops::plan_check(&untyped_index), Err(STATUS_ENCODING));
+    assert_eq!(
+        ops::plan_check(&protect(&untyped_index)),
+        Err(STATUS_ENCODING)
+    );
 
     // a one-segment context is not a label a fields plan can seal under.
     let one_segment = encode(obj(vec![(
@@ -1314,11 +1341,17 @@ fn plan_check_answers_without_a_cipher() {
             ("outputs", Tree::Array(vec![s("c")])),
         ]),
     )]));
-    assert_eq!(ops::plan_check(&one_segment), Err(STATUS_ENCODING));
+    assert_eq!(
+        ops::plan_check(&protect(&one_segment)),
+        Err(STATUS_ENCODING)
+    );
 
     // not a plan at all.
-    assert_eq!(ops::plan_check(&encode(s("users"))), Err(STATUS_ENCODING));
-    assert_eq!(ops::plan_check(b"\xff\xff"), Err(STATUS_ENCODING));
+    assert_eq!(
+        ops::plan_check(&protect(&encode(s("users")))),
+        Err(STATUS_ENCODING)
+    );
+    assert_eq!(ops::plan_check(&protect(b"\xff\xff")), Err(STATUS_ENCODING));
 }
 
 /// `targets` is the fixed wire shape: `{"targets": [...]}`. The build
@@ -1457,8 +1490,8 @@ fn a_query_term_is_the_term_of_the_index_that_answers_its_operator() {
     let term_of = |value: Tree, field: &str, kind: u32| {
         block_on(ops::term(
             &keyset,
-            &encode(value),
-            &encode(label(field)),
+            &protect(&encode(value)),
+            &protect(&encode(label(field))),
             kind,
         ))
         .expect("term")
@@ -1466,15 +1499,20 @@ fn a_query_term_is_the_term_of_the_index_that_answers_its_operator() {
     let query = |input: Tree, field: &str, operator: &str| {
         let input = encode(input);
         assert_eq!(
-            ops::validate::query_term(&input, &plan(), field.as_bytes(), operator.as_bytes()),
+            ops::validate::query_term(
+                &protect(&input),
+                &protect(&plan()),
+                field.as_bytes(),
+                operator.as_bytes()
+            ),
             Ok(()),
             "{operator} on {field} validates"
         );
         query_term_entries(
             &block_on(ops::query_term(
                 &keyset,
-                &input,
-                &plan(),
+                &protect(&input),
+                &protect(&plan()),
                 field.as_bytes(),
                 operator.as_bytes(),
             ))
@@ -1546,14 +1584,21 @@ fn equality_text_that_does_not_normalize_is_a_term_failure_before_any_cipher() {
     )]));
     let input = encode(s("a\u{0378}bc"));
     assert_eq!(
-        ops::validate::query_term(&input, &plan, b"email", b"eq"),
+        ops::validate::query_term(&protect(&input), &protect(&plan), b"email", b"eq"),
         Err(STATUS_TERM),
         "validation"
     );
     let cipher = cipher();
     let keyset = cipher.default_keyset();
     assert_eq!(
-        block_on(ops::query_term(&keyset, &input, &plan, b"email", b"eq")).map(|_| ()),
+        block_on(ops::query_term(
+            &keyset,
+            &protect(&input),
+            &protect(&plan),
+            b"email",
+            b"eq"
+        ))
+        .map(|_| ()),
         Err(STATUS_TERM),
         "the op"
     );
@@ -1598,15 +1643,20 @@ fn query_term_validation_refuses_what_the_query_op_refuses() {
     ] {
         let input = encode(input);
         assert_eq!(
-            ops::validate::query_term(&input, &plan(), field.as_bytes(), operator.as_bytes()),
+            ops::validate::query_term(
+                &protect(&input),
+                &protect(&plan()),
+                field.as_bytes(),
+                operator.as_bytes()
+            ),
             Err(status),
             "{what}: validation"
         );
         assert_eq!(
             block_on(ops::query_term(
                 &keyset,
-                &input,
-                &plan(),
+                &protect(&input),
+                &protect(&plan()),
                 field.as_bytes(),
                 operator.as_bytes()
             )),
@@ -1615,7 +1665,12 @@ fn query_term_validation_refuses_what_the_query_op_refuses() {
         );
     }
     assert_eq!(
-        ops::validate::query_term(&encode(Tree::UInt32(1)), &plan(), b"\xff", b"eq"),
+        ops::validate::query_term(
+            &protect(&encode(Tree::UInt32(1))),
+            &protect(&plan()),
+            b"\xff",
+            b"eq"
+        ),
         Err(STATUS_ENCODING),
         "a field name that is not UTF-8"
     );
@@ -1631,8 +1686,14 @@ fn verify_answers_a_page_in_one_call() {
         Tree::Null,
         s("malice"),
     ]));
-    let out =
-        ops::verify(&encode(s("alice")), &values, &plan(), b"name", b"matches").expect("verify");
+    let out = ops::verify(
+        &protect(&encode(s("alice"))),
+        &protect(&values),
+        &protect(&plan()),
+        b"name",
+        b"matches",
+    )
+    .expect("verify");
     let Tree::Array(verified) = decode(&out) else {
         panic!("a list");
     };
@@ -1681,9 +1742,9 @@ fn verify_answers_a_page_in_one_call() {
     ] {
         assert_eq!(
             ops::verify(
-                &encode(input),
-                &encode(values),
-                &plan(),
+                &protect(&encode(input)),
+                &protect(&encode(values)),
+                &protect(&plan()),
                 field.as_bytes(),
                 operator.as_bytes()
             ),
@@ -1693,9 +1754,9 @@ fn verify_answers_a_page_in_one_call() {
     }
     assert_eq!(
         ops::verify(
-            &encode(s("al")),
-            &encode(Tree::Array(vec![])),
-            &plan(),
+            &protect(&encode(s("al"))),
+            &protect(&encode(Tree::Array(vec![]))),
+            &protect(&plan()),
             b"name",
             b"matches"
         ),
@@ -1713,8 +1774,8 @@ fn target_limit_sizes_a_fetch_from_the_terms_bytes() {
     let keyset = cipher.default_keyset();
     let out = block_on(ops::query_term(
         &keyset,
-        &encode(s("ali")),
-        &plan(),
+        &protect(&encode(s("ali"))),
+        &protect(&plan()),
         b"name",
         b"matches",
     ))
@@ -1731,8 +1792,8 @@ fn target_limit_sizes_a_fetch_from_the_terms_bytes() {
     let limit = |stats: &[u8], term: &[u8], field: &str, operator: &str| {
         ops::target_limit(
             term,
-            stats,
-            &plan(),
+            &protect(stats),
+            &protect(&plan()),
             field.as_bytes(),
             operator.as_bytes(),
             10,
@@ -1916,8 +1977,8 @@ fn a_text_match_field_answers_matches_through_its_twin() {
     )]));
     let term = block_on(ops::query_term(
         &keyset,
-        &encode(s("Alice")),
-        &plan,
+        &protect(&encode(s("Alice"))),
+        &protect(&plan),
         b"name",
         b"matches",
     ))
@@ -1940,9 +2001,13 @@ fn a_text_match_field_answers_matches_through_its_twin() {
     );
 
     let verified = ops::verify(
-        &encode(s("ALICE")),
-        &encode(Tree::Array(vec![s("say alice"), s("alison"), Tree::Null])),
-        &plan,
+        &protect(&encode(s("ALICE"))),
+        &protect(&encode(Tree::Array(vec![
+            s("say alice"),
+            s("alison"),
+            Tree::Null,
+        ]))),
+        &protect(&plan),
         b"name",
         b"matches",
     )
@@ -1960,8 +2025,8 @@ fn a_text_match_field_answers_matches_through_its_twin() {
     };
     let limit = ops::target_limit(
         twin_bytes.as_slice(),
-        &encode(obj(vec![("rows", Tree::UInt64(1000))])),
-        &plan,
+        &protect(&encode(obj(vec![("rows", Tree::UInt64(1000))]))),
+        &protect(&plan),
         b"name",
         b"matches",
         10,
@@ -1975,8 +2040,8 @@ fn a_text_match_field_answers_matches_through_its_twin() {
     assert_eq!(
         block_on(ops::query_term(
             &keyset,
-            &encode(s("alice")),
-            &plan,
+            &protect(&encode(s("alice"))),
+            &protect(&plan),
             b"name",
             b"eq",
         ))
@@ -1988,7 +2053,8 @@ fn a_text_match_field_answers_matches_through_its_twin() {
 
 /// The operators of one field, each as `(operator, fidelity, arity, index)`.
 fn operators_of(plan: &[u8], field: &str) -> Vec<[String; 4]> {
-    let Tree::Array(items) = decode(&ops::operators(plan, field.as_bytes()).expect("operators"))
+    let Tree::Array(items) =
+        decode(&ops::operators(&protect(plan), field.as_bytes()).expect("operators"))
     else {
         panic!("operators are a list");
     };
@@ -2039,8 +2105,12 @@ fn a_fields_operators_are_the_queries_it_answers() {
             } else {
                 input.clone()
             };
-            let checked =
-                ops::validate::query_term(&encode(input), &plan(), field.as_bytes(), op.as_bytes());
+            let checked = ops::validate::query_term(
+                &protect(&encode(input)),
+                &protect(&plan()),
+                field.as_bytes(),
+                op.as_bytes(),
+            );
             if listed.iter().any(|l| l == op) {
                 assert_eq!(checked, Ok(()), "{field} {op} is listed and answered");
             } else {
@@ -2049,11 +2119,14 @@ fn a_fields_operators_are_the_queries_it_answers() {
         }
     }
     assert_eq!(
-        ops::operators(&plan(), b"phone"),
+        ops::operators(&protect(&plan()), b"phone"),
         Err(STATUS_ENCODING),
         "a field the plan lacks"
     );
-    assert_eq!(ops::operators(b"\xff", b"age"), Err(STATUS_ENCODING));
+    assert_eq!(
+        ops::operators(&protect(b"\xff"), b"age"),
+        Err(STATUS_ENCODING)
+    );
 }
 
 /// In the `eql` build a field that names an EQL type answers what the
@@ -2119,8 +2192,12 @@ fn a_context_field_record_opens_under_the_context_it_stores() {
         tenant_row("tenants/acme", 34),
         tenant_row("tenants/globex", 34),
     ]));
-    let record = block_on(ops::encrypt_record(&cipher.default_keyset(), &batch, &plan))
-        .expect("encrypt a batch of two tenants");
+    let record = block_on(ops::encrypt_record(
+        &cipher.default_keyset(),
+        &protect(&batch),
+        &protect(&plan),
+    ))
+    .expect("encrypt a batch of two tenants");
     assert_eq!(cipher.kms().generate_calls.load(Ordering::SeqCst), 1);
 
     // The same age under two tenants is two terms.
@@ -2141,7 +2218,7 @@ fn a_context_field_record_opens_under_the_context_it_stores() {
     let opened = block_on(ops::decrypt_record(
         Scope::Client(&cipher),
         &record,
-        &plan,
+        &protect(&plan),
         None,
     ))
     .expect("each record opens under the context it stores");
@@ -2164,7 +2241,7 @@ fn a_context_field_record_opens_under_the_context_it_stores() {
         block_on(ops::decrypt_record(
             Scope::Client(&cipher),
             &record,
-            &plan,
+            &protect(&plan),
             Some(acme.clone()),
         )),
         Err(STATUS_CONTEXT_MISMATCH),
@@ -2176,24 +2253,31 @@ fn a_context_field_record_opens_under_the_context_it_stores() {
         "refused before any key is retrieved"
     );
     assert_eq!(
-        ops::validate::record_tree(&record, &plan, Some(&acme)),
+        ops::validate::record_tree(&record, &protect(&plan), Some(&acme)),
         Err(STATUS_CONTEXT_MISMATCH),
         "and the boundary validation refuses it the same way"
     );
-    assert_eq!(ops::validate::record_tree(&record, &plan, None), Ok(()));
+    assert_eq!(
+        ops::validate::record_tree(&record, &protect(&plan), None),
+        Ok(())
+    );
 
     // One record stored under the expected context opens under it.
     let one = encode(tenant_row("tenants/acme", 35));
-    let record =
-        block_on(ops::encrypt_record(&cipher.default_keyset(), &one, &plan)).expect("encrypt one");
+    let record = block_on(ops::encrypt_record(
+        &cipher.default_keyset(),
+        &protect(&one),
+        &protect(&plan),
+    ))
+    .expect("encrypt one");
     assert_eq!(
-        ops::validate::record_tree(&record, &plan, Some(&acme)),
+        ops::validate::record_tree(&record, &protect(&plan), Some(&acme)),
         Ok(())
     );
     let opened = block_on(ops::decrypt_record(
         Scope::Client(&cipher),
         &record,
-        &plan,
+        &protect(&plan),
         Some(acme),
     ))
     .expect("the expected context opens it");
diff --git a/languages/golang/encrypt/guest/tests/support/mod.rs b/languages/golang/encrypt/guest/tests/support/mod.rs
index e21c00bcb..c1240de09 100644
--- a/languages/golang/encrypt/guest/tests/support/mod.rs
+++ b/languages/golang/encrypt/guest/tests/support/mod.rs
@@ -15,9 +15,14 @@ use stack_encrypt::dynamic::plaintext::{
     visit_map, visit_seq, Error as _, FixedType, Float, Int, Logical, MapSink, Physical, SeqSink,
     Sink, SourceError,
 };
-use stack_encrypt::{Controlled, Protected};
+use stack_encrypt::Controlled;
 use stack_encrypt::{DecodeError, Decrypt, Encrypt};
 
+/// Bytes a test sends, held as an export holds an input it took.
+pub(crate) fn protect(bytes: &[u8]) -> stack_encrypt::Protected<Vec<u8>> {
+    stack_encrypt::Protected::new(bytes.to_vec())
+}
+
 /// A value as a test spells it: each scalar at its own width, a logical
 /// scalar under its type. Equality is structural and variable-time, which
 /// is why this is test code; floats compare by bit pattern, so `-0.0` and a
@@ -80,7 +85,7 @@ impl PartialEq for Tree {
 impl Tree {
     /// The tree's frame, written by vitaminc's own frame writer, which
     /// refuses a repeated key.
-    pub(crate) fn to_frame(&self) -> Result<Protected<Vec<u8>>, FrameWriteError> {
+    pub(crate) fn to_frame(&self) -> Result<stack_encrypt::Buffer, FrameWriteError> {
         to_frame(self)
     }
 
@@ -141,7 +146,7 @@ fn write(value: &Tree, out: &mut Vec<u8>) {
 /// read back.
 pub(crate) fn value_of<T: serde::Serialize>(answer: &T) -> Tree {
     let frame = stack_encrypt::dynamic::frame::serde::to_vec(answer).expect("frames");
-    Tree::from_frame(&frame).expect("a value")
+    Tree::from_frame(stack_encrypt::Controlled::risky_ref(&frame)).expect("a value")
 }
 
 fn scalar<S: Sink>(sink: S, ty: Option<Logical>, value: &Tree) -> Result<S::Ok, S::Error> {
diff --git a/packages/eql/Cargo.lock b/packages/eql/Cargo.lock
index a71c1d4e3..870d24070 100644
--- a/packages/eql/Cargo.lock
+++ b/packages/eql/Cargo.lock
@@ -631,16 +631,16 @@ dependencies = [
 
 [[package]]
 name = "clww-ore"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b95747f5724666cb973b2ca0659e10b6083c11f99877c4727b4c9f534a591c74"
+checksum = "9527fcb65fbebc5a8f8987063c171bb37bb37fb628de1293e07c1b6e0a21a24f"
 dependencies = [
  "blake3",
  "hex",
  "subtle",
  "thiserror 1.0.69",
  "vitaminc-ore",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -1223,7 +1223,7 @@ dependencies = [
  "stack-kms",
  "tokio",
  "uuid",
- "vitaminc-aead 0.8.0",
+ "vitaminc-aead 0.9.0",
 ]
 
 [[package]]
@@ -1272,7 +1272,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2655,9 +2655,9 @@ dependencies = [
 
 [[package]]
 name = "ore-rs"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bd65962ec1409c09d20e1e016f4fe1b4ae2e2e58dba38c155538b2c0801a185"
+checksum = "b274b7a0bf081d51815ccc7b20fa3b023e5769e3446fe4de1e8e8044a4413201"
 dependencies = [
  "aes",
  "block-modes",
@@ -2667,12 +2667,12 @@ dependencies = [
  "rand 0.10.1",
  "subtle-ng",
  "thiserror 1.0.69",
- "vitaminc-context 0.8.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-hmac",
  "vitaminc-ore",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -3037,7 +3037,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3465,7 +3465,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3522,7 +3522,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4148,8 +4148,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -4165,7 +4165,7 @@ dependencies = [
  "clww-ore",
  "futures",
  "miette",
- "ore-rs 0.10.0",
+ "ore-rs 0.11.0",
  "rand 0.10.1",
  "rust_decimal",
  "serde",
@@ -4176,15 +4176,15 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-aead 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-aead 0.9.0",
  "vitaminc-aead-frame",
- "vitaminc-encrypt 0.8.0",
+ "vitaminc-encrypt 0.9.0",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-ore",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -4219,8 +4219,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -4369,10 +4369,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4975,16 +4975,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea37168a603d605732d0bf0672586139ab91736f767d7b85e173c84dcee19054"
+checksum = "e7aa53d696a9e1af61b36a60b92cc0dde7421f8f58787333d3c425a176af241c"
 dependencies = [
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-encrypt 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
- "vitaminc-traits 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-encrypt 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
+ "vitaminc-traits 0.9.0",
 ]
 
 [[package]]
@@ -5017,9 +5017,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9bb97fd543ee6a2b168e257ec69d0d274a775b1eaa3f856b5ac2941b01891c1"
+checksum = "efba1dac1efc04ffc09cba49e343e0fe656c88c32472a4206f2a6df284add33d"
 dependencies = [
  "bytes",
  "chrono",
@@ -5027,10 +5027,10 @@ dependencies = [
  "rust_decimal",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-aead-derive 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead-derive 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -5047,9 +5047,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0845a44c07ddc882ed47a0e92e04fc83496220f054b589ad0cbd215c5009e5b7"
+checksum = "a3c6575dac7701e578b375d16a0b693294d73847ed275c9b9962cf20c423ea10"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5058,13 +5058,13 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0299777255171712a296d59164691dc1e93d10bddaab6e248fede1790dfd2e"
+checksum = "ba4a3e8a2057ce32724b0d42f71e87ee348d13c818fc54a16c443b86c4fe8d9a"
 dependencies = [
  "serde",
- "vitaminc-aead 0.8.0",
- "zeroize",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -5079,12 +5079,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a630079ba2d50680ee5048addd430eda30613559809dd6d383551e6d3d299826"
+checksum = "5b407b3127be198a8da7d4d914c11215e1eae1b467cdf89eca8a7a296055e863"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -5117,72 +5117,72 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db45e073f92ae8ca27f8fe14270bc34c75e767559c2347098dacca95180d1ddd"
+checksum = "7fa0a3493624afd1490085448d6d09d22bf061954e9ab0db08837f423db3a58d"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5fa0ae8bbad85ae30fb5c91b0b72b694d59bf2c2c1e7ad799eda66fdbd67e7c"
+checksum = "ada61349172294efe0a71bf2af367969b4e196437b46c20c688aaf15f692bc2d"
 dependencies = [
  "hmac 0.13.0",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5a2d8875e0b8b35b7a4f9dd698bbd13c989837cea564b5a4cbb5371b78fa937"
+checksum = "f1d354f4ee3764be072eb02f4f8db79ed0ed467a7c6d9f2c6143823867bde347"
 dependencies = [
  "thiserror 2.0.20",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
 name = "vitaminc-ore"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05518b4d35cb0c592dad59afb11b8e883ea252449b9ae47ff5ddeff0ed49f75"
+checksum = "9a812b8e245352094c3c2113312cf86d0804b83f1e315bacd15571cd01703c8b"
 dependencies = [
  "thiserror 2.0.20",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-normalize",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916688478273ca3e5c6805b355534ce9263688391cd4ab23b08bef760039d325"
+checksum = "d1703452d837ef964ec1f20cc601265857245d72ac14426276d49c3106dd39b3"
 dependencies = [
  "mutants",
  "thiserror 2.0.20",
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-normalize",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -5219,9 +5219,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6edc22562a9bbff0ba9704a2c43670b2c7cb1637524c045c3ba6436ed00917f"
+checksum = "67a44502e43de42fbd95c12a35efbaea903eedcc7a3922fceacea93054f44485"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -5230,7 +5230,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.20",
- "vitaminc-protected-derive 0.8.0",
+ "vitaminc-protected-derive 0.9.1",
  "zeroize",
 ]
 
@@ -5258,9 +5258,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cce3a7d0ce6f57c0e82345f20e87f3737cccd3a70aec2a2ab49f68a3a5e24a"
+checksum = "f4315341c559af17bd773e8b4e32125a2025d7fbe3e31cbae49120ee1dcab02e"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -5299,16 +5299,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb253f783ce6f31a55a92f5a9f0526109b8caa6a465edb94244fd344a078c11"
+checksum = "71e32850b739b58a7064b50eb3db655de323f57f21c1fe74d5ccd4d308560563"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.20",
- "vitaminc-protected 0.8.0",
- "vitaminc-random-derives 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random-derives 0.9.0",
  "zeroize",
 ]
 
@@ -5336,9 +5336,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0b3615936d6dded4b775856f4b0fa229d745d183f0b3754ac80035f16c27d9"
+checksum = "1863fe02de3945047dc9094d3cadbde06becafa49aa95d5e475bf903c8d83981"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5379,17 +5379,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9098ee4b13446ef959583ee2f3c384df571b453179104f7b4960ffddf65ee9"
+checksum = "a715ef503b1b41801a6c23e9756ed3d5a1201fa632609bccfa2a7a41ab5386cf"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.20",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -5658,7 +5658,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/packages/eql/crates/eql-bindings/src/encryption/targets.rs b/packages/eql/crates/eql-bindings/src/encryption/targets.rs
index a1cb06544..c434fda50 100644
--- a/packages/eql/crates/eql-bindings/src/encryption/targets.rs
+++ b/packages/eql/crates/eql-bindings/src/encryption/targets.rs
@@ -742,8 +742,14 @@ impl<S: Plaintext> Plaintext for Option<S> {
     fn into_frame(self) -> Result<ValueFrame, Error> {
         match self {
             Some(value) => value.into_frame(),
-            None => ValueFrame::from_bytes(&[stack_encrypt::dynamic::frame::tags::NULL])
-                .map_err(|error| Error::Other(Box::new(error))),
+            None => {
+                let null =
+                    stack_encrypt::Protected::new([stack_encrypt::dynamic::frame::tags::NULL]);
+                ValueFrame::from_bytes(
+                    stack_encrypt::AsProtectedRef::as_protected_ref(&null).as_ref_of(),
+                )
+                .map_err(|error| Error::Other(Box::new(error)))
+            }
         }
     }
 }
diff --git a/packages/eql/tests/encryption/Cargo.toml b/packages/eql/tests/encryption/Cargo.toml
index 787f19abc..9ab1fea1c 100644
--- a/packages/eql/tests/encryption/Cargo.toml
+++ b/packages/eql/tests/encryption/Cargo.toml
@@ -31,7 +31,7 @@ stack-encrypt = { path = "../../../stack-encrypt", default-features = false, fea
 # `plaintext::Sink`, for a plaintext type with its own `Encrypt` impl; and
 # chrono's and rust_decimal's own sources, which seal the leaf a date,
 # timestamp or decimal from any other producer seals.
-vitaminc-aead = { version = "0.8.0", features = ["chrono", "rust_decimal"] }
+vitaminc-aead = { version = "0.9.0", features = ["chrono", "rust_decimal"] }
 chrono = { version = "0.4.44", default-features = false, features = ["std"] }
 rust_decimal = { version = "1", default-features = false, features = ["std"] }
 stack-kms = { path = "../../../stack-kms", default-features = false, features = ["test-support"] }
diff --git a/packages/eql/tests/encryption/tests/json_tree/elements.rs b/packages/eql/tests/encryption/tests/json_tree/elements.rs
index 5e4ea4359..37d19b9dd 100644
--- a/packages/eql/tests/encryption/tests/json_tree/elements.rs
+++ b/packages/eql/tests/encryption/tests/json_tree/elements.rs
@@ -24,6 +24,7 @@
 //!   included.
 
 use super::*;
+use stack_encrypt::AsProtectedRef as _;
 
 use eql_bindings::encryption::targets::{self as eql_targets, Target};
 use stack_encrypt::dynamic::{
@@ -122,11 +123,22 @@ fn contact_plan() -> record::Plan {
             "target": {"name": "JsonSearch", "options": {"ordered": [RELATIONSHIP, CALLS]}}
         }
     });
-    record::plan_with(&dynamic::frame::serde::to_vec(&wire).unwrap(), &Eql).unwrap()
+    record::plan_with(
+        dynamic::frame::serde::to_vec(&wire)
+            .unwrap()
+            .as_protected_ref(),
+        &Eql,
+    )
+    .unwrap()
 }
 
 pub(super) fn frame_of(value: &Value) -> ValueFrame {
-    ValueFrame::from_bytes(&dynamic::frame::serde::to_vec(value).unwrap()).unwrap()
+    ValueFrame::from_bytes(
+        dynamic::frame::serde::to_vec(value)
+            .unwrap()
+            .as_protected_ref(),
+    )
+    .unwrap()
 }
 
 /// The operand of `operator` on `profile` for `input`, as the SQL binds
@@ -189,7 +201,13 @@ fn layout_plan(sealed: bool) -> record::Plan {
             }}
         }
     });
-    record::plan_with(&dynamic::frame::serde::to_vec(&wire).unwrap(), &Eql).unwrap()
+    record::plan_with(
+        dynamic::frame::serde::to_vec(&wire)
+            .unwrap()
+            .as_protected_ref(),
+        &Eql,
+    )
+    .unwrap()
 }
 
 /// A contact with each field present when given.
diff --git a/packages/eql/tests/encryption/tests/json_tree/predicate.rs b/packages/eql/tests/encryption/tests/json_tree/predicate.rs
index 202937053..1e5a97c32 100644
--- a/packages/eql/tests/encryption/tests/json_tree/predicate.rs
+++ b/packages/eql/tests/encryption/tests/json_tree/predicate.rs
@@ -8,6 +8,7 @@
 
 use super::elements::{derive, eql_text, frame_of, Eql};
 use super::*;
+use stack_encrypt::AsProtectedRef as _;
 
 use stack_encrypt::dynamic::{self, record, OpSpec, Operand};
 use stack_encrypt::KeysetCipher;
@@ -35,7 +36,13 @@ fn people_plan() -> record::Plan {
             "target": {"name": "JsonSearch", "options": {"ordered": ORDERED}}
         }
     });
-    record::plan_with(&dynamic::frame::serde::to_vec(&wire).unwrap(), &Eql).unwrap()
+    record::plan_with(
+        dynamic::frame::serde::to_vec(&wire)
+            .unwrap()
+            .as_protected_ref(),
+        &Eql,
+    )
+    .unwrap()
 }
 
 /// Documents with every field absent, `null` or a value of the one type its
diff --git a/packages/eql/tests/encryption/tests/json_tree_data_plan.rs b/packages/eql/tests/encryption/tests/json_tree_data_plan.rs
index a52ab565a..30a5aa2aa 100644
--- a/packages/eql/tests/encryption/tests/json_tree_data_plan.rs
+++ b/packages/eql/tests/encryption/tests/json_tree_data_plan.rs
@@ -18,6 +18,7 @@
 
 mod common;
 
+use stack_encrypt::AsProtectedRef as _;
 use std::collections::BTreeMap;
 
 use eql_bindings::encryption::targets::{self as eql_targets, Target};
@@ -122,7 +123,13 @@ fn plan() -> record::Plan {
             }
         }
     });
-    record::plan_with(&dynamic::frame::serde::to_vec(&wire).unwrap(), &Eql).unwrap()
+    record::plan_with(
+        dynamic::frame::serde::to_vec(&wire)
+            .unwrap()
+            .as_protected_ref(),
+        &Eql,
+    )
+    .unwrap()
 }
 
 fn frame<T: Encrypt>(value: T) -> ValueFrame {
@@ -400,7 +407,7 @@ async fn a_document_does_not_open_under_another_column() {
     .await
     .unwrap();
     let other = record::plan_with(
-        &dynamic::frame::serde::to_vec(&json!({
+        (dynamic::frame::serde::to_vec(&json!({
             "profile": {
                 "context": ["users", "other"],
                 "type": "json",
@@ -411,7 +418,8 @@ async fn a_document_does_not_open_under_another_column() {
                 }
             }
         }))
-        .unwrap(),
+        .unwrap())
+        .as_protected_ref(),
         &Eql,
     )
     .unwrap();
@@ -488,7 +496,12 @@ fn input(entries: &[(&str, Value)]) -> ValueFrame {
         .iter()
         .map(|(k, v)| ((*k).to_owned(), v.clone()))
         .collect();
-    ValueFrame::from_bytes(&dynamic::frame::serde::to_vec(&object).unwrap()).unwrap()
+    ValueFrame::from_bytes(
+        dynamic::frame::serde::to_vec(&object)
+            .unwrap()
+            .as_protected_ref(),
+    )
+    .unwrap()
 }
 
