diff --git a/DynamicWhere.Tests/CancellationTests.cs b/DynamicWhere.Tests/CancellationTests.cs
new file mode 100644
index 0000000..d5d3af1
--- /dev/null
+++ b/DynamicWhere.Tests/CancellationTests.cs
@@ -0,0 +1,316 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Classes.Result;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using DynamicWhere.ex.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Microsoft.EntityFrameworkCore.Query;
+using System.Collections;
+using System.Data.Common;
+using System.Linq.Expressions;
+
+namespace DynamicWhere.Tests;
+
+public class CancelledRow
+{
+    public int Id { get; set; }
+
+    public string Team { get; set; } = string.Empty;
+
+    public int Points { get; set; }
+}
+
+public sealed class CancellationContext : DbContext
+{
+    private readonly SqliteConnection _connection;
+    private readonly IInterceptor[] _interceptors;
+
+    public CancellationContext(SqliteConnection connection, params IInterceptor[] interceptors)
+    {
+        _connection = connection;
+        _interceptors = interceptors;
+    }
+
+    public DbSet<CancelledRow> Rows => Set<CancelledRow>();
+
+    protected override void OnConfiguring(DbContextOptionsBuilder options) =>
+        options.UseSqlite(_connection).AddInterceptors(_interceptors);
+}
+
+/// <summary>
+/// Cancels a token just before the numbered command runs, and counts the commands that finished, so a
+/// test can tell which read the token reached.
+/// </summary>
+public sealed class CancelBeforeCommand : DbCommandInterceptor
+{
+    private readonly CancellationTokenSource _source;
+    private readonly int _at;
+    private int _started;
+
+    public CancelBeforeCommand(CancellationTokenSource source, int at)
+    {
+        _source = source;
+        _at = at;
+    }
+
+    public int Finished { get; private set; }
+
+    public override ValueTask<InterceptionResult<DbDataReader>> ReaderExecutingAsync(
+        DbCommand command,
+        CommandEventData eventData,
+        InterceptionResult<DbDataReader> result,
+        CancellationToken cancellationToken = default)
+    {
+        if (++_started == _at)
+        {
+            _source.Cancel();
+        }
+
+        return base.ReaderExecutingAsync(command, eventData, result, cancellationToken);
+    }
+
+    public override ValueTask<DbDataReader> ReaderExecutedAsync(
+        DbCommand command,
+        CommandExecutedEventData eventData,
+        DbDataReader result,
+        CancellationToken cancellationToken = default)
+    {
+        Finished++;
+
+        return base.ReaderExecutedAsync(command, eventData, result, cancellationToken);
+    }
+}
+
+/// <summary>An async provider that fails as it builds the query, before any task exists.</summary>
+public sealed class UntranslatableQuery<T> : IQueryable<T>, IAsyncQueryProvider
+{
+    public UntranslatableQuery() => Expression = Expression.Constant(this);
+
+    public Type ElementType => typeof(T);
+
+    public Expression Expression { get; }
+
+    public IQueryProvider Provider => this;
+
+    public IEnumerator<T> GetEnumerator() => throw new InvalidOperationException("untranslatable");
+
+    IEnumerator IEnumerable.GetEnumerator() => GetEnumerator();
+
+    public IQueryable CreateQuery(Expression expression) => this;
+
+    public IQueryable<TElement> CreateQuery<TElement>(Expression expression) => throw new InvalidOperationException("untranslatable");
+
+    public object Execute(Expression expression) => throw new InvalidOperationException("untranslatable");
+
+    public TResult Execute<TResult>(Expression expression) => throw new InvalidOperationException("untranslatable");
+
+    public TResult ExecuteAsync<TResult>(Expression expression, CancellationToken cancellationToken = default) =>
+        throw new InvalidOperationException("untranslatable");
+}
+
+/// <summary>
+/// Every asynchronous terminal takes a <see cref="CancellationToken"/>, guarded or not, and hands it to
+/// the provider.
+/// </summary>
+/// <remarks>
+/// Before 3.2.0 no method took one, so a request its client had abandoned could not cancel its read.
+/// The overloads sit beside the ones without a token rather than replacing them: a parameter added to
+/// an existing method changes its signature, which a caller compiled against the old one cannot find.
+/// <para>
+/// Runs on the EF Core 6 leg too, because a dynamic read reaches EF Core's own asynchronous operators by
+/// reflection, and a method found by name is exactly what differs between versions.
+/// </para>
+/// </remarks>
+public sealed class CancellationTests : IDisposable
+{
+    private readonly SqliteConnection _connection;
+    private readonly CancellationContext _db;
+
+    public CancellationTests()
+    {
+        _connection = new SqliteConnection("DataSource=:memory:");
+        _connection.Open();
+
+        _db = new CancellationContext(_connection);
+        _db.Database.EnsureCreated();
+
+        for (int i = 1; i <= 6; i++)
+        {
+            _db.Rows.Add(new CancelledRow { Id = i, Team = i % 2 == 0 ? "even" : "odd", Points = i * 10 });
+        }
+
+        _db.SaveChanges();
+        _db.ChangeTracker.Clear();
+    }
+
+    public void Dispose()
+    {
+        _db.Dispose();
+        _connection.Dispose();
+    }
+
+    private static CancellationToken Canceled()
+    {
+        using CancellationTokenSource source = new();
+
+        source.Cancel();
+
+        return source.Token;
+    }
+
+    private static Filter Paged() => new()
+    {
+        Orders = new List<OrderBy> { new() { Sort = 1, Field = "Id", Direction = Direction.Ascending } },
+        Page = new PageBy { PageNumber = 1, PageSize = 4 }
+    };
+
+    private static Filter PagedDynamic()
+    {
+        Filter filter = Paged();
+
+        filter.Selects = new List<string> { "Id", "Team" };
+
+        return filter;
+    }
+
+    private static Summary ByTeam() => new()
+    {
+        GroupBy = new GroupBy
+        {
+            Fields = new List<string> { "Team" },
+            AggregateBy = new List<AggregateBy>
+            {
+                new() { Field = "Points", Alias = "Total", Aggregator = Aggregator.Sumation }
+            }
+        },
+        Orders = new List<OrderBy> { new() { Sort = 1, Field = "Team", Direction = Direction.Ascending } }
+    };
+
+    private static Segment OddOrFirst() => new()
+    {
+        ConditionSets =
+        {
+            new ConditionSet
+            {
+                Sort = 1,
+                ConditionGroup = new ConditionGroup
+                {
+                    Conditions = { new Condition { Field = "Team", DataType = DataType.Text, Operator = Operator.Equal, Values = { "odd" } } }
+                }
+            },
+            new ConditionSet
+            {
+                Sort = 2,
+                Intersection = Intersection.Union,
+                ConditionGroup = new ConditionGroup
+                {
+                    Conditions = { new Condition { Field = "Id", DataType = DataType.Number, Operator = Operator.Equal, Values = { 2 } } }
+                }
+            }
+        }
+    };
+
+    private PolicyQueryable<CancelledRow> Guarded() =>
+        _db.Rows.ApplyPolicy(
+            new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+            new DwPolicyOptions { Tier = DwTier.Strict, Caps = { MinGroupSize = 1 } },
+            new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+    [Fact]
+    public async Task A_canceled_token_stops_every_unguarded_async_terminal()
+    {
+        CancellationToken canceled = Canceled();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => _db.Rows.ToListAsync(Paged(), canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => _db.Rows.ToListAsync(Paged(), true, canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => _db.Rows.ToListAsyncDynamic(PagedDynamic(), canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => _db.Rows.ToListAsyncDynamic(PagedDynamic(), true, canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => _db.Rows.ToListAsync(ByTeam(), canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => _db.Rows.ToListAsync(ByTeam(), true, canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => _db.Rows.ToListAsync(OddOrFirst(), canceled));
+    }
+
+    [Fact]
+    public async Task A_canceled_token_stops_every_guarded_async_terminal()
+    {
+        CancellationToken canceled = Canceled();
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => Guarded().ToListAsync(Paged(), canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => Guarded().ToListAsyncDynamic(PagedDynamic(), canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => Guarded().ToListAsync(ByTeam(), canceled));
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => Guarded().ToListAsync(OddOrFirst(), canceled));
+    }
+
+    /// <summary>
+    /// Each terminal counts, then reads. Canceling just before the first command shows the count took the
+    /// token; canceling just before the second shows the read did, after a count that finished.
+    /// </summary>
+    [Theory]
+    [InlineData(1)]
+    [InlineData(2)]
+    public async Task The_token_reaches_both_the_count_and_the_read(int at)
+    {
+        async Task Check(Func<CancellationContext, CancellationToken, Task> run)
+        {
+            using CancellationTokenSource source = new();
+            CancelBeforeCommand interceptor = new(source, at);
+            using CancellationContext db = new(_connection, interceptor);
+
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(() => run(db, source.Token));
+            Assert.Equal(at - 1, interceptor.Finished);
+        }
+
+        await Check((db, token) => db.Rows.ToListAsync(Paged(), token));
+        await Check((db, token) => db.Rows.ToListAsyncDynamic(PagedDynamic(), token));
+        await Check((db, token) => db.Rows.ToListAsync(ByTeam(), token));
+        await Check((db, token) => db.Rows.ToListAsync(OddOrFirst(), token));
+    }
+
+    /// <summary>
+    /// A grouped count reaches EF Core's operator by reflection. A query it cannot build fails with its own
+    /// exception, as the synchronous count it replaced did, not one wrapped by the reflection call.
+    /// </summary>
+    [Fact]
+    public async Task A_provider_failure_leaves_the_grouped_count_as_itself()
+    {
+        InvalidOperationException failure = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => AsyncReads.CountAsync(new UntranslatableQuery<int>(), CancellationToken.None));
+
+        Assert.Equal("untranslatable", failure.Message);
+    }
+
+    /// <summary>A token that is never canceled changes nothing: each overload answers as the one without a token does.</summary>
+    [Fact]
+    public async Task A_live_token_returns_what_the_overload_without_one_returns()
+    {
+        using CancellationTokenSource live = new();
+
+        FilterResult<CancelledRow> plain = await _db.Rows.ToListAsync(Paged());
+        FilterResult<CancelledRow> tokened = await _db.Rows.ToListAsync(Paged(), live.Token);
+        Assert.Equal(plain.Data.Select(row => row.Id), tokened.Data.Select(row => row.Id));
+        Assert.Equal((plain.TotalCount, plain.PageCount), (tokened.TotalCount, tokened.PageCount));
+
+        FilterResult<dynamic> dynamicRows = await _db.Rows.ToListAsyncDynamic(PagedDynamic(), live.Token);
+        Assert.Equal(new[] { 1, 2, 3, 4 }, dynamicRows.Data.Select(row => (int)row.Id));
+        Assert.Equal(6, dynamicRows.TotalCount);
+
+        SummaryResult summary = await _db.Rows.ToListAsync(ByTeam(), live.Token);
+        Assert.Equal(2, summary.TotalCount);
+        Assert.Equal(new[] { 120, 90 }, summary.Data.Select(row => (int)row.Total));
+
+        SegmentResult<CancelledRow> segment = await _db.Rows.ToListAsync(OddOrFirst(), live.Token);
+        Assert.Equal(new[] { 1, 2, 3, 5 }, segment.Data!.Select(row => row.Id).OrderBy(id => id));
+
+        Assert.Equal(new[] { 1, 2, 3, 4 }, (await Guarded().ToListAsync(Paged(), live.Token)).Data.Select(row => row.Id));
+        Assert.Equal(new[] { 1, 2, 3, 4 }, (await Guarded().ToListAsyncDynamic(PagedDynamic(), live.Token)).Data.Select(row => (int)row.Id));
+        Assert.Equal(new[] { 120, 90 }, (await Guarded().ToListAsync(ByTeam(), live.Token)).Data.Select(row => (int)row.Total));
+        Assert.Equal(4, (await Guarded().ToListAsync(OddOrFirst(), live.Token)).TotalCount);
+    }
+}
diff --git a/DynamicWhere.Tests/ComplexMemberTests.cs b/DynamicWhere.Tests/ComplexMemberTests.cs
new file mode 100644
index 0000000..1a61f1d
--- /dev/null
+++ b/DynamicWhere.Tests/ComplexMemberTests.cs
@@ -0,0 +1,215 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace DynamicWhere.Tests;
+
+/// <summary>An entity with a denied scalar and a complex property with nothing denied beneath it.</summary>
+public class CxCrate
+{
+    public int Id { get; set; }
+
+    [DwDenied]
+    public string? Label { get; set; }
+
+    public CxSize Size { get; set; } = new();
+}
+
+public class CxSize
+{
+    public int Width { get; set; }
+
+    public int Height { get; set; }
+}
+
+public class CxSecretSize
+{
+    public int Width { get; set; }
+
+    [DwDenied]
+    public int Height { get; set; }
+}
+
+/// <summary>An entity whose only denial sits inside its complex property.</summary>
+public class CxSealedBox
+{
+    public int Id { get; set; }
+
+    public string Name { get; set; } = string.Empty;
+
+    public CxSecretSize Inner { get; set; } = new();
+}
+
+/// <summary>A row projected from <see cref="CxSealedBox"/>, carrying its complex value.</summary>
+[DwEntity(RequirePolicy = true)]
+public sealed class CxBoxRow
+{
+    public int Id { get; set; }
+
+    [DwDenied]
+    public string? Tenant { get; set; }
+
+    public CxSecretSize Inner { get; set; } = new();
+}
+
+/// <summary>An owned member stored as JSON, with a denial beneath it.</summary>
+public class CxJsonShelf
+{
+    public int Id { get; set; }
+
+    public string Name { get; set; } = string.Empty;
+
+    public CxJsonMeta Meta { get; set; } = new();
+}
+
+public class CxJsonMeta
+{
+    public string Label { get; set; } = string.Empty;
+
+    [DwDenied]
+    public string? Code { get; set; }
+}
+
+/// <summary>A primitive collection named with a word the expression parser keeps.</summary>
+public class CxCastEntity
+{
+    public int Id { get; set; }
+
+    [DwDenied]
+    public string? Secret { get; set; }
+
+    public List<string> Cast { get; set; } = new();
+}
+
+public sealed class ComplexMemberContext : DbContext
+{
+    private readonly SqliteConnection _connection;
+
+    public ComplexMemberContext(SqliteConnection connection) => _connection = connection;
+
+    public DbSet<CxCrate> Crates => Set<CxCrate>();
+
+    public DbSet<CxSealedBox> Boxes => Set<CxSealedBox>();
+
+    public DbSet<CxJsonShelf> JsonShelves => Set<CxJsonShelf>();
+
+    public DbSet<CxCastEntity> CastEntities => Set<CxCastEntity>();
+
+    protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+    protected override void OnModelCreating(ModelBuilder model)
+    {
+        model.Entity<CxCrate>().ComplexProperty(crate => crate.Size);
+        model.Entity<CxSealedBox>().ComplexProperty(box => box.Inner);
+        model.Entity<CxJsonShelf>().OwnsOne(shelf => shelf.Meta, meta => meta.ToJson());
+    }
+}
+
+/// <summary>
+/// An EF Core complex property, which EF Core 8 loads with the entity on every query. A synthesized
+/// projection keeps it whole, and leaves it out whole when something beneath it is denied: the core
+/// narrows a nested object behind a comparison with null, which EF Core refuses for a complex type.
+/// </summary>
+/// <remarks>Not on the EF Core 6 leg, which has no complex properties.</remarks>
+public sealed class ComplexMemberTests : IDisposable
+{
+    private readonly SqliteConnection _connection;
+    private readonly ComplexMemberContext _db;
+
+    public ComplexMemberTests()
+    {
+        _connection = new SqliteConnection("DataSource=:memory:");
+        _connection.Open();
+
+        _db = new ComplexMemberContext(_connection);
+        _db.Database.EnsureCreated();
+
+        _db.Crates.Add(new CxCrate { Label = "label-secret", Size = new CxSize { Width = 4, Height = 5 } });
+        _db.Boxes.Add(new CxSealedBox { Name = "B1", Inner = new CxSecretSize { Width = 2, Height = 9 } });
+        _db.JsonShelves.Add(new CxJsonShelf { Name = "J1", Meta = new CxJsonMeta { Label = "L", Code = "json-secret" } });
+        _db.CastEntities.Add(new CxCastEntity { Secret = "s", Cast = new List<string> { "a" } });
+        _db.SaveChanges();
+        _db.ChangeTracker.Clear();
+    }
+
+    public void Dispose()
+    {
+        _db.Dispose();
+        _connection.Dispose();
+    }
+
+    private static PolicyQueryable<T> Guard<T>(IQueryable<T> source) where T : class =>
+        source.ApplyPolicy(
+            new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+            new DwPolicyOptions { Tier = DwTier.Strict },
+            new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+    [Fact]
+    public void A_complex_property_with_nothing_denied_beneath_is_kept_whole()
+    {
+        CxCrate crate = Guard(_db.Crates).ToList(new Filter()).Data.Single();
+
+        Assert.Null(crate.Label);
+        Assert.Equal((4, 5), (crate.Size.Width, crate.Size.Height));
+    }
+
+    /// <summary>
+    /// A projected row carrying a complex value: the core's narrowing compares it to null, which EF Core
+    /// refuses, so with a denial beneath it the value is left out whole rather than failing the query.
+    /// </summary>
+    [Fact]
+    public void A_projected_complex_value_with_a_denial_beneath_is_left_out()
+    {
+        PolicyQueryable<CxBoxRow> guarded = Guard(_db.Boxes.Select(b => new CxBoxRow { Id = b.Id, Tenant = b.Name, Inner = b.Inner }));
+
+        CxBoxRow row = guarded.ToList(new Filter()).Data.Single();
+
+        Assert.Equal((0, 0), (row.Inner.Width, row.Inner.Height));
+        Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Inner"
+            && decision.Reason == "left out whole: the projection builds it in a way the core cannot narrow");
+    }
+
+    /// <summary>An owned member stored as JSON cannot be narrowed by EF Core, so it is left out whole.</summary>
+    [Fact]
+    public void An_owned_member_stored_as_json_with_a_denial_beneath_is_left_out()
+    {
+        PolicyQueryable<CxJsonShelf> guarded = Guard(_db.JsonShelves);
+
+        CxJsonShelf shelf = guarded.ToList(new Filter()).Data.Single();
+
+        Assert.Equal("J1", shelf.Name);
+        Assert.Null(shelf.Meta.Code);
+        Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Meta"
+            && decision.Reason == "left out whole: it is stored as JSON, which EF Core cannot narrow");
+    }
+
+    /// <summary>A primitive collection named with a parser word cannot be projected, so it is skipped.</summary>
+    [Fact]
+    public void A_primitive_collection_named_with_a_parser_word_is_skipped()
+    {
+        CxCastEntity entity = Guard(_db.CastEntities).ToList(new Filter()).Data.Single();
+
+        Assert.Null(entity.Secret);
+    }
+
+    [Fact]
+    public void A_complex_property_with_a_denial_beneath_is_left_out_whole()
+    {
+        PolicyQueryable<CxSealedBox> guarded = Guard(_db.Boxes);
+
+        CxSealedBox box = guarded.ToList(new Filter()).Data.Single();
+
+        Assert.Equal("B1", box.Name);
+        Assert.Equal((0, 0), (box.Inner.Width, box.Inner.Height));
+        Assert.Contains(
+            guarded.LastTrace!.Decisions,
+            decision => decision.FieldPath == "Inner"
+                        && decision.Reason == "left out whole: it is a complex property, which EF Core cannot narrow");
+    }
+}
diff --git a/DynamicWhere.Tests/DefaultOrderTests.cs b/DynamicWhere.Tests/DefaultOrderTests.cs
index 80469f3..e7a0709 100644
--- a/DynamicWhere.Tests/DefaultOrderTests.cs
+++ b/DynamicWhere.Tests/DefaultOrderTests.cs
@@ -108,6 +108,20 @@ public class AuditedTicket
     public int Rank { get; set; }
 }
 
+/// <summary>A default reaching through a reference, for the projections that do and do not assign it.</summary>
+[DwEntity(DefaultOrder = "Owner.Name desc, Id")]
+public class OwnedTicket
+{
+    public int Id { get; set; }
+
+    public TicketOwner? Owner { get; set; }
+}
+
+public class TicketOwner
+{
+    public string Name { get; set; } = string.Empty;
+}
+
 /// <summary>A type that declares no default, and so is never ordered by one.</summary>
 public class PlainTicket
 {
@@ -537,6 +551,111 @@ public void A_denial_a_rule_can_lift_is_a_warning_and_so_is_one_for_segments()
             unsegmented.Warnings);
     }
 
+    // ------------------------------------------------------------------- a projected source (3.2.0)
+
+    /// <summary>
+    /// DCMP's A9. A projection that builds the type in an initializer and assigns every field the
+    /// default names hides nothing, so the default applies: EF Core translates the order through the
+    /// members the projection assigned. It used to be left unordered, like every projection.
+    /// </summary>
+    [Fact]
+    public async Task A_projection_that_assigns_every_default_field_takes_the_default()
+    {
+        IQueryable<Ticket> rows = _db.Tickets.Select(t => new Ticket { Id = t.Id, Priority = t.Priority, Title = t.Title });
+
+        PolicyQueryable<Ticket> guarded = rows.ApplyPolicy(Caller(), Options(), Resolver());
+
+        Assert.Equal(ByDefault, Ids(guarded.ToList(new Filter()).Data));
+        Assert.Equal(ByDefault, Ids((await guarded.ToListAsync(new Filter())).Data));
+        Assert.Equal(new[] { 2, 4 }, Ids(guarded.Page(FirstTwo()).AsUnguardedQueryable().ToList()));
+        Assert.Equal(new[] { 2, 4, 3, 5 }, Ids((await guarded.ToListAsync(UrgentOrFive())).Data!));
+    }
+
+    /// <summary>A projection that leaves out a field the default names keeps whatever order it had.</summary>
+    [Fact]
+    public void A_projection_that_leaves_a_default_field_out_keeps_its_own_order()
+    {
+        IQueryable<Ticket> rows = _db.Tickets.Select(t => new Ticket { Id = t.Id, Title = t.Title });
+
+        Assert.Equal(AsWritten, Ids(rows.ApplyPolicy(Caller(), Options(), Resolver()).ToList(new Filter()).Data));
+    }
+
+    /// <summary>DCMP's A10 and A11: a source ordered before its projection keeps that order, and a caller's order wins.</summary>
+    [Fact]
+    public void A_source_ordered_before_its_projection_keeps_that_order_and_the_callers_order_wins()
+    {
+        IQueryable<Ticket> rows = _db.Tickets.OrderBy(t => t.Title)
+            .Select(t => new Ticket { Id = t.Id, Priority = t.Priority, Title = t.Title });
+
+        Assert.Equal(AsWritten, Ids(rows.ApplyPolicy(Caller(), Options(), Resolver()).ToList(new Filter()).Data));
+        Assert.Equal(
+            new[] { 5, 4, 3, 2, 1 },
+            Ids(rows.ApplyPolicy(Caller(), Options(), Resolver())
+                .ToList(new Filter { Orders = new List<OrderBy> { By("Id", Direction.Descending) } }).Data));
+    }
+
+    /// <summary>
+    /// The default is for the rows the caller's source makes. A projection the caller composes on the
+    /// guarded handle afterwards stays in its own order, even when it keeps every field the default names.
+    /// </summary>
+    [Fact]
+    public void A_projection_composed_after_ApplyPolicy_stays_unordered_even_with_every_default_field()
+    {
+        PolicyQueryable<Ticket> projected = Guarded().Select(new List<string> { "Id", "Priority" });
+
+        Assert.Equal(new[] { 1, 2 }, Ids(projected.Page(FirstTwo()).AsUnguardedQueryable().ToList()));
+        Assert.Equal(AsWritten, Ids(projected.ToList(new Filter()).Data));
+    }
+
+    /// <summary>
+    /// A composed Filter whose orders were all dropped sent orders, so nothing later in the chain adds a
+    /// default in their place, exactly as a composed Order whose fields were all dropped does.
+    /// </summary>
+    [Fact]
+    public void A_filter_composed_with_orders_that_were_all_dropped_gets_no_default_later()
+    {
+        PolicyQueryable<Ticket> guarded = Guarded(
+            new FakePolicyProvider().Add("Title", PolicyFeature.Order, PolicyEffect.Deny, PolicyLevel.DynamicGlobal));
+
+        PolicyQueryable<Ticket> filtered = guarded.Filter(new Filter { Orders = new List<OrderBy> { By("Title") } });
+
+        Assert.Equal(new[] { 1, 2 }, Ids(filtered.Page(FirstTwo()).AsUnguardedQueryable().ToList()));
+    }
+
+    /// <summary>
+    /// A nested default is assigned only when every level of its path is an initializer that assigns
+    /// the next member. Any other expression along the way, or a member left out, hides it.
+    /// </summary>
+    [Fact]
+    public void A_nested_default_is_assigned_only_through_initializers()
+    {
+        OwnedTicket[] source =
+        {
+            new() { Id = 1, Owner = new TicketOwner { Name = "b" } },
+            new() { Id = 2, Owner = new TicketOwner { Name = "c" } },
+            new() { Id = 3, Owner = new TicketOwner { Name = "a" } }
+        };
+
+        IQueryable<OwnedTicket> initialized = source.AsQueryable()
+            .Select(t => new OwnedTicket { Id = t.Id, Owner = new TicketOwner { Name = t.Owner!.Name } });
+        IQueryable<OwnedTicket> assignedWhole = source.AsQueryable()
+            .Select(t => new OwnedTicket { Id = t.Id, Owner = t.Owner });
+        IQueryable<OwnedTicket> leftOut = source.AsQueryable()
+            .Select(t => new OwnedTicket { Id = t.Id });
+
+        Assert.False(DefaultOrder.HidesDefault(initialized.Expression, typeof(OwnedTicket)));
+        Assert.True(DefaultOrder.HidesDefault(assignedWhole.Expression, typeof(OwnedTicket)));
+        Assert.True(DefaultOrder.HidesDefault(leftOut.Expression, typeof(OwnedTicket)));
+        Assert.False(DefaultOrder.HidesDefault(source.AsQueryable().Expression, typeof(OwnedTicket)));
+
+        Assert.Equal(
+            new[] { 2, 1, 3 },
+            initialized.ApplyPolicy(Caller(), Options(), Resolver()).ToList(new Filter()).Data.Select(row => row.Id));
+        Assert.Equal(
+            new[] { 1, 2, 3 },
+            assignedWhole.ApplyPolicy(Caller(), Options(), Resolver()).ToList(new Filter()).Data.Select(row => row.Id));
+    }
+
     [Fact]
     public void An_audited_default_field_is_recorded_only_when_the_query_orders_by_it()
     {
diff --git a/DynamicWhere.Tests/DynamicWhere.Tests.csproj b/DynamicWhere.Tests/DynamicWhere.Tests.csproj
index 679f213..48e78ca 100644
--- a/DynamicWhere.Tests/DynamicWhere.Tests.csproj
+++ b/DynamicWhere.Tests/DynamicWhere.Tests.csproj
@@ -27,6 +27,9 @@
     <!-- Version comes from DwEfCoreVersion above: 8.0.10 by default, because the sales fixture
          needs DateOnly/TimeOnly and primitive-collection mapping; 6.0.22 on the floor leg. -->
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="$(DwEfCoreVersion)" />
+    <!-- Lazy-loading proxies, for the test that a navigation a proxy can fill after the query counts as
+         loaded. Same version as EF Core, on both legs. -->
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="$(DwEfCoreVersion)" />
     <!-- ConfigurationBuilder, for the posture-binding tests. In the always-on group rather
          than beside Npgsql, because binding is a core feature and the floor leg has to run
          its tests too. An Extensions package at 6.0.0 pulls no EF Core graph with it. -->
@@ -79,6 +82,10 @@
          primary key it reads from the EF Core model, both of which differ between 6 and 8. It
          carries its own SQLite model. -->
     <Compile Include="SegmentCompositionTests.cs" />
+    <!-- Kept: a dynamic read and a grouped count reach EF Core's own asynchronous operators by
+         reflection, found by name, which is what differs between 6 and 8. It carries its own SQLite
+         model. -->
+    <Compile Include="CancellationTests.cs" />
     <Compile Remove="Policies/EfPolicyModelTests.cs" />
     <Compile Remove="Policies/EfPolicyStoreTests.cs" />
     <Compile Remove="Policies/EfStoreConformanceTests.cs" />
diff --git a/DynamicWhere.Tests/Policies/ProjectedRowTests.cs b/DynamicWhere.Tests/Policies/ProjectedRowTests.cs
new file mode 100644
index 0000000..51a7a31
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ProjectedRowTests.cs
@@ -0,0 +1,702 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Classes.Result;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using DynamicWhere.ex.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace DynamicWhere.Tests.Policies;
+
+// ------------------------------------------------------------------------------------ the database
+
+/// <summary>A role, scoped to a tenant or, with none, a platform template.</summary>
+public class PrRole
+{
+    public int Id { get; set; }
+
+    public string Code { get; set; } = string.Empty;
+
+    public string NameAr { get; set; } = string.Empty;
+
+    public string NameEn { get; set; } = string.Empty;
+
+    public int? TenantId { get; set; }
+}
+
+/// <summary>A permission, with a value no row built from it may carry out.</summary>
+public class PrPermission
+{
+    public int Id { get; set; }
+
+    public string Code { get; set; } = string.Empty;
+
+    public string Secret { get; set; } = string.Empty;
+}
+
+/// <summary>A permission granted to a role.</summary>
+public class PrGrant
+{
+    public int Id { get; set; }
+
+    public int RoleId { get; set; }
+
+    public int PermissionId { get; set; }
+
+    public PrPermission Permission { get; set; } = null!;
+}
+
+/// <summary>An entity with nothing denied at the top: every denial sits beneath a member.</summary>
+public class PrShelf
+{
+    public int Id { get; set; }
+
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Owned, so EF Core loads it with every shelf.</summary>
+    public PrLocation? Location { get; set; }
+
+    /// <summary>Owned as well, and a collection.</summary>
+    public List<PrTag> Tags { get; set; } = new();
+
+    /// <summary>A navigation, loaded only when something includes it.</summary>
+    public List<PrBook> Books { get; set; } = new();
+}
+
+public class PrLocation
+{
+    public string Aisle { get; set; } = string.Empty;
+
+    [DwDenied]
+    public string? Code { get; set; }
+}
+
+public class PrTag
+{
+    public int Id { get; set; }
+
+    public string Name { get; set; } = string.Empty;
+
+    [DwDenied]
+    public string? Hidden { get; set; }
+}
+
+public class PrBook
+{
+    public int Id { get; set; }
+
+    public int PrShelfId { get; set; }
+
+    public string Title { get; set; } = string.Empty;
+
+    [DwDenied]
+    public string? Isbn { get; set; }
+}
+
+/// <summary>An entity with a denied scalar, an owned member with nothing denied beneath it, and a blob.</summary>
+public class PrBin
+{
+    public int Id { get; set; }
+
+    [DwDenied]
+    public string? Label { get; set; }
+
+    public PrPlace? Place { get; set; }
+
+    public byte[] Photo { get; set; } = Array.Empty<byte>();
+}
+
+public class PrPlace
+{
+    public string Aisle { get; set; } = string.Empty;
+
+    public int Row { get; set; }
+}
+
+/// <summary>An entity whose children's key no caller may see.</summary>
+public class PrKeyParent
+{
+    public int Id { get; set; }
+
+    public List<PrKeyChild> Kids { get; set; } = new();
+}
+
+public class PrKeyChild
+{
+    [DwDenied]
+    public int Id { get; set; }
+
+    public int PrKeyParentId { get; set; }
+
+    public string Name { get; set; } = string.Empty;
+}
+
+public sealed class ProjectedRowContext : DbContext
+{
+    private readonly SqliteConnection _connection;
+
+    public ProjectedRowContext(SqliteConnection connection) => _connection = connection;
+
+    public DbSet<PrRole> Roles => Set<PrRole>();
+
+    public DbSet<PrPermission> Permissions => Set<PrPermission>();
+
+    public DbSet<PrGrant> Grants => Set<PrGrant>();
+
+    public DbSet<PrShelf> Shelves => Set<PrShelf>();
+
+    public DbSet<PrBin> Bins => Set<PrBin>();
+
+    public DbSet<PrKeyParent> KeyParents => Set<PrKeyParent>();
+
+    protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+    protected override void OnModelCreating(ModelBuilder model)
+    {
+        model.Entity<PrShelf>().OwnsOne(shelf => shelf.Location);
+        model.Entity<PrShelf>().OwnsMany(shelf => shelf.Tags, tag => tag.HasKey(t => t.Id));
+        model.Entity<PrBin>().OwnsOne(bin => bin.Place);
+    }
+}
+
+// ------------------------------------------------------------------------------------ the rows
+
+/// <summary>DCMP's role row: a denied, forced tenant beside a nested object, a list of objects and a list of values.</summary>
+[DwEntity(RequirePolicy = true)]
+public sealed class PrRoleRow
+{
+    public int Id { get; set; }
+
+    public string Code { get; set; } = string.Empty;
+
+    [DwDenied, DwForceWhere(Operator.Equal, ContextValue = "TenantId", AllowNull = true)]
+    public int? TenantId { get; set; }
+
+    [DwNoWhere, DwNoOrder]
+    public PrName? Name { get; set; }
+
+    [DwNoWhere, DwNoOrder]
+    public List<PrGrantRow> Contents { get; set; } = new();
+
+    [DwNoWhere, DwNoOrder]
+    public List<string> Codes { get; set; } = new();
+}
+
+public sealed class PrName
+{
+    public string Ar { get; set; } = string.Empty;
+
+    public string En { get; set; } = string.Empty;
+}
+
+public sealed class PrGrantRow
+{
+    public string Code { get; set; } = string.Empty;
+
+    public string NameEn { get; set; } = string.Empty;
+}
+
+/// <summary>A row with nothing denied at the top and a denial inside its list.</summary>
+[DwEntity(RequirePolicy = true)]
+public sealed class PrOpenRow
+{
+    public int Id { get; set; }
+
+    public string Code { get; set; } = string.Empty;
+
+    [DwNoWhere, DwNoOrder]
+    public List<PrSecretGrantRow> Contents { get; set; } = new();
+}
+
+public sealed class PrSecretGrantRow
+{
+    public string Code { get; set; } = string.Empty;
+
+    [DwDenied]
+    public string? Secret { get; set; }
+}
+
+/// <summary>A row whose list elements carry a key no caller may see, which the core adds to any narrowing.</summary>
+[DwEntity(RequirePolicy = true)]
+public sealed class PrKeyedRow
+{
+    public int Id { get; set; }
+
+    [DwNoWhere, DwNoOrder]
+    public List<PrKeyedGrantRow> Contents { get; set; } = new();
+}
+
+public sealed class PrKeyedGrantRow
+{
+    [DwDenied]
+    public int Id { get; set; }
+
+    public string Code { get; set; } = string.Empty;
+}
+
+/// <summary>A row whose list is typed as a collection the core does not unwrap.</summary>
+[DwEntity(RequirePolicy = true)]
+public sealed class PrReadOnlyRow
+{
+    public int Id { get; set; }
+
+    [DwNoWhere, DwNoOrder]
+    public IReadOnlyList<PrSecretGrantRow> Contents { get; set; } = new List<PrSecretGrantRow>();
+
+    [DwNoWhere, DwNoOrder]
+    public IReadOnlyList<PrGrantRow> Clean { get; set; } = new List<PrGrantRow>();
+}
+
+/// <summary>
+/// A guarded query over rows its source builds, and over an entity whose denials sit beneath its
+/// members: what a caller who sends no projection receives, and what one who names a member does.
+/// </summary>
+/// <remarks>
+/// DCMP projects every read into its own row type before guarding it, and a row there carries a
+/// select-denied tenant. The projection the library synthesized for that denial kept scalars only, so
+/// every nested object and list came back empty. Checking it found that a denial only beneath a member
+/// synthesized nothing at all, and the whole row, denied values included, came back.
+/// </remarks>
+public sealed class ProjectedRowTests : IDisposable
+{
+    private readonly SqliteConnection _connection;
+    private readonly ProjectedRowContext _db;
+
+    public ProjectedRowTests()
+    {
+        _connection = new SqliteConnection("DataSource=:memory:");
+        _connection.Open();
+
+        _db = new ProjectedRowContext(_connection);
+        _db.Database.EnsureCreated();
+
+        PrPermission read = new() { Code = "read", Secret = "s-read" };
+        PrPermission write = new() { Code = "write", Secret = "s-write" };
+        PrRole ownRole = new() { Code = "R1", NameAr = "دور", NameEn = "Role one", TenantId = 1 };
+        PrRole otherRole = new() { Code = "R2", NameAr = "دور", NameEn = "Role two", TenantId = 2 };
+        PrRole template = new() { Code = "T0", NameAr = "قالب", NameEn = "Template", TenantId = null };
+
+        _db.AddRange(read, write, ownRole, otherRole, template);
+        _db.SaveChanges();
+
+        _db.Grants.AddRange(
+            new PrGrant { RoleId = ownRole.Id, PermissionId = read.Id },
+            new PrGrant { RoleId = ownRole.Id, PermissionId = write.Id },
+            new PrGrant { RoleId = otherRole.Id, PermissionId = read.Id },
+            new PrGrant { RoleId = template.Id, PermissionId = read.Id });
+
+        _db.Shelves.Add(new PrShelf
+        {
+            Name = "S1",
+            Location = new PrLocation { Aisle = "A7", Code = "location-secret" },
+            Tags = { new PrTag { Name = "t1", Hidden = "tag-secret" } },
+            Books = { new PrBook { Title = "B1", Isbn = "isbn-secret" } }
+        });
+
+        _db.Bins.Add(new PrBin
+        {
+            Label = "label-secret", Place = new PrPlace { Aisle = "B2", Row = 3 }, Photo = new byte[] { 1, 2, 3 }
+        });
+
+        _db.KeyParents.Add(new PrKeyParent { Kids = { new PrKeyChild { Name = "k1" } } });
+
+        _db.SaveChanges();
+        _db.ChangeTracker.Clear();
+    }
+
+    public void Dispose()
+    {
+        _db.Dispose();
+        _connection.Dispose();
+    }
+
+    private static DwPolicyContext Caller() =>
+        new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1").WithValue("TenantId", 1);
+
+    private static DwPolicyOptions Options(DwTier tier, bool dryRun = false) =>
+        new() { Tier = tier, DryRun = dryRun };
+
+    private static PolicyResolver Resolver() => new(new IDwPolicyProvider[] { new AttributePolicyProvider() });
+
+    private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier, bool dryRun = false) where T : class =>
+        source.ApplyPolicy(Caller(), Options(tier, dryRun), Resolver());
+
+    private static Filter Everything() => new();
+
+    private static Filter Selecting(params string[] fields) => new() { Selects = fields.ToList() };
+
+    private IQueryable<PrRoleRow> RoleRows() => _db.Roles.AsNoTracking().Select(role => new PrRoleRow
+    {
+        Id = role.Id,
+        Code = role.Code,
+        TenantId = role.TenantId,
+        Name = new PrName { Ar = role.NameAr, En = role.NameEn },
+        Contents = _db.Grants
+            .Where(grant => grant.RoleId == role.Id)
+            .OrderBy(grant => grant.Permission.Code)
+            .Select(grant => new PrGrantRow { Code = grant.Permission.Code, NameEn = grant.Permission.Code + "!" })
+            .ToList(),
+        Codes = _db.Grants
+            .Where(grant => grant.RoleId == role.Id)
+            .Select(grant => grant.Permission.Code)
+            .OrderBy(code => code)
+            .ToList()
+    });
+
+    private IQueryable<PrOpenRow> OpenRows() => _db.Roles.AsNoTracking().Select(role => new PrOpenRow
+    {
+        Id = role.Id,
+        Code = role.Code,
+        Contents = _db.Grants
+            .Where(grant => grant.RoleId == role.Id)
+            .OrderBy(grant => grant.Permission.Code)
+            .Select(grant => new PrSecretGrantRow { Code = grant.Permission.Code, Secret = grant.Permission.Secret })
+            .ToList()
+    });
+
+    private IQueryable<PrKeyedRow> KeyedRows() => _db.Roles.AsNoTracking().Select(role => new PrKeyedRow
+    {
+        Id = role.Id,
+        Contents = _db.Grants
+            .Where(grant => grant.RoleId == role.Id)
+            .Select(grant => new PrKeyedGrantRow { Id = grant.Permission.Id, Code = grant.Permission.Code })
+            .ToList()
+    });
+
+    private IQueryable<PrReadOnlyRow> ReadOnlyRows() => _db.Roles.AsNoTracking().Select(role => new PrReadOnlyRow
+    {
+        Id = role.Id,
+        Contents = _db.Grants
+            .Where(grant => grant.RoleId == role.Id)
+            .Select(grant => new PrSecretGrantRow { Code = grant.Permission.Code, Secret = grant.Permission.Secret })
+            .ToList(),
+        Clean = _db.Grants
+            .Where(grant => grant.RoleId == role.Id)
+            .Select(grant => new PrGrantRow { Code = grant.Permission.Code, NameEn = grant.Permission.Code })
+            .ToList()
+    });
+
+    private static string Describe(PrRoleRow row) =>
+        $"{row.Code}|{row.TenantId?.ToString() ?? "-"}|{row.Name?.En ?? "-"}|"
+        + $"{string.Join(",", row.Contents.Select(grant => grant.Code + "/" + grant.NameEn))}|{string.Join(",", row.Codes)}";
+
+    private static string Describe(PrOpenRow row) =>
+        $"{row.Code}:{string.Join(",", row.Contents.Select(grant => grant.Code + "/" + (grant.Secret ?? "-")))}";
+
+    // ------------------------------------------------------------------ DW-12: a projected row stays whole
+
+    /// <summary>
+    /// DCMP's B1b, B1f and C1. The denied tenant is stripped and every other member arrives as the
+    /// source built it: the nested name, the list of grants and the list of codes.
+    /// </summary>
+    [Theory]
+    [InlineData(DwTier.Convenience)]
+    [InlineData(DwTier.Strict)]
+    public async Task A_projected_row_keeps_its_nested_objects_and_lists_when_a_scalar_is_denied(DwTier tier)
+    {
+        string[] expected =
+        {
+            "R1|-|Role one|read/read!,write/write!|read,write",
+            "T0|-|Template|read/read!|read"
+        };
+
+        Assert.Equal(expected, Guard(RoleRows(), tier).ToList(Everything()).Data.Select(Describe).OrderBy(x => x));
+        Assert.Equal(expected, (await Guard(RoleRows(), tier).ToListAsync(Everything())).Data.Select(Describe).OrderBy(x => x));
+
+        FilterResult<dynamic> dynamicRows = await Guard(RoleRows(), tier).ToListAsyncDynamic(Everything());
+        dynamic first = dynamicRows.Data.Single(row => (string)row.Code == "R1");
+        Assert.Equal("Role one", (string)first.Name.En);
+        Assert.Equal(2, ((IEnumerable<PrGrantRow>)first.Contents).Count());
+        Assert.Equal(new[] { "read", "write" }, (IEnumerable<string>)first.Codes);
+        Assert.Null(((object)first).GetType().GetProperty("TenantId"));
+
+        SegmentResult<PrRoleRow> segment = await Guard(RoleRows(), tier).ToListAsync(new Segment());
+        Assert.Equal(expected, segment.Data!.Select(Describe).OrderBy(x => x));
+    }
+
+    /// <summary>The same row, read without the library, for comparison: nothing is lost but the tenant.</summary>
+    [Fact]
+    public void The_guarded_row_matches_what_plain_EF_Core_returns_less_the_denied_field()
+    {
+        List<string> plain = RoleRows().Where(row => row.TenantId == 1 || row.TenantId == null).ToList()
+            .Select(row => { row.TenantId = null; return Describe(row); })
+            .OrderBy(x => x)
+            .ToList();
+
+        Assert.Equal(plain, Guard(RoleRows(), DwTier.Strict).ToList(Everything()).Data.Select(Describe).OrderBy(x => x));
+    }
+
+    /// <summary>The tenant stays denied everywhere else: a condition on it is refused, and the scope still applies.</summary>
+    [Theory]
+    [InlineData(DwTier.Convenience)]
+    [InlineData(DwTier.Strict)]
+    public void The_denied_field_is_still_refused_as_a_condition(DwTier tier)
+    {
+        Filter byTenant = new()
+        {
+            ConditionGroup = new ConditionGroup
+            {
+                Conditions = { new Condition { Field = "TenantId", DataType = DataType.Number, Operator = Operator.Equal, Values = { 2 } } }
+            }
+        };
+
+        PolicyException refused = Assert.Throws<PolicyException>(() => Guard(RoleRows(), tier).ToList(byTenant));
+
+        Assert.Equal(PolicyErrorCode.FieldDeniedForWhere, refused.ErrorCode);
+    }
+
+    /// <summary>A member the caller names is carried whole when nothing beneath it is denied, as it was.</summary>
+    [Fact]
+    public void A_member_named_by_the_caller_is_carried_whole()
+    {
+        PrRoleRow row = Guard(RoleRows(), DwTier.Strict)
+            .ToList(Selecting("Code", "Name", "Contents", "Codes")).Data.Single(r => r.Code == "R1");
+
+        Assert.Equal("R1|-|Role one|read/read!,write/write!|read,write", Describe(row));
+    }
+
+    // ------------------------------------------------------------------ F1: a denial beneath a member
+
+    /// <summary>
+    /// Nothing is denied at the top of this row, so nothing used to be synthesized and the whole list,
+    /// its denied values included, came back. The list is now narrowed around the denial.
+    /// </summary>
+    [Theory]
+    [InlineData(DwTier.Convenience)]
+    [InlineData(DwTier.Strict)]
+    public async Task A_denial_beneath_a_projected_member_narrows_it(DwTier tier)
+    {
+        string[] expected = { "R1:read/-,write/-", "R2:read/-", "T0:read/-" };
+
+        PolicyQueryable<PrOpenRow> guarded = Guard(OpenRows(), tier);
+
+        Assert.Equal(expected, guarded.ToList(Everything()).Data.Select(Describe).OrderBy(x => x));
+        Assert.Contains(
+            guarded.LastTrace!.Decisions,
+            decision => decision is { FieldPath: "Contents.Secret", Feature: PolicyFeature.Select, Action: PolicyAction.Dropped });
+
+        Assert.Equal(expected, (await Guard(OpenRows(), tier).ToListAsync(Everything())).Data.Select(Describe).OrderBy(x => x));
+        Assert.Equal(expected, (await Guard(OpenRows(), tier).ToListAsync(new Segment())).Data!.Select(Describe).OrderBy(x => x));
+
+        FilterResult<dynamic> dynamicRows = Guard(OpenRows(), tier).ToListDynamic(Everything());
+        foreach (dynamic row in dynamicRows.Data)
+        {
+            foreach (object grant in (System.Collections.IEnumerable)row.Contents)
+            {
+                Assert.Null(grant.GetType().GetProperty("Secret"));
+            }
+        }
+    }
+
+    /// <summary>A dry run enforces nothing, as it never has: the rows come back whole and the decision is recorded.</summary>
+    [Fact]
+    public void A_dry_run_records_the_denial_beneath_and_returns_the_row_whole()
+    {
+        PolicyQueryable<PrOpenRow> guarded = Guard(OpenRows(), DwTier.Strict, dryRun: true);
+
+        Assert.Contains("R1:read/s-read,write/s-write", guarded.ToList(Everything()).Data.Select(Describe));
+        Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Contents.Secret");
+    }
+
+    /// <summary>
+    /// An included navigation of an entity used to come back whole whenever nothing at the top was
+    /// denied. It is now left out, as a navigation always was once a projection was needed; the owned
+    /// members, which EF Core loads with every shelf, are narrowed and kept.
+    /// </summary>
+    [Theory]
+    [InlineData(DwTier.Convenience)]
+    [InlineData(DwTier.Strict)]
+    public async Task An_entity_with_a_denial_beneath_leaves_out_its_navigations_and_narrows_what_it_owns(DwTier tier)
+    {
+        PrShelf shelf = (await Guard(_db.Shelves.Include(s => s.Books), tier).ToListAsync(Everything())).Data.Single();
+
+        Assert.Equal("S1", shelf.Name);
+        Assert.Empty(shelf.Books);
+        Assert.Equal(("A7", (string?)null), (shelf.Location!.Aisle, shelf.Location.Code));
+        Assert.Equal(("t1", (string?)null), (shelf.Tags.Single().Name, shelf.Tags.Single().Hidden));
+
+        dynamic row = Guard(_db.Shelves.Include(s => s.Books), tier).ToListDynamic(Everything()).Data.Single();
+        Assert.Null(((object)row).GetType().GetProperty("Books"));
+        Assert.Null(((object)row.Location).GetType().GetProperty("Code"));
+    }
+
+    /// <summary>
+    /// A projection that hands back the entity itself builds no rows: its navigations hold a value only
+    /// when something includes them, so they are left out as an entity query's are. Kept, they would be
+    /// loaded, and the guarded query would return more than the unguarded one.
+    /// </summary>
+    [Fact]
+    public void A_projection_returning_entities_is_read_as_an_entity_query()
+    {
+        PrShelf shelf = Guard(_db.Shelves.Select(s => s), DwTier.Strict).ToList(Everything()).Data.Single();
+
+        Assert.Empty(shelf.Books);
+        Assert.Equal(("A7", (string?)null), (shelf.Location!.Aisle, shelf.Location.Code));
+    }
+
+    /// <summary>
+    /// A top-level denial on an entity keeps what EF Core loads with it: the owned member whole and
+    /// the blob, which a projection of scalars alone used to empty.
+    /// </summary>
+    [Fact]
+    public void An_entity_keeps_its_owned_member_and_its_blob_beside_a_denied_scalar()
+    {
+        PrBin bin = Guard(_db.Bins, DwTier.Strict).ToList(Everything()).Data.Single();
+
+        Assert.Null(bin.Label);
+        Assert.Equal(("B2", 3), (bin.Place!.Aisle, bin.Place.Row));
+        Assert.Equal(new byte[] { 1, 2, 3 }, bin.Photo);
+    }
+
+    /// <summary>
+    /// Rows in memory keep their values and leave every object member out once a projection is needed,
+    /// as 3.1.0 did. A member kept from them would be the caller's own object, which a transform would
+    /// then change in place, and a denial only beneath a member now needs that projection too.
+    /// </summary>
+    [Fact]
+    public void Rows_in_memory_keep_their_values_and_leave_their_objects_out()
+    {
+        PrRoleRow[] roles =
+        {
+            new() { Id = 1, Code = "R1", TenantId = 1, Name = new PrName { En = "One" }, Contents = { new PrGrantRow { Code = "read" } }, Codes = { "read" } }
+        };
+        PrOpenRow[] open = { new() { Id = 1, Code = "R1", Contents = { new PrSecretGrantRow { Code = "read", Secret = "s-read" } } } };
+
+        PrRoleRow role = roles.AsQueryable().ApplyPolicy(Caller(), Options(DwTier.Strict), Resolver()).ToList(Everything()).Data.Single();
+        PolicyQueryable<PrOpenRow> guarded = open.AsQueryable().ApplyPolicy(Caller(), Options(DwTier.Strict), Resolver());
+        PrOpenRow row = guarded.ToList(Everything()).Data.Single();
+
+        Assert.Equal("R1|-|-||read", Describe(role));
+        Assert.Equal(("R1", 0), (row.Code, row.Contents.Count));
+        Assert.Equal("s-read", open[0].Contents[0].Secret);
+        Assert.Contains(
+            guarded.LastTrace!.Decisions,
+            decision => decision is { FieldPath: "Contents.Secret", Action: PolicyAction.Dropped });
+    }
+
+    // ------------------------------------------------------------------ F2: the key the builder adds
+
+    /// <summary>A synthesized projection cannot narrow a list whose key is denied, so it leaves the list out.</summary>
+    [Theory]
+    [InlineData(DwTier.Convenience)]
+    [InlineData(DwTier.Strict)]
+    public void A_member_whose_key_is_denied_is_left_out_whole(DwTier tier)
+    {
+        PolicyQueryable<PrKeyedRow> guarded = Guard(KeyedRows(), tier);
+
+        Assert.All(guarded.ToList(Everything()).Data, row => Assert.Empty(row.Contents));
+        Assert.Contains(
+            guarded.LastTrace!.Decisions,
+            decision => decision.FieldPath == "Contents" && decision.Reason == "left out whole: the projection would add its key 'Contents.Id', which is denied");
+    }
+
+    /// <summary>
+    /// Naming a navigation whose key is denied used to drop the key from the list in the convenience
+    /// tier, and the builder added it straight back. It is refused in both tiers, as naming a sibling
+    /// of the key already was.
+    /// </summary>
+    [Theory]
+    [InlineData(DwTier.Convenience)]
+    [InlineData(DwTier.Strict)]
+    public void Naming_a_navigation_whose_key_is_denied_is_refused(DwTier tier)
+    {
+        PolicyException projected = Assert.Throws<PolicyException>(
+            () => Guard(KeyedRows(), tier).ToList(Selecting("Id", "Contents")));
+        PolicyException entity = Assert.Throws<PolicyException>(
+            () => Guard(_db.KeyParents, tier).ToList(Selecting("Id", "Kids")));
+
+        Assert.Equal(PolicyErrorCode.FieldDeniedForSelect, projected.ErrorCode);
+        Assert.Equal(PolicyErrorCode.FieldDeniedForSelect, entity.ErrorCode);
+        Assert.Equal(tier == DwTier.Strict ? "*" : "Contents.Id", projected.FieldPath);
+        Assert.Equal(tier == DwTier.Strict ? "*" : "Kids.Id", entity.FieldPath);
+    }
+
+    // ------------------------------------------------------------------ F3: a list typed IReadOnlyList<T>
+
+    /// <summary>
+    /// The projection gate read collections through a narrower list than the policy, so a list typed
+    /// <c>IReadOnlyList&lt;T&gt;</c> hid its denied field: naming it carried the value out in both tiers.
+    /// </summary>
+    [Theory]
+    [InlineData(DwTier.Convenience)]
+    [InlineData(DwTier.Strict)]
+    public void Naming_a_read_only_list_with_a_denial_beneath_is_refused(DwTier tier)
+    {
+        PolicyException typed = Assert.Throws<PolicyException>(
+            () => Guard(ReadOnlyRows(), tier).ToList(Selecting("Id", "Contents")));
+        PolicyException dynamicRows = Assert.Throws<PolicyException>(
+            () => Guard(ReadOnlyRows(), tier).ToListDynamic(Selecting("Id", "Contents")));
+
+        Assert.Equal(PolicyErrorCode.FieldDeniedForSelect, typed.ErrorCode);
+        Assert.Equal(PolicyErrorCode.FieldDeniedForSelect, dynamicRows.ErrorCode);
+        Assert.Equal(tier == DwTier.Strict ? "*" : "Contents.Secret", typed.FieldPath);
+    }
+
+    /// <summary>
+    /// With no projection sent, the read-only list with a denial beneath is left out, since the core
+    /// cannot project a path through it; the clean one beside it is carried whole.
+    /// </summary>
+    [Fact]
+    public void A_read_only_list_is_kept_whole_when_clean_and_left_out_when_it_cannot_be_narrowed()
+    {
+        PolicyQueryable<PrReadOnlyRow> guarded = Guard(ReadOnlyRows(), DwTier.Strict);
+        PrReadOnlyRow row = guarded.ToList(Everything()).Data.Single(r => r.Id == 1);
+
+        Assert.Empty(row.Contents);
+        Assert.Equal(new[] { "read", "write" }, row.Clean.Select(grant => grant.Code).OrderBy(x => x));
+        Assert.Contains(
+            guarded.LastTrace!.Decisions,
+            decision => decision.FieldPath == "Contents" && decision.Reason == "left out whole: the core cannot project 'Contents.Code'");
+        Assert.Equal(
+            new[] { "read", "write" },
+            Guard(ReadOnlyRows(), DwTier.Strict).ToList(Selecting("Id", "Clean")).Data
+                .Single(r => r.Id == 1).Clean.Select(grant => grant.Code).OrderBy(x => x));
+    }
+
+    // ------------------------------------------------------------------ the gate, without a database
+
+    /// <summary>A type with nothing denied anywhere keeps its null projection, on every source.</summary>
+    [Fact]
+    public void Nothing_is_synthesized_when_nothing_is_denied_at_any_depth()
+    {
+        foreach (RowShape rows in new[] { RowShape.Unknown, RowShape.InMemory })
+        {
+            Filter sanitized = FilterSanitizer.Sanitize<PrShelfWithoutDenials>(
+                new Filter(), Resolver(), Caller(), Options(DwTier.Strict), new PolicyTrace(DwTier.Strict, dryRun: false), rows: rows);
+
+            Assert.Null(sanitized.Selects);
+        }
+    }
+
+    /// <summary>What each source keeps of the same type, with one denial beneath a list.</summary>
+    [Fact]
+    public void Each_source_keeps_what_it_carries()
+    {
+        List<string>? Synthesized(RowShape rows) => FilterSanitizer.Sanitize<PrOpenRow>(
+            new Filter(), Resolver(), Caller(), Options(DwTier.Strict), new PolicyTrace(DwTier.Strict, dryRun: false), rows: rows).Selects;
+
+        Assert.Equal(new[] { "Code", "Id" }, Synthesized(RowShape.Unknown)!.OrderBy(x => x, StringComparer.Ordinal));
+        Assert.Equal(new[] { "Code", "Contents.Code", "Id" }, Synthesized(RowShape.Of(OpenRows()))!.OrderBy(x => x, StringComparer.Ordinal));
+        Assert.Equal(new[] { "Code", "Id" }, Synthesized(RowShape.InMemory)!.OrderBy(x => x, StringComparer.Ordinal));
+    }
+}
+
+/// <summary>The shelf's shape with no attribute anywhere.</summary>
+public class PrShelfWithoutDenials
+{
+    public int Id { get; set; }
+
+    public string Name { get; set; } = string.Empty;
+
+    public PrPlace? Place { get; set; }
+
+    public List<PrGrantRow> Contents { get; set; } = new();
+}
diff --git a/DynamicWhere.Tests/Policies/ProjectionReachTests.cs b/DynamicWhere.Tests/Policies/ProjectionReachTests.cs
new file mode 100644
index 0000000..c50748e
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ProjectionReachTests.cs
@@ -0,0 +1,1249 @@
+using System.Collections;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // --------------------------------------------------------------------------------- the database
+
+    public class RcCustomer
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<RcCard> Cards { get; set; } = new();
+
+        public List<RcOrder> Orders { get; set; } = new();
+    }
+
+    public class RcCard
+    {
+        public int Id { get; set; }
+
+        public int RcCustomerId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class RcOrder
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public int RcCustomerId { get; set; }
+
+        public RcCustomer? Customer { get; set; }
+
+        public List<RcLine> Lines { get; set; } = new();
+    }
+
+    public class RcLine
+    {
+        public int Id { get; set; }
+
+        public int RcOrderId { get; set; }
+
+        public string Sku { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Cost { get; set; }
+    }
+
+    public class RcPerson
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? TaxId { get; set; }
+    }
+
+    public class RcAccount
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public int RcPersonId { get; set; }
+
+        public RcPerson? Person { get; set; }
+    }
+
+    /// <summary>The root of a hierarchy whose derived type declares a denied field.</summary>
+    public class RcParty
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class RcCompany : RcParty
+    {
+        [DwDenied]
+        public string? TaxSecret { get; set; }
+    }
+
+    public class RcDeal
+    {
+        public int Id { get; set; }
+
+        public string Note { get; set; } = string.Empty;
+
+        public int RcPartyId { get; set; }
+
+        public RcParty? Party { get; set; }
+    }
+
+    /// <summary>An abstract root, which no projection can build.</summary>
+    public abstract class RcAsset
+    {
+        public int Id { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+    }
+
+    public class RcVault : RcAsset
+    {
+        [DwDenied]
+        public string? Combination { get; set; }
+    }
+
+    /// <summary>A value EF Core converts to text, holding a type with a denied field.</summary>
+    public class RcCharge
+    {
+        public string Sku { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Amount { get; set; }
+    }
+
+    public class RcClient
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public Dictionary<string, RcCharge> Charges { get; set; } = new();
+    }
+
+    public class RcPurchase
+    {
+        public int Id { get; set; }
+
+        public int RcClientId { get; set; }
+
+        public RcClient? Client { get; set; }
+    }
+
+    /// <summary>A navigation whose entity owns a chain deeper than the walker goes.</summary>
+    public class RcHolding
+    {
+        public int Id { get; set; }
+
+        public int RcKeeperId { get; set; }
+
+        public RcKeeper? Keeper { get; set; }
+    }
+
+    public class RcKeeper
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public RcProfile Profile { get; set; } = new();
+    }
+
+    public class RcProfile
+    {
+        public string A { get; set; } = string.Empty;
+
+        public RcDetail Detail { get; set; } = new();
+    }
+
+    public class RcDetail
+    {
+        public string B { get; set; } = string.Empty;
+
+        public RcInner Inner { get; set; } = new();
+    }
+
+    public class RcInner
+    {
+        public string C { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    /// <summary>An automatically included navigation with a denied field.</summary>
+    public class RcBadgeHolder
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public int RcBadgeId { get; set; }
+
+        public RcBadge? Badge { get; set; }
+    }
+
+    public class RcBadge
+    {
+        public int Id { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pin { get; set; }
+    }
+
+    /// <summary>A member EF Core does not map that can hold an object of any type.</summary>
+    public class RcBag
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public int RcBagOwnerId { get; set; }
+
+        public RcBagOwner? Owner { get; set; }
+
+        [NotMapped]
+        public object? Extra { get; set; }
+    }
+
+    public class RcBagOwner
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    /// <summary>An owned member with a mapped property that has no setter.</summary>
+    public class RcShop
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public string? Notes { get; set; }
+
+        public RcAddress Address { get; set; } = new();
+    }
+
+    public class RcAddress
+    {
+        public RcAddress()
+        {
+        }
+
+        public RcAddress(string city, string? zip)
+        {
+            City = city;
+            Zip = zip;
+        }
+
+        public string City { get; set; } = string.Empty;
+
+        public string? Zip { get; }
+    }
+
+    /// <summary>An owned member every path of which the walk asks about, and an included navigation.</summary>
+    public class RcStore
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public RcPlace Place { get; set; } = new();
+
+        public int RcStoreKeeperId { get; set; }
+
+        public RcStoreKeeper? Keeper { get; set; }
+    }
+
+    public class RcPlace
+    {
+        public string City { get; set; } = string.Empty;
+
+        public string Zone { get; set; } = string.Empty;
+    }
+
+    public class RcStoreKeeper
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    /// <summary>An owned chain whose last owned type exposes a mapped field through a getter the model does not map.</summary>
+    public class RcRoom
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public RcShelf Shelf { get; set; } = new();
+    }
+
+    public class RcShelf
+    {
+        public string Label { get; set; } = string.Empty;
+
+        public RcBox Box { get; set; } = new();
+    }
+
+    public class RcBox
+    {
+        public string Label { get; set; } = string.Empty;
+
+        public RcLid Lid { get; set; } = new();
+    }
+
+    public class RcLid
+    {
+        private string? _code;
+
+        public string Colour { get; set; } = string.Empty;
+
+        [NotMapped]
+        public RcCodeView Code => new() { Value = _code };
+
+        public void Seal(string code) => _code = code;
+    }
+
+    public class RcCodeView
+    {
+        [DwDenied]
+        public string? Value { get; set; }
+    }
+
+    public sealed class ProjectionReachContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ProjectionReachContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<RcCustomer> Customers => Set<RcCustomer>();
+
+        public DbSet<RcOrder> Orders => Set<RcOrder>();
+
+        public DbSet<RcPerson> People => Set<RcPerson>();
+
+        public DbSet<RcAccount> Accounts => Set<RcAccount>();
+
+        public DbSet<RcParty> Parties => Set<RcParty>();
+
+        public DbSet<RcDeal> Deals => Set<RcDeal>();
+
+        public DbSet<RcAsset> Assets => Set<RcAsset>();
+
+        public DbSet<RcPurchase> Purchases => Set<RcPurchase>();
+
+        public DbSet<RcHolding> Holdings => Set<RcHolding>();
+
+        public DbSet<RcBadgeHolder> BadgeHolders => Set<RcBadgeHolder>();
+
+        public DbSet<RcBag> Bags => Set<RcBag>();
+
+        public DbSet<RcShop> Shops => Set<RcShop>();
+
+        public DbSet<RcStore> Stores => Set<RcStore>();
+
+        public DbSet<RcRoom> Rooms => Set<RcRoom>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<RcCompany>();
+            model.Entity<RcVault>();
+            model.Entity<RcClient>().Property(c => c.Charges).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, RcCharge>>(text, (JsonSerializerOptions?)null)!);
+            model.Entity<RcKeeper>().OwnsOne(
+                k => k.Profile, p => p.OwnsOne(x => x.Detail, d => d.OwnsOne(y => y.Inner)));
+            model.Entity<RcBadgeHolder>().Navigation(h => h.Badge).AutoInclude();
+            model.Entity<RcShop>().OwnsOne(s => s.Address, a => a.Property(x => x.Zip));
+            model.Entity<RcStore>().OwnsOne(s => s.Place);
+            model.Entity<RcRoom>().OwnsOne(
+                r => r.Shelf, s => s.OwnsOne(x => x.Box, b => b.OwnsOne(y => y.Lid, l => l.Property<string?>("_code"))));
+        }
+    }
+
+    // --------------------------------------------------------------------------------- lazy loaders
+
+    /// <summary>A lazy loader delegate the constructor takes and keeps in a field.</summary>
+    public class RcFieldBlog
+    {
+        private readonly Action<object, string>? _loader;
+        private List<RcFieldPost>? _posts;
+
+        public RcFieldBlog()
+        {
+        }
+
+        private RcFieldBlog(Action<object, string> lazyLoader) => _loader = lazyLoader;
+
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<RcFieldPost> Posts
+        {
+            get
+            {
+                _loader?.Invoke(this, nameof(Posts));
+
+                return _posts ??= new List<RcFieldPost>();
+            }
+            set => _posts = value;
+        }
+    }
+
+    public class RcFieldPost
+    {
+        public int Id { get; set; }
+
+        public int RcFieldBlogId { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Draft { get; set; }
+    }
+
+    /// <summary>A lazy loader delegate kept in a property not named LazyLoader.</summary>
+    public class RcNamedBlog
+    {
+        private List<RcNamedPost>? _posts;
+
+        public RcNamedBlog()
+        {
+        }
+
+        private RcNamedBlog(Action<object, string> lazyLoader) => Loader = lazyLoader;
+
+        private Action<object, string>? Loader { get; set; }
+
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<RcNamedPost> Posts
+        {
+            get
+            {
+                Loader?.Invoke(this, nameof(Posts));
+
+                return _posts ??= new List<RcNamedPost>();
+            }
+            set => _posts = value;
+        }
+    }
+
+    public class RcNamedPost
+    {
+        public int Id { get; set; }
+
+        public int RcNamedBlogId { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Draft { get; set; }
+    }
+
+    public sealed class ProjectionReachLazyContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ProjectionReachLazyContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<RcFieldBlog> FieldBlogs => Set<RcFieldBlog>();
+
+        public DbSet<RcNamedBlog> NamedBlogs => Set<RcNamedBlog>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<RcFieldBlog>().Navigation(b => b.Posts).HasField("_posts");
+            model.Entity<RcNamedBlog>().Navigation(b => b.Posts).HasField("_posts");
+        }
+    }
+
+    // --------------------------------------------------------------------------------- rows
+
+    /// <summary>A row whose member a constructor sets, before its initializer runs.</summary>
+    public class RcHolder
+    {
+        public RcHolder()
+        {
+        }
+
+        public RcHolder(RcPerson person) => Person = person;
+
+        public int Id { get; set; }
+
+        public RcPerson? Person { get; set; }
+    }
+
+    public class RcDealRow
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Note { get; set; }
+
+        public RcParty? Party { get; set; }
+    }
+
+    public sealed class RcDeepRow
+    {
+        public int Id { get; set; }
+
+        public string? Tenant { get; set; }
+
+        public RcL1? First { get; set; }
+    }
+
+    public sealed class RcL1
+    {
+        public RcL2? Next { get; set; }
+    }
+
+    public sealed class RcL2
+    {
+        public RcL3? Next { get; set; }
+    }
+
+    public sealed class RcL3
+    {
+        public string Name { get; set; } = string.Empty;
+
+        public RcL4? Next { get; set; }
+    }
+
+    public sealed class RcL4
+    {
+        public string? Secret { get; set; }
+    }
+
+    /// <summary>A row holding policed objects through a collection that is not generic.</summary>
+    public sealed class RcBagRow
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Note { get; set; }
+
+        public IEnumerable? Items { get; set; }
+    }
+
+    public sealed class RcNode
+    {
+        public string Name { get; set; } = string.Empty;
+
+        public RcNode? Next { get; set; }
+    }
+
+    public sealed class RcLink
+    {
+        public int Id { get; set; }
+
+        public RcNode? Head { get; set; }
+    }
+
+    /// <summary>A base type whose subtype's field a rule denies, no attribute anywhere.</summary>
+    public class RcPet
+    {
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class RcHamster : RcPet
+    {
+        public string? Tag { get; set; }
+    }
+
+    public class RcCage
+    {
+        public int Id { get; set; }
+
+        public RcPet? Pet { get; set; }
+    }
+
+    /// <summary>A row in memory holding an object of any type, with nothing denied anywhere.</summary>
+    public class RcNote
+    {
+        public int Id { get; set; }
+
+        public object? Payload { get; set; }
+    }
+
+    /// <summary>Rows in memory whose subtype declares a denied field.</summary>
+    public class RcAnimal
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class RcDog : RcAnimal
+    {
+        [DwDenied]
+        public string? Chip { get; set; }
+    }
+
+    // --------------------------------------------------------------------------------- the tests
+
+    /// <summary>
+    /// What a denied value can reach, read from what the source actually loads, and what a member can
+    /// hold that no path names: a derived type's field, a path a policy denying by default never names,
+    /// a collection that is not generic. Each test asserts the safe outcome, so a failing one is a leak.
+    /// </summary>
+    public sealed class ProjectionReachTests : IDisposable
+    {
+        private static readonly JsonSerializerOptions Json = new() { ReferenceHandler = ReferenceHandler.IgnoreCycles };
+
+        private readonly SqliteConnection _connection;
+        private readonly ProjectionReachContext _db;
+
+        public ProjectionReachTests()
+        {
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+
+            _db = new ProjectionReachContext(_connection);
+            _db.Database.EnsureCreated();
+
+            _db.Customers.Add(new RcCustomer
+            {
+                Name = "C1",
+                Cards = { new RcCard { Label = "visa", Pan = "pan-secret" } },
+                Orders = { new RcOrder { Code = "O1", Lines = { new RcLine { Sku = "S1", Cost = "cost-secret" } } } }
+            });
+            _db.Accounts.Add(new RcAccount { Name = "A1", Person = new RcPerson { Name = "P1", TaxId = "tax-secret" } });
+            _db.Deals.Add(new RcDeal { Note = "note", Party = new RcCompany { Name = "Acme", TaxSecret = "company-secret" } });
+            _db.Assets.Add(new RcVault { Label = "V1", Combination = "combination-secret" });
+            _db.Purchases.Add(new RcPurchase
+            {
+                Client = new RcClient { Name = "K1", Charges = { ["a"] = new RcCharge { Sku = "S1", Amount = "amount-secret" } } }
+            });
+            _db.Holdings.Add(new RcHolding
+            {
+                Keeper = new RcKeeper
+                {
+                    Name = "O1",
+                    Profile = new RcProfile { A = "a", Detail = new RcDetail { B = "b", Inner = new RcInner { C = "c", Secret = "deep-secret" } } }
+                }
+            });
+            _db.BadgeHolders.Add(new RcBadgeHolder { Name = "H1", Badge = new RcBadge { Label = "gold", Pin = "pin-secret" } });
+            _db.Bags.Add(new RcBag { Name = "B1", Owner = new RcBagOwner { Name = "W1" } });
+            _db.Shops.Add(new RcShop { Name = "S1", Notes = "notes", Address = new RcAddress("Basra", "zip-secret") });
+            _db.Stores.Add(new RcStore { Name = "T1", Place = new RcPlace { City = "Basra", Zone = "Z1" }, Keeper = new RcStoreKeeper { Name = "K" } });
+
+            RcRoom room = new() { Name = "R1", Shelf = new RcShelf { Label = "s", Box = new RcBox { Label = "b", Lid = new RcLid { Colour = "red" } } } };
+            room.Shelf.Box.Lid.Seal("lid-secret");
+            _db.Rooms.Add(room);
+
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static DwPolicyContext Caller() =>
+            new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1").WithValue("TenantId", 1);
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict, params IDwPolicyProvider[] more)
+            where T : class =>
+            source.ApplyPolicy(
+                Caller(),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }.Concat(more).ToArray()));
+
+        private static Filter Selecting(params string[] fields) => new() { Selects = fields.ToList() };
+
+        /// <summary>A policy that denies Select on every field except those it names.</summary>
+        private static FakePolicyProvider DenyingAllBut(params string[] allowed)
+        {
+            FakePolicyProvider rules = new FakePolicyProvider()
+                .Add("*", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            foreach (string path in allowed)
+            {
+                rules.Add(path, PolicyFeature.Select, PolicyEffect.Allow, PolicyLevel.DynamicGlobal);
+            }
+
+            return rules;
+        }
+
+        /// <summary>Everything a row holds, as a serializer would send it.</summary>
+        private static string Sent(object? rows) => JsonSerializer.Serialize(rows, Json);
+
+        /// <summary>
+        /// True when anything reachable from a value holds the text, read by each object's runtime type: a
+        /// serializer that writes the declared type would miss a derived type's field.
+        /// </summary>
+        private static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is ValueType)
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held == text)
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (!seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IEnumerable items)
+                {
+                    foreach (object? item in items)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                foreach (System.Reflection.PropertyInfo property in current.GetType().GetProperties())
+                {
+                    if (property.GetIndexParameters().Length == 0 && property.CanRead)
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                }
+            }
+
+            return false;
+        }
+
+        private static void Refused(Action query)
+        {
+            PolicyException refusal = Assert.Throws<PolicyException>(query);
+
+            Assert.Equal(PolicyErrorCode.FieldDeniedForSelect, refusal.ErrorCode);
+        }
+
+        // ---------------------------------------------------------------- includes read from another root
+
+        /// <summary>
+        /// A later operator that reaches the rows through a navigation keeps what the includes loaded, named
+        /// from the query's root: <c>Select(o =&gt; o.Customer)</c> after an include of the customer's cards.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public async Task An_include_named_from_another_root_counts_as_loading_every_navigation(DwTier tier)
+        {
+            IQueryable<RcCustomer> source = _db.Orders
+                .Include(o => o.Customer).ThenInclude(c => c!.Cards)
+                .Select(o => o.Customer!);
+
+            Assert.Contains("pan-secret", Sent(source.AsNoTracking().ToList()));
+
+            Assert.DoesNotContain("pan-secret", Sent(Guard(source, tier).ToList(new Filter()).Data));
+            Assert.DoesNotContain("pan-secret", Sent(Guard(source, tier).ToListDynamic(new Filter()).Data));
+            Assert.DoesNotContain("pan-secret", Sent((await Guard(source, tier).ToListAsync(new Filter(), CancellationToken.None)).Data));
+            Assert.DoesNotContain("pan-secret", Sent((await Guard(source, tier).ToListAsync(new Segment(), CancellationToken.None)).Data));
+
+            IQueryable<RcCustomer> named = _db.Orders.Include("Customer.Cards").Select(o => o.Customer!);
+
+            Assert.DoesNotContain("pan-secret", Sent(Guard(named, tier).ToList(new Filter()).Data));
+        }
+
+        [Fact]
+        public void An_include_named_from_another_root_is_read_through_SelectMany_and_Join()
+        {
+            IQueryable<RcOrder> flattened = _db.Customers
+                .Include(c => c.Orders).ThenInclude(o => o.Lines)
+                .SelectMany(c => c.Orders);
+            IQueryable<RcOrder> selected = _db.Customers
+                .Include(c => c.Orders).ThenInclude(o => o.Lines)
+                .SelectMany(c => c.Orders, (c, o) => o);
+            IQueryable<RcCustomer> joined = _db.Orders
+                .Include(o => o.Customer).ThenInclude(c => c!.Cards)
+                .Join(_db.Accounts, o => o.Id, a => a.Id, (o, a) => o.Customer!);
+
+            Assert.Contains("cost-secret", Sent(flattened.AsNoTracking().ToList()));
+
+            Assert.DoesNotContain("cost-secret", Sent(Guard(flattened).ToList(new Filter()).Data));
+            Assert.DoesNotContain("cost-secret", Sent(Guard(selected).ToList(new Filter()).Data));
+            Assert.DoesNotContain("pan-secret", Sent(Guard(joined).ToList(new Filter()).Data));
+        }
+
+        // ---------------------------------------------------------------- projections the outer Select hides
+
+        /// <summary>
+        /// A projection behind a <c>Select</c> that builds nothing, a member of an anonymous row or a
+        /// conditional still loads what it assigns, although the rows are the entity's type.
+        /// </summary>
+        [Fact]
+        public void A_projection_behind_another_Select_is_not_read_as_an_entity_query()
+        {
+            IQueryable<RcAccount> identity = _db.Accounts
+                .Select(a => new RcAccount { Id = a.Id, Name = a.Name, Person = a.Person })
+                .Select(x => x);
+            IQueryable<RcAccount> member = _db.Accounts
+                .Select(a => new { Row = new RcAccount { Id = a.Id, Name = a.Name, Person = a.Person } })
+                .Select(x => x.Row);
+            IQueryable<RcAccount> conditional = _db.Accounts
+                .Select(a => a.Id > 0
+                    ? new RcAccount { Id = a.Id, Name = a.Name, Person = a.Person }
+                    : new RcAccount { Id = a.Id, Name = a.Name });
+
+            Assert.Contains("tax-secret", Sent(identity.ToList()));
+
+            Assert.DoesNotContain("tax-secret", Sent(Guard(identity).ToList(new Filter()).Data));
+            Assert.DoesNotContain("tax-secret", Sent(Guard(member).ToList(new Filter()).Data));
+            Assert.DoesNotContain("tax-secret", Sent(Guard(conditional).ToList(new Filter()).Data));
+        }
+
+        /// <summary>
+        /// A projection beneath a <c>Join</c> does not make the join's rows: they are the result selector's,
+        /// which here puts the person back. The rows are read as the entity they are, every navigation loaded.
+        /// </summary>
+        [Fact]
+        public void A_projection_beneath_a_Join_is_not_the_one_that_makes_the_rows()
+        {
+            IQueryable<RcAccount> rows = _db.Accounts
+                .Select(a => new RcAccount { Id = a.Id, RcPersonId = a.RcPersonId })
+                .Join(_db.People, a => a.RcPersonId, p => p.Id, (a, p) => new RcAccount { Id = a.Id, Person = p });
+
+            RowShape shape = RowShape.Of(rows);
+
+            Assert.Equal(RowKind.Entity, shape.Kind);
+            Assert.True(shape.Materializes("Person.TaxId"));
+            Assert.Contains("tax-secret", Sent(rows.ToList()));
+
+            // EF Core may refuse to read a member the result selector did not assign; it never returns the value.
+            Exception? refused = Record.Exception(() => Assert.DoesNotContain("tax-secret", Sent(Guard(rows).ToList(new Filter()).Data)));
+
+            Assert.True(refused is null or InvalidOperationException, refused?.ToString());
+        }
+
+        /// <summary>A constructor with arguments sets members its initializer never names.</summary>
+        [Fact]
+        public void An_initializer_after_a_constructor_with_arguments_counts_every_member_as_assigned()
+        {
+            IQueryable<RcHolder> rows = _db.People.Select(p => new RcHolder(p) { Id = p.Id });
+
+            Assert.Contains("tax-secret", Sent(rows.ToList()));
+            Assert.DoesNotContain("tax-secret", Sent(Guard(rows).ToList(new Filter()).Data));
+        }
+
+        // ---------------------------------------------------------------- lazy loaders the model keeps no record of
+
+        /// <summary>
+        /// A lazy loader delegate the constructor takes gets no service property, whether the class keeps it
+        /// in a field or in a property of another name; it still fills the navigation after the query.
+        /// </summary>
+        [Fact]
+        public void A_lazy_loader_kept_where_the_model_has_no_record_of_it_counts_as_loading()
+        {
+            using SqliteConnection connection = new("DataSource=:memory:");
+            connection.Open();
+
+            using ProjectionReachLazyContext db = new(connection);
+            db.Database.EnsureCreated();
+            db.FieldBlogs.Add(new RcFieldBlog { Name = "B1", Posts = { new RcFieldPost { Title = "T", Draft = "field-draft" } } });
+            db.NamedBlogs.Add(new RcNamedBlog { Name = "B2", Posts = { new RcNamedPost { Title = "T", Draft = "named-draft" } } });
+            db.SaveChanges();
+            db.ChangeTracker.Clear();
+
+            RcFieldBlog field = Guard(db.FieldBlogs).ToList(new Filter()).Data.Single();
+            RcNamedBlog named = Guard(db.NamedBlogs).ToList(new Filter()).Data.Single();
+
+            Assert.DoesNotContain(field.Posts, post => post.Draft == "field-draft");
+            Assert.DoesNotContain(named.Posts, post => post.Draft == "named-draft");
+        }
+
+        // ---------------------------------------------------------------- a rule in another letter case
+
+        /// <summary>
+        /// A rule spelled in another letter case, on a path deeper than the walk, reaches a projected row's
+        /// assigned member: whether or not anything else is denied, it asks for the projection.
+        /// </summary>
+        [Theory]
+        [InlineData(false)]
+        [InlineData(true)]
+        public void A_rule_in_another_letter_case_reaches_an_assigned_member(bool somethingElseDenied)
+        {
+            IQueryable<RcDeepRow> rows = _db.Customers.Select(c => new RcDeepRow
+            {
+                Id = c.Id,
+                Tenant = c.Name,
+                First = new RcL1 { Next = new RcL2 { Next = new RcL3 { Name = c.Name, Next = new RcL4 { Secret = "camel-secret" } } } }
+            });
+
+            FakePolicyProvider rules = new FakePolicyProvider()
+                .Add("first.next.next.next.secret", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            if (somethingElseDenied)
+            {
+                rules.Add("tenant", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+            }
+
+            RcDeepRow row = Guard(rows, DwTier.Strict, rules).ToList(new Filter()).Data.Single();
+
+            Assert.Null(row.First?.Next?.Next?.Next?.Secret);
+            Assert.Equal("C1", row.First?.Next?.Next?.Name);
+        }
+
+        // ---------------------------------------------------------------- what a member can hold
+
+        /// <summary>A collection that is not generic holds objects, whatever they carry, so it is never clean.</summary>
+        [Fact]
+        public void A_collection_that_is_not_generic_is_never_kept_whole()
+        {
+            IQueryable<RcBagRow> rows = _db.Customers.Select(c => new RcBagRow { Id = c.Id, Note = c.Name, Items = c.Cards.ToList() });
+
+            PolicyQueryable<RcBagRow> guarded = Guard(rows);
+            RcBagRow row = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Null(row.Items);
+            Assert.Contains(guarded.LastTrace!.Decisions, d => d.FieldPath == "Items" && d.Action == PolicyAction.Dropped);
+        }
+
+        /// <summary>
+        /// A member declared as a base type holds a derived entity, whose own denied field the base type
+        /// never names: a projected row narrows it to the base type rather than keeping it whole.
+        /// </summary>
+        [Fact]
+        public void A_member_declared_as_a_base_type_is_narrowed_to_it()
+        {
+            IQueryable<RcDealRow> rows = _db.Deals.Select(d => new RcDealRow { Id = d.Id, Note = d.Note, Party = d.Party });
+
+            Assert.True(Holds(rows.ToList(), "company-secret"));
+
+            RcDealRow row = Guard(rows).ToList(new Filter()).Data.Single();
+
+            Assert.False(Holds(row, "company-secret"));
+            Assert.IsNotType<RcCompany>(row.Party);
+            Assert.Equal("Acme", row.Party!.Name);
+        }
+
+        /// <summary>
+        /// A query over the root of a hierarchy returns each row as its derived type. A derived type's denied
+        /// field asks for the projection, which builds the root type.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void A_denied_field_of_a_derived_type_projects_the_root(DwTier tier)
+        {
+            PolicyQueryable<RcParty> guarded = Guard(_db.Parties, tier);
+            RcParty party = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.IsNotType<RcCompany>(party);
+            Assert.Equal("Acme", party.Name);
+            Assert.Contains(guarded.LastTrace!.Decisions, d => d.FieldPath == "TaxSecret" && d.Action == PolicyAction.Dropped);
+        }
+
+        /// <summary>
+        /// An abstract root cannot be built, so the typed terminal refuses the projection a derived type's denial
+        /// asks for, as it refuses any type with no public parameterless constructor. The dynamic terminal builds
+        /// its own class and returns the root's allowed members.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void An_abstract_root_that_needs_a_projection_is_never_returned_whole(DwTier tier)
+        {
+            LogicException refusal = Assert.Throws<LogicException>(() => Guard(_db.Assets, tier).ToList(new Filter()));
+
+            Assert.Equal(ErrorCode.SelectTypeMustHaveParameterlessConstructor, refusal.Message);
+
+            List<dynamic> rows = Guard(_db.Assets, tier).ToListDynamic(new Filter()).Data!;
+
+            Assert.Equal("V1", (string)Assert.Single(rows).Label);
+            Assert.False(Holds(rows, "combination-secret"));
+
+            // Its concrete type can be queried, and is projected like any other.
+            Assert.Null(Guard(_db.Assets.OfType<RcVault>(), tier).ToList(new Filter()).Data.Single().Combination);
+        }
+
+        /// <summary>Rows in memory can be any loaded subtype, and are projected to the rows' type.</summary>
+        [Fact]
+        public void Rows_in_memory_of_a_subtype_with_a_denied_field_are_projected()
+        {
+            RcAnimal[] rows = { new RcDog { Id = 1, Name = "Rex", Chip = "chip-secret" } };
+
+            RcAnimal row = Guard(rows.AsQueryable()).ToList(new Filter()).Data.Single();
+
+            Assert.IsNotType<RcDog>(row);
+            Assert.Equal("Rex", row.Name);
+        }
+
+        /// <summary>
+        /// A navigation named in Selects, or included, declared as the root of a hierarchy, holds the
+        /// derived type's denied field. Strict refuses naming it; Convenience narrows it to the root type.
+        /// An included one is left out of the projection it asks for.
+        /// </summary>
+        [Fact]
+        public void A_navigation_declared_as_a_base_type_carries_the_derived_type()
+        {
+            Refused(() => Guard(_db.Deals, DwTier.Strict).ToList(Selecting("Id", "Party")));
+
+            RcDeal named = Guard(_db.Deals, DwTier.Convenience).ToList(Selecting("Id", "Party")).Data.Single();
+            RcDeal included = Guard(_db.Deals.Include(d => d.Party)).ToList(new Filter()).Data.Single();
+
+            Assert.True(Holds(_db.Deals.Include(d => d.Party).AsNoTracking().ToList(), "company-secret"));
+            Assert.Equal("Acme", named.Party!.Name);
+            Assert.False(Holds(named, "company-secret"));
+            Assert.False(Holds(included, "company-secret"));
+        }
+
+        // ---------------------------------------------------------------- a policy that denies what it does not name
+
+        /// <summary>
+        /// Under a <c>"*"</c> deny, a path the walk never asks about is denied: one around a cycle, one
+        /// deeper than the walk, and a property with no setter.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Under_a_deny_by_default_policy_a_member_named_is_never_kept_whole(DwTier tier)
+        {
+            RcLink[] links = { new() { Id = 1, Head = new RcNode { Name = "n1", Next = new RcNode { Name = "n2-secret" } } } };
+
+            // In memory a member cannot be narrowed, so it is refused in both tiers.
+            Refused(() => Guard(links.AsQueryable(), tier, DenyingAllBut("Id", "Head", "Head.Name")).ToList(Selecting("Id", "Head")));
+
+            FakePolicyProvider shop = DenyingAllBut("Id", "Name", "Address", "Address.City");
+
+            if (tier == DwTier.Strict)
+            {
+                Refused(() => Guard(_db.Shops, tier, shop).ToList(Selecting("Id", "Address")));
+            }
+            else
+            {
+                RcShop row = Guard(_db.Shops, tier, shop).ToList(Selecting("Id", "Address")).Data.Single();
+
+                Assert.Equal(("Basra", (string?)null), (row.Address.City, row.Address.Zip));
+            }
+        }
+
+        [Fact]
+        public void Under_a_deny_by_default_policy_a_synthesized_projection_narrows_what_the_walk_misses()
+        {
+            IQueryable<RcDeepRow> deep = _db.Customers.Select(c => new RcDeepRow
+            {
+                Id = c.Id,
+                Tenant = c.Name,
+                First = new RcL1 { Next = new RcL2 { Next = new RcL3 { Name = c.Name, Next = new RcL4 { Secret = "deep-secret" } } } }
+            });
+
+            RcDeepRow row = Guard(deep, DwTier.Strict, DenyingAllBut("Id", "First", "First.Next", "First.Next.Next", "First.Next.Next.Name"))
+                .ToList(new Filter()).Data.Single();
+
+            Assert.Null(row.First?.Next?.Next?.Next?.Secret);
+            Assert.Equal("C1", row.First?.Next?.Next?.Name);
+
+            // Notes denied, and with nothing else denied: the owned address is narrowed either way.
+            foreach (FakePolicyProvider rules in new[]
+                     {
+                         DenyingAllBut("Id", "Name", "Address", "Address.City"),
+                         DenyingAllBut("Id", "Name", "Notes", "Address", "Address.City")
+                     })
+            {
+                RcShop shop = Guard(_db.Shops, DwTier.Strict, rules).ToList(new Filter()).Data.Single();
+
+                Assert.Equal(("Basra", (string?)null), (shop.Address.City, shop.Address.Zip));
+            }
+        }
+
+        /// <summary>
+        /// A deny-by-default policy that names every path of an owned member asks for nothing: the entity is
+        /// read as loaded, its included navigation with it.
+        /// </summary>
+        [Fact]
+        public void Under_a_deny_by_default_policy_a_member_the_walk_covers_is_kept()
+        {
+            FakePolicyProvider rules = DenyingAllBut(
+                "Id", "Name", "Place", "Place.City", "Place.Zone", "RcStoreKeeperId", "Keeper", "Keeper.Id", "Keeper.Name");
+
+            PolicyQueryable<RcStore> guarded = Guard(_db.Stores.Include(s => s.Keeper), DwTier.Strict, rules);
+            RcStore store = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Equal(("Z1", "K"), (store.Place.Zone, store.Keeper?.Name));
+            Assert.DoesNotContain(guarded.LastTrace!.Decisions, d => d.Action == PolicyAction.Dropped);
+        }
+
+        // ---------------------------------------------------------------- what a navigation's entity loads
+
+        /// <summary>
+        /// Naming a navigation loads its entity whole, its owned chain included, however deep. Strict refuses
+        /// it; Convenience narrows it to the paths the walk can name.
+        /// </summary>
+        [Fact]
+        public void A_navigation_named_whose_owned_chain_holds_a_denial_past_the_walk_is_not_returned_whole()
+        {
+            Refused(() => Guard(_db.Holdings, DwTier.Strict).ToList(Selecting("Id", "Keeper")));
+
+            RcHolding holding = Guard(_db.Holdings, DwTier.Convenience).ToList(Selecting("Id", "Keeper")).Data.Single();
+
+            Assert.Equal("O1", holding.Keeper!.Name);
+            Assert.DoesNotContain("deep-secret", Sent(holding));
+        }
+
+        /// <summary>A column of a navigation's entity holding a framework collection of a policed type.</summary>
+        [Fact]
+        public void A_navigation_named_whose_column_holds_a_policed_type_is_not_returned_whole()
+        {
+            Assert.Contains("amount-secret", Sent(_db.Purchases.Include(p => p.Client).ToList()));
+
+            Refused(() => Guard(_db.Purchases, DwTier.Strict).ToList(Selecting("Id", "Client")));
+            Refused(() => Guard(_db.Purchases, DwTier.Strict).ToList(Selecting("Id", "Client.Charges")));
+
+            // Convenience narrows the navigation around the column, and the column itself to nothing.
+            RcPurchase purchase = Guard(_db.Purchases, DwTier.Convenience).ToList(Selecting("Id", "Client")).Data.Single();
+            PolicyQueryable<RcPurchase> guarded = Guard(_db.Purchases, DwTier.Convenience);
+            RcPurchase column = guarded.ToList(Selecting("Id", "Client.Charges")).Data.Single();
+
+            Assert.Equal("K1", purchase.Client!.Name);
+            Assert.False(Holds(purchase, "amount-secret"));
+            Assert.False(Holds(column, "amount-secret"));
+            Assert.Contains(guarded.LastTrace!.Decisions, d => d.FieldPath == "Client.Charges" && d.Action == PolicyAction.Dropped);
+        }
+
+        /// <summary>
+        /// An included navigation whose own navigation holds the denial, unloaded, asks for nothing: the
+        /// entity comes back as loaded, the included navigation with it.
+        /// </summary>
+        [Fact]
+        public void An_included_navigation_with_a_denial_only_beneath_what_it_does_not_load_is_kept()
+        {
+            PolicyQueryable<RcOrder> guarded = Guard(_db.Orders.Include(o => o.Customer));
+            RcOrder order = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Equal("C1", order.Customer?.Name);
+            Assert.DoesNotContain(guarded.LastTrace!.Decisions, d => d.Action == PolicyAction.Dropped);
+        }
+
+        /// <summary>An automatically included navigation loads with every query, and so does its denied field.</summary>
+        [Fact]
+        public void An_automatically_included_navigation_counts_as_loaded()
+        {
+            Assert.Contains("pin-secret", Sent(_db.BadgeHolders.ToList()));
+
+            PolicyQueryable<RcBadgeHolder> guarded = Guard(_db.BadgeHolders);
+            RcBadgeHolder holder = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.DoesNotContain("pin-secret", Sent(holder));
+            Assert.Contains(guarded.LastTrace!.Decisions, d => d.FieldPath == "Badge.Pin" && d.Action == PolicyAction.Dropped);
+        }
+
+        /// <summary>
+        /// A getter the model does not map, past the walker's four segments in an owned chain, hands out a
+        /// mapped field: what it returns counts as loaded, so its denied field asks for the projection.
+        /// </summary>
+        [Fact]
+        public void A_getter_the_model_does_not_map_past_the_walk_counts_as_loaded()
+        {
+            Assert.True(Holds(_db.Rooms.AsNoTracking().ToList(), "lid-secret"));
+
+            PolicyQueryable<RcRoom> guarded = Guard(_db.Rooms);
+            RcRoom room = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.False(Holds(room, "lid-secret"));
+            Assert.Equal("red", room.Shelf.Box.Lid.Colour);
+        }
+
+        /// <summary>
+        /// A rule on a field only a subtype declares, reached through a member declared as the base type, is
+        /// enforced like an attribute there would be: named or not, the field does not come back.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void A_rule_on_a_subtype_field_through_a_base_typed_member_is_enforced(DwTier tier)
+        {
+            RcCage[] rows = { new() { Id = 1, Pet = new RcHamster { Name = "Ham", Tag = "tag-by-rule" } } };
+            FakePolicyProvider rules = new FakePolicyProvider()
+                .Add("Pet.Tag", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            Assert.False(Holds(Guard(rows.AsQueryable(), tier, rules).ToList(new Filter()).Data, "tag-by-rule"));
+
+            Exception? named = Record.Exception(() =>
+                Assert.False(Holds(Guard(rows.AsQueryable(), tier, rules).ToList(Selecting("Id", "Pet")).Data, "tag-by-rule")));
+
+            Assert.True(named is null or PolicyException, named?.ToString());
+        }
+
+        /// <summary>
+        /// With nothing denied, a row in memory holding an object of any type is returned as it is: such a
+        /// member asks for no projection on its own.
+        /// </summary>
+        [Fact]
+        public void A_row_in_memory_holding_an_object_with_nothing_denied_is_returned_as_it_is()
+        {
+            RcNote[] rows = { new() { Id = 1, Payload = new Dictionary<string, object> { ["a"] = 1 } } };
+
+            PolicyQueryable<RcNote> guarded = Guard(rows.AsQueryable());
+
+            Assert.Same(rows[0], guarded.ToList(new Filter()).Data.Single());
+            Assert.DoesNotContain(guarded.LastTrace!.Decisions, d => d.Action == PolicyAction.Dropped);
+        }
+
+        /// <summary>
+        /// A member that can hold an object of any type asks for no projection: the policy cannot see into it
+        /// whether or not one is built. The entity comes back as loaded, its included navigation with it.
+        /// </summary>
+        [Fact]
+        public void A_member_that_can_hold_anything_asks_for_nothing()
+        {
+            PolicyQueryable<RcBag> guarded = Guard(_db.Bags.Include(b => b.Owner));
+            RcBag bag = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Equal("W1", bag.Owner?.Name);
+            Assert.DoesNotContain(guarded.LastTrace!.Decisions, d => d.Action == PolicyAction.Dropped);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ProjectionReviewTests.cs b/DynamicWhere.Tests/Policies/ProjectionReviewTests.cs
new file mode 100644
index 0000000..69b4433
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ProjectionReviewTests.cs
@@ -0,0 +1,959 @@
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.RegularExpressions;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+
+namespace SystemsCorp.Payroll
+{
+    /// <summary>An application type whose namespace only starts with the word System.</summary>
+    public sealed class RvPay
+    {
+        public string? Grade { get; set; }
+
+        [DwDenied]
+        public string? Salary { get; set; }
+    }
+}
+
+namespace DynamicWhere.Tests.Policies
+{
+    // --------------------------------------------------------------------------------- the database
+
+    public class RvRole
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public int? KeeperId { get; set; }
+
+        public RvKeeper? Keeper { get; set; }
+    }
+
+    public class RvKeeper
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Ssn { get; set; }
+    }
+
+    /// <summary>An entity with values EF Core maps through converters, and a denial only beneath a navigation.</summary>
+    public class RvAsset
+    {
+        public int Id { get; set; }
+
+        public Uri? Home { get; set; }
+
+        public RvMoney Price { get; set; }
+
+        [NotMapped]
+        public List<string> Tags { get; set; } = new();
+
+        public int? KeeperId { get; set; }
+
+        public RvKeeper? Keeper { get; set; }
+    }
+
+    public readonly record struct RvMoney(decimal Amount);
+
+    /// <summary>The same shape with a denied column, so a projection is always needed.</summary>
+    public class RvSealedAsset
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Serial { get; set; }
+
+        public Uri? Home { get; set; }
+
+        public RvMoney Price { get; set; }
+
+        [NotMapped]
+        public string Display => Serial ?? "none";
+
+        [NotMapped]
+        public List<string> Tags { get; set; } = new();
+    }
+
+    /// <summary>A table-per-hierarchy base with a denial only beneath a navigation it does not load.</summary>
+    public abstract class RvVehicle
+    {
+        public int Id { get; set; }
+
+        public string Plate { get; set; } = string.Empty;
+
+        public int? KeeperId { get; set; }
+
+        public RvKeeper? Keeper { get; set; }
+    }
+
+    public class RvTruck : RvVehicle
+    {
+        public int Axles { get; set; }
+    }
+
+    /// <summary>An entity whose owned member has a denied property with no setter.</summary>
+    public class RvShop
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public RvAddress Address { get; set; } = new();
+    }
+
+    public class RvAddress
+    {
+        public RvAddress()
+        {
+        }
+
+        public RvAddress(string city, string? zip)
+        {
+            City = city;
+            Zip = zip;
+        }
+
+        public string City { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Zip { get; }
+    }
+
+    /// <summary>An entity whose denied members are not simple values: nothing else is denied.</summary>
+    public class RvVault
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public byte[] Blob { get; set; } = Array.Empty<byte>();
+
+        [DwDenied]
+        public RvVaultPlace? Place { get; set; }
+    }
+
+    public class RvVaultPlace
+    {
+        public string Aisle { get; set; } = string.Empty;
+    }
+
+    /// <summary>An entity whose child's key no caller may see, reached through another navigation.</summary>
+    public class RvHouse
+    {
+        public int Id { get; set; }
+
+        public int? MainId { get; set; }
+
+        public RvGroup? Main { get; set; }
+    }
+
+    public class RvGroup
+    {
+        [DwDenied]
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public int? LeadId { get; set; }
+
+        public RvLead? Lead { get; set; }
+    }
+
+    public class RvLead
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    /// <summary>An entity whose children are scoped to a tenant: the scope filters parents, not children.</summary>
+    public class RvFamily
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<RvKid> Kids { get; set; } = new();
+    }
+
+    public class RvKid
+    {
+        public int Id { get; set; }
+
+        public int RvFamilyId { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwForceWhere(Operator.Equal, ContextValue = "TenantId")]
+        public int TenantId { get; set; }
+    }
+
+    /// <summary>An entity whose posts arrive through an injected lazy loader.</summary>
+    public class RvBlog
+    {
+        private List<RvPost>? _posts;
+
+        public RvBlog()
+        {
+        }
+
+        private RvBlog(ILazyLoader lazyLoader) => LazyLoader = lazyLoader;
+
+        private ILazyLoader? LazyLoader { get; set; }
+
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<RvPost> Posts
+        {
+            get
+            {
+                if (LazyLoader is not null)
+                {
+                    LazyLoader.Load(this, ref _posts);
+                }
+
+                return _posts ??= new List<RvPost>();
+            }
+            set => _posts = value;
+        }
+    }
+
+    public class RvPost
+    {
+        public int Id { get; set; }
+
+        public int RvBlogId { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Draft { get; set; }
+    }
+
+    public sealed class ProjectionReviewContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ProjectionReviewContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<RvRole> Roles => Set<RvRole>();
+
+        public DbSet<RvAsset> Assets => Set<RvAsset>();
+
+        public DbSet<RvSealedAsset> SealedAssets => Set<RvSealedAsset>();
+
+        public DbSet<RvVehicle> Vehicles => Set<RvVehicle>();
+
+        public DbSet<RvShop> Shops => Set<RvShop>();
+
+        public DbSet<RvVault> Vaults => Set<RvVault>();
+
+        public DbSet<RvHouse> Houses => Set<RvHouse>();
+
+        public DbSet<RvFamily> Families => Set<RvFamily>();
+
+        public DbSet<RvBlog> Blogs => Set<RvBlog>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<RvAsset>().Property(a => a.Price).HasConversion(m => m.Amount, a => new RvMoney(a));
+            model.Entity<RvSealedAsset>().Property(a => a.Price).HasConversion(m => m.Amount, a => new RvMoney(a));
+            model.Entity<RvTruck>();
+            model.Entity<RvShop>().OwnsOne(s => s.Address, a => a.Property(x => x.Zip));
+            model.Entity<RvVault>().OwnsOne(v => v.Place);
+            model.Entity<RvBlog>().Navigation(b => b.Posts).HasField("_posts");
+        }
+    }
+
+    // --------------------------------------------------------------------------------- the rows
+
+    [DwEntity(RequirePolicy = true)]
+    public sealed class RvRoleRow
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Tenant { get; set; }
+
+        public RvKeeper? Keeper { get; set; }
+    }
+
+    public sealed class RvContact
+    {
+        public RvContact()
+        {
+        }
+
+        public RvContact(string email) => Email = email;
+
+        public string Phone { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Email { get; }
+    }
+
+    [DwEntity(RequirePolicy = true)]
+    public sealed class RvContactRow
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Tenant { get; set; }
+
+        public RvContact? Contact { get; set; }
+    }
+
+    public sealed class RvLine
+    {
+        public string Sku { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Cost { get; set; }
+    }
+
+    /// <summary>Framework types holding a policed type: the walker does not enter them.</summary>
+    [DwEntity(RequirePolicy = true)]
+    public sealed class RvKeyedRow
+    {
+        public int Id { get; set; }
+
+        public Dictionary<string, RvLine> BySku { get; set; } = new();
+
+        public object? Payload { get; set; }
+    }
+
+    public sealed class RvLevel1
+    {
+        public RvLevel2? Next { get; set; }
+    }
+
+    public sealed class RvLevel2
+    {
+        public RvLevel3? Next { get; set; }
+    }
+
+    public sealed class RvLevel3
+    {
+        public string Name { get; set; } = string.Empty;
+
+        public RvLevel4? Next { get; set; }
+    }
+
+    public sealed class RvLevel4
+    {
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    /// <summary>A denial five segments down, deeper than the walker gives a fragment.</summary>
+    [DwEntity(RequirePolicy = true)]
+    public sealed class RvDeepRow
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Tenant { get; set; }
+
+        public RvLevel1? First { get; set; }
+    }
+
+    public sealed class RvStaffRow
+    {
+        public int Id { get; set; }
+
+        public SystemsCorp.Payroll.RvPay? Pay { get; set; }
+    }
+
+    [DwEntity(DefaultOrder = "Label desc")]
+    public sealed class RvLabelRow
+    {
+        public int Id { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+    }
+
+    [DwEntity(RequirePolicy = true)]
+    public sealed class RvReservedRow
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Tenant { get; set; }
+
+        public List<string> Cast { get; set; } = new();
+    }
+
+    public sealed class RvItem
+    {
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Hidden { get; set; }
+    }
+
+    [DwEntity(RequirePolicy = true)]
+    public sealed class RvArrayRow
+    {
+        public int Id { get; set; }
+
+        public RvItem[] Items { get; set; } = Array.Empty<RvItem>();
+    }
+
+    /// <summary>
+    /// What the 3.2.0 review found in the first cut of the synthesized projection, and the fixes for
+    /// it: denials the gate could not see, projections EF Core cannot translate, and members the first
+    /// cut lost that 3.1.0 returned.
+    /// </summary>
+    public sealed class ProjectionReviewTests : IDisposable
+    {
+        private readonly SqliteConnection _connection;
+        private readonly ProjectionReviewContext _db;
+
+        public ProjectionReviewTests()
+        {
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+
+            _db = new ProjectionReviewContext(_connection);
+            _db.Database.EnsureCreated();
+
+            RvKeeper keeper = new() { Name = "K", Ssn = "ssn-secret" };
+
+            _db.Roles.Add(new RvRole { Code = "R1", Keeper = keeper });
+            _db.Assets.Add(new RvAsset { Home = new Uri("https://example.test/"), Price = new RvMoney(12.5m), Keeper = keeper });
+            _db.SealedAssets.Add(new RvSealedAsset { Serial = "serial-secret", Home = new Uri("https://example.test/"), Price = new RvMoney(7m) });
+            _db.Vehicles.Add(new RvTruck { Plate = "T42", Axles = 3, Keeper = keeper });
+            _db.Shops.Add(new RvShop { Name = "S1", Address = new RvAddress("Basra", "zip-secret") });
+            _db.Vaults.Add(new RvVault { Name = "V1", Blob = new byte[] { 9 }, Place = new RvVaultPlace { Aisle = "A1" } });
+            _db.Houses.Add(new RvHouse { Main = new RvGroup { Name = "G", Lead = new RvLead { Name = "L" } } });
+            _db.Families.Add(new RvFamily
+            {
+                Name = "F1",
+                Kids = { new RvKid { Name = "own", TenantId = 1 }, new RvKid { Name = "other", TenantId = 2 } }
+            });
+            _db.Blogs.Add(new RvBlog { Name = "B1", Posts = { new RvPost { Title = "P1", Draft = "draft-secret" } } });
+
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static DwPolicyContext Caller() =>
+            new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1").WithValue("TenantId", 1);
+
+        private static PolicyResolver Resolver(params IDwPolicyProvider[] more) =>
+            new(new IDwPolicyProvider[] { new AttributePolicyProvider() }.Concat(more).ToArray());
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict, params IDwPolicyProvider[] more)
+            where T : class =>
+            source.ApplyPolicy(Caller(), new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } }, Resolver(more));
+
+        private static Filter Selecting(params string[] fields) => new() { Selects = fields.ToList() };
+
+        // ---------------------------------------------------------------- entity queries keep 3.1.0's shape
+
+        /// <summary>
+        /// A denial beneath a navigation the query does not load reaches nothing, so it needs no
+        /// projection: the entity comes back as EF Core loads it, converted members and all.
+        /// </summary>
+        [Fact]
+        public void A_denial_beneath_a_navigation_nothing_loads_leaves_the_entity_as_loaded()
+        {
+            PolicyQueryable<RvAsset> guarded = Guard(_db.Assets);
+            RvAsset asset = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Equal(("https://example.test/", 12.5m), (asset.Home!.ToString(), asset.Price.Amount));
+            Assert.DoesNotContain(guarded.LastTrace!.Decisions, decision => decision.Action == PolicyAction.Dropped);
+        }
+
+        /// <summary>A hierarchy keeps its runtime types and its abstract base, as it did in 3.1.0.</summary>
+        [Fact]
+        public void A_hierarchy_is_still_read_as_entities()
+        {
+            RvVehicle vehicle = Guard(_db.Vehicles).ToList(new Filter()).Data.Single();
+
+            Assert.Equal(3, Assert.IsType<RvTruck>(vehicle).Axles);
+        }
+
+        /// <summary>
+        /// When a projection is needed, an entity keeps every mapped column, converted ones included, and
+        /// leaves out a member EF Core does not map, which would make it read the denied column.
+        /// </summary>
+        [Fact]
+        public void A_needed_projection_keeps_converted_columns_and_skips_unmapped_members()
+        {
+            PolicyQueryable<RvSealedAsset> guarded = Guard(_db.SealedAssets, DwTier.Convenience);
+            FilterResultOf<RvSealedAsset> result = new(guarded.ToList(new Filter(), getQueryString: true));
+
+            Assert.Equal(("https://example.test/", 7m, "none"), (result.Row.Home!.ToString(), result.Row.Price.Amount, result.Row.Display));
+            Assert.DoesNotContain("Serial", result.Sql, StringComparison.OrdinalIgnoreCase);
+        }
+
+        /// <summary>
+        /// A denied member that holds no simple value, a blob or an owned object, used to be passed over,
+        /// so with nothing else denied the whole entity came back with it.
+        /// </summary>
+        [Fact]
+        public void A_denied_member_that_is_not_a_simple_value_is_withheld()
+        {
+            RvVault vault = Guard(_db.Vaults).ToList(new Filter()).Data.Single();
+
+            Assert.Equal("V1", vault.Name);
+            Assert.Empty(vault.Blob);
+            Assert.Null(vault.Place);
+        }
+
+        /// <summary>A denied owned property with no setter is left out of the owned member, which is kept.</summary>
+        [Theory]
+        [InlineData(DwTier.Convenience)]
+        [InlineData(DwTier.Strict)]
+        public void A_denied_property_with_no_setter_beneath_an_owned_member_is_left_out(DwTier tier)
+        {
+            RvShop shop = Guard(_db.Shops, tier).ToList(new Filter()).Data.Single();
+
+            Assert.Equal(("Basra", (string?)null), (shop.Address.City, shop.Address.Zip));
+
+            if (tier == DwTier.Strict)
+            {
+                Assert.Throws<PolicyException>(() => Guard(_db.Shops, tier).ToList(Selecting("Id", "Address")));
+            }
+            else
+            {
+                RvAddress named = Guard(_db.Shops, tier).ToList(Selecting("Id", "Address")).Data.Single().Address;
+
+                Assert.Equal(("Basra", (string?)null), (named.City, named.Zip));
+            }
+        }
+
+        /// <summary>
+        /// A navigation a lazy loader can fill carries its denied values out after the query, so its
+        /// entity needs the projection, whose rows have no loader.
+        /// </summary>
+        [Fact]
+        public void A_navigation_a_lazy_loader_can_fill_needs_the_projection()
+        {
+            PolicyQueryable<RvBlog> guarded = Guard(_db.Blogs);
+            RvBlog blog = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Equal("B1", blog.Name);
+            Assert.Empty(blog.Posts);
+            Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Posts.Draft");
+        }
+
+        /// <summary>
+        /// A forced scope on a list's elements filters the rows that hold the list, never the elements,
+        /// so a list kept whole would carry every tenant's children. A projection that is needed anyway
+        /// leaves it out whole; the scope alone asks for none, as it never did.
+        /// </summary>
+        [Fact]
+        public void A_list_whose_elements_carry_a_forced_scope_is_left_out_of_a_needed_projection()
+        {
+            PolicyQueryable<RvFamilyRow> guarded = Guard(_db.Families.Select(f => new RvFamilyRow
+            {
+                Id = f.Id,
+                Tenant = f.Name,
+                Kids = f.Kids.Select(k => new RvKidRow { Name = k.Name, TenantId = k.TenantId }).ToList()
+            }));
+
+            RvFamilyRow row = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Empty(row.Kids);
+            Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Kids"
+                && decision.Reason == "left out whole: a scope forced beneath it cannot be applied to what it holds");
+        }
+
+        /// <summary>
+        /// A navigation named through another keeps the key of each node it passes through, and a
+        /// denied one refuses the projection, as naming a sibling of the key always did.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Convenience)]
+        [InlineData(DwTier.Strict)]
+        public void A_navigation_named_through_one_whose_key_is_denied_is_refused(DwTier tier)
+        {
+            PolicyException refused = Assert.Throws<PolicyException>(
+                () => Guard(_db.Houses, tier).ToList(Selecting("Id", "Main.Lead")));
+
+            Assert.Equal(PolicyErrorCode.FieldDeniedForSelect, refused.ErrorCode);
+        }
+
+        // ---------------------------------------------------------------- projected rows
+
+        /// <summary>
+        /// A member the projection never assigns holds its default and is not carried: narrowing it
+        /// would read it through EF.Property, which EF Core cannot translate for an unbound member.
+        /// </summary>
+        [Fact]
+        public void A_member_the_projection_does_not_assign_is_not_narrowed()
+        {
+            RvRoleRow row = Guard(_db.Roles.Select(r => new RvRoleRow { Id = r.Id, Code = r.Code }))
+                .ToList(new Filter()).Data.Single();
+
+            Assert.Equal(("R1", (RvKeeper?)null), (row.Code, row.Keeper));
+        }
+
+        /// <summary>A composed projection feeds the terminal only what it selected.</summary>
+        [Fact]
+        public void A_composed_projection_then_a_terminal_runs()
+        {
+            Assert.Equal("R1", Guard(_db.Roles).Filter(new Filter()).ToList(new Filter()).Data.Single().Code);
+            Assert.Equal("R1", Guard(_db.Roles).Select(new List<string> { "Id", "Code" }).ToList(new Filter()).Data.Single().Code);
+        }
+
+        /// <summary>
+        /// A property with no setter is not one the gate can narrow a member around, and a member built
+        /// by a constructor is not one the core can narrow: such a member is left out whole.
+        /// </summary>
+        [Fact]
+        public void A_member_built_by_a_constructor_with_a_hidden_denial_is_left_out()
+        {
+            PolicyQueryable<RvContactRow> guarded = Guard(
+                _db.Roles.Select(r => new RvContactRow { Id = r.Id, Contact = new RvContact(r.Code) }));
+
+            Assert.Null(guarded.ToList(new Filter()).Data.Single().Contact);
+            Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Contact"
+                && decision.Reason == "left out whole: the projection builds it in a way the core cannot narrow");
+        }
+
+        /// <summary>
+        /// A denial five segments down has no fragment, since the walker stops at four. A projection
+        /// carrying the member whole used to return it; the member is now narrowed to what the policy
+        /// can speak about.
+        /// </summary>
+        [Fact]
+        public void A_denial_deeper_than_the_walker_goes_is_not_carried()
+        {
+            RvDeepRow row = Guard(_db.Roles.Select(r => new RvDeepRow
+            {
+                Id = r.Id,
+                First = new RvLevel1 { Next = new RvLevel2 { Next = new RvLevel3 { Name = r.Code, Next = new RvLevel4 { Secret = "deep-secret" } } } }
+            })).ToList(new Filter()).Data.Single();
+
+            Assert.Equal("R1", row.First!.Next!.Next!.Name);
+            Assert.Null(row.First.Next.Next.Next?.Secret);
+        }
+
+        /// <summary>
+        /// The same member named in Selects: the strict tier refuses a denial it cannot name, and the
+        /// convenience tier narrows it away.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Convenience)]
+        [InlineData(DwTier.Strict)]
+        public void Naming_a_member_with_a_denial_deeper_than_the_walker_goes(DwTier tier)
+        {
+            IQueryable<RvDeepRow> rows = _db.Roles.Select(r => new RvDeepRow
+            {
+                Id = r.Id,
+                First = new RvLevel1 { Next = new RvLevel2 { Next = new RvLevel3 { Name = r.Code, Next = new RvLevel4 { Secret = "deep-secret" } } } }
+            });
+
+            if (tier == DwTier.Strict)
+            {
+                Assert.Throws<PolicyException>(() => Guard(rows, tier).ToList(Selecting("Id", "First")));
+
+                return;
+            }
+
+            RvDeepRow row = Guard(rows, tier).ToList(Selecting("Id", "First")).Data.Single();
+
+            Assert.Null(row.First!.Next!.Next!.Next?.Secret);
+        }
+
+        /// <summary>A default order computed on the client cannot be translated, so it is not applied.</summary>
+        [Fact]
+        public void A_default_computed_by_an_application_method_is_not_applied()
+        {
+            IQueryable<RvLabelRow> rows = _db.Roles.Select(r => new RvLabelRow { Id = r.Id, Label = Decorate(r.Code) });
+
+            Assert.Equal("[R1]", Guard(rows).ToList(new Filter()).Data.Single().Label);
+        }
+
+        private static string Decorate(string code) => "[" + code + "]";
+
+        /// <summary>
+        /// A default applies only to a column: a framework method EF Core cannot translate, such as
+        /// <c>Regex.Replace</c>, computes the field on the client, and ordering by it would make the guarded
+        /// query fail where the unguarded one ran. A column read directly, through a navigation or through
+        /// <c>EF.Property</c> is ordered by.
+        /// </summary>
+        [Fact]
+        public void A_default_applies_only_to_a_column_the_projection_assigns()
+        {
+            IQueryable<RvLabelRow> replaced = _db.Roles.Select(r => new RvLabelRow { Id = r.Id, Label = Regex.Replace(r.Code, "R", "X") });
+            IQueryable<RvLabelRow> joined = _db.Roles.Select(r => new RvLabelRow { Id = r.Id, Label = r.Code + "!" });
+            IQueryable<RvLabelRow> direct = _db.Roles.Select(r => new RvLabelRow { Id = r.Id, Label = r.Code });
+            IQueryable<RvLabelRow> navigated = _db.Roles.Select(r => new RvLabelRow { Id = r.Id, Label = r.Keeper!.Name });
+            IQueryable<RvLabelRow> byName = _db.Roles.Select(r => new RvLabelRow { Id = r.Id, Label = EF.Property<string>(r, "Code") });
+
+            Assert.True(DefaultOrder.HidesDefault(replaced.Expression, typeof(RvLabelRow)));
+            Assert.True(DefaultOrder.HidesDefault(joined.Expression, typeof(RvLabelRow)));
+            Assert.False(DefaultOrder.HidesDefault(direct.Expression, typeof(RvLabelRow)));
+            Assert.False(DefaultOrder.HidesDefault(navigated.Expression, typeof(RvLabelRow)));
+            Assert.False(DefaultOrder.HidesDefault(byName.Expression, typeof(RvLabelRow)));
+
+            Assert.Equal("X1", Guard(replaced).ToList(new Filter()).Data.Single().Label);
+        }
+
+        /// <summary>A member named with a word the parser keeps cannot be projected, so it is skipped.</summary>
+        [Fact]
+        public void A_member_named_with_a_parser_word_is_skipped()
+        {
+            RvReservedRow row = Guard(_db.Roles.Select(r => new RvReservedRow
+                {
+                    Id = r.Id,
+                    Tenant = r.Code,
+                    Cast = _db.Roles.Where(x => x.Id == r.Id).Select(x => x.Code).ToList()
+                }))
+                .ToList(new Filter()).Data.Single();
+
+            Assert.Equal((1, (string?)null), (row.Id, row.Tenant));
+        }
+
+        /// <summary>An array needing narrowing is left out, since the core can only bind a list.</summary>
+        [Fact]
+        public void An_array_that_needs_narrowing_is_left_out()
+        {
+            PolicyQueryable<RvArrayRow> guarded = Guard(_db.Roles.Select(r => new RvArrayRow
+            {
+                Id = r.Id,
+                Items = _db.Roles.Where(x => x.Id == r.Id).Select(x => new RvItem { Name = x.Code, Hidden = "hidden" }).ToArray()
+            }));
+
+            Assert.Empty(guarded.ToList(new Filter()).Data.Single().Items);
+            Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Items"
+                && decision.Reason!.StartsWith("left out whole", StringComparison.Ordinal));
+        }
+
+        // ---------------------------------------------------------------- what the policy cannot see
+
+        /// <summary>
+        /// A framework collection of a policed type, and a member typed object, are not entered by the
+        /// walker. Rows in memory leave them out once a projection is needed, which a denial inside them
+        /// now asks for; naming one is refused.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Convenience)]
+        [InlineData(DwTier.Strict)]
+        public void A_framework_collection_of_a_policed_type_is_not_returned(DwTier tier)
+        {
+            RvKeyedRow[] rows =
+            {
+                new() { Id = 1, BySku = { ["a"] = new RvLine { Sku = "a", Cost = "cost-secret" } }, Payload = new RvLine { Cost = "payload-secret" } }
+            };
+
+            RvKeyedRow row = Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data.Single();
+
+            Assert.Empty(row.BySku);
+            Assert.Null(row.Payload);
+            Assert.Throws<PolicyException>(() => Guard(rows.AsQueryable(), tier).ToList(Selecting("Id", "BySku")));
+        }
+
+        /// <summary>
+        /// A namespace that only starts with the word System is the application's. The walker read it
+        /// as the framework's and put no fragment beneath its types, so a denied field there was
+        /// returned, filtered on and ordered by.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Convenience)]
+        [InlineData(DwTier.Strict)]
+        public void A_namespace_starting_with_System_is_policed(DwTier tier)
+        {
+            RvStaffRow[] rows = { new() { Id = 1, Pay = new SystemsCorp.Payroll.RvPay { Grade = "G1", Salary = "salary-secret" } } };
+
+            Filter where = new()
+            {
+                ConditionGroup = new ConditionGroup
+                {
+                    Conditions = { new Condition { Field = "Pay.Salary", DataType = DataType.Text, Operator = Operator.Equal, Values = { "x" } } }
+                }
+            };
+
+            Assert.Throws<PolicyException>(() => Guard(rows.AsQueryable(), tier).ToList(where));
+            Assert.Contains(
+                new AttributePolicyProvider().GetFragments(typeof(RvStaffRow), Caller()),
+                fragment => fragment.FieldPath == "Pay.Salary");
+        }
+
+        /// <summary>A runtime rule on a path reached through a cycle is found beneath a member, as its fragment names it.</summary>
+        [Fact]
+        public void A_rule_on_a_path_through_a_cycle_is_seen_beneath_a_member()
+        {
+            RvLink[] rows = { new() { Id = 1, Head = new RvNode { Name = "n1", Next = new RvNode { Name = "n2-secret" } } } };
+            FakePolicyProvider rule = new FakePolicyProvider().Add(
+                "Head.Next.Name", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            PolicyQueryable<RvLink> guarded = Guard(rows.AsQueryable(), DwTier.Convenience, rule);
+
+            Assert.Null(guarded.ToList(new Filter()).Data.Single().Head);
+            Assert.Throws<PolicyException>(() => Guard(rows.AsQueryable(), DwTier.Convenience, rule).ToList(Selecting("Id", "Head")));
+        }
+
+        /// <summary>
+        /// A rule on a path the type does not have, one left behind by a member since removed, holds nothing
+        /// a projection could carry, so it does not stop a caller naming the member above it.
+        /// </summary>
+        [Fact]
+        public void A_rule_on_a_path_that_does_not_exist_beneath_a_member_changes_nothing()
+        {
+            RvLink[] rows = { new() { Id = 1, Head = new RvNode { Name = "n1" } } };
+            FakePolicyProvider stale = new FakePolicyProvider().Add(
+                "Head.Fax", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            RvLink row = Guard(rows.AsQueryable(), DwTier.Strict, stale).ToList(Selecting("Id", "Head")).Data.Single();
+
+            Assert.Equal("n1", row.Head!.Name);
+        }
+
+        /// <summary>
+        /// A navigation EF Core's lazy-loading proxies can fill counts as loaded as well, and the rows the
+        /// projection returns are plain objects, with no proxy left to load it.
+        /// </summary>
+        [Fact]
+        public void A_navigation_a_lazy_loading_proxy_can_fill_needs_the_projection()
+        {
+            using SqliteConnection connection = new("DataSource=:memory:");
+            connection.Open();
+
+            using ProxyContext proxies = new(connection);
+
+            proxies.Database.EnsureCreated();
+            proxies.Blogs.Add(new PxBlog { Name = "X1", Posts = { new PxPost { Title = "T", Draft = "proxy-draft" } } });
+            proxies.SaveChanges();
+            proxies.ChangeTracker.Clear();
+
+            PolicyQueryable<PxBlog> guarded = Guard(proxies.Blogs);
+            PxBlog blog = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Equal("X1", blog.Name);
+            Assert.Empty(blog.Posts);
+            Assert.Equal(typeof(PxBlog), blog.GetType());
+            Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Posts.Draft");
+        }
+
+        /// <summary>
+        /// An include on a join's inner source loads a navigation of the rows the join returns, and it is
+        /// not on the chain the paths are read from, so every navigation counts as loaded.
+        /// </summary>
+        [Fact]
+        public void An_include_anywhere_in_the_query_counts()
+        {
+            IQueryable<RvRole> rows = _db.Assets.Join(_db.Roles.Include(r => r.Keeper), a => a.Id, r => r.Id, (a, r) => r);
+
+            PolicyQueryable<RvRole> guarded = Guard(rows);
+
+            Assert.Null(guarded.ToList(new Filter()).Data.Single().Keeper);
+            Assert.Contains(guarded.LastTrace!.Decisions, decision => decision.FieldPath == "Keeper.Ssn");
+        }
+
+        /// <summary>Holds a reference to a copy of the result and its SQL, to keep a test to one statement per line.</summary>
+        private sealed class FilterResultOf<T>
+            where T : class
+        {
+            internal FilterResultOf(DynamicWhere.ex.Classes.Result.FilterResult<T> result)
+            {
+                Row = result.Data.Single();
+                Sql = result.QueryString ?? string.Empty;
+            }
+
+            internal T Row { get; }
+
+            internal string Sql { get; }
+        }
+    }
+
+    public sealed class RvKidRow
+    {
+        public string Name { get; set; } = string.Empty;
+
+        [DwForceWhere(Operator.Equal, ContextValue = "TenantId")]
+        public int TenantId { get; set; }
+    }
+
+    [DwEntity(RequirePolicy = true)]
+    public sealed class RvFamilyRow
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Tenant { get; set; }
+
+        public List<RvKidRow> Kids { get; set; } = new();
+    }
+
+    public class PxBlog
+    {
+        public virtual int Id { get; set; }
+
+        public virtual string Name { get; set; } = string.Empty;
+
+        public virtual List<PxPost> Posts { get; set; } = new();
+    }
+
+    public class PxPost
+    {
+        public virtual int Id { get; set; }
+
+        public virtual int PxBlogId { get; set; }
+
+        public virtual string Title { get; set; } = string.Empty;
+
+        [DwDenied]
+        public virtual string? Draft { get; set; }
+    }
+
+    public sealed class ProxyContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ProxyContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<PxBlog> Blogs => Set<PxBlog>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) =>
+            options.UseSqlite(_connection).UseLazyLoadingProxies();
+    }
+
+    public sealed class RvNode
+    {
+        public string Name { get; set; } = string.Empty;
+
+        public RvNode? Next { get; set; }
+    }
+
+    [DwEntity(RequirePolicy = true)]
+    public sealed class RvLink
+    {
+        public int Id { get; set; }
+
+        public RvNode? Head { get; set; }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewCollectionClassTests.cs b/DynamicWhere.Tests/Policies/ReviewCollectionClassTests.cs
new file mode 100644
index 0000000..b907114
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewCollectionClassTests.cs
@@ -0,0 +1,176 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ an application's own generic collections: models
+
+    /// <summary>An application collection of values that declares a member of its own.</summary>
+    public class ZxTagSet : List<string>
+    {
+        [DwDenied]
+        public string? OwnerSecret { get; set; }
+    }
+
+    public class ZxPlainCard
+    {
+        public string Label { get; set; } = string.Empty;
+    }
+
+    /// <summary>An application collection of objects that declares a member of its own.</summary>
+    public class ZxCardList : List<ZxPlainCard>
+    {
+        [DwDenied]
+        public string? MasterKey { get; set; }
+    }
+
+    /// <summary>An application dictionary that declares a member of its own.</summary>
+    public class ZxPropertyBag : Dictionary<string, string>
+    {
+        [DwDenied]
+        public string? BagSecret { get; set; }
+    }
+
+    public class ZxBagRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZxTagSet Tags { get; set; } = new();
+    }
+
+    public class ZxListRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZxCardList Cards { get; set; } = new();
+    }
+
+    public class ZxPropsRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZxPropertyBag Props { get; set; } = new();
+    }
+
+    /// <summary>The same, beside a top-level denial, so a projection is built for another reason.</summary>
+    public class ZxBagRowDenied
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Ssn { get; set; }
+
+        public ZxTagSet Tags { get; set; } = new();
+
+        public ZxCardList Cards { get; set; } = new();
+    }
+
+    // ============================================================================ an application's own generic collections: tests
+
+    /// <summary>
+    /// An application's own collection class, deriving from List&lt;string&gt;, List&lt;T&gt; or a Dictionary, declares
+    /// members beside the elements it holds, and they are read as any type's are.
+    /// </summary>
+    public sealed class ReviewCollectionClassTests
+    {
+        private readonly ITestOutputHelper _out;
+
+        public ReviewCollectionClassTests(ITestOutputHelper output) => _out = output;
+
+        private object? Read<T>(IQueryable<T> source, DwTier tier, bool dynamic = false) where T : class
+        {
+            PolicyQueryable<T> guarded = ZxKit.Guard(source, tier);
+            object? data = ZxKit.SafeRead(() => dynamic ? guarded.ToListDynamic(new Filter()).Data : guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"{typeof(T).Name} {tier} dynamic={dynamic}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            return data;
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict, false)]
+        [InlineData(DwTier.Convenience, false)]
+        [InlineData(DwTier.Strict, true)]
+        public void Zx_K1_a_collection_of_values_that_declares_a_denied_member(DwTier tier, bool dynamic)
+        {
+            ZxBagRow[] rows = { new() { Id = 1, Name = "r1", Tags = new ZxTagSet { "a", "b" } } };
+            rows[0].Tags.OwnerSecret = "tagset-owner-secret";
+
+            object? data = Read(rows.AsQueryable(), tier, dynamic);
+
+            Assert.False(ZxKit.Holds(data, "tagset-owner-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict, false)]
+        [InlineData(DwTier.Convenience, false)]
+        [InlineData(DwTier.Strict, true)]
+        public void Zx_K2_a_collection_of_objects_that_declares_a_denied_member(DwTier tier, bool dynamic)
+        {
+            ZxListRow[] rows = { new() { Id = 1, Name = "r1", Cards = new ZxCardList { new() { Label = "visa" } } } };
+            rows[0].Cards.MasterKey = "cardlist-master-secret";
+
+            object? data = Read(rows.AsQueryable(), tier, dynamic);
+
+            Assert.False(ZxKit.Holds(data, "cardlist-master-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_K3_a_dictionary_that_declares_a_denied_member(DwTier tier)
+        {
+            ZxPropsRow[] rows = { new() { Id = 1, Name = "r1", Props = new ZxPropertyBag { ["k"] = "v" } } };
+            rows[0].Props.BagSecret = "bag-own-secret";
+
+            object? data = Read(rows.AsQueryable(), tier);
+
+            Assert.False(ZxKit.Holds(data, "bag-own-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_K4_beside_a_top_level_denial_the_projection_keeps_the_collection(DwTier tier)
+        {
+            ZxBagRowDenied[] rows =
+            {
+                new() { Id = 1, Ssn = "ssn-secret", Tags = new ZxTagSet { "a" }, Cards = new ZxCardList { new() { Label = "visa" } } }
+            };
+            rows[0].Tags.OwnerSecret = "tagset-owner-secret-2";
+            rows[0].Cards.MasterKey = "cardlist-master-secret-2";
+
+            object? data = Read(rows.AsQueryable(), tier);
+
+            Assert.False(ZxKit.Holds(data, "ssn-secret"));