 /// The data path's term for one operator and input on `profile`.
@@ -557,10 +570,11 @@ fn a_document_field_answers_the_json_operators() {
         ]
     );
     let unordered = record::plan_with(
-        &dynamic::frame::serde::to_vec(&json!({
+        (dynamic::frame::serde::to_vec(&json!({
             "profile": {"context": ["users", "profile"], "target": "JsonSearch"}
         }))
-        .unwrap(),
+        .unwrap())
+        .as_protected_ref(),
         &Eql,
     )
     .unwrap();
@@ -904,8 +918,12 @@ async fn open(
     request: Value,
     groups: Vec<Vec<String>>,
 ) -> Result<Vec<Vec<Value>>, stack_encrypt::Error> {
-    let request =
-        ValueFrame::from_bytes(&dynamic::frame::serde::to_vec(&request).unwrap()).unwrap();
+    let request = ValueFrame::from_bytes(
+        dynamic::frame::serde::to_vec(&request)
+            .unwrap()
+            .as_protected_ref(),
+    )
+    .unwrap();
     let rows = frame(&groups);
     let opened = dynamic::json_open(keyset, plan, "profile", request, rows, &Eql)
         .unwrap()
diff --git a/packages/eql/tests/encryption/tests/v4_date_time_numeric.rs b/packages/eql/tests/encryption/tests/v4_date_time_numeric.rs
index d8b503302..f8bf583db 100644
--- a/packages/eql/tests/encryption/tests/v4_date_time_numeric.rs
+++ b/packages/eql/tests/encryption/tests/v4_date_time_numeric.rs
@@ -15,6 +15,7 @@
 
 mod common;
 
+use stack_encrypt::AsProtectedRef as _;
 use std::str::FromStr;
 
 use chrono::{DateTime, NaiveDate, Utc};
@@ -939,7 +940,8 @@ async fn a_storage_only_type_stores_a_none_as_long_as_a_value() {
         "and an Option opens a value"
     );
 
-    let null = ValueFrame::from_bytes(&[0x00]).unwrap();
+    let null = stack_encrypt::Protected::new([0x00u8]);
+    let null = ValueFrame::from_bytes(null.as_protected_ref().as_ref_of()).unwrap();
     let named: date::Date = by_name(&keyset, "Date", null.clone()).await;
     assert_eq!(leaf_len(&named.c), leaf_len(&absent.c), "by name too");
     let opened = targets::decrypt(
@@ -989,7 +991,8 @@ fn refused_null(
     keyset: &stack_encrypt::KeysetCipher<'_, common::Observed>,
     name: &str,
 ) -> TargetError {
-    let null = ValueFrame::from_bytes(&[0x00]).unwrap();
+    let null = stack_encrypt::Protected::new([0x00u8]);
+    let null = ValueFrame::from_bytes(null.as_protected_ref().as_ref_of()).unwrap();
     refused(targets::encrypt(name, keyset, &label(), null))
 }
 
diff --git a/packages/eql/tests/timing/ore_block_v2/ctgen/Cargo.lock b/packages/eql/tests/timing/ore_block_v2/ctgen/Cargo.lock
index a600d1a03..a743e844b 100644
--- a/packages/eql/tests/timing/ore_block_v2/ctgen/Cargo.lock
+++ b/packages/eql/tests/timing/ore_block_v2/ctgen/Cargo.lock
@@ -407,9 +407,9 @@ dependencies = [
 
 [[package]]
 name = "ore-rs"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bd65962ec1409c09d20e1e016f4fe1b4ae2e2e58dba38c155538b2c0801a185"
+checksum = "b274b7a0bf081d51815ccc7b20fa3b023e5769e3446fe4de1e8e8044a4413201"
 dependencies = [
  "aes",
  "block-modes",
@@ -743,9 +743,9 @@ checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9bb97fd543ee6a2b168e257ec69d0d274a775b1eaa3f856b5ac2941b01891c1"
+checksum = "efba1dac1efc04ffc09cba49e343e0fe656c88c32472a4206f2a6df284add33d"
 dependencies = [
  "bytes",
  "futures-util",
@@ -760,9 +760,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0845a44c07ddc882ed47a0e92e04fc83496220f054b589ad0cbd215c5009e5b7"
+checksum = "a3c6575dac7701e578b375d16a0b693294d73847ed275c9b9962cf20c423ea10"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -771,9 +771,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a630079ba2d50680ee5048addd430eda30613559809dd6d383551e6d3d299826"
+checksum = "5b407b3127be198a8da7d4d914c11215e1eae1b467cdf89eca8a7a296055e863"
 dependencies = [
  "mutants",
  "vitaminc-protected",
@@ -781,9 +781,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5fa0ae8bbad85ae30fb5c91b0b72b694d59bf2c2c1e7ad799eda66fdbd67e7c"
+checksum = "ada61349172294efe0a71bf2af367969b4e196437b46c20c688aaf15f692bc2d"
 dependencies = [
  "hmac",
  "sha2",
@@ -794,9 +794,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5a2d8875e0b8b35b7a4f9dd698bbd13c989837cea564b5a4cbb5371b78fa937"
+checksum = "f1d354f4ee3764be072eb02f4f8db79ed0ed467a7c6d9f2c6143823867bde347"
 dependencies = [
  "thiserror 2.0.21",
  "unicode-general-category",
@@ -807,9 +807,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-ore"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05518b4d35cb0c592dad59afb11b8e883ea252449b9ae47ff5ddeff0ed49f75"
+checksum = "9a812b8e245352094c3c2113312cf86d0804b83f1e315bacd15571cd01703c8b"
 dependencies = [
  "thiserror 2.0.21",
  "unicode-general-category",
@@ -823,9 +823,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916688478273ca3e5c6805b355534ce9263688391cd4ab23b08bef760039d325"
+checksum = "d1703452d837ef964ec1f20cc601265857245d72ac14426276d49c3106dd39b3"
 dependencies = [
  "mutants",
  "thiserror 2.0.21",
@@ -835,9 +835,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6edc22562a9bbff0ba9704a2c43670b2c7cb1637524c045c3ba6436ed00917f"
+checksum = "44e61d6e58132793aace6898403ffa949bc06e388c1fc89c08d48ad0303133c3"
 dependencies = [
  "bitvec",
  "digest",
@@ -852,9 +852,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cce3a7d0ce6f57c0e82345f20e87f3737cccd3a70aec2a2ab49f68a3a5e24a"
+checksum = "a60e915eb16c115882ea4754cecc99d7bcd3d8a1bfb9b8e512af4b6f7dd14801"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -864,9 +864,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb253f783ce6f31a55a92f5a9f0526109b8caa6a465edb94244fd344a078c11"
+checksum = "71e32850b739b58a7064b50eb3db655de323f57f21c1fe74d5ccd4d308560563"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
@@ -879,9 +879,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0b3615936d6dded4b775856f4b0fa229d745d183f0b3754ac80035f16c27d9"
+checksum = "1863fe02de3945047dc9094d3cadbde06becafa49aa95d5e475bf903c8d83981"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/packages/eql/tests/timing/ore_block_v2/ctgen/Cargo.toml b/packages/eql/tests/timing/ore_block_v2/ctgen/Cargo.toml
index b5e23206e..586ce92b7 100644
--- a/packages/eql/tests/timing/ore_block_v2/ctgen/Cargo.toml
+++ b/packages/eql/tests/timing/ore_block_v2/ctgen/Cargo.toml
@@ -14,11 +14,11 @@ publish = false
 [dependencies]
 # ore-rs's `BlockOre`, whose 6-bit fixed-width and chained engines are what
 # EQL v4's `ore_block_v2` compares; the same version as the root Cargo.lock.
-# Since 0.10 a value reaches the engines only through vitaminc-ore, as it
+# Since ore-rs 0.10 a value reaches the engines only through vitaminc-ore, as it
 # does in stack-encrypt.
-ore-rs = { version = "=0.10.0", default-features = false }
-vitaminc-ore = "=0.8.0"
-vitaminc-protected = "=0.8.0"
+ore-rs = { version = "=0.11.0", default-features = false }
+vitaminc-ore = "=0.9.0"
+vitaminc-protected = "=0.9.0"
 rand = "0.8"
 hex = "0.4"
 
diff --git a/packages/stack-auth/fuzz/Cargo.lock b/packages/stack-auth/fuzz/Cargo.lock
index b24b8daa9..7fbe492aa 100644
--- a/packages/stack-auth/fuzz/Cargo.lock
+++ b/packages/stack-auth/fuzz/Cargo.lock
@@ -2626,8 +2626,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -3181,16 +3181,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea37168a603d605732d0bf0672586139ab91736f767d7b85e173c84dcee19054"
+checksum = "e7aa53d696a9e1af61b36a60b92cc0dde7421f8f58787333d3c425a176af241c"
 dependencies = [
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-encrypt 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
- "vitaminc-traits 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-encrypt 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
+ "vitaminc-traits 0.9.0",
 ]
 
 [[package]]
@@ -3210,18 +3210,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9bb97fd543ee6a2b168e257ec69d0d274a775b1eaa3f856b5ac2941b01891c1"
+checksum = "efba1dac1efc04ffc09cba49e343e0fe656c88c32472a4206f2a6df284add33d"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-aead-derive 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead-derive 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -3238,9 +3238,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0845a44c07ddc882ed47a0e92e04fc83496220f054b589ad0cbd215c5009e5b7"
+checksum = "a3c6575dac7701e578b375d16a0b693294d73847ed275c9b9962cf20c423ea10"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3259,12 +3259,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a630079ba2d50680ee5048addd430eda30613559809dd6d383551e6d3d299826"
+checksum = "5b407b3127be198a8da7d4d914c11215e1eae1b467cdf89eca8a7a296055e863"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -3283,15 +3283,15 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db45e073f92ae8ca27f8fe14270bc34c75e767559c2347098dacca95180d1ddd"
+checksum = "7fa0a3493624afd1490085448d6d09d22bf061954e9ab0db08837f423db3a58d"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -3314,9 +3314,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6edc22562a9bbff0ba9704a2c43670b2c7cb1637524c045c3ba6436ed00917f"
+checksum = "67a44502e43de42fbd95c12a35efbaea903eedcc7a3922fceacea93054f44485"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -3325,7 +3325,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.18",
- "vitaminc-protected-derive 0.8.0",
+ "vitaminc-protected-derive 0.9.1",
  "zeroize",
 ]
 
@@ -3342,9 +3342,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cce3a7d0ce6f57c0e82345f20e87f3737cccd3a70aec2a2ab49f68a3a5e24a"
+checksum = "f4315341c559af17bd773e8b4e32125a2025d7fbe3e31cbae49120ee1dcab02e"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -3369,16 +3369,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb253f783ce6f31a55a92f5a9f0526109b8caa6a465edb94244fd344a078c11"
+checksum = "71e32850b739b58a7064b50eb3db655de323f57f21c1fe74d5ccd4d308560563"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.18",
- "vitaminc-protected 0.8.0",
- "vitaminc-random-derives 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random-derives 0.9.0",
  "zeroize",
 ]
 
@@ -3395,9 +3395,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0b3615936d6dded4b775856f4b0fa229d745d183f0b3754ac80035f16c27d9"
+checksum = "1863fe02de3945047dc9094d3cadbde06becafa49aa95d5e475bf903c8d83981"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3422,17 +3422,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9098ee4b13446ef959583ee2f3c384df571b453179104f7b4960ffddf65ee9"
+checksum = "a715ef503b1b41801a6c23e9756ed3d5a1201fa632609bccfa2a7a41ab5386cf"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
diff --git a/packages/stack-encrypt/CHANGELOG.md b/packages/stack-encrypt/CHANGELOG.md
index 74b5d3df6..863f1e763 100644
--- a/packages/stack-encrypt/CHANGELOG.md
+++ b/packages/stack-encrypt/CHANGELOG.md
@@ -17,6 +17,90 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   different terms and silently miss those old rows: they return no error. Keep
   the final extension alone for both reads and queries of old data, or re-encrypt
   and re-index it under the appended context. This does not migrate stored data.
+- **stack-encrypt requires the vitaminc 0.9 crates (vitaminc-protected
+  0.9.1), clww-ore 0.7 and ore-rs 0.11.** If your crate names a vitaminc type that stack-encrypt takes
+  or returns, move it to vitaminc 0.9 too. No sealed bytes, terms, or stored
+  formats change. Two parts of this crate's API change:
+  - The re-exported frame codec, `stack_encrypt::dynamic::frame`, now writes
+    into a `vitaminc_protected::Buffer`, not a `Vec<u8>`. A `Buffer` wipes each
+    allocation it outgrows. `serde::to_vec` returns a `Buffer`, and
+    `FrameWriter` writes into one. `Buffer` is re-exported as
+    `stack_encrypt::Buffer`. `ValueFrame::into_inner` still returns
+    `Protected<Vec<u8>>`.
+  - The frame readers take a `ProtectedRef<'_, [u8]>` in place of a
+    `&[u8]`: `dynamic::context`, `record::plan`, `record::plan_with`,
+    `ValueFrame::from_bytes`, `ValueFrame::check`, `IndexSpec::from_frame`,
+    and `op::Stats::from_frame`. Pass a `Buffer` or a `ValueFrame` with
+    `.as_protected_ref()`, and a `Protected<Vec<u8>>` with
+    `.as_protected_ref().as_deref()`. Bytes that arrive as a plain `Vec<u8>`
+    or `&[u8]` go into a `Protected` first. The `Protected` wipes them. So a caller
+    never reads the bytes with `risky_ref` to pass them to a reader. This
+    needs vitaminc-protected 0.9.1. `AsProtectedRef` and `ProtectedRef` are
+    re-exported from the crate root, and `ValueFrame` now implements
+    `AsProtectedRef<'_, [u8]>`.
+  - `ValueFrame::of` no longer names a repeated map key outside a
+    passthrough. `ValueFrame::of` returns `DecodeError::Source` in place of
+    `DecodeError::DuplicateKey(key)`, and the source error is
+    `FrameWriteError::DuplicateKey`.
+    The vitaminc 0.9 writer does not copy the key out of the frame, because
+    the key is plaintext. A record source still reports `Reason::RepeatedKey`
+    for the field.
+
+### Added
+
+- **Owned collections: `EncryptInto` encrypts a `Vec<S>` into a `Vec<T>`,
+  and `DecryptFrom` decrypts it back** (#1482). `Vec<T>` implements
+  `EncryptTarget<Vec<S>>` and `DecryptSource<Vec<P>>` for any owned element
+  target. For example, `vec![29i32, 34].encrypt_into::<Vec<Ciphertext>, _>(&keyset)`
+  needs no caller context, and `Vec::<i32>::decrypt_from(ciphertexts, &keyset)`
+  decrypts the result.
+  - A collection uses its element target's `ContextInput`. A collection of a
+    `RequiredContext` target must be given a context, and a collection of a
+    `NoCallerContext` target cannot be given one. `Default` does not change
+    either rule.
+  - Each element is encrypted under its own data key and authenticated on
+    its own. An element's position and the number of elements are not
+    authenticated. That suits the common case of storing each element in its
+    own database row. A query can return rows in any order, or only some of
+    them.
+  - A collection makes one logical batch of key requests, in element order.
+    That is one `generate_keys` call to encrypt it, and one `retrieve_keys`
+    call for each keyset to decrypt it. An empty collection makes no call. The key
+    source can still split a logical batch into several requests to its
+    provider.
+  - The plaintext `Vec` is wiped before the pending request is returned, even
+    when the context is refused. The elements do not need to implement
+    `Clone`.
+  - If an element fails after earlier elements were decrypted, the earlier
+    plaintexts are wiped before the error is returned. If an element's
+    conversion panics, they are wiped before the panic unwinds.
+  - A `Vec<u8>` is not a collection of bytes. A `Vec<u8>` is one byte
+    string, as the next entry describes.
+  - `keyset.encrypt` still takes a single value, and `encrypt_tree` is still
+    the structural path.
+- **Byte strings encrypt as one value: `Vec<u8>` and `[u8; N]` encrypt into
+  one `Ciphertext`, and a `Vec<Vec<u8>>` encrypts into a `Vec<Ciphertext>`.** So
+  `keyset.encrypt(vec![1u8, 2, 3])` and
+  `Vec::<u8>::decrypt_from(ciphertext, &keyset)` now compile. The structural
+  API and the Go SDK already encrypted byte strings this way.
+  - `OpaqueEncode` is now implemented for every owned `Zeroize` type whose
+    borrow is a Vitamin C `plaintext::Scalar`. A `Scalar` is a type that
+    Vitamin C encrypts as a single value. `OpaqueDecode` is implemented for
+    every `Zeroize` type that implements `FromScalar`.
+  - Before this change, both traits were implemented for a list of types
+    kept by hand. That list did not include the byte strings that Vitamin C
+    treats as single values.
+  - Your own type becomes an `OpaqueEncode` type if its borrow implements
+    `Scalar` and the type implements `Zeroize`.
+  - `u8` alone, and a `Vec` of any type other than `u8`, still do not encrypt
+    into one `Ciphertext`.
+- **`ValueFrame` implements `PartialEq`, comparing frames in constant time.**
+  Two frames are equal when their bytes are. So `34u32` and `34u64` are not
+  equal. Two maps with their keys in a different order are not equal either. Frames
+  of different lengths are unequal at once. The frame is now held in an
+  `Equatable<Protected<Vec<u8>>>`. Until vitaminc-protected implements
+  `ConstantTimeEq` for `Vec<u8>` (cipherstash/vitaminc#602), the bytes are
+  compared through `TimingSafeEq`.
 
 ## [0.3.0] - 2026-10-27
 
diff --git a/packages/stack-encrypt/examples/scalar.rs b/packages/stack-encrypt/examples/scalar.rs
index 1d11733cd..20b30c8d8 100644
--- a/packages/stack-encrypt/examples/scalar.rs
+++ b/packages/stack-encrypt/examples/scalar.rs
@@ -29,5 +29,18 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .await?;
     let value = i32::decrypt_from_with_context(encrypted, &keyset, ("users", "age")).await?;
     assert_eq!(value, 42);
+
+    // A column of scalars: one logical batch, each element its own ciphertext.
+    let ages: Vec<Ciphertext> = vec![29i32, 34, 41].encrypt_into(&keyset).await?;
+    let one: i32 = keyset.decrypt(ages[1].clone()).await?;
+    assert_eq!(one, 34);
+    let values = Vec::<i32>::decrypt_from(ages, &keyset).await?;
+    assert_eq!(values, [29, 34, 41]);
+
+    let names: Vec<Ciphertext> = vec!["ada".to_owned(), "grace".to_owned()]
+        .encrypt_into_with_context(&keyset, ("users", "name"))
+        .await?;
+    let names = Vec::<String>::decrypt_from_with_context(names, &keyset, ("users", "name")).await?;
+    assert_eq!(names, ["ada", "grace"]);
     Ok(())
 }
diff --git a/packages/stack-encrypt/fuzz/Cargo.lock b/packages/stack-encrypt/fuzz/Cargo.lock
index a4dd39004..9254732a4 100644
--- a/packages/stack-encrypt/fuzz/Cargo.lock
+++ b/packages/stack-encrypt/fuzz/Cargo.lock
@@ -366,16 +366,16 @@ dependencies = [
 
 [[package]]
 name = "clww-ore"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b95747f5724666cb973b2ca0659e10b6083c11f99877c4727b4c9f534a591c74"
+checksum = "9527fcb65fbebc5a8f8987063c171bb37bb37fb628de1293e07c1b6e0a21a24f"
 dependencies = [
  "blake3",
  "hex",
  "subtle",
  "thiserror 1.0.69",
  "vitaminc-ore",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -1475,9 +1475,9 @@ dependencies = [
 
 [[package]]
 name = "ore-rs"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bd65962ec1409c09d20e1e016f4fe1b4ae2e2e58dba38c155538b2c0801a185"
+checksum = "b274b7a0bf081d51815ccc7b20fa3b023e5769e3446fe4de1e8e8044a4413201"
 dependencies = [
  "aes",
  "block-modes",
@@ -1487,12 +1487,12 @@ dependencies = [
  "rand 0.10.1",
  "subtle-ng",
  "thiserror 1.0.69",
- "vitaminc-context 0.8.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-hmac",
  "vitaminc-ore",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -2066,8 +2066,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -2092,15 +2092,15 @@ dependencies = [
  "stack-kms",
  "thiserror 1.0.69",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-aead 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-aead 0.9.0",
  "vitaminc-aead-frame",
- "vitaminc-encrypt 0.8.0",
+ "vitaminc-encrypt 0.9.0",
  "vitaminc-hmac",
  "vitaminc-normalize",
  "vitaminc-ore",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
@@ -2122,8 +2122,8 @@ dependencies = [
  "serde_json",
  "stack-encrypt",
  "uuid",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2148,8 +2148,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2594,16 +2594,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea37168a603d605732d0bf0672586139ab91736f767d7b85e173c84dcee19054"
+checksum = "e7aa53d696a9e1af61b36a60b92cc0dde7421f8f58787333d3c425a176af241c"
 dependencies = [
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-encrypt 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
- "vitaminc-traits 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-encrypt 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
+ "vitaminc-traits 0.9.0",
 ]
 
 [[package]]
@@ -2623,18 +2623,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9bb97fd543ee6a2b168e257ec69d0d274a775b1eaa3f856b5ac2941b01891c1"
+checksum = "efba1dac1efc04ffc09cba49e343e0fe656c88c32472a4206f2a6df284add33d"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-aead-derive 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead-derive 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -2651,9 +2651,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0845a44c07ddc882ed47a0e92e04fc83496220f054b589ad0cbd215c5009e5b7"
+checksum = "a3c6575dac7701e578b375d16a0b693294d73847ed275c9b9962cf20c423ea10"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2662,13 +2662,13 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-frame"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0299777255171712a296d59164691dc1e93d10bddaab6e248fede1790dfd2e"
+checksum = "ba4a3e8a2057ce32724b0d42f71e87ee348d13c818fc54a16c443b86c4fe8d9a"
 dependencies = [
  "serde",
- "vitaminc-aead 0.8.0",
- "zeroize",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2683,12 +2683,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a630079ba2d50680ee5048addd430eda30613559809dd6d383551e6d3d299826"
+checksum = "5b407b3127be198a8da7d4d914c11215e1eae1b467cdf89eca8a7a296055e863"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2707,72 +2707,72 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db45e073f92ae8ca27f8fe14270bc34c75e767559c2347098dacca95180d1ddd"
+checksum = "7fa0a3493624afd1490085448d6d09d22bf061954e9ab0db08837f423db3a58d"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-hmac"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5fa0ae8bbad85ae30fb5c91b0b72b694d59bf2c2c1e7ad799eda66fdbd67e7c"
+checksum = "ada61349172294efe0a71bf2af367969b4e196437b46c20c688aaf15f692bc2d"
 dependencies = [
  "hmac",
  "sha2 0.11.0",
  "vitaminc-prf",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-normalize"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5a2d8875e0b8b35b7a4f9dd698bbd13c989837cea564b5a4cbb5371b78fa937"
+checksum = "f1d354f4ee3764be072eb02f4f8db79ed0ed467a7c6d9f2c6143823867bde347"
 dependencies = [
  "thiserror 2.0.18",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
 name = "vitaminc-ore"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05518b4d35cb0c592dad59afb11b8e883ea252449b9ae47ff5ddeff0ed49f75"
+checksum = "9a812b8e245352094c3c2113312cf86d0804b83f1e315bacd15571cd01703c8b"
 dependencies = [
  "thiserror 2.0.18",
  "unicode-general-category",
  "unicode-normalization",
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-normalize",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-prf"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916688478273ca3e5c6805b355534ce9263688391cd4ab23b08bef760039d325"
+checksum = "d1703452d837ef964ec1f20cc601265857245d72ac14426276d49c3106dd39b3"
 dependencies = [
  "mutants",
  "thiserror 2.0.18",
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
  "vitaminc-normalize",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2794,9 +2794,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6edc22562a9bbff0ba9704a2c43670b2c7cb1637524c045c3ba6436ed00917f"
+checksum = "67a44502e43de42fbd95c12a35efbaea903eedcc7a3922fceacea93054f44485"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2805,7 +2805,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.18",
- "vitaminc-protected-derive 0.8.0",
+ "vitaminc-protected-derive 0.9.1",
  "zeroize",
 ]
 
@@ -2822,9 +2822,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cce3a7d0ce6f57c0e82345f20e87f3737cccd3a70aec2a2ab49f68a3a5e24a"
+checksum = "f4315341c559af17bd773e8b4e32125a2025d7fbe3e31cbae49120ee1dcab02e"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2849,16 +2849,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb253f783ce6f31a55a92f5a9f0526109b8caa6a465edb94244fd344a078c11"
+checksum = "71e32850b739b58a7064b50eb3db655de323f57f21c1fe74d5ccd4d308560563"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.18",
- "vitaminc-protected 0.8.0",
- "vitaminc-random-derives 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random-derives 0.9.0",
  "zeroize",
 ]
 
@@ -2875,9 +2875,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0b3615936d6dded4b775856f4b0fa229d745d183f0b3754ac80035f16c27d9"
+checksum = "1863fe02de3945047dc9094d3cadbde06becafa49aa95d5e475bf903c8d83981"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2902,17 +2902,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9098ee4b13446ef959583ee2f3c384df571b453179104f7b4960ffddf65ee9"
+checksum = "a715ef503b1b41801a6c23e9756ed3d5a1201fa632609bccfa2a7a41ab5386cf"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
diff --git a/packages/stack-encrypt/fuzz/Cargo.toml b/packages/stack-encrypt/fuzz/Cargo.toml
index 8b47f231a..dfbe55b4a 100644
--- a/packages/stack-encrypt/fuzz/Cargo.toml
+++ b/packages/stack-encrypt/fuzz/Cargo.toml
@@ -17,9 +17,9 @@ cargo-fuzz = true
 [dependencies]
 # `Controlled`, to take a passthrough node's frame out of its wrapper: the
 # same line stack-encrypt builds on.
-vitaminc-protected = "0.8.0"
+vitaminc-protected = "0.9.1"
 # The sinks the record harness writes its plans and passthroughs through.
-vitaminc-aead = "0.8.0"
+vitaminc-aead = "0.9.0"
 libfuzzer-sys = "0.4"
 # Structure-aware inputs for `check_record` and `plan_build`: the mirror
 # types derive `Arbitrary`, so the fuzzer mutates trees and plans, not bytes.
diff --git a/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs b/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
index 2bce08130..19eff4853 100644
--- a/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
+++ b/packages/stack-encrypt/fuzz/fuzz_targets/check_record.rs
@@ -41,7 +41,7 @@ use stack_encrypt::{
 };
 use uuid::Uuid;
 use vitaminc_aead::plaintext::{visit_map, Physical, Raw, Sink};
-use vitaminc_protected::Controlled;
+use vitaminc_protected::{AsProtectedRef as _, Controlled};
 
 /// A value as a binding sends it: its frame. `None` for a value no frame
 /// carries (an object with a key given twice, or one nested too deep),
@@ -428,7 +428,7 @@ fuzz_target!(|case: Case| {
     let Some(frame) = spec.into_value() else {
         return;
     };
-    let Ok(plan) = plan_with(frame.risky_ref(), &Fixed) else {
+    let Ok(plan) = plan_with(frame.as_protected_ref(), &Fixed) else {
         if trace {
             eprintln!("verdict: plan refused");
         }
diff --git a/packages/stack-encrypt/src/dynamic/context.rs b/packages/stack-encrypt/src/dynamic/context.rs
index 3b2d1493b..079675b84 100644
--- a/packages/stack-encrypt/src/dynamic/context.rs
+++ b/packages/stack-encrypt/src/dynamic/context.rs
@@ -74,11 +74,11 @@ use crate::{ContextPiece, NonEmpty};
 ///
 /// ```
 /// use stack_encrypt::dynamic::context;
-/// use stack_encrypt::{nonempty, IntoAad};
+/// use stack_encrypt::{nonempty, AsProtectedRef, IntoAad};
 ///
 /// // `[["users", "age"], 7u64]`, as a binding writes it.
 /// let frame = vitaminc_aead_frame::serde::to_vec(&(("users", "age"), 7u64))?;
-/// let parsed = context(&frame)?;
+/// let parsed = context(frame.as_protected_ref())?;
 /// let typed = nonempty!("users").with("age").with(7u64);
 /// assert_eq!(
 ///     parsed.into_inner().into_aad().as_bytes(),
@@ -93,8 +93,10 @@ use crate::{ContextPiece, NonEmpty};
 /// ([`Reason::ContextKind`]), including bytes that are not one frame, and
 /// for a context that renders empty ([`Reason::EmptyContext`]). It names no
 /// field: the caller that knows the field names it ([`Error::in_field`]).
-pub fn context(frame: &[u8]) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
-    let Context(piece) = vitaminc_aead_frame::serde::from_slice(frame)
+pub fn context(
+    frame: vitaminc_protected::ProtectedRef<'_, [u8]>,
+) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
+    let Context(piece) = vitaminc_aead_frame::serde::from_slice(frame.risky_ref())
         .map_err(|_| Error::bad_context(Reason::ContextKind))?;
     non_empty(piece)
 }
@@ -228,6 +230,8 @@ mod tests {
     use crate::dynamic::test_frame::Tree;
     use crate::{nonempty, Descriptor, IntoAad, IntoPrfContext};
     use vitaminc_aead_frame::serde::to_vec;
+    use vitaminc_protected::AsProtectedRef as _;
+    use vitaminc_protected::Protected;
 
     fn s(value: &str) -> Tree {
         Tree::String(value.into())
@@ -235,7 +239,7 @@ mod tests {
 
     /// The context `value` spells, read from its frame.
     fn ctx(value: Tree) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
-        context(&frame_of(&value))
+        context(frame_of(&value).as_protected_ref().as_deref())
     }
 
     /// `borrowed` is a view, so it must be the same context for every
@@ -546,7 +550,9 @@ mod tests {
     /// refused rather than widened.
     #[test]
     fn an_integer_is_read_at_its_own_width() {
-        let read = |frame: Vec<u8>| context(&frame).map(NonEmpty::into_inner);
+        let read = |frame: vitaminc_protected::Buffer| {
+            context(frame.as_protected_ref()).map(NonEmpty::into_inner)
+        };
         assert_eq!(read(to_vec(&7i32).unwrap()).unwrap(), ContextPiece::I32(7));
         assert_eq!(read(to_vec(&7i64).unwrap()).unwrap(), ContextPiece::I64(7));
         assert_eq!(read(to_vec(&7u32).unwrap()).unwrap(), ContextPiece::U32(7));
@@ -591,7 +597,7 @@ mod tests {
         let mut bytes = vec![vitaminc_aead::frame::ARRAY];
         bytes.extend_from_slice(&u32::MAX.to_le_bytes());
         assert!(matches!(
-            context(&bytes),
+            context(Protected::new(bytes.to_vec()).as_protected_ref().as_deref()),
             Err(Error::Context {
                 reason: Reason::ContextKind,
                 ..
@@ -602,9 +608,13 @@ mod tests {
     /// Bytes that are not one frame are not a context.
     #[test]
     fn bytes_that_are_not_a_frame_are_refused() {
-        for bytes in [&[][..], &[0xff, 1, 2], &to_vec(&"a").unwrap()[..2]] {
+        for bytes in [
+            &[][..],
+            &[0xff, 1, 2],
+            &crate::Controlled::risky_ref(&to_vec(&"a").unwrap())[..2],
+        ] {
             assert!(matches!(
-                context(bytes),
+                context(Protected::new(bytes.to_vec()).as_protected_ref().as_deref()),
                 Err(Error::Context {
                     reason: Reason::ContextKind,
                     ..
diff --git a/packages/stack-encrypt/src/dynamic/kind.rs b/packages/stack-encrypt/src/dynamic/kind.rs
index 633a56538..935f5c43c 100644
--- a/packages/stack-encrypt/src/dynamic/kind.rs
+++ b/packages/stack-encrypt/src/dynamic/kind.rs
@@ -173,7 +173,7 @@ fn scalar_of(kind: ValueKind) -> Option<(Option<Logical>, Physical<'static>)> {
 /// // A JavaScript number is a float; against a `uint64` field it is 34.
 /// let value = read(ValueKind::UInt64, 34.0f64)?;
 /// assert_eq!(value.kind(), Some(ValueKind::UInt64));
-/// assert_eq!(value.risky_ref(), ValueFrame::of(34u64)?.risky_ref());
+/// assert_eq!(value, ValueFrame::of(34u64)?);
 /// assert!(read(ValueKind::UInt64, 34.5f64).is_err());
 /// // Against an `int8` field, 34 is the 8-bit integer; 300 does not fit.
 /// assert_eq!(read(ValueKind::Int8, 34i64)?.kind(), Some(ValueKind::Int8));
diff --git a/packages/stack-encrypt/src/dynamic/query.rs b/packages/stack-encrypt/src/dynamic/query.rs
index e678d0a63..2d2df71ce 100644
--- a/packages/stack-encrypt/src/dynamic/query.rs
+++ b/packages/stack-encrypt/src/dynamic/query.rs
@@ -184,6 +184,7 @@ pub enum OpSpec {
     /// ```
     /// use serde_json::json;
     /// use stack_encrypt::dynamic::{check_query, frame, record, OpSpec, Reason, ValueFrame};
+    /// use stack_encrypt::AsProtectedRef;
     /// # use stack_encrypt::dynamic::{TargetDescriptor, TargetError, TargetOptions, TargetResolver, ValueKind};
     /// # use stack_encrypt::target::IndexSpec;
     /// # use stack_encrypt::{KeysetCipher, Label, Pending, StackCipher};
@@ -208,18 +209,16 @@ pub enum OpSpec {
     /// #     ) -> Result<Pending<'a, Vec<u8>, K>, TargetError> { unreachable!() }
     /// # }
     /// // A document field that orders `$.age`.
-    /// let plan = record::plan_with(
-    ///     &frame::serde::to_vec(&json!({"profile": {
-    ///         "context": ["users", "profile"], "type": "json", "null": "sql",
-    ///         "target": {"name": "JsonSearch", "options": {"ordered": ["$.age"]}}
-    ///     }}))?,
-    ///     &Documents,
-    /// )?;
+    /// let declaration = frame::serde::to_vec(&json!({"profile": {
+    ///     "context": ["users", "profile"], "type": "json", "null": "sql",
+    ///     "target": {"name": "JsonSearch", "options": {"ordered": ["$.age"]}}
+    /// }}))?;
+    /// let plan = record::plan_with(declaration.as_protected_ref(), &Documents)?;
     /// // What `jsonb_path_match(col, $1, $2)` takes: the predicate, and its
     /// // variables as the JSON text of one object.
     /// let input = |predicate: &str| -> ValueFrame {
     ///     let input = json!({"predicate": predicate, "vars": r#"{"min": 18, "r": "sibling"}"#});
-    ///     ValueFrame::from_bytes(&frame::serde::to_vec(&input).unwrap()).unwrap()
+    ///     ValueFrame::from_bytes(frame::serde::to_vec(&input).unwrap().as_protected_ref()).unwrap()
     /// };
     /// let check = |predicate: &str| {
     ///     check_query(&plan, "profile", OpSpec::Match, input(predicate), &Documents)
@@ -787,10 +786,12 @@ fn answers(
 /// ```
 /// use stack_encrypt::dynamic::{field_operators, record, NoTargets, OpSpec};
 /// use stack_encrypt::target::IndexSpec;
+/// use stack_encrypt::AsProtectedRef;
 ///
-/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+/// let declaration = vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
 ///     "age": { "context": ["users", "age"], "outputs": ["c", "eq", "ore"], "type": "uint32" },
-/// }))?)?;
+/// }))?;
+/// let plan = record::plan(declaration.as_protected_ref())?;
 ///
 /// let operators = field_operators(&plan, "age", &NoTargets)?;
 /// assert_eq!(operators[0], (OpSpec::Eq, IndexSpec::Equality));
@@ -1191,14 +1192,15 @@ where
 /// ```
 /// use stack_encrypt::dynamic::{query_term, record, NoTargets, OpSpec, Operand};
 /// use stack_encrypt::kms::FakeDataKeySource;
-/// use stack_encrypt::{op, Ore, Plan, StackCipher};
+/// use stack_encrypt::{op, AsProtectedRef, Ore, Plan, StackCipher};
 ///
 /// # tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(async {
 /// let cipher = StackCipher::builder().kms(FakeDataKeySource::new()).init().await?;
 /// let keyset = cipher.default_keyset();
-/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+/// let declaration = vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
 ///     "age": { "context": ["users", "age"], "outputs": ["c", "ore"], "type": "uint32" },
-/// }))?)?;
+/// }))?;
+/// let plan = record::plan(declaration.as_protected_ref())?;
 ///
 /// let term = query_term(&keyset, &plan, "age", OpSpec::Lt, 40u32, &NoTargets)?.await?;
 ///
@@ -1470,8 +1472,8 @@ impl Stats {
     /// [`Error::Source`] with [`Reason::NotStats`] for anything else: not a
     /// frame, not an object, no `rows`, a key given twice or not one of the
     /// three, or a value of another type.
-    pub fn from_frame(bytes: &[u8]) -> Result<Self, Error> {
-        let wire: StatsWire = vitaminc_aead_frame::serde::from_slice(bytes)
+    pub fn from_frame(bytes: vitaminc_protected::ProtectedRef<'_, [u8]>) -> Result<Self, Error> {
+        let wire: StatsWire = vitaminc_aead_frame::serde::from_slice(bytes.risky_ref())
             .map_err(|_| Error::bad_source(Reason::NotStats))?;
         let stats = match wire.histogram {
             Some(histogram) => Stats::measured(wire.rows, histogram),
@@ -1523,6 +1525,7 @@ mod tests {
     use super::*;
     use crate::dynamic::test_frame::Tree;
     use crate::dynamic::test_frame::{frame_of, value_of};
+    use vitaminc_protected::AsProtectedRef as _;
 
     fn operator_value(operator: OpSpec, index: &IndexSpec) -> Tree {
         value_of(&OperatorEntry::new(operator, index))
@@ -1530,7 +1533,11 @@ mod tests {
 
     /// Statistics as a binding sends them.
     fn stats_frame(value: &Tree) -> Result<Stats, Error> {
-        Stats::from_frame(&crate::dynamic::test_frame::frame_of(value))
+        Stats::from_frame(
+            crate::dynamic::test_frame::frame_of(value)
+                .as_protected_ref()
+                .as_deref(),
+        )
     }
     use crate::dynamic::{record, NoTargets, TargetError};
     use crate::op::{self, Probabilistic as _};
@@ -1577,16 +1584,20 @@ mod tests {
             "match".into(),
             Tree::Object(vec![("downcase".into(), Tree::Bool(false))]),
         )]);
-        record::plan(&frame_of(&Tree::Object(vec![
-            field("email", "string", vec![text("c"), text("eq")]),
-            field("name", "string", vec![text("c"), text("match")]),
-            field("age", "uint32", vec![text("c"), text("ope"), text("ore")]),
-            field("score", "int64", vec![text("ope")]),
-            field("nickname", "string", vec![text("c"), text("ore")]),
-            field("handle", "string", vec![text("c"), case_sensitive]),
-            field("ratio", "float32", vec![text("c"), text("ore")]),
-            field("rating", "float64", vec![text("c"), text("ope")]),
-        ])))
+        record::plan(
+            frame_of(&Tree::Object(vec![
+                field("email", "string", vec![text("c"), text("eq")]),
+                field("name", "string", vec![text("c"), text("match")]),
+                field("age", "uint32", vec![text("c"), text("ope"), text("ore")]),
+                field("score", "int64", vec![text("ope")]),
+                field("nickname", "string", vec![text("c"), text("ore")]),
+                field("handle", "string", vec![text("c"), case_sensitive]),
+                field("ratio", "float32", vec![text("c"), text("ore")]),
+                field("rating", "float64", vec![text("c"), text("ope")]),
+            ]))
+            .as_protected_ref()
+            .as_deref(),
+        )
         .expect("the plan parses")
     }
 
@@ -1984,11 +1995,15 @@ mod tests {
     async fn block_ore_refuses_text_it_has_no_term_for_before_any_term() {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
-        let plan = record::plan(&frame_of(&Tree::Object(vec![field(
-            "title",
-            "string",
-            vec![text("c"), text("ore_block")],
-        )])))
+        let plan = record::plan(
+            frame_of(&Tree::Object(vec![field(
+                "title",
+                "string",
+                vec![text("c"), text("ore_block")],
+            )]))
+            .as_protected_ref()
+            .as_deref(),
+        )
         .expect("the plan parses");
         let one = |text: &str| ValueFrame::of(text).expect("a value");
         let two = |lo: &str, hi: &str| ValueFrame::of(vec![lo, hi]).expect("a value");
@@ -2047,11 +2062,15 @@ mod tests {
                 ]),
             )
         };
-        let plan = record::plan(&frame_of(&Tree::Object(vec![
-            ("context_field".into(), text("tenant")),
-            one("tenant", "string", "passthrough"),
-            one("email", "string", "eq"),
-        ])))
+        let plan = record::plan(
+            frame_of(&Tree::Object(vec![
+                ("context_field".into(), text("tenant")),
+                one("tenant", "string", "passthrough"),
+                one("email", "string", "eq"),
+            ]))
+            .as_protected_ref()
+            .as_deref(),
+        )
         .unwrap();
         let error = query_term(&keyset, &plan, "email", OpSpec::Eq, text("a"), &NoTargets)
             .map(drop)
@@ -2203,7 +2222,9 @@ mod tests {
             ..MatchOptions::default()
         };
         let context = crate::dynamic::context(
-            &vitaminc_aead_frame::serde::to_vec(&("users", "name")).expect("frames"),
+            vitaminc_aead_frame::serde::to_vec(&("users", "name"))
+                .expect("frames")
+                .as_protected_ref(),
         )
         .expect("context");
         let field = FieldPlan::new(
@@ -2432,13 +2453,17 @@ mod tests {
         use vitaminc_aead::plaintext::{Int, Logical, Physical, Raw, TimeUnit};
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
-        let plan = record::plan(&frame_of(&Tree::Object(vec![
-            field("tiny", "int16", vec![text("c"), text("ore")]),
-            field("huge", "int128", vec![text("c"), text("ope")]),
-            field("day", "date", vec![text("c"), text("eq")]),
-            field("at", "timestamp", vec![text("c"), text("eq")]),
-            field("price", "decimal", vec![text("c"), text("eq")]),
-        ])))
+        let plan = record::plan(
+            frame_of(&Tree::Object(vec![
+                field("tiny", "int16", vec![text("c"), text("ore")]),
+                field("huge", "int128", vec![text("c"), text("ope")]),
+                field("day", "date", vec![text("c"), text("eq")]),
+                field("at", "timestamp", vec![text("c"), text("eq")]),
+                field("price", "decimal", vec![text("c"), text("eq")]),
+            ]))
+            .as_protected_ref()
+            .as_deref(),
+        )
         .expect("the plan parses");
         let frame = |ty: Option<Logical>, value: Physical<'_>| {
             ValueFrame::of(Raw(ty, value)).expect("a value")
@@ -2509,7 +2534,9 @@ mod tests {
         let stored = |value: &ValueFrame, name: &'static str| {
             let keyset = &keyset;
             let ctx = super::super::context(
-                &vitaminc_aead_frame::serde::to_vec(&("users", name)).expect("frames"),
+                vitaminc_aead_frame::serde::to_vec(&("users", name))
+                    .expect("frames")
+                    .as_protected_ref(),
             )
             .expect("context");
             let value = value.clone();
@@ -2931,7 +2958,7 @@ mod tests {
 
     fn match_type_plan() -> Plan {
         record::plan_with(
-            &frame_of(&Tree::Object(vec![(
+            frame_of(&Tree::Object(vec![(
                 "name".into(),
                 Tree::Object(vec![
                     (
@@ -2940,7 +2967,9 @@ mod tests {
                     ),
                     ("target".into(), text("Some")),
                 ]),
-            )])),
+            )]))
+            .as_protected_ref()
+            .as_deref(),
             &MatchType,
         )
         .unwrap()
@@ -3112,7 +3141,7 @@ mod tests {
         let cipher = cipher().await;
         let keyset = cipher.default_keyset();
         let plan = record::plan_with(
-            &frame_of(&Tree::Object(vec![(
+            frame_of(&Tree::Object(vec![(
                 "email".into(),
                 Tree::Object(vec![
                     (
@@ -3121,7 +3150,9 @@ mod tests {
                     ),
                     ("target".into(), text("Some")),
                 ]),
-            )])),
+            )]))
+            .as_protected_ref()
+            .as_deref(),
             &OneType,
         )
         .unwrap();
@@ -3173,8 +3204,7 @@ mod wire_bytes {
     use vitaminc_aead_frame::serde::to_vec;
 
     fn hex<T: Serialize>(value: &T) -> String {
-        to_vec(value)
-            .expect("frames")
+        crate::Controlled::risky_ref(&to_vec(value).expect("frames"))
             .iter()
             .map(|b| format!("{b:02x}"))
             .collect()
diff --git a/packages/stack-encrypt/src/dynamic/record.rs b/packages/stack-encrypt/src/dynamic/record.rs
index 3baeebf32..c108e2a16 100644
--- a/packages/stack-encrypt/src/dynamic/record.rs
+++ b/packages/stack-encrypt/src/dynamic/record.rs
@@ -1075,7 +1075,7 @@ fn declare<K: 'static>(
 /// # Errors
 ///
 /// As [`plan_with`].
-pub fn plan(frame: &[u8]) -> Result<Plan, Error> {
+pub fn plan(frame: vitaminc_protected::ProtectedRef<'_, [u8]>) -> Result<Plan, Error> {
     plan_with(frame, &NoTargets)
 }
 
@@ -1186,6 +1186,7 @@ pub fn plan(frame: &[u8]) -> Result<Plan, Error> {
 /// ```
 /// use stack_encrypt::dynamic::{record, NoTargets, Output};
 /// use stack_encrypt::target::IndexSpec;
+/// use stack_encrypt::AsProtectedRef;
 ///
 /// // As a binding sends it: seal `age` under the label users/age and index
 /// // it for equality.
@@ -1196,7 +1197,7 @@ pub fn plan(frame: &[u8]) -> Result<Plan, Error> {
 ///         "type": "uint32",
 ///     },
 /// }))?;
-/// let plan = record::plan_with(&frame, &NoTargets)?;
+/// let plan = record::plan_with(frame.as_protected_ref(), &NoTargets)?;
 ///
 /// assert_eq!(plan.fields().len(), 1);
 /// assert_eq!(plan.fields()[0].name(), "age");
@@ -1230,7 +1231,11 @@ pub fn plan(frame: &[u8]) -> Result<Plan, Error> {
 /// and no `"type"`. [`Error::Context`] for a `"context"` that is present but
 /// is not a context at all, or renders empty. [`Error::Target`] for a
 /// target the resolver refuses ([`Plan::new_with`]).
-pub fn plan_with(frame: &[u8], resolver: &(impl TargetResolver + ?Sized)) -> Result<Plan, Error> {
+pub fn plan_with(
+    frame: vitaminc_protected::ProtectedRef<'_, [u8]>,
+    resolver: &(impl TargetResolver + ?Sized),
+) -> Result<Plan, Error> {
+    let frame = frame.risky_ref();
     let wire: PlanWire =
         vitaminc_aead_frame::serde::from_slice(frame).map_err(|e| plan_refusal(&e, frame))?;
     let mut fields: Vec<FieldPlan> = Vec::with_capacity(wire.fields.len());
@@ -1587,7 +1592,7 @@ fn plan_refusal(error: &vitaminc_aead_frame::serde::Error, frame: &[u8]) -> Erro
 ///
 /// ```
 /// use stack_encrypt::dynamic::{record, Scope, ValueFrame};
-/// use stack_encrypt::StackCipher;
+/// use stack_encrypt::{AsProtectedRef, StackCipher};
 /// use stack_encrypt::kms::FakeDataKeySource;
 ///
 /// # tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(async {
@@ -1598,9 +1603,10 @@ fn plan_refusal(error: &vitaminc_aead_frame::serde::Error, frame: &[u8]) -> Erro
 /// let keyset = cipher.default_keyset();
 ///
 /// // Seal `age` under users/age with an equality term beside it.
-/// let plan = record::plan(&vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+/// let declaration = vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
 ///     "age": { "context": ["users", "age"], "outputs": ["c", "eq"], "type": "uint32" },
-/// }))?)?;
+/// }))?;
+/// let plan = record::plan(declaration.as_protected_ref())?;
 ///
 /// // The row as a binding hands it over: one transport frame. Here a Rust
 /// // map writes it; a binding's codec writes the same bytes.
@@ -1611,7 +1617,7 @@ fn plan_refusal(error: &vitaminc_aead_frame::serde::Error, frame: &[u8]) -> Erro
 /// // Only the ciphertext comes back, as the record's frame; the term is
 /// // one-way.
 /// let opened = record::decrypt(Scope::Client(&cipher), sealed, &plan, None)?.await?;
-/// assert_eq!(opened.risky_ref(), frame.risky_ref());
+/// assert_eq!(opened, frame);
 /// # Ok::<(), Box<dyn std::error::Error>>(())
 /// # }).unwrap();
 /// ```
@@ -2318,6 +2324,7 @@ fn split_refusal(error: DecodeError) -> Error {
     };
     let reason = match error {
         DecodeError::DuplicateKey(_) => Reason::RepeatedKey,
+        error if super::value_frame::is_unnamed_repeated_key(error) => Reason::RepeatedKey,
         DecodeError::Expected(_) => Reason::FieldType,
         _ => Reason::Unframeable,
     };
@@ -2488,7 +2495,7 @@ fn passthrough_frame(value: &ValueFrame) -> StackCipherText {
 /// The one value a passthrough node carries, in the value model, or `None`
 /// if its frame holds something the model does not.
 fn passthrough_value(payload: &PassthroughFrame) -> Option<ValueFrame> {
-    ValueFrame::from_bytes(&payload.0).ok()
+    ValueFrame::from_clear(&payload.0).ok()
 }
 
 /// The bytes a passthrough node carries, if it carries bytes: what a stored
@@ -2624,8 +2631,8 @@ fn write_record(rows: Rows<Vec<(String, ValueFrame)>>) -> Result<ValueFrame, cra
         }
         map.end()
     }
-    let mut out = Protected::new(Vec::new());
-    let writer = FrameWriter::new(out.risky_inner_mut());
+    let mut out = vitaminc_protected::Buffer::new();
+    let writer = FrameWriter::new(&mut out);
     let written = match rows {
         Rows::One(fields) => writer
             .map(Some(fields.len()))
@@ -2750,6 +2757,7 @@ mod tests {
     use crate::dynamic::test_frame::Tree;
     use std::borrow::Cow;
     use std::sync::atomic::{AtomicUsize, Ordering};
+    use vitaminc_protected::AsProtectedRef as _;
 
     use stack_kms::{
         DataKey, DataKeySource, DataKeyWithTag, FakeDataKeySource, GenerateKeyPayload,
@@ -2839,17 +2847,30 @@ mod tests {
 
     /// The context `value` spells, read from its frame as a binding sends it.
     fn context(value: Tree) -> Result<NonEmpty<ContextPiece<'static>>, Error> {
-        crate::dynamic::context(&crate::dynamic::test_frame::frame_of(&value))
+        crate::dynamic::context(
+            crate::dynamic::test_frame::frame_of(&value)
+                .as_protected_ref()
+                .as_deref(),
+        )
     }
 
     /// The plan `value` spells, read from its frame as a binding sends it.
     fn plan(value: Tree) -> Result<Plan, Error> {
-        super::plan(&crate::dynamic::test_frame::frame_of(&value))
+        super::plan(
+            crate::dynamic::test_frame::frame_of(&value)
+                .as_protected_ref()
+                .as_deref(),
+        )
     }
 
     /// [`plan`], under `resolver`.
     fn plan_with(value: Tree, resolver: &(impl TargetResolver + ?Sized)) -> Result<Plan, Error> {
-        super::plan_with(&crate::dynamic::test_frame::frame_of(&value), resolver)
+        super::plan_with(
+            crate::dynamic::test_frame::frame_of(&value)
+                .as_protected_ref()
+                .as_deref(),
+            resolver,
+        )
     }
 
     fn obj(entries: Vec<(&str, Tree)>) -> Tree {
@@ -3094,7 +3115,10 @@ mod tests {
         fn a_plan_that_declares_more_fields_than_it_holds_is_refused() {
             let mut bytes = vec![vitaminc_aead::frame::OBJECT];
             bytes.extend_from_slice(&u32::MAX.to_le_bytes());
-            assert!(crate::dynamic::record::plan(&bytes).is_err());
+            assert!(crate::dynamic::record::plan(
+                Protected::new(bytes.to_vec()).as_protected_ref().as_deref()
+            )
+            .is_err());
         }
 
         #[test]
@@ -7913,7 +7937,10 @@ mod tests {
         #[test]
         fn bytes_that_are_not_a_frame_are_not_a_plan() {
             for bytes in [&[][..], &[0xff, 1, 2]] {
-                let error = super::super::plan(bytes).expect_err("refused");
+                let error = super::super::plan(
+                    Protected::new(bytes.to_vec()).as_protected_ref().as_deref(),
+                )
+                .expect_err("refused");
                 expect(&error, "Plan", None, Reason::NotAnObject);
             }
         }
@@ -8193,7 +8220,7 @@ mod tests {
                 Some(vitaminc_aead::plaintext::Logical::Uuid),
                 vitaminc_aead::plaintext::Physical::Bytes(&[7; 16]),
             );
-            let mut frame = Vec::new();
+            let mut frame = vitaminc_protected::Buffer::new();
             {
                 let mut map = vitaminc_aead::FrameWriter::new(&mut frame)
                     .map(Some(1))
@@ -8202,12 +8229,13 @@ mod tests {
                     .expect("written");
                 map.end().expect("ended");
             }
-            let source = vitaminc_aead::Frame::parse(&frame).expect("a frame");
+            let source =
+                vitaminc_aead::Frame::parse(crate::Controlled::risky_ref(&frame)).expect("a frame");
             let error = check_source(source, &plan).expect_err("a uuid field");
             expect(&error, "Source", Some("email"), FieldType);
             // The same inside a passthrough subtree: the field is named, and
             // the cause is the value's type, not an unframeable source.
-            let mut frame = Vec::new();
+            let mut frame = vitaminc_protected::Buffer::new();
             {
                 let mut map = vitaminc_aead::FrameWriter::new(&mut frame)
                     .map(Some(1))
@@ -8218,7 +8246,8 @@ mod tests {
                     .expect("written");
                 map.end().expect("ended");
             }
-            let source = vitaminc_aead::Frame::parse(&frame).expect("a frame");
+            let source =
+                vitaminc_aead::Frame::parse(crate::Controlled::risky_ref(&frame)).expect("a frame");
             let error = check_source(source, &plan).expect_err("a uuid in a passthrough");
             expect(&error, "Source", Some("id"), FieldType);
             // Each row of a batch is split the same way, and the first fault
diff --git a/packages/stack-encrypt/src/dynamic/term.rs b/packages/stack-encrypt/src/dynamic/term.rs
index 756cd567b..14f3db90f 100644
--- a/packages/stack-encrypt/src/dynamic/term.rs
+++ b/packages/stack-encrypt/src/dynamic/term.rs
@@ -125,8 +125,8 @@ impl IndexSpec {
     /// unknown, mistyped or out of bounds, and for bytes that are not one
     /// frame (an option given twice is refused by the frame). It names no
     /// field: the plan parser names it.
-    pub fn from_frame(frame: &[u8]) -> Result<Self, Error> {
-        vitaminc_aead_frame::serde::from_slice::<IndexWire>(frame)
+    pub fn from_frame(frame: vitaminc_protected::ProtectedRef<'_, [u8]>) -> Result<Self, Error> {
+        vitaminc_aead_frame::serde::from_slice::<IndexWire>(frame.risky_ref())
             .map(IndexSpec::from)
             .map_err(|_| Error::bad_plan(Reason::UnknownOutput))
     }
@@ -415,7 +415,7 @@ impl TryFrom<MatchOptionsWire> for MatchWire {
 /// ```
 /// use stack_encrypt::dynamic::{context, term};
 /// use stack_encrypt::target::IndexSpec;
-/// use stack_encrypt::StackCipher;
+/// use stack_encrypt::{AsProtectedRef, StackCipher};
 /// use stack_encrypt::kms::FakeDataKeySource;
 ///
 /// # tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(async {
@@ -426,7 +426,7 @@ impl TryFrom<MatchOptionsWire> for MatchWire {
 /// let keyset = cipher.default_keyset();
 ///
 /// // `["users", "age"]`, as a binding writes it.
-/// let ctx = context(&vitaminc_aead_frame::serde::to_vec(&("users", "age"))?)?;
+/// let ctx = context(vitaminc_aead_frame::serde::to_vec(&("users", "age"))?.as_protected_ref())?;
 /// let probe = term(&keyset, &34u32, &IndexSpec::Equality, ctx.clone()).await?;
 /// let typed = keyset.equality_term(34u32, ctx).await?;
 /// assert_eq!(probe, typed.into_bytes().to_vec());
@@ -878,6 +878,7 @@ mod tests {
     use crate::{nonempty, StackCipher};
     use stack_kms::FakeDataKeySource;
     use vitaminc_aead::plaintext::Raw;
+    use vitaminc_protected::AsProtectedRef as _;
     use vitaminc_protected::Controlled;
 
     async fn cipher() -> StackCipher<FakeDataKeySource> {
@@ -1086,12 +1087,21 @@ mod tests {
 
     /// An index read from the frame of its wire form, as a plan carries it.
     fn index_of(value: &Tree) -> Result<IndexSpec, Error> {
-        IndexSpec::from_frame(&crate::dynamic::test_frame::frame_of(value))
+        IndexSpec::from_frame(
+            crate::dynamic::test_frame::frame_of(value)
+                .as_protected_ref()
+                .as_deref(),
+        )
     }
 
     /// A one-part context, read from its frame as a binding sends it.
     fn ctx(label: &str) -> NonEmpty<crate::ContextPiece<'static>> {
-        context(&vitaminc_aead_frame::serde::to_vec(&label).expect("frames")).expect("context")
+        context(
+            vitaminc_aead_frame::serde::to_vec(&label)
+                .expect("frames")
+                .as_protected_ref(),
+        )
+        .expect("context")
     }
 
     fn s(value: &str) -> Tree {
@@ -2042,9 +2052,14 @@ mod tests {
 mod wire_form {
     use super::*;
     use crate::dynamic::test_frame::Tree;
+    use vitaminc_protected::AsProtectedRef as _;
 
     fn index_of(value: &Tree) -> Result<IndexSpec, Error> {
-        IndexSpec::from_frame(&crate::dynamic::test_frame::frame_of(value))
+        IndexSpec::from_frame(
+            crate::dynamic::test_frame::frame_of(value)
+                .as_protected_ref()
+                .as_deref(),
+        )
     }
     use crate::sem::{MatchConfig, Tokenizer};
     use crate::target::{Equality, Index, Match, Ope, Ore};
diff --git a/packages/stack-encrypt/src/dynamic/test_frame.rs b/packages/stack-encrypt/src/dynamic/test_frame.rs
index 2f57c7f06..70162f9ff 100644
--- a/packages/stack-encrypt/src/dynamic/test_frame.rs
+++ b/packages/stack-encrypt/src/dynamic/test_frame.rs
@@ -13,7 +13,7 @@ use vitaminc_aead::plaintext::{
     Sink, SourceError,
 };
 use vitaminc_aead::{to_frame, DecodeError, Decrypt, Encrypt, Frame};
-use vitaminc_protected::{Controlled, Protected};
+use vitaminc_protected::Controlled;
 
 /// A value as a test spells it: each scalar at its own width, a logical
 /// scalar under its type. Equality is structural and variable-time, which
@@ -77,7 +77,7 @@ impl PartialEq for Tree {
 impl Tree {
     /// The tree's frame, written by vitaminc's own frame writer, which
     /// refuses a repeated key.
-    pub(crate) fn to_frame(&self) -> Result<Protected<Vec<u8>>, FrameWriteError> {
+    pub(crate) fn to_frame(&self) -> Result<vitaminc_protected::Buffer, FrameWriteError> {
         to_frame(self)
     }
 