+            Assert.False(ZxKit.Holds(data, "tagset-owner-secret-2"));
+            Assert.False(ZxKit.Holds(data, "cardlist-master-secret-2"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_K5_naming_the_collection_of_values_in_selects(DwTier tier)
+        {
+            ZxBagRow[] rows = { new() { Id = 1, Name = "r1", Tags = new ZxTagSet { "a" } } };
+            rows[0].Tags.OwnerSecret = "tagset-owner-secret-3";
+
+            PolicyQueryable<ZxBagRow> guarded = ZxKit.Guard(rows.AsQueryable(), tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToList(ZxKit.Selecting("Id", "Tags")).Data);
+
+            _out.WriteLine($"{tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "tagset-owner-secret-3"));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewConvertedColumnTests.cs b/DynamicWhere.Tests/Policies/ReviewConvertedColumnTests.cs
new file mode 100644
index 0000000..ec106b0
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewConvertedColumnTests.cs
@@ -0,0 +1,144 @@
+using System.Collections;
+using System.Reflection;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ converted columns holding policed types
+
+    /// <summary>The denial is declared on the interface member, which applies to the class's member too.</summary>
+    public interface IZvVaultCard
+    {
+        [DwDenied]
+        string? Pan { get; }
+    }
+
+    public class ZvVaultCard : IZvVaultCard
+    {
+        public string Label { get; set; } = string.Empty;
+
+        public string? Pan { get; set; }
+    }
+
+    /// <summary>Control: the same card with the attribute on its own member.</summary>
+    public class ZvVaultCardDirect
+    {
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZvVault
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Note { get; set; }
+
+        public Dictionary<string, ZvVaultCard> Cards { get; set; } = new();
+
+        public Dictionary<string, ZvVaultCardDirect> DirectCards { get; set; } = new();
+    }
+
+    public sealed class ZvConvertedContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZvConvertedContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZvVault> Vaults => Set<ZvVault>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZvVault>().Property(v => v.Cards).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, ZvVaultCard>>(text, (JsonSerializerOptions?)null)!);
+            model.Entity<ZvVault>().Property(v => v.DirectCards).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, ZvVaultCardDirect>>(text, (JsonSerializerOptions?)null)!);
+        }
+    }
+
+    public sealed class ReviewConvertedColumnTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZvConvertedContext _db;
+
+        public ReviewConvertedColumnTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZvConvertedContext(_connection);
+            _db.Database.EnsureCreated();
+            _db.Vaults.Add(new ZvVault
+            {
+                Name = "V1",
+                Note = "note-secret",
+                Cards = { ["a"] = new ZvVaultCard { Label = "visa", Pan = "iface-column-pan" } },
+                DirectCards = { ["b"] = new ZvVaultCardDirect { Label = "mc", Pan = "direct-column-pan" } }
+            });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        /// <summary>
+        /// 3.1.0 left every non-scalar member out once Note asked for a projection. The column is now kept whole when
+        /// the policy reads nothing denied in it; a denial declared on the interface member is not read there.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_F1_a_converted_column_holding_a_type_whose_interface_denies_a_member(DwTier tier)
+        {
+            PolicyQueryable<ZvVault> guarded = Guard(_db.Vaults, tier);
+            string sent;
+
+            try
+            {
+                sent = JsonSerializer.Serialize(guarded.ToList(new Filter()).Data);
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode == PolicyErrorCode.FieldDeniedForSelect)
+            {
+                sent = "refused";
+            }
+
+            _out.WriteLine("sent: " + sent + " decisions: "
+                           + string.Join(" | ", guarded.LastTrace?.Decisions.Where(d => d.Action != PolicyAction.Allowed)
+                               .Select(d => $"{d.FieldPath} {d.Action}") ?? Array.Empty<string>()));
+
+            Assert.DoesNotContain("note-secret", sent);
+            Assert.DoesNotContain("direct-column-pan", sent);
+            Assert.DoesNotContain("iface-column-pan", sent);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewConverterPrecisionTests.cs b/DynamicWhere.Tests/Policies/ReviewConverterPrecisionTests.cs
new file mode 100644
index 0000000..22e036c
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewConverterPrecisionTests.cs
@@ -0,0 +1,383 @@
+using System.Collections;
+using System.Globalization;
+using System.Net;
+using System.Numerics;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.ChangeTracking;
+using Xunit.Abstractions;
+
+// A converted column beside a top-level [DwDenied] (Secret), which builds a projection. An everyday converted column
+// comes back with its value; one that can hold an object of any type is left out, since the converter is the
+// application's code and the policy cannot see what it hands back.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public enum ZycStatus
+    {
+        Draft,
+        Active
+    }
+
+    public readonly record struct ZycAccountId(int Value);
+
+    public sealed record ZycAccountKey(Guid Value);
+
+    public sealed record ZycMoney(decimal Amount, string Currency);
+
+    public class ZycPrefs
+    {
+        public string Theme { get; set; } = string.Empty;
+
+        public int FontSize { get; set; }
+
+        public List<string> Recent { get; set; } = new();
+    }
+
+    /// <summary>A JSON envelope holding an arbitrary payload: genuinely able to hold any object.</summary>
+    public class ZycEnvelope
+    {
+        public string Kind { get; set; } = string.Empty;
+
+        public object? Data { get; set; }
+    }
+
+    public class ZycPoint
+    {
+        public double X { get; set; }
+
+        public double Y { get; set; }
+    }
+
+    public class ZycAccount
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        /// <summary>A top-level denial: every guarded query over the account builds a projection.</summary>
+        [DwDenied]
+        public string? Secret { get; set; }
+
+        public ZycStatus Status { get; set; }
+
+        public DateTime CreatedUtc { get; set; }
+
+        public List<string> Tags { get; set; } = new();
+
+        public string[] Aliases { get; set; } = Array.Empty<string>();
+
+        public HashSet<int> Codes { get; set; } = new();
+
+        public ZycAccountId Ref { get; set; }
+
+        public ZycAccountKey Key { get; set; } = new(Guid.Empty);
+
+        public ZycMoney Price { get; set; } = new(0, "IQD");
+
+        public ZycPrefs Prefs { get; set; } = new();
+
+        public List<ZycPrefs> History { get; set; } = new();
+
+        public ZycPoint Location { get; set; } = new();
+
+        public Dictionary<string, string> Labels { get; set; } = new();
+
+        public Dictionary<string, List<string>> Groups { get; set; } = new();
+
+        public Dictionary<string, JsonElement> Attributes { get; set; } = new();
+
+        public Dictionary<string, object> Bag { get; set; } = new();
+
+        public ZycEnvelope Envelope { get; set; } = new();
+
+        public BitArray Flags { get; set; } = new(0);
+
+        public Uri? Site { get; set; }
+
+        public IPAddress? Ip { get; set; }
+
+        public CultureInfo? Culture { get; set; }
+
+        public Version? Schema { get; set; }
+
+        public BigInteger Big { get; set; }
+
+        public JsonObject? Extra { get; set; }
+
+        public JsonElement Element { get; set; }
+
+        public object? Setting { get; set; }
+    }
+
+    public sealed class ZycContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZycContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZycAccount> Accounts => Set<ZycAccount>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        private static string J<T>(T value) => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null);
+
+        private static T U<T>(string text) => JsonSerializer.Deserialize<T>(text, (JsonSerializerOptions?)null)!;
+
+        private static ValueComparer<T> ByJson<T>() => new(
+            (left, right) => J(left) == J(right),
+            value => J(value).GetHashCode(),
+            value => U<T>(J(value)));
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            var account = model.Entity<ZycAccount>();
+
+            account.Property(a => a.Status).HasConversion<string>();
+            account.Property(a => a.CreatedUtc).HasConversion(v => v.ToUniversalTime(), v => DateTime.SpecifyKind(v, DateTimeKind.Utc));
+            account.Property(a => a.Tags).HasConversion(v => string.Join(',', v), v => v.Split(',', StringSplitOptions.RemoveEmptyEntries).ToList(), ByJson<List<string>>());
+            account.Property(a => a.Aliases).HasConversion(v => string.Join(',', v), v => v.Split(',', StringSplitOptions.RemoveEmptyEntries), ByJson<string[]>());
+            account.Property(a => a.Codes).HasConversion(v => J(v), v => U<HashSet<int>>(v), ByJson<HashSet<int>>());
+            account.Property(a => a.Ref).HasConversion(v => v.Value, v => new ZycAccountId(v));
+            account.Property(a => a.Key).HasConversion(v => v.Value, v => new ZycAccountKey(v));
+            account.Property(a => a.Price).HasConversion(v => J(v), v => U<ZycMoney>(v));
+            account.Property(a => a.Prefs).HasConversion(v => J(v), v => U<ZycPrefs>(v), ByJson<ZycPrefs>());
+            account.Property(a => a.History).HasConversion(v => J(v), v => U<List<ZycPrefs>>(v), ByJson<List<ZycPrefs>>());
+            account.Property(a => a.Location).HasConversion(v => J(v), v => U<ZycPoint>(v), ByJson<ZycPoint>());
+            account.Property(a => a.Labels).HasConversion(v => J(v), v => U<Dictionary<string, string>>(v), ByJson<Dictionary<string, string>>());
+            account.Property(a => a.Groups).HasConversion(v => J(v), v => U<Dictionary<string, List<string>>>(v), ByJson<Dictionary<string, List<string>>>());
+            account.Property(a => a.Attributes).HasConversion(v => J(v), v => U<Dictionary<string, JsonElement>>(v), ByJson<Dictionary<string, JsonElement>>());
+            account.Property(a => a.Bag).HasConversion(v => J(v), v => U<Dictionary<string, object>>(v), ByJson<Dictionary<string, object>>());
+            account.Property(a => a.Envelope).HasConversion(v => J(v), v => U<ZycEnvelope>(v), ByJson<ZycEnvelope>());
+            account.Property(a => a.Flags).HasConversion(
+                v => string.Concat(v.Cast<bool>().Select(bit => bit ? '1' : '0')),
+                v => new BitArray(v.Select(c => c == '1').ToArray()));
+            account.Property(a => a.Site).HasConversion(v => v == null ? null : v.ToString(), v => v == null ? null : new Uri(v));
+            account.Property(a => a.Ip).HasConversion(v => v == null ? null : v.ToString(), v => v == null ? null : IPAddress.Parse(v));
+            account.Property(a => a.Culture).HasConversion(v => v == null ? null : v.Name, v => v == null ? null : CultureInfo.GetCultureInfo(v));
+            account.Property(a => a.Schema).HasConversion(v => v == null ? null : v.ToString(), v => v == null ? null : Version.Parse(v));
+            account.Property(a => a.Big).HasConversion(v => v.ToString(), v => BigInteger.Parse(v));
+            account.Property(a => a.Extra).HasConversion(v => v == null ? null : v.ToJsonString((JsonSerializerOptions?)null), v => v == null ? null : (JsonObject)JsonNode.Parse(v, null, default)!);
+            account.Property(a => a.Element).HasConversion(v => v.GetRawText(), v => JsonDocument.Parse(v, default).RootElement.Clone());
+            account.Property(a => a.Setting).HasConversion(v => J(v), v => U<object>(v));
+        }
+    }
+
+    public sealed class ReviewConverterPrecisionTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZycContext _db;
+
+        public ReviewConverterPrecisionTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZycContext(_connection);
+            _db.Database.EnsureCreated();
+
+            _db.Accounts.Add(new ZycAccount
+            {
+                Name = "A1",
+                Secret = "zyc-secret",
+                Status = ZycStatus.Active,
+                CreatedUtc = new DateTime(2026, 1, 2, 3, 4, 5, DateTimeKind.Utc),
+                Tags = { "a", "b" },
+                Aliases = new[] { "x" },
+                Codes = { 7 },
+                Ref = new ZycAccountId(42),
+                Key = new ZycAccountKey(Guid.Parse("11111111-2222-3333-4444-555555555555")),
+                Price = new ZycMoney(9.5m, "USD"),
+                Prefs = new ZycPrefs { Theme = "dark", FontSize = 12, Recent = { "r" } },
+                History = { new ZycPrefs { Theme = "light" } },
+                Location = new ZycPoint { X = 1, Y = 2 },
+                Labels = { ["team"] = "blue" },
+                Groups = { ["g"] = new List<string> { "m" } },
+                Attributes = { ["n"] = JsonDocument.Parse("5").RootElement.Clone() },
+                Bag = { ["colour"] = "red" },
+                Envelope = new ZycEnvelope { Kind = "note", Data = "hello" },
+                Flags = new BitArray(new[] { true, false, true }),
+                Site = new Uri("https://example.org/a"),
+                Ip = IPAddress.Parse("10.0.0.1"),
+                Culture = CultureInfo.GetCultureInfo("ar-IQ"),
+                Schema = new Version(1, 2),
+                Big = BigInteger.Parse("123456789012345678901234567890"),
+                Extra = new JsonObject { ["p"] = 1 },
+                Element = JsonDocument.Parse("{\"q\":2}").RootElement.Clone(),
+                Setting = "on"
+            });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        /// <summary>What an unguarded read returns for each column, compared with the guarded read.</summary>
+        private static readonly Dictionary<string, Func<ZycAccount, bool>> Holds = new()
+        {
+            ["Status"] = a => a.Status == ZycStatus.Active,
+            ["CreatedUtc"] = a => a.CreatedUtc.Year == 2026,
+            ["Tags"] = a => a.Tags.SequenceEqual(new[] { "a", "b" }),
+            ["Aliases"] = a => a.Aliases.SequenceEqual(new[] { "x" }),
+            ["Codes"] = a => a.Codes.Contains(7),
+            ["Ref"] = a => a.Ref.Value == 42,
+            ["Key"] = a => a.Key.Value != Guid.Empty,
+            ["Price"] = a => a.Price.Amount == 9.5m,
+            ["Prefs"] = a => a.Prefs.Theme == "dark",
+            ["History"] = a => a.History.Count == 1,
+            ["Location"] = a => a.Location.Y == 2,
+            ["Labels"] = a => a.Labels.ContainsKey("team"),
+            ["Groups"] = a => a.Groups.ContainsKey("g"),
+            ["Attributes"] = a => a.Attributes.ContainsKey("n"),
+            ["Bag"] = a => a.Bag.ContainsKey("colour"),
+            ["Envelope"] = a => a.Envelope.Kind == "note",
+            ["Flags"] = a => a.Flags.Length == 3,
+            ["Site"] = a => a.Site is not null,
+            ["Ip"] = a => a.Ip is not null,
+            ["Culture"] = a => a.Culture is not null,
+            ["Schema"] = a => a.Schema is not null,
+            ["Big"] = a => !a.Big.IsZero,
+            ["Extra"] = a => a.Extra is not null,
+            ["Element"] = a => a.Element.ValueKind == JsonValueKind.Object,
+            ["Setting"] = a => a.Setting is not null
+        };
+
+        /// <summary>
+        /// Docs check (llms.txt 3.2.0 history): "The trace records a member left out only when a projection is built."
+        /// A dry run builds none and returns the rows whole.
+        /// </summary>
+        [Fact]
+        public void Zy_C_a_dry_run_returns_the_row_whole_and_records_what_it_would_leave_out()
+        {
+            PolicyQueryable<ZycAccount> guarded = _db.Accounts.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = DwTier.Strict, DryRun = true, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+            ZycAccount row = guarded.ToList(new Filter()).Data.Single();
+            string leftOut = string.Join(" | ", guarded.LastTrace?.Decisions
+                .Where(d => d.Reason?.StartsWith("left out", StringComparison.Ordinal) == true)
+                .Select(d => $"{d.FieldPath}: {d.Reason}") ?? Array.Empty<string>());
+
+            ZyLog.Write(_out, $"C dry run: secretReturned={row.Secret is not null} bagReturned={row.Bag.Count > 0} leftOut=[{leftOut}]");
+
+            // A dry run drops nothing, and records what a real run would leave out.
+            Assert.True(row.Bag.Count > 0);
+            Assert.Contains("Bag: left out whole: it can hold what the policy cannot name", leftOut);
+        }
+
+        [Theory]
+        [InlineData("Status")]
+        [InlineData("CreatedUtc")]
+        [InlineData("Tags")]
+        [InlineData("Aliases")]
+        [InlineData("Codes")]
+        [InlineData("Ref")]
+        [InlineData("Key")]
+        [InlineData("Price")]
+        [InlineData("Prefs")]
+        [InlineData("History")]
+        [InlineData("Location")]
+        [InlineData("Labels")]
+        [InlineData("Groups")]
+        [InlineData("Attributes")]
+        [InlineData("Flags")]
+        [InlineData("Site")]
+        [InlineData("Ip")]
+        [InlineData("Culture")]
+        [InlineData("Schema")]
+        [InlineData("Big")]
+        [InlineData("Extra")]
+        [InlineData("Element")]
+        public void Zy_C_a_converted_column_beside_a_top_level_denial_is_kept(string column)
+        {
+            ZycAccount unguarded = _db.Accounts.AsNoTracking().Single();
+
+            Assert.True(Holds[column](unguarded), "the unguarded read itself lost " + column);
+
+            PolicyQueryable<ZycAccount> guarded = _db.Accounts.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = DwTier.Strict, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+            ZycAccount row;
+
+            try
+            {
+                row = guarded.ToList(new Filter()).Data.Single();
+            }
+            catch (Exception e)
+            {
+                ZyLog.Write(_out, $"C {column}: THREW {e.GetType().Name} {e.Message.Split('\n')[0]}");
+
+                throw;
+            }
+
+            string about = string.Join(" | ", guarded.LastTrace?.Decisions
+                .Where(d => d.Action != PolicyAction.Allowed && d.FieldPath.StartsWith(column, StringComparison.Ordinal))
+                .Select(d => $"{d.FieldPath} {d.Action}: {d.Reason}") ?? Array.Empty<string>());
+
+            bool kept = Holds[column](row);
+
+            ZyLog.Write(_out, $"C {column}: {(kept ? "KEPT" : "LEFT OUT")} secretKept={row.Secret is not null} [{about}]");
+
+            Assert.Null(row.Secret);
+            Assert.True(kept, $"{column} left out: {about}");
+        }
+
+        [Theory]
+        [InlineData("Bag")]
+        [InlineData("Envelope")]
+        [InlineData("Setting")]
+        public void Zy_C_a_converted_column_that_can_hold_any_object_is_left_out_beside_a_top_level_denial(string column)
+        {
+            ZycAccount unguarded = _db.Accounts.AsNoTracking().Single();
+
+            Assert.True(Holds[column](unguarded), "the unguarded read itself lost " + column);
+
+            PolicyQueryable<ZycAccount> guarded = _db.Accounts.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = DwTier.Strict, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+            ZycAccount row;
+
+            try
+            {
+                row = guarded.ToList(new Filter()).Data.Single();
+            }
+            catch (Exception e)
+            {
+                ZyLog.Write(_out, $"C {column}: THREW {e.GetType().Name} {e.Message.Split('\n')[0]}");
+
+                throw;
+            }
+
+            string about = string.Join(" | ", guarded.LastTrace?.Decisions
+                .Where(d => d.Action != PolicyAction.Allowed && d.FieldPath.StartsWith(column, StringComparison.Ordinal))
+                .Select(d => $"{d.FieldPath} {d.Action}: {d.Reason}") ?? Array.Empty<string>());
+
+            bool kept = Holds[column](row);
+
+            ZyLog.Write(_out, $"C {column}: {(kept ? "KEPT" : "LEFT OUT")} secretKept={row.Secret is not null} [{about}]");
+
+            Assert.Null(row.Secret);
+            Assert.False(kept, $"{column} kept: {about}");
+            Assert.Contains($"{column} Dropped: left out whole: it can hold what the policy cannot name", about);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewConverterTests.cs b/DynamicWhere.Tests/Policies/ReviewConverterTests.cs
new file mode 100644
index 0000000..dac010b
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewConverterTests.cs
@@ -0,0 +1,189 @@
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ converters the model does not name: models
+
+    public class ZxIssued
+    {
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    /// <summary>The application's own converter: writes any object as JSON and reads it back as ZxIssued.</summary>
+    public sealed class ZxPayloadConverter : ValueConverter<object?, string>
+    {
+        public ZxPayloadConverter()
+            : base(v => Write(v), s => Read(s))
+        {
+        }
+
+        private static string Write(object? value) =>
+            value is null ? "null" : JsonSerializer.Serialize(value, value.GetType());
+
+        private static object? Read(string text) => JsonSerializer.Deserialize<ZxIssued>(text);
+    }
+
+    public class ZxConvEvent
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Actor { get; set; }
+
+        public object? Payload { get; set; }
+    }
+
+    /// <summary>How the converter is configured.</summary>
+    public enum ZxConverterStyle
+    {
+        /// <summary>Control: HasConversion(new converter()).</summary>
+        Instance,
+
+        /// <summary>HasConversion&lt;TConverter&gt;().</summary>
+        GenericType,
+
+        /// <summary>HasConversion(typeof(TConverter)).</summary>
+        TypeObject,
+
+        /// <summary>ConfigureConventions: Properties&lt;object&gt;().HaveConversion&lt;TConverter&gt;().</summary>
+        Convention
+    }
+
+    public abstract class ZxConvContextBase : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        protected ZxConvContextBase(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZxConvEvent> Events => Set<ZxConvEvent>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+    }
+
+    public sealed class ZxConvInstanceContext : ZxConvContextBase
+    {
+        public ZxConvInstanceContext(SqliteConnection connection) : base(connection) { }
+
+        protected override void OnModelCreating(ModelBuilder model) =>
+            model.Entity<ZxConvEvent>().Property(e => e.Payload).HasConversion(new ZxPayloadConverter());
+    }
+
+    public sealed class ZxConvGenericTypeContext : ZxConvContextBase
+    {
+        public ZxConvGenericTypeContext(SqliteConnection connection) : base(connection) { }
+
+        protected override void OnModelCreating(ModelBuilder model) =>
+            model.Entity<ZxConvEvent>().Property(e => e.Payload).HasConversion<ZxPayloadConverter>();
+    }
+
+    public sealed class ZxConvTypeObjectContext : ZxConvContextBase
+    {
+        public ZxConvTypeObjectContext(SqliteConnection connection) : base(connection) { }
+
+        protected override void OnModelCreating(ModelBuilder model) =>
+            model.Entity<ZxConvEvent>().Property(e => e.Payload).HasConversion(typeof(ZxPayloadConverter));
+    }
+
+    public sealed class ZxConvConventionContext : ZxConvContextBase
+    {
+        public ZxConvConventionContext(SqliteConnection connection) : base(connection) { }
+
+        protected override void ConfigureConventions(ModelConfigurationBuilder configuration) =>
+            configuration.Properties<object>().HaveConversion<ZxPayloadConverter>();
+
+        protected override void OnModelCreating(ModelBuilder model) =>
+            model.Entity<ZxConvEvent>().Property(e => e.Payload);
+    }
+
+    // ============================================================================ converters configured every way: tests
+
+    /// <summary>
+    /// A converted column that can hold any object is left out once a projection is built for another field,
+    /// however the converter is configured: an instance, a type, or a lambda.
+    /// </summary>
+    public sealed class ReviewConverterTests
+    {
+        private readonly ITestOutputHelper _out;
+
+        public ReviewConverterTests(ITestOutputHelper output) => _out = output;
+
+        private static ZxConvContextBase Create(ZxConverterStyle style, SqliteConnection connection) => style switch
+        {
+            ZxConverterStyle.Instance => new ZxConvInstanceContext(connection),
+            ZxConverterStyle.GenericType => new ZxConvGenericTypeContext(connection),
+            ZxConverterStyle.TypeObject => new ZxConvTypeObjectContext(connection),
+            _ => new ZxConvConventionContext(connection)
+        };
+
+        [Theory]
+        [InlineData(ZxConverterStyle.Instance, DwTier.Strict)]
+        [InlineData(ZxConverterStyle.GenericType, DwTier.Strict)]
+        [InlineData(ZxConverterStyle.GenericType, DwTier.Convenience)]
+        [InlineData(ZxConverterStyle.TypeObject, DwTier.Strict)]
+        [InlineData(ZxConverterStyle.Convention, DwTier.Strict)]
+        public void Zx_C1_a_converted_object_column_beside_a_top_level_denial(ZxConverterStyle style, DwTier tier)
+        {
+            using SqliteConnection connection = new("DataSource=:memory:");
+            connection.Open();
+
+            ZxConvContextBase db;
+
+            try
+            {
+                db = Create(style, connection);
+                db.Database.EnsureCreated();
+            }
+            catch (Exception e)
+            {
+                _out.WriteLine($"{style}: model not built: {e.GetType().Name}: {e.Message.Split('\n')[0]}");
+
+                return;
+            }
+
+            using (db)
+            {
+                db.Events.Add(new ZxConvEvent
+                {
+                    Kind = "CardIssued", Actor = "conv-actor-secret", Payload = new ZxIssued { Label = "visa", Pan = $"conv-pan-{style}" }
+                });
+                db.SaveChanges();
+                db.ChangeTracker.Clear();
+
+                IProperty payload = db.Model.FindEntityType(typeof(ZxConvEvent))!.FindProperty(nameof(ZxConvEvent.Payload))!;
+
+                _out.WriteLine($"{style}: GetValueConverter()={payload.GetValueConverter()?.GetType().Name ?? "null"} "
+                               + $"mapping.Converter={payload.GetTypeMapping().Converter?.GetType().Name ?? "null"}");
+
+                Assert.True(ZxKit.Holds(db.Events.AsNoTracking().ToList(), $"conv-pan-{style}"));
+
+                PolicyQueryable<ZxConvEvent> guarded = ZxKit.Guard(db.Events, tier);
+                object? data = ZxKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+                _out.WriteLine($"{style} {tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+                Assert.False(ZxKit.Holds(data, "conv-actor-secret"));
+                Assert.False(ZxKit.Holds(data, $"conv-pan-{style}"));
+
+                object? dynamicData = ZxKit.SafeRead(() => ZxKit.Guard(db.Events, tier).ToListDynamic(new Filter()).Data);
+
+                _out.WriteLine($"{style} {tier} dynamic: sent={ZxKit.Json(dynamicData)}");
+
+                Assert.False(ZxKit.Holds(dynamicData, $"conv-pan-{style}"));
+            }
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewDeclarationPrecisionTests.cs b/DynamicWhere.Tests/Policies/ReviewDeclarationPrecisionTests.cs
new file mode 100644
index 0000000..9fda2b7
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewDeclarationPrecisionTests.cs
@@ -0,0 +1,308 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+// A member that no declaration a row can run through the queried path denies stays filterable and is returned:
+// a sibling implementer's denial, a private or static member of the same name, an explicit implementation.
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ---- D1: one implementer of a widely shared interface denies its implementation -------------------------
+
+    public interface IZydAuditable
+    {
+        string? CreatedBy { get; }
+    }
+
+    public class ZydInvoice : IZydAuditable
+    {
+        public int Id { get; set; }
+
+        public string? CreatedBy { get; set; }
+    }
+
+    public class ZydPayslip : IZydAuditable
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? CreatedBy { get; set; }
+    }
+
+    // ---- D2: a subclass hides the member with a private one -----------------------------------------------
+
+    public class ZydNoteDto
+    {
+        public int Id { get; set; }
+
+        public string Text { get; set; } = string.Empty;
+    }
+
+    public class ZydRedactedNoteDto : ZydNoteDto
+    {
+        [DwDenied]
+        private new string Text { get; set; } = string.Empty;
+
+        public void Seal(string text) => Text = text;
+    }
+
+    // ---- D3: a subclass declares a static member of the same name -------------------------------------------
+
+    public class ZydRateDto
+    {
+        public int Id { get; set; }
+
+        public decimal Rate { get; set; }
+    }
+
+    public class ZydRateDefaultsDto : ZydRateDto
+    {
+        [DwDenied]
+        public static new decimal Rate { get; set; }
+    }
+
+    // ---- D4: a subclass implements an interface explicitly with a denied member of the same name -----------
+
+    public interface IZydCoded
+    {
+        string Code { get; }
+    }
+
+    public class ZydBadgeDto
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+    }
+
+    public class ZydSecretBadgeDto : ZydBadgeDto, IZydCoded
+    {
+        [DwDenied]
+        string IZydCoded.Code => "explicit-secret";
+    }
+
+    // ---- D5: a class with its own public member and an explicit implementation of a denying interface ------
+
+    public interface IZydSerialed
+    {
+        [DwDenied]
+        string Serial { get; }
+    }
+
+    public class ZydDevice : IZydSerialed
+    {
+        public int Id { get; set; }
+
+        public string Serial { get; set; } = string.Empty;
+
+        string IZydSerialed.Serial => "device-internal-serial";
+    }
+
+    // ---- D6: a sibling variant hides the member with new to withhold it in its own shape (documented limit) --
+
+    public class ZydEmployeeDto
+    {
+        public int Id { get; set; }
+
+        public decimal Salary { get; set; }
+    }
+
+    public class ZydPublicEmployeeDto : ZydEmployeeDto
+    {
+        [DwDenied]
+        public new decimal Salary { get; set; }
+    }
+
+    // ---- D7: an entity, and a generic interface one unrelated generic class implements over another argument --
+
+    public interface IZydKeyed<TKey>
+    {
+        TKey Key { get; }
+    }
+
+    public class ZydTicket : IZydKeyed<int>
+    {
+        public int Id { get; set; }
+
+        public int Key { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+    }
+
+    public class ZydVaultEntry<T> : IZydKeyed<string>
+    {
+        [DwDenied]
+        public string Key { get; set; } = string.Empty;
+
+        public T? Value { get; set; }
+    }
+
+    public sealed class ZydContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZydContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZydInvoice> Invoices => Set<ZydInvoice>();
+
+        public DbSet<ZydTicket> Tickets => Set<ZydTicket>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+    }
+
+    public sealed class ReviewDeclarationPrecisionTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZydContext _db;
+
+        public ReviewDeclarationPrecisionTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZydContext(_connection);
+            _db.Database.EnsureCreated();
+            _db.Invoices.Add(new ZydInvoice { CreatedBy = "alice" });
+            _db.Tickets.Add(new ZydTicket { Key = 7, Title = "T" });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = DwTier.Strict, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        private static Filter Where(string field, string value) => new()
+        {
+            ConditionGroup = new ConditionGroup
+            {
+                Conditions =
+                {
+                    new Condition
+                    {
+                        Field = field,
+                        DataType = decimal.TryParse(value, System.Globalization.NumberStyles.Number, System.Globalization.CultureInfo.InvariantCulture, out _) ? DataType.Number : DataType.Text,
+                        Operator = Operator.Equal,
+                        Values = { value }
+                    }
+                }
+            }
+        };
+
+        /// <summary>Filters on the member, then reads the rows whole; logs both and returns them.</summary>
+        private (string Filtered, List<T> Rows, PolicyQueryable<T> Guarded) Probe<T>(string label, IQueryable<T> source, string field, string value)
+            where T : class
+        {
+            string filtered;
+
+            try
+            {
+                filtered = "ran rows=" + Guard(source).ToList(Where(field, value)).Data.Count;
+            }
+            catch (PolicyException refusal)
+            {
+                filtered = refusal.ErrorCode.ToString();
+            }
+
+            PolicyQueryable<T> guarded = Guard(source);
+            List<T> rows = guarded.ToList(new Filter()).Data;
+
+            ZyLog.Write(_out, $"D {label}: Where({field})={filtered}; whole: dropped=[{ZyLog.Decisions(guarded)}]");
+
+            return (filtered, rows, guarded);
+        }
+
+        [Fact]
+        public void Zy_D1_an_entity_implementing_a_shared_interface_is_not_denied_by_a_sibling_implementer()
+        {
+            (string filtered, List<ZydInvoice> rows, PolicyQueryable<ZydInvoice> guarded) =
+                Probe("D1 entity beside a denying sibling implementer", _db.Invoices, "CreatedBy", "alice");
+
+            Assert.Equal("ran rows=1", filtered);
+            Assert.Equal("alice", rows.Single().CreatedBy);
+            Assert.False(ZyLog.AnyDropped(guarded), ZyLog.Decisions(guarded));
+        }
+
+        [Fact]
+        public void Zy_D2_a_private_member_a_subclass_hides_with_is_never_run_through_the_base_path()
+        {
+            ZydNoteDto[] notes = { new() { Id = 1, Text = "hello" } };
+
+            (string filtered, List<ZydNoteDto> rows, PolicyQueryable<ZydNoteDto> guarded) =
+                Probe("D2 private new in a subclass", notes.AsQueryable(), "Text", "hello");
+
+            Assert.Equal("ran rows=1", filtered);
+            Assert.Equal("hello", rows.Single().Text);
+            Assert.False(ZyLog.AnyDropped(guarded), ZyLog.Decisions(guarded));
+        }
+
+        [Fact]
+        public void Zy_D3_a_static_member_of_the_same_name_is_not_a_declaration_a_row_runs()
+        {
+            ZydRateDto[] rates = { new() { Id = 1, Rate = 2.5m } };
+
+            (string filtered, List<ZydRateDto> rows, PolicyQueryable<ZydRateDto> guarded) =
+                Probe("D3 static new in a subclass", rates.AsQueryable(), "Rate", "2.5");
+
+            Assert.StartsWith("ran", filtered);
+            Assert.Equal(2.5m, rows.Single().Rate);
+            Assert.False(ZyLog.AnyDropped(guarded), ZyLog.Decisions(guarded));
+        }
+
+        [Fact]
+        public void Zy_D4_an_explicit_implementation_in_a_subclass_does_not_deny_the_base_member()
+        {
+            ZydBadgeDto[] badges = { new() { Id = 1, Code = "B1" } };
+
+            (string filtered, List<ZydBadgeDto> rows, PolicyQueryable<ZydBadgeDto> guarded) =
+                Probe("D4 explicit implementation in a subclass", badges.AsQueryable(), "Code", "B1");
+
+            Assert.Equal("ran rows=1", filtered);
+            Assert.Equal("B1", rows.Single().Code);
+            Assert.False(ZyLog.AnyDropped(guarded), ZyLog.Decisions(guarded));
+        }
+
+        [Fact]
+        public void Zy_D5_a_public_member_beside_an_explicit_implementation_of_a_denying_interface()
+        {
+            ZydDevice[] devices = { new() { Id = 1, Serial = "S1" } };
+
+            (string filtered, List<ZydDevice> rows, PolicyQueryable<ZydDevice> guarded) =
+                Probe("D5 public member beside an explicit denying implementation", devices.AsQueryable(), "Serial", "S1");
+
+            Assert.Equal("ran rows=1", filtered);
+            Assert.Equal("S1", rows.Single().Serial);
+            Assert.False(ZyLog.AnyDropped(guarded), ZyLog.Decisions(guarded));
+        }
+
+        [Fact]
+        public void Zy_D7_an_entity_implementing_a_generic_interface_is_not_denied_by_an_open_generic_over_another_argument()
+        {
+            (string filtered, List<ZydTicket> rows, PolicyQueryable<ZydTicket> guarded) =
+                Probe("D7 entity beside an open generic implementer of IZydKeyed<string>", _db.Tickets, "Title", "T");
+
+            Assert.Equal("ran rows=1", filtered);
+            Assert.Equal(7, rows.Single().Key);
+            Assert.False(ZyLog.AnyDropped(guarded), ZyLog.Decisions(guarded));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewDefaultOrderTests.cs b/DynamicWhere.Tests/Policies/ReviewDefaultOrderTests.cs
new file mode 100644
index 0000000..4679c80
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewDefaultOrderTests.cs
@@ -0,0 +1,189 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+// DCMP's DW-13 shapes after 6c9e171's column-only rule: a projected row must still take its declared
+// default when it assigns every default field a mapped column, directly, through a reference
+// navigation or through EF.Property on a shadow property.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public class ZbTask
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public int? ZbTaskGroupId { get; set; }
+
+        public ZbTaskGroup? Group { get; set; }
+    }
+
+    public class ZbTaskGroup
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    [DwEntity(DefaultOrder = "Code desc")]
+    public class ZbTaskRow
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+    }
+
+    /// <summary>DCMP's shape with a denied member, so the guard also synthesizes a projection.</summary>
+    [DwEntity(DefaultOrder = "Code desc")]
+    public class ZbTaskSecretRow
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    [DwEntity(DefaultOrder = "Seq")]
+    public class ZbTaskSeqRow
+    {
+        public int Id { get; set; }
+
+        public short Seq { get; set; }
+    }
+
+    [DwEntity(DefaultOrder = "GroupName desc")]
+    public class ZbTaskGroupRow
+    {
+        public int Id { get; set; }
+
+        public string GroupName { get; set; } = string.Empty;
+    }
+
+    public sealed class ZbDefaultOrderContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZbDefaultOrderContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZbTask> Tasks => Set<ZbTask>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model) =>
+            model.Entity<ZbTask>().Property<short>("status_seq");
+    }
+
+    public sealed class ReviewDefaultOrderTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZbDefaultOrderContext _db;
+
+        public ReviewDefaultOrderTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+
+            _db = new ZbDefaultOrderContext(_connection);
+            _db.Database.EnsureCreated();
+
+            // Inserted B, C, A: none of the expected orders is the insertion order.
+            foreach ((string code, short seq, string group) in new[] { ("B", (short)2, "g2"), ("C", (short)1, "g3"), ("A", (short)3, "g1") })
+            {
+                ZbTask task = new() { Code = code, Group = new ZbTaskGroup { Name = group } };
+
+                _db.Tasks.Add(task);
+                _db.Entry(task).Property("status_seq").CurrentValue = seq;
+            }
+
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = DwTier.Strict, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        private string Log(string label, IEnumerable<int> ids)
+        {
+            string order = string.Join(",", ids.Select(id => _db.Tasks.AsNoTracking().Single(t => t.Id == id).Code));
+            string line = $"{label}: {order}";
+
+            _out.WriteLine(line);
+
+            return order;
+        }
+
+        [Fact]
+        public void Zb_G1_a_projected_row_assigning_a_column_takes_Code_desc()
+        {
+            IQueryable<ZbTaskRow> rows = _db.Tasks.Select(t => new ZbTaskRow { Id = t.Id, Code = t.Code });
+
+            Assert.Equal("C,B,A", Log("G1 typed", Guard(rows).ToList(new Filter()).Data.Select(r => r.Id)));
+            Assert.Equal("C,B", Log("G1 paged", Guard(rows).ToList(new Filter { Page = new PageBy { PageNumber = 1, PageSize = 2 } }).Data.Select(r => r.Id)));
+        }
+
+        [Fact]
+        public void Zb_G1b_a_projected_row_with_a_denied_member_still_takes_Code_desc()
+        {
+            IQueryable<ZbTaskSecretRow> rows = _db.Tasks.Select(t => new ZbTaskSecretRow { Id = t.Id, Code = t.Code, Secret = t.Code });
+
+            Assert.Equal("C,B,A", Log("G1b typed", Guard(rows).ToList(new Filter()).Data.Select(r => r.Id)));
+        }
+
+        [Fact]
+        public void Zb_G2_a_projected_row_bound_through_EF_Property_takes_its_default()
+        {
+            IQueryable<ZbTaskSeqRow> rows = _db.Tasks.Select(t => new ZbTaskSeqRow { Id = t.Id, Seq = EF.Property<short>(t, "status_seq") });
+
+            Assert.Equal("C,B,A", Log("G2 typed", Guard(rows).ToList(new Filter()).Data.Select(r => r.Id)));
+        }
+
+        [Fact]
+        public void Zb_G3_a_projected_row_reading_through_a_reference_navigation_takes_its_default()
+        {
+            IQueryable<ZbTaskGroupRow> rows = _db.Tasks.Select(t => new ZbTaskGroupRow { Id = t.Id, GroupName = t.Group!.Name });
+
+            Assert.Equal("C,B,A", Log("G3 typed", Guard(rows).ToList(new Filter()).Data.Select(r => r.Id)));
+        }
+
+        /// <summary>Informational: a computed value is left unordered by design since 6c9e171.</summary>
+        [Fact]
+        public void Zb_G4_a_projected_row_assigning_a_computed_value()
+        {
+            IQueryable<ZbTaskRow> rows = _db.Tasks.Select(t => new ZbTaskRow { Id = t.Id, Code = t.Code.Trim() });
+
+            Log("G4 typed (Trim)", Guard(rows).ToList(new Filter()).Data.Select(r => r.Id));
+        }
+
+        /// <summary>Informational: a projection over an anonymous intermediate row.</summary>
+        [Fact]
+        public void Zb_G5_a_projected_row_over_an_anonymous_intermediate()
+        {
+            IQueryable<ZbTaskRow> rows = _db.Tasks.Select(t => new { t.Id, t.Code }).Select(x => new ZbTaskRow { Id = x.Id, Code = x.Code });
+
+            Log("G5 typed (anonymous intermediate)", Guard(rows).ToList(new Filter()).Data.Select(r => r.Id));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewDenialsElsewhereTests.cs b/DynamicWhere.Tests/Policies/ReviewDenialsElsewhereTests.cs
new file mode 100644
index 0000000..421e742
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewDenialsElsewhereTests.cs
@@ -0,0 +1,1131 @@
+using System.Collections;
+using System.Reflection;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using DynamicWhere.ex.Policies.Storage;
+using DynamicWhere.ex.Policies.Validation;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ denials on other declarations: models
+
+    // ---- A1: a generic interface, implemented by an open generic class that denies the member ----------
+
+    public interface IZvHolder<T>
+    {
+        int Id { get; }
+
+        string? Secret { get; }
+    }
+
+    public class ZvHolderImpl<T> : IZvHolder<T>
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    /// <summary>Control: the same interface shape, implemented by a closed class.</summary>
+    public interface IZvClosedHolder<T>
+    {
+        int Id { get; }
+
+        string? Secret { get; }
+    }
+
+    public class ZvIntClosedHolder : IZvClosedHolder<int>
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    /// <summary>Control: a plain interface implemented by an open generic class.</summary>
+    public interface IZvPlainHolder
+    {
+        int Id { get; }
+
+        string? Secret { get; }
+    }
+
+    public class ZvGenPlainHolder<T> : IZvPlainHolder
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    public class ZvHolderRow
+    {
+        public int Id { get; set; }
+
+        public IZvHolder<int>? Holder { get; set; }
+    }
+
+    // ---- A1b: a generic base class whose open generic subclass overrides and denies ---------------------
+
+    public class ZvBox<T>
+    {
+        public int Id { get; set; }
+
+        public virtual string? Code { get; set; }
+    }
+
+    public class ZvSecretBox<T> : ZvBox<T>
+    {
+        [DwDenied]
+        public override string? Code
+        {
+            get => base.Code;
+            set => base.Code = value;
+        }
+    }
+
+    // ---- A2: an explicit interface implementation that denies the member --------------------------------
+
+    public interface IZvLocker
+    {
+        int Id { get; }
+
+        string? Pin { get; }
+    }
+
+    public class ZvLocker : IZvLocker
+    {
+        private string? _pin;
+
+        public int Id { get; set; }
+
+        [DwDenied]
+        string? IZvLocker.Pin => _pin;
+
+        public void Seal(string pin) => _pin = pin;
+    }
+
+    public class ZvLockerRoom
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public Dictionary<string, IZvLocker> Lockers { get; set; } = new();
+    }
+
+    // ---- A3: an interface member's denial, on a member a subtype of the queried type implements ---------
+
+    public interface IZvTaxed
+    {
+        [DwDenied]
+        string? TaxId { get; }
+    }
+
+    public class ZvFirm
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZvTaxedFirm : ZvFirm, IZvTaxed
+    {
+        public string? TaxId { get; set; }
+    }
+
+    /// <summary>Control: a subtype with the attribute on its own member, on a base of its own.</summary>
+    public class ZvFirmB
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZvDirectTaxedFirm : ZvFirmB
+    {
+        [DwDenied]
+        public string? TaxNumber { get; set; }
+    }
+
+    public class ZvFirmHolder
+    {
+        public int Id { get; set; }
+
+        public ZvFirm? Firm { get; set; }
+    }
+
+    // ---- A4: an interface member's denial, reached through a framework generic -------------------------
+
+    public interface IZvCardish
+    {
+        [DwDenied]
+        string? Pan { get; }
+    }
+
+    public class ZvCardImpl : IZvCardish
+    {
+        public string Label { get; set; } = string.Empty;
+
+        public string? Pan { get; set; }
+    }
+
+    public class ZvWallet
+    {
+        public int Id { get; set; }
+
+        public string Owner { get; set; } = string.Empty;
+
+        public Dictionary<string, ZvCardImpl> Cards { get; set; } = new();
+    }
+
+    public class ZvCardDirect
+    {
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZvWalletDirect
+    {
+        public int Id { get; set; }
+
+        public string Owner { get; set; } = string.Empty;
+
+        public Dictionary<string, ZvCardDirect> Cards { get; set; } = new();
+    }
+
+    // ---- A5: an override of the setter alone ----------------------------------------------------------
+
+    public class ZvGadget
+    {
+        public int Id { get; set; }
+
+        public virtual string? Code { get; set; }
+    }
+
+    public class ZvSetOnlyGadget : ZvGadget
+    {
+        [DwDenied]
+        public override string? Code
+        {
+            set => base.Code = value;
+        }
+    }
+
+    // ---- A6: a member hidden with new rather than overridden --------------------------------------------
+
+    public class ZvDevice
+    {
+        public int Id { get; set; }
+
+        public string? Serial { get; set; }
+    }
+
+    public class ZvHiddenDevice : ZvDevice
+    {
+        [DwDenied]
+        public new string? Serial
+        {
+            get => base.Serial;
+            set => base.Serial = value;
+        }
+    }
+
+    /// <summary>A member hidden with new that keeps its own value, as new usually does.</summary>
+    public class ZvDevice2
+    {
+        public int Id { get; set; }
+
+        public string? Serial { get; set; }
+    }
+
+    public class ZvHiddenDevice2 : ZvDevice2
+    {
+        [DwDenied]
+        public new string? Serial { get; set; }
+    }
+
+    // ---- A7: an override two levels down, of an abstract member ----------------------------------------
+
+    public abstract class ZvInstrument
+    {
+        public int Id { get; set; }
+
+        public abstract string? Code { get; set; }
+    }
+
+    public class ZvMidInstrument : ZvInstrument
+    {
+        public override string? Code { get; set; }
+    }
+
+    public class ZvLeafInstrument : ZvMidInstrument
+    {
+        [DwDenied]
+        public override string? Code
+        {
+            get => base.Code;
+            set => base.Code = value;
+        }
+    }
+
+    // ---- A8: an overridable and a sealed denial on a subtype's overrides --------------------------------
+
+    public class ZvMeter
+    {
+        public int Id { get; set; }
+
+        public virtual string? Reading { get; set; }
+
+        public virtual string? Serial { get; set; }
+    }
+
+    public class ZvSmartMeter : ZvMeter
+    {
+        [DwNoWhere(Overridable = true)]
+        public override string? Reading
+        {
+            get => base.Reading;
+            set => base.Reading = value;
+        }
+
+        [DwNoWhere]
+        public override string? Serial
+        {
+            get => base.Serial;
+            set => base.Serial = value;
+        }
+    }
+
+    public class ZvAnalogMeter : ZvMeter
+    {
+    }
+
+    // ---- A9: a transform on a subtype's override, which is documented as read from the declaration walked
+
+    public class ZvContactCard
+    {
+        public int Id { get; set; }
+
+        public virtual string? Phone { get; set; }
+    }
+
+    public class ZvMaskedContactCard : ZvContactCard
+    {
+        [DwMask(MaskStrategy.Full)]
+        public override string? Phone
+        {
+            get => base.Phone;
+            set => base.Phone = value;
+        }
+    }
+
+    // ---- A10: a rule on a subtype's member through a base-typed member, spelled in another letter case
+
+    public class ZvKennel
+    {
+        public int Id { get; set; }
+
+        public ZvKennelPet? Pet { get; set; }
+    }
+
+    public class ZvKennelPet
+    {
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZvKennelHamster : ZvKennelPet
+    {
+        public string? Tag { get; set; }
+    }
+
+    // ---- B1: siblings, and a concrete type's own subtype ----------------------------------------------
+
+    public class ZvCar
+    {
+        public int Id { get; set; }
+
+        public virtual string? Plate { get; set; }
+    }
+
+    public class ZvArmoredCar : ZvCar
+    {
+        [DwDenied]
+        public override string? Plate
+        {
+            get => base.Plate;
+            set => base.Plate = value;
+        }
+    }
+
+    public class ZvTaxi : ZvCar
+    {
+    }
+
+    public class ZvLimo : ZvTaxi
+    {
+        [DwNoOrder]
+        public override string? Plate
+        {
+            get => base.Plate;
+            set => base.Plate = value;
+        }
+    }
+
+    // ---- B2: a widely shared interface, one implementer denies -------------------------------------------
+
+    public interface IZvNamed
+    {
+        string Name { get; }
+    }
+
+    public class ZvCity : IZvNamed
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZvSpy : IZvNamed
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZvPin
+    {
+        public int Id { get; set; }
+
+        public IZvNamed? Place { get; set; }
+    }
+
+    // ---- B3: the startup scan over a default order a subtype's override denies overridably -------------
+
+    [DwEntity(DefaultOrder = "Rank")]
+    public class ZvRanked
+    {
+        public int Id { get; set; }
+
+        public virtual int Rank { get; set; }
+    }
+
+    public class ZvSecretlyRanked : ZvRanked
+    {
+        [DwNoOrder(Overridable = true)]
+        public override int Rank
+        {
+            get => base.Rank;
+            set => base.Rank = value;
+        }
+    }
+
+    /// <summary>Control: the same denial on the type's own member, which the scan reads as a warning.</summary>
+    [DwEntity(DefaultOrder = "Rank")]
+    public class ZvOwnRanked
+    {
+        public int Id { get; set; }
+
+        [DwNoOrder(Overridable = true)]
+        public int Rank { get; set; }
+    }
+
+    // ---- A3 on EF Core: a TPH root whose derived entity implements the interface ------------------------
+
+    public class ZvEfFirm
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZvEfTaxedFirm : ZvEfFirm, IZvTaxed
+    {
+        public string? TaxId { get; set; }
+    }
+
+    /// <summary>An entity implementing the shared interface one unrelated DTO denies.</summary>
+    public class ZvEfCity : IZvNamed
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    /// <summary>An entity the model maps alone.</summary>
+    public class ZvEfVehicle
+    {
+        public int Id { get; set; }
+
+        public virtual string? Code { get; set; }
+    }
+
+    /// <summary>A class the model does not map, which EF Core can never materialize for ZvEfVehicle's set.</summary>
+    public class ZvVehicleView : ZvEfVehicle
+    {
+        [DwDenied]
+        public override string? Code
+        {
+            get => base.Code;
+            set => base.Code = value;
+        }
+    }
+
+    public sealed class ZvDenialsContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZvDenialsContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZvEfFirm> Firms => Set<ZvEfFirm>();
+
+        public DbSet<ZvEfCity> Cities => Set<ZvEfCity>();
+
+        public DbSet<ZvEfVehicle> Vehicles => Set<ZvEfVehicle>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model) => model.Entity<ZvEfTaxedFirm>();
+    }
+
+    // ============================================================================ denials on other declarations: tests
+
+    /// <summary>
+    /// The denials read from another declaration of a member: an interface member, an implementation, an override
+    /// and a member hidden with new, through every path a row reaches them by.
+    /// </summary>
+    public sealed class ReviewDenialsElsewhereTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZvDenialsContext _db;
+
+        public ReviewDenialsElsewhereTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZvDenialsContext(_connection);
+            _db.Database.EnsureCreated();
+            _db.Firms.Add(new ZvEfTaxedFirm { Name = "Acme", TaxId = "ef-tax-secret" });
+            _db.Firms.Add(new ZvEfFirm { Name = "Plain" });
+            _db.Cities.Add(new ZvEfCity { Name = "Basra" });
+            _db.Vehicles.Add(new ZvEfVehicle { Code = "V-1" });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict, params IDwPolicyProvider[] more)
+            where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }.Concat(more).ToArray()));
+
+        private static Filter Where(string field, string value) => new()
+        {
+            ConditionGroup = new ConditionGroup
+            {
+                Conditions = { new Condition { Field = field, DataType = DataType.Text, Operator = Operator.Equal, Values = { value } } }
+            }
+        };
+
+        private static Filter OrderedBy(string field) => new() { Orders = new List<OrderBy> { new() { Field = field } } };
+
+        private static Summary GroupedBy(string field) => new()
+        {
+            GroupBy = new GroupBy
+            {
+                Fields = new List<string> { field },
+                AggregateBy = new List<AggregateBy> { new() { Alias = "Total", Aggregator = Aggregator.Count } }
+            }
+        };
+
+        /// <summary>The error code a guarded call refused with, or null when it ran.</summary>
+        private string Code(Action run)
+        {
+            try
+            {
+                run();
+
+                return "ran";
+            }
+            catch (PolicyException refusal)
+            {
+                return refusal.ErrorCode.ToString();
+            }
+            catch (Exception other)
+            {
+                return $"{other.GetType().Name}: {other.Message.Split('\n')[0]}";
+            }
+        }
+
+        private static IEnumerable<PolicyFragment> Denials(Type type, string path) =>
+            new AttributePolicyProvider().GetFragments(type, new DwPolicyContext())
+                .Where(f => f.Effect == PolicyEffect.Deny && string.Equals(f.FieldPath, path, StringComparison.Ordinal));
+
+        /// <summary>Everything reachable from a value, read by runtime type, including explicit interface members.</summary>
+        private static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is ValueType || current is MemberInfo)
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held == text)
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (!seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IDictionary map)
+                {
+                    foreach (object? item in map.Values)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                if (current is IEnumerable items)
+                {
+                    foreach (object? item in items)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                foreach (PropertyInfo property in current.GetType().GetProperties(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance))
+                {
+                    if (property.GetIndexParameters().Length != 0 || !property.CanRead)
+                    {
+                        continue;
+                    }
+
+                    try
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                    catch
+                    {
+                        // A getter that throws holds nothing readable.
+                    }
+                }
+            }
+
+            return false;
+        }
+
+        private static object? SafeRead(Func<object?> read)
+        {
+            try
+            {
+                return read();
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode is PolicyErrorCode.FieldDeniedForSelect or PolicyErrorCode.AllSelectsDenied)
+            {
+                return null;
+            }
+            catch (LogicException)
+            {
+                // The core refused to build the projection: nothing returned.
+                return null;
+            }
+        }
+
+        // ------------------------------------------------------------------------------------------------ A1
+
+        [Fact]
+        public void Zv_A1_a_generic_interface_implemented_by_an_open_generic_class_carries_its_denial()
+        {
+            _out.WriteLine("IZvHolder<int>.Secret denials: " + Denials(typeof(IZvHolder<int>), "Secret").Count());
+            _out.WriteLine("control IZvClosedHolder<int>.Secret denials: " + Denials(typeof(IZvClosedHolder<int>), "Secret").Count());
+            _out.WriteLine("control IZvPlainHolder.Secret denials: " + Denials(typeof(IZvPlainHolder), "Secret").Count());
+
+            Assert.NotEmpty(Denials(typeof(IZvClosedHolder<int>), "Secret"));
+            Assert.NotEmpty(Denials(typeof(IZvPlainHolder), "Secret"));
+            Assert.NotEmpty(Denials(typeof(IZvHolder<int>), "Secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_A1_filtering_a_generic_interface_on_the_member_its_open_generic_implementation_denies(DwTier tier)
+        {
+            IZvHolder<int>[] rows = { new ZvHolderImpl<int> { Id = 1, Secret = "generic-iface-secret" } };
+
+            string where = Code(() => Guard(rows.AsQueryable(), tier).ToList(Where("Secret", "generic-iface-secret")));
+            string order = Code(() => Guard(rows.AsQueryable(), tier).ToList(OrderedBy("Secret")));
+            string group = Code(() => Guard(rows.AsQueryable(), tier).ToList(GroupedBy("Secret")));
+
+            _out.WriteLine($"where={where} order={order} group={group}");
+
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), where);
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForGroup), group);
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_A1_rows_read_through_a_generic_interface_whose_open_generic_implementation_denies(DwTier tier)
+        {
+            IZvHolder<int>[] rows = { new ZvHolderImpl<int> { Id = 1, Secret = "generic-iface-secret" } };
+
+            PolicyQueryable<IZvHolder<int>> guarded = Guard(rows.AsQueryable(), tier);
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine("result: " + JsonSerializer.Serialize(data) + " decisions: "
+                           + string.Join(" | ", guarded.LastTrace?.Decisions.Select(d => $"{d.FieldPath} {d.Action}") ?? Array.Empty<string>()));
+
+            Assert.False(Holds(data, "generic-iface-secret"));
+        }
+
+        [Fact]
+        public void Zv_A1_a_member_typed_as_the_generic_interface()
+        {
+            ZvHolderRow[] rows = { new() { Id = 1, Holder = new ZvHolderImpl<int> { Id = 2, Secret = "generic-member-secret" } } };
+
+            string where = Code(() => Guard(rows.AsQueryable()).ToList(Where("Holder.Secret", "generic-member-secret")));
+            object? whole = SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data);
+
+            _out.WriteLine($"where on Holder.Secret={where}; whole result holds it={Holds(whole, "generic-member-secret")}");
+
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), where);
+            Assert.False(Holds(whole, "generic-member-secret"));
+        }
+
+        [Fact]
+        public void Zv_A1_control_a_closed_implementation_of_the_generic_interface_is_refused()
+        {
+            IZvClosedHolder<int>[] rows = { new ZvIntClosedHolder { Id = 1, Secret = "closed-secret" } };
+
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), Code(() => Guard(rows.AsQueryable()).ToList(Where("Secret", "closed-secret"))));
+        }
+
+        [Fact]
+        public void Zv_A1b_a_generic_base_class_whose_open_generic_subclass_overrides_and_denies()
+        {
+            ZvBox<int>[] rows = { new ZvSecretBox<int> { Id = 1, Code = "box-secret" } };
+
+            _out.WriteLine("ZvBox<int>.Code denials: " + Denials(typeof(ZvBox<int>), "Code").Count());
+
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), Code(() => Guard(rows.AsQueryable()).ToList(Where("Code", "box-secret"))));
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data), "box-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ A2
+
+        [Fact]
+        public void Zv_A2_an_explicit_interface_implementation_denies_the_interface_path()
+        {
+            ZvLocker locker = new() { Id = 1 };
+            locker.Seal("pin-secret");
+            IZvLocker[] rows = { locker };
+
+            _out.WriteLine("IZvLocker.Pin denials: " + Denials(typeof(IZvLocker), "Pin").Count());
+
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), Code(() => Guard(rows.AsQueryable()).ToList(Where("Pin", "pin-secret"))));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_A2_an_explicit_implementation_held_in_a_framework_generic(DwTier tier)
+        {
+            ZvLocker locker = new() { Id = 1 };
+            locker.Seal("pin-secret");
+            ZvLockerRoom[] rows = { new() { Id = 1, Name = "R", Lockers = { ["a"] = locker } } };
+
+            object? unguarded = rows;
+            Assert.Contains("pin-secret", JsonSerializer.Serialize(unguarded));
+
+            object? guarded = SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data);
+            object? named = SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter { Selects = new List<string> { "Id", "Lockers" } }).Data);
+
+            _out.WriteLine("whole: " + JsonSerializer.Serialize(guarded));
+            _out.WriteLine("named: " + JsonSerializer.Serialize(named));
+
+            Assert.DoesNotContain("pin-secret", JsonSerializer.Serialize(guarded));
+            Assert.DoesNotContain("pin-secret", JsonSerializer.Serialize(named));
+        }
+
+        // ------------------------------------------------------------------------------------------------ A3
+
+        [Fact]
+        public void Zv_A3_control_the_class_that_implements_the_interface_is_policed()
+        {
+            ZvTaxedFirm[] rows = { new() { Id = 1, Name = "Acme", TaxId = "tax-secret" } };
+
+            Assert.NotEmpty(Denials(typeof(ZvTaxedFirm), "TaxId"));
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), Code(() => Guard(rows.AsQueryable()).ToList(Where("TaxId", "tax-secret"))));
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data), "tax-secret"));
+        }
+
+        [Fact]
+        public void Zv_A3_control_a_subtypes_own_attribute_through_the_base_type()
+        {
+            ZvFirmB[] rows = { new ZvDirectTaxedFirm { Id = 1, Name = "Acme", TaxNumber = "direct-tax-secret" } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data), "direct-tax-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_A3_rows_in_memory_read_through_a_base_type_whose_subtype_implements_the_denying_interface(DwTier tier)
+        {
+            ZvFirm[] rows = { new ZvTaxedFirm { Id = 1, Name = "Acme", TaxId = "tax-secret" } };
+
+            PolicyQueryable<ZvFirm> guarded = Guard(rows.AsQueryable(), tier);
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine("types: " + string.Join(",", ((IEnumerable?)data ?? Array.Empty<object>()).Cast<object>().Select(r => r.GetType().Name)));
+
+            Assert.False(Holds(data, "tax-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_A3_a_base_typed_member_holding_the_subtype(DwTier tier)
+        {
+            ZvFirmHolder[] rows = { new() { Id = 1, Firm = new ZvTaxedFirm { Id = 2, Name = "Acme", TaxId = "tax-secret" } } };
+
+            object? whole = SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data);
+            object? named = SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter { Selects = new List<string> { "Id", "Firm" } }).Data);
+
+            Assert.False(Holds(whole, "tax-secret"));
+            Assert.False(Holds(named, "tax-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_A3_an_entity_hierarchy_root_whose_derived_entity_implements_the_denying_interface(DwTier tier)
+        {
+            Assert.True(Holds(_db.Firms.AsNoTracking().ToList(), "ef-tax-secret"));
+
+            PolicyQueryable<ZvEfFirm> guarded = Guard(_db.Firms, tier);
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine("types: " + string.Join(",", ((IEnumerable?)data ?? Array.Empty<object>()).Cast<object>().Select(r => r.GetType().Name)));
+
+            Assert.False(Holds(data, "ef-tax-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(_db.Firms, tier).ToListDynamic(new Filter()).Data), "ef-tax-secret"));
+        }
+
+        [Fact]
+        public void Zv_A3_control_the_derived_entity_queried_itself_is_policed()
+        {
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), Code(() => Guard(_db.Firms.OfType<ZvEfTaxedFirm>()).ToList(Where("TaxId", "x"))));
+            Assert.False(Holds(SafeRead(() => Guard(_db.Firms.OfType<ZvEfTaxedFirm>()).ToList(new Filter()).Data), "ef-tax-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ A4
+
+        [Fact]
+        public void Zv_A4_control_a_framework_generic_of_a_class_that_denies_its_own_member()
+        {
+            ZvWalletDirect[] rows = { new() { Id = 1, Owner = "O", Cards = { ["a"] = new ZvCardDirect { Label = "visa", Pan = "direct-pan-secret" } } } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data), "direct-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_A4_a_framework_generic_of_a_class_whose_interface_denies_the_member(DwTier tier)
+        {
+            ZvWallet[] rows = { new() { Id = 1, Owner = "O", Cards = { ["a"] = new ZvCardImpl { Label = "visa", Pan = "iface-pan-secret" } } } };
+
+            object? whole = SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data);
+            object? named = SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter { Selects = new List<string> { "Id", "Cards" } }).Data);
+
+            _out.WriteLine("whole: " + JsonSerializer.Serialize(whole));
+            _out.WriteLine("named: " + JsonSerializer.Serialize(named));
+
+            Assert.False(Holds(whole, "iface-pan-secret"));
+            Assert.False(Holds(named, "iface-pan-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ A5
+
+        [Fact]
+        public void Zv_A5_an_override_of_the_setter_alone()
+        {
+            PropertyInfo declared = typeof(ZvSetOnlyGadget).GetProperty("Code")!;
+
+            _out.WriteLine($"ZvSetOnlyGadget.Code: declaring={declared.DeclaringType!.Name} canRead={declared.CanRead}");
+            _out.WriteLine("ZvSetOnlyGadget.Code denials: " + Denials(typeof(ZvSetOnlyGadget), "Code").Count());
+            _out.WriteLine("ZvGadget.Code denials: " + Denials(typeof(ZvGadget), "Code").Count());
+
+            ZvGadget[] rows = { new ZvSetOnlyGadget { Id = 1, Code = "setter-secret" } };
+            ZvSetOnlyGadget[] own = { new() { Id = 1, Code = "setter-secret" } };
+
+            string direct = Code(() => Guard(own.AsQueryable()).ToList(Where("Code", "setter-secret")));
+            string through = Code(() => Guard(rows.AsQueryable()).ToList(Where("Code", "setter-secret")));
+
+            _out.WriteLine($"queried as the subtype: {direct}; through the base type: {through}");
+
+            object? data = SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data);
+            string sent = JsonSerializer.Serialize(data);
+
+            // The runtime type's PropertyInfo has no getter, so a reflection walk misses it; a serializer does not.
+            _out.WriteLine("through the base type, the result sent: " + sent);
+
+            // The same member of the same rows: whatever the subtype says, the base path should say too.
+            Assert.Equal(direct, through);
+            Assert.DoesNotContain("setter-secret", sent);
+        }
+
+        // ------------------------------------------------------------------------------------------------ A6
+
+        [Fact]
+        public void Zv_A6_a_member_hidden_with_new_denies_the_base_path()
+        {
+            ZvDevice[] rows = { new ZvHiddenDevice { Id = 1, Serial = "hidden-secret" } };
+            ZvHiddenDevice[] own = { new() { Id = 1, Serial = "hidden-secret" } };
+
+            string direct = Code(() => Guard(own.AsQueryable()).ToList(Where("Serial", "hidden-secret")));
+            string through = Code(() => Guard(rows.AsQueryable()).ToList(Where("Serial", "hidden-secret")));
+            object? data = SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data);
+
+            _out.WriteLine($"queried as the subtype: {direct}; through the base type: {through}; result holds: {Holds(data, "hidden-secret")}");
+
+            // Whether the new member reads the one it hides cannot be told, so the base path is denied too.
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), direct);
+            Assert.Equal(direct, through);
+            Assert.False(Holds(data, "hidden-secret"));
+        }
+
+        [Fact]
+        public void Zv_A6_a_member_hidden_with_new_that_keeps_its_own_value()
+        {
+            ZvDevice2[] rows = { new ZvHiddenDevice2 { Id = 1, Serial = "hidden-own-secret" } };
+            ((ZvDevice2)rows[0]).Serial = "public-serial";
+
+            PolicyQueryable<ZvDevice2> guarded = Guard(rows.AsQueryable());
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine("types: " + string.Join(",", ((IEnumerable?)data ?? Array.Empty<object>()).Cast<object>().Select(r => r.GetType().Name))
+                           + "; decisions: " + string.Join(" | ", guarded.LastTrace?.Decisions.Select(d => $"{d.FieldPath} {d.Action}") ?? Array.Empty<string>()));
+
+            // A row of the subtype still holds the hidden member's own value; a runtime-type serializer writes it.
+            Assert.False(Holds(data, "hidden-own-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ A7
+
+        [Fact]
+        public void Zv_A7_an_override_two_levels_down_of_an_abstract_member()
+        {
+            ZvInstrument[] root = { new ZvLeafInstrument { Id = 1, Code = "leaf-secret" } };
+            ZvMidInstrument[] mid = { new ZvLeafInstrument { Id = 1, Code = "leaf-secret" } };
+
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), Code(() => Guard(root.AsQueryable()).ToList(Where("Code", "leaf-secret"))));
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), Code(() => Guard(mid.AsQueryable()).ToList(Where("Code", "leaf-secret"))));
+            Assert.False(Holds(SafeRead(() => Guard(mid.AsQueryable()).ToList(new Filter()).Data), "leaf-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ A8
+
+        [Fact]
+        public void Zv_A8_a_rule_lifts_an_overridable_subtype_denial_and_not_a_sealed_one()
+        {
+            ZvMeter[] rows = { new ZvSmartMeter { Id = 1, Reading = "r", Serial = "s" } };
+            FakePolicyProvider allow = new FakePolicyProvider()
+                .Add("Reading", PolicyFeature.Where, PolicyEffect.Allow, PolicyLevel.DynamicGlobal)
+                .Add("Serial", PolicyFeature.Where, PolicyEffect.Allow, PolicyLevel.DynamicGlobal);
+
+            string readingWithout = Code(() => Guard(rows.AsQueryable()).ToList(Where("Reading", "r")));
+            string readingLifted = Code(() => Guard(rows.AsQueryable(), DwTier.Strict, allow).ToList(Where("Reading", "r")));
+            string serialLifted = Code(() => Guard(rows.AsQueryable(), DwTier.Strict, allow).ToList(Where("Serial", "s")));
+
+            _out.WriteLine($"Reading unlifted={readingWithout} lifted={readingLifted}; Serial with an allow rule={serialLifted}");
+
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), readingWithout);
+            Assert.Equal("ran", readingLifted);
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), serialLifted);
+        }
+
+        [Fact]
+        public void Zv_A8_the_store_refuses_a_rule_on_the_base_path_a_subtype_seals_and_not_on_a_sibling()
+        {
+            PolicyRule onBase = new(DwSubjectKind.Global, null, typeof(ZvMeter).FullName!, "Serial", PolicyFeature.Where, PolicyEffect.Allow);
+            PolicyRule onSibling = new(DwSubjectKind.Global, null, typeof(ZvAnalogMeter).FullName!, "Serial", PolicyFeature.Where, PolicyEffect.Allow);
+            PolicyRule overridable = new(DwSubjectKind.Global, null, typeof(ZvMeter).FullName!, "Reading", PolicyFeature.Where, PolicyEffect.Allow);
+
+            Func<string, Type?> resolve = name => name == typeof(ZvMeter).FullName ? typeof(ZvMeter)
+                : name == typeof(ZvAnalogMeter).FullName ? typeof(ZvAnalogMeter) : null;
+
+            Exception? baseRefusal = Record.Exception(() => SealedFields.Refuse(onBase, resolve, "rule"));
+            Exception? siblingRefusal = Record.Exception(() => SealedFields.Refuse(onSibling, resolve, "rule"));
+            Exception? overridableRefusal = Record.Exception(() => SealedFields.Refuse(overridable, resolve, "rule"));
+
+            _out.WriteLine($"base: {baseRefusal?.Message}");
+            _out.WriteLine($"sibling: {siblingRefusal?.Message}");
+            _out.WriteLine($"overridable: {overridableRefusal?.Message}");
+
+            Assert.IsType<ArgumentException>(baseRefusal);
+            Assert.Null(siblingRefusal);
+            Assert.Null(overridableRefusal);
+        }
+
+        // ------------------------------------------------------------------------------------------------ A9
+
+        // ------------------------------------------------------------------------------------------------ A10
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_A10_a_rule_on_a_subtype_member_spelled_in_another_case_is_enforced(DwTier tier)
+        {
+            ZvKennel[] rows = { new() { Id = 1, Pet = new ZvKennelHamster { Name = "Ham", Tag = "case-tag-secret" } } };
+            FakePolicyProvider rules = new FakePolicyProvider()
+                .Add("pet.TAG", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier, rules).ToList(new Filter()).Data), "case-tag-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier, rules)
+                .ToList(new Filter { Selects = new List<string> { "Id", "Pet" } }).Data), "case-tag-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ B1
+
+        [Fact]
+        public void Zv_B1_a_sibling_override_does_not_reach_a_concrete_type_and_its_own_subtype_does()
+        {
+            ZvTaxi[] taxis = { new() { Id = 1, Plate = "taxi-plate" } };
+
+            Assert.Empty(Denials(typeof(ZvTaxi), "Plate").Where(f => (f.Features & PolicyFeature.Where) != 0));
+            Assert.Equal("ran", Code(() => Guard(taxis.AsQueryable()).ToList(Where("Plate", "taxi-plate"))));
+            Assert.Equal("ran", Code(() => Guard(taxis.AsQueryable()).ToList(GroupedBy("Plate"))));
+            Assert.True(Holds(Guard(taxis.AsQueryable()).ToList(new Filter()).Data, "taxi-plate"));
+
+            // ZvLimo, a subtype of ZvTaxi, denies ordering on Plate: that reaches ZvTaxi's path.
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForOrder), Code(() => Guard(taxis.AsQueryable()).ToList(OrderedBy("Plate"))));
+
+            // ZvArmoredCar, a sibling, denies everything: the base path is denied, ZvTaxi's is not.
+            ZvCar[] cars = { new ZvTaxi { Id = 1, Plate = "taxi-plate" } };
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), Code(() => Guard(cars.AsQueryable()).ToList(Where("Plate", "taxi-plate"))));
+        }
+
+        // ------------------------------------------------------------------------------------------------ B2
+
+        [Fact]
+        public void Zv_B2_one_implementer_of_a_shared_interface_denies_the_interface_path_for_every_row()
+        {
+            ZvCity[] cities = { new() { Id = 1, Name = "Basra" } };
+            IZvNamed[] named = { new ZvCity { Id = 1, Name = "Basra" } };
+            ZvPin[] pins = { new() { Id = 1, Place = new ZvCity { Id = 2, Name = "Basra" } } };
+
+            string city = Code(() => Guard(cities.AsQueryable()).ToList(Where("Name", "Basra")));
+            string iface = Code(() => Guard(named.AsQueryable()).ToList(Where("Name", "Basra")));
+            string member = Code(() => Guard(pins.AsQueryable()).ToList(Where("Place.Name", "Basra")));
+            string whole = Code(() => Guard(pins.AsQueryable()).ToList(new Filter()));
+
+            _out.WriteLine($"class={city} interface={iface} interface-typed member={member} whole row={whole}");
+
+            Assert.Equal("ran", city);
+        }
+
+        /// <summary>
+        /// An EF Core query over one entity set, read through the interface the entity implements: an unrelated
+        /// implementer's denial (ZvSpy, not even an entity) decides the interface path for every row.
+        /// </summary>
+        [Fact]
+        public void Zv_B2_an_entity_set_read_through_a_shared_interface_takes_an_unrelated_implementers_denial()
+        {
+            IQueryable<IZvNamed> cities = _db.Cities;
+
+            string concrete = Code(() => Guard(_db.Cities).ToList(Where("Name", "Basra")));
+            string where = Code(() => Guard(cities).ToList(Where("Name", "Basra")));
+            string whole = Code(() => Guard(cities).ToList(new Filter()));
+            string dynamic = Code(() => Guard(cities).ToListDynamic(new Filter()));
+
+            _out.WriteLine($"concrete set Where={concrete}; through the interface: Where={where} ToList={whole} ToListDynamic={dynamic}");
+
+            Assert.Equal("ran", concrete);
+        }
+
+        /// <summary>
+        /// A class the EF Core model does not map overrides and denies an entity's member. EF Core never returns
+        /// one from the entity's set, but the walk reads every loaded subtype, so the entity's own path is denied:
+        /// a documented limit, which fails closed.
+        /// </summary>
+        [Fact]
+        public void Zv_B5_a_subclass_EF_Core_does_not_map_still_denies_the_entitys_path()
+        {
+            Assert.Null(_db.Model.FindEntityType(typeof(ZvVehicleView)));
+
+            string where = Code(() => Guard(_db.Vehicles).ToList(Where("Code", "V-1")));
+            object? data = SafeRead(() => Guard(_db.Vehicles).ToList(new Filter()).Data);
+
+            _out.WriteLine($"Where={where} whole={JsonSerializer.Serialize(data)}");
+
+            Assert.Equal(nameof(PolicyErrorCode.FieldDeniedForWhere), where);
+            Assert.False(Holds(data, "V-1"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ B3
+
+        [Fact]
+        public void Zv_B3_the_startup_scan_reads_a_subtypes_overridable_denial_of_a_default_order_as_a_warning()
+        {
+            PolicyModelReport subtype = PolicyModelValidator.Inspect(new[] { typeof(ZvRanked) });
+            PolicyModelReport own = PolicyModelValidator.Inspect(new[] { typeof(ZvOwnRanked) });
+
+            _out.WriteLine("subtype's override: errors=[" + string.Join(" | ", subtype.Errors) + "] warnings=[" + string.Join(" | ", subtype.Warnings) + "]");
+            _out.WriteLine("own member: errors=[" + string.Join(" | ", own.Errors) + "] warnings=[" + string.Join(" | ", own.Warnings) + "]");
+
+            // The control: an overridable denial on the type's own member is a warning.
+            Assert.Empty(own.Errors);
+            Assert.NotEmpty(own.Warnings);
+
+            // The same overridable denial on a subtype's override should read the same way.
+            Assert.Empty(subtype.Errors);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewGateTests.cs b/DynamicWhere.Tests/Policies/ReviewGateTests.cs
new file mode 100644
index 0000000..d769b78
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewGateTests.cs
@@ -0,0 +1,240 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Xunit.Abstractions;
+
+// An application's own collection classes, members sharing a name or hidden with new, and the framework's value collections.
+
+namespace DynamicWhere.Tests.Policies
+{
+    /// <summary>An application list of strings with a plain member of its own (a paged list, a tag set with a note).</summary>
+    public class ZwLabelSet : List<string>
+    {
+        public string? Note { get; set; }
+    }
+
+    /// <summary>The ASP.NET Core tutorial's PaginatedList shape, over strings.</summary>
+    public class ZwPagedNames : List<string>
+    {
+        public int PageIndex { get; set; }
+
+        public bool HasNextPage => false;
+    }
+
+    /// <summary>An application list of strings whose own member is denied.</summary>
+    public class ZwSecretTags : List<string>
+    {
+        [DwDenied]
+        public string? OwnerSecret { get; set; }
+    }
+
+    public class ZwLabelRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Ssn { get; set; }
+
+        public ZwLabelSet Labels { get; set; } = new();
+
+        public ZwPagedNames Names { get; set; } = new();
+    }
+
+    public class ZwPlainLabelRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZwLabelSet Labels { get; set; } = new();
+    }
+
+    public class ZwNestedTagRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZwSecretTags> Sets { get; set; } = new();
+
+        public ZwSecretTags[] Arr { get; set; } = Array.Empty<ZwSecretTags>();
+    }
+
+    public class ZwDeclaredFrameworkRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<string> Tags { get; set; } = new();
+
+        public IEnumerable<string> Seq { get; set; } = Array.Empty<string>();
+    }
+
+    public class ZwCaseRow
+    {
+        public int Id { get; set; }
+
+        public string? Code { get; set; }
+
+        [DwDenied]
+        public string? CODE { get; set; }
+    }
+
+    public class ZwHideValueBase
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Code { get; set; }
+    }
+
+    public class ZwHideValueDerived : ZwHideValueBase
+    {
+        public new string? Code { get; set; }
+    }
+
+    public class ZwItemsBase
+    {
+        public int Id { get; set; }
+
+        public List<string>? Items { get; set; }
+    }
+
+    public class ZwItemsDerived : ZwItemsBase
+    {
+        public new List<ZwPayCard>? Items { get; set; }
+    }
+
+    public sealed class ReviewGateTests
+    {
+        private readonly ITestOutputHelper _out;
+
+        public ReviewGateTests(ITestOutputHelper output) => _out = output;
+
+        private static PolicyQueryable<T> GuardWith<T>(IQueryable<T> source, DwTier tier, params IDwPolicyProvider[] more) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }.Concat(more).ToArray()));
+
+        private object? Read<T>(string label, IQueryable<T> source, DwTier tier, Filter? filter = null, bool dynamic = false, params IDwPolicyProvider[] more) where T : class
+        {
+            PolicyQueryable<T> guarded = GuardWith(source, tier, more);
+            object? data = null;
+            string code = ZwKit.Code(() => data = dynamic ? guarded.ToListDynamic(filter ?? new Filter()).Data : guarded.ToList(filter ?? new Filter()).Data);
+
+            _out.WriteLine($"{label} {tier} dynamic={dynamic}: code={code} sent={ZwKit.Json(data)} trace=[{ZwKit.Trace(guarded)}]");
+
+            return data;
+        }
+
+        // ------------------------------------------------------------------ O: OwnsMembers on everyday list subclasses
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zw_O1_a_list_of_strings_subclass_with_a_plain_member_is_kept_beside_a_top_level_denial(DwTier tier)
+        {
+            ZwLabelRow[] rows =
+            {
+                new() { Id = 1, Name = "r1", Ssn = "zw-ssn-secret", Labels = new ZwLabelSet { "a", "b" }, Names = new ZwPagedNames { "x", "y" } }
+            };
+            rows[0].Labels.Note = "note";
+
+            object? data = Read("O1", rows.AsQueryable(), tier);
+            List<ZwLabelRow> sent = Assert.IsType<List<ZwLabelRow>>(data);
+
+            Assert.False(ZwKit.Holds(data, "zw-ssn-secret"));
+            Assert.Equal(2, sent[0].Labels.Count);
+            Assert.Equal(2, sent[0].Names.Count);
+        }
+
+        [Fact]
+        public void Zw_O2_under_a_star_deny_a_list_of_strings_subclass_granted_by_name_is_kept()
+        {
+            ZwPlainLabelRow[] rows = { new() { Id = 1, Name = "r1", Labels = new ZwLabelSet { "a", "b" } } };
+
+            FakePolicyProvider rules = new FakePolicyProvider()
+                .Add("*", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal)
+                .Add("Id", PolicyFeature.Select, PolicyEffect.Allow, PolicyLevel.DynamicGlobal)
+                .Add("Name", PolicyFeature.Select, PolicyEffect.Allow, PolicyLevel.DynamicGlobal)
+                .Add("Labels", PolicyFeature.Select, PolicyEffect.Allow, PolicyLevel.DynamicGlobal);
+
+            object? whole = Read("O2 none", rows.AsQueryable(), DwTier.Convenience, null, false, rules);
+            object? named = Read("O2 named", rows.AsQueryable(), DwTier.Convenience, new Filter { Selects = new List<string> { "Id", "Labels" } }, false, rules);
+
+            List<ZwPlainLabelRow> a = Assert.IsType<List<ZwPlainLabelRow>>(whole);
+            List<ZwPlainLabelRow> b = Assert.IsType<List<ZwPlainLabelRow>>(named);
+
+            Assert.Equal(2, a[0].Labels.Count);
+            Assert.Equal(2, b[0].Labels.Count);
+        }
+
+        // ------------------------------------------------------------------ K: an application collection's own members, one level removed
+
+        [Theory]
+        [InlineData(DwTier.Strict, false)]
+        [InlineData(DwTier.Convenience, false)]
+        [InlineData(DwTier.Strict, true)]
+        public void Zw_K1_a_list_and_an_array_of_a_collection_class_with_a_denied_member(DwTier tier, bool dynamic)
+        {
+            ZwSecretTags tags = new() { "a" };
+            tags.OwnerSecret = "zw-nested-owner-secret";
+
+            ZwNestedTagRow[] rows = { new() { Id = 1, Name = "r1", Sets = new List<ZwSecretTags> { tags }, Arr = new[] { tags } } };
+
+            object? data = Read("K1", rows.AsQueryable(), tier, null, dynamic);
+
+            Assert.False(ZwKit.Holds(data, "zw-nested-owner-secret"));
+        }
+
+        // ------------------------------------------------------------------ S: shared names
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zw_S1_two_value_members_differing_only_in_case_the_denied_one_is_withheld(DwTier tier)
+        {
+            ZwCaseRow[] rows = { new() { Id = 1, Code = "open", CODE = "zw-case-secret" } };
+
+            object? data = Read("S1", rows.AsQueryable(), tier);
+
+            Assert.False(ZwKit.Holds(data, "zw-case-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zw_S2_a_denied_value_member_hidden_with_new_by_another_value(DwTier tier)
+        {
+            ZwHideValueDerived row = new() { Id = 1, Code = "open" };
+            ((ZwHideValueBase)row).Code = "zw-hidden-base-secret";
+
+            object? data = Read("S2", new[] { row }.AsQueryable(), tier);
+
+            Assert.False(ZwKit.Holds(data, "zw-hidden-base-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zw_S3_a_list_of_values_hidden_by_a_list_of_cards(DwTier tier)
+        {
+            ZwItemsDerived row = new() { Id = 1, Items = new List<ZwPayCard> { new() { Label = "visa", Pan = "zw-items-pan-secret" } } };
+            ((ZwItemsBase)row).Items = new List<string> { "a" };
+
+            object? data = Read("S3", new[] { row }.AsQueryable(), tier);
+            object? named = Read("S3 named", new[] { row }.AsQueryable(), tier, new Filter { Selects = new List<string> { "Id", "Items" } });
+
+            Assert.False(ZwKit.Holds(data, "zw-items-pan-secret"));
+            Assert.False(ZwKit.Holds(named, "zw-items-pan-secret"));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewJoinEvalTests.cs b/DynamicWhere.Tests/Policies/ReviewJoinEvalTests.cs
new file mode 100644
index 0000000..48ae8e1
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewJoinEvalTests.cs
@@ -0,0 +1,694 @@
+using System.Collections;
+using System.Data.Common;
+using System.Linq.Expressions;
+using System.Reflection;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using DynamicWhere.ex.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Xunit.Abstractions;
+
+// Joins on a filtered, tagged or untracked set, and anonymous carriers: a query the tree holds inline is read where it
+// stands, not evaluated, so these read as plain chains.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public class ZwTier
+    {
+        public int Id { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+    }
+
+    public class ZwCustomer
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public string Region { get; set; } = string.Empty;
+
+        public int ZwTierId { get; set; }
+
+        /// <summary>Automatically included; nothing beneath it is denied.</summary>
+        public ZwTier? Tier { get; set; }
+
+        /// <summary>A converted JSON bag.</summary>
+        public Dictionary<string, object> Meta { get; set; } = new();
+
+        /// <summary>The only denial is beneath it; nothing includes it.</summary>
+        public List<ZwCard> Cards { get; set; } = new();
+
+        public List<ZwOrder> Orders { get; set; } = new();
+    }
+
+    public class ZwCard
+    {
+        public int Id { get; set; }
+
+        public int ZwCustomerId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZwChannel
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZwOrder
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public string Region { get; set; } = string.Empty;
+
+        public int ZwCustomerId { get; set; }
+
+        public ZwCustomer? Customer { get; set; }
+
+        public int ZwChannelId { get; set; }
+
+        /// <summary>Automatically included.</summary>
+        public ZwChannel? Channel { get; set; }
+
+        public Dictionary<string, object> Meta { get; set; } = new();
+    }
+
+    /// <summary>Counts the commands a context sends.</summary>
+    public sealed class ZwCommandCounter : DbCommandInterceptor
+    {
+        public int Readers;
+
+        public override InterceptionResult<DbDataReader> ReaderExecuting(DbCommand command, CommandEventData eventData, InterceptionResult<DbDataReader> result)
+        {
+            Interlocked.Increment(ref Readers);
+
+            return result;
+        }
+    }
+
+    public sealed class ZwContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZwContext(SqliteConnection connection, ZwCommandCounter? counter = null)
+        {
+            _connection = connection;
+            Counter = counter;
+        }
+
+        public ZwCommandCounter? Counter { get; }
+
+        public DbSet<ZwCustomer> Customers => Set<ZwCustomer>();
+
+        public DbSet<ZwOrder> Orders => Set<ZwOrder>();
+
+        public DbSet<ZwCard> Cards => Set<ZwCard>();
+
+        /// <summary>An ordinary method on the context (not a mapped function) that returns a query with an include.</summary>
+        public IQueryable<ZwCustomer> CustomersWithCardsNamed(string name) => Customers.Include(c => c.Cards).Where(c => c.Name == name);
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options)
+        {
+            options.UseSqlite(_connection);
+
+            if (Counter is not null)
+            {
+                options.AddInterceptors(Counter);
+            }
+        }
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZwCustomer>().ToTable("ZwCustomers");
+            model.Entity<ZwOrder>().ToTable("ZwOrders");
+            model.Entity<ZwCustomer>().Navigation(c => c.Tier).AutoInclude();
+            model.Entity<ZwOrder>().Navigation(o => o.Channel).AutoInclude();
+            model.Entity<ZwCustomer>().Property(c => c.Meta).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!);
+            model.Entity<ZwOrder>().Property(o => o.Meta).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!);
+        }
+    }
+
+    /// <summary>A repository whose methods the guard now evaluates.</summary>
+    public sealed class ZwRepository
+    {
+        private readonly ZwContext _db;
+        private IQueryable<ZwCustomer>? _level2;
+
+        public ZwRepository(ZwContext db) => _db = db;
+
+        public int Calls;
+
+        public int FlipCalls;
+
+        /// <summary>Counts its calls (a log line, a metric, an audit record).</summary>
+        public IQueryable<ZwCustomer> Customers()
+        {
+            Interlocked.Increment(ref Calls);
+
+            return _db.Customers;
+        }
+
+        /// <summary>Resolves which customers the caller may see with a query of its own, then hands back a query.</summary>
+        public IQueryable<ZwCustomer> Visible()
+        {
+            Interlocked.Increment(ref Calls);
+
+            List<int> ids = _db.Customers.AsNoTracking().Where(c => c.Region != string.Empty).Select(c => c.Id).ToList();
+
+            return _db.Customers.Where(c => ids.Contains(c.Id));
+        }
+
+        /// <summary>A stateful method: the first call hands back the plain set, every later one includes the cards.</summary>
+        public IQueryable<ZwCustomer> Flip()
+        {
+            int call = Interlocked.Increment(ref FlipCalls);
+
+            return call == 1 ? _db.Customers : _db.Customers.Include(c => c.Cards);
+        }
+
+        /// <summary>The same as a property getter.</summary>
+        public IQueryable<ZwCustomer> FlipSet
+        {
+            get
+            {
+                int call = Interlocked.Increment(ref FlipCalls);
+
+                return call == 1 ? _db.Customers : _db.Customers.Include(c => c.Cards);
+            }
+        }
+
+        /// <summary>A query that captures a built query two levels down.</summary>
+        public IQueryable<ZwCustomer> Level1()
+        {
+            _level2 ??= _db.Customers.Select(c => new ZwCustomer { Id = c.Id, Name = c.Name, Region = c.Region, Cards = c.Cards });
+
+            IQueryable<ZwCustomer> level2 = _level2;
+
+            return _db.Customers.Where(c => c.Name != string.Empty).SelectMany(c => level2.Where(x => x.Id == c.Id));
+        }
+
+        /// <summary>Customers already in memory, handed out as a query.</summary>
+        public IQueryable<ZwCustomer> InMemory(List<ZwCustomer> held) => held.AsQueryable();
+    }
+
+    internal static class ZwKit
+    {
+        private static readonly JsonSerializerOptions JsonOptions = new() { ReferenceHandler = ReferenceHandler.IgnoreCycles };
+
+        internal static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        internal static string Shape(Expression expression)
+        {
+            string Try(Func<bool> read)
+            {
+                try
+                {
+                    return read().ToString();
+                }
+                catch (Exception e)
+                {
+                    return "threw " + e.GetType().Name;
+                }
+            }
+
+            return $"reshapes={Try(() => QueryRoot.Reshapes(expression))} builds={Try(() => QueryRoot.Builds(expression))}";
+        }
+
+        internal static string Trace<T>(PolicyQueryable<T> guarded) where T : class =>
+            string.Join(" | ", guarded.LastTrace?.Decisions
+                .Where(d => d.Action != PolicyAction.Allowed)
+                .Select(d => $"{d.FieldPath} {d.Action}: {d.Reason}") ?? Array.Empty<string>());
+
+        internal static bool AnyDropped<T>(PolicyQueryable<T> guarded) where T : class =>
+            guarded.LastTrace?.Decisions.Any(d => d.Action == PolicyAction.Dropped) ?? false;
+
+        internal static string Json(object? value)
+        {
+            try
+            {
+                return JsonSerializer.Serialize(value, JsonOptions);
+            }
+            catch (Exception e)
+            {
+                return $"<unserializable: {e.GetType().Name}>";
+            }
+        }
+
+        internal static string Code(Action run)
+        {
+            try
+            {
+                run();
+
+                return "ran";
+            }
+            catch (PolicyException refusal)
+            {
+                return $"{refusal.ErrorCode}({refusal.FieldPath}; {refusal.SourceOrigin})";
+            }
+            catch (Exception other)
+            {
+                return $"{other.GetType().Name}: {other.Message.Split('\n')[0]}";
+            }
+        }
+
+        internal static object? SafeRead(Func<object?> read)
+        {
+            try
+            {
+                return read();
+            }
+            catch (PolicyException)
+            {
+                return null;
+            }
+            catch (LogicException)
+            {
+                return null;
+            }
+        }
+
+        /// <summary>Everything reachable from a value, read by runtime type (public and non-public properties and fields).</summary>
+        internal static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is MemberInfo || current is Delegate
+                    || (current.GetType().Namespace ?? string.Empty).StartsWith("Microsoft.", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held.Contains(text, StringComparison.Ordinal))
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (current.GetType().IsPrimitive || current is decimal || current is DateTime || current is Guid)
+                {
+                    continue;
+                }
+
+                if (!current.GetType().IsValueType && !seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IDictionary map)
+                {
+                    foreach (DictionaryEntry item in map)
+                    {
+                        pending.Push(item.Key);
+                        pending.Push(item.Value);
+                    }
+                }
+                else if (current is IEnumerable items)
+                {
+                    try
+                    {
+                        foreach (object? item in items)
+                        {
+                            pending.Push(item);
+                        }
+                    }
+                    catch
+                    {
+                        // Unreadable.
+                    }
+                }
+
+                const BindingFlags all = BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance;
+
+                foreach (PropertyInfo property in current.GetType().GetProperties(all))
+                {
+                    if (property.GetIndexParameters().Length != 0 || !property.CanRead)
+                    {
+                        continue;
+                    }
+
+                    try
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                    catch
+                    {
+                        // Unreadable.
+                    }
+                }
+
+                for (Type? type = current.GetType(); type is not null && type != typeof(object); type = type.BaseType)
+                {
+                    if (type.Namespace is { } ns && (ns == "System" || ns.StartsWith("System.", StringComparison.Ordinal)
+                                                     || ns.StartsWith("Microsoft.", StringComparison.Ordinal)))
+                    {
+                        continue;
+                    }
+
+                    foreach (FieldInfo field in type.GetFields(all | BindingFlags.DeclaredOnly))
+                    {
+                        try
+                        {
+                            pending.Push(field.GetValue(current));
+                        }
+                        catch
+                        {
+                            // Unreadable.
+                        }
+                    }
+                }
+            }
+
+            return false;
+        }
+    }
+
+    public sealed class ReviewJoinEvalTests : IDisposable
+    {
+        private const string Secret = "zw-pan-secret";
+
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZwCommandCounter _counter = new();
+        private readonly ZwContext _db;
+        private readonly ZwRepository _repo;
+
+        public ReviewJoinEvalTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZwContext(_connection, _counter);
+            _db.Database.EnsureCreated();
+            _repo = new ZwRepository(_db);
+
+            ZwTier gold = new() { Label = "gold" };
+            ZwChannel web = new() { Name = "web" };
+
+            ZwCustomer c1 = new()
+            {
+                Name = "C1",
+                Region = "north",
+                Tier = gold,
+                Meta = { ["k"] = "v1" },
+                Cards = { new ZwCard { Label = "visa", Pan = Secret } }
+            };
+            ZwCustomer c2 = new() { Name = "C2", Region = "south", Tier = gold, Meta = { ["k"] = "v2" } };
+
+            c1.Orders.Add(new ZwOrder { Code = "O1", Region = "north", Channel = web, Meta = { ["k"] = "o1" } });
+            c1.Orders.Add(new ZwOrder { Code = "O2", Region = "south", Channel = web, Meta = { ["k"] = "o2" } });
+            c2.Orders.Add(new ZwOrder { Code = "O3", Region = "south", Channel = web, Meta = { ["k"] = "o3" } });
+
+            _db.Customers.AddRange(c1, c2);
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private (List<T>? Rows, PolicyQueryable<T> Guarded) Run<T>(string label, IQueryable<T> source) where T : class
+        {
+            string shape = ZwKit.Shape(source.Expression);
+            PolicyQueryable<T> guarded = ZwKit.Guard(source);
+
+            try
+            {
+                int count = source.AsNoTracking().ToList().Count;
+
+                _out.WriteLine($"{label}: unguarded OK rows={count} {shape}");
+            }
+            catch (Exception e)
+            {
+                _out.WriteLine($"{label}: unguarded THREW {e.GetType().Name} {e.Message.Split('\n')[0]} {shape}");
+
+                return (null, guarded);
+            }
+
+            _db.ChangeTracker.Clear();
+
+            List<T> rows = guarded.ToList(new Filter()).Data;
+
+            _out.WriteLine($"{label}: guarded rows={rows.Count} trace=[{ZwKit.Trace(guarded)}]");
+
+            return (rows, guarded);
+        }
+
+        private void CustomersAsLoaded(string label, IQueryable<ZwCustomer> source, int count)
+        {
+            (List<ZwCustomer>? rows, PolicyQueryable<ZwCustomer> guarded) = Run(label, source);
+
+            Assert.NotNull(rows);
+            Assert.Equal(count, rows!.Count);
+            Assert.False(ZwKit.AnyDropped(guarded), ZwKit.Trace(guarded));
+            Assert.All(rows, row => Assert.Equal("gold", row.Tier?.Label));
+            Assert.All(rows, row => Assert.True(row.Meta.ContainsKey("k"), "Meta left out"));
+        }
+
+        private void OrdersAsLoaded(string label, IQueryable<ZwOrder> source, int count)
+        {
+            (List<ZwOrder>? rows, PolicyQueryable<ZwOrder> guarded) = Run(label, source);
+
+            Assert.NotNull(rows);
+            Assert.Equal(count, rows!.Count);
+            Assert.False(ZwKit.AnyDropped(guarded), ZwKit.Trace(guarded));
+            Assert.All(rows, row => Assert.Equal("web", row.Channel?.Name));
+            Assert.All(rows, row => Assert.True(row.Meta.ContainsKey("k"), "Meta left out"));
+        }
+
+        // ------------------------------------------------------------------ J: joins whose inner sequence is not a bare set
+
+        [Fact]
+        public void Zw_J0_control_join_on_a_bare_set()
+        {
+            CustomersAsLoaded("J0 Join(_db.Customers)", _db.Orders.Join(_db.Customers, o => o.ZwCustomerId, c => c.Id, (o, c) => c), 3);
+        }
+
+        [Fact]
+        public void Zw_J1_join_on_a_filtered_set()
+        {
+            CustomersAsLoaded(
+                "J1 Join(_db.Customers.Where(..))",
+                _db.Orders.Join(_db.Customers.Where(c => c.Region != string.Empty), o => o.ZwCustomerId, c => c.Id, (o, c) => c),
+                3);
+        }
+
+        [Fact]
+        public void Zw_J2_query_syntax_join_on_an_untracked_set()
+        {
+            IQueryable<ZwCustomer> source =
+                from o in _db.Orders
+                join c in _db.Customers.AsNoTracking() on o.ZwCustomerId equals c.Id
+                select c;
+
+            CustomersAsLoaded("J2 join c in _db.Customers.AsNoTracking()", source, 3);
+        }
+
+        [Fact]
+        public void Zw_J3_left_join_on_a_filtered_set()
+        {
+            IQueryable<ZwCustomer> source =
+                from o in _db.Orders
+                join c in _db.Customers.Where(x => x.Region != string.Empty) on o.ZwCustomerId equals c.Id into cs
+                from c in cs.DefaultIfEmpty()
+                select c;
+
+            CustomersAsLoaded("J3 left join on a filtered set", source, 3);
+        }
+
+        [Fact]
+        public void Zw_J4_join_on_a_filtered_set_returning_the_outer_rows()
+        {
+            OrdersAsLoaded(
+                "J4 Join(_db.Customers.Where(..), (o, c) => o)",
+                _db.Orders.Join(_db.Customers.Where(c => c.Region != string.Empty), o => o.ZwCustomerId, c => c.Id, (o, c) => o),
+                3);
+        }
+
+        [Fact]
+        public void Zw_J5_join_on_a_tagged_set()
+        {
+            CustomersAsLoaded(
+                "J5 Join(_db.Customers.TagWith(..))",
+                _db.Orders.Join(_db.Customers.TagWith("lookup"), o => o.ZwCustomerId, c => c.Id, (o, c) => c),
+                3);
+        }
+
+        [Fact]
+        public void Zw_J6_where_then_join_on_a_filtered_order_set()
+        {
+            OrdersAsLoaded(
+                "J6 _db.Orders.Where(..).Join(_db.Orders.Where(..), (a, b) => a)",
+                _db.Orders.Where(o => o.Code != string.Empty)
+                    .Join(_db.Orders.Where(o => o.Region != string.Empty), a => a.Id, b => b.Id, (a, b) => a),
+                3);
+        }
+
+        // ------------------------------------------------------------------ E: what the evaluation of user code costs
+
+        [Fact]
+        public void Zw_E4_a_repository_query_capturing_a_built_query_two_levels_down()
+        {
+            IQueryable<ZwCustomer> source = _db.Orders.SelectMany(o => _repo.Level1().Where(c => c.Id == o.ZwCustomerId));
+            string unguarded;
+
+            try
+            {
+                unguarded = ZwKit.Holds(source.AsNoTracking().ToList(), Secret) ? "HOLDS PAN" : "no pan";
+            }
+            catch (Exception e)
+            {
+                unguarded = $"THREW {e.GetType().Name}: {e.Message.Split('\n')[0]}";
+            }
+
+            PolicyQueryable<ZwCustomer> guarded = ZwKit.Guard(source);
+            object? data;
+
+            try
+            {
+                data = ZwKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+            }
+            catch (InvalidOperationException) when (typeof(DbContext).Assembly.GetName().Version!.Major < 7)
+            {
+                // EF Core 6 cannot translate the projection this shape needs, so the guarded read fails closed.
+                return;
+            }
+
+            _out.WriteLine($"E4 {ZwKit.Shape(source.Expression)} unguarded={unguarded} sent={ZwKit.Json(data)} trace=[{ZwKit.Trace(guarded)}]");
+
+            Assert.False(ZwKit.Holds(data, Secret));
+        }
+
+        [Fact]
+        public void Zw_E5_a_repository_method_handing_out_rows_in_memory()
+        {
+            List<ZwCustomer> held = _db.Customers.Include(c => c.Cards).AsNoTracking().ToList();
+            IQueryable<ZwCustomer> source = _db.Orders.SelectMany(o => _repo.InMemory(held).Where(c => c.Id == o.ZwCustomerId));
+
+            string code = ZwKit.Code(() => source.AsNoTracking().ToList());
+            PolicyQueryable<ZwCustomer> guarded = ZwKit.Guard(source);
+            object? data = null;
+            string guardedCode = ZwKit.Code(() => data = guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"E5 {ZwKit.Shape(source.Expression)} unguarded={code} guarded={guardedCode} sent={ZwKit.Json(data)}");
+
+            Assert.False(ZwKit.Holds(data, Secret));
+        }
+
+        [Fact]
+        public void Zw_E6_a_context_method_that_includes_read_through_a_correlated_argument()
+        {
+            IQueryable<ZwCustomer> source = _db.Orders.SelectMany(o => _db.CustomersWithCardsNamed(o.Code));
+
+            string code = ZwKit.Code(() => source.AsNoTracking().ToList());
+            PolicyQueryable<ZwCustomer> guarded = ZwKit.Guard(source);
+            object? data = null;
+            string guardedCode = ZwKit.Code(() => data = guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"E6 {ZwKit.Shape(source.Expression)} unguarded={code} guarded={guardedCode} sent={ZwKit.Json(data)}");
+
+            Assert.False(ZwKit.Holds(data, Secret));
+        }
+
+        // ------------------------------------------------------------------ A: anonymous carriers under the caller's tracking
+
+        [Theory]
+        [InlineData("AsTracking")]
+        [InlineData("IdentityResolution")]
+        [InlineData("None")]
+        public void Zw_A1_an_anonymous_carrier_with_the_cards_in_a_context_that_tracks_them(string tracking)
+        {
+            // Earlier in the unit of work the application read the cards with tracking.
+            _ = _db.Cards.ToList();
+
+            IQueryable<ZwOrder> orders = tracking switch
+            {
+                "AsTracking" => _db.Orders.AsTracking(),
+                "IdentityResolution" => _db.Orders.AsNoTrackingWithIdentityResolution(),
+                _ => _db.Orders
+            };
+
+            IQueryable<ZwCustomer> source = orders
+                .Select(o => new { o.Customer, Cards = o.Customer!.Cards.ToList() })
+                .Select(x => x.Customer!);
+
+            PolicyQueryable<ZwCustomer> guarded = ZwKit.Guard(source);
+            object? data = ZwKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"A1 {tracking} {ZwKit.Shape(source.Expression)} tracked={_db.ChangeTracker.Entries().Count()} sent={ZwKit.Json(data)} trace=[{ZwKit.Trace(guarded)}]");
+
+            Assert.False(ZwKit.Holds(data, Secret));
+        }
+
+        [Theory]
+        [InlineData("AsTracking")]
+        [InlineData("IdentityResolution")]
+        public void Zw_A2_the_carrier_is_the_last_projection_before_a_member_read(string tracking)
+        {
+            _ = _db.Cards.ToList();
+
+            IQueryable<ZwOrder> orders = tracking == "AsTracking" ? _db.Orders.AsTracking() : _db.Orders.AsNoTrackingWithIdentityResolution();
+
+            IQueryable<ZwCustomer> source = orders
+                .Select(o => new { Order = o, Owner = o.Customer, o.Customer!.Cards })
+                .Where(x => x.Cards.Count >= 0)
+                .Select(x => x.Owner!);
+
+            PolicyQueryable<ZwCustomer> guarded = ZwKit.Guard(source);
+            object? data = ZwKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"A2 {tracking} {ZwKit.Shape(source.Expression)} sent={ZwKit.Json(data)} trace=[{ZwKit.Trace(guarded)}]");
+
+            Assert.False(ZwKit.Holds(data, Secret));
+        }
+
+        [Fact]
+        public void Zw_A3_control_the_anonymous_carrier_query_reads_as_it_did()
+        {
+            CustomersAsLoaded(
+                "A3 Select(o => new { o.Customer, o.Code }).Select(x => x.Customer)",
+                _db.Orders.Select(o => new { o.Customer, o.Code }).Select(x => x.Customer!),
+                3);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewJoinRootTests.cs b/DynamicWhere.Tests/Policies/ReviewJoinRootTests.cs
new file mode 100644
index 0000000..181b45c
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewJoinRootTests.cs
@@ -0,0 +1,224 @@
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+// A join on a filtered set over roots a typed projection cannot build (DDD, constructor-bound, abstract): read from the model, not projected.
+// The only denial (ZwKey.Secret) sits beneath Owner.Keys, which nothing loads.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public class ZwOwner
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZwKey> Keys { get; set; } = new();
+
+        public List<ZwInvoice> Invoices { get; set; } = new();
+
+        public List<ZwMember> Members { get; set; } = new();
+
+        public List<ZwPayment> Payments { get; set; } = new();
+    }
+
+    public class ZwKey
+    {
+        public int Id { get; set; }
+
+        public int ZwOwnerId { get; set; }
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    /// <summary>DDD style: a private constructor for EF Core, a public one for the domain, private setters.</summary>
+    public class ZwInvoice
+    {
+        private ZwInvoice()
+        {
+        }
+
+        public ZwInvoice(string number) => Number = number;
+
+        public int Id { get; private set; }
+
+        public string Number { get; private set; } = string.Empty;
+
+        public int ZwOwnerId { get; private set; }
+
+        public ZwOwner? Owner { get; private set; }
+    }
+
+    /// <summary>Constructor-bound: EF Core binds it, and it has no parameterless constructor.</summary>
+    public class ZwMember
+    {
+        public ZwMember(int id, string name, int zwOwnerId)
+        {
+            Id = id;
+            Name = name;
+            ZwOwnerId = zwOwnerId;
+        }
+
+        public int Id { get; private set; }
+
+        public string Name { get; private set; }
+
+        public int ZwOwnerId { get; private set; }
+
+        public ZwOwner? Owner { get; private set; }
+    }
+
+    public abstract class ZwPayment
+    {
+        public int Id { get; set; }
+
+        public long Cents { get; set; }
+
+        public int ZwOwnerId { get; set; }
+
+        public ZwOwner? Owner { get; set; }
+    }
+
+    public class ZwCardPayment : ZwPayment
+    {
+        public string Last4 { get; set; } = string.Empty;
+    }
+
+    public class ZwCashPayment : ZwPayment
+    {
+        public string Till { get; set; } = string.Empty;
+    }
+
+    public sealed class ZwOwnerContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZwOwnerContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZwOwner> Owners => Set<ZwOwner>();
+
+        public DbSet<ZwPayment> Payments => Set<ZwPayment>();
+
+        public DbSet<ZwMember> Members => Set<ZwMember>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZwCardPayment>();
+            model.Entity<ZwCashPayment>();
+            model.Entity<ZwMember>().HasOne(m => m.Owner).WithMany(o => o.Members).HasForeignKey(m => m.ZwOwnerId);
+        }
+    }
+
+    public sealed class ReviewJoinRootTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZwOwnerContext _db;
+
+        public ReviewJoinRootTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZwOwnerContext(_connection);
+            _db.Database.EnsureCreated();
+