@@ -105,10 +105,10 @@ pub(crate) enum ReadError {
 
 /// The frame bytes of `value`, written by hand: an object's entries in
 /// order, a repeated key included.
-pub(crate) fn frame_of(value: &Tree) -> Vec<u8> {
+pub(crate) fn frame_of(value: &Tree) -> vitaminc_protected::Protected<Vec<u8>> {
     let mut out = Vec::new();
     write(value, &mut out);
-    out
+    vitaminc_protected::Protected::new(out)
 }
 
 fn write(value: &Tree, out: &mut Vec<u8>) {
@@ -138,7 +138,7 @@ fn write(value: &Tree, out: &mut Vec<u8>) {
 /// read back.
 pub(crate) fn value_of<T: serde::Serialize>(answer: &T) -> Tree {
     let frame = vitaminc_aead_frame::serde::to_vec(answer).expect("frames");
-    Tree::from_frame(&frame).expect("a value")
+    Tree::from_frame(frame.risky_ref()).expect("a value")
 }
 
 fn scalar<S: Sink>(sink: S, ty: Option<Logical>, value: &Tree) -> Result<S::Ok, S::Error> {
@@ -383,13 +383,19 @@ mod tests {
         for (at, tree) in variants.iter().enumerate() {
             let frame = tree.to_frame().expect("frames");
             assert_eq!(&Tree::from_frame(frame.risky_ref()).expect("reads"), tree);
-            assert_eq!(&Tree::from_frame(&frame_of(tree)).expect("reads"), tree);
+            assert_eq!(
+                &Tree::from_frame(frame_of(tree).risky_ref()).expect("reads"),
+                tree
+            );
             for (other_at, other) in variants.iter().enumerate() {
                 assert_eq!(tree == other, at == other_at, "{tree:?} vs {other:?}");
             }
         }
         let array = Tree::Array(variants.clone());
-        assert_eq!(Tree::from_frame(&frame_of(&array)).expect("reads"), array);
+        assert_eq!(
+            Tree::from_frame(frame_of(&array).risky_ref()).expect("reads"),
+            array
+        );
         let object = Tree::Object(
             variants
                 .into_iter()
@@ -397,7 +403,10 @@ mod tests {
                 .map(|(at, tree)| (at.to_string(), tree))
                 .collect(),
         );
-        assert_eq!(Tree::from_frame(&frame_of(&object)).expect("reads"), object);
+        assert_eq!(
+            Tree::from_frame(frame_of(&object).risky_ref()).expect("reads"),
+            object
+        );
     }
 
     /// A logical type over anything but a scalar is not a value, and bytes
diff --git a/packages/stack-encrypt/src/dynamic/value_frame.rs b/packages/stack-encrypt/src/dynamic/value_frame.rs
index 11ff10a61..1ea40687a 100644
--- a/packages/stack-encrypt/src/dynamic/value_frame.rs
+++ b/packages/stack-encrypt/src/dynamic/value_frame.rs
@@ -14,14 +14,15 @@
 //!
 //! ```
 //! use stack_encrypt::dynamic::{ValueFrame, ValueKind};
+//! use stack_encrypt::AsProtectedRef;
 //!
 //! # fn main() -> Result<(), Box<dyn std::error::Error>> {
 //! let frame = ValueFrame::of("alice")?;
 //! assert_eq!(frame.kind(), Some(ValueKind::String));
 //!
 //! // The same value, as a binding would hand it over.
-//! let from_host = ValueFrame::from_bytes(frame.risky_ref())?;
-//! assert_eq!(from_host.risky_ref(), frame.risky_ref());
+//! let from_host = ValueFrame::from_bytes(frame.as_protected_ref())?;
+//! assert_eq!(from_host, frame);
 //! # Ok(())
 //! # }
 //! ```
@@ -37,7 +38,10 @@ use vitaminc_aead::plaintext::{
     TimeUnit, Width,
 };
 use vitaminc_aead::{DecodeError, Decrypt, Encrypt};
-use vitaminc_protected::{Controlled, OpaqueDebug, Protected};
+use vitaminc_protected::{
+    AsProtectedRef, Buffer, Controlled, Equatable, OpaqueDebug, Protected, ProtectedRef,
+    TimingSafeEq,
+};
 
 use super::ValueKind;
 use crate::plan::IntoLabel;
@@ -58,6 +62,9 @@ use crate::{Label, LabelError};
 /// `Debug` ([`OpaqueDebug`]) names the type and masks the frame, which is
 /// plaintext.
 ///
+/// Two frames compare with `==` in constant time. See the [`PartialEq`
+/// impl](#impl-PartialEq-for-ValueFrame) for what equal means.
+///
 /// # The value model
 ///
 /// A frame can carry any of vitaminc's scalars. The engine admits a subset,
@@ -72,7 +79,7 @@ use crate::{Label, LabelError};
 /// sink adapter that holds these rules, so a frame from a host and a frame
 /// opened from a ciphertext are read the same way.
 #[derive(OpaqueDebug)]
-pub struct ValueFrame(Protected<Vec<u8>>);
+pub struct ValueFrame(Equatable<Protected<Vec<u8>>>);
 
 /// Why [`ValueFrame::from_bytes`] or [`ValueFrame::check`] refused its bytes.
 #[derive(Debug, thiserror::Error)]
@@ -90,11 +97,18 @@ impl ValueFrame {
     ///
     /// # Errors
     ///
-    /// [`DecodeError::Expected`] for a scalar outside the model (a uuid, a
-    /// logical type this build does not know, a date, decimal or timestamp
-    /// outside vitaminc's range), [`DecodeError::DuplicateKey`] for a map with a
-    /// repeated key, and [`DecodeError::Source`] for a source that fails or
-    /// a value deeper or longer than a frame carries.
+    /// - [`DecodeError::Expected`] for a scalar outside the model. That is a
+    ///   uuid, a logical type this build does not know, or a date, decimal, or
+    ///   timestamp outside vitaminc's range.
+    /// - [`DecodeError::DuplicateKey`] for a map inside a passthrough that
+    ///   repeats a key.
+    /// - [`DecodeError::Source`] for a source that fails, or for a value
+    ///   deeper or longer than a frame allows.
+    /// - [`DecodeError::Source`] for a map outside a passthrough that repeats a
+    ///   key. The error wraps the frame writer's
+    ///   [`FrameWriteError::DuplicateKey`]. That error does not name the key,
+    ///   because the key is plaintext. The writer does not copy plaintext out
+    ///   of the frame.
     pub fn of<P: Encrypt>(value: P) -> Result<Self, DecodeError> {
         write(|writer| value.visit(Modeled::new(writer)))
     }
@@ -114,7 +128,15 @@ impl ValueFrame {
     /// bytes are not exactly one frame, and
     /// [`FromFrameError::Value`] as
     /// [`of`](Self::of) refuses a value.
-    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FromFrameError> {
+    pub fn from_bytes(
+        bytes: vitaminc_protected::ProtectedRef<'_, [u8]>,
+    ) -> Result<Self, FromFrameError> {
+        Self::from_clear(bytes.risky_ref())
+    }
+
+    /// [`from_bytes`](Self::from_bytes) over bytes held in the clear, such as
+    /// a passthrough field's frame, which is not secret by contract.
+    pub(super) fn from_clear(bytes: &[u8]) -> Result<Self, FromFrameError> {
         let frame = Frame::parse(bytes).map_err(FromFrameError::Frame)?;
         Self::of(frame).map_err(FromFrameError::Value)
     }
@@ -133,22 +155,31 @@ impl ValueFrame {
     /// # Errors
     ///
     /// As [`from_bytes`](Self::from_bytes).
-    pub fn check(bytes: &[u8]) -> Result<Frame<'_>, FromFrameError> {
-        let frame = Frame::parse(bytes).map_err(FromFrameError::Frame)?;
+    pub fn check(
+        bytes: vitaminc_protected::ProtectedRef<'_, [u8]>,
+    ) -> Result<Frame<'_>, FromFrameError> {
+        let frame = Frame::parse(bytes.risky_ref()).map_err(FromFrameError::Frame)?;
         frame.visit(Check).map_err(FromFrameError::Value)?;
         Ok(frame)
     }
 
     /// A frame this module's writers wrote from frames already in the value
     /// model: the record a decrypt assembles. Checked to be one frame.
-    pub(super) fn from_written(buffer: Protected<Vec<u8>>) -> Result<Self, crate::Error> {
+    pub(super) fn from_written(buffer: Buffer) -> Result<Self, crate::Error> {
         let _ = Frame::parse(buffer.risky_ref()).map_err(|_| crate::Error::ResponseShape)?;
-        Ok(Self(buffer))
+        Ok(Self::from_buffer(buffer))
+    }
+
+    /// The frame in a [`Buffer`] that a writer has finished writing. The bytes
+    /// move into the frame's [`Protected`] without being copied. While the
+    /// writer wrote, the `Buffer` wiped each allocation it outgrew.
+    fn from_buffer(buffer: Buffer) -> Self {
+        Self(Equatable::from(Protected::from(buffer)))
     }
 
     /// The null, as a frame: what an absent value opens to.
     pub(super) fn null() -> Self {
-        Self(Protected::new(vec![vitaminc_aead::tags::NULL]))
+        Self(Equatable::new(vec![vitaminc_aead::tags::NULL]))
     }
 
     /// A typed null of `ty`, as a frame: the leaf alone. Walked into the
@@ -157,7 +188,7 @@ impl ValueFrame {
     /// typed null of its own types only ([`model_null`]), so `ty` is one of
     /// those a [`ValueKind`] names.
     pub(super) fn typed_null(ty: FixedType) -> Self {
-        let mut leaf = Protected::new(Vec::new());
+        let mut leaf = Equatable::new(Vec::new());
         vitaminc_aead::leaf::write_typed_null(ty, leaf.risky_inner_mut());
         Self(leaf)
     }
@@ -182,7 +213,7 @@ impl ValueFrame {
 
     /// The frame bytes, still protected.
     pub fn into_inner(self) -> Protected<Vec<u8>> {
-        self.0
+        Protected::new(self.0.risky_unwrap())
     }
 
     /// The frame, for walking.
@@ -286,9 +317,9 @@ impl MapSink for Check {
 fn write(
     f: impl FnOnce(FrameWriter<'_>) -> Result<(), DecodeError>,
 ) -> Result<ValueFrame, DecodeError> {
-    let mut buffer = Protected::new(Vec::new());
-    f(FrameWriter::new(buffer.risky_inner_mut()))?;
-    Ok(ValueFrame(buffer))
+    let mut buffer = Buffer::new();
+    f(FrameWriter::new(&mut buffer))?;
+    Ok(ValueFrame::from_buffer(buffer))
 }
 
 /// Walks the frame in place: no scalar leaves the buffer except to go
@@ -304,6 +335,16 @@ impl Encrypt for &ValueFrame {
 }
 
 /// Walks the frame, then drops it, which wipes it.
+/// A frame lends its bytes, so it can be passed to a frame reader, such as
+/// [`record::plan`](super::record::plan), without reading it through
+/// [`risky_ref`](ValueFrame::risky_ref). The frame still wipes its bytes
+/// when it drops.
+impl<'a> AsProtectedRef<'a, [u8]> for ValueFrame {
+    fn as_protected_ref(&'a self) -> ProtectedRef<'a, [u8]> {
+        self.0.as_protected_ref().as_deref()
+    }
+}
+
 impl Encrypt for ValueFrame {
     fn visit<S: Sink>(self, sink: S) -> Result<S::Ok, S::Error> {
         (&self).visit(sink)
@@ -325,7 +366,35 @@ impl Decrypt for ValueFrame {
 /// original does.
 impl Clone for ValueFrame {
     fn clone(&self) -> Self {
-        Self(Protected::new(self.0.risky_ref().to_vec()))
+        Self(Equatable::new(self.0.risky_ref().to_vec()))
+    }
+}
+
+/// Two frames are equal when their bytes are. The bytes are compared in
+/// constant time, so the comparison does not reveal where two frames first
+/// differ. Frames of different lengths are unequal at once, which reveals
+/// only their lengths. A ciphertext's length already shows those.
+///
+/// This compares frames, not values. A frame records each scalar's width and
+/// type, so `34u32` and `34u64` are not equal, and neither are `0.0` and
+/// `-0.0`, or a typed null and a plain one. A map is equal to another only
+/// when its keys are written in the same order.
+///
+/// ```
+/// use stack_encrypt::dynamic::ValueFrame;
+///
+/// assert_eq!(ValueFrame::of(34u64)?, ValueFrame::of(34u64)?);
+/// assert_ne!(ValueFrame::of(34u64)?, ValueFrame::of(34u32)?);
+/// # Ok::<(), Box<dyn std::error::Error>>(())
+/// ```
+impl PartialEq for ValueFrame {
+    fn eq(&self, other: &Self) -> bool {
+        // The frame is held in an `Equatable`, which would compare it itself,
+        // but vitaminc-protected 0.9.1 has no `ConstantTimeEq` for `Vec<u8>`.
+        // Until it does, compare the bytes through `TimingSafeEq`, which uses
+        // `subtle`, and derive `PartialEq` once the impl is released.
+        let (ours, theirs) = (self.0.risky_ref(), other.0.risky_ref());
+        TimingSafeEq::ts_eq(ours.as_slice(), theirs.as_slice()).into()
     }
 }
 
@@ -441,12 +510,34 @@ pub(super) struct FieldFault {
     pub(super) error: DecodeError,
 }
 
-/// A frame writer's refusal as a decode error. A repeated key is reported
-/// where the key is known ([`Modeled::entry`]). A value the model does not
-/// hold, or a repeated key, inside a passthrough subtree reaches here wrapped
-/// as the writer's source error ([`ModelOnly`] can only return the writer's
-/// error type), and is unwrapped, so it is refused as the same `Expected` or
-/// `DuplicateKey` a sealed value is.
+/// Whether `error` is the frame writer's refusal of a repeated map key. That
+/// error does not name the key (see [`decode_error`]).
+pub(super) fn is_unnamed_repeated_key(error: &DecodeError) -> bool {
+    matches!(
+        error,
+        DecodeError::Source(source)
+            if matches!(
+                source.inner().downcast_ref::<FrameWriteError>(),
+                Some(FrameWriteError::DuplicateKey)
+            )
+    )
+}
+
+/// Converts a frame writer's refusal into a decode error.
+///
+/// Inside a passthrough subtree, [`ModelOnly`] can only return the writer's
+/// error type. So a value outside the model, or a repeated key, arrives
+/// wrapped as the writer's source error. This function unwraps it, and the
+/// caller gets the same `Expected` or `DuplicateKey` error a sealed value
+/// gives.
+///
+/// Outside a passthrough, the writer finds a repeated key when the map ends,
+/// by comparing it with the keys already in the frame. The writer then
+/// returns its own [`FrameWriteError::DuplicateKey`]. That error does not
+/// name the key.
+/// Naming the key would copy plaintext out of the frame, into memory that is
+/// freed without being wiped. [`is_unnamed_repeated_key`] recognises this
+/// error.
 fn decode_error(error: FrameWriteError) -> DecodeError {
     match error {
         FrameWriteError::Source(error) => match error.inner().downcast_ref::<DecodeError>() {
@@ -553,9 +644,6 @@ impl MapSink for Modeled<FrameMap<'_>> {
                 inner: writer,
                 field,
             }),
-            Err(FrameWriteError::DuplicateKey) => {
-                Err(Modeled { inner: (), field }.fault(DecodeError::duplicate_key(key)))
-            }
             Err(error) => Err(Modeled { inner: (), field }.written(error)),
         }
     }
@@ -736,7 +824,7 @@ type Finish<T> = fn(bool, Vec<(Option<String>, ValueFrame)>) -> Result<T, Decode
 /// keeps a repeated key for `finish` to refuse.
 pub struct Children<T> {
     map: bool,
-    children: Vec<(Option<String>, Protected<Vec<u8>>)>,
+    children: Vec<(Option<String>, Buffer)>,
     finish: Finish<T>,
 }
 
@@ -750,21 +838,20 @@ impl<T> Children<T> {
     }
 
     fn next(&mut self, key: Option<&str>) -> Modeled<FrameWriter<'_>> {
-        self.children
-            .push((key.map(str::to_owned), Protected::new(Vec::new())));
+        self.children.push((key.map(str::to_owned), Buffer::new()));
         let buffer = match self.children.last_mut() {
             Some((_, buffer)) => buffer,
             // Pushed on the line above.
             None => unreachable!(),
         };
-        Modeled::new(FrameWriter::new(buffer.risky_inner_mut()))
+        Modeled::new(FrameWriter::new(buffer))
     }
 
     fn finish(self) -> Result<T, DecodeError> {
         let children = self
             .children
             .into_iter()
-            .map(|(key, buffer)| (key, ValueFrame(buffer)))
+            .map(|(key, buffer)| (key, ValueFrame::from_buffer(buffer)))
             .collect();
         (self.finish)(self.map, children)
     }
@@ -1195,7 +1282,7 @@ impl SeqSink for NotARow<'_> {
 /// names the entry's key in any refusal.
 pub(super) struct RowMap<O> {
     out: O,
-    entries: Vec<(String, Protected<Vec<u8>>)>,
+    entries: Vec<(String, Buffer)>,
 }
 
 impl<O> RowMap<O> {
@@ -1216,24 +1303,20 @@ impl<O: PutRow> MapSink for RowMap<O> {
         Self: 's;
 
     fn entry(&mut self, key: &str) -> Result<Modeled<FrameWriter<'_>>, DecodeError> {
-        self.entries
-            .push((key.to_owned(), Protected::new(Vec::new())));
+        self.entries.push((key.to_owned(), Buffer::new()));
         let buffer = match self.entries.last_mut() {
             Some((_, buffer)) => buffer,
             // Pushed on the line above.
             None => unreachable!(),
         };
-        Ok(Modeled::in_field(
-            FrameWriter::new(buffer.risky_inner_mut()),
-            key,
-        ))
+        Ok(Modeled::in_field(FrameWriter::new(buffer), key))
     }
 
     fn end(self) -> Result<O::Ok, DecodeError> {
         let row = self
             .entries
             .into_iter()
-            .map(|(key, buffer)| (key, ValueFrame(buffer)))
+            .map(|(key, buffer)| (key, ValueFrame::from_buffer(buffer)))
             .collect();
         Ok(self.out.put(Some(row)))
     }
@@ -1244,6 +1327,46 @@ mod tests {
     use super::*;
     use crate::dynamic::test_frame::Tree;
 
+    mod equality {
+        use super::*;
+
+        #[test]
+        fn frames_with_the_same_bytes_are_equal() {
+            let frame = ValueFrame::of("alice").unwrap();
+            assert_eq!(frame, frame.clone());
+            assert_eq!(
+                frame,
+                ValueFrame::from_bytes(frame.as_protected_ref()).unwrap()
+            );
+        }
+
+        #[test]
+        fn frames_with_different_bytes_of_the_same_length_are_not_equal() {
+            let (a, b) = (
+                ValueFrame::of("alice").unwrap(),
+                ValueFrame::of("alicf").unwrap(),
+            );
+            assert_eq!(a.risky_ref().len(), b.risky_ref().len());
+            assert_ne!(a, b);
+        }
+
+        #[test]
+        fn frames_of_different_lengths_are_not_equal() {
+            assert_ne!(
+                ValueFrame::of("alice").unwrap(),
+                ValueFrame::of("alice!").unwrap()
+            );
+        }
+
+        #[test]
+        fn the_same_number_at_two_widths_is_not_equal() {
+            assert_ne!(
+                ValueFrame::of(34u32).unwrap(),
+                ValueFrame::of(34u64).unwrap()
+            );
+        }
+    }
+
     fn s(value: &str) -> Tree {
         Tree::String(value.into())
     }
@@ -1326,8 +1449,15 @@ mod tests {
             let written = ValueFrame::of(TypedNull(ty)).expect("in the model");
             assert_eq!(written.risky_ref(), null.risky_ref(), "{ty:?} written");
             let bytes = typed_null_frame(ty);
-            assert!(ValueFrame::check(&bytes).is_ok(), "{ty:?} checks");
-            let read = ValueFrame::from_bytes(&bytes).expect("reads");
+            assert!(
+                ValueFrame::check(Protected::new(bytes.to_vec()).as_protected_ref().as_deref())
+                    .is_ok(),
+                "{ty:?} checks"
+            );
+            let read = ValueFrame::from_bytes(
+                Protected::new(bytes.to_vec()).as_protected_ref().as_deref(),
+            )
+            .expect("reads");
             assert_eq!(read.risky_ref(), null.risky_ref(), "{ty:?} read");
             let opened = TypedNull(ty).visit(Opening).expect("opens");
             assert_eq!(opened.risky_ref(), null.risky_ref(), "{ty:?} opened");
@@ -1346,8 +1476,10 @@ mod tests {
         ));
         let bytes = typed_null_frame(uuid);
         for refused in [
-            ValueFrame::check(&bytes).map(drop),
-            ValueFrame::from_bytes(&bytes).map(drop),
+            ValueFrame::check(Protected::new(bytes.to_vec()).as_protected_ref().as_deref())
+                .map(drop),
+            ValueFrame::from_bytes(Protected::new(bytes.to_vec()).as_protected_ref().as_deref())
+                .map(drop),
         ] {
             assert!(
                 matches!(
@@ -1380,8 +1512,15 @@ mod tests {
             let written = ValueFrame::of(Hidden(TypedNull(ty))).expect("in the model");
             assert_eq!(written.risky_ref(), null.risky_ref(), "{ty:?} written");
             let bytes = hidden_typed_null_frame(ty);
-            assert!(ValueFrame::check(&bytes).is_ok(), "{ty:?} checks");
-            let read = ValueFrame::from_bytes(&bytes).expect("reads");
+            assert!(
+                ValueFrame::check(Protected::new(bytes.to_vec()).as_protected_ref().as_deref())
+                    .is_ok(),
+                "{ty:?} checks"
+            );
+            let read = ValueFrame::from_bytes(
+                Protected::new(bytes.to_vec()).as_protected_ref().as_deref(),
+            )
+            .expect("reads");
             assert_eq!(read.risky_ref(), null.risky_ref(), "{ty:?} read");
         }
         assert!(matches!(
@@ -1390,8 +1529,10 @@ mod tests {
         ));
         let bytes = hidden_typed_null_frame(uuid_null());
         for refused in [
-            ValueFrame::check(&bytes).map(drop),
-            ValueFrame::from_bytes(&bytes).map(drop),
+            ValueFrame::check(Protected::new(bytes.to_vec()).as_protected_ref().as_deref())
+                .map(drop),
+            ValueFrame::from_bytes(Protected::new(bytes.to_vec()).as_protected_ref().as_deref())
+                .map(drop),
         ] {
             assert!(
                 matches!(
@@ -1460,7 +1601,7 @@ mod tests {
         ] {
             let frame = ValueFrame::of(Raw(None, Physical::Int(int))).expect("in the model");
             assert_eq!(frame.risky_ref()[0], tag);
-            let back = ValueFrame::from_bytes(frame.risky_ref()).expect("in the model");
+            let back = ValueFrame::from_bytes(frame.as_protected_ref()).expect("in the model");
             assert_eq!(
                 back.risky_ref(),
                 frame.risky_ref(),
@@ -1526,7 +1667,7 @@ mod tests {
     fn check_refuses_what_from_bytes_refuses_without_a_copy() {
         let good = every_variant();
         let bytes = ValueFrame::of(&good).expect("frames");
-        let checked = ValueFrame::check(bytes.risky_ref()).expect("checks");
+        let checked = ValueFrame::check(bytes.as_protected_ref()).expect("checks");
         assert_eq!(checked.as_bytes().as_ptr(), bytes.risky_ref().as_ptr());
         assert_eq!(checked.as_bytes(), bytes.risky_ref());
         let hidden = vitaminc_aead::to_frame(Hidden(vitaminc_aead::plaintext::Raw(
@@ -1541,16 +1682,24 @@ mod tests {
         .expect("frames");
         for refused in [hidden.risky_ref(), uuid.risky_ref()] {
             assert!(matches!(
-                ValueFrame::check(refused),
+                ValueFrame::check(
+                    Protected::new(refused.to_vec())
+                        .as_protected_ref()
+                        .as_deref()
+                ),
                 Err(super::FromFrameError::Value(DecodeError::Expected(_)))
             ));
             assert!(matches!(
-                ValueFrame::from_bytes(refused),
+                ValueFrame::from_bytes(
+                    Protected::new(refused.to_vec())
+                        .as_protected_ref()
+                        .as_deref()
+                ),
                 Err(super::FromFrameError::Value(DecodeError::Expected(_)))
             ));
         }
         assert!(matches!(
-            ValueFrame::check(&[]),
+            ValueFrame::check(Protected::new(Vec::new()).as_protected_ref().as_deref()),
             Err(super::FromFrameError::Frame(_))
         ));
     }
@@ -1610,19 +1759,21 @@ mod tests {
             ValueFrame::of(hidden),
             Err(DecodeError::Expected(_))
         ));
+        // A repeated key is refused when its map ends, unnamed: the writer
+        // copies no key out of the frame to say which one.
         let repeated = Tree::Object(vec![("k".into(), Tree::Null), ("k".into(), Tree::Null)]);
         assert!(matches!(
             ValueFrame::of(&repeated),
-            Err(DecodeError::DuplicateKey(key)) if key == "k"
+            Err(ref error) if super::is_unnamed_repeated_key(error)
         ));
         assert!(matches!(
-            ValueFrame::from_bytes(&[]),
+            ValueFrame::from_bytes(Protected::new(Vec::new()).as_protected_ref().as_deref()),
             Err(super::FromFrameError::Frame(_))
         ));
         let uuid = vitaminc_aead::to_frame(Raw(Some(Logical::Uuid), Physical::Bytes(&[7; 16])))
             .expect("frames");
         assert!(matches!(
-            ValueFrame::from_bytes(uuid.risky_ref()),
+            ValueFrame::from_bytes(uuid.as_protected_ref()),
             Err(super::FromFrameError::Value(DecodeError::Expected(_)))
         ));
     }
diff --git a/packages/stack-encrypt/src/lib.rs b/packages/stack-encrypt/src/lib.rs
index fa25af1c8..db1af8a3b 100644
--- a/packages/stack-encrypt/src/lib.rs
+++ b/packages/stack-encrypt/src/lib.rs
@@ -228,8 +228,12 @@ endpoint — are `StackKmsBuilder`'s, and the two keyset-cache knobs are
 //! ```
 //! # async fn example() -> Result<(), stack_encrypt::Error> {
 //! use stack_encrypt::{Ciphertext, EncryptInto, DecryptFrom, StackCipher};
+//! // With no `.kms(..)`, the cipher uses ZeroKMS. It reads credentials from
+//! // the environment, or from the profile that `npx stash auth login` writes.
 //! let cipher = StackCipher::builder()
-//!     .kms(stack_encrypt::kms::FakeDataKeySource::new()).init().await?;
+//! #     .kms(stack_encrypt::kms::FakeDataKeySource::new())
+//!     .init()
+//!     .await?;
 //! let keyset = cipher.default_keyset();
 //! let encrypted: Ciphertext = 42i32.encrypt_into(&keyset).await?;
 //! let plain = i32::decrypt_from(encrypted, &keyset).await?;
@@ -239,12 +243,82 @@ endpoint — are `StackKmsBuilder`'s, and the two keyset-cache knobs are
 //! # tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(example()).unwrap();
 //! ```
 //!
+//! # Collections
+//!
+//! [`EncryptInto`] encrypts a `Vec` of owned plaintexts into a `Vec` of any
+//! owned target, and [`DecryptFrom`] decrypts it back. A caller context is
+//! optional, as it is for a single value.
+//!
+//! Each element is encrypted under its own data key and authenticated on its
+//! own, so [`KeysetCipher::decrypt`] can decrypt any one element alone. An
+//! element's position in the `Vec`, and the number of elements, are not part
+//! of what is authenticated. So you can decrypt the elements in a different
+//! order, or decrypt only some of them.
+//!
+//! This suits a very common case: storing each element in its own database
+//! row. A database can return rows in any order. A query can also return only
+//! some of them. If your application needs the order or the length of a
+//! `Vec` to be authenticated, this API does not provide that.
+//!
+//! A collection makes one logical batch of key requests, with the requests
+//! in element order:
+//!
+//! - Encrypting a collection makes one `generate_keys` call.
+//! - Decrypting a collection makes one `retrieve_keys` call for each keyset.
+//! - An empty collection makes no call.
+//!
+//! The key source can still split one logical batch into several requests to
+//! its provider.
+//!
+//! The plaintext `Vec` is wiped before the pending request is returned, as a
+//! single value is. Sometimes an element fails to decrypt after earlier
+//! elements succeeded. The earlier plaintexts are then wiped before the error
+//! is returned. If an element's conversion panics, they are wiped before the
+//! panic unwinds.
+//!
+//! ```
+//! # async fn example() -> Result<(), stack_encrypt::Error> {
+//! use stack_encrypt::{Ciphertext, DecryptFrom, EncryptInto, StackCipher};
+//! // With no `.kms(..)`, the cipher uses ZeroKMS. It reads credentials from
+//! // the environment, or from the profile that `npx stash auth login` writes.
+//! let cipher = StackCipher::builder()
+//! #     .kms(stack_encrypt::kms::FakeDataKeySource::new())
+//!     .init()
+//!     .await?;
+//! let keyset = cipher.default_keyset();
+//!
+//! // Without a caller context, each element is encrypted under the empty context.
+//! let ages: Vec<Ciphertext> = vec![29i32, 34, 41].encrypt_into(&keyset).await?;
+//! assert_eq!(Vec::<i32>::decrypt_from(ages.clone(), &keyset).await?, [29, 34, 41]);
+//! // Each element is an ordinary ciphertext, which decrypts on its own.
+//! assert_eq!(keyset.decrypt::<i32>(ages[1].clone()).await?, 34);
+//!
+//! // With a caller context, the context is bound to every element.
+//! let names: Vec<Ciphertext> = vec!["ada".to_owned(), "grace".to_owned()]
+//!     .encrypt_into_with_context(&keyset, ("users", "name"))
+//!     .await?;
+//! let names = Vec::<String>::decrypt_from_with_context(names, &keyset, ("users", "name")).await?;
+//! assert_eq!(names, ["ada", "grace"]);
+//! # Ok(())
+//! # }
+//! # tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(example()).unwrap();
+//! ```
+//!
+//! A collection follows its element target's rules for a caller context. If
+//! the element target requires a context, the collection requires one. If
+//! the element target accepts no context, the collection cannot be given
+//! one.
+//!
+//! A `Vec<u8>` is one byte string, not a collection of bytes. Vitamin C
+//! encrypts a `Vec<u8>` as a single value, and `u8` is not an
+//! [`OpaqueEncode`] type. So a `Vec<u8>` encrypts into one `Ciphertext`, and
+//! a `Vec<Vec<u8>>` is a collection of byte strings.
+//!
 //! Existing structural plans and derives still use [`StackCipherText`], a tree
 //! of sealed leaves. Their low-level direct entry points are
 //! [`KeysetCipher::encrypt_tree`] and [`KeysetCipher::decrypt_tree`]; their
 //! borrowed conversion helpers live in [`target::legacy`]. They are separate
-//! from the owned scalar API. There is no generic `Serialize` fallback and
-//! no implicit `Vec<u8>` blob.
+//! from the owned scalar API. There is no generic `Serialize` fallback.
 //!
 //! # What is authenticated
 //!
@@ -362,5 +436,8 @@ pub use vitaminc_prf::PrfContext;
 pub use vitaminc_protected::{nonempty, nonempty_bytes, EmptyError, MaybeEmpty, NonEmpty};
 