+            ZwOwner owner = new()
+            {
+                Name = "W1",
+                Keys = { new ZwKey { Secret = "zw-key-secret" } },
+                Payments = { new ZwCardPayment { Cents = 100, Last4 = "4242" }, new ZwCashPayment { Cents = 200, Till = "T1" } },
+                Invoices = { new ZwInvoice("INV-1") }
+            };
+
+            _db.Owners.Add(owner);
+            _db.SaveChanges();
+            _db.Members.Add(new ZwMember(0, "M1", owner.Id));
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private string Typed<T>(string label, IQueryable<T> source) where T : class
+        {
+            string unguarded = JsonSerializer.Serialize(source.AsNoTracking().ToList().Select(r => r.GetType().Name));
+            PolicyQueryable<T> guarded = ZwKit.Guard(source);
+            string outcome;
+
+            _db.ChangeTracker.Clear();
+
+            try
+            {
+                List<T> rows = guarded.ToList(new Filter()).Data;
+
+                outcome = $"OK types={JsonSerializer.Serialize(rows.Select(r => r.GetType().Name))} json={JsonSerializer.Serialize<object>(rows)}";
+            }
+            catch (Exception e)
+            {
+                outcome = $"THREW {e.GetType().Name} {(e is PolicyException p ? p.ErrorCode.ToString() : string.Empty)} {e.Message.Split('\n')[0]}";
+            }
+
+            _out.WriteLine($"{label}: {ZwKit.Shape(source.Expression)} unguarded types={unguarded} guarded {outcome} trace=[{ZwKit.Trace(guarded)}]");
+
+            return outcome;
+        }
+
+        [Fact]
+        public void Zw_D0_control_a_DDD_aggregate_joined_on_a_bare_set()
+        {
+            string outcome = Typed("D0", _db.Owners.Join(_db.Set<ZwInvoice>(), o => o.Id, i => i.ZwOwnerId, (o, i) => i));
+
+            Assert.StartsWith("OK", outcome);
+            Assert.Contains("INV-1", outcome);
+        }
+
+        [Fact]
+        public void Zw_D1_a_DDD_aggregate_joined_on_a_filtered_set()
+        {
+            string outcome = Typed("D1", _db.Owners.Join(_db.Set<ZwInvoice>().Where(i => i.Number != string.Empty), o => o.Id, i => i.ZwOwnerId, (o, i) => i));
+
+            Assert.StartsWith("OK", outcome);
+            Assert.Contains("INV-1", outcome);
+        }
+
+        [Fact]
+        public void Zw_D2_a_constructor_bound_entity_joined_on_a_filtered_set()
+        {
+            string outcome = Typed("D2", _db.Owners.Join(_db.Members.Where(m => m.Name != string.Empty), o => o.Id, m => m.ZwOwnerId, (o, m) => m));
+
+            Assert.StartsWith("OK", outcome);
+        }
+
+        [Fact]
+        public void Zw_D3_abstract_rows_joined_on_a_filtered_set()
+        {
+            string outcome = Typed("D3", _db.Owners.Join(_db.Payments.Where(p => p.Cents > 0), o => o.Id, p => p.ZwOwnerId, (o, p) => p));
+
+            Assert.StartsWith("OK", outcome);
+            Assert.Contains("ZwCardPayment", outcome);
+        }
+
+        [Fact]
+        public void Zw_D4_a_captured_filtered_query_as_the_inner_sequence()
+        {
+            IQueryable<ZwMember> named = _db.Members.Where(m => m.Name != string.Empty);
+
+            string outcome = Typed("D4", _db.Owners.Join(named, o => o.Id, m => m.ZwOwnerId, (o, m) => m));
+
+            Assert.StartsWith("OK", outcome);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewLeakTests.cs b/DynamicWhere.Tests/Policies/ReviewLeakTests.cs
new file mode 100644
index 0000000..b85da7f
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewLeakTests.cs
@@ -0,0 +1,746 @@
+using System.Collections;
+using System.ComponentModel.DataAnnotations.Schema;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ round 3 probes: models
+
+    // ---- P1: an unmapped getter over a private, mapped field ----------------------------------------
+
+    public class ZrEmployee
+    {
+        private string? _band;
+
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        /// <summary>Computed from a private field EF Core maps as a column; the model does not map this member.</summary>
+        [NotMapped]
+        public ZrPay Pay => new() { Grade = "G", Band = _band };
+
+        public void SetBand(string band) => _band = band;
+    }
+
+    public class ZrPay
+    {
+        public string? Grade { get; set; }
+
+        [DwDenied]
+        public string? Band { get; set; }
+    }
+
+    // ---- P1b: the same inside an owned type -----------------------------------------------------------
+
+    public class ZrClinic
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZrContact Contact { get; set; } = new();
+    }
+
+    public class ZrContact
+    {
+        private string? _phone;
+
+        public string City { get; set; } = string.Empty;
+
+        [NotMapped]
+        public ZrPhoneView Phone => new() { Number = _phone };
+
+        public void SetPhone(string phone) => _phone = phone;
+    }
+
+    public class ZrPhoneView
+    {
+        [DwDenied]
+        public string? Number { get; set; }
+    }
+
+    // ---- P2: an unmapped getter exposing a private, automatically included navigation ------------------
+
+    public class ZrLedger
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        private List<ZrEntry> Entries { get; set; } = new();
+
+        [NotMapped]
+        public IReadOnlyList<ZrEntry> Items => Entries;
+
+        public void Add(ZrEntry entry) => Entries.Add(entry);
+    }
+
+    public class ZrEntry
+    {
+        public int Id { get; set; }
+
+        public int ZrLedgerId { get; set; }
+
+        public string Memo { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Amount { get; set; }
+    }
+
+    /// <summary>An entity that includes the ledger, so the ledger is a loaded navigation beneath the row.</summary>
+    public class ZrBook
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        public int ZrLedgerId { get; set; }
+
+        public ZrLedger? Ledger { get; set; }
+    }
+
+    // ---- P3: generic subtypes, which the subtype search never lists -----------------------------------
+
+    public class ZrCreature
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZrTagged<TTag> : ZrCreature
+    {
+        [DwDenied]
+        public string? Secret { get; set; }
+
+        public TTag? Tag { get; set; }
+    }
+
+    public class ZrPen
+    {
+        public int Id { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        public ZrCreature? Pet { get; set; }
+    }
+
+    /// <summary>An EF Core hierarchy whose derived entity is a closed generic type.</summary>
+    public class ZrOrg
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZrGenOrg<TMarker> : ZrOrg
+    {
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    /// <summary>A derived entity whose field no attribute denies, for a rule to deny instead.</summary>
+    public class ZrBank : ZrOrg
+    {
+        public string? Swift { get; set; }
+    }
+
+    public class ZrLoan
+    {
+        public int Id { get; set; }
+
+        public string Note { get; set; } = string.Empty;
+
+        public int ZrOrgId { get; set; }
+
+        public ZrOrg? Org { get; set; }
+    }
+
+    public class ZrLoanRow
+    {
+        public int Id { get; set; }
+
+        public string Note { get; set; } = string.Empty;
+
+        public ZrOrg? Org { get; set; }
+    }
+
+    // ---- P4: a member typed as a framework base class ---------------------------------------------------
+
+    public class ZrDeclinedException : Exception
+    {
+        public ZrDeclinedException()
+            : base("declined")
+        {
+        }
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZrJobResult
+    {
+        public int Id { get; set; }
+
+        public string Status { get; set; } = string.Empty;
+
+        public Exception? Error { get; set; }
+    }
+
+    // ---- P5: a rule on a subtype's field, reached through a base-typed member ---------------------------
+
+    public class ZrCat : ZrCreature
+    {
+        public string? Microchip { get; set; }
+    }
+
+    // ---- P8: two members differing only in letter case -------------------------------------------------
+
+    public class ZrCaseRow
+    {
+        public int Id { get; set; }
+
+        public ZrCardInfo INFO { get; set; } = new();
+
+        public ZrSafeInfo Info { get; set; } = new();
+    }
+
+    public class ZrCardInfo
+    {
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZrSafeInfo
+    {
+        public string? Label { get; set; }
+    }
+
+    // ---- P6: a Concat of two projections ---------------------------------------------------------------
+
+    public class ZrAcctRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZrPersonView? Person { get; set; }
+    }
+
+    public class ZrPersonView
+    {
+        public string? Name { get; set; }
+
+        [DwDenied]
+        public string? TaxId { get; set; }
+    }
+
+    // ---- P9: many-to-many with an explicit join entity carrying a denied payload ------------------------
+
+    public class ZrPost
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        public List<ZrTag> Tags { get; set; } = new();
+
+        public List<ZrPostTag> PostTags { get; set; } = new();
+    }
+
+    public class ZrTag
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZrPost> Posts { get; set; } = new();
+
+        public List<ZrPostTag> PostTags { get; set; } = new();
+    }
+
+    public class ZrPostTag
+    {
+        public int ZrPostId { get; set; }
+
+        public int ZrTagId { get; set; }
+
+        public ZrPost? Post { get; set; }
+
+        public ZrTag? Tag { get; set; }
+
+        [DwDenied]
+        public string? AddedBy { get; set; }
+    }
+
+    public sealed class ZrProbeContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZrProbeContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZrEmployee> Employees => Set<ZrEmployee>();
+
+        public DbSet<ZrClinic> Clinics => Set<ZrClinic>();
+
+        public DbSet<ZrLedger> Ledgers => Set<ZrLedger>();
+
+        public DbSet<ZrBook> Books => Set<ZrBook>();
+
+        public DbSet<ZrOrg> Orgs => Set<ZrOrg>();
+
+        public DbSet<ZrLoan> Loans => Set<ZrLoan>();
+
+        public DbSet<ZrPost> Posts => Set<ZrPost>();
+
+        public DbSet<ZrTag> Tags => Set<ZrTag>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZrEmployee>().Property<string?>("_band");
+            model.Entity<ZrClinic>().OwnsOne(c => c.Contact, o => o.Property<string?>("_phone"));
+            model.Entity<ZrLedger>(b =>
+            {
+                b.HasMany<ZrEntry>("Entries").WithOne().HasForeignKey(e => e.ZrLedgerId);
+                b.Navigation("Entries").AutoInclude();
+            });
+            model.Entity<ZrGenOrg<int>>();
+            model.Entity<ZrBank>();
+            model.Entity<ZrPost>()
+                .HasMany(p => p.Tags)
+                .WithMany(t => t.Posts)
+                .UsingEntity<ZrPostTag>(
+                    j => j.HasOne(pt => pt.Tag).WithMany(t => t.PostTags).HasForeignKey(pt => pt.ZrTagId),
+                    j => j.HasOne(pt => pt.Post).WithMany(p => p.PostTags).HasForeignKey(pt => pt.ZrPostId),
+                    j => j.HasKey(pt => new { pt.ZrPostId, pt.ZrTagId }));
+        }
+    }
+
+    // ============================================================================ round 3 probes: tests
+
+    /// <summary>
+    /// Round 3 adversarial probes. Every assertion states the safe outcome, so a red test is a leak. A refusal with
+    /// FieldDeniedForSelect is a safe outcome.
+    /// </summary>
+    public sealed class ReviewLeakTests : IDisposable
+    {
+        private readonly SqliteConnection _connection;
+        private readonly ZrProbeContext _db;
+
+        public ReviewLeakTests()
+        {
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+
+            _db = new ZrProbeContext(_connection);
+            _db.Database.EnsureCreated();
+
+            ZrEmployee employee = new() { Name = "E1" };
+            employee.SetBand("band-secret");
+            _db.Employees.Add(employee);
+
+            ZrClinic clinic = new() { Name = "C1", Contact = new ZrContact { City = "Basra" } };
+            clinic.Contact.SetPhone("phone-secret");
+            _db.Clinics.Add(clinic);
+
+            ZrLedger ledger = new() { Name = "L1" };
+            ledger.Add(new ZrEntry { Memo = "m", Amount = "amount-secret" });
+            _db.Ledgers.Add(ledger);
+            _db.Books.Add(new ZrBook { Title = "B1", Ledger = ledger });
+
+            _db.Loans.Add(new ZrLoan { Note = "gen", Org = new ZrGenOrg<int> { Name = "G", Secret = "generic-entity-secret" } });
+            _db.Loans.Add(new ZrLoan { Note = "bank", Org = new ZrBank { Name = "K", Swift = "swift-by-rule" } });
+
+            ZrPost post = new() { Title = "P1" };
+            ZrTag tag = new() { Name = "T1" };
+            _db.Posts.Add(post);
+            _db.Tags.Add(tag);
+            _db.SaveChanges();
+            _db.Set<ZrPostTag>().Add(new ZrPostTag { ZrPostId = post.Id, ZrTagId = tag.Id, AddedBy = "join-secret" });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static DwPolicyContext Caller() =>
+            new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1").WithValue("TenantId", 1);
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict, params IDwPolicyProvider[] more)
+            where T : class =>
+            source.ApplyPolicy(
+                Caller(),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }.Concat(more).ToArray()));
+
+        private static Filter Selecting(params string[] fields) => new() { Selects = fields.ToList() };
+
+        private static FakePolicyProvider Denying(params string[] paths)
+        {
+            FakePolicyProvider rules = new();
+
+            foreach (string path in paths)
+            {
+                rules.Add(path, PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+            }
+
+            return rules;
+        }
+
+        private static FakePolicyProvider DenyingAllBut(params string[] allowed)
+        {
+            FakePolicyProvider rules = new FakePolicyProvider()
+                .Add("*", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            foreach (string path in allowed)
+            {
+                rules.Add(path, PolicyFeature.Select, PolicyEffect.Allow, PolicyLevel.DynamicGlobal);
+            }
+
+            return rules;
+        }
+
+        /// <summary>
+        /// True when anything reachable from a value holds the text, read by each object's runtime type, through
+        /// every readable public property (getter-only ones included, as a serializer writes them).
+        /// </summary>
+        private static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is ValueType || current is System.Reflection.MemberInfo)
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held == text)
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (!seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IEnumerable items)
+                {
+                    foreach (object? item in items)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                foreach (System.Reflection.PropertyInfo property in current.GetType().GetProperties())
+                {
+                    if (property.GetIndexParameters().Length != 0 || !property.CanRead)
+                    {
+                        continue;
+                    }
+
+                    object? read;
+
+                    try
+                    {
+                        read = property.GetValue(current);
+                    }
+                    catch
+                    {
+                        continue;
+                    }
+
+                    pending.Push(read);
+                }
+            }
+
+            return false;
+        }
+
+        /// <summary>Runs a guarded read; a FieldDeniedForSelect refusal is safe and reads as no rows.</summary>
+        private static object? SafeRead(Func<object?> read)
+        {
+            try
+            {
+                return read();
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode == PolicyErrorCode.FieldDeniedForSelect)
+            {
+                return null;
+            }
+        }
+
+        // ------------------------------------------------------------------------------------------------ P1
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P1_an_unmapped_getter_over_a_private_mapped_field_does_not_carry_the_denied_value(DwTier tier)
+        {
+            // Unguarded, the entity carries the value through the getter.
+            Assert.True(Holds(_db.Employees.AsNoTracking().ToList(), "band-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(_db.Employees, tier).ToList(new Filter()).Data), "band-secret"));
+        }
+
+        [Fact]
+        public void Zr_P1_dynamic_terminal()
+        {
+            Assert.False(Holds(SafeRead(() => Guard(_db.Employees).ToListDynamic(new Filter()).Data), "band-secret"));
+        }
+
+        [Fact]
+        public async Task Zr_P1_segment_terminal()
+        {
+            object? rows = null;
+
+            try
+            {
+                rows = (await Guard(_db.Employees).ToListAsync(new Segment(), CancellationToken.None)).Data;
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode == PolicyErrorCode.FieldDeniedForSelect)
+            {
+            }
+
+            Assert.False(Holds(rows, "band-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P1b_an_owned_type_with_an_unmapped_getter_over_a_private_mapped_field(DwTier tier)
+        {
+            Assert.True(Holds(_db.Clinics.AsNoTracking().ToList(), "phone-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(_db.Clinics, tier).ToList(new Filter()).Data), "phone-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P2
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P2_an_unmapped_getter_exposing_a_private_auto_included_navigation(DwTier tier)
+        {
+            Assert.True(Holds(_db.Ledgers.AsNoTracking().ToList(), "amount-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(_db.Ledgers, tier).ToList(new Filter()).Data), "amount-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P2b_the_same_beneath_an_included_navigation(DwTier tier)
+        {
+            IQueryable<ZrBook> source = _db.Books.Include(b => b.Ledger);
+
+            Assert.True(Holds(source.AsNoTracking().ToList(), "amount-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(source, tier).ToList(new Filter()).Data), "amount-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P3
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P3_rows_in_memory_of_a_generic_subtype_with_a_denied_field(DwTier tier)
+        {
+            ZrCreature[] rows = { new ZrTagged<int> { Id = 1, Name = "Rex", Secret = "generic-secret", Tag = 7 } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data), "generic-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P3b_a_base_typed_member_in_memory_holding_a_generic_subtype(DwTier tier)
+        {
+            ZrPen[] rows = { new() { Id = 1, Label = "pen", Pet = new ZrTagged<int> { Id = 2, Name = "Rex", Secret = "generic-secret" } } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data), "generic-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(Selecting("Id", "Pet")).Data), "generic-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P3c_a_projected_member_holding_a_closed_generic_derived_entity(DwTier tier)
+        {
+            IQueryable<ZrLoanRow> rows = _db.Loans.Select(l => new ZrLoanRow { Id = l.Id, Note = l.Note, Org = l.Org });
+
+            Assert.True(Holds(rows.ToList(), "generic-entity-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(rows, tier).ToList(new Filter()).Data), "generic-entity-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(rows, tier).ToList(Selecting("Id", "Org")).Data), "generic-entity-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P3c_control_the_entity_query_reads_the_model(DwTier tier)
+        {
+            IQueryable<ZrLoan> source = _db.Loans.Include(l => l.Org);
+
+            Assert.True(Holds(source.AsNoTracking().ToList(), "generic-entity-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(source, tier).ToList(new Filter()).Data), "generic-entity-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(_db.Orgs, tier).ToList(new Filter()).Data), "generic-entity-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P4
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P4_a_member_typed_as_a_framework_base_class_holding_an_application_subtype(DwTier tier)
+        {
+            ZrJobResult[] rows = { new() { Id = 1, Status = "failed", Error = new ZrDeclinedException { Pan = "exception-secret" } } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data), "exception-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(Selecting("Id", "Error")).Data), "exception-secret"));
+        }
+
+        [Fact]
+        public void Zr_P4b_under_a_deny_by_default_policy()
+        {
+            ZrJobResult[] rows = { new() { Id = 1, Status = "failed", Error = new ZrDeclinedException { Pan = "exception-secret" } } };
+
+            FakePolicyProvider rules = DenyingAllBut("Id", "Error");
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), DwTier.Strict, rules).ToList(Selecting("Id", "Error")).Data), "exception-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P5
+
+        [Fact]
+        public void Zr_P5_control_a_rule_on_a_subtype_field_at_the_root_is_enforced()
+        {
+            ZrCreature[] rows = { new ZrCat { Id = 1, Name = "Tom", Microchip = "chip-by-rule" } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), DwTier.Strict, Denying("Microchip")).ToList(new Filter()).Data), "chip-by-rule"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P5_a_rule_on_a_subtype_field_through_a_base_typed_member_in_memory(DwTier tier)
+        {
+            ZrPen[] rows = { new() { Id = 1, Label = "pen", Pet = new ZrCat { Id = 2, Name = "Tom", Microchip = "chip-by-rule" } } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier, Denying("Pet.Microchip")).ToList(new Filter()).Data), "chip-by-rule"));
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier, Denying("Pet.Microchip")).ToList(Selecting("Id", "Pet")).Data), "chip-by-rule"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P5_control_the_entity_query_enforces_the_rule(DwTier tier)
+        {
+            Assert.True(Holds(_db.Loans.Include(l => l.Org).AsNoTracking().ToList(), "swift-by-rule"));
+
+            Assert.False(Holds(SafeRead(() => Guard(_db.Loans.Include(l => l.Org), tier, Denying("Org.Swift")).ToList(new Filter()).Data), "swift-by-rule"));
+            Assert.False(Holds(SafeRead(() => Guard(_db.Loans, tier, Denying("Org.Swift")).ToList(Selecting("Id", "Org")).Data), "swift-by-rule"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P5_a_rule_on_a_subtype_field_through_a_projected_member(DwTier tier)
+        {
+            IQueryable<ZrLoanRow> rows = _db.Loans.Select(l => new ZrLoanRow { Id = l.Id, Note = l.Note, Org = l.Org });
+
+            Assert.False(Holds(SafeRead(() => Guard(rows, tier, Denying("Org.Swift")).ToList(new Filter()).Data), "swift-by-rule"));
+            Assert.False(Holds(SafeRead(() => Guard(rows, tier, Denying("Org.Swift")).ToList(Selecting("Id", "Org")).Data), "swift-by-rule"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P5_a_rule_on_a_subtype_field_through_the_composable_Select(DwTier tier)
+        {
+            Assert.False(Holds(
+                SafeRead(() => Guard(_db.Loans, tier, Denying("Org.Swift")).Select(new List<string> { "Id", "Org" }).ToList(new Filter()).Data),
+                "swift-by-rule"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P6
+
+        [Fact]
+        public void Zr_P6_a_Concat_of_two_projections_assigning_different_members()
+        {
+            IQueryable<ZrAcctRow> rows = _db.Employees
+                .Select(e => new ZrAcctRow { Id = e.Id, Name = e.Name })
+                .Concat(_db.Employees.Select(e => new ZrAcctRow
+                {
+                    Id = e.Id,
+                    Name = e.Name,
+                    Person = new ZrPersonView { Name = e.Name, TaxId = "concat-secret" }
+                }));
+
+            Exception? unguarded = Record.Exception(() => rows.ToList());
+
+            if (unguarded is not null)
+            {
+                // EF Core cannot run it at all, so nothing can leak through it.
+                return;
+            }
+
+            Assert.False(Holds(SafeRead(() => Guard(rows).ToList(new Filter()).Data), "concat-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P8
+
+        [Fact]
+        public void Zr_P8_two_members_differing_only_in_letter_case()
+        {
+            ZrCaseRow[] rows = { new() { Id = 1, INFO = new ZrCardInfo { Pan = "case-secret" }, Info = new ZrSafeInfo { Label = "ok" } } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data), "case-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P9
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P9_including_a_skip_navigation_does_not_carry_the_join_entity_payload(DwTier tier)
+        {
+            IQueryable<ZrPost> source = _db.Posts.Include(p => p.Tags);
+
+            bool unguardedLeaks = Holds(source.AsNoTracking().ToList(), "join-secret");
+
+            Assert.False(Holds(SafeRead(() => Guard(source, tier).ToList(new Filter()).Data), "join-secret"),
+                $"unguarded leaks: {unguardedLeaks}");
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewLeakTests2.cs b/DynamicWhere.Tests/Policies/ReviewLeakTests2.cs
new file mode 100644
index 0000000..80f0fea
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewLeakTests2.cs
@@ -0,0 +1,450 @@
+using System.Collections;
+using System.Reflection;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ round 3, batch 2: models
+
+    // ---- P10: a derived type overrides a member its base declares, and denies it there ----------------
+
+    public class ZrVehicle
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public virtual string? Code { get; set; }
+    }
+
+    public class ZrArmored : ZrVehicle
+    {
+        /// <summary>Overridden to deny it here; it reads and writes the base's storage, which EF Core maps.</summary>
+        [DwDenied]
+        public override string? Code
+        {
+            get => base.Code;
+            set => base.Code = value;
+        }
+    }
+
+    public class ZrConvoy
+    {
+        public int Id { get; set; }
+
+        public string Route { get; set; } = string.Empty;
+
+        public int ZrVehicleId { get; set; }
+
+        public ZrVehicle? Lead { get; set; }
+    }
+
+    public class ZrConvoyRow
+    {
+        public int Id { get; set; }
+
+        public ZrVehicle? Lead { get; set; }
+    }
+
+    // ---- P11: a projection that builds a subtype of T --------------------------------------------------
+
+    public class ZrOrgDto
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZrBankDto : ZrOrgDto
+    {
+        [DwDenied]
+        public string? Swift { get; set; }
+    }
+
+    // ---- P3d: a base type whose only subtype is generic, under a policy denying what it does not name ---
+
+    public class ZrShape
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+    }
+
+    public class ZrShapeOf<TUnit> : ZrShape
+    {
+        public string? Hidden { get; set; }
+    }
+
+    public class ZrCanvas
+    {
+        public int Id { get; set; }
+
+        public ZrShape? Shape { get; set; }
+    }
+
+    // ---- P12: an asynchronous lazy-loader delegate ------------------------------------------------------
+
+    public class ZrAsyncBlog
+    {
+        private readonly Func<object, CancellationToken, string, Task>? _loader;
+        private List<ZrAsyncPost>? _posts;
+
+        public ZrAsyncBlog()
+        {
+        }
+
+        private ZrAsyncBlog(Func<object, CancellationToken, string, Task> lazyLoader) => _loader = lazyLoader;
+
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZrAsyncPost> Posts
+        {
+            get
+            {
+                _loader?.Invoke(this, CancellationToken.None, nameof(Posts)).GetAwaiter().GetResult();
+
+                return _posts ??= new List<ZrAsyncPost>();
+            }
+            set => _posts = value;
+        }
+
+        public bool HasLoader => _loader is not null;
+    }
+
+    public class ZrAsyncPost
+    {
+        public int Id { get; set; }
+
+        public int ZrAsyncBlogId { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Draft { get; set; }
+    }
+
+    public sealed class ZrProbeContext2 : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZrProbeContext2(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZrVehicle> Vehicles => Set<ZrVehicle>();
+
+        public DbSet<ZrConvoy> Convoys => Set<ZrConvoy>();
+
+        public DbSet<ZrAsyncBlog> AsyncBlogs => Set<ZrAsyncBlog>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZrArmored>();
+            model.Entity<ZrAsyncBlog>().Navigation(b => b.Posts).HasField("_posts");
+            model.Entity<ZrAsyncBlog>().Ignore(b => b.HasLoader);
+        }
+    }
+
+    // ============================================================================ round 3, batch 2: tests
+
+    public sealed class ReviewLeakTests2 : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZrProbeContext2 _db;
+
+        public ReviewLeakTests2(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+
+            _db = new ZrProbeContext2(_connection);
+            _db.Database.EnsureCreated();
+
+            _db.Convoys.Add(new ZrConvoy { Route = "R1", Lead = new ZrArmored { Name = "A1", Code = "override-secret" } });
+            _db.AsyncBlogs.Add(new ZrAsyncBlog { Name = "B1", Posts = { new ZrAsyncPost { Title = "T", Draft = "async-draft" } } });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict, params IDwPolicyProvider[] more)
+            where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }.Concat(more).ToArray()));
+
+        private static Filter Selecting(params string[] fields) => new() { Selects = fields.ToList() };
+
+        private static FakePolicyProvider DenyingAllBut(params string[] allowed)
+        {
+            FakePolicyProvider rules = new FakePolicyProvider()
+                .Add("*", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            foreach (string path in allowed)
+            {
+                rules.Add(path, PolicyFeature.Select, PolicyEffect.Allow, PolicyLevel.DynamicGlobal);
+            }
+
+            return rules;
+        }
+
+        private static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is ValueType || current is MemberInfo)
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held == text)
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (!seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IEnumerable items)
+                {
+                    foreach (object? item in items)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                foreach (PropertyInfo property in current.GetType().GetProperties())
+                {
+                    if (property.GetIndexParameters().Length != 0 || !property.CanRead)
+                    {
+                        continue;
+                    }
+
+                    try
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                    catch
+                    {
+                        // A getter that throws holds nothing readable.
+                    }
+                }
+            }
+
+            return false;
+        }
+
+        private static object? SafeRead(Func<object?> read)
+        {
+            try
+            {
+                return read();
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode == PolicyErrorCode.FieldDeniedForSelect)
+            {
+                return null;
+            }
+        }
+
+        // ------------------------------------------------------------------------------------------------ P10
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10_rows_in_memory_of_a_subtype_that_denies_an_overridden_member(DwTier tier)
+        {
+            ZrVehicle[] rows = { new ZrArmored { Id = 1, Name = "A1", Code = "override-secret" } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data), "override-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10_an_entity_hierarchy_root_whose_derived_type_denies_an_overridden_column(DwTier tier)
+        {
+            Assert.True(Holds(_db.Vehicles.AsNoTracking().ToList(), "override-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(_db.Vehicles, tier).ToList(new Filter()).Data), "override-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(_db.Vehicles, tier).ToListDynamic(new Filter()).Data), "override-secret"));
+        }
+
+        /// <summary>The same member read through the base type is also groupable, so a summary returns it as a key.</summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10_a_summary_grouped_by_the_overridden_member(DwTier tier)
+        {
+            Summary summary = new()
+            {
+                GroupBy = new DynamicWhere.ex.Classes.Core.GroupBy
+                {
+                    Fields = new List<string> { "Code" },
+                    AggregateBy = new List<DynamicWhere.ex.Classes.Core.AggregateBy>
+                    {
+                        new() { Alias = "Total", Aggregator = DynamicWhere.ex.Enums.Aggregator.Count }
+                    }
+                }
+            };
+
+            string sent;
+
+            try
+            {
+                sent = System.Text.Json.JsonSerializer.Serialize(Guard(_db.Vehicles, tier).ToList(summary).Data);
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode is PolicyErrorCode.FieldDeniedForGroup or PolicyErrorCode.FieldDeniedForSelect)
+            {
+                return;
+            }
+
+            _out.WriteLine(sent);
+
+            Assert.DoesNotContain("override-secret", sent);
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10_an_included_base_typed_navigation(DwTier tier)
+        {
+            IQueryable<ZrConvoy> source = _db.Convoys.Include(c => c.Lead);
+
+            Assert.True(Holds(source.AsNoTracking().ToList(), "override-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(source, tier).ToList(new Filter()).Data), "override-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10_a_base_typed_navigation_named_in_Selects(DwTier tier)
+        {
+            Assert.False(Holds(SafeRead(() => Guard(_db.Convoys, tier).ToList(Selecting("Id", "Lead")).Data), "override-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(_db.Convoys, tier).ToList(Selecting("Id", "Lead.Code")).Data), "override-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10_control_a_projected_base_typed_member_is_scanned(DwTier tier)
+        {
+            IQueryable<ZrConvoyRow> rows = _db.Convoys.Select(c => new ZrConvoyRow { Id = c.Id, Lead = c.Lead });
+
+            Assert.False(Holds(SafeRead(() => Guard(rows, tier).ToList(new Filter()).Data), "override-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P11
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P11_a_projection_that_builds_a_subtype_of_T(DwTier tier)
+        {
+            // A repository returning IQueryable<ZrOrgDto> from a projection into the derived DTO.
+            IQueryable<ZrOrgDto> covariant = _db.Convoys.Select(c => new ZrBankDto { Id = c.Id, Name = c.Route, Swift = c.Route + "-swift-secret" });
+            IQueryable<ZrOrgDto> declared = _db.Convoys.Select<ZrConvoy, ZrOrgDto>(c => new ZrBankDto { Id = c.Id, Name = c.Route, Swift = c.Route + "-swift-secret" });
+
+            Assert.True(Holds(covariant.ToList(), "R1-swift-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(covariant, tier).ToList(new Filter()).Data), "R1-swift-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(declared, tier).ToList(new Filter()).Data), "R1-swift-secret"));
+            Assert.False(Holds(SafeRead(() => Guard(covariant, tier).ToListDynamic(new Filter()).Data), "R1-swift-secret"));
+        }
+
+        [Fact]
+        public void Zr_P11_control_the_same_rows_in_memory_are_projected()
+        {
+            ZrOrgDto[] rows = { new ZrBankDto { Id = 1, Name = "R1", Swift = "R1-swift-secret" } };
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data), "R1-swift-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P3d
+
+        [Fact]
+        public void Zr_P3d_a_generic_only_subtype_under_a_deny_by_default_policy()
+        {
+            ZrCanvas[] rows = { new() { Id = 1, Shape = new ZrShapeOf<int> { Id = 2, Kind = "k", Hidden = "unnamed-secret" } } };
+
+            FakePolicyProvider rules = DenyingAllBut("Id", "Shape", "Shape.Id", "Shape.Kind");
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), DwTier.Strict, rules).ToList(Selecting("Id", "Shape")).Data), "unnamed-secret"));
+        }
+
+        [Fact]
+        public void Zr_P3d_control_a_non_generic_subtype_under_the_same_policy_is_refused()
+        {
+            ZrPen[] rows = { new() { Id = 1, Label = "pen", Pet = new ZrCat { Id = 2, Name = "Tom", Microchip = "unnamed-secret" } } };
+
+            FakePolicyProvider rules = DenyingAllBut("Id", "Pet", "Pet.Id", "Pet.Name");
+
+            Assert.False(Holds(SafeRead(() => Guard(rows.AsQueryable(), DwTier.Strict, rules).ToList(Selecting("Id", "Pet")).Data), "unnamed-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P12
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P12_an_asynchronous_lazy_loader_delegate(DwTier tier)
+        {
+            ZrAsyncBlog unguarded = _db.AsyncBlogs.AsNoTracking().ToList().Single();
+
+            try
+            {
+                _out.WriteLine($"EF injected the async loader: {unguarded.HasLoader}; unguarded posts: {unguarded.Posts.Count}");
+            }
+            catch (InvalidOperationException detached)
+            {
+                // EF Core 6 refuses to lazy-load an entity read with AsNoTracking, so nothing can load after the query.
+                _out.WriteLine($"no lazy loading of an untracked entity here: {detached.Message}");
+
+                return;
+            }
+
+            ZrAsyncBlog guarded = Guard(_db.AsyncBlogs, tier).ToList(new Filter()).Data.Single();
+
+            _out.WriteLine($"guarded row has loader: {guarded.HasLoader}");
+
+            Assert.DoesNotContain(guarded.Posts, post => post.Draft == "async-draft");
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewLeakTests3.cs b/DynamicWhere.Tests/Policies/ReviewLeakTests3.cs
new file mode 100644
index 0000000..a0420f5
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewLeakTests3.cs
@@ -0,0 +1,174 @@
+using System.Collections;
+using System.Reflection;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ round 3, batch 3: models
+
+    /// <summary>An application collection that implements only the non-generic IEnumerable.</summary>
+    public sealed class ZrLooseBag : IEnumerable
+    {
+        private readonly List<object> _items = new();
+
+        public void Add(object item) => _items.Add(item);
+
+        public IEnumerator GetEnumerator() => _items.GetEnumerator();
+    }
+
+    public class ZrVoucher
+    {
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Code { get; set; }
+    }
+
+    public class ZrWallet
+    {
+        public int Id { get; set; }
+
+        public string Owner { get; set; } = string.Empty;
+
+        public ZrLooseBag Vouchers { get; set; } = new();
+    }
+
+    // ============================================================================ round 3, batch 3: tests
+
+    public sealed class ReviewLeakTests3 : IDisposable
+    {
+        private readonly SqliteConnection _connection;
+        private readonly ZrProbeContext _db;
+
+        public ReviewLeakTests3()
+        {
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+
+            _db = new ZrProbeContext(_connection);
+            _db.Database.EnsureCreated();
+
+            _db.Loans.Add(new ZrLoan { Note = "gen", Org = new ZrGenOrg<int> { Name = "G", Secret = "generic-entity-secret" } });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict, params IDwPolicyProvider[] more)
+            where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }.Concat(more).ToArray()));
+
+        private static Filter Selecting(params string[] fields) => new() { Selects = fields.ToList() };
+
+        private static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is ValueType || current is MemberInfo)
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held == text)
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (!seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IEnumerable items)
+                {
+                    foreach (object? item in items)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                foreach (PropertyInfo property in current.GetType().GetProperties())
+                {
+                    if (property.GetIndexParameters().Length != 0 || !property.CanRead)
+                    {
+                        continue;
+                    }
+
+                    try
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                    catch
+                    {
+                        // A getter that throws holds nothing readable.
+                    }
+                }
+            }
+
+            return false;
+        }
+
+        private static object? SafeRead(Func<object?> read)
+        {
+            try
+            {
+                return read();
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode == PolicyErrorCode.FieldDeniedForSelect)
+            {
+                return null;
+            }
+        }
+
+        // ------------------------------------------------------------------------------------------------ P3e
+
+        /// <summary>
+        /// An entity query re-rooted by Select reads no model, so its derived types come from the subtype search,
+        /// which never lists a generic one.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P3e_an_entity_query_re_rooted_by_Select_holding_a_closed_generic_derived_entity(DwTier tier)
+        {
+            IQueryable<ZrOrg> source = _db.Loans.Select(l => l.Org!);
+
+            Assert.True(Holds(source.AsNoTracking().ToList(), "generic-entity-secret"));
+
+            Assert.False(Holds(SafeRead(() => Guard(source, tier).ToList(new Filter()).Data), "generic-entity-secret"));
+        }
+
+        // ------------------------------------------------------------------------------------------------ P13
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewLeakTests4.cs b/DynamicWhere.Tests/Policies/ReviewLeakTests4.cs
new file mode 100644
index 0000000..84c30bd
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewLeakTests4.cs
@@ -0,0 +1,142 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ---- P10b: an interface declares the member; the implementing class denies it -------------------------
+
+    public interface IZrAccount
+    {
+        int Id { get; }
+
+        string Holder { get; }
+
+        string? Iban { get; }
+    }
+
+    public class ZrAccountEntity : IZrAccount
+    {
+        public int Id { get; set; }
+
+        public string Holder { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Iban { get; set; }
+    }
+
+    public class ZrStatement
+    {
+        public int Id { get; set; }
+
+        public IZrAccount? Account { get; set; }
+    }
+
+    public sealed class ZrProbeContext4 : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZrProbeContext4(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZrAccountEntity> Accounts => Set<ZrAccountEntity>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+    }
+
+    public sealed class ReviewLeakTests4 : IDisposable
+    {
+        private readonly SqliteConnection _connection;
+        private readonly ZrProbeContext4 _db;
+
+        public ReviewLeakTests4()
+        {
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZrProbeContext4(_connection);
+            _db.Database.EnsureCreated();
+            _db.Accounts.Add(new ZrAccountEntity { Holder = "H", Iban = "iban-secret" });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict)
+            where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        private static bool Leaks(Func<IEnumerable<object?>> read)
+        {
+            try
+            {
+                return read().Any(row => row is ZrAccountEntity { Iban: "iban-secret" }
+                                         || row is ZrStatement { Account: ZrAccountEntity { Iban: "iban-secret" } });
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode is PolicyErrorCode.FieldDeniedForSelect or PolicyErrorCode.AllSelectsDenied)
+            {
+                return false;
+            }
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10b_rows_in_memory_read_through_the_interface_that_declares_the_denied_member(DwTier tier)
+        {
+            IZrAccount[] rows = { new ZrAccountEntity { Id = 1, Holder = "H", Iban = "iban-secret" } };
+
+            Assert.False(Leaks(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10b_an_entity_query_read_through_the_interface(DwTier tier)
+        {
+            IQueryable<IZrAccount> source = _db.Accounts;
+
+            Exception? unguarded = Record.Exception(() => source.AsNoTracking().ToList());
+
+            if (unguarded is not null)
+            {
+                // EF Core cannot run the query through the interface at all.
+                return;
+            }
+
+            Assert.False(Leaks(() => Guard(source, tier).ToList(new Filter()).Data));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P10b_a_member_typed_as_the_interface(DwTier tier)
+        {
+            ZrStatement[] rows = { new() { Id = 1, Account = new ZrAccountEntity { Id = 2, Holder = "H", Iban = "iban-secret" } } };
+
+            Assert.False(Leaks(() => Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data));
+            Assert.False(Leaks(() => Guard(rows.AsQueryable(), tier).ToList(new Filter { Selects = new List<string> { "Id", "Account" } }).Data));
+        }
+
+        [Fact]
+        public void Zr_P10b_control_the_class_itself_is_policed()
+        {
+            ZrAccountEntity[] rows = { new() { Id = 1, Holder = "H", Iban = "iban-secret" } };
+
+            Assert.False(Leaks(() => Guard(rows.AsQueryable()).ToList(new Filter()).Data));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewLeakTests5.cs b/DynamicWhere.Tests/Policies/ReviewLeakTests5.cs
new file mode 100644
index 0000000..920786e
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewLeakTests5.cs
@@ -0,0 +1,121 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ---- P12b: an entity that takes the DbContext in its constructor and loads its navigation with it -----
+
+    public class ZrCtxBlog
+    {
+        private readonly ZrProbeContext5? _context;
+        private List<ZrCtxPost>? _posts;
+
+        public ZrCtxBlog()
+        {
+        }
+
+        private ZrCtxBlog(ZrProbeContext5 context) => _context = context;
+
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        /// <summary>Loaded on first read through the context EF Core injected, the pattern EF Core documents.</summary>
+        public List<ZrCtxPost> Posts
+        {
+            get => _posts ??= _context?.Set<ZrCtxPost>().AsNoTracking().Where(p => p.ZrCtxBlogId == Id).ToList()
+                              ?? new List<ZrCtxPost>();
+            set => _posts = value;
+        }
+    }
+
+    public class ZrCtxPost
+    {
+        public int Id { get; set; }
+
+        public int ZrCtxBlogId { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Draft { get; set; }
+    }
+
+    public sealed class ZrProbeContext5 : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZrProbeContext5(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZrCtxBlog> Blogs => Set<ZrCtxBlog>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model) =>
+            model.Entity<ZrCtxBlog>().Navigation(b => b.Posts).HasField("_posts");
+    }
+
+    public sealed class ReviewLeakTests5 : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZrProbeContext5 _db;
+
+        public ReviewLeakTests5(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZrProbeContext5(_connection);
+            _db.Database.EnsureCreated();
+            _db.Blogs.Add(new ZrCtxBlog { Name = "B1", Posts = { new ZrCtxPost { Title = "T", Draft = "context-draft" } } });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict)
+            where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P12b_a_navigation_its_entity_loads_through_an_injected_DbContext(DwTier tier)
+        {
+            ZrCtxBlog unguarded = _db.Blogs.AsNoTracking().ToList().Single();
+
+            _out.WriteLine($"unguarded drafts: {string.Join(",", unguarded.Posts.Select(p => p.Draft))}");
+
+            ZrCtxBlog guarded;
+
+            try
+            {
+                guarded = Guard(_db.Blogs, tier).ToList(new Filter()).Data.Single();
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode == PolicyErrorCode.FieldDeniedForSelect)
+            {
+                return;
+            }
+
+            Assert.DoesNotContain(guarded.Posts, post => post.Draft == "context-draft");
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewLeakTests6.cs b/DynamicWhere.Tests/Policies/ReviewLeakTests6.cs
new file mode 100644
index 0000000..5c6ea69
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewLeakTests6.cs
@@ -0,0 +1,96 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ---- P1c: a top-level denial forces the projection, and the owned member is still kept whole -----------
+
+    public class ZrClinic2
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Notes { get; set; }
+
+        public ZrContact Contact { get; set; } = new();
+    }
+
+    public sealed class ZrProbeContext6 : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZrProbeContext6(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZrClinic2> Clinics => Set<ZrClinic2>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model) =>
+            model.Entity<ZrClinic2>().OwnsOne(c => c.Contact, o => o.Property<string?>("_phone"));
+    }
+
+    public sealed class ReviewLeakTests6 : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZrProbeContext6 _db;
+
+        public ReviewLeakTests6(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZrProbeContext6(_connection);
+            _db.Database.EnsureCreated();
+
+            ZrClinic2 clinic = new() { Name = "C1", Notes = "notes-secret", Contact = new ZrContact { City = "Basra" } };
+            clinic.Contact.SetPhone("phone-secret");
+            _db.Clinics.Add(clinic);
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zr_P1c_an_owned_member_kept_whole_by_a_synthesized_projection(DwTier tier)
+        {
+            PolicyQueryable<ZrClinic2> guarded = _db.Clinics.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+            ZrClinic2 row = guarded.ToList(new Filter()).Data.Single();
+
+            foreach (PolicyDecision decision in guarded.LastTrace!.Decisions)
+            {
+                _out.WriteLine($"trace: {decision.FieldPath} {decision.Feature} {decision.Action} {decision.Reason}");
+            }
+
+            // The projection ran: the top-level denial is withheld.
+            Assert.Null(row.Notes);
+            Assert.Equal("Basra", row.Contact.City);
+
+            // And the owned member it kept whole carries the value its unmapped getter exposes.
+            Assert.Null(row.Contact.Phone.Number);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewLeakTests7.cs b/DynamicWhere.Tests/Policies/ReviewLeakTests7.cs
new file mode 100644
index 0000000..6a32ad8
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewLeakTests7.cs
@@ -0,0 +1,228 @@
+using System.Collections;
+using System.Reflection;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ---- an interface a subtype adds over a member it inherits ---------------------------------------------
+
+    public interface IZwCarded
+    {
+        [DwDenied]
+        string? Pan { get; }
+    }
+
+    public class ZwAccount
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public string? Pan { get; set; }
+    }
+
+    /// <summary>Declares nothing of its own: the base class's member implements the denied interface member.</summary>
+    public class ZwCardAccount : ZwAccount, IZwCarded
+    {
+    }
+
+    // ---- an interface implemented by an override whose base declaration denies ----------------------------
+
+    public interface IZwPinned
+    {
+        int Id { get; }
+
+        string? Pin { get; }
+    }
+
+    public class ZwPinBase
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public virtual string? Pin { get; set; }
+    }
+
+    public class ZwPinned : ZwPinBase, IZwPinned
+    {
+        public override string? Pin
+        {
+            get => base.Pin;
+            set => base.Pin = value;
+        }
+    }
+
+    public class ZwPinHolder
+    {
+        public int Id { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        public List<IZwPinned> Pins { get; set; } = new();
+    }
+
+    // ---- one class implementing two instantiations of a generic interface, one of them denied --------------
+
+    public interface IZwSlot<T>
+    {
+        string? Code { get; }
+    }
+
+    public class ZwTwoSlots : IZwSlot<int>, IZwSlot<string>
+    {
+        public int Id { get; set; }
+
+        public string? Open { get; set; }
+
+        public string? Sealed { get; set; }
+
+        string? IZwSlot<int>.Code => Open;
+
+        [DwDenied]
+        string? IZwSlot<string>.Code => Sealed;
+    }
+
+    /// <summary>
+    /// A denial on another declaration of a member than the one walked: an interface a subtype adds over a
+    /// member it inherits, and an implementation that is an override of a denied member.
+    /// </summary>
+    public class ReviewLeakTests7
+    {
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict)
+            where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        private static Filter Where(string field, string value) => new()
+        {
+            ConditionGroup = new ConditionGroup
+            {
+                Conditions = { new Condition { Field = field, DataType = DataType.Text, Operator = Operator.Equal, Values = { value } } }
+            }
+        };
+
+        /// <summary>True when a value, read by runtime type and through every collection, holds the text.</summary>
+        private static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is ValueType)
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held == text)
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (!seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IEnumerable items)
+                {
+                    foreach (object? item in items)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                foreach (PropertyInfo property in current.GetType().GetProperties(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance))
+                {
+                    if (property.GetIndexParameters().Length == 0 && property.CanRead)
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                }
+            }
+
+            return false;
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void An_interface_a_subtype_adds_over_an_inherited_member_denies_the_base_path(DwTier tier)
+        {
+            ZwAccount[] rows = { new ZwCardAccount { Id = 1, Name = "a", Pan = "inherited-pan-secret" } };
+
+            PolicyException refusal = Assert.ThrowsAny<PolicyException>(
+                () => Guard(rows.AsQueryable(), tier).ToList(Where("Pan", "inherited-pan-secret")));
+
+            Assert.Equal(PolicyErrorCode.FieldDeniedForWhere, refusal.ErrorCode);
+            Assert.False(Holds(Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data, "inherited-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void An_implementation_that_overrides_a_denied_member_denies_the_interface_path(DwTier tier)
+        {
+            IZwPinned[] rows = { new ZwPinned { Id = 1, Pin = "override-pin-secret" } };
+
+            PolicyException refusal = Assert.ThrowsAny<PolicyException>(
+                () => Guard(rows.AsQueryable(), tier).ToList(Where("Pin", "override-pin-secret")));
+
+            Assert.Equal(PolicyErrorCode.FieldDeniedForWhere, refusal.ErrorCode);
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void A_list_of_the_interface_is_not_returned_holding_the_denied_value(DwTier tier)
+        {
+            ZwPinHolder[] rows =
+            {
+                new() { Id = 1, Label = "desk", Pins = { new ZwPinned { Id = 2, Pin = "listed-pin-secret" } } }
+            };
+
+            object? data = Guard(rows.AsQueryable(), tier).ToList(new Filter()).Data;
+
+            Assert.False(Holds(data, "listed-pin-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void A_denial_on_one_instantiation_of_a_generic_interface_leaves_the_other_alone(DwTier tier)
+        {
+            ZwTwoSlots row = new() { Id = 1, Open = "open", Sealed = "sealed-secret" };
+            IZwSlot<int>[] open = { row };
+            IZwSlot<string>[] sealedRows = { row };
+
+            Assert.Single(Guard(open.AsQueryable(), tier).ToList(Where("Code", "open")).Data);
+
+            PolicyException refusal = Assert.ThrowsAny<PolicyException>(
+                () => Guard(sealedRows.AsQueryable(), tier).ToList(Where("Code", "sealed-secret")));
+
+            Assert.Equal(PolicyErrorCode.FieldDeniedForWhere, refusal.ErrorCode);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewObjectMemberTests.cs b/DynamicWhere.Tests/Policies/ReviewObjectMemberTests.cs
new file mode 100644
index 0000000..363fcc8
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewObjectMemberTests.cs
@@ -0,0 +1,453 @@
+using System.Collections;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Reflection;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ members that can hold any object: models
+
+    /// <summary>The application type an event's payload column is converted to and from.</summary>
+    public class ZvCardIssued
+    {
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    /// <summary>An event whose payload column is typed object and converted to an application type.</summary>
+    public class ZvEvent
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+
+        public object? Payload { get; set; }
+    }
+
+    /// <summary>The same, with a top-level denial that asks for a projection on its own.</summary>
+    public class ZvAuditedEvent
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Actor { get; set; }
+
+        public object? Payload { get; set; }
+    }
+
+    /// <summary>An owned member holding the converted payload, beside a top-level denial.</summary>
+    public class ZvEnvelope
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Actor { get; set; }
+
+        public ZvMeta Meta { get; set; } = new();
+    }
+
+    public class ZvMeta
+    {
+        public string Tag { get; set; } = string.Empty;
+
+        public object? Payload { get; set; }
+    }
+
+    /// <summary>An unmapped getter typed object, over a private automatically included navigation.</summary>
+    public class ZvKeyring
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        private List<ZvKey> Keys { get; set; } = new();
+
+        [NotMapped]
+        public object Items => Keys;
+
+        public void Add(ZvKey key) => Keys.Add(key);
+    }
+
+    /// <summary>Control: the same getter typed as the element list, which the policy reads.</summary>
+    public class ZvTypedKeyring
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        private List<ZvTypedKey> Keys { get; set; } = new();
+
+        [NotMapped]
+        public IReadOnlyList<ZvTypedKey> Items => Keys;
+
+        public void Add(ZvTypedKey key) => Keys.Add(key);
+    }
+
+    public class ZvKey
+    {
+        public int Id { get; set; }
+
+        public int ZvKeyringId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    public class ZvTypedKey
+    {
+        public int Id { get; set; }
+
+        public int ZvTypedKeyringId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    /// <summary>
+    /// An entity whose unmapped member the application fills once EF Core has read it, beside a top-level denial.
+    /// </summary>
+    public class ZvNotedEvent
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Actor { get; set; }
+
+        [NotMapped]
+        public object? Note { get; set; }
+    }
+
+    /// <summary>The same, one level down: an owned member whose unmapped member the application fills.</summary>
+    public class ZvNoteHolder
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Actor { get; set; }
+
+        public ZvNoteMeta Meta { get; set; } = new();
+    }
+
+    public class ZvNoteMeta
+    {
+        public string Tag { get; set; } = string.Empty;
+
+        [NotMapped]
+        public object? Note { get; set; }
+    }
+
+    public sealed class ZvObjectContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZvObjectContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZvEvent> Events => Set<ZvEvent>();
+
+        public DbSet<ZvAuditedEvent> AuditedEvents => Set<ZvAuditedEvent>();
+
+        public DbSet<ZvEnvelope> Envelopes => Set<ZvEnvelope>();
+
+        public DbSet<ZvKeyring> Keyrings => Set<ZvKeyring>();
+
+        public DbSet<ZvTypedKeyring> TypedKeyrings => Set<ZvTypedKeyring>();
+
+        public DbSet<ZvNotedEvent> NotedEvents => Set<ZvNotedEvent>();
+
+        public DbSet<ZvNoteHolder> NoteHolders => Set<ZvNoteHolder>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        private static string Write(object? value) => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null);
+
+        private static object? Read(string text) => JsonSerializer.Deserialize<ZvCardIssued>(text, (JsonSerializerOptions?)null);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZvEvent>().Property(e => e.Payload).HasConversion(v => Write(v), s => Read(s));
+            model.Entity<ZvAuditedEvent>().Property(e => e.Payload).HasConversion(v => Write(v), s => Read(s));
+            model.Entity<ZvEnvelope>().OwnsOne(e => e.Meta, m => m.Property(x => x.Payload).HasConversion(v => Write(v), s => Read(s)));
+            model.Entity<ZvNoteHolder>().OwnsOne(h => h.Meta);
+            model.Entity<ZvKeyring>(b =>
+            {
+                b.HasMany<ZvKey>("Keys").WithOne().HasForeignKey(k => k.ZvKeyringId);
+                b.Navigation("Keys").AutoInclude();
+            });
+            model.Entity<ZvTypedKeyring>(b =>
+            {
+                b.HasMany<ZvTypedKey>("Keys").WithOne().HasForeignKey(k => k.ZvTypedKeyringId);
+                b.Navigation("Keys").AutoInclude();
+            });
+        }
+    }
+
+    // ============================================================================ members that can hold any object: tests
+
+    /// <summary>
+    /// A member typed object asks for no projection. What EF Core materializes holds no application object, but a
+    /// converted column can, so once a projection is built for another reason it is left out rather than kept
+    /// whole; an unmapped getter typed as the list it hands out is read as that list.
+    /// </summary>
+    public sealed class ReviewObjectMemberTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZvObjectContext _db;
+
+        public ReviewObjectMemberTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZvObjectContext(_connection);
+            _db.Database.EnsureCreated();
+
+            _db.Events.Add(new ZvEvent { Kind = "CardIssued", Payload = new ZvCardIssued { Label = "visa", Pan = "event-pan-secret" } });
+            _db.AuditedEvents.Add(new ZvAuditedEvent
+            {
+                Kind = "CardIssued", Actor = "actor-secret", Payload = new ZvCardIssued { Label = "visa", Pan = "audited-pan-secret" }
+            });
+            _db.Envelopes.Add(new ZvEnvelope
+            {
+                Kind = "CardIssued", Actor = "actor-secret",
+                Meta = new ZvMeta { Tag = "t", Payload = new ZvCardIssued { Label = "visa", Pan = "owned-pan-secret" } }
+            });
+
+            ZvKeyring keyring = new() { Name = "K1" };
+            keyring.Add(new ZvKey { Label = "front", Secret = "key-secret" });
+            _db.Keyrings.Add(keyring);
+
+            ZvTypedKeyring typed = new() { Name = "K2" };
+            typed.Add(new ZvTypedKey { Label = "back", Secret = "typed-key-secret" });
+            _db.TypedKeyrings.Add(typed);
+
+            _db.NotedEvents.Add(new ZvNotedEvent { Kind = "Noted", Actor = "noted-actor-secret" });
+            _db.NoteHolders.Add(new ZvNoteHolder { Kind = "Held", Actor = "holder-actor-secret", Meta = new ZvNoteMeta { Tag = "t1" } });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict)
+            where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        private static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is ValueType || current is MemberInfo)
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held == text)
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (!seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IEnumerable items)
+                {
+                    foreach (object? item in items)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                foreach (PropertyInfo property in current.GetType().GetProperties())
+                {
+                    if (property.GetIndexParameters().Length != 0 || !property.CanRead)
+                    {
+                        continue;
+                    }
+
+                    try
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                    catch
+                    {
+                        // A getter that throws holds nothing readable.
+                    }
+                }
+            }
+
+            return false;
+        }
+
+        private static object? SafeRead(Func<object?> read)
+        {
+            try
+            {
+                return read();
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode is PolicyErrorCode.FieldDeniedForSelect or PolicyErrorCode.AllSelectsDenied)
+            {
+                return null;
+            }
+        }
+
+        private string Describe<T>(PolicyQueryable<T> guarded, object? data) where T : class =>
+            "sent=" + JsonSerializer.Serialize(data) + " decisions=["
+            + string.Join(" | ", guarded.LastTrace?.Decisions
+                .Where(d => d.Action != PolicyAction.Allowed)
+                .Select(d => $"{d.FieldPath} {d.Action}: {d.Reason}") ?? Array.Empty<string>()) + "]";
+
+        // ------------------------------------------------------------------------ a converted column typed object
+
+        /// <summary>
+        /// 3.1.0 synthesized a projection of scalars only whenever a top-level field was denied, so this column was
+        /// dropped with the denied Actor. Now a synthesized projection keeps an entity's object column whole.
+        /// </summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_D5_a_converted_object_column_beside_a_top_level_denial(DwTier tier)
+        {
+            Assert.True(Holds(_db.AuditedEvents.AsNoTracking().ToList(), "audited-pan-secret"));
+
+            PolicyQueryable<ZvAuditedEvent> guarded = Guard(_db.AuditedEvents, tier);
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine(Describe(guarded, data));
+
+            Assert.False(Holds(data, "actor-secret"));
+            Assert.False(Holds(data, "audited-pan-secret"));
+        }
+
+        /// <summary>An owned member holding the converted column, beside a top-level denial.</summary>
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_D5_an_owned_member_holding_a_converted_object_column_beside_a_top_level_denial(DwTier tier)
+        {
+            Assert.True(Holds(_db.Envelopes.AsNoTracking().ToList(), "owned-pan-secret"));
+
+            PolicyQueryable<ZvEnvelope> guarded = Guard(_db.Envelopes, tier);
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine(Describe(guarded, data));
+
+            Assert.False(Holds(data, "owned-pan-secret"));
+        }
+
+        // ------------------------------------------------------------------------ an unmapped getter typed object
+
+        [Fact]
+        public void Zv_D6_control_an_unmapped_getter_typed_as_the_list_is_read()
+        {
+            Assert.True(Holds(_db.TypedKeyrings.AsNoTracking().ToList(), "typed-key-secret"));
+
+            PolicyQueryable<ZvTypedKeyring> guarded = Guard(_db.TypedKeyrings);
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine(Describe(guarded, data));
+
+            Assert.False(Holds(data, "typed-key-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_D5_an_unmapped_member_the_application_fills_beside_a_top_level_denial(DwTier tier)
+        {
+            _db.ChangeTracker.Clear();
+            _db.ChangeTracker.Tracked += (_, tracked) =>
+            {
+                if (tracked.FromQuery && tracked.Entry.Entity is ZvNotedEvent noted)
+                {
+                    noted.Note = new ZvCardIssued { Label = "memo", Pan = "unmapped-pan-secret" };
+                }
+            };
+
+            Assert.True(Holds(_db.NotedEvents.ToList(), "unmapped-pan-secret"));
+
+            _db.ChangeTracker.Clear();
+
+            object? data = Guard(_db.NotedEvents, tier).ToList(new Filter()).Data;
+
+            Assert.False(Holds(data, "noted-actor-secret"));
+            Assert.False(Holds(data, "unmapped-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_D5_an_owned_member_whose_unmapped_member_the_application_fills(DwTier tier)
+        {
+            _db.ChangeTracker.Clear();
+            _db.ChangeTracker.Tracked += (_, tracked) =>
+            {
+                if (tracked.FromQuery && tracked.Entry.Entity is ZvNoteMeta meta)
+                {
+                    meta.Note = new ZvCardIssued { Label = "memo", Pan = "owned-unmapped-secret" };
+                }
+            };
+
+            Assert.True(Holds(_db.NoteHolders.ToList(), "owned-unmapped-secret"));
+
+            _db.ChangeTracker.Clear();
+
+            PolicyQueryable<ZvNoteHolder> guarded = Guard(_db.NoteHolders, tier);
+            object? data = guarded.ToList(new Filter()).Data;
+
+            _out.WriteLine(Describe(guarded, data));
+
+            Assert.False(Holds(data, "holder-actor-secret"));
+            Assert.False(Holds(data, "owned-unmapped-secret"));
+            Assert.Contains("t1", JsonSerializer.Serialize(data));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewOpaqueCollectionTests.cs b/DynamicWhere.Tests/Policies/ReviewOpaqueCollectionTests.cs
new file mode 100644
index 0000000..301d96c
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewOpaqueCollectionTests.cs
@@ -0,0 +1,180 @@
+using System.Collections;
+using System.Reflection;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ an application class that implements IEnumerable
+
+    /// <summary>
+    /// An application type with its own policed members that also enumerates, non-generically. It can hold
+    /// anything, and its own members are still read.
+    /// </summary>
+    public class ZvLedgerBag : IEnumerable
+    {
+        public string Owner { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? AccountNo { get; set; }
+
+        public IEnumerator GetEnumerator() => Array.Empty<object>().GetEnumerator();
+    }
+
+    public class ZvBagHolder
+    {
+        public int Id { get; set; }
+
+        public Dictionary<string, ZvLedgerBag> Bags { get; set; } = new();
+    }
+
+    public class ZvBagBase
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZvBagSub : ZvBagBase
+    {
+        public ZvLedgerBag? Bag { get; set; }
+    }
+
+    public sealed class ReviewOpaqueCollectionTests
+    {
+        private readonly ITestOutputHelper _out;
+
+        public ReviewOpaqueCollectionTests(ITestOutputHelper output) => _out = output;
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        /// <summary>Everything reachable, read by runtime type; an IEnumerable is read as its properties too.</summary>
+        private static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is ValueType || current is MemberInfo)
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held == text)
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (!seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IDictionary map)
+                {
+                    foreach (object? item in map.Values)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                if (current is IEnumerable items && current.GetType().Namespace?.StartsWith("System", StringComparison.Ordinal) == true)
+                {
+                    foreach (object? item in items)
+                    {
+                        pending.Push(item);
+                    }
+
+                    continue;
+                }
+
+                foreach (PropertyInfo property in current.GetType().GetProperties())
+                {
+                    if (property.GetIndexParameters().Length != 0 || !property.CanRead)
+                    {
+                        continue;
+                    }
+
+                    try
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                    catch
+                    {
+                        // A getter that throws holds nothing readable.
+                    }
+                }
+            }
+
+            return false;
+        }
+
+        private static object? SafeRead(Func<object?> read)
+        {
+            try
+            {
+                return read();
+            }
+            catch (PolicyException refusal) when (refusal.ErrorCode is PolicyErrorCode.FieldDeniedForSelect or PolicyErrorCode.AllSelectsDenied)
+            {
+                return null;
+            }
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_E1_an_enumerable_application_type_inside_a_framework_generic(DwTier tier)
+        {
+            ZvBagHolder[] rows = { new() { Id = 1, Bags = { ["a"] = new ZvLedgerBag { Owner = "o", AccountNo = "acct-secret" } } } };
+
+            PolicyQueryable<ZvBagHolder> guarded = Guard(rows.AsQueryable(), tier);
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine("holds: " + Holds(data, "acct-secret") + "; decisions: "
+                           + string.Join(" | ", guarded.LastTrace?.Decisions.Where(d => d.Action != PolicyAction.Allowed).Select(d => $"{d.FieldPath} {d.Action}") ?? Array.Empty<string>()));
+
+            Assert.False(Holds(data, "acct-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_E2_rows_in_memory_whose_subtype_holds_an_enumerable_application_type(DwTier tier)
+        {
+            ZvBagBase[] rows = { new ZvBagSub { Id = 1, Name = "n", Bag = new ZvLedgerBag { Owner = "o", AccountNo = "acct-secret" } } };
+
+            PolicyQueryable<ZvBagBase> guarded = Guard(rows.AsQueryable(), tier);
+            object? data = SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine("holds: " + Holds(data, "acct-secret") + "; types: "
+                           + string.Join(",", ((IEnumerable?)data ?? Array.Empty<object>()).Cast<object>().Select(r => r.GetType().Name)));
+
+            Assert.False(Holds(data, "acct-secret"));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewOverBlockTests.cs b/DynamicWhere.Tests/Policies/ReviewOverBlockTests.cs
new file mode 100644
index 0000000..df7bda1
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewOverBlockTests.cs
@@ -0,0 +1,994 @@
+using System.Collections;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+using Zb.Geo;
+
+// Probes for over-blocking in 6c9e171. Every test asserts what an ordinary query should get when
+// nothing denied can reach the result (or what 3.1.0 / f7e1cc6 returned), so a failing test is a
+// candidate over-block. Each test also writes its outcome, run with a detailed console logger.
+
+namespace Zb.Geo
+{
+    /// <summary>
+    /// Shaped like NetTopologySuite's Geometry: an application-namespace type with an object member
+    /// (NTS has Geometry.UserData) and subtypes.
+    /// </summary>
+    public abstract class ZbGeometry
+    {
+        public int Srid { get; set; }
+
+        public object? UserData { get; set; }
+    }
+
+    public class ZbPoint : ZbGeometry
+    {
+        public double X { get; set; }
+
+        public double Y { get; set; }
+    }
+
+    public class ZbPolygon : ZbGeometry
+    {
+        public List<ZbPoint> Shell { get; set; } = new();
+    }
+}
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ------------------------------------------------------------ columns holding objects, no denials
+
+    public class ZbTicket
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        public Dictionary<string, object> Extra { get; set; } = new();
+    }
+
+    public class ZbComment
+    {
+        public int Id { get; set; }
+
+        public string Text { get; set; } = string.Empty;
+
+        public int ZbTicketId { get; set; }
+
+        public ZbTicket? Ticket { get; set; }
+    }
+
+    public class ZbSensor
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public BitArray Flags { get; set; } = new(4);
+    }
+
+    public class ZbSite
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZbPoint? Location { get; set; }
+    }
+
+    public class ZbVisit
+    {
+        public int Id { get; set; }
+
+        public string Note { get; set; } = string.Empty;
+
+        public int ZbSiteId { get; set; }
+
+        public ZbSite? Site { get; set; }
+    }
+
+    public class ZbProfileHolder
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZbSettings Settings { get; set; } = new();
+    }
+
+    public class ZbSettings
+    {
+        public string Theme { get; set; } = string.Empty;
+
+        public Dictionary<string, object> Prefs { get; set; } = new();
+    }
+
+    // ------------------------------------------------------------ reshaped chains
+
+    public class ZbCustomer
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZbCard> Cards { get; set; } = new();
+
+        public List<ZbOrder> Orders { get; set; } = new();
+    }
+
+    public class ZbCard
+    {
+        public int Id { get; set; }
+
+        public int ZbCustomerId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZbOrder
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public int ZbCustomerId { get; set; }
+
+        public ZbCustomer? Customer { get; set; }
+
+        public List<ZbLine> Lines { get; set; } = new();
+    }
+
+    public class ZbLine
+    {
+        public int Id { get; set; }
+
+        public int ZbOrderId { get; set; }
+
+        public string Sku { get; set; } = string.Empty;
+
+        public string? Cost { get; set; }
+    }
+
+    /// <summary>A constructor-bound entity: EF Core binds it, and it has no parameterless constructor.</summary>
+    public class ZbMember
+    {
+        public ZbMember(int id, string name)
+        {
+            Id = id;
+            Name = name;
+        }
+
+        public int Id { get; private set; }
+
+        public string Name { get; private set; }
+
+        public List<ZbBadge> Badges { get; private set; } = new();
+    }
+
+    public class ZbBadge
+    {
+        public int Id { get; set; }
+
+        public int ZbMemberId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pin { get; set; }
+    }
+
+    public class ZbLink
+    {
+        public int Id { get; set; }
+
+        public int ZbMemberId { get; set; }
+
+        public ZbMember? Member { get; set; }
+    }
+
+    /// <summary>A shopper whose tier is auto-included and holds nothing denied; a denial sits beneath unloaded wallets.</summary>
+    public class ZbShopper
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public int ZbTierId { get; set; }
+
+        public ZbTier? Tier { get; set; }
+
+        public List<ZbWallet> Wallets { get; set; } = new();
+    }
+
+    public class ZbTier
+    {
+        public int Id { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+    }
+
+    public class ZbWallet
+    {
+        public int Id { get; set; }
+
+        public int ZbShopperId { get; set; }
+
+        [DwDenied]
+        public string? Iban { get; set; }
+    }
+
+    public class ZbBasket
+    {
+        public int Id { get; set; }
+
+        public int ZbShopperId { get; set; }
+
+        public ZbShopper? Shopper { get; set; }
+    }
+
+    // ------------------------------------------------------------ hierarchies
+
+    public abstract class ZbPayment
+    {
+        public int Id { get; set; }
+
+        public long Cents { get; set; }
+    }
+
+    public class ZbCardPayment : ZbPayment
+    {
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZbCashPayment : ZbPayment
+    {
+        public string Till { get; set; } = string.Empty;
+    }
+
+    /// <summary>An abstract root; no denial anywhere, one derived type holds a JSON bag.</summary>
+    public abstract class ZbEvent
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+    }
+
+    public class ZbClickEvent : ZbEvent
+    {
+        public Dictionary<string, object> Data { get; set; } = new();
+    }
+
+    public class ZbViewEvent : ZbEvent
+    {
+        public string Page { get; set; } = string.Empty;
+    }
+
+    /// <summary>A concrete root; no denial anywhere, one derived type holds a JSON bag.</summary>
+    public class ZbDoc
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+    }
+
+    public class ZbRichDoc : ZbDoc
+    {
+        public Dictionary<string, object> Meta { get; set; } = new();
+    }
+
+    // ------------------------------------------------------------ rows
+
+    public interface IZbContact
+    {
+        string Name { get; set; }
+    }
+
+    public class ZbContactRow : IZbContact
+    {
+        public string Name { get; set; } = string.Empty;
+    }
+
+    /// <summary>Another implementor of the interface, somewhere in the application, with a denial.</summary>
+    public class ZbVipContact : IZbContact
+    {
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Phone { get; set; }
+    }
+
+    public class ZbCustomerRow
+    {
+        public int Id { get; set; }
+
+        public IZbContact? Contact { get; set; }
+    }
+
+    public class ZbPersonDto
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public ZbAddressDto? Address { get; set; }
+    }
+
+    /// <summary>A subclass of the DTO elsewhere in the application, with a denial.</summary>
+    public class ZbStaffDto : ZbPersonDto
+    {
+        [DwDenied]
+        public string? Salary { get; set; }
+    }
+
+    public class ZbAddressDto
+    {
+        public string City { get; set; } = string.Empty;
+    }
+
+    public class ZbOrderRow
+    {
+        public ZbOrderRow()
+        {
+        }
+
+        public ZbOrderRow(int id) => Id = id;
+
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public List<ZbLineRow> Lines { get; set; } = new();
+    }
+
+    public class ZbLineRow
+    {
+        public string Sku { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Cost { get; set; }
+    }
+
+    public class ZbPlaceDto
+    {
+        public string City { get; set; } = string.Empty;
+
+        public string Display => City.ToUpperInvariant();
+    }
+
+    public class ZbPlaceRow
+    {
+        public int Id { get; set; }
+
+        public ZbPlaceDto? Place { get; set; }
+    }
+
+    public class ZbZoneDto
+    {
+        public string Code { get; set; } = string.Empty;
+    }
+
+    /// <summary>A subclass with no denial at all.</summary>
+    public class ZbSubZoneDto : ZbZoneDto
+    {
+        public string Parent { get; set; } = string.Empty;
+    }
+
+    public class ZbZoneRow
+    {
+        public int Id { get; set; }
+
+        public ZbZoneDto? Zone { get; set; }
+    }
+
+    // ------------------------------------------------------------ the database
+
+    public sealed class ZbProbeContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZbProbeContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZbTicket> Tickets => Set<ZbTicket>();
+
+        public DbSet<ZbComment> Comments => Set<ZbComment>();
+
+        public DbSet<ZbSensor> Sensors => Set<ZbSensor>();
+
+        public DbSet<ZbSite> Sites => Set<ZbSite>();
+
+        public DbSet<ZbVisit> Visits => Set<ZbVisit>();
+
+        public DbSet<ZbProfileHolder> ProfileHolders => Set<ZbProfileHolder>();
+
+        public DbSet<ZbCustomer> Customers => Set<ZbCustomer>();
+
+        public DbSet<ZbOrder> Orders => Set<ZbOrder>();
+
+        public DbSet<ZbMember> Members => Set<ZbMember>();
+
+        public DbSet<ZbLink> Links => Set<ZbLink>();
+
+        public DbSet<ZbPayment> Payments => Set<ZbPayment>();
+
+        public DbSet<ZbEvent> Events => Set<ZbEvent>();
+
+        public DbSet<ZbDoc> Docs => Set<ZbDoc>();
+
+        public DbSet<ZbShopper> Shoppers => Set<ZbShopper>();
+
+        public DbSet<ZbBasket> Baskets => Set<ZbBasket>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZbTicket>().Property(t => t.Extra).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!);
+
+            model.Entity<ZbSensor>().Property(s => s.Flags).HasConversion(
+                value => string.Concat(value.Cast<bool>().Select(bit => bit ? '1' : '0')),
+                text => new BitArray(text.Select(c => c == '1').ToArray()));
+
+            model.Entity<ZbSite>().Property(s => s.Location).HasConversion(
+                value => value == null ? null : $"{value.X};{value.Y}",
+                text => text == null ? null : new ZbPoint { X = double.Parse(text.Split(';', StringSplitOptions.None)[0]), Y = double.Parse(text.Split(';', StringSplitOptions.None)[1]) });
+
+            model.Entity<ZbProfileHolder>().OwnsOne(p => p.Settings, s => s.Property(x => x.Prefs).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!));
+
+            model.Entity<ZbMember>().HasMany(m => m.Badges).WithOne().HasForeignKey(b => b.ZbMemberId);
+
+            model.Entity<ZbCardPayment>();
+            model.Entity<ZbCashPayment>();
+
+            model.Entity<ZbClickEvent>().Property(e => e.Data).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!);
+            model.Entity<ZbViewEvent>();
+
+            model.Entity<ZbShopper>().Navigation(s => s.Tier).AutoInclude();
+
+            model.Entity<ZbRichDoc>().Property(d => d.Meta).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!);
+        }
+    }
+
+    // ------------------------------------------------------------ the probes
+
+    public sealed class ReviewOverBlockTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZbProbeContext _db;
+
+        public ReviewOverBlockTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+
+            _db = new ZbProbeContext(_connection);
+            _db.Database.EnsureCreated();
+
+            ZbTicket ticket = new() { Title = "T1", Extra = { ["colour"] = "red" } };
+
+            _db.Tickets.Add(ticket);
+            _db.Comments.Add(new ZbComment { Text = "c1", Ticket = ticket });
+            _db.Sensors.Add(new ZbSensor { Name = "S1", Flags = new BitArray(new[] { true, false, true, true }) });
+
+            ZbSite site = new() { Name = "Basra", Location = new ZbPoint { X = 30.5, Y = 47.8 } };
+
+            _db.Sites.Add(site);
+            _db.Visits.Add(new ZbVisit { Note = "v1", Site = site });
+            _db.ProfileHolders.Add(new ZbProfileHolder { Name = "P1", Settings = new ZbSettings { Theme = "dark", Prefs = { ["lang"] = "ar" } } });
+
+            ZbCustomer withOrders = new()
+            {
+                Name = "C1",
+                Cards = { new ZbCard { Label = "visa", Pan = "pan-secret" } },
+                Orders = { new ZbOrder { Code = "O1", Lines = { new ZbLine { Sku = "S1", Cost = "9" } } } }
+            };
+
+            _db.Customers.Add(withOrders);
+            _db.Customers.Add(new ZbCustomer { Name = "C2-no-orders" });
+
+            ZbMember member = new(0, "M1");
+
+            member.Badges.Add(new ZbBadge { Label = "gold", Pin = "pin-secret" });
+            _db.Members.Add(member);
+            _db.Links.Add(new ZbLink { Member = member });
+
+            _db.Payments.Add(new ZbCardPayment { Cents = 100, Pan = "payment-pan-secret" });
+            _db.Payments.Add(new ZbCashPayment { Cents = 200, Till = "till-1" });
+
+            _db.Events.Add(new ZbClickEvent { Kind = "click", Data = { ["x"] = 1 } });
+            _db.Events.Add(new ZbViewEvent { Kind = "view", Page = "/home" });
+
+            ZbShopper shopper = new() { Name = "S1", Tier = new ZbTier { Label = "gold" }, Wallets = { new ZbWallet { Iban = "iban-secret" } } };
+
+            _db.Shoppers.Add(shopper);
+            _db.Baskets.Add(new ZbBasket { Shopper = shopper });
+
+            _db.Docs.Add(new ZbDoc { Title = "plain" });
+            _db.Docs.Add(new ZbRichDoc { Title = "rich", Meta = { ["pages"] = 3 } });
+
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static DwPolicyContext Caller() =>
+            new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1").WithValue("TenantId", 1);
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict, params IDwPolicyProvider[] more)
+            where T : class =>
+            source.ApplyPolicy(
+                Caller(),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }.Concat(more).ToArray()));
+
+        private static FakePolicyProvider DenyingAllBut(params string[] allowed)
+        {
+            FakePolicyProvider rules = new FakePolicyProvider()
+                .Add("*", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            foreach (string path in allowed)
+            {
+                rules.Add(path, PolicyFeature.Select, PolicyEffect.Allow, PolicyLevel.DynamicGlobal);
+            }
+
+            return rules;
+        }
+
+        private static string Dropped<T>(PolicyQueryable<T> guarded) where T : class =>
+            string.Join(" | ", guarded.LastTrace?.Decisions
+                .Where(d => d.Action != PolicyAction.Allowed)
+                .Select(d => $"{d.FieldPath} {d.Action}: {d.Reason}") ?? Array.Empty<string>());
+
+        private static bool AnyDropped<T>(PolicyQueryable<T> guarded) where T : class =>
+            guarded.LastTrace?.Decisions.Any(d => d.Action == PolicyAction.Dropped) ?? false;
+
+        /// <summary>Runs a guarded call and describes what came back, or what it threw.</summary>
+        private string Outcome<T>(string label, PolicyQueryable<T> guarded, Func<PolicyQueryable<T>, IEnumerable> run)
+            where T : class
+        {
+            string line;
+
+            try
+            {
+                List<object?> rows = run(guarded).Cast<object?>().ToList();
+
+                line = $"{label}: OK rows={rows.Count} types=[{string.Join(",", rows.Select(r => r?.GetType().Name ?? "null"))}]"
+                       + $" json={JsonSerializer.Serialize(rows)} decisions=[{Dropped(guarded)}]";
+            }
+            catch (Exception e)
+            {
+                string code = e is PolicyException refusal ? refusal.ErrorCode.ToString() : string.Empty;
+
+                line = $"{label}: THREW {e.GetType().Name} {code} {e.Message.Split('\n')[0]} decisions=[{Dropped(guarded)}]";
+            }
+
+            _out.WriteLine(line);
+
+            return line;
+        }
+
+        // ================================================================ A: columns that hold objects
+
+        [Fact]
+        public void Zb_A1_entity_with_an_object_bag_column_and_no_denial_is_returned_as_loaded()
+        {
+            PolicyQueryable<ZbTicket> guarded = Guard(_db.Tickets);
+
+            Outcome("A1 typed", Guard(_db.Tickets), g => g.ToList(new Filter()).Data);
+
+            ZbTicket ticket = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+            Assert.True(ticket.Extra.ContainsKey("colour"));
+        }
+
+        [Fact]
+        public void Zb_A2_entity_with_a_BitArray_column_and_no_denial_is_returned_as_loaded()
+        {
+            PolicyQueryable<ZbSensor> guarded = Guard(_db.Sensors);
+
+            Outcome("A2 typed", Guard(_db.Sensors), g => g.ToList(new Filter()).Data);
+
+            ZbSensor sensor = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+            Assert.Equal(4, sensor.Flags.Length);
+            Assert.True(sensor.Flags[3]);
+        }
+
+        [Fact]
+        public void Zb_A3_entity_with_a_geometry_like_column_and_no_denial_is_returned_as_loaded()
+        {
+            PolicyQueryable<ZbSite> guarded = Guard(_db.Sites);
+
+            Outcome("A3 typed", Guard(_db.Sites), g => g.ToList(new Filter()).Data);
+
+            ZbSite site = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+            Assert.NotNull(site.Location);
+        }
+
+        [Fact]
+        public void Zb_A4_an_included_navigation_whose_entity_holds_an_object_bag_is_kept()
+        {
+            PolicyQueryable<ZbComment> guarded = Guard(_db.Comments.Include(c => c.Ticket));
+
+            Outcome("A4 typed", Guard(_db.Comments.Include(c => c.Ticket)), g => g.ToList(new Filter()).Data);
+
+            ZbComment comment = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+            Assert.NotNull(comment.Ticket);
+        }
+
+        [Fact]
+        public void Zb_A5_an_included_navigation_whose_entity_holds_a_geometry_is_kept()
+        {
+            PolicyQueryable<ZbVisit> guarded = Guard(_db.Visits.Include(v => v.Site));
+
+            Outcome("A5 typed", Guard(_db.Visits.Include(v => v.Site)), g => g.ToList(new Filter()).Data);
+
+            ZbVisit visit = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+            Assert.NotNull(visit.Site);
+        }
+
+        [Fact]
+        public void Zb_A6_an_owned_member_holding_an_object_bag_is_kept()
+        {
+            PolicyQueryable<ZbProfileHolder> guarded = Guard(_db.ProfileHolders);
+
+            Outcome("A6 typed", Guard(_db.ProfileHolders), g => g.ToList(new Filter()).Data);
+
+            ZbProfileHolder holder = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+            Assert.True(holder.Settings.Prefs.ContainsKey("lang"));
+        }
+
+        // ================================================================ B: reshaped chains, nothing loaded beneath
+
+        [Fact]
+        public void Zb_B1_Select_to_a_navigation_with_nothing_loaded_beneath_is_not_projected()
+        {
+            IQueryable<ZbCustomer> source = _db.Orders.Select(o => o.Customer!);
+
+            Outcome("B1 unguarded", Guard(_db.Customers.Where(c => false)), _ => source.ToList());
+            Outcome("B1 typed", Guard(source), g => g.ToList(new Filter()).Data);
+            _db.ChangeTracker.Clear();
+
+            PolicyQueryable<ZbCustomer> guarded = Guard(source);
+            ZbCustomer customer = guarded.ToList(new Filter()).Data.Single();
+
+            Assert.Equal("C1", customer.Name);
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+        }
+
+        [Fact]
+        public void Zb_B2_SelectMany_with_nothing_loaded_beneath_is_not_projected()
+        {
+            IQueryable<ZbOrder> source = _db.Customers.SelectMany(c => c.Orders);
+
+            Outcome("B2 typed", Guard(source), g => g.ToList(new Filter()).Data);
+            _db.ChangeTracker.Clear();
+
+            PolicyQueryable<ZbOrder> guarded = Guard(source);
+
+            Assert.Single(guarded.ToList(new Filter()).Data);
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+        }
+
+        [Fact]
+        public void Zb_B10_a_filter_inside_a_reshaping_lambda_loads_nothing()
+        {
+            // A method call, and a value constructed, that only feed a predicate hand a row nothing.
+            IQueryable<ZbOrder> source = _db.Customers.SelectMany(c => c.Orders.Where(
+                o => EF.Functions.Like(o.Code, "%") && o.Id < new DateTime(2100, 1, 1).Year));
+
+            Outcome("B10 typed", Guard(source), g => g.ToList(new Filter()).Data);
+            _db.ChangeTracker.Clear();
+
+            PolicyQueryable<ZbOrder> guarded = Guard(source);
+
+            Assert.Single(guarded.ToList(new Filter()).Data);
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+        }
+
+        [Fact]
+        public void Zb_B3_Join_with_nothing_loaded_beneath_is_not_projected()
+        {
+            IQueryable<ZbCustomer> source = _db.Orders.Join(_db.Customers, o => o.ZbCustomerId, c => c.Id, (o, c) => c);
+
+            Outcome("B3 typed", Guard(source), g => g.ToList(new Filter()).Data);
+
+            PolicyQueryable<ZbCustomer> guarded = Guard(source);
+
+            Assert.Single(guarded.ToList(new Filter()).Data);
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+        }
+
+        [Fact]
+        public void Zb_B4_GroupBy_First_with_nothing_loaded_beneath_runs_unprojected()
+        {
+            // EF Core 6 cannot count this shape, guarded or not; the core's count fails there before the policy has a say.
+            if (typeof(DbContext).Assembly.GetName().Version!.Major < 7)
+            {
+                return;
+            }
+
+            IQueryable<ZbOrder> source = _db.Orders.GroupBy(o => o.ZbCustomerId).Select(g => g.OrderBy(o => o.Id).First());
+
+            Outcome("B4 unguarded", Guard(_db.Orders.Where(o => false)), _ => source.ToList());
+            Outcome("B4 typed", Guard(source), g => g.ToList(new Filter()).Data);
+            Outcome("B4 typed paged", Guard(source), g => g.ToList(new Filter { Page = new PageBy { PageNumber = 1, PageSize = 10 } }).Data);
+
+            PolicyQueryable<ZbOrder> guarded = Guard(source);
+
+            Assert.Single(guarded.ToList(new Filter()).Data);
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+        }
+
+        [Fact]
+        public void Zb_B5_Select_to_a_constructor_bound_entity_with_nothing_loaded_beneath_runs()
+        {
+            IQueryable<ZbMember> source = _db.Links.Select(l => l.Member!);
+
+            Outcome("B5 unguarded", Guard(_db.Members.Where(m => false)), _ => source.ToList());
+            Outcome("B5 typed", Guard(source), g => g.ToList(new Filter()).Data);
+            Outcome("B5 dynamic", Guard(source), g => g.ToListDynamic(new Filter()).Data);
+            Outcome("B5 direct typed (no reshape)", Guard(_db.Members), g => g.ToList(new Filter()).Data);
+
+            Assert.Equal("M1", Guard(source).ToList(new Filter()).Data.Single().Name);
+        }
+
+        [Fact]
+        public void Zb_B6_Select_FirstOrDefault_with_a_missing_row_runs_as_it_does_unguarded()
+        {
+            IQueryable<ZbOrder> source = _db.Customers.OrderBy(c => c.Id).Select(c => c.Orders.OrderBy(o => o.Id).FirstOrDefault()!);
+
+            Outcome("B6 unguarded", Guard(_db.Orders.Where(o => false)), _ => source.ToList());
+            Outcome("B6 typed", Guard(source), g => g.ToList(new Filter()).Data);
+
+            Assert.Equal(2, Guard(source).ToList(new Filter()).Data.Count);
+        }
+
+        [Fact]
+        public void Zb_B7_left_join_through_DefaultIfEmpty_runs_as_it_does_unguarded()
+        {
+            IQueryable<ZbOrder> source = _db.Customers.SelectMany(c => c.Orders.DefaultIfEmpty(), (c, o) => o!);
+
+            Outcome("B7 unguarded", Guard(_db.Orders.Where(o => false)), _ => source.ToList());
+            Outcome("B7 typed", Guard(source), g => g.ToList(new Filter()).Data);
+
+            Assert.Equal(2, Guard(source).ToList(new Filter()).Data.Count);
+        }
+
+        /// <summary>
+        /// The needless projection over a reshaped chain drops an auto-included navigation that holds nothing
+        /// denied: only the unloaded wallets hold a denial.
+        /// </summary>
+        [Fact]
+        public void Zb_B9_Select_to_a_navigation_keeps_its_auto_included_navigation()
+        {
+            IQueryable<ZbShopper> source = _db.Baskets.Select(b => b.Shopper!);
+
+            Outcome("B9 unguarded", Guard(_db.Shoppers.Where(s => false)), _ => source.AsNoTracking().ToList());
+            Outcome("B9 typed", Guard(source), g => g.ToList(new Filter()).Data);
+            Outcome("B9 direct (no reshape)", Guard(_db.Shoppers), g => g.ToList(new Filter()).Data);
+
+            Assert.Equal("gold", Guard(_db.Shoppers).ToList(new Filter()).Data.Single().Tier?.Label);
+            Assert.Equal("gold", Guard(source).ToList(new Filter()).Data.Single().Tier?.Label);
+        }
+
+        /// <summary>
+        /// Informational: the same chains with a top-level denial, which forces the synthesized projection in
+        /// every version. Shows whether the exceptions above are the projection's own fragility.
+        /// </summary>
+        [Fact]
+        public void Zb_B8_the_same_chains_with_a_top_level_denial_in_every_version()
+        {
+            FakePolicyProvider code = new FakePolicyProvider().Add("Code", PolicyFeature.Select, PolicyEffect.Deny, PolicyLevel.DynamicGlobal);
+
+            Outcome("B8 FirstOrDefault + top-level denial", Guard(_db.Customers.OrderBy(c => c.Id).Select(c => c.Orders.OrderBy(o => o.Id).FirstOrDefault()!), DwTier.Strict, code), g => g.ToList(new Filter()).Data);
+            Outcome("B8 DefaultIfEmpty + top-level denial", Guard(_db.Customers.SelectMany(c => c.Orders.DefaultIfEmpty(), (c, o) => o!), DwTier.Strict, code), g => g.ToList(new Filter()).Data);
+            Outcome("B8 GroupBy First + top-level denial", Guard(_db.Orders.GroupBy(o => o.ZbCustomerId).Select(g => g.OrderBy(o => o.Id).First()), DwTier.Strict, code), g => g.ToList(new Filter()).Data);
+        }
+
+        // ================================================================ C: hierarchies
+
+        [Fact]
+        public void Zb_C1_an_abstract_root_with_no_denial_anywhere_runs()
+        {
+            Outcome("C1 typed", Guard(_db.Events), g => g.ToList(new Filter()).Data);
+            Outcome("C1 dynamic", Guard(_db.Events), g => g.ToListDynamic(new Filter()).Data);
+
+            List<ZbEvent> events = Guard(_db.Events).ToList(new Filter()).Data;
+
+            Assert.Contains(events, e => e is ZbClickEvent click && click.Data.ContainsKey("x"));
+        }
+
+        [Fact]
+        public void Zb_C2_a_concrete_root_with_no_denial_anywhere_keeps_its_derived_rows()
+        {
+            PolicyQueryable<ZbDoc> guarded = Guard(_db.Docs);
+
+            Outcome("C2 typed", Guard(_db.Docs), g => g.ToList(new Filter()).Data);
+
+            List<ZbDoc> docs = guarded.ToList(new Filter()).Data;
+
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+            Assert.Contains(docs, d => d is ZbRichDoc rich && rich.Meta.ContainsKey("pages"));
+        }
+
+        /// <summary>Informational: an abstract root whose derived type declares a denied field.</summary>
+        [Fact]
+        public void Zb_C3_an_abstract_root_whose_derived_type_has_a_denial()
+        {
+            string typed = Outcome("C3 typed", Guard(_db.Payments), g => g.ToList(new Filter()).Data);
+            string dynamic = Outcome("C3 dynamic", Guard(_db.Payments), g => g.ToListDynamic(new Filter()).Data);
+            string convenience = Outcome("C3 typed convenience", Guard(_db.Payments, DwTier.Convenience), g => g.ToList(new Filter()).Data);
+
+            Assert.DoesNotContain("THREW", dynamic);
+        }
+
+        // ================================================================ D: interfaces and DTO base classes
+
+        [Fact]
+        public void Zb_D1_a_projected_member_declared_as_an_interface_keeps_the_value_it_was_built_with()
+        {
+            IQueryable<ZbCustomerRow> rows = _db.Customers.OrderBy(c => c.Id)
+                .Select(c => new ZbCustomerRow { Id = c.Id, Contact = new ZbContactRow { Name = c.Name } });
+
+            Outcome("D1 typed", Guard(rows), g => g.ToList(new Filter()).Data);
+
+            PolicyQueryable<ZbCustomerRow> guarded = Guard(rows);
+            ZbCustomerRow row = guarded.ToList(new Filter()).Data.First();
+
+            Assert.Equal("C1", row.Contact?.Name);
+            Assert.False(AnyDropped(guarded), Dropped(guarded));
+        }
+
+        [Fact]
+        public void Zb_D2_an_in_memory_member_declared_as_an_interface_whose_other_implementation_is_denied_is_left_out()
+        {
+            ZbCustomerRow[] rows = { new() { Id = 1, Contact = new ZbContactRow { Name = "n1" } } };
+
+            Outcome("D2 typed", Guard(rows.AsQueryable()), g => g.ToList(new Filter()).Data);
+
+            PolicyQueryable<ZbCustomerRow> guarded = Guard(rows.AsQueryable());
+            ZbCustomerRow row = guarded.ToList(new Filter()).Data.Single();
+
+            // In memory the member can hold any implementation, one with a denied field among them, and an
+            // object of a row in memory is never kept once a projection is needed.
+            Assert.Null(row.Contact);
+            Assert.True(AnyDropped(guarded), Dropped(guarded));
+        }
+
+        [Fact]
+        public void Zb_D3_in_memory_rows_of_a_DTO_a_subclass_of_which_has_a_denial_are_projected()
+        {
+            ZbPersonDto[] rows = { new() { Id = 1, Name = "n1", Address = new ZbAddressDto { City = "Basra" } } };
+
+            Outcome("D3 typed", Guard(rows.AsQueryable()), g => g.ToList(new Filter()).Data);
+
+            PolicyQueryable<ZbPersonDto> guarded = Guard(rows.AsQueryable());
+            ZbPersonDto row = guarded.ToList(new Filter()).Data.Single();
+
+            // A loaded subclass declares a denied field, and a row in memory can be one: the rows are projected
+            // to the declared type, which leaves their objects out.
+            Assert.NotSame(rows[0], row);
+            Assert.Null(row.Address);
+            Assert.Equal("n1", row.Name);
+        }
+
+        // ================================================================ E: constructor plus initializer
+
+        [Fact]
+        public void Zb_E1_an_initializer_after_a_constructor_still_narrows_the_members_it_assigns()
+        {
+            IQueryable<ZbOrderRow> rows = _db.Orders.Select(o => new ZbOrderRow(o.Id)
+            {
+                Code = o.Code,
+                Lines = o.Lines.Select(l => new ZbLineRow { Sku = l.Sku, Cost = l.Cost }).ToList()
+            });
+
+            Outcome("E1 typed", Guard(rows), g => g.ToList(new Filter()).Data);
+
+            ZbOrderRow row = Guard(rows).ToList(new Filter()).Data.Single();
+
+            Assert.Equal("O1", row.Code);
+            Assert.Equal("S1", Assert.Single(row.Lines).Sku);
+            Assert.Null(row.Lines[0].Cost);
+        }
+
+        // ================================================================ F: deny-by-default, every path allowed
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zb_F1_deny_by_default_allowing_every_path_keeps_an_in_memory_member_with_a_computed_property(DwTier tier)
+        {
+            ZbPlaceRow[] rows = { new() { Id = 1, Place = new ZbPlaceDto { City = "Basra" } } };
+            FakePolicyProvider rules = DenyingAllBut("Id", "Place", "Place.City", "Place.Display");
+
+            Outcome($"F1 {tier} named", Guard(rows.AsQueryable(), tier, rules), g => g.ToList(new Filter { Selects = new List<string> { "Id", "Place" } }).Data);
+            Outcome($"F1 {tier} none", Guard(rows.AsQueryable(), tier, rules), g => g.ToList(new Filter()).Data);
+
+            ZbPlaceRow row = Guard(rows.AsQueryable(), tier, rules).ToList(new Filter { Selects = new List<string> { "Id", "Place" } }).Data.Single();
+
+            Assert.Equal("Basra", row.Place?.City);
+        }
+
+        [Fact]
+        public void Zb_F2_deny_by_default_allowing_every_path_keeps_a_projected_member_with_a_computed_property()
+        {
+            IQueryable<ZbPlaceRow> rows = _db.Customers.OrderBy(c => c.Id).Select(c => new ZbPlaceRow { Id = c.Id, Place = new ZbPlaceDto { City = c.Name } });
+            FakePolicyProvider rules = DenyingAllBut("Id", "Place", "Place.City", "Place.Display");
+
+            Outcome("F2 none", Guard(rows, DwTier.Strict, rules), g => g.ToList(new Filter()).Data);
+            Outcome("F2 named", Guard(rows, DwTier.Strict, rules), g => g.ToList(new Filter { Selects = new List<string> { "Id", "Place" } }).Data);
+
+            PolicyQueryable<ZbPlaceRow> guarded = Guard(rows, DwTier.Strict, rules);
+            ZbPlaceRow row = guarded.ToList(new Filter()).Data.First();
+
+            Assert.Equal("C1", row.Place?.City);
+
+            // Naming the member, every path of which the policy allows, is not refused.
+            ZbPlaceRow named = Guard(rows, DwTier.Strict, rules).ToList(new Filter { Selects = new List<string> { "Id", "Place" } }).Data.First();
+
+            Assert.Equal("C1", named.Place?.City);
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zb_F3_deny_by_default_keeps_a_member_only_when_every_subtype_path_is_named(DwTier tier)
+        {
+            ZbZoneRow[] rows = { new() { Id = 1, Zone = new ZbZoneDto { Code = "Z1" } } };
+            FakePolicyProvider rules = DenyingAllBut("Id", "Zone", "Zone.Code");
+
+            Outcome($"F3 {tier} named", Guard(rows.AsQueryable(), tier, rules), g => g.ToList(new Filter { Selects = new List<string> { "Id", "Zone" } }).Data);
+
+            // The subclass declares Parent, which the policy does not name, and a row in memory can hold it.
+            Assert.Throws<PolicyException>(() => Guard(rows.AsQueryable(), tier, rules).ToList(new Filter { Selects = new List<string> { "Id", "Zone" } }));
+
+            // Named too, every path a Zone can hold is granted, and the member is kept whole.
+            FakePolicyProvider named = DenyingAllBut("Id", "Zone", "Zone.Code", "Zone.Parent");
+            ZbZoneRow row = Guard(rows.AsQueryable(), tier, named).ToList(new Filter { Selects = new List<string> { "Id", "Zone" } }).Data.Single();
+
+            Assert.Equal("Z1", row.Zone?.Code);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewOwnedPrecisionTests.cs b/DynamicWhere.Tests/Policies/ReviewOwnedPrecisionTests.cs
new file mode 100644
index 0000000..3cb684c
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewOwnedPrecisionTests.cs
@@ -0,0 +1,168 @@
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+// A converted JSON bag inside an owned member, beside a top-level denial. A converter can hand back any object, so
+// the owned member is narrowed around the bag: it comes back with its plain fields, and without the bag.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public class ZyoSettings
+    {
+        public string Theme { get; set; } = string.Empty;
+
+        public Dictionary<string, object> Prefs { get; set; } = new();
+    }
+
+    public class ZyoAddress
+    {
+        public string City { get; set; } = string.Empty;
+
+        public Dictionary<string, object> Extra { get; set; } = new();
+    }
+
+    public class ZyoProfile
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Secret { get; set; }
+
+        public ZyoSettings Settings { get; set; } = new();
+
+        public List<ZyoAddress> Addresses { get; set; } = new();
+    }
+
+    public sealed class ZyoContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZyoContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZyoProfile> Profiles => Set<ZyoProfile>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZyoProfile>().OwnsOne(p => p.Settings, s => s.Property(x => x.Prefs).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!));
+            model.Entity<ZyoProfile>().OwnsMany(p => p.Addresses, a =>
+            {
+                a.WithOwner().HasForeignKey("ZyoProfileId");
+                a.Property<int>("Id");
+                a.HasKey("Id");
+                a.Property(x => x.Extra).HasConversion(
+                    value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                    text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!);
+            });
+        }
+    }
+
+    public sealed class ReviewOwnedPrecisionTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZyoContext _db;
+
+        public ReviewOwnedPrecisionTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZyoContext(_connection);
+            _db.Database.EnsureCreated();
+            _db.Profiles.Add(new ZyoProfile
+            {
+                Name = "P1",
+                Secret = "zyo-secret",
+                Settings = new ZyoSettings { Theme = "dark", Prefs = { ["lang"] = "ar" } },
+                Addresses = { new ZyoAddress { City = "Basra", Extra = { ["floor"] = 3 } } }
+            });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private (ZyoProfile? Row, string Outcome) Run()
+        {
+            PolicyQueryable<ZyoProfile> guarded = _db.Profiles.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = DwTier.Strict, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+            try
+            {
+                ZyoProfile row = guarded.ToList(new Filter()).Data.Single();
+                string outcome = $"OK json={JsonSerializer.Serialize(row)} dropped=[{ZyLog.Decisions(guarded)}]";
+
+                ZyLog.Write(_out, "O owned: " + outcome);
+
+                return (row, outcome);
+            }
+            catch (Exception e)
+            {
+                string outcome = $"THREW {e.GetType().Name} {e.Message.Split('\n')[0]} dropped=[{ZyLog.Decisions(guarded)}]";
+
+                ZyLog.Write(_out, "O owned: " + outcome);
+
+                return (null, outcome);
+            }
+        }
+
+        [Fact]
+        public void Zy_O1_an_owned_member_holding_a_converted_bag_keeps_its_plain_fields()
+        {
+            (ZyoProfile? row, string outcome) = Run();
+
+            Assert.NotNull(row);
+            Assert.Null(row!.Secret);
+            Assert.Equal("dark", row.Settings?.Theme);
+        }
+
+        [Fact]
+        public void Zy_O2_an_owned_member_holding_a_converted_bag_is_narrowed_around_the_bag()
+        {
+            (ZyoProfile? row, string outcome) = Run();
+
+            Assert.NotNull(row);
+            Assert.NotNull(row!.Settings);
+            Assert.False(row.Settings!.Prefs.ContainsKey("lang"), outcome);
+            Assert.Contains("Settings.Prefs Dropped: left out whole: it can hold what the policy cannot name", outcome);
+        }
+
+        [Fact]
+        public void Zy_O3_an_owned_collection_holding_a_converted_bag_keeps_its_elements()
+        {
+            (ZyoProfile? row, string outcome) = Run();
+
+            Assert.NotNull(row);
+            Assert.Equal("Basra", Assert.Single(row!.Addresses).City);
+        }
+
+        [Fact]
+        public void Zy_O4_an_owned_collection_holding_a_converted_bag_is_narrowed_around_the_bag()
+        {
+            (ZyoProfile? row, string outcome) = Run();
+
+            Assert.NotNull(row);
+            Assert.False(Assert.Single(row!.Addresses).Extra.ContainsKey("floor"), outcome);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewReshapeImpactTests.cs b/DynamicWhere.Tests/Policies/ReviewReshapeImpactTests.cs
new file mode 100644
index 0000000..67e17af
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewReshapeImpactTests.cs
@@ -0,0 +1,323 @@
+using System.Linq.Expressions;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+// What the needless projection behind a reshaping lambda costs on shapes other than a plain entity: an abstract
+// hierarchy, a concrete root with derived rows, and a constructor-bound entity. The only denial (ZyiKey.Secret) sits
+// beneath Owner.Keys, which nothing loads. Each test asserts the rows come back as the unguarded query returns them.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public class ZyiOwner
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZyiKey> Keys { get; set; } = new();
+
+        public List<ZyiPayment> Payments { get; set; } = new();
+
+        public List<ZyiDoc> Docs { get; set; } = new();
+
+        public List<ZyiMember> Members { get; set; } = new();
+
+        public List<ZyiInvoice> Invoices { get; set; } = new();
+    }
+
+    /// <summary>DDD style: a private constructor for EF Core, a public one for the domain, private setters.</summary>
+    public class ZyiInvoice
+    {
+        private ZyiInvoice()
+        {
+        }
+
+        public ZyiInvoice(string number) => Number = number;
+
+        public int Id { get; private set; }
+
+        public string Number { get; private set; } = string.Empty;
+
+        public int ZyiOwnerId { get; private set; }
+
+        public ZyiOwner? Owner { get; private set; }
+    }
+
+    public class ZyiKey
+    {
+        public int Id { get; set; }
+
+        public int ZyiOwnerId { get; set; }
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    public abstract class ZyiPayment
+    {
+        public int Id { get; set; }
+
+        public long Cents { get; set; }
+
+        public int ZyiOwnerId { get; set; }
+
+        public ZyiOwner? Owner { get; set; }
+    }
+
+    public class ZyiCardPayment : ZyiPayment
+    {
+        public string Last4 { get; set; } = string.Empty;
+    }
+
+    public class ZyiCashPayment : ZyiPayment
+    {
+        public string Till { get; set; } = string.Empty;
+    }
+
+    public class ZyiDoc