 // And the wrapper plaintext comes back in (`ValueFrame::into_inner`, a
-// decrypted `Protected<T>`), with the trait that reads it.
-pub use vitaminc_protected::{Controlled, Protected};
+// decrypted `Protected<T>`), with the trait that reads it, and the wiping
+// buffer the re-exported frame writer writes into (`dynamic::frame`). The
+// frame readers take a `ProtectedRef` of bytes, which that buffer lends
+// through `AsProtectedRef`.
+pub use vitaminc_protected::{AsProtectedRef, Buffer, Controlled, Protected, ProtectedRef};
diff --git a/packages/stack-encrypt/src/scalar.rs b/packages/stack-encrypt/src/scalar.rs
index b5aadf1f8..a5cdb7600 100644
--- a/packages/stack-encrypt/src/scalar.rs
+++ b/packages/stack-encrypt/src/scalar.rs
@@ -5,7 +5,8 @@ use crate::target::{
     OptionalContext, Pending, ScalarContext,
 };
 use crate::{CipherText, Decrypt, Error, KeysetCipher, LeafBytesError, SealedValue};
-use vitaminc_aead::plaintext::{Encrypt, Sink};
+use vitaminc_aead::plaintext::{Encrypt, Scalar, Sink};
+use vitaminc_aead::FromScalar;
 use vitaminc_protected::OpaqueDebug;
 use zeroize::Zeroize;
 
@@ -20,41 +21,103 @@ mod sealed {
 
 /// A plaintext type that encrypts as one opaque [`Ciphertext`].
 ///
-/// Implemented for `bool`, the fixed-width signed integers, the unsigned
-/// integers from `u16` through `u128`, `f32`, `f64` and `String`. The trait is
-/// sealed: collections and borrowed values deliberately do not implement it.
-/// `u8` waits on separating Vitamin C's byte-buffer and element
-/// representations, and must not make `Vec<u8>` an implicit single
-/// ciphertext.
-/// Nullable `Option<T>` values are also deferred in this scalar slice. Use
-/// [`KeysetCipher::encrypt_tree`] and [`KeysetCipher::decrypt_tree`] for them;
-/// fixed-width nullable values retain Vitamin C's padded-null representation.
+/// `OpaqueEncode` is implemented for every owned type `S` that meets two
+/// conditions:
+///
+/// - `&S` implements Vitamin C's [`Scalar`] marker, so Vitamin C encrypts it
+///   as a single value.
+/// - `S` implements [`Zeroize`], so it can be wiped.
+///
+/// These built-in types meet both conditions:
+///
+/// - `bool`, `f32`, `f64`, and `String`
+/// - the fixed-width signed integers
+/// - the unsigned integers from `u16` to `u128`
+/// - the byte strings `Vec<u8>` and `[u8; N]`
+///
+/// A type of your own meets them if its borrow implements `Scalar` and the
+/// type implements `Zeroize`. The trait is sealed, so you cannot implement it
+/// directly.
+///
+/// A sequence is not a `Scalar`, so `Vec<u8>` is the only `Vec` that encrypts
+/// into one `Ciphertext`. A `Vec` of any other `OpaqueEncode` type encrypts
+/// element by element into a `Vec<Ciphertext>`, through [`EncryptInto`]. The
+/// [crate docs on collections](crate#collections) explain how. `u8` is not an `OpaqueEncode` type,
+/// because Vitamin C encrypts a `Vec<u8>` as one byte string, not as a
+/// collection of bytes.
+///
+/// # Nullable values
+///
+/// A nullable `Option<T>` is not an `OpaqueEncode` type either, so
+/// `keyset.encrypt(Some(34i64))` does not compile. Encrypt a nullable value
+/// with [`KeysetCipher::encrypt_tree`], which returns a [`StackCipherText`](crate::StackCipherText).
+/// Decrypt it with [`KeysetCipher::decrypt_tree`].
+///
+/// A `None` of a fixed-width type, such as `Option<i64>`, is encrypted as a
+/// null that is padded to the type's width. So its ciphertext is as long as
+/// the ciphertext of a `Some`, and the length does not show whether a value
+/// was present. Text has no fixed width, so the ciphertext of an
+/// `Option<String>` that is `None` is shorter than one that is `Some`.
+///
+/// ```
+/// # async fn example() -> Result<(), stack_encrypt::Error> {
+/// use stack_encrypt::StackCipher;
+/// // With no `.kms(..)`, the cipher uses ZeroKMS. It reads credentials from
+/// // the environment, or from the profile that `npx stash auth login` writes.
+/// let cipher = StackCipher::builder()
+/// #     .kms(stack_encrypt::kms::FakeDataKeySource::new())
+///     .init()
+///     .await?;
+/// let keyset = cipher.default_keyset();
+///
+/// // A value that is present.
+/// let stored = keyset.encrypt_tree(Some(34i64), ("users", "age")).await?;
+/// let age: Option<i64> = keyset.decrypt_tree(stored, ("users", "age")).await?;
+/// assert_eq!(age, Some(34));
+///
+/// // A value that is absent. Its ciphertext is as long as a present one's.
+/// let stored = keyset.encrypt_tree(None::<i64>, ("users", "age")).await?;
+/// let age: Option<i64> = keyset.decrypt_tree(stored, ("users", "age")).await?;
+/// assert_eq!(age, None);
+/// # Ok(())
+/// # }
+/// # tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(example()).unwrap();
+/// ```
 pub trait OpaqueEncode: sealed::Encode + Zeroize + Send + 'static {}
 
-/// A plaintext type that one opaque [`Ciphertext`] decrypts to: the types
-/// that implement [`OpaqueEncode`]. Sealed, like it.
+/// A plaintext type that one opaque [`Ciphertext`] decrypts to.
+///
+/// `OpaqueDecode` is implemented for every [`FromScalar`] type that also
+/// implements [`Zeroize`]. Every built-in [`OpaqueEncode`] type is one. The
+/// trait is sealed, as `OpaqueEncode` is.
 pub trait OpaqueDecode: sealed::Decode + Decrypt + Zeroize + Send + 'static {}
 
-macro_rules! opaque {
-    ($($ty:ty),* $(,)?) => {$(
-        impl sealed::Encode for $ty {
-            const DEPTH: Option<usize> = <&$ty as Encrypt>::DEPTH;
-            const FIXED: Option<vitaminc_aead::plaintext::FixedType> = <&$ty as Encrypt>::FIXED;
-            fn visit<S: Sink>(&self, sink: S) -> Result<S::Ok, S::Error> {
-                Encrypt::visit(self, sink)
-            }
-        }
-        impl sealed::Decode for $ty {}
-        impl OpaqueEncode for $ty {}
-        impl OpaqueDecode for $ty {}
-    )*};
+// The bridge from an owned `S` to its borrow's walk: `OpaqueEncode`'s
+// callers hold `&S`, and only this impl's where clause knows `&S` encrypts.
+impl<S> sealed::Encode for S
+where
+    S: Zeroize + Send + 'static,
+    for<'a> &'a S: Scalar,
+{
+    const DEPTH: Option<usize> = <&S as Encrypt>::DEPTH;
+    const FIXED: Option<vitaminc_aead::plaintext::FixedType> = <&S as Encrypt>::FIXED;
+    fn visit<V: Sink>(&self, sink: V) -> Result<V::Ok, V::Error> {
+        Encrypt::visit(self, sink)
+    }
+}
+impl<S> OpaqueEncode for S
+where
+    S: Zeroize + Send + 'static,
+    for<'a> &'a S: Scalar,
+{
 }
-opaque!(bool, i8, i16, i32, i64, i128, u16, u32, u64, u128, f32, f64, String);
+impl<P: FromScalar + Zeroize + Send + 'static> sealed::Decode for P {}
+impl<P: FromScalar + Zeroize + Send + 'static> OpaqueDecode for P {}
 
 pub(crate) struct ScalarRef<'a, S>(pub &'a S);
-// Vitamin C 0.8 implements Encrypt for &Protected<T>, but not ProtectedRef<T>.
-// This bridge preserves its encoding metadata while the owned conversion keeps
-// the source in Protected. Replace it when the encoder accepts protected borrows.
+// The owned conversion keeps the source in Protected and hands this a borrow.
+// It carries the scalar's encoding metadata through `sealed::Encode`, whose
+// supertrait bound is what lets a generic caller walk `&S` at all.
 impl<S: OpaqueEncode> Encrypt for ScalarRef<'_, S> {
     const DEPTH: Option<usize> = <S as sealed::Encode>::DEPTH;
     const FIXED: Option<vitaminc_aead::plaintext::FixedType> = <S as sealed::Encode>::FIXED;
diff --git a/packages/stack-encrypt/src/target/collections.rs b/packages/stack-encrypt/src/target/collections.rs
new file mode 100644
index 000000000..08be9547e
--- /dev/null
+++ b/packages/stack-encrypt/src/target/collections.rs
@@ -0,0 +1,77 @@
+//! Owned collections. A `Vec<S>` encrypts into a `Vec<T>` as one logical
+//! batch, and a `Vec<T>` decrypts back. Both use the element target's own
+//! declaration.
+//!
+//! A collection declares nothing of its own. A collection's `ContextInput` is
+//! the element target's, so the element target decides once whether a caller can
+//! omit a context or must give one. The same rule then applies to the whole
+//! collection. For example, a `Vec<Ciphertext>` needs no caller context, but
+//! a collection of a `RequiredContext` target does. `Default` does not affect
+//! this.
+//!
+//! Each element is encrypted under its own ZeroKMS data key and authenticated
+//! on its own. The collection's length and the order of its elements are not
+//! part of what is authenticated. That suits a very common case, where each
+//! element is stored in its own database row. A database can return rows in
+//! any order. A query can also return only some of them.
+//!
+//! [`Pending::collect`] merges the elements' key requests into one logical
+//! batch, in element order. An empty collection makes no request. The key
+//! source can still split one logical batch into several requests to its
+//! provider.
+//!
+//! A `Vec<u8>` is not a collection. Vitamin C encrypts a `Vec<u8>` as one
+//! byte string, and `u8` is not an opaque scalar. So
+//! `vec![1u8].encrypt_into::<Vec<Ciphertext>, _>(..)` does not compile. A
+//! `Vec<u8>` encrypts into one `Ciphertext`, and a `Vec<Vec<u8>>` is a
+//! collection of them. A nullable element, `Option<S>`, is not an opaque scalar either.
+use super::{DecryptSource, Decryption, EncryptTarget, Encryption, Pending};
+use stack_kms::MaybeSend;
+use zeroize::Zeroize;
+
+impl<S: Zeroize, T: EncryptTarget<S>> EncryptTarget<Vec<S>> for Vec<T>
+where
+    T::ContextInput: Clone + MaybeSend + 'static,
+{
+    /// The element target's context input. A collection can omit a context
+    /// only if one element can. A collection must be given a context if one
+    /// element must.
+    type ContextInput = T::ContextInput;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, Vec<S>, Self, K, Self::ContextInput>
+    where
+        S: 's,
+    {
+        // Each element is handed by reference to the element declaration,
+        // which runs in its usual borrowed mode: the owned conversion holds
+        // the whole vector in its guard, and nothing is cloned. The
+        // collection stops declaring at the first element that fails, so a
+        // refused context is reported once rather than once per row.
+        Encryption::from_build(
+            move |source: &'s Vec<S>, cipher, context: T::ContextInput| {
+                Pending::collect(
+                    cipher,
+                    source
+                        .iter()
+                        .map(|element| cipher.run(T::encryption(), element, context.clone())),
+                )
+            },
+        )
+    }
+}
+
+impl<P: Zeroize + 'static, T: DecryptSource<P>> DecryptSource<Vec<P>> for Vec<T>
+where
+    T::ContextInput: Clone,
+{
+    /// The element target's context input, as for encryption.
+    type ContextInput = T::ContextInput;
+    fn decryption<K: 'static>(self, context: Self::ContextInput) -> Decryption<Vec<P>, K> {
+        // Every element's keys are retrieved in one batch and the results
+        // keep element order. An element that fails after its key arrived
+        // fails the collection, and the elements recovered before it are wiped.
+        Decryption::all_wiping(
+            self.into_iter()
+                .map(|element| element.decryption(context.clone())),
+        )
+    }
+}
diff --git a/packages/stack-encrypt/src/target/mod.rs b/packages/stack-encrypt/src/target/mod.rs
index 79df136cd..b89e6f579 100644
--- a/packages/stack-encrypt/src/target/mod.rs
+++ b/packages/stack-encrypt/src/target/mod.rs
@@ -5,6 +5,11 @@
 //! capabilities explicitly allow omission or supply; `Default` does not
 //! determine either. [`scalar_ciphertext`] is the first owned operation.
 //!
+//! A `Vec<S>` of owned plaintexts encrypts into a `Vec<T>` of any owned
+//! target, and decrypts back the same way. The collection uses the element
+//! target's `ContextInput`. The collection makes one logical batch of key
+//! requests. Each element is authenticated on its own.
+//!
 //! # Structural API during migration
 //!
 //! Existing derives, plans and dynamic targets still use the declarations
@@ -79,10 +84,12 @@
 //!
 //! # Collections and authentication
 //!
-//! `Vec<Target>` describes independently encrypted rows under the same context.
-//! Encrypting a plaintext `Vec<T>` into `StackCipherText` instead follows Vitamin
-//! C's native sequence model, including its authenticated empty marker. The same
-//! distinction applies to `Option<Target>` versus a native encrypted option.
+//! `Vec<Target>` describes rows that are each encrypted on their own, under
+//! the same context. That rule applies on the owned path, where a `Vec<S>` encrypts
+//! into a `Vec` of [`EncryptTarget`]s, and on the structural path. Encrypting a plaintext `Vec<T>` into `StackCipherText` instead
+//! follows Vitamin C's native sequence model, including its authenticated empty
+//! marker. The same distinction applies to `Option<Target>` versus a native
+//! encrypted option.
 //! Readers preserve marker ciphertext and map keys; changing a key changes the
 //! authenticated context when opening. Passthrough metadata and query terms are
 //! not presented as AEAD-authenticated values.
@@ -95,6 +102,7 @@
 //! `cipher.decrypt_as(record, context)`, or import [`legacy::EncryptInto`] and
 //! [`legacy::DecryptFrom`] while migrating these declarations. New scalar
 //! targets implement [`EncryptTarget`] and [`DecryptSource`].
+mod collections;
 mod context;
 mod conversion;
 pub(crate) mod core;
diff --git a/packages/stack-encrypt/src/target/operations.rs b/packages/stack-encrypt/src/target/operations.rs
index cc50c253e..5c416e382 100644
--- a/packages/stack-encrypt/src/target/operations.rs
+++ b/packages/stack-encrypt/src/target/operations.rs
@@ -165,6 +165,21 @@ impl<T, K> fmt::Debug for Decryption<T, K> {
 impl<'s, S: 's, T: 'static, K: 'static, Ctx: 's, M: SourceMode<'s, S>>
     Encryption<'s, S, T, K, Ctx, M>
 {
+    /// A description built from its execution closure. This constructor is
+    /// crate-internal, because it gives a closure the source and the cipher
+    /// together, and the public constructors never do that. The collection
+    /// declarations use it to run an element's description once for each
+    /// element.
+    pub(crate) fn from_build<F>(build: F) -> Self
+    where
+        F: for<'a, 'k> FnOnce(M::Source, &'a KeysetCipher<'k, K>, Ctx) -> Pending<'a, T, K>
+            + MaybeSend
+            + 's,
+    {
+        Self {
+            build: Box::new(build),
+        }
+    }
     /// A description whose output is already known — metadata a record
     /// carries, or a declaration rejected before any key request.
     pub fn ready(result: Result<T, Error>) -> Self
@@ -396,9 +411,7 @@ where
         + MaybeSend
         + 's,
 {
-    Encryption {
-        build: Box::new(choose),
-    }
+    Encryption::from_build(choose)
 }
 
 /// A description that only checks the borrowed source, yielding `()` or the
@@ -808,19 +821,47 @@ impl<T: 'static, K: 'static> Decryption<T, K> {
     /// built. A `Vec<T>` whose rows validate a stored context does not go on
     /// validating rows once one has been refused.
     pub fn all<I>(items: I) -> Decryption<Vec<T>, K>
+    where
+        I: IntoIterator<Item = Self>,
+    {
+        match Self::openings(items) {
+            Err(error) => Decryption::failed(error),
+            Ok(opens) => Decryption::open(Box::new(move |cipher| {
+                Pending::collect(cipher, opens.into_iter().map(|open| open(cipher)))
+            })),
+        }
+    }
+    /// The same as [`all`](Self::all), but for recovered plaintext. When an
+    /// item fails after its key arrived, `all` drops the items recovered
+    /// before it. This function wipes them. The owned `Vec<S>` conversions
+    /// decrypt through this function.
+    pub(crate) fn all_wiping<I>(items: I) -> Decryption<Vec<T>, K>
+    where
+        I: IntoIterator<Item = Self>,
+        T: zeroize::Zeroize,
+    {
+        match Self::openings(items) {
+            Err(error) => Decryption::failed(error),
+            Ok(opens) => Decryption::open(Box::new(move |cipher| {
+                Pending::collect_wiping(cipher, opens.into_iter().map(|open| open(cipher)))
+            })),
+        }
+    }
+    /// The openings of `items`, up to the first description that fails. If a
+    /// description fails, this returns its error, and the descriptions after
+    /// it are never built.
+    fn openings<I>(items: I) -> Result<Vec<Open<T, K>>, Error>
     where
         I: IntoIterator<Item = Self>,
     {
         let mut opens = Vec::new();
         for item in items {
             match item.inner {
-                Opening::Failed(error) => return Decryption::failed(error),
+                Opening::Failed(error) => return Err(error),
                 Opening::Open(open) => opens.push(open),
             }
         }
-        Decryption::open(Box::new(move |cipher| {
-            Pending::collect(cipher, opens.into_iter().map(|open| open(cipher)))
-        }))
+        Ok(opens)
     }
     /// An absent item recovers as `None` without I/O.
     fn optional(item: Option<Self>) -> Decryption<Option<T>, K>
diff --git a/packages/stack-encrypt/src/target/pending.rs b/packages/stack-encrypt/src/target/pending.rs
index b62935126..11089a99f 100644
--- a/packages/stack-encrypt/src/target/pending.rs
+++ b/packages/stack-encrypt/src/target/pending.rs
@@ -339,6 +339,39 @@ impl<'a, T: 'a, K> Pending<'a, T, K> {
     pub(crate) fn collect(
         scope: impl CipherScope<'a, K>,
         items: impl IntoIterator<Item = Pending<'a, T, K>>,
+    ) -> Pending<'a, Vec<T>, K> {
+        Self::collect_releasing(scope, items, drop)
+    }
+
+    /// The same as [`collect`](Self::collect), but for a collection of
+    /// recovered plaintext. `collect` drops the items recovered before a
+    /// failure. This function wipes them.
+    ///
+    /// The wipe applies when a later item fails at fulfilment, after its key
+    /// arrived. That failure can be an authentication failure, a type
+    /// failure, or a panic in the item's conversion. The items recovered
+    /// before it are wiped before the error is returned, or before the panic
+    /// unwinds. A failure before fulfilment recovers nothing, so there is
+    /// nothing to wipe.
+    pub(crate) fn collect_wiping(
+        scope: impl CipherScope<'a, K>,
+        items: impl IntoIterator<Item = Pending<'a, T, K>>,
+    ) -> Pending<'a, Vec<T>, K>
+    where
+        T: zeroize::Zeroize,
+    {
+        Self::collect_releasing(scope, items, |mut recovered| {
+            zeroize::Zeroize::zeroize(&mut recovered)
+        })
+    }
+
+    /// The collection builder that `collect` and `collect_wiping` both use.
+    /// When an item fails or panics, `release` receives the items fulfilled
+    /// before it. When every item succeeds, `release` is not called.
+    fn collect_releasing(
+        scope: impl CipherScope<'a, K>,
+        items: impl IntoIterator<Item = Pending<'a, T, K>>,
+        release: impl FnOnce(Vec<T>) + MaybeSend + 'a,
     ) -> Pending<'a, Vec<T>, K> {
         let items = items.into_iter();
         let cipher = scope.cipher();
@@ -365,15 +398,46 @@ impl<'a, T: 'a, K> Pending<'a, T, K> {
             requests,
             failed: None,
             fulfil: Box::new(move |responses| {
-                fulfils
-                    .into_iter()
-                    .map(|fulfil| fulfil(responses))
-                    .collect()
+                // Held in a guard so that an item whose fulfilment panics
+                // releases the prefix during the unwind, as an error does.
+                let mut recovered = Recovered {
+                    items: Vec::with_capacity(fulfils.len()),
+                    release: Some(release),
+                };
+                for fulfil in fulfils {
+                    recovered.items.push(fulfil(responses)?);
+                }
+                Ok(recovered.keep())
             }),
         }
     }
 }
 