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        public int ZyiOwnerId { get; set; }
+
+        public ZyiOwner? Owner { get; set; }
+    }
+
+    public class ZyiRichDoc : ZyiDoc
+    {
+        public int Pages { get; set; }
+    }
+
+    /// <summary>Constructor-bound: EF Core binds it, and it has no parameterless constructor.</summary>
+    public class ZyiMember
+    {
+        public ZyiMember(int id, string name, int zyiOwnerId)
+        {
+            Id = id;
+            Name = name;
+            ZyiOwnerId = zyiOwnerId;
+        }
+
+        public int Id { get; private set; }
+
+        public string Name { get; private set; }
+
+        public int ZyiOwnerId { get; private set; }
+
+        public ZyiOwner? Owner { get; private set; }
+    }
+
+    public static class ZyiSpecs
+    {
+        public static readonly Expression<Func<ZyiPayment, bool>> Paid = p => p.Cents > 0;
+
+        public static readonly Expression<Func<ZyiDoc, bool>> Titled = d => d.Title != string.Empty;
+
+        public static readonly Expression<Func<ZyiMember, bool>> Named = m => m.Name != string.Empty;
+
+        public static readonly Expression<Func<ZyiInvoice, bool>> Numbered = i => i.Number != string.Empty;
+    }
+
+    public sealed class ZyiContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZyiContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZyiOwner> Owners => Set<ZyiOwner>();
+
+        public DbSet<ZyiPayment> Payments => Set<ZyiPayment>();
+
+        public DbSet<ZyiDoc> Docs => Set<ZyiDoc>();
+
+        public DbSet<ZyiMember> Members => Set<ZyiMember>();
+
+        /// <summary>A queryable function, as EF Core maps a table-valued function (not mapped here; only its shape is read).</summary>
+        public IQueryable<ZyiDoc> DocsOf(int ownerId) => Docs.Where(d => d.ZyiOwnerId == ownerId);
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZyiCardPayment>();
+            model.Entity<ZyiCashPayment>();
+            model.Entity<ZyiRichDoc>();
+            model.Entity<ZyiMember>().HasOne(m => m.Owner).WithMany(o => o.Members).HasForeignKey(m => m.ZyiOwnerId);
+        }
+    }
+
+    public sealed class ReviewReshapeImpactTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZyiContext _db;
+
+        public ReviewReshapeImpactTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZyiContext(_connection);
+            _db.Database.EnsureCreated();
+
+            ZyiOwner owner = new()
+            {
+                Name = "W1",
+                Keys = { new ZyiKey { Secret = "zyi-secret" } },
+                Payments = { new ZyiCardPayment { Cents = 100, Last4 = "4242" }, new ZyiCashPayment { Cents = 200, Till = "T1" } },
+                Docs = { new ZyiDoc { Title = "plain" }, new ZyiRichDoc { Title = "rich", Pages = 3 } },
+                Invoices = { new ZyiInvoice("INV-1") }
+            };
+
+            _db.Owners.Add(owner);
+            _db.SaveChanges();
+            _db.Members.Add(new ZyiMember(0, "M1", owner.Id));
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = DwTier.Strict, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        private string Typed<T>(string label, IQueryable<T> source) where T : class
+        {
+            string unguarded = JsonSerializer.Serialize(source.AsNoTracking().ToList().Select(r => r.GetType().Name));
+            PolicyQueryable<T> guarded = Guard(source);
+            string outcome;
+
+            _db.ChangeTracker.Clear();
+
+            try
+            {
+                List<T> rows = guarded.ToList(new Filter()).Data;
+
+                outcome = $"OK types={JsonSerializer.Serialize(rows.Select(r => r.GetType().Name))} json={JsonSerializer.Serialize<object>(rows)}";
+            }
+            catch (Exception e)
+            {
+                outcome = $"THREW {e.GetType().Name} {(e is PolicyException p ? p.ErrorCode.ToString() : string.Empty)} {e.Message.Split('\n')[0]}";
+            }
+
+            ZyLog.Write(_out, $"I {label}: {ZyLog.Shape(source.Expression)} unguarded types={unguarded} guarded {outcome} dropped=[{ZyLog.Decisions(guarded)}]");
+
+            return outcome;
+        }
+
+        [Fact]
+        public void Zy_I1_control_abstract_rows_through_a_navigation_collection()
+        {
+            string outcome = Typed("I1 control SelectMany(o => o.Payments)", _db.Owners.SelectMany(o => o.Payments));
+
+            Assert.StartsWith("OK", outcome);
+            Assert.Contains("ZyiCardPayment", outcome);
+        }
+
+        [Fact]
+        public void Zy_I2_abstract_rows_through_a_navigation_collection_with_a_specification()
+        {
+            string outcome = Typed("I2 SelectMany(o => o.Payments.AsQueryable().Where(spec))", _db.Owners.SelectMany(o => o.Payments.AsQueryable().Where(ZyiSpecs.Paid)));
+
+            Assert.StartsWith("OK", outcome);
+            Assert.Contains("ZyiCardPayment", outcome);
+        }
+
+        [Fact]
+        public void Zy_I3_control_derived_rows_of_a_concrete_root()
+        {
+            string outcome = Typed("I3 control SelectMany(o => o.Docs)", _db.Owners.SelectMany(o => o.Docs));
+
+            Assert.Contains("ZyiRichDoc", outcome);
+        }
+
+        [Fact]
+        public void Zy_I4_derived_rows_of_a_concrete_root_with_a_specification()
+        {
+            string outcome = Typed("I4 SelectMany(o => o.Docs.AsQueryable().Where(spec))", _db.Owners.SelectMany(o => o.Docs.AsQueryable().Where(ZyiSpecs.Titled)));
+
+            Assert.Contains("ZyiRichDoc", outcome);
+        }
+
+        [Fact]
+        public void Zy_I5_control_a_constructor_bound_entity()
+        {
+            string outcome = Typed("I5 control SelectMany(o => o.Members)", _db.Owners.SelectMany(o => o.Members));
+
+            Assert.StartsWith("OK", outcome);
+        }
+
+        [Fact]
+        public void Zy_I6_a_constructor_bound_entity_with_a_specification()
+        {
+            string outcome = Typed("I6 SelectMany(o => o.Members.AsQueryable().Where(spec))", _db.Owners.SelectMany(o => o.Members.AsQueryable().Where(ZyiSpecs.Named)));
+
+            Assert.StartsWith("OK", outcome);
+        }
+
+        [Fact]
+        public void Zy_I9_control_a_DDD_aggregate_with_a_private_constructor()
+        {
+            string outcome = Typed("I9 control SelectMany(o => o.Invoices)", _db.Owners.SelectMany(o => o.Invoices));
+
+            Assert.StartsWith("OK", outcome);
+            Assert.Contains("INV-1", outcome);
+        }
+
+        [Fact]
+        public void Zy_I10_a_DDD_aggregate_with_a_private_constructor_and_a_specification()
+        {
+            string outcome = Typed("I10 SelectMany(o => o.Invoices.AsQueryable().Where(spec))", _db.Owners.SelectMany(o => o.Invoices.AsQueryable().Where(ZyiSpecs.Numbered)));
+
+            Assert.StartsWith("OK", outcome);
+            Assert.Contains("INV-1", outcome);
+        }
+
+        [Fact]
+        public void Zy_I11_a_DDD_aggregate_through_a_left_join_in_query_syntax()
+        {
+            IQueryable<ZyiInvoice> source =
+                from o in _db.Owners
+                join i in _db.Set<ZyiInvoice>() on o.Id equals i.ZyiOwnerId into invoices
+                from i in invoices.DefaultIfEmpty()
+                select i;
+
+            string outcome = Typed("I11 left join to a DDD aggregate", source);
+
+            Assert.StartsWith("OK", outcome);
+            Assert.Contains("INV-1", outcome);
+        }
+
+        [Fact]
+        public void Zy_I7_a_queryable_function_on_the_context_is_read_as_building()
+        {
+            // Shape only: EF Core maps such a method to a table-valued function; SQLite cannot run one.
+            IQueryable<ZyiDoc> source = _db.Owners.SelectMany(o => _db.DocsOf(o.Id));
+            string shape = ZyLog.Shape(source.Expression);
+
+            ZyLog.Write(_out, $"I I7 SelectMany(o => _db.DocsOf(o.Id)) (shape only): {shape}");
+
+            Assert.DoesNotContain("builds=True", shape);
+        }
+
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewReshapePrecisionTests.cs b/DynamicWhere.Tests/Policies/ReviewReshapePrecisionTests.cs
new file mode 100644
index 0000000..e3534a8
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewReshapePrecisionTests.cs
@@ -0,0 +1,630 @@
+using System.Linq.Expressions;
+using System.Reflection;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+// What an ordinary reshaped EF Core query gets when the only denial (ZyrCard.Pan) sits beneath a navigation nothing
+// loads: no projection, the auto-included Tier kept, the converted Meta bag kept. Specifications, repositories,
+// FromSql, a context's Set through an interface, composite keys and query-syntax joins, lets and left joins read no
+// more than a plain chain does. QueryRoot's internals are reached by reflection.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public class ZyrTier
+    {
+        public int Id { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+    }
+
+    public class ZyrCustomer
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public string Region { get; set; } = string.Empty;
+
+        public int ZyrTierId { get; set; }
+
+        /// <summary>Automatically included; nothing beneath it is denied.</summary>
+        public ZyrTier? Tier { get; set; }
+
+        /// <summary>A converted JSON bag, the pre-EF7 way to store one.</summary>
+        public Dictionary<string, object> Meta { get; set; } = new();
+
+        /// <summary>Never loaded by any probe; the only denial is beneath it.</summary>
+        public List<ZyrCard> Cards { get; set; } = new();
+
+        public List<ZyrOrder> Orders { get; set; } = new();
+    }
+
+    public class ZyrCard
+    {
+        public int Id { get; set; }
+
+        public int ZyrCustomerId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZyrChannel
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+    }
+
+    public class ZyrOrder
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public string Region { get; set; } = string.Empty;
+
+        public int ZyrCustomerId { get; set; }
+
+        /// <summary>Never loaded; Customer.Cards.Pan is the denial beneath it.</summary>
+        public ZyrCustomer? Customer { get; set; }
+
+        public int ZyrChannelId { get; set; }
+
+        /// <summary>Automatically included; nothing beneath it is denied.</summary>
+        public ZyrChannel? Channel { get; set; }
+
+        /// <summary>A converted JSON bag.</summary>
+        public Dictionary<string, object> Meta { get; set; } = new();
+    }
+
+    /// <summary>A context exposed through an interface, as clean-architecture templates do.</summary>
+    public interface IZyrContext
+    {
+        DbSet<TEntity> Set<TEntity>() where TEntity : class;
+    }
+
+    /// <summary>What a repository layer looks like: a method and a property handing out a plain set.</summary>
+    public sealed class ZyrRepository
+    {
+        private readonly ZyrContext _db;
+
+        public ZyrRepository(ZyrContext db) => _db = db;
+
+        public IQueryable<ZyrCustomer> Customers() => _db.Customers;
+
+        public IQueryable<ZyrCustomer> CustomerSet => _db.Customers;
+    }
+
+    /// <summary>Reusable predicates, the specification pattern.</summary>
+    public static class ZyrSpecs
+    {
+        public static readonly Expression<Func<ZyrOrder, bool>> Open = o => o.Code != string.Empty;
+
+        public static Expression<Func<ZyrOrder, bool>> InRegion(string region) => o => o.Region == region;
+
+        public static readonly Expression<Func<ZyrCustomer, bool>> Named = c => c.Name != string.Empty;
+    }
+
+    public readonly record struct ZyrRegionId(int Value);
+
+    /// <summary>A request object a controller captures into a query.</summary>
+    public sealed class ZyrFilter
+    {
+        public string Region { get; set; } = string.Empty;
+
+        public List<string> Codes { get; set; } = new();
+    }
+
+    public sealed class ZyrContext : DbContext, IZyrContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZyrContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZyrCustomer> Customers => Set<ZyrCustomer>();
+
+        public DbSet<ZyrOrder> Orders => Set<ZyrOrder>();
+
+        public DbSet<ZyrTier> Tiers => Set<ZyrTier>();
+
+        public DbSet<ZyrChannel> Channels => Set<ZyrChannel>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZyrCustomer>().ToTable("ZyrCustomers");
+            model.Entity<ZyrOrder>().ToTable("ZyrOrders");
+            model.Entity<ZyrCustomer>().Navigation(c => c.Tier).AutoInclude();
+            model.Entity<ZyrOrder>().Navigation(o => o.Channel).AutoInclude();
+            model.Entity<ZyrCustomer>().Property(c => c.Meta).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!);
+            model.Entity<ZyrOrder>().Property(o => o.Meta).HasConversion(
+                value => JsonSerializer.Serialize(value, (JsonSerializerOptions?)null),
+                text => JsonSerializer.Deserialize<Dictionary<string, object>>(text, (JsonSerializerOptions?)null)!);
+        }
+    }
+
+    /// <summary>Writes a test's outcome to its output, and reads the query's shape.</summary>
+    internal static class ZyLog
+    {
+        internal static void Write(ITestOutputHelper output, string line) => output.WriteLine(line);
+
+        /// <summary>QueryRoot.Reshapes / Builds, by reflection, where the tree has them.</summary>
+        internal static string Shape(Expression expression)
+        {
+            Type? root = typeof(Filter).Assembly.GetType("DynamicWhere.ex.Source.QueryRoot");
+
+            string Call(string name)
+            {
+                MethodInfo? method = root?.GetMethod(name, BindingFlags.NonPublic | BindingFlags.Static, null, new[] { typeof(Expression) }, null);
+
+                if (method is null)
+                {
+                    return "n/a";
+                }
+
+                try
+                {
+                    return method.Invoke(null, new object[] { expression })!.ToString()!;
+                }
+                catch (TargetInvocationException e)
+                {
+                    return "threw " + e.InnerException?.GetType().Name;
+                }
+            }
+
+            return $"reshapes={Call("Reshapes")} builds={Call("Builds")}";
+        }
+
+        internal static string Decisions<T>(PolicyQueryable<T> guarded) where T : class =>
+            string.Join(" | ", guarded.LastTrace?.Decisions
+                .Where(d => d.Action != PolicyAction.Allowed)
+                .Select(d => $"{d.FieldPath} {d.Action}: {d.Reason}") ?? Array.Empty<string>());
+
+        internal static bool AnyDropped<T>(PolicyQueryable<T> guarded) where T : class =>
+            guarded.LastTrace?.Decisions.Any(d => d.Action == PolicyAction.Dropped) ?? false;
+    }
+
+    public sealed class ReviewReshapePrecisionTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZyrContext _db;
+        private readonly ZyrRepository _repo;
+
+        public ReviewReshapePrecisionTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZyrContext(_connection);
+            _db.Database.EnsureCreated();
+            _repo = new ZyrRepository(_db);
+
+            ZyrTier gold = new() { Label = "gold" };
+            ZyrChannel web = new() { Name = "web" };
+
+            ZyrCustomer c1 = new()
+            {
+                Name = "C1",
+                Region = "north",
+                Tier = gold,
+                Meta = { ["k"] = "v1" },
+                Cards = { new ZyrCard { Label = "visa", Pan = "zyr-pan-secret" } }
+            };
+            ZyrCustomer c2 = new() { Name = "C2", Region = "south", Tier = gold, Meta = { ["k"] = "v2" } };
+
+            c1.Orders.Add(new ZyrOrder { Code = "O1", Region = "north", Channel = web, Meta = { ["k"] = "o1" } });
+            c1.Orders.Add(new ZyrOrder { Code = "O2", Region = "south", Channel = web, Meta = { ["k"] = "o2" } });
+            c2.Orders.Add(new ZyrOrder { Code = "O3", Region = "south", Channel = web, Meta = { ["k"] = "o3" } });
+
+            _db.Customers.AddRange(c1, c2);
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        /// <summary>
+        /// Runs the unguarded query (to show EF Core translates it) and the guarded one, logs both, and returns the
+        /// guarded rows with the handle; null rows when the unguarded query itself does not translate.
+        /// </summary>
+        private (List<T>? Rows, PolicyQueryable<T> Guarded) Run<T>(string label, IQueryable<T> source) where T : class
+        {
+            string shape = ZyLog.Shape(source.Expression);
+            PolicyQueryable<T> guarded = Guard(source);
+
+            try
+            {
+                int count = source.AsNoTracking().ToList().Count;
+
+                ZyLog.Write(_out, $"R {label}: unguarded OK rows={count} {shape}");
+            }
+            catch (Exception e)
+            {
+                ZyLog.Write(_out, $"R {label}: unguarded THREW {e.GetType().Name} {e.Message.Split('\n')[0]} {shape}");
+
+                return (null, guarded);
+            }
+
+            _db.ChangeTracker.Clear();
+
+            try
+            {
+                List<T> rows = guarded.ToList(new Filter()).Data;
+                int tracked = _db.ChangeTracker.Entries().Count();
+
+                ZyLog.Write(_out, $"R {label}: guarded OK rows={rows.Count} tracked={tracked} dropped=[{ZyLog.Decisions(guarded)}]");
+
+                return (rows, guarded);
+            }
+            catch (Exception e)
+            {
+                string code = e is PolicyException refusal ? refusal.ErrorCode.ToString() : string.Empty;
+
+                ZyLog.Write(_out, $"R {label}: guarded THREW {e.GetType().Name} {code} {e.Message.Split('\n')[0]} dropped=[{ZyLog.Decisions(guarded)}]");
+
+                throw;
+            }
+        }
+
+        private void CustomersAsLoaded(string label, IQueryable<ZyrCustomer> source, int count)
+        {
+            (List<ZyrCustomer>? rows, PolicyQueryable<ZyrCustomer> guarded) = Run(label, source);
+
+            if (rows is null)
+            {
+                return;
+            }
+
+            Assert.Equal(count, rows.Count);
+            Assert.False(ZyLog.AnyDropped(guarded), ZyLog.Decisions(guarded));
+            Assert.All(rows, row => Assert.Equal("gold", row.Tier?.Label));
+            Assert.All(rows, row => Assert.True(row.Meta.ContainsKey("k"), "Meta left out"));
+        }
+
+        private void OrdersAsLoaded(string label, IQueryable<ZyrOrder> source, int count)
+        {
+            (List<ZyrOrder>? rows, PolicyQueryable<ZyrOrder> guarded) = Run(label, source);
+
+            if (rows is null)
+            {
+                return;
+            }
+
+            Assert.Equal(count, rows.Count);
+            Assert.False(ZyLog.AnyDropped(guarded), ZyLog.Decisions(guarded));
+            Assert.All(rows, row => Assert.Equal("web", row.Channel?.Name));
+            Assert.All(rows, row => Assert.True(row.Meta.ContainsKey("k"), "Meta left out"));
+        }
+
+        // ------------------------------------------------------------------ controls: expected green everywhere
+
+        [Fact]
+        public void Zy_R00_control_Select_to_a_navigation()
+        {
+            CustomersAsLoaded("R00 Select(o => o.Customer)", _db.Orders.Select(o => o.Customer!), 3);
+        }
+
+        [Fact]
+        public void Zy_R01_control_SelectMany_over_a_collection()
+        {
+            OrdersAsLoaded("R01 SelectMany(c => c.Orders)", _db.Customers.SelectMany(c => c.Orders), 3);
+        }
+
+        [Fact]
+        public void Zy_R02_control_correlated_subquery_over_a_captured_set_property()
+        {
+            CustomersAsLoaded(
+                "R02 SelectMany(o => _db.Customers.Where(..))",
+                _db.Orders.SelectMany(o => _db.Customers.Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R03_control_correlated_subquery_over_DbContext_Set()
+        {
+            CustomersAsLoaded(
+                "R03 SelectMany(o => _db.Set<C>().Where(..))",
+                _db.Orders.SelectMany(o => _db.Set<ZyrCustomer>().Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R04_control_correlated_subquery_over_a_repository_property()
+        {
+            CustomersAsLoaded(
+                "R04 SelectMany(o => _repo.CustomerSet.Where(..))",
+                _db.Orders.SelectMany(o => _repo.CustomerSet.Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R05_control_captured_plain_query_variable()
+        {
+            IQueryable<ZyrCustomer> named = _db.Customers.Where(c => c.Name != string.Empty).AsNoTracking();
+
+            CustomersAsLoaded(
+                "R05 SelectMany(o => named.Where(..))",
+                _db.Orders.SelectMany(o => named.Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R06_control_captured_values_in_a_nested_predicate()
+        {
+            List<string> regions = new() { "north", "south" };
+            ZyrRegionId region = new(1);
+            DateTime cutoff = new(2000, 1, 1);
+
+            OrdersAsLoaded(
+                "R06 nested predicate: list.Contains, struct id, DateTime, new DateTime",
+                _db.Customers.SelectMany(c => c.Orders.Where(o => regions.Contains(o.Region)
+                                                                   && region.Value > 0
+                                                                   && new DateTime(2100, 1, 1) > cutoff)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R07_control_Join_on_a_single_key()
+        {
+            CustomersAsLoaded(
+                "R07 Join single key",
+                _db.Orders.Join(_db.Customers, o => o.ZyrCustomerId, c => c.Id, (o, c) => c),
+                3);
+        }
+
+        // ------------------------------------------------------------------ what a lambda reads without building
+
+        [Fact]
+        public void Zy_R10_a_specification_variable_inside_a_correlated_subquery()
+        {
+            Expression<Func<ZyrCustomer, bool>> named = c => c.Name != string.Empty;
+
+            CustomersAsLoaded(
+                "R10 SelectMany(o => _db.Customers.Where(specVariable).Where(..))",
+                _db.Orders.SelectMany(o => _db.Customers.Where(named).Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R11_a_static_specification_on_a_navigation_collection()
+        {
+            OrdersAsLoaded(
+                "R11 SelectMany(c => c.Orders.AsQueryable().Where(ZyrSpecs.Open))",
+                _db.Customers.SelectMany(c => c.Orders.AsQueryable().Where(ZyrSpecs.Open)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R12_a_specification_factory_method_on_a_navigation_collection()
+        {
+            OrdersAsLoaded(
+                "R12 SelectMany(c => c.Orders.AsQueryable().Where(ZyrSpecs.InRegion(\"south\")))",
+                _db.Customers.SelectMany(c => c.Orders.AsQueryable().Where(ZyrSpecs.InRegion("south"))),
+                2);
+        }
+
+        [Fact]
+        public void Zy_R13_a_static_specification_inside_a_correlated_subquery_over_a_set()
+        {
+            CustomersAsLoaded(
+                "R13 SelectMany(o => _db.Customers.Where(ZyrSpecs.Named).Where(..))",
+                _db.Orders.SelectMany(o => _db.Customers.Where(ZyrSpecs.Named).Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R14_a_repository_method_inside_a_correlated_subquery()
+        {
+            CustomersAsLoaded(
+                "R14 SelectMany(o => _repo.Customers().Where(..))",
+                _db.Orders.SelectMany(o => _repo.Customers().Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R15_Set_through_a_context_interface_inside_a_correlated_subquery()
+        {
+            IZyrContext context = _db;
+
+            CustomersAsLoaded(
+                "R15 SelectMany(o => iface.Set<C>().Where(..))",
+                _db.Orders.SelectMany(o => context.Set<ZyrCustomer>().Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R16_FromSqlRaw_inside_a_correlated_subquery()
+        {
+            CustomersAsLoaded(
+                "R16 SelectMany(o => _db.Customers.FromSqlRaw(..).Where(..))",
+                _db.Orders.SelectMany(o => _db.Customers.FromSqlRaw("SELECT * FROM ZyrCustomers").Where(c => c.Id == o.ZyrCustomerId)),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R17_a_specification_in_query_syntax()
+        {
+            Expression<Func<ZyrOrder, bool>> open = o => o.Code != string.Empty;
+
+            IQueryable<ZyrOrder> source =
+                from c in _db.Customers
+                from o in c.Orders.AsQueryable().Where(open)
+                select o;
+
+            OrdersAsLoaded("R17 from c .. from o in c.Orders.AsQueryable().Where(spec) select o", source, 3);
+        }
+
+        // ------------------------------------------------------------------ 3.2.0-wide: anonymous keys and carriers
+
+        [Fact]
+        public void Zy_R20_Join_on_a_composite_key()
+        {
+            CustomersAsLoaded(
+                "R20 Join composite key",
+                _db.Orders.Join(_db.Customers, o => new { Id = o.ZyrCustomerId, o.Region }, c => new { c.Id, c.Region }, (o, c) => c),
+                2);
+        }
+
+        [Fact]
+        public void Zy_R21_left_join_in_query_syntax()
+        {
+            IQueryable<ZyrCustomer> source =
+                from o in _db.Orders
+                join c in _db.Customers on o.ZyrCustomerId equals c.Id into cs
+                from c in cs.DefaultIfEmpty()
+                select c;
+
+            CustomersAsLoaded("R21 left join (GroupJoin + DefaultIfEmpty)", source, 3);
+        }
+
+        [Fact]
+        public void Zy_R22_two_from_clauses_with_a_where()
+        {
+            IQueryable<ZyrOrder> source =
+                from c in _db.Customers
+                from o in c.Orders
+                where o.Code != string.Empty
+                select o;
+
+            OrdersAsLoaded("R22 from c from o in c.Orders where .. select o", source, 3);
+        }
+
+        [Fact]
+        public void Zy_R23_GroupBy_on_a_composite_key_then_First()
+        {
+            if (typeof(DbContext).Assembly.GetName().Version!.Major < 7)
+            {
+                return;
+            }
+
+            OrdersAsLoaded(
+                "R23 GroupBy(new { .. }).Select(g => g.OrderBy(..).First())",
+                _db.Orders.GroupBy(o => new { o.ZyrCustomerId, o.Region }).Select(g => g.OrderBy(o => o.Id).First()),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R08_control_a_conditional_with_null()
+        {
+            CustomersAsLoaded(
+                "R08 Select(o => o.ZyrCustomerId > 0 ? o.Customer : null)",
+                _db.Orders.Select(o => o.ZyrCustomerId > 0 ? o.Customer! : null!),
+                3);
+        }
+
+        [Fact]
+        public void Zy_R09_control_captured_filter_object_in_a_nested_predicate()
+        {
+            ZyrFilter filter = new() { Region = "south", Codes = new List<string> { "O2", "O3" } };
+
+            OrdersAsLoaded(
+                "R09 nested predicate over a captured filter object's members",
+                _db.Customers.SelectMany(c => c.Orders.Where(o => o.Region == filter.Region && filter.Codes.Contains(o.Code))),
+                2);
+        }
+
+        [Fact]
+        public void Zy_R18_control_two_from_clauses_without_a_where()
+        {
+            IQueryable<ZyrOrder> source =
+                from c in _db.Customers
+                from o in c.Orders
+                select o;
+
+            OrdersAsLoaded("R18 from c from o in c.Orders select o", source, 3);
+        }
+
+        [Fact]
+        public void Zy_R19_control_join_in_query_syntax()
+        {
+            IQueryable<ZyrCustomer> source =
+                from o in _db.Orders
+                join c in _db.Customers on o.ZyrCustomerId equals c.Id
+                select c;
+
+            CustomersAsLoaded("R19 from o join c .. select c", source, 3);
+        }
+
+        [Fact]
+        public void Zy_R25_join_then_where_in_query_syntax()
+        {
+            IQueryable<ZyrCustomer> source =
+                from o in _db.Orders
+                join c in _db.Customers on o.ZyrCustomerId equals c.Id
+                where o.Code != string.Empty
+                select c;
+
+            CustomersAsLoaded("R25 from o join c .. where o.Code .. select c", source, 3);
+        }
+
+        /// <summary>Shape only: value-typed calls in predicates and keys (string.Format, interpolation, Convert, ToUpper, Nullable).</summary>
+        [Fact]
+        public void Zy_R30_control_value_calls_in_predicates_and_keys_are_not_read_as_building()
+        {
+            (string Label, System.Linq.Expressions.Expression Expression)[] shapes =
+            {
+                ("string.Format in a nested predicate", _db.Customers.SelectMany(c => c.Orders.Where(o => string.Format("{0}", o.Code) == "O1")).Expression),
+                ("interpolation in a nested predicate", _db.Customers.SelectMany(c => c.Orders.Where(o => $"{o.Code}-{o.Region}" != string.Empty)).Expression),
+                ("Convert in a nested predicate", _db.Customers.SelectMany(c => c.Orders.Where(o => Convert.ToString(o.ZyrCustomerId) != string.Empty)).Expression),
+                ("ToUpper key", _db.Orders.GroupBy(o => o.Region.ToUpper()).Select(g => g.OrderBy(o => o.Id).First()).Expression),
+                ("Nullable key", _db.Orders.GroupBy(o => (int?)o.ZyrCustomerId).Select(g => g.OrderBy(o => o.Id).First()).Expression),
+                ("EF.Functions in a nested predicate", _db.Customers.SelectMany(c => c.Orders.Where(o => EF.Functions.Like(o.Code, "O%"))).Expression)
+            };
+
+            List<string> building = new();
+
+            foreach ((string label, System.Linq.Expressions.Expression expression) in shapes)
+            {
+                string shape = ZyLog.Shape(expression);
+
+                ZyLog.Write(_out, $"R R30 {label}: {shape}");
+
+                if (shape.Contains("builds=True"))
+                {
+                    building.Add(label);
+                }
+            }
+
+            Assert.Empty(building);
+        }
+
+        [Fact]
+        public void Zy_R24_let_clause()
+        {
+            IQueryable<ZyrCustomer> source =
+                from o in _db.Orders
+                let c = o.Customer
+                where c!.Name != string.Empty
+                select c;
+
+            CustomersAsLoaded("R24 let c = o.Customer", source, 3);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewReshapeTests.cs b/DynamicWhere.Tests/Policies/ReviewReshapeTests.cs
new file mode 100644
index 0000000..efed892
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewReshapeTests.cs
@@ -0,0 +1,298 @@
+using System.Collections;
+using System.Reflection;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using DynamicWhere.ex.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ reshaped chains: models
+
+    public class ZvShopper
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZvPayCard> Cards { get; set; } = new();
+    }
+
+    public class ZvPayCard
+    {
+        public int Id { get; set; }
+
+        public int ZvShopperId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZvPurchase
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public int ZvShopperId { get; set; }
+
+        public ZvShopper? Shopper { get; set; }
+    }
+
+    /// <summary>What an application's mapper does: builds the row type from what the query hands it.</summary>
+    public static class ZvMapper
+    {
+        public static ZvShopper Shopper(ZvShopper shopper, List<ZvPayCard> cards) =>
+            new() { Id = shopper.Id, Name = shopper.Name, Cards = cards };
+    }
+
+    public sealed class ZvReshapeContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZvReshapeContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZvShopper> Shoppers => Set<ZvShopper>();
+
+        public DbSet<ZvPurchase> Purchases => Set<ZvPurchase>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+    }
+
+    // ============================================================================ reshaped chains: tests
+
+    /// <summary>
+    /// A reshaped chain with no include and no object built in its lambdas is read from the model. These are
+    /// chains that load a navigation anyway: an application's method builds the row, or a lambda captures a query
+    /// with its own projection or include. An EF Core translation failure of the unguarded query is reported,
+    /// not asserted.
+    /// </summary>
+    public sealed class ReviewReshapeTests : IDisposable
+    {
+        private static readonly JsonSerializerOptions Json = new() { ReferenceHandler = ReferenceHandler.IgnoreCycles };
+
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZvReshapeContext _db;
+
+        public ReviewReshapeTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZvReshapeContext(_connection);
+            _db.Database.EnsureCreated();
+
+            ZvShopper shopper = new() { Name = "S1", Cards = { new ZvPayCard { Label = "visa", Pan = "reshape-pan-secret" } } };
+
+            _db.Shoppers.Add(shopper);
+            _db.Purchases.Add(new ZvPurchase { Code = "P1", Shopper = shopper });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict)
+            where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        private static string Sent(object? rows) => JsonSerializer.Serialize(rows, Json);
+
+        /// <summary>Runs the unguarded query and the guarded one, and reports what each returned.</summary>
+        private (string Unguarded, string Guarded) Run<T>(string label, IQueryable<T> source, DwTier tier = DwTier.Strict) where T : class
+        {
+            string unguarded;
+            string guarded;
+
+            try
+            {
+                unguarded = Sent(source.AsNoTracking().ToList());
+            }
+            catch (Exception e)
+            {
+                unguarded = $"THREW {e.GetType().Name}: {e.Message.Split('\n')[0]}";
+            }
+
+            try
+            {
+                PolicyQueryable<T> handle = Guard(source, tier);
+
+                guarded = Sent(handle.ToList(new Filter()).Data) + " decisions=["
+                          + string.Join(" | ", handle.LastTrace?.Decisions.Where(d => d.Action != PolicyAction.Allowed)
+                              .Select(d => $"{d.FieldPath} {d.Action}") ?? Array.Empty<string>()) + "]";
+            }
+            catch (Exception e)
+            {
+                guarded = $"THREW {e.GetType().Name}: {e.Message.Split('\n')[0]}";
+            }
+
+            RowShape shape = RowShape.Of(source);
+
+            _out.WriteLine($"{label}: shape={shape.Kind} materializes(Cards.Pan)={shape.Materializes("Cards.Pan")} "
+                           + $"reshapes={QueryRoot.Reshapes(source.Expression)} builds={QueryRoot.Builds(source.Expression)}");
+            _out.WriteLine($"{label}: unguarded={unguarded}");
+            _out.WriteLine($"{label}: guarded={guarded}");
+
+            return (unguarded, guarded);
+        }
+
+        // ------------------------------------------------------------------------ D1: a mapper builds the row
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zv_D1_a_reshaped_chain_whose_row_a_method_builds_from_a_loaded_collection(DwTier tier)
+        {
+            IQueryable<ZvShopper> source = _db.Purchases.Select(p => ZvMapper.Shopper(p.Shopper!, p.Shopper!.Cards.ToList()));
+
+            (string unguarded, string guarded) = Run("D1", source, tier);
+
+            Assert.Contains("reshape-pan-secret", unguarded);
+            Assert.DoesNotContain("reshape-pan-secret", guarded);
+        }
+
+        // ------------------------------------------------------------------------ D2: the projection is behind a closure
+
+        [Fact]
+        public void Zv_D2_a_projection_captured_in_a_closure_inside_a_SelectMany()
+        {
+            IQueryable<ZvShopper> built = _db.Shoppers.Select(s => new ZvShopper { Id = s.Id, Name = s.Name, Cards = s.Cards });
+            IQueryable<ZvShopper> source = _db.Purchases.SelectMany(p => built.Where(s => s.Id == p.ZvShopperId));
+
+            (string unguarded, string guarded) = Run("D2 SelectMany", source);
+
+            if (unguarded.StartsWith("THREW", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Assert.DoesNotContain("reshape-pan-secret", guarded);
+        }
+
+        [Fact]
+        public void Zv_D2_a_projection_captured_in_a_closure_inside_a_Select()
+        {
+            IQueryable<ZvShopper> built = _db.Shoppers.Select(s => new ZvShopper { Id = s.Id, Name = s.Name, Cards = s.Cards });
+            IQueryable<ZvShopper> source = _db.Purchases.Select(p => built.First(s => s.Id == p.ZvShopperId));
+
+            (string unguarded, string guarded) = Run("D2 Select", source);
+
+            if (unguarded.StartsWith("THREW", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Assert.DoesNotContain("reshape-pan-secret", guarded);
+        }
+
+        /// <summary>An object captured from memory holds whatever it holds, which no include accounts for.</summary>
+        [Fact]
+        public void Zv_D2_an_object_captured_from_memory_inside_a_Select()
+        {
+            ZvShopper keeper = new() { Id = 99, Name = "keeper", Cards = { new ZvPayCard { Label = "mem", Pan = "memory-pan-secret" } } };
+            IQueryable<ZvShopper> source = _db.Purchases.Select(p => keeper);
+
+            (string unguarded, string guarded) = Run("D2 memory", source);
+
+            if (unguarded.StartsWith("THREW", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Assert.Contains("memory-pan-secret", unguarded);
+            Assert.DoesNotContain("memory-pan-secret", guarded);
+        }
+
+        /// <summary>The same, with an include in place of the projection: the include is behind the closure too.</summary>
+        [Fact]
+        public void Zv_D2_an_include_captured_in_a_closure_inside_a_Select()
+        {
+            IQueryable<ZvShopper> withCards = _db.Shoppers.Include(s => s.Cards);
+            IQueryable<ZvShopper> source = _db.Purchases.Select(p => withCards.First(s => s.Id == p.ZvShopperId));
+
+            (string unguarded, string guarded) = Run("D2 include", source);
+
+            if (unguarded.StartsWith("THREW", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Assert.DoesNotContain("reshape-pan-secret", guarded);
+        }
+
+        // ------------------------------------------------------------------------ ordinary EF Core queries and the epoch
+
+        // ------------------------------------------------------------------------ D3/D4: ruled-out shapes
+
+        /// <summary>An object built only inside a Where subquery loads nothing into the rows.</summary>
+        [Fact]
+        public void Zv_D3_an_object_built_only_inside_a_Where_subquery()
+        {
+            IQueryable<ZvShopper> source = _db.Purchases
+                .Where(p => _db.Shoppers.Select(s => new { s.Id, s.Name }).Any(x => x.Id == p.ZvShopperId))
+                .Select(p => p.Shopper!);
+
+            (string unguarded, string guarded) = Run("D3", source);
+
+            Assert.DoesNotContain("reshape-pan-secret", unguarded);
+            Assert.DoesNotContain("reshape-pan-secret", guarded);
+        }
+
+        /// <summary>A Join whose inner source projects: the construction is an argument of the chain, so it is seen.</summary>
+        [Fact]
+        public void Zv_D4_a_Join_whose_inner_source_projects()
+        {
+            IQueryable<ZvShopper> source = _db.Purchases.Join(
+                _db.Shoppers.Select(s => new ZvShopper { Id = s.Id, Name = s.Name, Cards = s.Cards }),
+                p => p.ZvShopperId,
+                s => s.Id,
+                (p, s) => s);
+
+            (string unguarded, string guarded) = Run("D4", source);
+
+            if (unguarded.StartsWith("THREW", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Assert.DoesNotContain("reshape-pan-secret", guarded);
+        }
+
+        /// <summary>A Join whose inner source is a projection held in a variable: still an argument, still seen.</summary>
+        [Fact]
+        public void Zv_D4_a_Join_whose_inner_source_is_a_projection_in_a_variable()
+        {
+            IQueryable<ZvShopper> built = _db.Shoppers.Select(s => new ZvShopper { Id = s.Id, Name = s.Name, Cards = s.Cards });
+            IQueryable<ZvShopper> source = _db.Purchases.Join(built, p => p.ZvShopperId, s => s.Id, (p, s) => s);
+
+            (string unguarded, string guarded) = Run("D4 variable", source);
+
+            if (unguarded.StartsWith("THREW", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Assert.DoesNotContain("reshape-pan-secret", guarded);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewSharedNameEfTests.cs b/DynamicWhere.Tests/Policies/ReviewSharedNameEfTests.cs
new file mode 100644
index 0000000..c97c79c
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewSharedNameEfTests.cs
@@ -0,0 +1,300 @@
+using System.Linq.Expressions;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+// Members sharing a name on an EF Core entity, read from what the query loads; a denied value a derived type hides with
+// new, read as its base; and a join on a filtered set, which holds its query inline.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public class ZwAuthorCard
+    {
+        public int Id { get; set; }
+
+        public int ZwAuthorId { get; set; }
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZwAuthor
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        /// <summary>Never loaded by any probe; the only denial is beneath it.</summary>
+        public List<ZwAuthorCard> Cards { get; set; } = new();
+    }
+
+    public class ZwDocBase
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        public int? ZwAuthorId { get; set; }
+
+        public virtual ZwAuthor? Author { get; set; }
+    }
+
+    /// <summary>Re-declares the navigation with new, the same type (to change an annotation, say).</summary>
+    public class ZwDoc : ZwDocBase
+    {
+        public new ZwAuthor? Author
+        {
+            get => base.Author;
+            set => base.Author = value;
+        }
+    }
+
+    public sealed class ZwDocContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZwDocContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZwDoc> Docs => Set<ZwDoc>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+    }
+
+    public class ZwInfoBase
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public string? Info { get; set; }
+    }
+
+    public class ZwPlainThing
+    {
+        public string Label { get; set; } = string.Empty;
+    }
+
+    /// <summary>Hides the denied value with an object of a clean type.</summary>
+    public class ZwInfoDerived : ZwInfoBase
+    {
+        public new ZwPlainThing? Info { get; set; }
+    }
+
+    /// <summary>The same beside a top-level denial, so a projection is built.</summary>
+    public class ZwInfoDerivedDenied : ZwInfoBase
+    {
+        [DwDenied]
+        public string? Ssn { get; set; }
+
+        public new ZwPlainThing? Info { get; set; }
+    }
+
+    public class ZwVipAuthor : ZwAuthor
+    {
+        public string Level { get; set; } = string.Empty;
+    }
+
+    public class ZwDocBase2
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        public int? ZwAuthorId { get; set; }
+
+        public ZwAuthor? Author { get; set; }
+    }
+
+    /// <summary>Re-declares the navigation with new, under a derived type.</summary>
+    public class ZwDoc2 : ZwDocBase2
+    {
+        public new ZwVipAuthor? Author { get; set; }
+    }
+
+    public sealed class ZwDoc2Context : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZwDoc2Context(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZwDoc2> Docs => Set<ZwDoc2>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+    }
+
+    public sealed class ReviewSharedNameEfTests
+    {
+        private readonly ITestOutputHelper _out;
+
+        public ReviewSharedNameEfTests(ITestOutputHelper output) => _out = output;
+
+        [Fact]
+        public void Zw_N1_an_entity_redeclaring_an_unloaded_navigation_with_new_is_not_projected()
+        {
+            using SqliteConnection connection = new("DataSource=:memory:");
+            connection.Open();
+
+            using ZwDocContext db = new(connection);
+            string model;
+
+            try
+            {
+                db.Database.EnsureCreated();
+                model = "built";
+            }
+            catch (Exception e)
+            {
+                model = $"THREW {e.GetType().Name}: {e.Message.Split('\n')[0]}";
+            }
+
+            _out.WriteLine($"N1 model {model}; Author members: " + string.Join(", ", typeof(ZwDoc).GetProperties().Where(p => p.Name == "Author").Select(p => p.DeclaringType!.Name)));
+
+            if (!model.StartsWith("built", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            db.Docs.Add(new ZwDoc { Title = "d1", Author = new ZwAuthor { Name = "a1", Cards = { new ZwAuthorCard { Pan = "zw-author-pan" } } } });
+            db.SaveChanges();
+            db.ChangeTracker.Clear();
+
+            PolicyQueryable<ZwDoc> guarded = ZwKit.Guard<ZwDoc>(db.Docs);
+            object? data = null;
+            string code = ZwKit.Code(() => data = guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"N1 code={code} sent={ZwKit.Json(data)} trace=[{ZwKit.Trace(guarded)}]");
+
+            Assert.Equal("ran", code);
+            Assert.False(ZwKit.AnyDropped(guarded), ZwKit.Trace(guarded));
+        }
+
+        [Fact]
+        public void Zw_N1b_an_entity_redeclaring_a_navigation_with_new_under_a_derived_type()
+        {
+            using SqliteConnection connection = new("DataSource=:memory:");
+            connection.Open();
+
+            using ZwDoc2Context db = new(connection);
+            string model;
+
+            try
+            {
+                db.Database.EnsureCreated();
+                model = "built: " + string.Join(", ", db.Model.FindEntityType(typeof(ZwDoc2))!.GetNavigations().Select(n => $"{n.Name}->{n.TargetEntityType.ClrType.Name}"));
+            }
+            catch (Exception e)
+            {
+                model = $"THREW {e.GetType().Name}: {e.Message.Split('\n')[0]}";
+            }
+
+            _out.WriteLine($"N1b model {model}");
+
+            if (!model.StartsWith("built", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            db.Docs.Add(new ZwDoc2 { Title = "d1", Author = new ZwVipAuthor { Name = "a1", Level = "gold", Cards = { new ZwAuthorCard { Pan = "zw-author-pan" } } } });
+            db.SaveChanges();
+            db.ChangeTracker.Clear();
+
+            PolicyQueryable<ZwDoc2> guarded = ZwKit.Guard<ZwDoc2>(db.Docs);
+            object? data = null;
+            string code = ZwKit.Code(() => data = guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"N1b code={code} sent={ZwKit.Json(data)} trace=[{ZwKit.Trace(guarded)}]");
+
+            // The caller includes the author (not its cards, beneath which the only denial sits).
+            PolicyQueryable<ZwDoc2> included = ZwKit.Guard<ZwDoc2>(db.Docs.Include(d => d.Author));
+            List<ZwDoc2>? rows = null;
+            string code2 = ZwKit.Code(() => rows = included.ToList(new Filter()).Data);
+
+            _out.WriteLine($"N1b Include(d => d.Author): code={code2} sent={ZwKit.Json(rows)} trace=[{ZwKit.Trace(included)}]");
+
+            Assert.Equal("ran", code);
+            Assert.False(ZwKit.AnyDropped(guarded), ZwKit.Trace(guarded));
+            Assert.Equal("ran", code2);
+            Assert.Equal("a1", rows![0].Author?.Name);
+        }
+
+        [Fact]
+        public void Zw_N2_a_hidden_denied_value_serialized_through_the_base_type()
+        {
+            ZwHideValueDerived row = new() { Id = 1, Code = "open" };
+            ((ZwHideValueBase)row).Code = "zw-hidden-base-secret";
+
+            PolicyQueryable<ZwHideValueDerived> guarded = ZwKit.Guard(new[] { row }.AsQueryable());
+            List<ZwHideValueDerived> sent = guarded.ToList(new Filter()).Data;
+
+            // An API whose response type is the base class, as a controller returning List<Base> does.
+            string asBase = JsonSerializer.Serialize(sent.Cast<ZwHideValueBase>().ToList());
+
+            _out.WriteLine($"N2 as derived={JsonSerializer.Serialize(sent)} as base={asBase} trace=[{ZwKit.Trace(guarded)}] denials(Code)="
+                           + string.Join(",", new AttributePolicyProvider()
+                               .GetFragments(typeof(ZwHideValueDerived), new DwPolicyContext())
+                               .Where(f => f.FieldPath == "Code").Select(f => f.Effect)));
+
+            Assert.DoesNotContain("zw-hidden-base-secret", asBase);
+        }
+
+        [Fact]
+        public void Zw_N3_why_a_join_on_a_filtered_set_reads_as_building()
+        {
+            using SqliteConnection connection = new("DataSource=:memory:");
+            connection.Open();
+
+            using ZwContext db = new(connection);
+            IQueryable<ZwCustomer> source = db.Orders.Join(db.Customers.Where(c => c.Region != string.Empty), o => o.ZwCustomerId, c => c.Id, (o, c) => c);
+            MethodCallExpression join = (MethodCallExpression)source.Expression;
+            Expression inner = join.Arguments[1];
+            string evaluated;
+
+            try
+            {
+                object? value = Expression.Lambda<Func<object?>>(Expression.Convert(inner, typeof(object))).Compile(preferInterpretation: true)();
+
+                evaluated = "ok " + value?.GetType().Name;
+            }
+            catch (Exception e)
+            {
+                evaluated = $"THREW {e.GetType().Name}: {e.Message.Split('\n')[0]}";
+            }
+
+            _out.WriteLine($"N3 inner={inner.NodeType} {inner.GetType().Name} arg0={((MethodCallExpression)inner).Arguments[0].GetType().Name} evaluated: {evaluated} {ZwKit.Shape(source.Expression)}");
+
+            // Diagnostic: the inner sequence cannot be compiled on its own (an inline EF Core root is not reducible), and
+            // the guard must not read that as building.
+            Assert.Contains("builds=False", ZwKit.Shape(source.Expression));
+        }
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zw_N4_a_denied_value_hidden_by_an_object_of_a_clean_type(DwTier tier)
+        {
+            ZwInfoDerived row = new() { Id = 1, Info = new ZwPlainThing { Label = "x" } };
+            ((ZwInfoBase)row).Info = "zw-info-base-secret";
+            ZwInfoDerivedDenied denied = new() { Id = 2, Ssn = "ssn", Info = new ZwPlainThing { Label = "y" } };
+            ((ZwInfoBase)denied).Info = "zw-info-base-secret-2";
+
+            PolicyQueryable<ZwInfoDerived> guarded = ZwKit.Guard(new[] { row }.AsQueryable(), tier);
+            object? data = ZwKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+            PolicyQueryable<ZwInfoDerivedDenied> guarded2 = ZwKit.Guard(new[] { denied }.AsQueryable(), tier);
+            object? data2 = ZwKit.SafeRead(() => guarded2.ToList(new Filter()).Data);
+
+            string asBase = data is List<ZwInfoDerived> a ? JsonSerializer.Serialize(a.Cast<ZwInfoBase>().ToList()) : "null";
+            string asBase2 = data2 is List<ZwInfoDerivedDenied> b ? JsonSerializer.Serialize(b.Cast<ZwInfoBase>().ToList()) : "null";
+
+            _out.WriteLine($"N4 {tier}: as base={asBase} trace=[{ZwKit.Trace(guarded)}]");
+            _out.WriteLine($"N4 {tier} projected: as base={asBase2} trace=[{ZwKit.Trace(guarded2)}]");
+
+            Assert.False(ZwKit.Holds(data, "zw-info-base-secret"));
+            Assert.False(ZwKit.Holds(data2, "zw-info-base-secret-2"));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewSharedNameTests.cs b/DynamicWhere.Tests/Policies/ReviewSharedNameTests.cs
new file mode 100644
index 0000000..cb06b3e
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewSharedNameTests.cs
@@ -0,0 +1,183 @@
+using System.Reflection;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ other declarations: models
+
+    /// <summary>A base type whose denied member a subtype overrides with a covariant return type (C# 9).</summary>
+    public class ZxCovBase
+    {
+        protected ZxBaseCard? CardValue;
+
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        [DwDenied]
+        public virtual ZxBaseCard? Card => CardValue;
+
+        public void Put(ZxBaseCard card) => CardValue = card;
+    }
+
+    public class ZxCovDerived : ZxCovBase
+    {
+        public override ZxDerivedCard? Card => CardValue as ZxDerivedCard;
+    }
+
+    /// <summary>The same with a scalar beneath, the denial on the abstract base declaration.</summary>
+    public abstract class ZxCovAbstract
+    {
+        public int Id { get; set; }
+
+        [DwDenied]
+        public abstract ZxBaseCard? Card { get; }
+    }
+
+    public class ZxCovConcrete : ZxCovAbstract
+    {
+        public ZxDerivedCard? Held { private get; set; }
+
+        public override ZxDerivedCard? Card => Held;
+    }
+
+    // ---- a default interface member that a derived interface overrides explicitly, with the denial there ----
+
+    public interface IZxCoded
+    {
+        string? Code { get; }
+    }
+
+    public interface IZxSecretCoded : IZxCoded
+    {
+        string? Raw { get; }
+
+        [DwDenied]
+        string? IZxCoded.Code => Raw;
+    }
+
+    public class ZxCodedImpl : IZxSecretCoded
+    {
+        public string? Raw { get; set; }
+    }
+
+    public class ZxCodedRow
+    {
+        public int Id { get; set; }
+
+        public IZxCoded? Coded { get; set; }
+    }
+
+    // ---- T itself hides a base member with new, typed as an object holding a denied field ----
+
+    public class ZxHideBase
+    {
+        public int Id { get; set; }
+
+        public string? Info { get; set; }
+    }
+
+    public class ZxHideDerived : ZxHideBase
+    {
+        public new ZxPayCard? Info { get; set; }
+    }
+
+    /// <summary>The same beside a top-level denial, so a projection is built.</summary>
+    public class ZxHideDerivedDenied : ZxHideBase
+    {
+        [DwDenied]
+        public string? Ssn { get; set; }
+
+        public new ZxPayCard? Info { get; set; }
+    }
+
+    // ============================================================================ other declarations: tests
+
+    public sealed class ReviewSharedNameTests
+    {
+        private readonly ITestOutputHelper _out;
+
+        public ReviewSharedNameTests(ITestOutputHelper output) => _out = output;
+
+        [Fact]
+        public void Zx_D1_a_covariant_override_keeps_the_base_declarations_denial()
+        {
+            Assert.NotEmpty(ZxKit.Denials(typeof(ZxCovDerived), "Card"));
+            Assert.NotEmpty(ZxKit.Denials(typeof(ZxCovConcrete), "Card"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_D1_rows_of_the_covariant_subtype_do_not_return_the_denied_member(DwTier tier)
+        {
+            ZxCovDerived row = new() { Id = 1, Name = "r1" };
+            row.Put(new ZxDerivedCard { Label = "covariant-card-secret" });
+            ZxCovConcrete concrete = new() { Id = 2, Held = new ZxDerivedCard { Label = "abstract-covariant-secret" } };
+
+            PolicyQueryable<ZxCovDerived> guarded = ZxKit.Guard(new[] { row }.AsQueryable(), tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"{tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            PolicyQueryable<ZxCovConcrete> guarded2 = ZxKit.Guard(new[] { concrete }.AsQueryable(), tier);
+            object? data2 = ZxKit.SafeRead(() => guarded2.ToList(new Filter()).Data);
+
+            _out.WriteLine($"{tier}: sent={ZxKit.Json(data2)} trace=[{ZxKit.Trace(guarded2)}]");
+
+            Assert.False(ZxKit.Holds(data, "covariant-card-secret"));
+            Assert.False(ZxKit.Holds(data2, "abstract-covariant-secret"));
+        }
+
+        [Fact]
+        public void Zx_D4_a_denial_on_a_derived_interfaces_explicit_default_implementation()
+        {
+            ZxCodedRow[] rows = { new() { Id = 1, Coded = new ZxCodedImpl { Raw = "dim-code-secret" } } };
+
+            _out.WriteLine("runs: " + ((IZxCoded)rows[0].Coded!).Code);
+            _out.WriteLine("Coded.Code denials: " + ZxKit.Denials(typeof(ZxCodedRow), "Coded.Code").Count());
+
+            string where = ZxKit.Code(() => ZxKit.Guard(rows.AsQueryable()).ToList(ZxKit.Where("Coded.Code", "dim-code-secret")));
+            object? data = ZxKit.SafeRead(() => ZxKit.Guard(rows.AsQueryable()).ToList(new Filter()).Data);
+
+            _out.WriteLine($"where={where} sent={ZxKit.Json(data)}");
+
+            Assert.NotEqual("ran", where);
+            Assert.False(ZxKit.Holds(data, "dim-code-secret") && ZxKit.Json(data).Contains("dim-code-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_D5_a_row_type_that_hides_a_value_member_with_an_object_holding_a_denied_field(DwTier tier)
+        {
+            PropertyInfo[] infos = typeof(ZxHideDerived).GetProperties().Where(p => p.Name == "Info").ToArray();
+
+            _out.WriteLine("GetProperties order: " + string.Join(", ", infos.Select(p => $"{p.DeclaringType!.Name}.{p.Name}:{p.PropertyType.Name}")));
+            _out.WriteLine("Info.Pan denials: " + ZxKit.Denials(typeof(ZxHideDerived), "Info.Pan").Count());
+
+            ZxHideDerived[] rows = { new() { Id = 1, Info = new ZxPayCard { Label = "visa", Pan = "hide-pan-secret" } } };
+            ZxHideDerivedDenied[] denied = { new() { Id = 2, Ssn = "hide-ssn", Info = new ZxPayCard { Label = "visa", Pan = "hide-pan-secret-2" } } };
+
+            PolicyQueryable<ZxHideDerived> guarded = ZxKit.Guard(rows.AsQueryable(), tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+            object? named = ZxKit.SafeRead(() => ZxKit.Guard(rows.AsQueryable(), tier).ToList(ZxKit.Selecting("Id", "Info")).Data);
+            PolicyQueryable<ZxHideDerivedDenied> guarded2 = ZxKit.Guard(denied.AsQueryable(), tier);
+            object? data2 = ZxKit.SafeRead(() => guarded2.ToList(new Filter()).Data);
+
+            _out.WriteLine($"{tier} none: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+            _out.WriteLine($"{tier} named: sent={ZxKit.Json(named)}");
+            _out.WriteLine($"{tier} projected: sent={ZxKit.Json(data2)} trace=[{ZxKit.Trace(guarded2)}]");
+
+            Assert.False(ZxKit.Holds(data, "hide-pan-secret"));
+            Assert.False(ZxKit.Holds(named, "hide-pan-secret"));
+            Assert.False(ZxKit.Holds(data2, "hide-pan-secret-2"));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewSubtypeIndexTests.cs b/DynamicWhere.Tests/Policies/ReviewSubtypeIndexTests.cs
new file mode 100644
index 0000000..f894168
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewSubtypeIndexTests.cs
@@ -0,0 +1,136 @@
+using System.Collections;
+using System.Diagnostics;
+using System.Reflection;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ the subtype index: models
+
+    public class ZvIntBox : ZvBox<int>
+    {
+    }
+
+    public class ZvStringBox : ZvBox<string>
+    {
+    }
+
+    public class ZvMidBox<T> : ZvBox<T>
+    {
+    }
+
+    public class ZvLeafBox : ZvMidBox<int>
+    {
+    }
+
+    /// <summary>An open generic type whose ancestor is closed: it can never be a ZvBox&lt;int&gt;.</summary>
+    public class ZvFixedBox<TOther> : ZvBox<string>
+    {
+        [DwNoGroup]
+        public override string? Code
+        {
+            get => base.Code;
+            set => base.Code = value;
+        }
+    }
+
+    public class ZvDerivedHolder<T> : ZvHolderImpl<T>
+    {
+    }
+
+    /// <summary>The base type a late-loaded assembly derives from; nothing else in this assembly does.</summary>
+    public class ZvLateBase
+    {
+        public int Id { get; set; }
+
+        public virtual string? Code { get; set; }
+    }
+
+    public class ZvJobRow
+    {
+        public int Id { get; set; }
+
+        public string Status { get; set; } = string.Empty;
+
+        public Exception? Error { get; set; }
+    }
+
+    // ============================================================================ the subtype index: tests
+
+    public sealed class ReviewSubtypeIndexTests
+    {
+        private readonly ITestOutputHelper _out;
+
+        public ReviewSubtypeIndexTests(ITestOutputHelper output) => _out = output;
+
+        private static PolicyQueryable<T> Guard<T>(IQueryable<T> source) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = DwTier.Strict, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        private static int Denials(Type type, string path, PolicyFeature feature) =>
+            new AttributePolicyProvider().GetFragments(type, new DwPolicyContext())
+                .Count(f => f.Effect == PolicyEffect.Deny && f.FieldPath == path && (f.Features & feature) != 0);
+
+        // ------------------------------------------------------------------------------------------------ C1
+
+        [Fact]
+        public void Zv_C1_generic_subtypes_are_indexed_under_the_instantiations_they_can_be()
+        {
+            IReadOnlyList<Type> ofIntBox = KnownSubtypes.Of(typeof(ZvBox<int>));
+            IReadOnlyList<Type> ofHolder = KnownSubtypes.Of(typeof(IZvHolder<int>));
+
+            _out.WriteLine("Of(ZvBox<int>): " + string.Join(", ", ofIntBox.Select(t => t.Name)));
+            _out.WriteLine("Of(IZvHolder<int>): " + string.Join(", ", ofHolder.Select(t => t.Name)));
+
+            Assert.Contains(typeof(ZvIntBox), ofIntBox);
+            Assert.Contains(typeof(ZvLeafBox), ofIntBox);
+            Assert.Contains(typeof(ZvSecretBox<>), ofIntBox);
+            Assert.Contains(typeof(ZvMidBox<>), ofIntBox);
+            Assert.DoesNotContain(typeof(ZvStringBox), ofIntBox);
+
+            Assert.Contains(typeof(ZvHolderImpl<>), ofHolder);
+            Assert.Contains(typeof(ZvDerivedHolder<>), ofHolder);
+            Assert.Contains(typeof(ZvGenPlainHolder<>), KnownSubtypes.Of(typeof(IZvPlainHolder)));
+        }
+
+        /// <summary>What the interface map says for an open generic implementation and a closed interface.</summary>
+        [Fact]
+        public void Zv_C1_the_interface_map_of_an_open_generic_implementation_for_a_closed_interface()
+        {
+            Exception? closed = Record.Exception(() => typeof(ZvHolderImpl<>).GetInterfaceMap(typeof(IZvHolder<int>)));
+            Exception? open = Record.Exception(() => typeof(ZvHolderImpl<>).GetInterfaceMap(typeof(ZvHolderImpl<>).GetInterfaces()[0]));
+
+            _out.WriteLine($"GetInterfaceMap(ZvHolderImpl<>, IZvHolder<int>): {closed?.GetType().Name ?? "ok"} {closed?.Message}");
+            _out.WriteLine($"GetInterfaceMap(ZvHolderImpl<>, IZvHolder<T>): {open?.GetType().Name ?? "ok"}");
+
+            Assert.NotNull(closed);
+            Assert.Null(open);
+        }
+
+        /// <summary>
+        /// An open generic type whose ancestor is a different closed instantiation is not a subtype of this one,
+        /// so its override's denial does not reach a path no row of it can be on.
+        /// </summary>
+        [Fact]
+        public void Zv_C1_an_open_generic_type_over_another_closed_instantiation_is_not_its_subtype()
+        {
+            _out.WriteLine("Of(ZvBox<int>) holds ZvFixedBox<>: " + KnownSubtypes.Of(typeof(ZvBox<int>)).Contains(typeof(ZvFixedBox<>)));
+            _out.WriteLine("ZvBox<int>.Code group denials: " + Denials(typeof(ZvBox<int>), "Code", PolicyFeature.Group));
+            _out.WriteLine("ZvBox<string>.Code group denials: " + Denials(typeof(ZvBox<string>), "Code", PolicyFeature.Group));
+
+            // ZvFixedBox<T> derives from ZvBox<string> only; a ZvBox<int> is never one, and a ZvBox<string> can be.
+            Assert.DoesNotContain(typeof(ZvFixedBox<>), KnownSubtypes.Of(typeof(ZvBox<int>)));
+            Assert.Contains(typeof(ZvFixedBox<>), KnownSubtypes.Of(typeof(ZvBox<string>)));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewTrackingKit.cs b/DynamicWhere.Tests/Policies/ReviewTrackingKit.cs
new file mode 100644
index 0000000..bc40cd8
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewTrackingKit.cs
@@ -0,0 +1,201 @@
+using System.Collections;
+using System.Reflection;
+using System.Text.Json;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Exceptions;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Context;
+using DynamicWhere.ex.Policies.DTOs;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Resolution;
+using DynamicWhere.ex.Policies.Source;
+
+namespace DynamicWhere.Tests.Policies
+{
+    /// <summary>Shared helpers for the tracking, variance, converter, shared-name and collection tests.</summary>
+    internal static class ZxKit
+    {
+        internal static PolicyQueryable<T> Guard<T>(IQueryable<T> source, DwTier tier = DwTier.Strict) where T : class =>
+            source.ApplyPolicy(
+                new DwPolicyContext().WithSubject(DwSubjectKind.User, "u1"),
+                new DwPolicyOptions { Tier = tier, Caps = { MinGroupSize = 1 } },
+                new PolicyResolver(new IDwPolicyProvider[] { new AttributePolicyProvider() }));
+
+        internal static Filter Where(string field, string value) => new()
+        {
+            ConditionGroup = new ConditionGroup
+            {
+                Conditions = { new Condition { Sort = 1, Field = field, DataType = DataType.Text, Operator = Operator.Equal, Values = { value } } }
+            }
+        };
+
+        internal static Filter Selecting(params string[] fields) => new() { Selects = fields.ToList() };
+
+        /// <summary>The refusal code, "ran" when it ran, or the other exception.</summary>
+        internal static string Code(Action run)
+        {
+            try
+            {
+                run();
+
+                return "ran";
+            }
+            catch (PolicyException refusal)
+            {
+                return refusal.ErrorCode.ToString();
+            }
+            catch (Exception other)
+            {
+                return $"{other.GetType().Name}: {other.Message.Split('\n')[0]}";
+            }
+        }
+
+        /// <summary>Runs a read; a policy refusal or a core refusal returns null (nothing reached the caller).</summary>
+        internal static object? SafeRead(Func<object?> read)
+        {
+            try
+            {
+                return read();
+            }
+            catch (PolicyException)
+            {
+                return null;
+            }
+            catch (LogicException)
+            {
+                return null;
+            }
+        }
+
+        internal static IEnumerable<PolicyFragment> Denials(Type type, string path) =>
+            new AttributePolicyProvider().GetFragments(type, new DwPolicyContext())
+                .Where(f => f.Effect == PolicyEffect.Deny && string.Equals(f.FieldPath, path, StringComparison.OrdinalIgnoreCase));
+
+        internal static string Trace<T>(PolicyQueryable<T> guarded) where T : class =>
+            string.Join(" | ", guarded.LastTrace?.Decisions
+                .Where(d => d.Action != PolicyAction.Allowed)
+                .Select(d => $"{d.FieldPath} {d.Action}: {d.Reason}") ?? Array.Empty<string>());
+
+        internal static string Json(object? value)
+        {
+            try
+            {
+                return JsonSerializer.Serialize(value, new JsonSerializerOptions
+                {
+                    ReferenceHandler = System.Text.Json.Serialization.ReferenceHandler.IgnoreCycles
+                });
+            }
+            catch (Exception e)
+            {
+                return $"<unserializable: {e.GetType().Name}>";
+            }
+        }
+
+        /// <summary>Everything reachable from a value, read by runtime type (public and non-public properties and fields).</summary>
+        internal static bool Holds(object? value, string text)
+        {
+            HashSet<object> seen = new(ReferenceEqualityComparer.Instance);
+            Stack<object?> pending = new();
+
+            pending.Push(value);
+
+            while (pending.Count > 0)
+            {
+                object? current = pending.Pop();
+
+                if (current is null || current is MemberInfo || current is Delegate
+                    || (current.GetType().Namespace ?? string.Empty).StartsWith("Microsoft.", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                if (current is string held)
+                {
+                    if (held.Contains(text, StringComparison.Ordinal))
+                    {
+                        return true;
+                    }
+
+                    continue;
+                }
+
+                if (current.GetType().IsPrimitive || current is decimal || current is DateTime || current is Guid)
+                {
+                    continue;
+                }
+
+                if (!current.GetType().IsValueType && !seen.Add(current))
+                {
+                    continue;
+                }
+
+                if (current is IDictionary map)
+                {
+                    foreach (DictionaryEntry item in map)
+                    {
+                        pending.Push(item.Key);
+                        pending.Push(item.Value);
+                    }
+                }
+                else if (current is IEnumerable items)
+                {
+                    try
+                    {
+                        foreach (object? item in items)
+                        {
+                            pending.Push(item);
+                        }
+                    }
+                    catch
+                    {
+                        // An enumerator that throws holds nothing readable.
+                    }
+                }
+
+                const BindingFlags all = BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance;
+
+                foreach (PropertyInfo property in current.GetType().GetProperties(all))
+                {
+                    if (property.GetIndexParameters().Length != 0 || !property.CanRead)
+                    {
+                        continue;
+                    }
+
+                    try
+                    {
+                        pending.Push(property.GetValue(current));
+                    }
+                    catch
+                    {
+                        // A getter that throws holds nothing readable.
+                    }
+                }
+
+                for (Type? type = current.GetType(); type is not null && type != typeof(object); type = type.BaseType)
+                {
+                    if (type.Namespace is { } ns && (ns == "System" || ns.StartsWith("System.", StringComparison.Ordinal)
+                                                     || ns.StartsWith("Microsoft.", StringComparison.Ordinal)))
+                    {
+                        continue;
+                    }
+
+                    foreach (FieldInfo field in type.GetFields(all | BindingFlags.DeclaredOnly))
+                    {
+                        try
+                        {
+                            pending.Push(field.GetValue(current));
+                        }
+                        catch
+                        {
+                            // Unreadable.
+                        }
+                    }
+                }
+            }
+
+            return false;
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewTrackingTests.cs b/DynamicWhere.Tests/Policies/ReviewTrackingTests.cs
new file mode 100644
index 0000000..675f963
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewTrackingTests.cs
@@ -0,0 +1,325 @@
+using System.Collections;
+using System.Linq.Expressions;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
+using DynamicWhere.ex.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ reshaped chains and tracking: models
+
+    public class ZxShopper
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZxPayCard> Cards { get; set; } = new();
+    }
+
+    public class ZxPayCard
+    {
+        public int Id { get; set; }
+
+        public int ZxShopperId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZxPurchase
+    {
+        public int Id { get; set; }
+
+        public string Code { get; set; } = string.Empty;
+
+        public int ZxShopperId { get; set; }
+
+        public ZxShopper? Shopper { get; set; }
+    }
+
+    /// <summary>An application helper whose result is only a flag, and which hands the row its cards on the way.</summary>
+    public static class ZxHydrator
+    {
+        public static bool Attach(ZxShopper shopper, List<ZxPayCard> cards)
+        {
+            shopper.Cards = cards;
+
+            return true;
+        }
+    }
+
+    /// <summary>The same, done by a constructor whose object is only read for a flag.</summary>
+    public sealed class ZxAttachment
+    {
+        public ZxAttachment(ZxShopper shopper, List<ZxPayCard> cards) => shopper.Cards = cards;
+
+        public bool Done => true;
+    }
+
+    public class ZxMaskedNote
+    {
+        public int Id { get; set; }
+
+        [DwMask(MaskStrategy.Full)]
+        public string Body { get; set; } = string.Empty;
+    }
+
+    public sealed class ZxShopContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZxShopContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZxShopper> Shoppers => Set<ZxShopper>();
+
+        public DbSet<ZxPayCard> Cards => Set<ZxPayCard>();
+
+        public DbSet<ZxPurchase> Purchases => Set<ZxPurchase>();
+
+        public DbSet<ZxMaskedNote> Notes => Set<ZxMaskedNote>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+    }
+
+    /// <summary>
+    /// A queryable that forwards to another provider, as LinqKit's AsExpandable, DelegateDecompiler's Decompile and
+    /// similar wrappers do over an EF Core query. Its provider is not EF Core's, so EF Core's AsNoTracking leaves it
+    /// unchanged.
+    /// </summary>
+    public sealed class ZxForwardingQuery<T> : IOrderedQueryable<T>
+    {
+        private readonly IQueryable<T> _inner;
+
+        public ZxForwardingQuery(IQueryable<T> inner)
+        {
+            _inner = inner;
+            Provider = new ZxForwardingProvider(inner.Provider);
+        }
+
+        public Type ElementType => typeof(T);
+
+        public Expression Expression => _inner.Expression;
+
+        public IQueryProvider Provider { get; }
+
+        public IEnumerator<T> GetEnumerator() => _inner.GetEnumerator();
+
+        IEnumerator IEnumerable.GetEnumerator() => GetEnumerator();
+    }
+
+    public sealed class ZxForwardingProvider : IQueryProvider
+    {
+        private readonly IQueryProvider _inner;
+
+        public ZxForwardingProvider(IQueryProvider inner) => _inner = inner;
+
+        public IQueryable CreateQuery(Expression expression)
+        {
+            IQueryable created = _inner.CreateQuery(expression);
+
+            return (IQueryable)Activator.CreateInstance(typeof(ZxForwardingQuery<>).MakeGenericType(created.ElementType), created)!;
+        }
+
+        public IQueryable<TElement> CreateQuery<TElement>(Expression expression) =>
+            new ZxForwardingQuery<TElement>(_inner.CreateQuery<TElement>(expression));
+
+        public object? Execute(Expression expression) => _inner.Execute(expression);
+
+        public TResult Execute<TResult>(Expression expression) => _inner.Execute<TResult>(expression);
+    }
+
+    // ============================================================================ reshaped chains and tracking: tests
+
+    public sealed class ReviewTrackingTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZxShopContext _db;
+
+        public ReviewTrackingTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZxShopContext(_connection);
+            _db.Database.EnsureCreated();
+
+            ZxShopper shopper = new() { Name = "S1", Cards = { new ZxPayCard { Label = "visa", Pan = "zx-pan-secret" } } };
+
+            _db.Shoppers.Add(shopper);
+            _db.Purchases.Add(new ZxPurchase { Code = "P1", Shopper = shopper });
+            _db.Notes.Add(new ZxMaskedNote { Body = "original-note-body" });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private (string Unguarded, object? Guarded) Run<T>(string label, IQueryable<T> source, DwTier tier, bool dynamic = false) where T : class
+        {
+            string unguarded;
+
+            try
+            {
+                unguarded = ZxKit.Holds(source.AsNoTracking().ToList(), "zx-pan-secret") ? "HOLDS PAN" : "no pan";
+            }
+            catch (Exception e)
+            {
+                unguarded = $"THREW {e.GetType().Name}: {e.Message.Split('\n')[0]}";
+            }
+
+            PolicyQueryable<T> guarded = ZxKit.Guard(source, tier);
+            object? data;
+
+            try
+            {
+                data = dynamic ? guarded.ToListDynamic(new Filter()).Data : guarded.ToList(new Filter()).Data;
+            }
+            catch (Exception e)
+            {
+                data = null;
+                _out.WriteLine($"{label}: guarded threw {e.GetType().Name}: {e.Message.Split('\n')[0]}");
+            }
+
+            RowShape shape = RowShape.Of(source);
+
+            _out.WriteLine($"{label} {tier}: shape={shape.Kind} materializes(Cards.Pan)={shape.Materializes("Cards.Pan")} "
+                           + $"reshapes={QueryRoot.Reshapes(source.Expression)} builds={QueryRoot.Builds(source.Expression)}");
+            _out.WriteLine($"{label} {tier}: unguarded={unguarded}");
+            _out.WriteLine($"{label} {tier}: guarded={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            return (unguarded, data);
+        }
+
+        // ------------------------------------------------------------------------ B1: a flag-typed subtree that hands the row its cards
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_B1_an_application_method_read_only_for_a_flag_in_a_conditional(DwTier tier)
+        {
+            IQueryable<ZxShopper> source = _db.Purchases
+                .Select(p => ZxHydrator.Attach(p.Shopper!, p.Shopper!.Cards.ToList()) ? p.Shopper! : p.Shopper!);
+
+            (string unguarded, object? guarded) = Run("B1", source, tier);
+
+            if (!unguarded.StartsWith("HOLDS", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Assert.False(ZxKit.Holds(guarded, "zx-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_B2_a_constructor_read_only_for_a_flag_in_a_conditional(DwTier tier)
+        {
+            IQueryable<ZxShopper> source = _db.Purchases
+                .Select(p => new ZxAttachment(p.Shopper!, p.Shopper!.Cards.ToList()).Done ? p.Shopper! : p.Shopper!);
+
+            (string unguarded, object? guarded) = Run("B2", source, tier);
+
+            if (!unguarded.StartsWith("HOLDS", StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            Assert.False(ZxKit.Holds(guarded, "zx-pan-secret"));
+        }
+
+        // ------------------------------------------------------------------------ T: a provider that wraps EF Core runs a tracking query
+
+        [Theory]
+        [InlineData(DwTier.Strict, false)]
+        [InlineData(DwTier.Convenience, false)]
+        [InlineData(DwTier.Strict, true)]
+        public void Zx_T1_a_wrapped_query_over_a_context_that_already_tracks_the_cards(DwTier tier, bool dynamic)
+        {
+            // Earlier in the same unit of work, the application read the cards with tracking.
+            _ = _db.Cards.ToList();
+
+            IQueryable<ZxShopper> source = new ZxForwardingQuery<ZxShopper>(_db.Shoppers);
+
+            (_, object? guarded) = Run("T1", source, tier, dynamic);
+
+            Assert.False(ZxKit.Holds(guarded, "zx-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_T2_a_wrapped_query_over_a_context_that_already_tracks_the_shopper_with_its_cards(DwTier tier)
+        {
+            _ = _db.Shoppers.Include(s => s.Cards).ToList();
+
+            IQueryable<ZxShopper> source = new ZxForwardingQuery<ZxShopper>(_db.Shoppers);
+
+            (_, object? guarded) = Run("T2", source, tier);
+
+            Assert.False(ZxKit.Holds(guarded, "zx-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_T3_control_the_same_query_unwrapped(DwTier tier)
+        {
+            _ = _db.Cards.ToList();
+
+            (_, object? guarded) = Run("T3", _db.Shoppers, tier);
+
+            Assert.False(ZxKit.Holds(guarded, "zx-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_T4_a_wrapped_reshaped_query_over_tracked_cards(DwTier tier)
+        {
+            _ = _db.Cards.ToList();
+
+            IQueryable<ZxShopper> source = new ZxForwardingQuery<ZxPurchase>(_db.Purchases).Select(p => p.Shopper!);
+
+            (_, object? guarded) = Run("T4", source, tier);
+
+            Assert.False(ZxKit.Holds(guarded, "zx-pan-secret"));
+        }
+
+        /// <summary>
+        /// Guarded() detaches the query so that a transform applied to a materialized entity is never written back.
+        /// Through a wrapping provider the query tracks, and the masked value is the entity's pending state.
+        /// </summary>
+        [Fact]
+        public void Zx_T5_a_wrapped_query_leaves_a_masked_value_as_a_pending_change()
+        {
+            IQueryable<ZxMaskedNote> source = new ZxForwardingQuery<ZxMaskedNote>(_db.Notes);
+
+            object? data = ZxKit.Guard(source).ToList(new Filter()).Data;
+
+            _out.WriteLine($"sent={ZxKit.Json(data)} tracked={_db.ChangeTracker.Entries().Count()} hasChanges={_db.ChangeTracker.HasChanges()}");
+
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+
+            string stored = _db.Notes.AsNoTracking().Single().Body;
+
+            _out.WriteLine($"stored after SaveChanges: {stored}");
+
+            Assert.Equal("original-note-body", stored);
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewTrackingWrapperTests.cs b/DynamicWhere.Tests/Policies/ReviewTrackingWrapperTests.cs
new file mode 100644
index 0000000..301ac80
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewTrackingWrapperTests.cs
@@ -0,0 +1,332 @@
+using System.Collections;
+using System.Linq.Expressions;
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Query;
+using Xunit.Abstractions;
+
+// A guarded query through a provider wrapping EF Core's runs untracked: AsNoTracking goes into the query itself.
+
+namespace DynamicWhere.Tests.Policies
+{
+    public class ZwShopper
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public List<ZwPayCard> Cards { get; set; } = new();
+    }
+
+    public class ZwPayCard
+    {
+        public int Id { get; set; }
+
+        public int ZwShopperId { get; set; }
+
+        public string Label { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Pan { get; set; }
+    }
+
+    public class ZwNote
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = string.Empty;
+
+        [DwMask(MaskStrategy.Full)]
+        public string Body { get; set; } = string.Empty;
+    }
+
+    public sealed class ZwShopContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZwShopContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZwShopper> Shoppers => Set<ZwShopper>();
+
+        public DbSet<ZwPayCard> Cards => Set<ZwPayCard>();
+
+        public DbSet<ZwNote> Notes => Set<ZwNote>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+    }
+
+    /// <summary>A wrapper that forwards to EF Core's provider, async included, as LinqKit's EF Core build does.</summary>
+    public sealed class ZwAsyncQuery<T> : IOrderedQueryable<T>, IAsyncEnumerable<T>
+    {
+        private readonly IQueryable<T> _inner;
+
+        public ZwAsyncQuery(IQueryable<T> inner)
+        {
+            _inner = inner;
+            Provider = new ZwAsyncProvider(inner.Provider);
+        }
+
+        public Type ElementType => typeof(T);
+
+        public Expression Expression => _inner.Expression;
+
+        public IQueryProvider Provider { get; }
+
+        public IEnumerator<T> GetEnumerator() => _inner.GetEnumerator();
+
+        IEnumerator IEnumerable.GetEnumerator() => GetEnumerator();
+
+        public IAsyncEnumerator<T> GetAsyncEnumerator(CancellationToken cancellationToken = default) =>
+            ((IAsyncEnumerable<T>)_inner).GetAsyncEnumerator(cancellationToken);
+    }
+
+    public sealed class ZwAsyncProvider : IAsyncQueryProvider
+    {
+        private readonly IQueryProvider _inner;
+
+        public ZwAsyncProvider(IQueryProvider inner) => _inner = inner;
+
+        public IQueryable CreateQuery(Expression expression)
+        {
+            IQueryable created = _inner.CreateQuery(expression);
+
+            return (IQueryable)Activator.CreateInstance(typeof(ZwAsyncQuery<>).MakeGenericType(created.ElementType), created)!;
+        }
+
+        public IQueryable<TElement> CreateQuery<TElement>(Expression expression) =>
+            new ZwAsyncQuery<TElement>(_inner.CreateQuery<TElement>(expression));
+
+        public object? Execute(Expression expression) => _inner.Execute(expression);
+
+        public TResult Execute<TResult>(Expression expression) => _inner.Execute<TResult>(expression);
+
+        public TResult ExecuteAsync<TResult>(Expression expression, CancellationToken cancellationToken = default) =>
+            ((IAsyncQueryProvider)_inner).ExecuteAsync<TResult>(expression, cancellationToken);
+    }
+
+    /// <summary>
+    /// A wrapper whose expression is a constant of itself, which its provider swaps for the inner query's before
+    /// handing it on: the EF Core root is not in the tree the guard reads.
+    /// </summary>
+    public sealed class ZwConstantRootQuery<T> : IOrderedQueryable<T>
+    {
+        public ZwConstantRootQuery(IQueryable<T> inner, Expression? expression = null)
+        {
+            Inner = inner;
+            Expression = expression ?? Expression.Constant(this);
+            Provider = new ZwConstantRootProvider<T>(this);
+        }
+
+        internal IQueryable<T> Inner { get; }
+
+        public Type ElementType => typeof(T);
+
+        public Expression Expression { get; }
+
+        public IQueryProvider Provider { get; }
+
+        public IEnumerator<T> GetEnumerator() =>
+            Inner.Provider.CreateQuery<T>(ZwConstantRootProvider<T>.Unwrap(Expression)).GetEnumerator();
+
+        IEnumerator IEnumerable.GetEnumerator() => GetEnumerator();
+    }
+
+    public sealed class ZwConstantRootProvider<TRoot> : IQueryProvider
+    {
+        private readonly ZwConstantRootQuery<TRoot> _root;
+
+        public ZwConstantRootProvider(ZwConstantRootQuery<TRoot> root) => _root = root;
+
+        internal static Expression Unwrap(Expression expression) => new Swap().Visit(expression);
+
+        private sealed class Swap : ExpressionVisitor
+        {
+            protected override Expression VisitConstant(ConstantExpression node) =>
+                node.Value is ZwConstantRootQuery<TRoot> query ? query.Inner.Expression : node;
+        }
+
+        public IQueryable CreateQuery(Expression expression) =>
+            (IQueryable)Activator.CreateInstance(
+                typeof(ZwConstantRootQuery<>).MakeGenericType(expression.Type.GetGenericArguments()[0]),
+                _root.Inner.Provider.CreateQuery(Unwrap(expression)), expression)!;
+
+        public IQueryable<TElement> CreateQuery<TElement>(Expression expression) =>
+            (IQueryable<TElement>)CreateQuery(expression);
+
+        public object? Execute(Expression expression) => _root.Inner.Provider.Execute(Unwrap(expression));
+
+        public TResult Execute<TResult>(Expression expression) => _root.Inner.Provider.Execute<TResult>(Unwrap(expression));
+    }
+
+    public sealed class ReviewTrackingWrapperTests : IDisposable
+    {
+        private const string Secret = "zw-shop-pan-secret";
+
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZwShopContext _db;
+
+        public ReviewTrackingWrapperTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZwShopContext(_connection);
+            _db.Database.EnsureCreated();
+
+            _db.Shoppers.Add(new ZwShopper { Name = "S1", Cards = { new ZwPayCard { Label = "visa", Pan = Secret } } });
+            _db.Shoppers.Add(new ZwShopper { Name = "S2" });
+            _db.Notes.Add(new ZwNote { Title = "t1", Body = "original-note-body" });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        private static Segment Union() => new()
+        {
+            ConditionSets =
+            {
+                new ConditionSet
+                {
+                    Sort = 1,
+                    ConditionGroup = new ConditionGroup
+                    {
+                        Conditions = { new Condition { Sort = 1, Field = "Name", DataType = DataType.Text, Operator = Operator.Equal, Values = { "S1" } } }
+                    }
+                },
+                new ConditionSet
+                {
+                    Sort = 2,
+                    Intersection = Intersection.Union,
+                    ConditionGroup = new ConditionGroup
+                    {
+                        Conditions = { new Condition { Sort = 1, Field = "Name", DataType = DataType.Text, Operator = Operator.Equal, Values = { "S2" } } }
+                    }
+                }
+            }
+        };
+
+        private static Summary CountByName() => new()
+        {
+            GroupBy = new GroupBy
+            {
+                Fields = new List<string> { "Name" },
+                AggregateBy = new List<AggregateBy> { new() { Alias = "Total", Aggregator = Aggregator.Count } }
+            }
+        };
+
+        // ------------------------------------------------------------------ W: a wrapper with async support
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public async Task Zw_W1_async_reads_through_a_wrapper_over_a_context_tracking_the_cards(DwTier tier)
+        {
+            _ = _db.Cards.ToList();
+            int before = _db.ChangeTracker.Entries().Count();
+
+            IQueryable<ZwShopper> source = new ZwAsyncQuery<ZwShopper>(_db.Shoppers);
+
+            object? data = null;
+            string code = ZwKit.Code(() => data = ZwKit.Guard(source, tier).ToListAsync(new Filter()).GetAwaiter().GetResult().Data);
+            string async = ZwKit.Code(() => ZwKit.Guard(source, tier).ToListAsyncDynamic(new Filter()).GetAwaiter().GetResult());
+            string segment = ZwKit.Code(() => ZwKit.Guard(source, tier).ToListAsync(Union()).GetAwaiter().GetResult());
+            string summary = ZwKit.Code(() => ZwKit.Guard(source, tier).ToListAsync(CountByName()).GetAwaiter().GetResult());
+            int after = _db.ChangeTracker.Entries().Count();
+
+            _out.WriteLine($"W1 {tier}: list={code} dynamic={async} segment={segment} summary={summary} tracked {before}->{after} sent={ZwKit.Json(data)}");
+
+            Assert.Equal("ran", code);
+            Assert.Equal("ran", async);
+            Assert.Equal("ran", segment);
+            Assert.Equal("ran", summary);
+            Assert.False(ZwKit.Holds(data, Secret));
+        }
+
+        [Fact]
+        public async Task Zw_W2_a_masked_value_read_async_through_a_wrapper_is_never_a_pending_change()
+        {
+            IQueryable<ZwNote> source = new ZwAsyncQuery<ZwNote>(_db.Notes);
+
+            object? data = (await ZwKit.Guard(source).ToListAsync(new Filter())).Data;
+
+            _out.WriteLine($"W2 sent={ZwKit.Json(data)} tracked={_db.ChangeTracker.Entries().Count()} changes={_db.ChangeTracker.HasChanges()}");
+
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+
+            Assert.Equal("original-note-body", _db.Notes.AsNoTracking().Single().Body);
+        }
+
+        [Fact]
+        public async Task Zw_W3_a_masked_value_read_through_a_wrapped_segment_is_never_a_pending_change()
+        {
+            IQueryable<ZwNote> source = new ZwAsyncQuery<ZwNote>(_db.Notes);
+
+            Segment segment = new()
+            {
+                ConditionSets =
+                {
+                    new ConditionSet
+                    {
+                        Sort = 1,
+                        ConditionGroup = new ConditionGroup
+                        {
+                            Conditions = { new Condition { Sort = 1, Field = "Title", DataType = DataType.Text, Operator = Operator.Equal, Values = { "t1" } } }
+                        }
+                    }
+                }
+            };
+
+            object? data = (await ZwKit.Guard(source).ToListAsync(segment)).Data;
+
+            _out.WriteLine($"W3 sent={ZwKit.Json(data)} tracked={_db.ChangeTracker.Entries().Count()} changes={_db.ChangeTracker.HasChanges()}");
+
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+
+            Assert.Equal("original-note-body", _db.Notes.AsNoTracking().Single().Body);
+        }
+
+        [Fact]
+        public void Zw_W4_the_callers_AsTracking_inside_a_wrapper_does_not_outlive_the_guard()
+        {
+            _ = _db.Cards.ToList();
+
+            IQueryable<ZwShopper> source = new ZwAsyncQuery<ZwShopper>(_db.Shoppers.AsTracking());
+            object? data = ZwKit.SafeRead(() => ZwKit.Guard(source).ToList(new Filter()).Data);
+
+            _out.WriteLine($"W4 sent={ZwKit.Json(data)} tracked={_db.ChangeTracker.Entries().Count()}");
+
+            Assert.False(ZwKit.Holds(data, Secret));
+        }
+
+        // ------------------------------------------------------------------ C: a wrapper whose root the guard cannot see
+
+        [Fact]
+        public void Zw_C2_shoppers_through_a_wrapper_whose_expression_is_a_constant_of_itself()
+        {
+            _ = _db.Cards.ToList();
+
+            IQueryable<ZwShopper> source = new ZwConstantRootQuery<ZwShopper>(_db.Shoppers);
+
+            object? data = null;
+            string code = ZwKit.Code(() => data = ZwKit.Guard(source).ToList(new Filter()).Data);
+
+            _out.WriteLine($"C2 code={code} sent={ZwKit.Json(data)} tracked={_db.ChangeTracker.Entries().Count()}");
+
+            Assert.False(ZwKit.Holds(data, Secret));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/Policies/ReviewVarianceTests.cs b/DynamicWhere.Tests/Policies/ReviewVarianceTests.cs
new file mode 100644
index 0000000..3ca4eca
--- /dev/null
+++ b/DynamicWhere.Tests/Policies/ReviewVarianceTests.cs
@@ -0,0 +1,356 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Classes.Core;
+using DynamicWhere.ex.Enums;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Config;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests.Policies
+{
+    // ============================================================================ variant generic interfaces: models
+
+    public class ZxBaseCard
+    {
+        public string Label { get; set; } = string.Empty;
+    }
+
+    public class ZxDerivedCard : ZxBaseCard
+    {
+        public string Tier { get; set; } = string.Empty;
+    }
+
+    // ---- covariant, implemented only by an open generic class over a closed subtype argument -------------------
+
+    /// <summary>A covariant interface: an IZxOpenVar&lt;ZxDerivedCard&gt; is an IZxOpenVar&lt;ZxBaseCard&gt;.</summary>
+    public interface IZxOpenVar<out T>
+    {
+        T Value { get; }
+
+        string? Code { get; }
+    }
+
+    /// <summary>Every instantiation of this class is an IZxOpenVar&lt;ZxBaseCard&gt; through covariance.</summary>
+    public class ZxOpenVarImpl<TTag> : IZxOpenVar<ZxDerivedCard>
+    {
+        public ZxDerivedCard Value { get; set; } = new();
+
+        [DwDenied]
+        public string? Code { get; set; }
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    public class ZxOpenVarRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public IZxOpenVar<ZxBaseCard>? Tagged { get; set; }
+    }
+
+    // ---- covariant, implemented only by a CLOSED class over a subtype argument ----
+
+    public interface IZxClosedVar<out T>
+    {
+        T Value { get; }
+
+        string? Code { get; }
+    }
+
+    public class ZxClosedVarImpl : IZxClosedVar<ZxDerivedCard>
+    {
+        public ZxDerivedCard Value { get; set; } = new();
+
+        [DwDenied]
+        public string? Code { get; set; }
+
+        [DwDenied]
+        public string? Secret { get; set; }
+    }
+
+    public class ZxClosedVarRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public IZxClosedVar<ZxBaseCard>? Tagged { get; set; }
+    }
+
+    // ---- contravariant, implemented by a closed class over a BASE argument ----
+
+    public interface IZxSink<in T>
+    {
+        string? Code { get; }
+
+        void Accept(T item);
+    }
+
+    public class ZxBaseSink : IZxSink<ZxBaseCard>
+    {
+        [DwDenied]
+        public string? Code { get; set; }
+
+        public void Accept(ZxBaseCard item)
+        {
+        }
+    }
+
+    public class ZxSinkRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public IZxSink<ZxDerivedCard>? Sink { get; set; }
+    }
+
+    // ---- controls: the member typed as the exact instantiation implemented ----
+
+    public class ZxExactOpenRow
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = string.Empty;
+
+        public IZxOpenVar<ZxDerivedCard>? Tagged { get; set; }
+    }
+
+    // ============================================================================ variant generic interfaces: tests
+
+    /// <summary>
+    /// A member typed as a variant interface holds implementations of other instantiations, which the subtype index
+    /// and the walker read as the runtime assigns them, covariant and contravariant alike.
+    /// </summary>
+    public sealed class ReviewVarianceTests
+    {
+        private readonly ITestOutputHelper _out;
+
+        public ReviewVarianceTests(ITestOutputHelper output) => _out = output;
+
+        private static Summary GroupedBy(string field) => new()
+        {
+            GroupBy = new GroupBy
+            {
+                Fields = new List<string> { field },
+                AggregateBy = new List<AggregateBy> { new() { Alias = "Total", Aggregator = Aggregator.Count } }
+            }
+        };
+
+        private void Report(string label, Type type)
+        {
+            _out.WriteLine($"{label}: Of({type.Name}<{type.GetGenericArguments()[0].Name}>) = "
+                           + string.Join(", ", KnownSubtypes.Of(type).Select(t => t.Name)));
+        }
+
+        [Fact]
+        public void Zx_V0_the_types_are_assignable_through_variance()
+        {
+            Assert.True(typeof(IZxOpenVar<ZxBaseCard>).IsAssignableFrom(typeof(ZxOpenVarImpl<int>)));
+            Assert.True(typeof(IZxClosedVar<ZxBaseCard>).IsAssignableFrom(typeof(ZxClosedVarImpl)));
+            Assert.True(typeof(IZxSink<ZxDerivedCard>).IsAssignableFrom(typeof(ZxBaseSink)));
+
+            Exception? map = Record.Exception(() => typeof(ZxOpenVarImpl<>).GetInterfaceMap(typeof(IZxOpenVar<ZxBaseCard>)));
+            Exception? closedMap = Record.Exception(() => typeof(ZxClosedVarImpl).GetInterfaceMap(typeof(IZxClosedVar<ZxBaseCard>)));
+
+            _out.WriteLine($"GetInterfaceMap(ZxOpenVarImpl<>, IZxOpenVar<ZxBaseCard>): {map?.GetType().Name ?? "ok"}");
+            _out.WriteLine($"GetInterfaceMap(ZxClosedVarImpl, IZxClosedVar<ZxBaseCard>): {closedMap?.GetType().Name ?? "ok"}");
+        }
+
+        // ------------------------------------------------------------------------ the subtype index
+
+        [Fact]
+        public void Zx_V1_open_the_index_lists_an_open_generic_implementation_over_a_subtype_argument()
+        {
+            Report("open", typeof(IZxOpenVar<ZxBaseCard>));
+
+            Assert.Contains(typeof(ZxOpenVarImpl<>), KnownSubtypes.Of(typeof(IZxOpenVar<ZxBaseCard>)));
+        }
+
+        [Fact]
+        public void Zx_V1_closed_the_index_lists_a_closed_implementation_over_a_subtype_argument()
+        {
+            Report("closed", typeof(IZxClosedVar<ZxBaseCard>));
+
+            Assert.Contains(typeof(ZxClosedVarImpl), KnownSubtypes.Of(typeof(IZxClosedVar<ZxBaseCard>)));
+        }
+
+        [Fact]
+        public void Zx_V1_contra_the_index_lists_a_contravariant_implementation()
+        {
+            Report("contra", typeof(IZxSink<ZxDerivedCard>));
+
+            Assert.Contains(typeof(ZxBaseSink), KnownSubtypes.Of(typeof(IZxSink<ZxDerivedCard>)));
+        }
+
+        // ------------------------------------------------------------------------ the walker's fragment on the path
+
+        [Fact]
+        public void Zx_V2_control_the_exact_instantiation_carries_the_implementations_denial()
+        {
+            Assert.NotEmpty(ZxKit.Denials(typeof(ZxExactOpenRow), "Tagged.Code"));
+        }
+
+        [Fact]
+        public void Zx_V2_open_the_covariant_path_carries_the_implementations_denial()
+        {
+            _out.WriteLine("open Tagged.Code denials: " + ZxKit.Denials(typeof(ZxOpenVarRow), "Tagged.Code").Count());
+
+            Assert.NotEmpty(ZxKit.Denials(typeof(ZxOpenVarRow), "Tagged.Code"));
+        }
+
+        [Fact]
+        public void Zx_V2_closed_the_covariant_path_carries_the_implementations_denial()
+        {
+            _out.WriteLine("closed Tagged.Code denials: " + ZxKit.Denials(typeof(ZxClosedVarRow), "Tagged.Code").Count());
+
+            Assert.NotEmpty(ZxKit.Denials(typeof(ZxClosedVarRow), "Tagged.Code"));
+        }
+
+        [Fact]
+        public void Zx_V2_contra_the_contravariant_path_carries_the_implementations_denial()
+        {
+            _out.WriteLine("contra Sink.Code denials: " + ZxKit.Denials(typeof(ZxSinkRow), "Sink.Code").Count());
+
+            Assert.NotEmpty(ZxKit.Denials(typeof(ZxSinkRow), "Sink.Code"));
+        }
+
+        // ------------------------------------------------------------------------ where, group, order on the denied path
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_V3_open_where_group_and_order_on_the_denied_code_are_refused(DwTier tier)
+        {
+            ZxOpenVarRow[] rows = { new() { Id = 1, Name = "r1", Tagged = new ZxOpenVarImpl<int> { Code = "open-code-secret" } } };
+
+            string where = ZxKit.Code(() => ZxKit.Guard(rows.AsQueryable(), tier).ToList(ZxKit.Where("Tagged.Code", "open-code-secret")));
+            object? grouped = null;
+            string group = ZxKit.Code(() => grouped = ZxKit.Guard(rows.AsQueryable(), tier).ToList(GroupedBy("Tagged.Code")).Data);
+            string order = ZxKit.Code(() => ZxKit.Guard(rows.AsQueryable(), tier).ToList(new Filter
+            {
+                Orders = new List<OrderBy> { new() { Field = "Tagged.Code" } }, Selects = new List<string> { "Id" }
+            }));
+
+            _out.WriteLine($"open {tier}: where={where} group={group} ({ZxKit.Json(grouped)}) order={order}");
+
+            Assert.NotEqual("ran", where);
+            Assert.NotEqual("ran", group);
+
+            if (tier == DwTier.Strict)
+            {
+                Assert.NotEqual("ran", order);
+            }
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_V3_closed_where_group_and_order_on_the_denied_code_are_refused(DwTier tier)
+        {
+            ZxClosedVarRow[] rows = { new() { Id = 1, Name = "r1", Tagged = new ZxClosedVarImpl { Code = "closed-code-secret" } } };
+
+            string where = ZxKit.Code(() => ZxKit.Guard(rows.AsQueryable(), tier).ToList(ZxKit.Where("Tagged.Code", "closed-code-secret")));
+            object? grouped = null;
+            string group = ZxKit.Code(() => grouped = ZxKit.Guard(rows.AsQueryable(), tier).ToList(GroupedBy("Tagged.Code")).Data);
+
+            _out.WriteLine($"closed {tier}: where={where} group={group} ({ZxKit.Json(grouped)})");
+
+            Assert.NotEqual("ran", where);
+            Assert.NotEqual("ran", group);
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_V3_contra_where_on_the_denied_code_is_refused(DwTier tier)
+        {
+            ZxSinkRow[] rows = { new() { Id = 1, Name = "r1", Sink = new ZxBaseSink { Code = "contra-code-secret" } } };
+
+            string where = ZxKit.Code(() => ZxKit.Guard(rows.AsQueryable(), tier).ToList(ZxKit.Where("Sink.Code", "contra-code-secret")));
+
+            _out.WriteLine($"contra {tier}: where={where}");
+
+            Assert.NotEqual("ran", where);
+        }
+
+        // ------------------------------------------------------------------------ rows returned with no projection asked for
+
+        [Theory]
+        [InlineData(DwTier.Strict, false)]
+        [InlineData(DwTier.Convenience, false)]
+        [InlineData(DwTier.Strict, true)]
+        public void Zx_V4_open_rows_do_not_return_the_implementations_denied_members(DwTier tier, bool dynamic)
+        {
+            ZxOpenVarRow[] rows =
+            {
+                new() { Id = 1, Name = "r1", Tagged = new ZxOpenVarImpl<int> { Code = "open-code-secret", Secret = "open-own-secret" } }
+            };
+
+            PolicyQueryable<ZxOpenVarRow> guarded = ZxKit.Guard(rows.AsQueryable(), tier);
+            object? data = ZxKit.SafeRead(() => dynamic ? guarded.ToListDynamic(new Filter()).Data : guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"open {tier} dynamic={dynamic}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "open-code-secret"));
+            Assert.False(ZxKit.Holds(data, "open-own-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_V4_closed_rows_do_not_return_the_implementations_denied_members(DwTier tier)
+        {
+            ZxClosedVarRow[] rows =
+            {
+                new() { Id = 1, Name = "r1", Tagged = new ZxClosedVarImpl { Code = "closed-code-secret", Secret = "closed-own-secret" } }
+            };
+
+            PolicyQueryable<ZxClosedVarRow> guarded = ZxKit.Guard(rows.AsQueryable(), tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"closed {tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "closed-code-secret"));
+            Assert.False(ZxKit.Holds(data, "closed-own-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_V4_contra_rows_do_not_return_the_implementations_denied_members(DwTier tier)
+        {
+            ZxSinkRow[] rows = { new() { Id = 1, Name = "r1", Sink = new ZxBaseSink { Code = "contra-code-secret" } } };
+
+            PolicyQueryable<ZxSinkRow> guarded = ZxKit.Guard(rows.AsQueryable(), tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"contra {tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "contra-code-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_V4_control_rows_typed_as_the_exact_instantiation(DwTier tier)
+        {
+            ZxExactOpenRow[] rows =
+            {
+                new() { Id = 1, Name = "r1", Tagged = new ZxOpenVarImpl<int> { Code = "exact-code-secret", Secret = "exact-own-secret" } }
+            };
+
+            PolicyQueryable<ZxExactOpenRow> guarded = ZxKit.Guard(rows.AsQueryable(), tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"exact {tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "exact-code-secret"));
+            Assert.False(ZxKit.Holds(data, "exact-own-secret"));
+        }
+    }
+}
diff --git a/DynamicWhere.Tests/ReviewComplexPropertyTests.cs b/DynamicWhere.Tests/ReviewComplexPropertyTests.cs
new file mode 100644
index 0000000..7f6f521
--- /dev/null
+++ b/DynamicWhere.Tests/ReviewComplexPropertyTests.cs
@@ -0,0 +1,199 @@
+using DynamicWhere.ex.Classes.Complex;
+using DynamicWhere.ex.Policies.Attributes;
+using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
+using DynamicWhere.Tests.Policies;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Xunit.Abstractions;
+
+namespace DynamicWhere.Tests
+{
+    // EF Core 8 only (complex types, JSON columns): kept at the test project's root so the EF Core 6 floor leg,
+    // which compiles Policies/** only, leaves it out.
+
+    // ============================================================================ a converted member inside a complex or JSON type: models
+
+    public class ZxComplexMeta
+    {
+        public string Tag { get; set; } = string.Empty;
+
+        public object? Payload { get; set; }
+    }
+
+    public class ZxComplexEvent
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Actor { get; set; }
+
+        public ZxComplexMeta Meta { get; set; } = new();
+    }
+
+    public class ZxJsonMeta
+    {
+        public string Tag { get; set; } = string.Empty;
+
+        public object? Payload { get; set; }
+    }
+
+    public class ZxJsonEvent
+    {
+        public int Id { get; set; }
+
+        public string Kind { get; set; } = string.Empty;
+
+        [DwDenied]
+        public string? Actor { get; set; }
+
+        public ZxJsonMeta? Meta { get; set; }
+    }
+
+    public sealed class ZxComplexContext : DbContext
+    {
+        private readonly SqliteConnection _connection;
+
+        public ZxComplexContext(SqliteConnection connection) => _connection = connection;
+
+        public DbSet<ZxComplexEvent> ComplexEvents => Set<ZxComplexEvent>();
+
+        public DbSet<ZxJsonEvent> JsonEvents => Set<ZxJsonEvent>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder options) => options.UseSqlite(_connection);
+
+        protected override void OnModelCreating(ModelBuilder model)
+        {
+            model.Entity<ZxComplexEvent>().ComplexProperty(e => e.Meta, meta => meta.Property(m => m.Payload).HasConversion(new ZxPayloadConverter()));
+            model.Entity<ZxJsonEvent>().OwnsOne(e => e.Meta, meta =>
+            {
+                meta.ToJson();
+                meta.Property(m => m.Payload).HasConversion(new ZxPayloadConverter());
+            });
+        }
+    }
+
+    // ============================================================================ a converted member inside a complex or JSON type: tests
+
+    /// <summary>
+    /// RowShape.Converted asks the entity type for the column. A complex property is read whole as its CLR type, and
+    /// the converter on the member inside it is never asked about.
+    /// </summary>
+    public sealed class ReviewComplexPropertyTests : IDisposable
+    {
+        private readonly ITestOutputHelper _out;
+        private readonly SqliteConnection _connection;
+        private readonly ZxComplexContext _db;
+
+        public ReviewComplexPropertyTests(ITestOutputHelper output)
+        {
+            _out = output;
+            _connection = new SqliteConnection("DataSource=:memory:");
+            _connection.Open();
+            _db = new ZxComplexContext(_connection);
+            _db.Database.EnsureCreated();
+            _db.ComplexEvents.Add(new ZxComplexEvent
+            {
+                Kind = "CardIssued", Actor = "complex-actor-secret",
+                Meta = new ZxComplexMeta { Tag = "t", Payload = new ZxIssued { Label = "visa", Pan = "complex-pan-secret" } }
+            });
+            _db.JsonEvents.Add(new ZxJsonEvent
+            {
+                Kind = "CardIssued", Actor = "json-actor-secret",
+                Meta = new ZxJsonMeta { Tag = "t", Payload = new ZxIssued { Label = "visa", Pan = "json-pan-secret" } }
+            });
+            _db.SaveChanges();
+            _db.ChangeTracker.Clear();
+        }
+
+        public void Dispose()
+        {
+            _db.Dispose();
+            _connection.Dispose();
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_C2_a_converted_object_member_inside_a_complex_property_beside_a_top_level_denial(DwTier tier)
+        {
+            Assert.True(ZxKit.Holds(_db.ComplexEvents.AsNoTracking().ToList(), "complex-pan-secret"));
+
+            PolicyQueryable<ZxComplexEvent> guarded = ZxKit.Guard(_db.ComplexEvents, tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"{tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "complex-actor-secret"));
+            Assert.False(ZxKit.Holds(data, "complex-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_C2_dynamic_a_converted_object_member_inside_a_complex_property(DwTier tier)
+        {
+            PolicyQueryable<ZxComplexEvent> guarded = ZxKit.Guard(_db.ComplexEvents, tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToListDynamic(new Filter()).Data);
+
+            _out.WriteLine($"{tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "complex-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public void Zx_C3_a_converted_object_member_inside_a_json_owned_type_beside_a_top_level_denial(DwTier tier)
+        {
+            List<ZxJsonEvent> raw;
+
+            try
+            {
+                raw = _db.JsonEvents.AsNoTracking().ToList();
+            }
+            catch (Exception e)
+            {
+                _out.WriteLine($"unguarded threw: {e.GetType().Name}: {e.Message.Split('\n')[0]}");
+
+                return;
+            }
+
+            _out.WriteLine("unguarded holds pan: " + ZxKit.Holds(raw, "json-pan-secret"));
+
+            PolicyQueryable<ZxJsonEvent> guarded = ZxKit.Guard(_db.JsonEvents, tier);
+            object? data = ZxKit.SafeRead(() => guarded.ToList(new Filter()).Data);
+
+            _out.WriteLine($"{tier}: sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "json-actor-secret"));
+            Assert.False(ZxKit.Holds(data, "json-pan-secret"));
+        }
+
+        [Theory]
+        [InlineData(DwTier.Strict)]
+        [InlineData(DwTier.Convenience)]
+        public async Task Zx_C2_segment_a_converted_object_member_inside_a_complex_property(DwTier tier)
+        {
+            PolicyQueryable<ZxComplexEvent> guarded = ZxKit.Guard(_db.ComplexEvents, tier);
+            object? data;
+
+            try
+            {
+                data = (await guarded.ToListAsync(new Segment())).Data;
+            }
+            catch (Exception e)
+            {
+                _out.WriteLine($"{tier}: segment threw {e.GetType().Name}: {e.Message.Split('\n')[0]}");
+
+                return;
+            }
+
+            _out.WriteLine($"{tier}: segment sent={ZxKit.Json(data)} trace=[{ZxKit.Trace(guarded)}]");
+
+            Assert.False(ZxKit.Holds(data, "complex-pan-secret"));
+        }
+    }
+}
diff --git a/DynamicWhere.ex.Policies.AspNetCore/DynamicWhere.ex.Policies.AspNetCore.csproj b/DynamicWhere.ex.Policies.AspNetCore/DynamicWhere.ex.Policies.AspNetCore.csproj
index b97432c..78ce335 100644
--- a/DynamicWhere.ex.Policies.AspNetCore/DynamicWhere.ex.Policies.AspNetCore.csproj
+++ b/DynamicWhere.ex.Policies.AspNetCore/DynamicWhere.ex.Policies.AspNetCore.csproj
@@ -31,8 +31,10 @@
     <Company>Sajjad H. Al-Khafaji</Company>
     <Copyright>Free Forever — Copyright © Sajjad H. Al-Khafaji</Copyright>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
-    <Version>3.1.0</Version>
-    <PackageReleaseNotes>v3.1.0 — Released in lockstep with DynamicWhere.ex 3.1.0, which it now requires. No API change in this package. The core release changes what its endpoints report, as it changes any guarded call: /simulate answers with 3.1.0's pipeline, the new caps, the strict tier's refusals and a type's DefaultOrder included, and /health's loadedAt and ageSeconds advance on a poll that confirms the version served, so an idle healthy store no longer reads as stale. One change needs action: DwClaimsAdapter.FromClaims returns an unprepared context, and ApplyPolicy(context) now refuses one with PolicyContextNotPrepared even when no store is configured. Use CreateContextAsync or ToPolicyContextAsync, or pass the context through DwPolicy.PrepareAsync before querying. In this package, the audit middleware's warning for events recorded with no IDwAuditSink registered now names both ways to stop recording them: remove [DwAudit] from the fields that produced them, or turn off DwPolicyOptions.AuditRefusals, the core's new switch that records refused guarded queries as audit events, which the middleware drains like any other.
+    <Version>3.2.0</Version>
+    <PackageReleaseNotes>v3.2.0 — Released in lockstep with DynamicWhere.ex 3.2.0, which it now requires. No API change in this package. The core release changes what /simulate reports for a request that sends no Selects. A simulation has no source, so it reads the type as one it cannot see into: every denial beneath a member counts, and the projection it shows keeps only members holding a value, where a guarded query over a projected row, an entity or rows in memory keeps what that source carries.
+
+v3.1.0 — Released in lockstep with DynamicWhere.ex 3.1.0, which it now requires. No API change in this package. The core release changes what its endpoints report, as it changes any guarded call: /simulate answers with 3.1.0's pipeline, the new caps, the strict tier's refusals and a type's DefaultOrder included, and /health's loadedAt and ageSeconds advance on a poll that confirms the version served, so an idle healthy store no longer reads as stale. One change needs action: DwClaimsAdapter.FromClaims returns an unprepared context, and ApplyPolicy(context) now refuses one with PolicyContextNotPrepared even when no store is configured. Use CreateContextAsync or ToPolicyContextAsync, or pass the context through DwPolicy.PrepareAsync before querying. In this package, the audit middleware's warning for events recorded with no IDwAuditSink registered now names both ways to stop recording them: remove [DwAudit] from the fields that produced them, or turn off DwPolicyOptions.AuditRefusals, the core's new switch that records refused guarded queries as audit events, which the middleware drains like any other.
 
 v3.0.0 — First release. The administrative surface for the DynamicWhere.ex field-level policy layer, introduced in DynamicWhere.ex 3.0.0. MapDwPolicyAdmin mounts schema discovery, rule management, explain, simulate and health, and refuses to map at all without a named authorization policy — there is deliberately no default, and it fails at startup rather than on the first request.
 
diff --git a/DynamicWhere.ex.Policies.EntityFrameworkCore/DynamicWhere.ex.Policies.EntityFrameworkCore.csproj b/DynamicWhere.ex.Policies.EntityFrameworkCore/DynamicWhere.ex.Policies.EntityFrameworkCore.csproj
index 9367e98..6837aa4 100644
--- a/DynamicWhere.ex.Policies.EntityFrameworkCore/DynamicWhere.ex.Policies.EntityFrameworkCore.csproj
+++ b/DynamicWhere.ex.Policies.EntityFrameworkCore/DynamicWhere.ex.Policies.EntityFrameworkCore.csproj
@@ -34,8 +34,10 @@
       <Copyright>Free Forever — Copyright © Sajjad H. Al-Khafaji</Copyright>
       <PackageLicenseExpression>MIT</PackageLicenseExpression>
       <!-- Locked to the core's version; see the note in the Redis package. -->
-      <Version>3.1.0</Version>
-      <PackageReleaseNotes>v3.1.0 — Released in lockstep with DynamicWhere.ex 3.1.0, which it now requires. No API or behaviour change in this package. A stored rule's forced predicate can now carry allowNull, which lets rows with no value through: the core's PolicyRuleDocument writes it into the Detail column's forced object as "allowNull": true, only when it is true, so no migration is needed and a rule without it is stored exactly as before. A row whose forced object pairs IsNull or IsNotNull with "allowNull": true, value or no value, or with a contextValue, is refused when it is read, like any row the core cannot read: a Global, Tenant, Role or Custom rule fails the load, and a User rule fails DwPolicy.PrepareAsync for that user.
+      <Version>3.2.0</Version>
+      <PackageReleaseNotes>v3.2.0 — Released in lockstep with DynamicWhere.ex 3.2.0, which it now requires. No API or behaviour change in this package.
+
+v3.1.0 — Released in lockstep with DynamicWhere.ex 3.1.0, which it now requires. No API or behaviour change in this package. A stored rule's forced predicate can now carry allowNull, which lets rows with no value through: the core's PolicyRuleDocument writes it into the Detail column's forced object as "allowNull": true, only when it is true, so no migration is needed and a rule without it is stored exactly as before. A row whose forced object pairs IsNull or IsNotNull with "allowNull": true, value or no value, or with a contextValue, is refused when it is read, like any row the core cannot read: a Global, Tenant, Role or Custom rule fails the load, and a User rule fails DwPolicy.PrepareAsync for that user.
 