+/// The items a collection has recovered so far. If this guard is dropped
+/// before [`keep`](Self::keep) is called, by an early return or an unwind, it
+/// passes the items to `release`.
+struct Recovered<T, R: FnOnce(Vec<T>)> {
+    items: Vec<T>,
+    release: Option<R>,
+}
+
+impl<T, R: FnOnce(Vec<T>)> Recovered<T, R> {
+    /// Returns the items as the output, without releasing them. Call this
+    /// when every item has succeeded.
+    fn keep(mut self) -> Vec<T> {
+        self.release = None;
+        std::mem::take(&mut self.items)
+    }
+}
+
+impl<T, R: FnOnce(Vec<T>)> Drop for Recovered<T, R> {
+    fn drop(&mut self) {
+        if let Some(release) = self.release.take() {
+            release(std::mem::take(&mut self.items));
+        }
+    }
+}
+
 impl<'a, T: 'a, K> Pending<'a, T, K>
 where
     K: DataKeySource + IndexKeySource,
diff --git a/packages/stack-encrypt/tests/collections.rs b/packages/stack-encrypt/tests/collections.rs
new file mode 100644
index 000000000..50c6568a8
--- /dev/null
+++ b/packages/stack-encrypt/tests/collections.rs
@@ -0,0 +1,527 @@
+//! Owned collections: `Vec<S>` encrypts into `Vec<T>` and back as one
+//! logical batch of independently authenticated elements. No service
+//! credentials are needed.
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+
+use stack_encrypt::target::{
+    AcceptsContext, DecryptSource, Decryption, EncryptTarget, Encryption, NoCallerContext,
+    OptionalContext, RequiredContext, ScalarContext,
+};
+use stack_encrypt::{Ciphertext, DecryptFrom, EncryptInto, Error};
+mod common;
+
+#[tokio::test]
+async fn a_column_round_trips_without_caller_context_in_one_batch() {
+    let (cipher, generates, retrieves) = common::counting_cipher().await;
+    let keyset = cipher.default_keyset();
+    let ages = vec![3i32, -1, 42, 0, 7];
+
+    let column: Vec<Ciphertext> = ages.clone().encrypt_into(&keyset).await.unwrap();
+    assert_eq!(column.len(), ages.len());
+    assert_eq!(
+        generates.load(Ordering::SeqCst),
+        1,
+        "five elements share one generate_keys call"
+    );
+
+    let opened = Vec::<i32>::decrypt_from(column.clone(), &keyset)
+        .await
+        .unwrap();
+    assert_eq!(opened, ages, "order is preserved");
+    assert_eq!(
+        retrieves.load(Ordering::SeqCst),
+        1,
+        "five elements share one retrieve_keys call"
+    );
+
+    // Every element is an ordinary opaque ciphertext: the scalar API opens
+    // it on its own, under the same empty context.
+    for (element, age) in column.into_iter().zip(ages) {
+        assert_eq!(keyset.decrypt::<i32>(element).await.unwrap(), age);
+    }
+
+    let names = vec!["ada".to_owned(), "grace".to_owned()];
+    let column: Vec<Ciphertext> = names.clone().encrypt_into(&keyset).await.unwrap();
+    assert_eq!(
+        Vec::<String>::decrypt_from(column, &cipher).await.unwrap(),
+        names
+    );
+}
+
+#[tokio::test]
+async fn a_column_round_trips_with_caller_context() {
+    let cipher = common::stack_cipher().await;
+    let keyset = cipher.default_keyset();
+    let ages = vec![29i32, 34, 41];
+
+    let column: Vec<Ciphertext> = ages
+        .clone()
+        .encrypt_into_with_context(&keyset, ("users", "age"))
+        .await
+        .unwrap();
+    assert_eq!(
+        Vec::<i32>::decrypt_from_with_context(column.clone(), &keyset, ("users", "age"))
+            .await
+            .unwrap(),
+        ages
+    );
+    // The context is each element's own AAD, as the scalar API binds it.
+    assert_eq!(
+        keyset
+            .decrypt_with_context::<i32>(column[1].clone(), ("users", "age"))
+            .await
+            .unwrap(),
+        34
+    );
+    assert!(matches!(
+        Vec::<i32>::decrypt_from(column.clone(), &keyset).await,
+        Err(Error::Aead)
+    ));
+    assert!(matches!(
+        Vec::<i32>::decrypt_from_with_context(column, &keyset, ("users", "name")).await,
+        Err(Error::Aead)
+    ));
+}
+
+#[tokio::test]
+async fn an_empty_column_makes_no_key_request() {
+    let (cipher, generates, retrieves) = common::counting_cipher().await;
+    let keyset = cipher.default_keyset();
+    let column: Vec<Ciphertext> = Vec::<i32>::new().encrypt_into(&keyset).await.unwrap();
+    assert!(column.is_empty());
+    let opened = Vec::<i32>::decrypt_from(column, &keyset).await.unwrap();
+    assert!(opened.is_empty());
+    assert_eq!(generates.load(Ordering::SeqCst), 0);
+    assert_eq!(retrieves.load(Ordering::SeqCst), 0);
+}
+
+#[tokio::test]
+async fn elements_are_authenticated_on_their_own_not_as_a_sequence() {
+    let cipher = common::stack_cipher().await;
+    let keyset = cipher.default_keyset();
+    let column: Vec<Ciphertext> = vec![1i32, 2, 3].encrypt_into(&keyset).await.unwrap();
+
+    // Neither order nor length is authenticated: stored values are rows,
+    // which come back in any order and in part.
+    let mut reordered = column.clone();
+    reordered.reverse();
+    assert_eq!(
+        Vec::<i32>::decrypt_from(reordered, &keyset).await.unwrap(),
+        [3, 2, 1]
+    );
+    assert_eq!(
+        Vec::<i32>::decrypt_from(column[..2].to_vec(), &keyset)
+            .await
+            .unwrap(),
+        [1, 2]
+    );
+
+    // Each element is: one altered byte fails the column.
+    let mut bytes = column[1].to_bytes();
+    *bytes.last_mut().unwrap() ^= 1;
+    let mut tampered = column.clone();
+    tampered[1] = Ciphertext::from_bytes(&bytes).unwrap();
+    assert!(matches!(
+        Vec::<i32>::decrypt_from(tampered, &keyset).await,
+        Err(Error::Aead)
+    ));
+
+    // The element's type is its own too: an element of another type in
+    // the column is a shape refusal, not tampering.
+    let mut mixed = column.clone();
+    mixed[2] = keyset.encrypt("three".to_owned()).await.unwrap();
+    assert!(matches!(
+        Vec::<i32>::decrypt_from(mixed, &keyset).await,
+        Err(Error::OpenedType { .. })
+    ));
+}
+
+#[tokio::test]
+async fn a_foreign_keyset_element_is_refused_before_retrieval() {
+    let (cipher, _, retrieves) = common::counting_cipher().await;
+    let keyset = cipher.default_keyset();
+    let other = cipher
+        .keyset(stack_encrypt::kms::IdentifiedBy::Uuid(uuid::Uuid::new_v4()))
+        .await
+        .unwrap();
+    let column: Vec<Ciphertext> = vec![1i32, 2].encrypt_into(&keyset).await.unwrap();
+    assert!(matches!(
+        Vec::<i32>::decrypt_from(column, &other).await,
+        Err(Error::ForeignKeyset { .. })
+    ));
+    assert_eq!(retrieves.load(Ordering::SeqCst), 0);
+}
+
+#[tokio::test]
+async fn a_byte_string_is_one_ciphertext_and_a_column_of_them_is_a_column() {
+    let (cipher, generates, retrieves) = common::counting_cipher().await;
+    let keyset = cipher.default_keyset();
+
+    // One byte leaf: one ciphertext, one key.
+    let blob: Ciphertext = vec![0u8, 1, 255].encrypt_into(&keyset).await.unwrap();
+    assert_eq!(
+        Vec::<u8>::decrypt_from(blob.clone(), &keyset)
+            .await
+            .unwrap(),
+        [0, 1, 255]
+    );
+    // A byte leaf opened as a `String` is a type mismatch, not tampering.
+    assert!(matches!(
+        keyset.decrypt::<String>(blob).await,
+        Err(Error::OpenedType { .. })
+    ));
+    assert_eq!(generates.load(Ordering::SeqCst), 1);
+    assert_eq!(retrieves.load(Ordering::SeqCst), 2);
+
+    // A column of byte strings, the empty one included, is one batch.
+    let blobs = vec![vec![1u8, 2, 3], vec![], vec![9]];
+    let column: Vec<Ciphertext> = blobs.clone().encrypt_into(&keyset).await.unwrap();
+    assert_eq!(column.len(), 3);
+    assert_eq!(generates.load(Ordering::SeqCst), 2);
+    assert_eq!(
+        Vec::<Vec<u8>>::decrypt_from(column.clone(), &keyset)
+            .await
+            .unwrap(),
+        blobs
+    );
+    assert_eq!(retrieves.load(Ordering::SeqCst), 3);
+    // Each element is an ordinary byte-string ciphertext.
+    assert_eq!(
+        keyset.decrypt::<Vec<u8>>(column[2].clone()).await.unwrap(),
+        [9]
+    );
+
+    // A fixed-width byte array is a byte leaf too.
+    let key: Ciphertext = [7u8; 16].encrypt_into(&keyset).await.unwrap();
+    assert_eq!(
+        <[u8; 16]>::decrypt_from(key, &keyset).await.unwrap(),
+        [7u8; 16]
+    );
+}
+
+#[tokio::test]
+async fn nested_columns_settle_in_one_batch_and_keep_their_shape() {
+    let (cipher, generates, retrieves) = common::counting_cipher().await;
+    let keyset = cipher.default_keyset();
+    let rows = vec![vec![1i32, 2], vec![], vec![3]];
+    let column: Vec<Vec<Ciphertext>> = rows.clone().encrypt_into(&keyset).await.unwrap();
+    assert_eq!(column.iter().map(Vec::len).collect::<Vec<_>>(), [2, 0, 1]);
+    assert_eq!(generates.load(Ordering::SeqCst), 1);
+    assert_eq!(
+        Vec::<Vec<i32>>::decrypt_from(column, &keyset)
+            .await
+            .unwrap(),
+        rows
+    );
+    assert_eq!(retrieves.load(Ordering::SeqCst), 1);
+}
+
+// A target that requires a caller context, even though `u64: Default`.
+struct BoundInteger(Ciphertext);
+impl EncryptTarget<i32> for BoundInteger {
+    type ContextInput = RequiredContext<u64>;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, i32, Self, K, Self::ContextInput> {
+        stack_encrypt::target::scalar_ciphertext()
+            .map(Self)
+            .accepting()
+    }
+}
+impl DecryptSource<i32> for BoundInteger {
+    type ContextInput = RequiredContext<u64>;
+    fn decryption<K: 'static>(self, context: Self::ContextInput) -> Decryption<i32, K> {
+        self.0
+            .decryption(OptionalContext::<ScalarContext>::supplied(
+                context.into_inner().into(),
+            ))
+    }
+}
+#[tokio::test]
+async fn a_column_of_a_required_context_target_takes_the_elements_requirement() {
+    let cipher = common::stack_cipher().await;
+    let keyset = cipher.default_keyset();
+    let column: Vec<BoundInteger> = vec![1i32, 2, 3]
+        .encrypt_into_with_context(&keyset, 7u64)
+        .await
+        .unwrap();
+    assert_eq!(
+        keyset
+            .decrypt_with_context::<i32>(column[0].0.clone(), 7u64)
+            .await
+            .unwrap(),
+        1
+    );
+    let wrong: Vec<BoundInteger> = column.iter().map(|b| BoundInteger(b.0.clone())).collect();
+    assert!(matches!(
+        Vec::<i32>::decrypt_from_with_context(wrong, &keyset, 8u64).await,
+        Err(Error::Aead)
+    ));
+    assert_eq!(
+        Vec::<i32>::decrypt_from_with_context(column, &keyset, 7u64)
+            .await
+            .unwrap(),
+        [1, 2, 3]
+    );
+}
+
+// A target that declares its whole context and accepts none from the caller.
+struct FixedInteger(Ciphertext);
+impl EncryptTarget<i32> for FixedInteger {
+    type ContextInput = NoCallerContext;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, i32, Self, K, Self::ContextInput> {
+        stack_encrypt::target::scalar_ciphertext()
+            .map(Self)
+            .under(stack_encrypt::nonempty!("users/fixed-age"))
+            .accepting()
+    }
+}
+impl DecryptSource<i32> for FixedInteger {
+    type ContextInput = NoCallerContext;
+    fn decryption<K: 'static>(self, _: Self::ContextInput) -> Decryption<i32, K> {
+        self.0
+            .decryption(OptionalContext::<ScalarContext>::supplied(
+                "users/fixed-age".into(),
+            ))
+    }
+}
+#[tokio::test]
+async fn a_column_of_a_no_caller_context_target_keeps_the_declared_context() {
+    let cipher = common::stack_cipher().await;
+    let keyset = cipher.default_keyset();
+    let column: Vec<FixedInteger> = vec![5i32, 6].encrypt_into(&keyset).await.unwrap();
+    assert_eq!(
+        keyset
+            .decrypt_with_context::<i32>(column[1].0.clone(), "users/fixed-age")
+            .await
+            .unwrap(),
+        6
+    );
+    assert_eq!(
+        Vec::<i32>::decrypt_from(column, &keyset).await.unwrap(),
+        [5, 6]
+    );
+}
+
+// Deliberately not Clone: a column of these is held by the conversion's
+// guard and handed to each element's declaration by reference.
+struct Tracked {
+    value: String,
+    wiped: Arc<AtomicBool>,
+}
+impl zeroize::Zeroize for Tracked {
+    fn zeroize(&mut self) {
+        self.value.zeroize();
+        self.wiped.store(true, Ordering::SeqCst);
+    }
+}
+impl Drop for Tracked {
+    fn drop(&mut self) {
+        assert!(
+            self.value.is_empty(),
+            "owned plaintext dropped without wiping"
+        );
+    }
+}
+fn tracked(value: &str) -> (Tracked, Arc<AtomicBool>) {
+    let wiped = Arc::new(AtomicBool::new(false));
+    (
+        Tracked {
+            value: value.to_owned(),
+            wiped: wiped.clone(),
+        },
+        wiped,
+    )
+}
+fn tracked_column(values: &[&str]) -> (Vec<Tracked>, Vec<Arc<AtomicBool>>) {
+    values.iter().map(|value| tracked(value)).unzip()
+}
+fn all_wiped(flags: &[Arc<AtomicBool>]) -> bool {
+    flags.iter().all(|flag| flag.load(Ordering::SeqCst))
+}
+struct TrackedCiphertext {
+    ciphertext: Ciphertext,
+    /// Set when the plaintext this opens to is wiped.
+    wiped: Arc<AtomicBool>,
+}
+impl TrackedCiphertext {
+    fn new(ciphertext: Ciphertext) -> Self {
+        Self {
+            ciphertext,
+            wiped: Arc::default(),
+        }
+    }
+}
+impl EncryptTarget<Tracked> for TrackedCiphertext {
+    type ContextInput = OptionalContext<ScalarContext>;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, Tracked, Self, K, Self::ContextInput> {
+        stack_encrypt::target::scalar_ciphertext::<String, K>()
+            .project(|source: &Tracked| &source.value)
+            .map(Self::new)
+    }
+}
+/// Opens to a [`Tracked`], so wiping of recovered plaintext is observable.
+impl DecryptSource<Tracked> for TrackedCiphertext {
+    type ContextInput = OptionalContext<ScalarContext>;
+    fn decryption<K: 'static>(self, context: Self::ContextInput) -> Decryption<Tracked, K> {
+        let wiped = self.wiped;
+        self.ciphertext
+            .decryption(context)
+            .map(move |value: String| Tracked { value, wiped })
+    }
+}
+
+#[tokio::test]
+async fn owned_elements_are_wiped_before_the_pending_is_returned() {
+    let (cipher, generates, _) = common::counting_cipher().await;
+    let keyset = cipher.default_keyset();
+
+    let (column, wiped) = tracked_column(&["one", "two", "three"]);
+    let pending = column.encrypt_into::<Vec<TrackedCiphertext>, _>(&keyset);
+    assert!(all_wiped(&wiped), "every element is wiped before any await");
+    assert_eq!(generates.load(Ordering::SeqCst), 0);
+    drop(pending);
+    assert_eq!(generates.load(Ordering::SeqCst), 0);
+
+    let (column, wiped) = tracked_column(&["one", "two", "three"]);
+    let pending = column.encrypt_into::<Vec<TrackedCiphertext>, _>(&keyset);
+    assert!(all_wiped(&wiped));
+    let encrypted = pending.await.unwrap();
+    assert_eq!(generates.load(Ordering::SeqCst), 1);
+    let opened: Vec<String> = Vec::<String>::decrypt_from(
+        encrypted
+            .into_iter()
+            .map(|t| t.ciphertext)
+            .collect::<Vec<_>>(),
+        &keyset,
+    )
+    .await
+    .unwrap();
+    assert_eq!(opened, ["one", "two", "three"]);
+}
+
+#[tokio::test]
+async fn owned_elements_are_wiped_when_the_context_is_refused() {
+    let (cipher, generates, _) = common::counting_cipher().await;
+    let keyset = cipher.default_keyset();
+    let (column, wiped) = tracked_column(&["one", "two"]);
+    let pending =
+        column.encrypt_into_with_context::<Vec<TrackedCiphertext>, _>(&keyset, "x".repeat(65536));
+    assert!(all_wiped(&wiped));
+    assert!(pending.await.is_err());
+    assert_eq!(generates.load(Ordering::SeqCst), 0);
+}
+
+#[tokio::test]
+async fn owned_elements_are_guarded_during_context_conversion() {
+    struct Panics;
+    impl From<Panics> for ScalarContext {
+        fn from(_: Panics) -> Self {
+            panic!("conversion failed")
+        }
+    }
+    let cipher = common::stack_cipher().await;
+    let keyset = cipher.default_keyset();
+    let (column, wiped) = tracked_column(&["one", "two"]);
+    let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        column.encrypt_into_with_context::<Vec<TrackedCiphertext>, _>(&keyset, Panics)
+    }));
+    assert!(result.is_err());
+    assert!(all_wiped(&wiped));
+}
+
+#[tokio::test]
+async fn a_late_element_failure_wipes_the_plaintext_recovered_before_it() {
+    let (cipher, _, retrieves) = common::counting_cipher().await;
+    let keyset = cipher.default_keyset();
+    let first = keyset.encrypt("recovered first".to_owned()).await.unwrap();
+    // The second element is sealed under another context, so it fails
+    // authentication only once its key has arrived: the first element has
+    // been recovered by then.
+    let second = keyset
+        .encrypt_with_context("never recovered".to_owned(), "elsewhere")
+        .await
+        .unwrap();
+    let column = vec![
+        TrackedCiphertext::new(first),
+        TrackedCiphertext::new(second),
+    ];
+    let wiped: Vec<_> = column.iter().map(|t| t.wiped.clone()).collect();
+    // `Tracked::drop` also fails the test if the recovered prefix is
+    // dropped unwiped.
+    let result = Vec::<Tracked>::decrypt_from(column, &keyset).await;
+    assert!(matches!(result, Err(Error::Aead)), "{:?}", result.err());
+    assert!(
+        wiped[0].load(Ordering::SeqCst),
+        "the recovered prefix is wiped"
+    );
+    assert!(
+        !wiped[1].load(Ordering::SeqCst),
+        "nothing was recovered to wipe"
+    );
+    assert_eq!(retrieves.load(Ordering::SeqCst), 1, "both keys in one call");
+}
+
+// Opens to a `Flagged`, and panics in its conversion when told to. `Flagged`
+// has no drop check of its own, so an unwiped drop during the unwind is seen
+// through the flag rather than as an abort.
+struct Flagged {
+    value: String,
+    wiped: Arc<AtomicBool>,
+}
+impl zeroize::Zeroize for Flagged {
+    fn zeroize(&mut self) {
+        self.value.zeroize();
+        self.wiped.store(true, Ordering::SeqCst);
+    }
+}
+struct PanickingCiphertext {
+    ciphertext: Ciphertext,
+    panics: bool,
+    wiped: Arc<AtomicBool>,
+}
+impl DecryptSource<Flagged> for PanickingCiphertext {
+    type ContextInput = OptionalContext<ScalarContext>;
+    fn decryption<K: 'static>(self, context: Self::ContextInput) -> Decryption<Flagged, K> {
+        let (panics, wiped) = (self.panics, self.wiped);
+        self.ciphertext
+            .decryption(context)
+            .map(move |value: String| {
+                assert!(!panics, "element conversion failed");
+                Flagged { value, wiped }
+            })
+    }
+}
+
+#[test]
+fn a_panicking_element_conversion_wipes_the_plaintext_recovered_before_it() {
+    let rt = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    let cipher = rt.block_on(common::stack_cipher());
+    let keyset = cipher.default_keyset();
+    let column: Vec<_> = rt
+        .block_on(async {
+            vec![
+                keyset.encrypt("recovered first".to_owned()).await.unwrap(),
+                keyset.encrypt("never recovered".to_owned()).await.unwrap(),
+            ]
+        })
+        .into_iter()
+        .enumerate()
+        .map(|(row, ciphertext)| PanickingCiphertext {
+            ciphertext,
+            panics: row == 1,
+            wiped: Arc::default(),
+        })
+        .collect();
+    let wiped: Vec<_> = column.iter().map(|c| c.wiped.clone()).collect();
+    let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        rt.block_on(async { Vec::<Flagged>::decrypt_from(column, &keyset).await })
+    }));
+    assert!(result.is_err(), "the element conversion panicked");
+    assert!(
+        wiped[0].load(Ordering::SeqCst),
+        "the prefix recovered before the panic is wiped during the unwind"
+    );
+}
diff --git a/packages/stack-encrypt/tests/conformance.rs b/packages/stack-encrypt/tests/conformance.rs
index f2875aa01..d8eb8235d 100644
--- a/packages/stack-encrypt/tests/conformance.rs
+++ b/packages/stack-encrypt/tests/conformance.rs
@@ -3,6 +3,7 @@
 
 mod common;
 
+use stack_encrypt::AsProtectedRef as _;
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::PathBuf;
 use std::sync::atomic::Ordering;
@@ -77,7 +78,12 @@ fn plan(corpus: &Corpus, case: &Case) -> record::Plan {
     let declaration = json!({corpus.field.clone(): {
         "context": context, "outputs": ["c", "eq"], "type": case.kind,
     }});
-    record::plan(&vitaminc_aead_frame::serde::to_vec(&declaration).unwrap()).unwrap()
+    record::plan(
+        vitaminc_aead_frame::serde::to_vec(&declaration)
+            .unwrap()
+            .as_protected_ref(),
+    )
+    .unwrap()
 }
 
 fn stored(corpus: &Corpus, artifact: &Artifact) -> StackCipherText {
diff --git a/packages/stack-encrypt/tests/context_conformance.rs b/packages/stack-encrypt/tests/context_conformance.rs
index 75fedd012..f06bce421 100644
--- a/packages/stack-encrypt/tests/context_conformance.rs
+++ b/packages/stack-encrypt/tests/context_conformance.rs
@@ -11,6 +11,7 @@ use stack_encrypt::dynamic::{self, record, Scope, ValueFrame};
 use stack_encrypt::plan::pick;
 use stack_encrypt::sem::EqualityTerm;
 use stack_encrypt::target::{DeclaredContext, Encrypted};
+use stack_encrypt::AsProtectedRef as _;
 use stack_encrypt::{
     CipherText, Descriptor, Equality, IntoAad, IntoPrfContext, Label, NonEmpty, Plan, SealedValue,
     StackCipherText,
@@ -111,7 +112,7 @@ fn plan(case: &Case) -> record::Plan {
             ("type", frame("string")),
         ]),
     ));
-    record::plan(object(fields).risky_ref()).unwrap()
+    record::plan(object(fields).as_protected_ref()).unwrap()
 }
 fn source(case: &Case) -> ValueFrame {
     let mut fields = vec![];
@@ -205,7 +206,7 @@ async fn shared_context_composition() {
         Label::parse(&case.label).unwrap();
         eprintln!("context conformance: {}", case.id);
         let context_frame = context(&case, false);
-        let ctx = dynamic::context(context_frame.risky_ref()).unwrap();
+        let ctx = dynamic::context(context_frame.as_protected_ref()).unwrap();
         let descriptor = Descriptor::of(ctx.clone()).as_str().to_owned();
         let aad = hex(ctx.clone().into_aad().as_bytes());
         let prf = hex(ctx.clone().into_prf_context().as_bytes());
@@ -242,7 +243,7 @@ async fn shared_context_composition() {
                     ("type", frame("string")),
                 ]),
             )])
-            .risky_ref(),
+            .as_protected_ref(),
         )
         .unwrap();
         let query = dynamic::query_term(
@@ -681,7 +682,7 @@ async fn a_grouped_extension_remains_one_part_when_appended() {
             ("outputs", frame(vec!["c"])),
         ]),
     )]);
-    assert!(record::plan(declaration.risky_ref()).is_err());
+    assert!(record::plan(declaration.as_protected_ref()).is_err());
 }
 
 #[tokio::test]
diff --git a/packages/stack-encrypt/tests/declarations.rs b/packages/stack-encrypt/tests/declarations.rs
index d56eac509..fb1469e59 100644
--- a/packages/stack-encrypt/tests/declarations.rs
+++ b/packages/stack-encrypt/tests/declarations.rs
@@ -3,6 +3,7 @@
 
 mod common;
 use common::{hex, unhex};
+use stack_encrypt::AsProtectedRef as _;
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::PathBuf;
 
@@ -12,6 +13,7 @@ use serde_json::value::RawValue;
 use serde_json::{json, Value};
 use stack_encrypt::dynamic::record::{self, NullMode, Output};
 use stack_encrypt::{ContextPiece, ErrorPayload};
+use vitaminc_protected::Controlled as _;
 
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -116,12 +118,16 @@ fn shared_declaration_grammar() {
             Input::Json(value) => {
                 vitaminc_aead_frame::serde::to_vec(&projection(&value).unwrap()).unwrap()
             }
-            Input::FrameHex(text) => unhex(&text),
+            Input::FrameHex(text) => {
+                let mut frame = vitaminc_protected::Buffer::new();
+                frame.extend_from_slice(&unhex(&text));
+                frame
+            }
         };
         if let Some(boundary) = case.boundary_error {
             assert!(!case.accepted);
             assert!(
-                vitaminc_aead::Frame::parse(&frame).is_err(),
+                vitaminc_aead::Frame::parse(frame.risky_ref()).is_err(),
                 "{}: boundary refusal requires a malformed frame",
                 case.id
             );
@@ -129,7 +135,7 @@ fn shared_declaration_grammar() {
             assert!(boundary.fields.is_empty());
         }
         // No cipher/key source exists: declaration checking cannot do key I/O.
-        match (record::plan(&frame), case.expected_error) {
+        match (record::plan(frame.as_protected_ref()), case.expected_error) {
             (Ok(plan), None) => {
                 if let Some(expected) = case.normalized {
                     let actual = normalized(&plan);
@@ -211,11 +217,15 @@ fn projection(raw: &RawValue) -> Result<Projection, Box<dyn std::error::Error>>
 fn json_projection_is_lexical_and_lossless() {
     fn encoded(text: &str) -> Vec<u8> {
         let raw = serde_json::from_str::<Box<RawValue>>(text).unwrap();
-        vitaminc_aead_frame::serde::to_vec(&projection(&raw).unwrap()).unwrap()
+        vitaminc_aead_frame::serde::to_vec(&projection(&raw).unwrap())
+            .unwrap()
+            .risky_unwrap()
     }
     assert_eq!(
         encoded("-0"),
-        vitaminc_aead_frame::serde::to_vec(&0i64).unwrap()
+        vitaminc_aead_frame::serde::to_vec(&0i64)
+            .unwrap()
+            .risky_unwrap()
     );
     assert_eq!(encoded(r#"{"z":1,"a":2}"#), encoded(r#"{"a":2,"z":1}"#));
     for invalid in ["18446744073709551616", "-9223372036854775809", "1e400"] {
diff --git a/packages/stack-encrypt/tests/heap_hygiene.rs b/packages/stack-encrypt/tests/heap_hygiene.rs
index e229d412d..fc61376cb 100644
--- a/packages/stack-encrypt/tests/heap_hygiene.rs
+++ b/packages/stack-encrypt/tests/heap_hygiene.rs
@@ -40,6 +40,7 @@
 
 mod common;
 
+use stack_encrypt::AsProtectedRef as _;
 use std::alloc::{GlobalAlloc, Layout, System};
 use std::cell::Cell;
 use std::ffi::c_void;
@@ -240,7 +241,7 @@ fn plan() -> record::Plan {
             spec("doc", &["c"], None),
             spec("id", &["passthrough"], None),
         ])
-        .risky_ref(),
+        .as_protected_ref(),
     )
     .unwrap()
 }
@@ -345,9 +346,11 @@ fn a_late_read_type_failure_leaves_no_plaintext_on_the_heap() {
     let rt = runtime();
     let cipher = rt.block_on(common::stack_cipher());
     let keyset = cipher.default_keyset();
-    let writer = record::plan(object(vec![spec("value", &["c"], None)]).risky_ref()).unwrap();
+    let writer =
+        record::plan(object(vec![spec("value", &["c"], None)]).as_protected_ref()).unwrap();
     let reader =
-        record::plan(object(vec![spec("value", &["c"], Some("string"))]).risky_ref()).unwrap();
+        record::plan(object(vec![spec("value", &["c"], Some("string"))]).as_protected_ref())
+            .unwrap();
     let source = frame(vec![
         object(vec![("value", frame(marked("first-row")))]),
         object(vec![("value", frame(true))]),
@@ -369,6 +372,52 @@ fn a_late_read_type_failure_leaves_no_plaintext_on_the_heap() {
     });
 }
 
+/// The owned collection conversion: a column of owned strings is held by
+/// the conversion's guard, handed to each element's declaration by
+/// reference, and wiped before the pending is returned. Nothing it frees
+/// may still hold a value.
+#[test]
+fn an_owned_column_encrypted_leaves_no_plaintext_on_the_heap() {
+    use stack_encrypt::{Ciphertext, EncryptInto};
+    let rt = runtime();
+    let cipher = rt.block_on(common::stack_cipher());
+    let keyset = cipher.default_keyset();
+    let column = vec![marked("first"), marked("second"), marked("third")];
+    watched("Vec<String> -> Vec<Ciphertext>", || {
+        let sealed: Vec<Ciphertext> = rt
+            .block_on(async { column.encrypt_into(&keyset).await })
+            .unwrap();
+        assert_eq!(sealed.len(), 3);
+    });
+}
+
+/// A column whose later element fails after its key arrived, here with a
+/// type the destination does not accept: the element recovered before it is
+/// wiped rather than dropped as it is.
+#[test]
+fn a_late_type_failure_in_an_owned_column_leaves_no_plaintext_on_the_heap() {
+    use stack_encrypt::DecryptFrom;
+    let rt = runtime();
+    let cipher = rt.block_on(common::stack_cipher());
+    let keyset = cipher.default_keyset();
+    let column = rt.block_on(async {
+        vec![
+            keyset.encrypt(marked("first-row")).await.unwrap(),
+            keyset.encrypt(true).await.unwrap(),
+        ]
+    });
+    watched(
+        "late type failure in Vec<Ciphertext> -> Vec<String>",
+        || {
+            let result = rt.block_on(async { Vec::<String>::decrypt_from(column, &keyset).await });
+            assert!(matches!(
+                result,
+                Err(stack_encrypt::Error::OpenedType { .. })
+            ));
+        },
+    );
+}
+
 #[test]
 fn a_query_term_leaves_no_plaintext_on_the_heap() {
     let rt = runtime();
@@ -502,7 +551,9 @@ fn a_json_operators_input_leaves_no_plaintext_on_the_heap() {
                     "target": {"name": "JsonSearch", "options": {"ordered": ["$.age"]}}}
     });
     let plan = record::plan_with(
-        &stack_encrypt::dynamic::frame::serde::to_vec(&wire).unwrap(),
+        stack_encrypt::dynamic::frame::serde::to_vec(&wire)
+            .unwrap()
+            .as_protected_ref(),
         &Documents,
     )
     .unwrap();
@@ -870,7 +921,9 @@ mod json_index {
                         "target": {"name": "JsonSearch", "options": {"ordered": ["$.age", "$.visits[*].at"]}}}
         });
         let plan = record::plan_with(
-            &stack_encrypt::dynamic::frame::serde::to_vec(&wire).unwrap(),
+            stack_encrypt::dynamic::frame::serde::to_vec(&wire)
+                .unwrap()
+                .as_protected_ref(),
             &Documents,
         )
         .unwrap();
diff --git a/packages/stack-encrypt/tests/json_index.rs b/packages/stack-encrypt/tests/json_index.rs
index 2fef7e9d3..eb4278fe2 100644
--- a/packages/stack-encrypt/tests/json_index.rs
+++ b/packages/stack-encrypt/tests/json_index.rs
@@ -2932,6 +2932,7 @@ mod given_a_laid_out_plan {
 #[cfg(feature = "dynamic")]
 mod given_the_json_index_spec {
     use super::*;
+    use stack_encrypt::AsProtectedRef as _;
 
     /// The spec's wire form is a fixed contract with stored data and the Go
     /// guest, so its strings are pinned literally.
@@ -2961,13 +2962,13 @@ mod given_the_json_index_spec {
         let frame =
             vitaminc_aead_frame::serde::to_vec(&json!({"json": {"sealed_root": false}})).unwrap();
         assert_eq!(
-            IndexSpec::from_frame(&frame).unwrap(),
+            IndexSpec::from_frame(frame.as_protected_ref()).unwrap(),
             IndexSpec::Json(open_root()),
             "an option read from a frame"
         );
         let frame = vitaminc_aead_frame::serde::to_vec(&json!({"json": {"nope": true}})).unwrap();
         assert!(
-            IndexSpec::from_frame(&frame).is_err(),
+            IndexSpec::from_frame(frame.as_protected_ref()).is_err(),
             "an unknown option refuses the index"
         );
         // The ordered paths ride in `ordered`, written in their canonical
@@ -2984,14 +2985,14 @@ mod given_the_json_index_spec {
         )
         .unwrap();
         assert_eq!(
-            IndexSpec::from_frame(&frame).unwrap(),
+            IndexSpec::from_frame(frame.as_protected_ref()).unwrap(),
             ordered,
             "ordered paths read back parsed"
         );
         let frame =
             vitaminc_aead_frame::serde::to_vec(&json!({"json": {"ordered": ["age"]}})).unwrap();
         assert!(
-            IndexSpec::from_frame(&frame).is_err(),
+            IndexSpec::from_frame(frame.as_protected_ref()).is_err(),
             "a text that is not a path refuses the index"
         );
         // A position in an ordered path refuses the index too: no ordering
@@ -3000,7 +3001,7 @@ mod given_the_json_index_spec {
             vitaminc_aead_frame::serde::to_vec(&json!({"json": {"ordered": ["$.scores[2]"]}}))
                 .unwrap();
         assert!(
-            IndexSpec::from_frame(&frame).is_err(),
+            IndexSpec::from_frame(frame.as_protected_ref()).is_err(),
             "a position in an ordered path refuses the index"
         );
         assert_eq!(
diff --git a/packages/stack-encrypt/tests/json_operators.rs b/packages/stack-encrypt/tests/json_operators.rs
index 52cbc540d..902628dac 100644
--- a/packages/stack-encrypt/tests/json_operators.rs
+++ b/packages/stack-encrypt/tests/json_operators.rs
@@ -13,6 +13,7 @@
 
 mod common;
 
+use stack_encrypt::AsProtectedRef as _;
 use std::collections::BTreeMap;
 
 use base64ct::{Base64, Encoding};
@@ -116,7 +117,13 @@ fn plan_of(target: Value) -> record::Plan {
     let wire = json!({
         "profile": {"context": ["users", "profile"], "type": "json", "null": "sql", "target": target}
     });
-    record::plan_with(&dynamic::frame::serde::to_vec(&wire).unwrap(), &Documents).unwrap()
+    record::plan_with(
+        dynamic::frame::serde::to_vec(&wire)
+            .unwrap()
+            .as_protected_ref(),
+        &Documents,
+    )
+    .unwrap()
 }
 
 fn frame<T: Encrypt>(value: T) -> ValueFrame {
@@ -125,7 +132,12 @@ fn frame<T: Encrypt>(value: T) -> ValueFrame {
 