 v3.0.0 — First release. A database-backed policy store for the DynamicWhere.ex field-level policy layer, introduced in DynamicWhere.ex 3.0.0. Works with any EF Core provider; ships DwPolicyDbContext, the rule and version records, and their EF configurations. Passes the same store conformance suite as the in-memory and Redis stores, verified against PostgreSQL.
 
diff --git a/DynamicWhere.ex.Policies.Redis/DynamicWhere.ex.Policies.Redis.csproj b/DynamicWhere.ex.Policies.Redis/DynamicWhere.ex.Policies.Redis.csproj
index 931b439..9b1ea88 100644
--- a/DynamicWhere.ex.Policies.Redis/DynamicWhere.ex.Policies.Redis.csproj
+++ b/DynamicWhere.ex.Policies.Redis/DynamicWhere.ex.Policies.Redis.csproj
@@ -34,8 +34,10 @@
       <!-- Locked to the core's version. build/check-version.ps1 fails the build when the three
            disagree, because publish.yml packs all three from one push and a provider shipped at a
            version its core was never built against is a dependency nobody tested. -->
-      <Version>3.1.0</Version>
-      <PackageReleaseNotes>v3.1.0 — Released in lockstep with DynamicWhere.ex 3.1.0, which it now requires. No API or behaviour change in this package. A stored rule's forced predicate can now carry allowNull, which lets rows with no value through: the core's PolicyRuleDocument writes it into the rule document's forced object as "allowNull": true, only when it is true, so a rule without it is stored exactly as before. A document whose forced object pairs IsNull or IsNotNull with "allowNull": true, value or no value, or with a contextValue, is refused when it is read, like any document the core cannot read: a Global, Tenant, Role or Custom rule fails the load, and a User rule fails DwPolicy.PrepareAsync for that user.
+      <Version>3.2.0</Version>
+      <PackageReleaseNotes>v3.2.0 — Released in lockstep with DynamicWhere.ex 3.2.0, which it now requires. No API or behaviour change in this package.
+
+v3.1.0 — Released in lockstep with DynamicWhere.ex 3.1.0, which it now requires. No API or behaviour change in this package. A stored rule's forced predicate can now carry allowNull, which lets rows with no value through: the core's PolicyRuleDocument writes it into the rule document's forced object as "allowNull": true, only when it is true, so a rule without it is stored exactly as before. A document whose forced object pairs IsNull or IsNotNull with "allowNull": true, value or no value, or with a contextValue, is refused when it is read, like any document the core cannot read: a Global, Tenant, Role or Custom rule fails the load, and a User rule fails DwPolicy.PrepareAsync for that user.
 