 /// A JSON value as a frame: what a binding sends as an input or a request.
 fn json_frame(value: &Value) -> ValueFrame {
-    ValueFrame::from_bytes(&dynamic::frame::serde::to_vec(value).unwrap()).unwrap()
+    ValueFrame::from_bytes(
+        dynamic::frame::serde::to_vec(value)
+            .unwrap()
+            .as_protected_ref(),
+    )
+    .unwrap()
 }
 
 async fn term<K: Source>(
@@ -737,13 +749,14 @@ async fn rows_that_are_not_the_reads_are_refused() {
     // selector is derived under this field's column, so it is not the
     // one asked for.
     let two = record::plan_with(
-        &dynamic::frame::serde::to_vec(&json!({
+        (dynamic::frame::serde::to_vec(&json!({
             "profile": {"context": ["users", "profile"], "type": "json", "null": "sql",
                         "target": {"name": "JsonSearch", "options": {"ordered": ["$.age"]}}},
             "prefs": {"context": ["users", "prefs"], "type": "json", "null": "sql",
                       "target": "JsonSearch"}
         }))
-        .unwrap(),
+        .unwrap())
+        .as_protected_ref(),
         &Documents,
     )
     .unwrap();
@@ -912,8 +925,13 @@ fn a_malformed_read_is_refused_before_any_key() {
     // A field that does not store a document has no reads.
     let wire =
         json!({"email": {"context": ["users", "email"], "type": "string", "outputs": ["c"]}});
-    let scalar =
-        record::plan_with(&dynamic::frame::serde::to_vec(&wire).unwrap(), &Documents).unwrap();
+    let scalar = record::plan_with(
+        dynamic::frame::serde::to_vec(&wire)
+            .unwrap()
+            .as_protected_ref(),
+        &Documents,
+    )
+    .unwrap();
     let error = dynamic::check_json_open(
         &scalar,
         "email",
@@ -1581,8 +1599,13 @@ mod element_match {
                 "profile": {"context": ["users", "profile"], "type": "json", "null": "sql",
                             "target": {"name": "JsonSearch", "options": {"ordered": ["$.a[*].b"]}}}
             });
-            let plan = record::plan_with(&dynamic::frame::serde::to_vec(&wire).unwrap(), &Unnamed)
-                .unwrap();
+            let plan = record::plan_with(
+                dynamic::frame::serde::to_vec(&wire)
+                    .unwrap()
+                    .as_protected_ref(),
+                &Unnamed,
+            )
+            .unwrap();
             let names = names(&plan, &Unnamed);
             assert!(names.contains(&"lt_at"), "the orderings still: {names:?}");
             assert!(!names.contains(&"element_match"), "{names:?}");
@@ -2373,8 +2396,13 @@ mod compiled_match {
                 "profile": {"context": ["users", "profile"], "type": "json", "null": "sql",
                             "target": "JsonSearch"}
             });
-            let plan = record::plan_with(&dynamic::frame::serde::to_vec(&wire).unwrap(), &Unnamed)
-                .unwrap();
+            let plan = record::plan_with(
+                dynamic::frame::serde::to_vec(&wire)
+                    .unwrap()
+                    .as_protected_ref(),
+                &Unnamed,
+            )
+            .unwrap();
             let names = names(&plan, &Unnamed);
             assert!(names.contains(&"eq_at"), "the others still: {names:?}");
             assert!(!names.contains(&"match"), "{names:?}");
diff --git a/packages/stack-encrypt/tests/lifecycle_conformance.rs b/packages/stack-encrypt/tests/lifecycle_conformance.rs
index 85ec8a79a..514076ae5 100644
--- a/packages/stack-encrypt/tests/lifecycle_conformance.rs
+++ b/packages/stack-encrypt/tests/lifecycle_conformance.rs
@@ -4,6 +4,7 @@
 
 mod common;
 
+use stack_encrypt::AsProtectedRef as _;
 use std::borrow::Cow;
 use std::collections::BTreeMap;
 use std::future::IntoFuture;
@@ -13,7 +14,7 @@ use std::task::{Context, Waker};
 
 use common::frames::frame;
 use stack_encrypt::dynamic::{record, Scope, ValueFrame};
-use stack_encrypt::{Pending, StackCipher, StackCipherText};
+use stack_encrypt::{Ciphertext, EncryptInto, Pending, StackCipher, StackCipherText};
 use stack_kms::{
     DataKey, DataKeySource, DataKeyWithTag, FakeDataKeySource, GenerateKeyError,
     GenerateKeyPayload, IdentifiedBy, IndexKey, IndexKeySource, RetrieveKeyPayload,
@@ -105,10 +106,11 @@ async fn cipher() -> (StackCipher<Source>, Arc<Observations>) {
 
 fn plan() -> record::Plan {
     record::plan(
-        &vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
+        (vitaminc_aead_frame::serde::to_vec(&serde_json::json!({
             "value": {"context": ["lifecycle", "value"], "outputs": ["c"], "type": "string"}
         }))
-        .unwrap(),
+        .unwrap())
+        .as_protected_ref(),
     )
     .unwrap()
 }
@@ -250,3 +252,72 @@ async fn cancelling_in_flight_decrypt_drops_provider_and_captures() {
     assert_eq!(*calls.retrievals.lock().unwrap(), vec![3, 3]);
     assert_eq!(calls.retrieve_drops.load(Ordering::SeqCst), 2);
 }
+
+// The owned collection conversion, `Vec<S>` to `Vec<T>`, runs the element
+// declaration once per element and merges the results into one pending. The
+// probes below hold it to the same lifecycle as a record operation.
+fn owned_column<'a>(
+    keyset: &'a stack_encrypt::KeysetCipher<'_, Source>,
+    count: usize,
+) -> Pending<'a, Vec<Ciphertext>, Source> {
+    vec![String::from("lifecycle-input"); count].encrypt_into(keyset)
+}
+
+#[tokio::test]
+async fn dropping_an_unpolled_owned_column_releases_captures_without_key_io() {
+    let (cipher, calls) = cipher().await;
+    let keyset = cipher.default_keyset();
+    let drops = Arc::new(AtomicUsize::new(0));
+    let pending = observed(owned_column(&keyset, 2), drops.clone());
+    assert_eq!(drops.load(Ordering::SeqCst), 0);
+    assert!(calls.batches.lock().unwrap().is_empty());
+    drop(pending);
+    assert_eq!(drops.load(Ordering::SeqCst), 1);
+    assert!(calls.batches.lock().unwrap().is_empty());
+}
+
+#[tokio::test]
+async fn cancelling_an_owned_column_in_flight_drops_provider_and_captures() {
+    let (cipher, calls) = cipher().await;
+    calls.block.store(true, Ordering::SeqCst);
+    let keyset = cipher.default_keyset();
+    let drops = Arc::new(AtomicUsize::new(0));
+    let mut future = observed(owned_column(&keyset, 3), drops.clone()).into_future();
+    assert!(future
+        .as_mut()
+        .poll(&mut Context::from_waker(Waker::noop()))
+        .is_pending());
+    assert_eq!(*calls.batches.lock().unwrap(), vec![3]);
+    assert_eq!(drops.load(Ordering::SeqCst), 0);
+    assert_eq!(calls.provider_drops.load(Ordering::SeqCst), 0);
+    drop(future);
+    assert_eq!(drops.load(Ordering::SeqCst), 1);
+    assert_eq!(calls.provider_drops.load(Ordering::SeqCst), 1);
+    calls.block.store(false, Ordering::SeqCst);
+    owned_column(&keyset, 1).await.unwrap();
+    assert_eq!(*calls.batches.lock().unwrap(), vec![3, 1]);
+}
+
+#[tokio::test]
+async fn an_owned_column_is_one_logical_batch_and_releases_captures_once() {
+    for fail in [false, true] {
+        let (cipher, calls) = cipher().await;
+        calls.fail.store(fail, Ordering::SeqCst);
+        let keyset = cipher.default_keyset();
+        let drops = Arc::new(AtomicUsize::new(0));
+        let result = observed(owned_column(&keyset, 4), drops.clone()).await;
+        assert_eq!(result.is_err(), fail);
+        assert_eq!(drops.load(Ordering::SeqCst), 1);
+        assert_eq!(calls.provider_drops.load(Ordering::SeqCst), 1);
+        assert_eq!(*calls.batches.lock().unwrap(), vec![4]);
+    }
+}
+
+#[tokio::test]
+async fn an_empty_owned_column_makes_no_provider_call() {
+    let (cipher, calls) = cipher().await;
+    let keyset = cipher.default_keyset();
+    let sealed = owned_column(&keyset, 0).await.unwrap();
+    assert!(sealed.is_empty());
+    assert!(calls.batches.lock().unwrap().is_empty());
+}
diff --git a/packages/stack-encrypt/tests/query_operators.rs b/packages/stack-encrypt/tests/query_operators.rs
index 9103a2674..dca7c4390 100644
--- a/packages/stack-encrypt/tests/query_operators.rs
+++ b/packages/stack-encrypt/tests/query_operators.rs
@@ -16,6 +16,7 @@
 
 mod common;
 
+use stack_encrypt::AsProtectedRef as _;
 use std::path::PathBuf;
 
 use common::frames::{frame, object};
@@ -76,7 +77,7 @@ fn stats_cases() -> Vec<(Json, Stats)> {
 }
 
 /// A plan written as JSON, as frame bytes: what a binding sends.
-fn frame_of_json(value: &Json) -> Vec<u8> {
+fn frame_of_json(value: &Json) -> vitaminc_protected::Buffer {
     vitaminc_aead_frame::serde::to_vec(value).expect("frames")
 }
 
@@ -267,7 +268,8 @@ async fn data_term(
 async fn derived() -> Json {
     let cipher = deterministic_cipher(SEED).await;
     let keyset = cipher.default_keyset();
-    let plan = record::plan(&frame_of_json(&plan_json())).expect("the plan parses");
+    let plan =
+        record::plan(frame_of_json(&plan_json()).as_protected_ref()).expect("the plan parses");
 
     let mut terms = Vec::new();
     for (field, operator, input) in queries() {
@@ -317,8 +319,8 @@ async fn derived() -> Json {
         };
         let typed = typed_match(&cipher, input).await;
         for (stats_json, stats) in stats_cases() {
-            let read =
-                Stats::from_frame(frame_of_value(&stats_json).risky_ref()).expect("stats read");
+            let read = Stats::from_frame(frame_of_value(&stats_json).as_protected_ref())
+                .expect("stats read");
             assert_eq!(read, stats, "the wire form reads as the typed stats");
             let limit =
                 dynamic::target_limit(&plan, "name", OpSpec::Matches, bytes, 10, &read, &NoTargets)
diff --git a/packages/stack-encrypt/tests/read_conformance.rs b/packages/stack-encrypt/tests/read_conformance.rs
index c8749ed5d..b481e394a 100644
--- a/packages/stack-encrypt/tests/read_conformance.rs
+++ b/packages/stack-encrypt/tests/read_conformance.rs
@@ -9,6 +9,7 @@ use common::{
 use serde::Deserialize;
 use serde_json::{json, Map, Value};
 use stack_encrypt::dynamic::{record, Scope, ValueFrame};
+use stack_encrypt::AsProtectedRef as _;
 use stack_encrypt::{CipherText, ErrorPayload, Label, StackCipherText};
 use std::{
     collections::{BTreeMap, BTreeSet},
@@ -107,7 +108,12 @@ fn plan(decl: &Declaration, context_field: bool, context_name: &str) -> record::
     // Match Go Plan.Wire's declaration order explicitly, regardless of the
     // serde_json map backend or the context field's lexical position.
     let framed = |v: &Value| {
-        ValueFrame::from_bytes(&vitaminc_aead_frame::serde::to_vec(v).unwrap()).unwrap()
+        ValueFrame::from_bytes(
+            vitaminc_aead_frame::serde::to_vec(v)
+                .unwrap()
+                .as_protected_ref(),
+        )
+        .unwrap()
     };
     let mut fields = Vec::new();
     if context_field {
@@ -118,7 +124,7 @@ fn plan(decl: &Declaration, context_field: bool, context_name: &str) -> record::
         ));
     }
     fields.push(("value", framed(&spec)));
-    record::plan(object(fields).risky_ref()).unwrap()
+    record::plan(object(fields).as_protected_ref()).unwrap()
 }
 fn rows(input: &[Row], context_name: Option<&str>) -> ValueFrame {
     frame(
diff --git a/packages/stack-encrypt/tests/record_lowering.rs b/packages/stack-encrypt/tests/record_lowering.rs
index 3fa04934a..017de31ec 100644
--- a/packages/stack-encrypt/tests/record_lowering.rs
+++ b/packages/stack-encrypt/tests/record_lowering.rs
@@ -23,6 +23,7 @@
 
 mod common;
 
+use stack_encrypt::{AsProtectedRef as _, Protected};
 use std::collections::BTreeMap;
 use std::path::PathBuf;
 
@@ -93,7 +94,7 @@ fn plaintext_json() -> Json {
 // ---- JSON <-> frames, for the subset the fixture uses ---------------------
 
 /// A plan written as JSON, as frame bytes: what a binding sends.
-fn frame_of_json(value: &Json) -> Vec<u8> {
+fn frame_of_json(value: &Json) -> vitaminc_protected::Buffer {
     vitaminc_aead_frame::serde::to_vec(value).expect("frames")
 }
 
@@ -395,7 +396,8 @@ async fn open_lowered(
 #[tokio::test]
 async fn the_chain_and_the_lowering_are_one_engine_today() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("the data plan parses");
+    let plan = record::plan(frame_of_json(&data_plan_json()).as_protected_ref())
+        .expect("the data plan parses");
 
     let typed = json_of_record(seal_typed(&cipher).await);
     let lowered = json_of_record(seal_lowered(&cipher, &plan).await);
@@ -427,7 +429,8 @@ async fn the_chain_and_the_lowering_are_one_engine_today() {
 async fn the_committed_fixture_opens_both_ways() {
     let update = common::fixture_updates_requested_or_panic();
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("the data plan parses");
+    let plan = record::plan(frame_of_json(&data_plan_json()).as_protected_ref())
+        .expect("the data plan parses");
     let path = fixture_path();
 
     if update {
@@ -623,7 +626,12 @@ fn note_of_record(tree: StackCipherText) -> FieldValues {
                             let _ = values.insert(&name, id);
                         }
                         Err(_) => {
-                            let text = ValueFrame::from_bytes(&payload.0).expect("a value");
+                            let text = ValueFrame::from_bytes(
+                                Protected::new(payload.0.clone())
+                                    .as_protected_ref()
+                                    .as_deref(),
+                            )
+                            .expect("a value");
                             assert_eq!(text.kind(), Some(ValueKind::String), "the tenant is text");
                             let _ = values.insert(&name, text);
                         }
@@ -695,7 +703,8 @@ async fn open_note_lowered(
 #[tokio::test]
 async fn the_chain_and_the_lowering_agree_on_a_context_field_today() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(&frame_of_json(&note_plan_json())).expect("the data plan parses");
+    let plan = record::plan(frame_of_json(&note_plan_json()).as_protected_ref())
+        .expect("the data plan parses");
     assert_eq!(plan.context_field(), Some("tenant"));
 
     let typed = json_of_record(seal_note_typed(&cipher).await);
@@ -743,7 +752,8 @@ async fn the_chain_and_the_lowering_agree_on_a_context_field_today() {
 async fn the_committed_context_field_case_opens_both_ways() {
     let update = common::fixture_updates_requested_or_panic();
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(&frame_of_json(&note_plan_json())).expect("the data plan parses");
+    let plan = record::plan(frame_of_json(&note_plan_json()).as_protected_ref())
+        .expect("the data plan parses");
     let path = fixture_path();
 
     if update {
@@ -815,7 +825,7 @@ async fn the_committed_context_field_case_opens_both_ways() {
 #[tokio::test]
 async fn the_fixture_records_are_bound_to_their_labels() {
     let cipher = deterministic_cipher(SEED).await;
-    let plan = record::plan(&frame_of_json(&data_plan_json())).expect("plan");
+    let plan = record::plan(frame_of_json(&data_plan_json()).as_protected_ref()).expect("plan");
     let sealed = seal_lowered(&cipher, &plan).await;
     let CipherText::Map(mut fields) = sealed else {
         panic!("a map");
diff --git a/packages/stack-encrypt/tests/runtime_conformance.rs b/packages/stack-encrypt/tests/runtime_conformance.rs
index c9faf2db0..257ce525c 100644
--- a/packages/stack-encrypt/tests/runtime_conformance.rs
+++ b/packages/stack-encrypt/tests/runtime_conformance.rs
@@ -9,6 +9,7 @@ use common::{
 use serde::Deserialize;
 use serde_json::json;
 use stack_encrypt::dynamic::{self, record, NoTargets, OpSpec, Operand, Scope, ValueFrame};
+use stack_encrypt::AsProtectedRef as _;
 use stack_encrypt::CipherText;
 use std::{
     collections::{BTreeMap, BTreeSet},
@@ -102,9 +103,12 @@ async fn shared_record_runtime_profile() {
         if !case.null.is_empty() {
             spec["null"] = json!(case.null);
         }
-        let plan =
-            record::plan(&vitaminc_aead_frame::serde::to_vec(&json!({"value":spec})).unwrap())
-                .unwrap();
+        let plan = record::plan(
+            vitaminc_aead_frame::serde::to_vec(&json!({"value":spec}))
+                .unwrap()
+                .as_protected_ref(),
+        )
+        .unwrap();
         let keyset = cipher.default_keyset();
         match case.operation {
             Operation::Seal {
diff --git a/packages/stack-encrypt/tests/stored_rows.rs b/packages/stack-encrypt/tests/stored_rows.rs
index bc5aba38a..c610aedef 100644
--- a/packages/stack-encrypt/tests/stored_rows.rs
+++ b/packages/stack-encrypt/tests/stored_rows.rs
@@ -34,7 +34,8 @@ use stack_encrypt::dynamic::{admits, Scope, ValueFrame, ValueKind};
 use stack_encrypt::target::IndexSpec;
 use stack_encrypt::StackCipherText as Node;
 use stack_encrypt::{
-    CipherText, Label, PassthroughFrame, SealedValue, StackCipher, StackCipherText,
+    AsProtectedRef as _, CipherText, Label, PassthroughFrame, Protected, SealedValue, StackCipher,
+    StackCipherText,
 };
 use vitaminc_aead::plaintext::{Float, Int, Logical, MapSink, Physical, SeqSink, Sink};
 use vitaminc_aead::FrameWriter;
@@ -217,19 +218,19 @@ fn refreeze_order_terms(stored: &mut Json, resealed: &Json) {
 // ---- a plan as JSON ---------------------------------------------------------
 
 /// A plan written as JSON, as frame bytes: what a binding sends.
-fn frame_of_json(value: &Json) -> Vec<u8> {
+fn frame_of_json(value: &Json) -> vitaminc_protected::Buffer {
     vitaminc_aead_frame::serde::to_vec(value).expect("frames")
 }
 
 fn plan_of(json: &Json) -> DataPlan {
-    record::plan(&frame_of_json(json)).expect("the frozen plan parses")
+    record::plan(frame_of_json(json).as_protected_ref()).expect("the frozen plan parses")
 }
 
 // ---- sealing and opening ----------------------------------------------------
 
 async fn seal(
     cipher: &StackCipher<DeterministicSource>,
-    source: &[u8],
+    source: vitaminc_protected::ProtectedRef<'_, [u8]>,
     plan: &DataPlan,
 ) -> StackCipherText {
     let source = ValueFrame::from_bytes(source).expect("the source is a value");
@@ -289,7 +290,7 @@ async fn every_frozen_row_opens_and_seals_as_it_did() {
     for case in cases {
         let name = case["name"].as_str().expect("a name");
         let plan = plan_of(&case["plan"]);
-        let source = unhex(case["source"].as_str().expect("hex"));
+        let source = Protected::new(unhex(case["source"].as_str().expect("hex")));
         let stored = &case["stored"];
 
         let opened = open(&cipher, node_of_json(stored), &plan, expected_of(case)).await;
@@ -299,7 +300,8 @@ async fn every_frozen_row_opens_and_seals_as_it_did() {
             "{name}: the frozen row opens to what it opened to"
         );
 
-        let resealed = json_of_node(seal(&cipher, &source, &plan).await);
+        let resealed =
+            json_of_node(seal(&cipher, source.as_protected_ref().as_deref(), &plan).await);
         assert_eq!(
             without_order_terms(&resealed),
             without_order_terms(stored),
@@ -332,7 +334,7 @@ struct Case {
     name: &'static str,
     about: &'static str,
     plan: Json,
-    source: Vec<u8>,
+    source: vitaminc_protected::Buffer,
     expected_context: Option<&'static str>,
 }
 
@@ -385,8 +387,8 @@ impl Value {
         }
     }
 
-    fn frame(&self) -> Vec<u8> {
-        let mut bytes = Vec::new();
+    fn frame(&self) -> vitaminc_protected::Buffer {
+        let mut bytes = vitaminc_protected::Buffer::new();
         self.write(FrameWriter::new(&mut bytes)).expect("frames");
         bytes
     }
@@ -588,7 +590,7 @@ async fn write_stored_rows_v1() {
     let mut written = Vec::new();
     for case in cases() {
         let plan = plan_of(&case.plan);
-        let stored = seal(&cipher, &case.source, &plan).await;
+        let stored = seal(&cipher, case.source.as_protected_ref(), &plan).await;
         let stored_json = json_of_node(stored);
         let expected = case
             .expected_context
@@ -598,7 +600,7 @@ async fn write_stored_rows_v1() {
             "name": case.name,
             "about": case.about,
             "plan": case.plan,
-            "source": hex(&case.source),
+            "source": hex(vitaminc_protected::Controlled::risky_ref(&case.source)),
             "expected_context": case.expected_context,
             "stored": stored_json,
             "opened": hex(&opened),
diff --git a/packages/stack-encrypt/tests/ui/owned_collection_context.rs b/packages/stack-encrypt/tests/ui/owned_collection_context.rs
new file mode 100644
index 000000000..7ecf08457
--- /dev/null
+++ b/packages/stack-encrypt/tests/ui/owned_collection_context.rs
@@ -0,0 +1,46 @@
+//! A column takes exactly the element's caller-context capability: a column
+//! of a `RequiredContext` target cannot omit the context, even for a `u64`
+//! that implements `Default`, and a column of a `NoCallerContext` target
+//! cannot be handed one.
+use stack_encrypt::target::{
+    DecryptSource, Decryption, EncryptTarget, Encryption, NoCallerContext, RequiredContext,
+};
+use stack_encrypt::{Ciphertext, DecryptFrom, EncryptInto};
+
+struct Required(Ciphertext);
+impl EncryptTarget<i32> for Required {
+    type ContextInput = RequiredContext<u64>;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, i32, Self, K, Self::ContextInput> {
+        stack_encrypt::target::scalar_ciphertext().map(Self).accepting()
+    }
+}
+impl DecryptSource<i32> for Required {
+    type ContextInput = RequiredContext<u64>;
+    fn decryption<K: 'static>(self, _: Self::ContextInput) -> Decryption<i32, K> {
+        Decryption::failed(stack_encrypt::Error::Aead)
+    }
+}
+struct Fixed;
+impl EncryptTarget<i32> for Fixed {
+    type ContextInput = NoCallerContext;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, i32, Self, K, Self::ContextInput> {
+        Encryption::failed(stack_encrypt::Error::Aead)
+    }
+}
+impl DecryptSource<i32> for Fixed {
+    type ContextInput = NoCallerContext;
+    fn decryption<K: 'static>(self, _: Self::ContextInput) -> Decryption<i32, K> {
+        Decryption::failed(stack_encrypt::Error::Aead)
+    }
+}
+fn capabilities<K: 'static>(
+    keyset: &stack_encrypt::KeysetCipher<'_, K>,
+    required: Vec<Required>,
+    fixed: Vec<Fixed>,
+) {
+    let _ = vec![1i32, 2].encrypt_into::<Vec<Required>, _>(keyset);
+    let _ = Vec::<i32>::decrypt_from(required, keyset);
+    let _ = vec![1i32, 2].encrypt_into_with_context::<Vec<Fixed>, _>(keyset, ());
+    let _ = Vec::<i32>::decrypt_from_with_context(fixed, keyset, ());
+}
+fn main() {}
diff --git a/packages/stack-encrypt/tests/ui/owned_collection_context.stderr b/packages/stack-encrypt/tests/ui/owned_collection_context.stderr
new file mode 100644
index 000000000..286be41fa
--- /dev/null
+++ b/packages/stack-encrypt/tests/ui/owned_collection_context.stderr
@@ -0,0 +1,89 @@
+error[E0277]: the trait bound `RequiredContext<u64>: AllowsNoContext` is not satisfied
+  --> tests/ui/owned_collection_context.rs:41:13
+   |
+41 |     let _ = vec![1i32, 2].encrypt_into::<Vec<Required>, _>(keyset);
+   |             ^^^^^^^^^^^^^ ------------ required by a bound introduced by this call
+   |             |
+   |             the trait `AllowsNoContext` is not implemented for `RequiredContext<u64>`
+   |
+help: the following other types implement trait `AllowsNoContext`
+  --> src/target/input.rs
+   |
+   | impl AllowsNoContext for NoCallerContext {
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `NoCallerContext`
+...
+   | impl<C> AllowsNoContext for OptionalContext<C> {
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `OptionalContext<C>`
+note: required by a bound in `stack_encrypt::EncryptInto::encrypt_into`
+  --> src/target/conversion.rs
+   |
+   |     fn encrypt_into<'a, T, K: 'static>(self, cipher: &'a KeysetCipher<'_, K>) -> Pending<'a, T, K>
+   |        ------------ required by a bound in this associated function
+...
+   |         T::ContextInput: AllowsNoContext,
+   |                          ^^^^^^^^^^^^^^^ required by this bound in `EncryptInto::encrypt_into`
+
+error[E0277]: the trait bound `RequiredContext<u64>: AllowsNoContext` is not satisfied
+  --> tests/ui/owned_collection_context.rs:42:38
+   |
+42 |     let _ = Vec::<i32>::decrypt_from(required, keyset);
+   |             ------------------------ ^^^^^^^^ the trait `AllowsNoContext` is not implemented for `RequiredContext<u64>`
+   |             |
+   |             required by a bound introduced by this call
+   |
+help: the following other types implement trait `AllowsNoContext`
+  --> src/target/input.rs
+   |
+   | impl AllowsNoContext for NoCallerContext {
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `NoCallerContext`
+...
+   | impl<C> AllowsNoContext for OptionalContext<C> {
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `OptionalContext<C>`
+note: required by a bound in `stack_encrypt::DecryptFrom::decrypt_from`
+  --> src/target/conversion.rs
+   |
+   |     fn decrypt_from<'a, S, K: 'static>(
+   |        ------------ required by a bound in this associated function
+...
+   |         S::ContextInput: AllowsNoContext,
+   |                          ^^^^^^^^^^^^^^^ required by this bound in `DecryptFrom::decrypt_from`
+
+error[E0277]: the trait bound `NoCallerContext: AcceptsContext` is not satisfied
+  --> tests/ui/owned_collection_context.rs:43:27
+   |
+43 |     let _ = vec![1i32, 2].encrypt_into_with_context::<Vec<Fixed>, _>(keyset, ());
+   |                           ^^^^^^^^^^^^^^^^^^^^^^^^^ the trait `AcceptsContext` is not implemented for `NoCallerContext`
+   |
+help: the following other types implement trait `AcceptsContext`
+  --> src/target/input.rs
+   |
+   | impl<C> AcceptsContext for RequiredContext<C> {
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `RequiredContext<C>`
+...
+   | impl<C> AcceptsContext for OptionalContext<C> {
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `OptionalContext<C>`
+
+error[E0277]: the trait bound `NoCallerContext: AcceptsContext` is not satisfied
+  --> tests/ui/owned_collection_context.rs:44:51
+   |
+44 |     let _ = Vec::<i32>::decrypt_from_with_context(fixed, keyset, ());
+   |             ------------------------------------- ^^^^^ the trait `AcceptsContext` is not implemented for `NoCallerContext`
+   |             |
+   |             required by a bound introduced by this call
+   |
+help: the following other types implement trait `AcceptsContext`
+  --> src/target/input.rs
+   |
+   | impl<C> AcceptsContext for RequiredContext<C> {
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `RequiredContext<C>`
+...
+   | impl<C> AcceptsContext for OptionalContext<C> {
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `OptionalContext<C>`
+note: required by a bound in `stack_encrypt::DecryptFrom::decrypt_from_with_context`
+  --> src/target/conversion.rs
+   |
+   |     fn decrypt_from_with_context<'a, S, K: 'static>(
+   |        ------------------------- required by a bound in this associated function
+...
+   |         S::ContextInput: AcceptsContext,
+   |                          ^^^^^^^^^^^^^^ required by this bound in `DecryptFrom::decrypt_from_with_context`
diff --git a/packages/stack-encrypt/tests/ui/owned_collection_elements.rs b/packages/stack-encrypt/tests/ui/owned_collection_elements.rs
new file mode 100644
index 000000000..554d75ecd
--- /dev/null
+++ b/packages/stack-encrypt/tests/ui/owned_collection_elements.rs
@@ -0,0 +1,16 @@
+//! A collection's elements must be opaque scalars. `u8` is not one: Vitamin
+//! C keeps `Vec<u8>` one byte leaf and gives `u8` no source of its own, so a
+//! byte vector is one `Ciphertext` (`tests/ui/pass/owned_collections.rs`),
+//! never a column of bytes. A nullable element and a borrowed element are
+//! not opaque scalars either. No vector of scalars encrypts into one
+//! `Ciphertext`, and the decrypt side refuses the same element types.
+use stack_encrypt::{Ciphertext, DecryptFrom, EncryptInto};
+fn unsupported<K: 'static>(keyset: &stack_encrypt::KeysetCipher<'_, K>, column: Vec<Ciphertext>) {
+    let _ = vec![1u8, 2].encrypt_into::<Vec<Ciphertext>, _>(keyset);
+    let _ = vec![Some(1i32), None].encrypt_into::<Vec<Ciphertext>, _>(keyset);
+    let _ = EncryptInto::encrypt_into::<Vec<Ciphertext>, _>(vec!["borrowed", "plaintext"], keyset);
+    let _ = vec![1i32, 2].encrypt_into::<Ciphertext, _>(keyset);
+    let _ = Vec::<u8>::decrypt_from(column.clone(), keyset);
+    let _ = Vec::<Option<i32>>::decrypt_from(column, keyset);
+}
+fn main() {}
diff --git a/packages/stack-encrypt/tests/ui/owned_collection_elements.stderr b/packages/stack-encrypt/tests/ui/owned_collection_elements.stderr
new file mode 100644
index 000000000..029645211
--- /dev/null
+++ b/packages/stack-encrypt/tests/ui/owned_collection_elements.stderr
@@ -0,0 +1,129 @@
+error[E0277]: the trait bound `for<'a> &'a u8: Scalar` is not satisfied
+ --> tests/ui/owned_collection_elements.rs:9:26
+  |
+9 |     let _ = vec![1u8, 2].encrypt_into::<Vec<Ciphertext>, _>(keyset);
+  |                          ^^^^^^^^^^^^ the trait `for<'a> Scalar` is not implemented for `&'a u8`
+  |
+  = help: the following other types implement trait `Scalar`:
+            &f32
+            &f64
+            &i128
+            &i16
+            &i32
+            &i64
+            &i8
+            &u128
+          and $N others
+  = note: required for `u8` to implement `OpaqueEncode`
+  = note: required for `stack_encrypt::Ciphertext` to implement `EncryptTarget<u8>`
+  = note: 1 redundant requirement hidden
+  = note: required for `Vec<stack_encrypt::Ciphertext>` to implement `EncryptTarget<Vec<u8>>`
+
+error[E0277]: the trait bound `for<'a> &'a Option<i32>: Scalar` is not satisfied
+  --> tests/ui/owned_collection_elements.rs:10:36
+   |
+10 |     let _ = vec![Some(1i32), None].encrypt_into::<Vec<Ciphertext>, _>(keyset);
+   |                                    ^^^^^^^^^^^^ the trait `for<'a> Scalar` is not implemented for `&'a Option<i32>`
+   |
+   = help: the following other types implement trait `Scalar`:
+             &&'b T
+             &'a Protected<T>
+             &ProtectedRef<'a, T>
+             &Raw<'_>
+             &Vec<u8>
+             &[u8; N]
+             &[u8]
+             &bool
+           and $N others
+   = note: required for `Option<i32>` to implement `OpaqueEncode`
+   = note: required for `stack_encrypt::Ciphertext` to implement `EncryptTarget<Option<i32>>`
+   = note: 1 redundant requirement hidden
+   = note: required for `Vec<stack_encrypt::Ciphertext>` to implement `EncryptTarget<Vec<Option<i32>>>`
+
+error[E0277]: the trait bound `&str: zeroize::Zeroize` is not satisfied
+  --> tests/ui/owned_collection_elements.rs:11:13
+   |
+11 |     let _ = EncryptInto::encrypt_into::<Vec<Ciphertext>, _>(vec!["borrowed", "plaintext"], keyset);
+   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the trait `zeroize::DefaultIsZeroes` is not implemented for `&str`
+   |
+   = help: the following other types implement trait `zeroize::DefaultIsZeroes`:
+             ()
+             PhantomPinned
+             bool
+             char
+             f32
+             f64
+             i128
+             i16
+           and $N others
+   = note: required for `&str` to implement `zeroize::Zeroize`
+   = note: required for `Vec<stack_encrypt::Ciphertext>` to implement `EncryptTarget<Vec<&str>>`
+
+error[E0277]: the trait bound `for<'a> &'a Vec<i32>: Scalar` is not satisfied
+  --> tests/ui/owned_collection_elements.rs:12:27
+   |
+12 |     let _ = vec![1i32, 2].encrypt_into::<Ciphertext, _>(keyset);
+   |                           ^^^^^^^^^^^^ the trait `for<'a> Scalar` is not implemented for `&'a Vec<i32>`
+   |
+help: the following other types implement trait `Scalar`
+  --> $CARGO/vitaminc-aead-$VERSION/src/plaintext/sources.rs
+   |
+   |               impl Scalar for $ty {}
+   |               ^^^^^^^^^^^^^^^^^^^
+   |               |
+   |               `&Vec<u8>`
+   |               `Vec<u8>`
+...
+   | / scalar! {
+   | |     bool, &bool, f32, &f32, f64, &f64,
+   | |     i8, &i8, i16, &i16, i32, &i32, i64, &i64, i128, &i128,
+   | |     u16, &u16, u32, &u32, u64, &u64, u128, &u128,
+...  |
+   | |     Bytes<'_>, &Bytes<'_>, Raw<'_>, &Raw<'_>,
+   | | }
+   | |_- in this macro invocation
+   = note: required for `Vec<i32>` to implement `OpaqueEncode`
+   = note: required for `stack_encrypt::Ciphertext` to implement `EncryptTarget<Vec<i32>>`
+   = note: this error originates in the macro `scalar` (in Nightly builds, run with -Z macro-backtrace for more info)
+
+error[E0277]: the trait bound `u8: vitaminc_aead::typed::FromScalar` is not satisfied
+  --> tests/ui/owned_collection_elements.rs:13:13
+   |
+13 |     let _ = Vec::<u8>::decrypt_from(column.clone(), keyset);
+   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the trait `vitaminc_aead::typed::FromScalar` is not implemented for `u8`
+   |
+   = help: the following other types implement trait `vitaminc_aead::typed::FromScalar`:
+             f32
+             f64
+             i128
+             i16
+             i32
+             i64
+             i8
+             u128
+           and $N others
+   = note: required for `u8` to implement `OpaqueDecode`
+   = note: required for `stack_encrypt::Ciphertext` to implement `DecryptSource<u8>`
+   = note: 1 redundant requirement hidden
+   = note: required for `Vec<stack_encrypt::Ciphertext>` to implement `DecryptSource<Vec<u8>>`
+
+error[E0277]: the trait bound `Option<i32>: vitaminc_aead::typed::FromScalar` is not satisfied
+  --> tests/ui/owned_collection_elements.rs:14:13
+   |
+14 |     let _ = Vec::<Option<i32>>::decrypt_from(column, keyset);
+   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the trait `vitaminc_aead::typed::FromScalar` is not implemented for `Option<i32>`
+   |
+   = help: the following other types implement trait `vitaminc_aead::typed::FromScalar`:
+             Vec<u8>
+             [u8; N]
+             bool
+             chrono::datetime::DateTime<chrono::offset::utc::Utc>
+             chrono::naive::date::NaiveDate
+             f32
+             f64
+             i128
+           and $N others
+   = note: required for `Option<i32>` to implement `OpaqueDecode`
+   = note: required for `stack_encrypt::Ciphertext` to implement `DecryptSource<Option<i32>>`
+   = note: 1 redundant requirement hidden
+   = note: required for `Vec<stack_encrypt::Ciphertext>` to implement `DecryptSource<Vec<Option<i32>>>`
diff --git a/packages/stack-encrypt/tests/ui/pass/owned_collections.rs b/packages/stack-encrypt/tests/ui/pass/owned_collections.rs
new file mode 100644
index 000000000..70caf47ad
--- /dev/null
+++ b/packages/stack-encrypt/tests/ui/pass/owned_collections.rs
@@ -0,0 +1,97 @@
+//! The owned collection forms that must compile: a `Vec` of opaque scalars
+//! into a `Vec` of any owned target, with the element's caller-context
+//! capability, and back. A `Vec<u8>` is one byte leaf, so it is one
+//! `Ciphertext`, and a `Vec<Vec<u8>>` is a column of them. `tests/ui/owned_collection_elements.rs` and
+//! `tests/ui/owned_collection_context.rs` pin the forms that must not.
+use stack_encrypt::target::{
+    AcceptsContext, DecryptSource, Decryption, EncryptTarget, Encryption, NoCallerContext,
+    OptionalContext, RequiredContext, ScalarContext,
+};
+use stack_encrypt::{Ciphertext, DecryptFrom, EncryptInto, KeysetCipher, StackCipher};
+use stack_kms::FakeDataKeySource;
+
+struct Required(Ciphertext);
+impl EncryptTarget<i32> for Required {
+    type ContextInput = RequiredContext<u64>;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, i32, Self, K, Self::ContextInput> {
+        stack_encrypt::target::scalar_ciphertext().map(Self).accepting()
+    }
+}
+impl DecryptSource<i32> for Required {
+    type ContextInput = RequiredContext<u64>;
+    fn decryption<K: 'static>(self, context: Self::ContextInput) -> Decryption<i32, K> {
+        self.0.decryption(OptionalContext::<ScalarContext>::supplied(
+            context.into_inner().into(),
+        ))
+    }
+}
+struct Fixed(Ciphertext);
+impl EncryptTarget<i32> for Fixed {
+    type ContextInput = NoCallerContext;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, i32, Self, K, Self::ContextInput> {
+        stack_encrypt::target::scalar_ciphertext()
+            .map(Self)
+            .under(stack_encrypt::nonempty!("users/fixed"))
+            .accepting()
+    }
+}
+impl DecryptSource<i32> for Fixed {
+    type ContextInput = NoCallerContext;
+    fn decryption<K: 'static>(self, _: Self::ContextInput) -> Decryption<i32, K> {
+        self.0.decryption(OptionalContext::<ScalarContext>::supplied(
+            "users/fixed".into(),
+        ))
+    }
+}
+
+/// `Tracked` is deliberately not `Clone`: a column of owned values is held
+/// by the conversion's guard and handed to each element by reference.
+struct Tracked(String);
+impl zeroize::Zeroize for Tracked {
+    fn zeroize(&mut self) {
+        self.0.zeroize();
+    }
+}
+struct TrackedCiphertext(Ciphertext);
+impl EncryptTarget<Tracked> for TrackedCiphertext {
+    type ContextInput = OptionalContext<ScalarContext>;
+    fn encryption<'s, K: 'static>() -> Encryption<'s, Tracked, Self, K, Self::ContextInput> {
+        stack_encrypt::target::scalar_ciphertext::<String, K>()
+            .project(|source: &Tracked| &source.0)
+            .map(Self)
+    }
+}
+
+async fn columns(
+    cipher: &StackCipher<FakeDataKeySource>,
+    keyset: &KeysetCipher<'_, FakeDataKeySource>,
+) -> Result<(), stack_encrypt::Error> {
+    // Context-free, with a context, and through the client scope.
+    let ages: Vec<Ciphertext> = vec![1i32, 2].encrypt_into(keyset).await?;
+    let _: Vec<i32> = Vec::decrypt_from(ages, cipher).await?;
+    let names: Vec<Ciphertext> = vec![String::from("a")]
+        .encrypt_into_with_context(keyset, ("users", "name"))
+        .await?;
+    let _: Vec<String> = Vec::decrypt_from_with_context(names, keyset, ("users", "name")).await?;
+    // A byte string is one leaf, and a column of byte strings is a column.
+    let blob: Ciphertext = vec![1u8, 2].encrypt_into(keyset).await?;
+    let _: Vec<u8> = Vec::decrypt_from(blob, keyset).await?;
+    let fixed_bytes: Ciphertext = [7u8; 4].encrypt_into(keyset).await?;
+    let _: [u8; 4] = <[u8; 4]>::decrypt_from(fixed_bytes, keyset).await?;
+    let blobs: Vec<Ciphertext> = vec![vec![1u8], vec![]].encrypt_into(keyset).await?;
+    let _: Vec<Vec<u8>> = Vec::decrypt_from(blobs, keyset).await?;
+    // Nested columns, and a column of a non-`Clone` owned plaintext.
+    let nested: Vec<Vec<Ciphertext>> = vec![vec![1i32], vec![]].encrypt_into(keyset).await?;
+    let _: Vec<Vec<i32>> = Vec::decrypt_from(nested, keyset).await?;
+    let _: Vec<TrackedCiphertext> = vec![Tracked(String::from("x"))].encrypt_into(keyset).await?;
+    // The element's capability is the column's.
+    let required: Vec<Required> = vec![1i32].encrypt_into_with_context(keyset, 7u64).await?;
+    let _: Vec<i32> = Vec::decrypt_from_with_context(required, keyset, 7u64).await?;
+    let fixed: Vec<Fixed> = vec![1i32].encrypt_into(keyset).await?;
+    let _: Vec<i32> = Vec::decrypt_from(fixed, keyset).await?;
+    Ok(())
+}
+
+fn main() {
+    let _ = columns;
+}
diff --git a/packages/stack-encrypt/tests/ui/scalar_collections_and_borrows.rs b/packages/stack-encrypt/tests/ui/scalar_collections_and_borrows.rs
index b44585ce1..7ff064c5d 100644
--- a/packages/stack-encrypt/tests/ui/scalar_collections_and_borrows.rs
+++ b/packages/stack-encrypt/tests/ui/scalar_collections_and_borrows.rs
@@ -1,6 +1,5 @@
 fn unsupported<K: 'static>(keyset: &stack_encrypt::KeysetCipher<'_, K>) {
     let _ = keyset.encrypt(vec![1i32, 2]);
-    let _ = keyset.encrypt(vec![1u8, 2]);
     let _ = keyset.encrypt("borrowed plaintext");
 }
 fn main() {}
diff --git a/packages/stack-encrypt/tests/ui/scalar_collections_and_borrows.stderr b/packages/stack-encrypt/tests/ui/scalar_collections_and_borrows.stderr
index f8bde2374..ab5de3568 100644
--- a/packages/stack-encrypt/tests/ui/scalar_collections_and_borrows.stderr
+++ b/packages/stack-encrypt/tests/ui/scalar_collections_and_borrows.stderr
@@ -1,70 +1,58 @@
-error[E0277]: the trait bound `Vec<i32>: OpaqueEncode` is not satisfied
+error[E0277]: the trait bound `for<'a> &'a Vec<i32>: Scalar` is not satisfied
  --> tests/ui/scalar_collections_and_borrows.rs:2:28
   |
 2 |     let _ = keyset.encrypt(vec![1i32, 2]);
-  |                    ------- ^^^^^^^^^^^^^ the trait `OpaqueEncode` is not implemented for `Vec<i32>`
+  |                    ------- ^^^^^^^^^^^^^ the trait `for<'a> Scalar` is not implemented for `&'a Vec<i32>`
   |                    |
   |                    required by a bound introduced by this call
   |
-  = help: the following other types implement trait `OpaqueEncode`:
-            bool
-            f32
-            f64
-            i128
-            i16
-            i32
-            i64
-            i8
-          and $N others
+help: the following other types implement trait `Scalar`
+ --> $CARGO/vitaminc-aead-$VERSION/src/plaintext/sources.rs
+  |
+  |               impl Scalar for $ty {}
+  |               ^^^^^^^^^^^^^^^^^^^
+  |               |
+  |               `&Vec<u8>`
+  |               `Vec<u8>`
+...
+  | / scalar! {
+  | |     bool, &bool, f32, &f32, f64, &f64,
+  | |     i8, &i8, i16, &i16, i32, &i32, i64, &i64, i128, &i128,
+  | |     u16, &u16, u32, &u32, u64, &u64, u128, &u128,
+... |
+  | |     Bytes<'_>, &Bytes<'_>, Raw<'_>, &Raw<'_>,
+  | | }
+  | |_- in this macro invocation
+  = note: required for `Vec<i32>` to implement `OpaqueEncode`
 note: required by a bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
  --> src/scalar.rs
   |
   |     pub fn encrypt<S: OpaqueEncode>(&self, value: S) -> Pending<'_, Ciphertext, K> {
   |                       ^^^^^^^^^^^^ required by this bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
+  = note: this error originates in the macro `scalar` (in Nightly builds, run with -Z macro-backtrace for more info)
 
-error[E0277]: the trait bound `Vec<u8>: OpaqueEncode` is not satisfied
+error[E0277]: the trait bound `&str: OpaqueEncode` is not satisfied
  --> tests/ui/scalar_collections_and_borrows.rs:3:28
   |
-3 |     let _ = keyset.encrypt(vec![1u8, 2]);
-  |                    ------- ^^^^^^^^^^^^ the trait `OpaqueEncode` is not implemented for `Vec<u8>`
+3 |     let _ = keyset.encrypt("borrowed plaintext");
+  |                    ------- ^^^^^^^^^^^^^^^^^^^^ the trait `zeroize::DefaultIsZeroes` is not implemented for `&str`
   |                    |
   |                    required by a bound introduced by this call
   |
-  = help: the following other types implement trait `OpaqueEncode`:
+  = help: the following other types implement trait `zeroize::DefaultIsZeroes`:
+            ()
+            PhantomPinned
             bool
+            char
             f32
             f64
             i128
             i16
-            i32
-            i64
-            i8
           and $N others
+  = note: required for `&str` to implement `zeroize::Zeroize`
+  = note: required for `&str` to implement `OpaqueEncode`
 note: required by a bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
  --> src/scalar.rs
   |
   |     pub fn encrypt<S: OpaqueEncode>(&self, value: S) -> Pending<'_, Ciphertext, K> {
   |                       ^^^^^^^^^^^^ required by this bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
-
-error[E0277]: the trait bound `&str: OpaqueEncode` is not satisfied
- --> tests/ui/scalar_collections_and_borrows.rs:4:28
-  |
-4 |     let _ = keyset.encrypt("borrowed plaintext");
-  |                    ------- ^^^^^^^^^^^^^^^^^^^^ the trait `OpaqueEncode` is not implemented for `&str`
-  |                    |
-  |                    required by a bound introduced by this call
-  |
-help: the trait `OpaqueEncode` is implemented for `std::string::String`
- --> src/scalar.rs
-  |
-  |         impl OpaqueEncode for $ty {}
-  |         ^^^^^^^^^^^^^^^^^^^^^^^^^
-...
-  | opaque!(bool, i8, i16, i32, i64, i128, u16, u32, u64, u128, f32, f64, String);
-  | ----------------------------------------------------------------------------- in this macro invocation
-note: required by a bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
- --> src/scalar.rs
-  |
-  |     pub fn encrypt<S: OpaqueEncode>(&self, value: S) -> Pending<'_, Ciphertext, K> {
-  |                       ^^^^^^^^^^^^ required by this bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
-  = note: this error originates in the macro `opaque` (in Nightly builds, run with -Z macro-backtrace for more info)
diff --git a/packages/stack-encrypt/tests/ui/scalar_nullable.stderr b/packages/stack-encrypt/tests/ui/scalar_nullable.stderr
index c4647de38..9f3809f4f 100644
--- a/packages/stack-encrypt/tests/ui/scalar_nullable.stderr
+++ b/packages/stack-encrypt/tests/ui/scalar_nullable.stderr
@@ -1,45 +1,47 @@
-error[E0277]: the trait bound `Option<i32>: OpaqueEncode` is not satisfied
+error[E0277]: the trait bound `for<'a> &'a Option<i32>: Scalar` is not satisfied
  --> tests/ui/scalar_nullable.rs:2:28
   |
 2 |     let _ = keyset.encrypt(Some(42i32));
-  |                    ------- ^^^^^^^^^^^ the trait `OpaqueEncode` is not implemented for `Option<i32>`
+  |                    ------- ^^^^^^^^^^^ the trait `for<'a> Scalar` is not implemented for `&'a Option<i32>`
   |                    |
   |                    required by a bound introduced by this call
   |
-  = help: the following other types implement trait `OpaqueEncode`:
-            bool
-            f32
-            f64
-            i128
-            i16
-            i32
-            i64
-            i8
+  = help: the following other types implement trait `Scalar`:
+            &&'b T
+            &'a Protected<T>
+            &ProtectedRef<'a, T>
+            &Raw<'_>
+            &Vec<u8>
+            &[u8; N]
+            &[u8]
+            &bool
           and $N others
+  = note: required for `Option<i32>` to implement `OpaqueEncode`
 note: required by a bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
  --> src/scalar.rs
   |
   |     pub fn encrypt<S: OpaqueEncode>(&self, value: S) -> Pending<'_, Ciphertext, K> {
   |                       ^^^^^^^^^^^^ required by this bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
 
-error[E0277]: the trait bound `Option<i32>: OpaqueEncode` is not satisfied
+error[E0277]: the trait bound `for<'a> &'a Option<i32>: Scalar` is not satisfied
  --> tests/ui/scalar_nullable.rs:3:28
   |
 3 |     let _ = keyset.encrypt(None::<i32>);
-  |                    ------- ^^^^^^^^^^^ the trait `OpaqueEncode` is not implemented for `Option<i32>`
+  |                    ------- ^^^^^^^^^^^ the trait `for<'a> Scalar` is not implemented for `&'a Option<i32>`
   |                    |
   |                    required by a bound introduced by this call
   |
-  = help: the following other types implement trait `OpaqueEncode`:
-            bool
-            f32
-            f64
-            i128
-            i16
-            i32
-            i64
-            i8
+  = help: the following other types implement trait `Scalar`:
+            &&'b T
+            &'a Protected<T>
+            &ProtectedRef<'a, T>
+            &Raw<'_>
+            &Vec<u8>
+            &[u8; N]
+            &[u8]
+            &bool
           and $N others
+  = note: required for `Option<i32>` to implement `OpaqueEncode`
 note: required by a bound in `stack_encrypt::scalar::<impl KeysetCipher<'_, K>>::encrypt`
  --> src/scalar.rs
   |
diff --git a/packages/stack-encrypt/tests/value_kinds.rs b/packages/stack-encrypt/tests/value_kinds.rs
index cb55e3290..257f15f3a 100644
--- a/packages/stack-encrypt/tests/value_kinds.rs
+++ b/packages/stack-encrypt/tests/value_kinds.rs
@@ -19,6 +19,7 @@
 
 mod common;
 
+use stack_encrypt::AsProtectedRef as _;
 use std::path::PathBuf;
 
 use common::frames::{frame as value_of, object, payload};
@@ -33,6 +34,7 @@ use stack_encrypt::{CipherText, KeysetCipher, SealedValue, StackCipher, StackCip
 use vitaminc_aead::plaintext::{Int, Logical, Physical, Raw, TimeUnit};
 use vitaminc_aead::plaintext::{MapSink, Sink};
 use vitaminc_aead::{Encrypt, FrameWriter};
+use vitaminc_protected::Controlled as _;
 
 const SEED: [u8; 32] = *b"stack-encrypt value kinds v1    ";
 
@@ -185,13 +187,13 @@ fn data_plan() -> DataPlan {
             )
         })
         .collect();
-    record::plan(object(fields).risky_ref()).expect("the data plan parses")
+    record::plan(object(fields).as_protected_ref()).expect("the data plan parses")
 }
 
 /// The source as a binding hands it over: one frame, a map of the fields in
 /// plan order.
 fn source() -> ValueFrame {
-    let mut bytes = Vec::new();
+    let mut bytes = vitaminc_protected::Buffer::new();
     {
         let kinds = kinds();
         let mut map = FrameWriter::new(&mut bytes)
@@ -204,7 +206,7 @@ fn source() -> ValueFrame {
         }
         map.end().expect("ended");
     }
-    ValueFrame::from_bytes(&bytes).expect("in the value model")
+    ValueFrame::from_bytes(bytes.as_protected_ref()).expect("in the value model")
 }
 
 fn hex(bytes: &[u8]) -> String {
@@ -366,7 +368,9 @@ async fn every_new_kind_seals_opens_and_queries_as_the_typed_path() {
             kind.field
         );
         let ctx = context(
-            &vitaminc_aead_frame::serde::to_vec(&("value_kinds", kind.field)).expect("frames"),
+            vitaminc_aead_frame::serde::to_vec(&("value_kinds", kind.field))
+                .expect("frames")
+                .as_protected_ref(),
         )
         .expect("context");
         let typed_eq = keyset
@@ -416,7 +420,7 @@ async fn a_value_of_another_width_is_refused_when_sealed() {
     let cipher = deterministic_cipher(SEED).await;
     let plan = data_plan();
     // The source with the `int8` field's value sent at 32 bits.
-    let mut bytes = Vec::new();
+    let mut bytes = vitaminc_protected::Buffer::new();
     {
         let kinds = kinds();
         let mut map = FrameWriter::new(&mut bytes)
@@ -433,7 +437,7 @@ async fn a_value_of_another_width_is_refused_when_sealed() {
         map.end().expect("ended");
     }
     let keyset = cipher.default_keyset();
-    let source = vitaminc_aead::Frame::parse(&bytes).expect("a frame");
+    let source = vitaminc_aead::Frame::parse(bytes.risky_ref()).expect("a frame");
     let refused = record::encrypt(&keyset, source, &plan);
     assert!(
         matches!(&refused, Err(error) if error.field() == Some("i8") && error.reason() == Some(Reason::FieldType)),
diff --git a/packages/stack-guest-abi/src/abi.rs b/packages/stack-guest-abi/src/abi.rs
index bc04e172e..74becc16b 100644
--- a/packages/stack-guest-abi/src/abi.rs
+++ b/packages/stack-guest-abi/src/abi.rs
@@ -51,7 +51,8 @@
 //! this crate exports them, so every guest gets `se_alloc` and `se_dealloc`
 //! by depending on it and defines only the exports that are its own.
 
-use zeroize::{Zeroize, Zeroizing};
+use vitaminc_protected::Protected;
+use zeroize::Zeroize;
 
 use crate::buffers;
 use crate::call;
@@ -190,7 +191,7 @@ pub unsafe fn wipe_input(ptr: *mut u8, len: u32) {
 ///
 /// An export that holds its decoded value across a host round trip would
 /// otherwise keep the borrow of the host buffer alive for the whole call.
-/// Copying into a `Zeroizing` first lets the original be wiped immediately:
+/// Copying into a `Protected` first lets the original be wiped immediately:
 /// the plaintext then exists for the duration of the call and no longer,
 /// instead of sitting in linear memory until the host gets round to
 /// `se_dealloc`.
@@ -204,10 +205,10 @@ pub unsafe fn wipe_input(ptr: *mut u8, len: u32) {
 ///
 /// `ptr`/`len` must name a host buffer the caller is done with; it is zeroed
 /// before this returns.
-pub unsafe fn take_plaintext(ptr: *mut u8, len: u32) -> Result<Zeroizing<Vec<u8>>, u32> {
+pub unsafe fn take_plaintext(ptr: *mut u8, len: u32) -> Result<Protected<Vec<u8>>, u32> {
     // SAFETY: the borrow lives only for the copy on this line, inside the
     // call, over a buffer the caller has promised is the host's and live.
-    let taken = Zeroizing::new(unsafe { input(ptr, len)? }.to_vec());
+    let taken = Protected::new(unsafe { input(ptr, len)? }.to_vec());
     unsafe { wipe_input(ptr, len) };
     Ok(taken)
 }
diff --git a/packages/stack-kms/fuzz/Cargo.lock b/packages/stack-kms/fuzz/Cargo.lock
index 049141916..3c94ab85e 100644
--- a/packages/stack-kms/fuzz/Cargo.lock
+++ b/packages/stack-kms/fuzz/Cargo.lock
@@ -1964,8 +1964,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "web-time",
  "zeroize",
  "zerokms-protocol",
@@ -1992,8 +1992,8 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "vitaminc 0.8.0",
- "vitaminc-protected 0.8.0",
+ "vitaminc 0.9.0",
+ "vitaminc-protected 0.9.1",
  "zeroize",
  "zerokms-protocol",
 ]
@@ -2411,16 +2411,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea37168a603d605732d0bf0672586139ab91736f767d7b85e173c84dcee19054"
+checksum = "e7aa53d696a9e1af61b36a60b92cc0dde7421f8f58787333d3c425a176af241c"
 dependencies = [
- "vitaminc-aead 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-encrypt 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
- "vitaminc-traits 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-encrypt 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
+ "vitaminc-traits 0.9.0",
 ]
 
 [[package]]
@@ -2440,18 +2440,18 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9bb97fd543ee6a2b168e257ec69d0d274a775b1eaa3f856b5ac2941b01891c1"
+checksum = "efba1dac1efc04ffc09cba49e343e0fe656c88c32472a4206f2a6df284add33d"
 dependencies = [
  "bytes",
  "futures-util",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-aead-derive 0.8.0",
- "vitaminc-context 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead-derive 0.9.0",
+ "vitaminc-context 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -2468,9 +2468,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-aead-derive"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0845a44c07ddc882ed47a0e92e04fc83496220f054b589ad0cbd215c5009e5b7"
+checksum = "a3c6575dac7701e578b375d16a0b693294d73847ed275c9b9962cf20c423ea10"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2489,12 +2489,12 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-context"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a630079ba2d50680ee5048addd430eda30613559809dd6d383551e6d3d299826"
+checksum = "5b407b3127be198a8da7d4d914c11215e1eae1b467cdf89eca8a7a296055e863"
 dependencies = [
  "mutants",
- "vitaminc-protected 0.8.0",
+ "vitaminc-protected 0.9.1",
 ]
 
 [[package]]
@@ -2513,15 +2513,15 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-encrypt"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db45e073f92ae8ca27f8fe14270bc34c75e767559c2347098dacca95180d1ddd"
+checksum = "7fa0a3493624afd1490085448d6d09d22bf061954e9ab0db08837f423db3a58d"
 dependencies = [
  "aes-gcm",
  "aws-lc-rs",
- "vitaminc-aead 0.8.0",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-aead 0.9.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]
 
@@ -2544,9 +2544,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6edc22562a9bbff0ba9704a2c43670b2c7cb1637524c045c3ba6436ed00917f"
+checksum = "67a44502e43de42fbd95c12a35efbaea903eedcc7a3922fceacea93054f44485"
 dependencies = [
  "bitvec",
  "digest 0.11.3",
@@ -2555,7 +2555,7 @@ dependencies = [
  "serde_bytes",
  "subtle",
  "thiserror 2.0.18",
- "vitaminc-protected-derive 0.8.0",
+ "vitaminc-protected-derive 0.9.1",
  "zeroize",
 ]
 
@@ -2572,9 +2572,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-protected-derive"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cce3a7d0ce6f57c0e82345f20e87f3737cccd3a70aec2a2ab49f68a3a5e24a"
+checksum = "f4315341c559af17bd773e8b4e32125a2025d7fbe3e31cbae49120ee1dcab02e"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2599,16 +2599,16 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb253f783ce6f31a55a92f5a9f0526109b8caa6a465edb94244fd344a078c11"
+checksum = "71e32850b739b58a7064b50eb3db655de323f57f21c1fe74d5ccd4d308560563"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
  "rand 0.10.1",
  "thiserror 2.0.18",
- "vitaminc-protected 0.8.0",
- "vitaminc-random-derives 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random-derives 0.9.0",
  "zeroize",
 ]
 
@@ -2625,9 +2625,9 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-random-derives"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0b3615936d6dded4b775856f4b0fa229d745d183f0b3754ac80035f16c27d9"
+checksum = "1863fe02de3945047dc9094d3cadbde06becafa49aa95d5e475bf903c8d83981"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2652,17 +2652,17 @@ dependencies = [
 
 [[package]]
 name = "vitaminc-traits"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9098ee4b13446ef959583ee2f3c384df571b453179104f7b4960ffddf65ee9"
+checksum = "a715ef503b1b41801a6c23e9756ed3d5a1201fa632609bccfa2a7a41ab5386cf"
 dependencies = [
  "anyhow",
  "bytes",
  "rmp-serde",
  "serde",
  "thiserror 2.0.18",
- "vitaminc-protected 0.8.0",
- "vitaminc-random 0.8.0",
+ "vitaminc-protected 0.9.1",
+ "vitaminc-random 0.9.0",
  "zeroize",
 ]