 v3.0.0 — First release. A Redis-backed policy store for the DynamicWhere.ex field-level policy layer, introduced in DynamicWhere.ex 3.0.0. Holds runtime rules in Redis and invalidates through pub/sub with a poll behind it, because pub/sub is fire-and-forget and the poll is what bounds a dropped message. Passes the same store conformance suite as the in-memory and Entity Framework Core stores.
 
diff --git a/DynamicWhere.ex/DOC.md b/DynamicWhere.ex/DOC.md
index c12a4e5..b09bbbd 100644
--- a/DynamicWhere.ex/DOC.md
+++ b/DynamicWhere.ex/DOC.md
@@ -1,6 +1,6 @@
 # DynamicWhere.ex
 
-**Version:** 3.1.0 &nbsp;|&nbsp; **Target Framework:** .NET 6+ &nbsp;|&nbsp; **License:** MIT (Free Forever)
+**Version:** 3.2.0 &nbsp;|&nbsp; **Target Framework:** .NET 6+ &nbsp;|&nbsp; **License:** MIT (Free Forever)
 
 > A powerful and versatile library for dynamically creating complex filter, sort, paginate, group, aggregate, and set-operation expressions in Entity Framework Core applications — all driven by simple JSON objects from any front-end or API consumer.
 
@@ -31,7 +31,7 @@
 ## Installation
 
 ```bash
-dotnet add package DynamicWhere.ex --version 3.1.0
+dotnet add package DynamicWhere.ex --version 3.2.0
 ```
 
 **Dependencies:**
@@ -445,7 +445,7 @@ Inherits all properties from `FilterResult<T>`. Returned by segment operations.
 
 ## Extension Methods Reference
 
-All extension methods live in `DynamicWhere.ex.Source.Extension` and operate on `IQueryable<T>` (or `IEnumerable<T>` for in-memory variants).
+All extension methods live in `DynamicWhere.ex.Source.Extension` and operate on `IQueryable<T>` (or `IEnumerable<T>` for in-memory variants). There are 28 of them: the eighteen on `IQueryable<T>` that 3.1 had, three in-memory variants on `IEnumerable<T>`, and, since 3.2.0, seven more on `IQueryable<T>` — overloads of the asynchronous terminals that take a `CancellationToken` (see [Cancellation](#cancellation)).
 
 ### `.Select<T>(List<string> fields)`
 
@@ -632,6 +632,8 @@ In-memory variant — wraps the collection with `AsQueryable()` then delegates.
 
 Async version of `ToList<T>(Filter)`. Uses `CountAsync()` and `ToListAsync()` for EF Core.
 
+Since 3.2.0 two overloads take a `CancellationToken`, which reaches the count and the read: `.ToListAsync<T>(Filter filter, CancellationToken cancellationToken)` and `.ToListAsync<T>(Filter filter, bool getQueryString, CancellationToken cancellationToken)`. See [Cancellation](#cancellation).
+
 **Returns:** `Task<FilterResult<T>>`
 
 ---
@@ -655,7 +657,9 @@ In-memory variant — wraps the collection with `AsQueryable()` then delegates t
 
 ### `.ToListAsyncDynamic<T>(Filter filter, bool getQueryString = false)`
 
-Async version of `ToListDynamic<T>(Filter)`. Uses `CountAsync()` and `ToDynamicListAsync()` for EF Core.
+Async version of `ToListDynamic<T>(Filter)`. Counts with EF Core's `CountAsync()` and, since 3.2.0, reads with EF Core's own `ToListAsync()`, called for the query's element type: the class the projection generates, or `T` when `Selects` is null. It used to read with Dynamic LINQ's `ToDynamicListAsync()`, asynchronous as well but with no token to pass on; on an EF Core query a canceled token now reaches the database. The rows are the same. Only the count needs an EF Core async provider; on any other provider the read falls back to Dynamic LINQ's.
+
+Since 3.2.0 two overloads take a `CancellationToken`, which reaches the count and the read: `.ToListAsyncDynamic<T>(Filter filter, CancellationToken cancellationToken)` and `.ToListAsyncDynamic<T>(Filter filter, bool getQueryString, CancellationToken cancellationToken)`. See [Cancellation](#cancellation).
 
 **Returns:** `Task<FilterResult<dynamic>>`
 
@@ -687,7 +691,9 @@ In-memory variant for summary operations.
 
 ### `.ToListAsync<T>(Summary summary, bool getQueryString = false)`
 
-Async version of `ToList<T>(Summary)`.
+Async version of `ToList<T>(Summary)`. On an EF Core query it counts the groups with EF Core's `CountAsync()` and reads them with EF Core's `ToListAsync()`. Until 3.2.0 the count ran synchronously and the read went through Dynamic LINQ's `ToDynamicListAsync()`, which had no token to pass on; on an EF Core query a canceled token now reaches the database. The count and the rows are the same. A source whose provider is not EF Core's, such as rows in memory through `AsQueryable()`, keeps the synchronous count and Dynamic LINQ's read, on the calling thread.
+
+Since 3.2.0 two overloads take a `CancellationToken`, which reaches the count and the read: `.ToListAsync<T>(Summary summary, CancellationToken cancellationToken)` and `.ToListAsync<T>(Summary summary, bool getQueryString, CancellationToken cancellationToken)`. See [Cancellation](#cancellation).
 
 **Returns:** `Task<SummaryResult>`
 
@@ -697,10 +703,41 @@ Async version of `ToList<T>(Summary)`.
 
 Async-only segment operation. Combines every `ConditionSet` with set operations (`Union` / `Intersect` / `Except`) into one query, then orders, pages, projects and counts it in the database exactly as `ToListAsync(Filter)` does. Only the requested page is read, and `Orders` apply before `Selects`. `Union` and `Intersect` combine the sets' conditions and `Except` matches rows by primary key, never by object reference, so on a type with a primary key, tracking, `AsNoTracking()` and `Selects` return the same rows. Ordering follows the database: text sorts by its collation.
 
+Since 3.2.0 an overload takes a `CancellationToken`, `.ToListAsync<T>(Segment segment, CancellationToken cancellationToken)`, and passes it to the count and the read. See [Cancellation](#cancellation).
+
 **Returns:** `Task<SegmentResult<T>>`
 
 ---
 
+### Cancellation
+
+*New in 3.2.0.* Every asynchronous terminal has overloads that take a `CancellationToken`, guarded and unguarded:
+
+| Terminal | Overloads with a token |
+|---|---|
+| `ToListAsync` with a `Filter` | `(Filter filter, CancellationToken cancellationToken)` · `(Filter filter, bool getQueryString, CancellationToken cancellationToken)` |
+| `ToListAsyncDynamic` with a `Filter` | `(Filter filter, CancellationToken cancellationToken)` · `(Filter filter, bool getQueryString, CancellationToken cancellationToken)` |
+| `ToListAsync` with a `Summary` | `(Summary summary, CancellationToken cancellationToken)` · `(Summary summary, bool getQueryString, CancellationToken cancellationToken)` |
+| `ToListAsync` with a `Segment` | `(Segment segment, CancellationToken cancellationToken)` |
+
+- The token reaches the count and the read. On an EF Core query a canceled token stops whichever of the two is running, and the call throws `OperationCanceledException`. EF Core's `TaskCanceledException` derives from it. `ToListAsync(Summary)` on a provider that is not EF Core's, such as rows in memory, checks the token before its synchronous count and read.
+- The overloads without a token pass `CancellationToken.None`.
+- They are overloads, not an optional parameter added to the old signatures. The 3.1 signatures are unchanged, so code compiled against 3.1 still binds. A reflection lookup of `ToListAsyncDynamic` by name alone now finds three methods where it found one, on the extension class and on the guarded handle, so `Type.GetMethod` given only the name throws `AmbiguousMatchException`; pass the parameter types.
+- `ToListAsync(filter, default)` does not compile: `default` fits both `bool getQueryString` and `CancellationToken`, so the call is ambiguous (CS0121). So are `ToListAsyncDynamic(filter, default)` and `ToListAsync(summary, default)`, on a query and on the guarded handle alike. Write `false`, a token, or a named argument. A `Segment` takes no `getQueryString`, so `ToListAsync(segment, default)` binds the token overload.
+- The guarded handle, `PolicyQueryable<T>`, has the same seven overloads (see [The shape](#the-shape)).
+
+```csharp
+// A minimal API binds a CancellationToken parameter to HttpContext.RequestAborted,
+// so a client that disconnects cancels the count or the read.
+app.MapPost("/customers/search", async (Filter filter, AppDbContext db, CancellationToken cancellationToken) =>
+{
+    var result = await db.Customers.ToListAsync(filter, cancellationToken);
+    return Results.Ok(result);
+});
+```
+
+---
+
 ## Validation Rules
 
 ### Condition Validation Rules
@@ -1502,6 +1539,12 @@ var result = await db.Employees.ApplyPolicy(caller).ToListAsync(filter);
 
 A context carries the snapshot it was served, and the staleness ceiling measures how old that snapshot is — which is why it is built once per request rather than reused. Since 3.1.0 an unprepared context is **refused by `ApplyPolicy` itself**, with `PolicyContextNotPrepared`, whether or not a store is configured: before that only a store provider refused one, so an attributes-only deployment accepted the missing call and would have started refusing the day it gained a store. `DwPolicyContext.IsPrepared` reports it. The overload taking explicit options and a resolver does not check — that host composes its own configuration and owns preparation.
 
+`ApplyPolicy` returns a `PolicyQueryable<T>`, whose terminals mirror the core's: `ToList`, `ToListAsync`, `ToListDynamic` and `ToListAsyncDynamic` with a `Filter`, `ToList` and `ToListAsync` with a `Summary`, and `ToListAsync` with a `Segment`. Since 3.2.0 every asynchronous one also has the overloads that take a `CancellationToken` — `ToListAsync(Filter, CancellationToken)`, `ToListAsync(Filter, bool, CancellationToken)`, the same two for `ToListAsyncDynamic` and for `ToListAsync` with a `Summary`, and `ToListAsync(Segment, CancellationToken)`. The policy is applied first, so a refusal is thrown whatever the token says; the token then reaches the count and the read. See [Cancellation](#cancellation).
+
+```csharp
+var result = await db.Employees.ApplyPolicy(caller).ToListAsync(filter, cancellationToken);
+```
+
 ### Attribute reference
 
 | Attribute | Applies to | Effect |
@@ -1580,14 +1623,15 @@ It applies only under `ApplyPolicy`, when the caller sends no orders (`Orders` n
 - `ToList`, `ToListAsync`, `ToListDynamic` and `ToListAsyncDynamic` with a `Filter`;
 - `ToListAsync` with a `Segment`;
 - the composable `Filter` and `FilterDynamic`;
-- the composable `Page`, on a source nothing has ordered or projected.
+- the composable `Page`, on a source nothing has ordered and whose projection hides no field the default names.
 
 It is never applied:
 
 - by an unguarded call. The core extension methods on a plain `IQueryable<T>` or `IEnumerable<T>`, and a query taken out through `AsUnguardedQueryable()`, ignore the attribute and behave exactly as in 3.0;
 - when the caller sends orders — the default is not appended to them as a tiebreak;
-- to an `IQueryable<T>` that is already ordered, whether before it was guarded (`db.Tickets.OrderBy(t => t.Title).ApplyPolicy(caller)`) or by a composed `Order` earlier in the chain — even one whose every order the policy dropped, because the caller still sent orders. An in-memory sequence sorted with LINQ to Objects before `ApplyPolicy` is not seen as ordered, because `AsQueryable()` hides the sort, so the default replaces that order;
-- to a projected query. A `Select` anywhere in the chain — the guarded composable `Select`, or a projection made before `ApplyPolicy` — leaves the query in its own order, because a default applied after a projection can name a field the projection left out, which EF Core cannot translate, so `guarded.Select(["Id", "Title"]).Page(page)` on a type ordered by `Priority` pages unordered, as in 3.0.0;
+- to an `IQueryable<T>` that is already ordered, whether before it was guarded (`db.Tickets.OrderBy(t => t.Title).ApplyPolicy(caller)`) or by a composed `Order` earlier in the chain — even one whose every order the policy dropped, because the caller still sent orders. Since 3.2.0 a `Filter` composed on the handle that sent orders counts the same way. An in-memory sequence sorted with LINQ to Objects before `ApplyPolicy` is not seen as ordered, because `AsQueryable()` hides the sort, so the default replaces that order;
+- to a source whose projection could hide a field the default names. Only the outermost `Select` of the chain counts, because it makes the rows the default orders. Since 3.2.0 it hides nothing when it builds `T` itself in an object initializer, `Select(t => new TicketRow { CreatedAt = t.CreatedAt, Id = t.Id, … })`, and assigns every field the default names a column, at every level of a nested path (`"Owner.Name"` needs `Owner = new OwnerRow { Name = … }`). On EF Core a column is a member the model maps on the entity the `Select` reads, read directly, through reference navigations (`t.Owner.Name`) or through `EF.Property` (a shadow property included); in memory any assigned field is one. The default then applies, because EF Core translates an order by a column. A constructor with arguments, a default field the initializer does not assign, a nested path through anything but an initializer, a member the model does not map, or a default field the projection computes, by the application's own method (`Label = Decorate(r.Code)`), a framework one such as `Regex.Replace` or `ToUpper`, or an operator, leaves the query in its own order, as every projection did in 3.1.0: which of these EF Core can order by depends on the provider, and a default must never be the reason a query that ran unguarded fails;
+- after a projection composed on the handle. The guarded `Select`, or a guarded `Filter` whose `Selects` is set, leaves the rest of the chain unordered even when it keeps every default field, so `guarded.Select(["Id", "Title"]).Page(page)` on a type ordered by `Priority` pages unordered, as in 3.0.0. The default is for the rows the caller's source makes;
 - to a `Summary`, or by the composable `Where`, `Select`, `Order` or `Group`.
 
 Nothing is ordered that the type's own `[DwEntity]` did not declare, and a default is never a reason for the library to refuse a query. An entry naming a field the type does not have, one that is not a field optionally followed by a direction, one the core refuses to order by — a path ending on a collection of entities, such as `Tags` — or one whose name the expression parser keeps for itself, such as `Null`, is skipped. A path through a collection to a value, such as `Tags.Value`, is kept and sorted by its smallest value ascending or its largest descending. A field this caller may not order by is left out, in either tier, and never refused: the caller did not send it, and ordering by it would rank rows by a value they may not see. In a `Segment`, a field this caller may not use in a segment is left out as well, since a segment refuses it in any clause; a filter still orders by it. The trace records a `Dropped` decision for `Order` whose reason starts `left out of the default order`; a dry run keeps the field and still records the decision. A caller whose own orders were all dropped under `Convenience` sent orders, and gets no default in their place. The startup check reports every entry a query would skip or leave out.
@@ -1601,7 +1645,7 @@ A field the default keeps is a use of that field. One audited for `Order`, by `[
 `DwPolicy.ValidateModel(options, types)` inspects the policy attributes on the given types and throws `InvalidOperationException` listing every error; `PolicyModelValidator.Inspect(types, options)` returns the same `PolicyModelReport` — `Errors`, `Warnings`, `IsValid` — without throwing. Called at startup, either one lets a misconfiguration fail the deployment rather than a caller's request. Since 3.1.0 the scan also reports:
 
 - every `[DwForceWhere]` resolution would refuse: `Value` and `ContextValue` both set or both missing on a comparison, either one set on a null check, a member whose type has no `DataType`, and `AllowNull` with `IsNull` / `IsNotNull` or on a member that can never be null. Before, these surfaced on the first query that resolved them;
-- every `[DwEntity(DefaultOrder = ...)]` entry a guarded query would skip or leave out. An entry that is not a field optionally followed by `asc` or `desc` is an error; a field whose name starts with one of the words the expression parser keeps is an error, judged before the type is asked whether it has the member, because it may well have it — `"{Type}: DefaultOrder names '{field}', which starts with a name the expression parser keeps for itself, so no query can use it. Rename the member."`; a field the type does not have is a warning; a field no query can order by, such as a collection of entities, is an error; a field the type's own attributes seal against ordering is an error, because every guarded query would leave it out. A field denied for ordering only by attributes marked `Overridable = true` is a warning, because a rule can lift the denial for some callers — `"{Type}: DefaultOrder names '{field}', which its attributes deny for ordering unless a rule allows it, so guarded queries leave it out until one does."` — and so is a field the attributes deny for segments: `"{Type}: DefaultOrder names '{field}', which its attributes deny for segments, so guarded segments leave it out."`
+- every `[DwEntity(DefaultOrder = ...)]` entry a guarded query would skip or leave out. An entry that is not a field optionally followed by `asc` or `desc` is an error; a field whose name starts with one of the words the expression parser keeps is an error, judged before the type is asked whether it has the member, because it may well have it — `"{Type}: DefaultOrder names '{field}', which starts with a name the expression parser keeps for itself, so no query can use it. Rename the member."`; a field the type does not have is a warning; a field no query can order by, such as a collection of entities, is an error; a field the type's own attributes seal against ordering is an error, because every guarded query would leave it out; the attributes include those of the member's other declarations, an interface member it implements, a subtype's override and a public member a subtype hides with `new`. A field denied for ordering only by attributes marked `Overridable = true` is a warning, because a rule can lift the denial for some callers — `"{Type}: DefaultOrder names '{field}', which its attributes deny for ordering unless a rule allows it, so guarded queries leave it out until one does."` — and so is a field the attributes deny for segments: `"{Type}: DefaultOrder names '{field}', which its attributes deny for segments, so guarded segments leave it out."`
 
 ### Blocked-action semantics
 
@@ -1624,6 +1668,96 @@ A dropped field leaves nothing behind in the data, so the trace is the only way
 
 The convenience tier is unchanged: an unknown name fails validation with `LogicException` `ConditionMustHasValidFieldName`, a refusal names the field as the caller wrote it, with `RuleId` and `SourceOrigin` where a single source decided, and `MaxQueryCost` is checked before any field is gated. A dry run refuses no field, so an unknown name fails validation there in either tier.
 
+### A navigation named in Selects
+
+A `Selects` entry can name a navigation, such as `"Lines"`, rather than the fields beneath it. With nothing denied beneath it, the entry is kept as written. With a denied field beneath it, the `Convenience` tier replaces the entry with the allowed fields beneath it, and the `Strict` tier refuses it with `FieldDeniedForSelect`.
+
+| `Selects` names a navigation | `Convenience` | `Strict` |
+|---|---|---|
+| with nothing denied beneath it | Kept whole, or narrowed around a transform that lands on a property with no setter (3.2.0) | Kept whole, or narrowed the same way |
+| with a denied field beneath it | Replaced by the allowed fields beneath it | `FieldDeniedForSelect` |
+| whose key, `Lines.Id`, is denied (3.2.0) | `FieldDeniedForSelect` | `FieldDeniedForSelect` |
+| with a denied field beneath it, where the narrowing cannot be built (3.2.0) | `FieldDeniedForSelect` | `FieldDeniedForSelect` |
+| that can carry a field denied for `Select` that no path names: past four segments, in a framework generic, on a subtype, or unasked under a `"*"` deny (3.2.0) | Narrowed to the allowed fields where the core can narrow it; `FieldDeniedForSelect` where it cannot | `FieldDeniedForSelect` |
+
+- The fields beneath a member are read the way the attribute walker reads them: through any collection type, and no deeper than its four segments. Since 3.2.0 a member typed `IReadOnlyList<T>`, `IReadOnlyCollection<T>`, `Collection<T>` or an application's own collection no longer hides the denials beneath it. The providers' own rules are asked too, so a denied property with no setter and a rule on a path reached through a cycle count.
+- A narrowing that cannot be built as it was gated is refused in both tiers (3.2.0). The core's typed projection adds the key, `Id`, of every nested node it builds, so a navigation narrowed around its own denied key would get the key back. The core reads a path only through an array, `List<T>`, `IList<T>`, `ICollection<T>`, `IEnumerable<T>`, `HashSet<T>` or `ISet<T>`, so a narrowing through any other collection fails its validation. And some members cannot be narrowed at all: a column, a complex property or a member stored as JSON, which EF Core reads whole; a member of a row in memory; and a member a projection builds some way the core cannot narrow.
+- A named member can also carry a field denied for `Select` that no path names (3.2.0): one deeper than four segments, one inside a framework generic such as `Dictionary<string, T>`, or one a subtype of the member's type declares — a derived entity, a subclass, an interface's implementation. What it can carry is read from the source. On an entity it is read from the EF Core model, so only what loads counts: the navigation's columns, a converted one included, its owned chain at any depth, the navigations beneath it an include, an automatic include or a lazy loader fills, and each member the model does not map, read as its type, since its getter can hand out what EF Core loaded — for its type and every type the model derives from it. On a projected row it is the type the initializer constructs the member as, when it says, and otherwise the member's type and every loaded subtype of it, as on a row in memory. Under a policy with a `"*"` deny, a path the walk never asks about — past four segments, with no setter, or on a subtype — is a denied one unless the policy names it; around a cycle it always is. The `Strict` tier refuses such a member. The `Convenience` tier narrows it where the core can, which builds the declared type and so drops a subtype's fields; a path naming a framework generic itself narrows to nothing and is dropped. Where the core cannot narrow it — a column at the top of `T`, a member of a row in memory — both tiers refuse it.
+- A navigation named through another, `Main.Lead`, gates the key of every node it passes through, which the core's projection adds, as a dotted path to a value always did (3.2.0). A denied key refuses the projection. Naming a field beside a denied key, `Lines.Name` when `Lines.Id` is denied, was already refused in both tiers.
+- Under `Convenience` the refusal names the denied key, the first denied field beneath the member, or, for a denial no path names, the member itself. Under `Strict` its `FieldPath` is `"*"`, as on every field refusal. The trace records the reason either way.
+
+### A request that sends no Selects
+
+A request that sends no `Selects` returns whole rows, denied fields included, because the core projects only when `Selects` is set. So when a field denied for `Select` could reach the result, a guarded query synthesizes the projection itself. It does so in both tiers, typed and dynamic, for a whole `Filter` and for a `Segment`. A clause composed on its own, such as `Where`, `Order` or `Page`, synthesizes nothing.
+
+The projection keeps the **allowed members**: what an unguarded call would return, less what the policy withholds. Before 3.2.0 it kept the allowed scalars only, and only a simple field denied at the top of the type asked for it (breaking point 20).
+
+**When a projection is needed.**
+
+- A field denied at the top of `T` always asks for one, whatever it holds: a scalar, a blob, a list, an owned object or a JSON column.
+- A field denied beneath a member asks for one when its value can reach the result. On an entity, that is beneath a column, an owned or complex member, or a navigation something loads: an `Include` or `ThenInclude` on the query, an automatic include, or a lazy loader — EF Core's proxies, an injected `ILazyLoader`, a loader delegate or `ILazyLoader` the constructor takes and keeps in a field or any property, the asynchronous loader delegate of EF Core 7, or an injected `DbContext` — which fills a navigation after the query. On a row a projection builds, it is beneath a member the initializer assigns; a constructor with arguments counts every member as assigned, and an initializer after it still says what its own bindings hold. On a row in memory, it is beneath any member. A rule may spell the path in any letter case.
+- Every navigation counts as loaded where the library cannot read which the query loads: an `Include` in a form it cannot read, one off the query's own chain, and a chain that reaches its rows through anything but the root's own rows — `Select(o => o.Customer)`, a `SelectMany`, a `Join`, a `GroupBy` — when it also has an include, which EF Core applies from the root to the entities it reaches, or when one of its lambdas hands its rows an object: one it builds, as a projection behind an identity `Select`, or an object built inside an anonymous row or a conditional, does; one an application's method returns from what the lambda gives it; or one it captured, another query with its own include or projection, or an object in memory. A call that reads nothing of the lambda's and returns a query or an expression — a specification, a repository's query, `FromSql`, a context's `Set` through an interface — is evaluated as EF Core evaluates it, and what it returns is read; a context's own query function is a query root; an anonymous object that only carries what the rows hold, query-syntax range variables or a composite key, builds nothing; and what only feeds a predicate or a key is a value and hands a row nothing. Such a chain with none of these is read from the model.
+- A denial beneath a navigation nothing loads never leaves the database, so it asks for no projection. An entity whose only denials sit beneath such navigations is read as it was in 3.1.0.
+- A member whose value can hold a field denied for `Select` that no path names — deeper than the walker's four segments, inside a framework generic such as `Dictionary<string, T>`, or declared by a subtype of its type — asks for one too, read as for a named member, so on an entity only what loads counts. Under a `"*"` deny, so does a member whose value can hold a path the walk never asks about and the policy does not name.
+- A member that can hold an object of any type — one typed `object`, a framework interface such as `IComparable`, or a collection that is not generic, such as `IEnumerable`, `ArrayList` or an application's own — asks for nothing on its own: the policy cannot see into it whether or not a projection is built.
+- A row can be a subtype of `T`. On an entity, a member a type the model derives from `T` declares, and what loads beneath it, counts as one of `T`'s own would; on a row in memory, a member any loaded subtype declares does; on a row a projection builds, a member the type its initializer constructs declares below `T`. The projection builds `T` and leaves them out, recorded with a reason starting `left out: a type derived`. A subtype is any type loaded outside the framework's assemblies that derives from the type or implements it, an open generic one and an application's subclass of `Exception` included; a rule on a path through a subtype's member counts as a rule on the declared type's own path does.
+- A member EF Core does not map counts as loaded: its getter can hand out a mapped field or a private navigation, so its type is read whole.
+- The denials beneath a member come from the providers' rules as well as from walking the type, so a denied property with no setter, a rule on a path reached through a cycle, and a rule deeper than the walk all count.
+- A forced scope beneath a member asks for no projection on its own. It filters the rows that hold the member, as it always has. When a projection is needed anyway, the member is left out whole.
+
+**What it keeps.** A member holding a value — a simple type, or a collection of one such as `byte[]`, `string[]` or `List<string>` — is kept when it is allowed and the source carries it. A member holding an object, or a list of them, is kept whole, narrowed or left out whole, as below, and only where the source carries it:
+
+| Source | Values kept | Objects kept |
+|---|---|---|
+| A projection that builds its rows before `ApplyPolicy`: the outermost `Select` constructs the row, in an object initializer or with a constructor, as in `db.Roles.Select(r => new RoleRow { … })` | Every member the initializer assigns; every member when a constructor with arguments builds the row, with or without an initializer after it | The same |
+| An entity query, or a `Select` that hands back an entity, as in `db.Orders.Select(o => o.Customer)` | Every member EF Core maps | Its columns, converted and JSON ones included, its owned members and, on EF Core 8 or later, its complex properties, read from the EF Core model; a converted value that can hold an object of any type is left out |
+| Rows in memory, as in `roles.ApplyPolicy(caller)` | Every member | None |
+
+A value EF Core does not map is left out: computing it would make EF Core read the whole entity, the denied columns included, and it holds only its initial value anyway. A source the library cannot read — no EF Core model, and neither a projection it can see into nor rows in memory — keeps values only, as in 3.1.0, and every denial beneath a member counts.
+
+**Whole, narrowed or left out whole.** A member holding an object that the source carries is:
+
+- **kept whole** when nothing beneath it is denied, nothing its value can hold is denied (its subtypes included), it cannot hold an object of any type (asked of a projected row, a row in memory, and an entity's column a value converter hands back, directly or inside a complex property: what EF Core materializes itself never holds one), under a `"*"` deny every path beneath it the walk skips is one the policy names, no forced scope is beneath it, and no transform beneath it lands on a property with no setter;
+- **narrowed** otherwise, to the allowed fields beneath it, four segments deep, as a caller naming it would get it, where the core's narrowing translates: an object the projection's initializer builds, a list a subquery reads into a type the core can bind (not an array or a set), a navigation that is neither complex nor stored as JSON, or an entity's owned member not stored as JSON. The narrowing builds the declared type, so a subtype's fields are dropped. A field beneath it that can hold what the policy cannot name is left out;
+- **left out whole** otherwise, and recorded as `Dropped` on `Select` with a reason that starts `left out whole`.
+
+```text
+left out whole: a scope forced beneath it cannot be applied to what it holds
+left out whole: it is a column, which EF Core reads whole
+left out whole: it is a complex property, which EF Core cannot narrow
+left out whole: it is stored as JSON, which EF Core cannot narrow
+left out whole: the projection builds it in a way the core cannot narrow
+left out whole: the projection would add its key 'Contents.Id', which is denied
+left out whole: the core cannot project 'Contents.Code'
+left out whole: the core cannot build 'IContact', which it narrows into
+left out whole: nothing beneath it may be selected
+left out whole: it can hold what the policy cannot name
+```
+
+The last one is recorded on the field beneath the member that the narrowing leaves out.
+
+**Never kept.**
+
+- An entity's navigation, included or not: projecting it would load it. So once a denial needs a projection, an included or automatically included navigation is not returned, and the trace records it as `Dropped` with a reason starting `left out:`. Under `Convenience`, name it in `Selects` to get it narrowed; under `Strict`, name its allowed fields.
+- An object held by a row in memory: a kept object is the caller's own, and a transform beneath it would change it in place. The projection's rows are new and hold no member of an object type, so the source objects are left as they were.
+- A member with no setter, and a member named with one of the expression parser's own words.
+
+**Other rules.**
+
+- A narrowed reference that is null in the source comes back as an empty object, as it does for a caller's own dotted `Selects`.
+- A narrowed member carries every allowed field beneath it. An entity reached beneath it therefore has its own navigations projected, and so loaded, whether or not the source included them, exactly as when `Selects` names the member.
+- Each denied field whose value can reach the result, at the top or beneath, is recorded as `Dropped` on `Select`.
+- It never throws for a denied field, in either tier. It throws `AllSelectsDenied` only when no field is left. When nothing asks for a projection, `Selects` stays null and the query is the one an unguarded call runs.
+- A typed query projects into `T`, so `T` needs a public parameterless constructor, or the query fails with `SelectTypeMustHaveParameterlessConstructor` (breaking point 1). The dynamic terminals do not need one.
+- A dry run synthesizes nothing. It records the denials and returns the rows whole.
+- A simulation has no source, so it reads `T` as a source it cannot see into: every denial beneath a member counts, and the projection it shows keeps only members holding a value (see [Administration](#administration)).
+
+**What the policy cannot see into.** A member typed `object`, a framework interface or a collection that is not generic, such as `IEnumerable`, `ArrayList` or an application's own, is opaque to the policy. It never asks for a projection; when one is needed anyway, a projected row, a row in memory, and an entity's converted column leave it out, and an entity's other columns keep it; and naming it returns whatever it holds. A converter returning an application type through a column typed `object` is opaque the same way, so type the member as what it holds. `BitArray` and the framework's string collections hold values. An application's own collection class, generic or not, still has its own members read, and a collection of values stays a value unless one of them is denied. Two members sharing a name, one hidden with `new` under another type or spelled in another case, are left out when either holds a denial: the core reads one of them, and a row carries both. Rows in memory are projected when a member a base type declares, and the row type hides with `new`, is denied. A method in a reshaping lambda that builds a query from captured values runs once more per guarded read, and one that answers differently on each call is enforced as it answered the guard. A framework generic holding a policed type, such as `Dictionary<string, LineDto>`, has no paths beneath it: naming it is refused in both tiers where the core cannot narrow it, at the top of `T` or on a row in memory, narrowed away under `Convenience` beneath a navigation, and a synthesized projection leaves it out. Hold such values in a list of the policed type instead. A member EF Core does not map is read as its type, since its getter can hand out what EF Core loaded; a getter that copies a denied column into a type with no denial is the application's to withhold.
+
+**A projection builds the declared type.** A query over the root of a hierarchy whose derived type declares a denied field comes back as root-type rows, the derived types' allowed fields dropped too. Over an abstract root the typed terminals fail with `SelectTypeMustHaveParameterlessConstructor`, and the dynamic ones return the root's members. Query the derived type, `OfType<Company>()`, to keep its fields. Rows in memory can be any loaded subtype, and the policy does not look at the rows: when a subtype declares a denied field, they are projected and their objects left out, even if no row is that subtype. Under a `"*"` deny, a member is kept whole only when every path beneath it the walk skips is one the policy names. A `[DwDenied]` on an override, on a public member a subtype hides with `new`, or on a class's implementation of an interface member, through a variant instantiation too, applies to the path through the base type or the interface, on every row and in every clause.
+
+**A forced scope on a list's element type filters rows, not elements.** A forced scope declared on a list's element type filters the rows that hold the list, never its elements. `Selects` naming the list returns every element, those the scope excludes included, as in every release; a synthesized projection leaves such a list out. Scope the elements where the row is built.
+
 ### Results and the trace
 
 Every guarded query records a `PolicyTrace`: its tier, whether it ran dry, and a `PolicyDecision` — `FieldPath`, `Feature`, `Action`, `Reason` — for each thing the policy decided. `PolicyQueryable<T>.LastTrace` holds it for the most recent call on the handle, the composable methods included.
@@ -1802,6 +1936,8 @@ Options are frozen at startup. Every cap refuses a value below one, except two t
 | `POST` | `/simulate` | The sanitized clause, without executing or auditing |
 | `GET` | `/health` | Snapshot version, age, degraded state, last error |
 
+A simulation, through `/simulate` or `PolicySimulator`, has no source, so it reads the type as a source it cannot see into. That shows in a clause that sends no `Selects`: every denial beneath a member counts, and the projection it shows keeps only the members that hold a value, a collection of values included. A guarded query keeps what its own source carries — over a projected row, the objects its initializer assigns; over an entity, its columns, owned and complex members, asking only about the denials whose value it loads; over rows in memory, values only. So the simulated clause can list fewer members than the query returns, and can show a projection an entity query does not need. See [A request that sends no Selects](#a-request-that-sends-no-selects).
+
 ### Schema discovery
 
 `POST /dw-policies/schema` describes what one caller may do with one entity. It is a POST rather
@@ -2103,7 +2239,7 @@ All validation errors throw `LogicException` (inherits `Exception`) with one of
 ### ⚠️ Breaking Points
 
 1. **Parameterless Constructor Required for Select Projection**
-   `Select<T>(fields)` requires `T` to have a parameterless (default) constructor. If `T` does not have one — a positional record, most often — a `LogicException` is thrown whose `Message` is the stable code `SelectTypeMustHaveParameterlessConstructor` and whose `Subject` carries `typeof(T).Name`. Before 3.1.0 that message was an English sentence with the type name inside it. Most EF Core entity classes have parameterless constructors by default. A guarded query reaches the same refusal when a member carries `[DwNoSelect]`, because deny-select projects.
+   `Select<T>(fields)` requires `T` to have a parameterless (default) constructor. If `T` does not have one — a positional record, most often — a `LogicException` is thrown whose `Message` is the stable code `SelectTypeMustHaveParameterlessConstructor` and whose `Subject` carries `typeof(T).Name`. Before 3.1.0 that message was an English sentence with the type name inside it. Most EF Core entity classes have parameterless constructors by default. A guarded query reaches the same refusal when a member carries `[DwNoSelect]`, because deny-select projects — since 3.2.0 whatever the member holds, and beneath another member when its value can reach the result (point 20).
 
 2. **Segment Operations are Async-Only**
    `ToListAsync<T>(Segment)` is the only entry point for segment queries. There is no synchronous `ToList<T>(Segment)` variant. The condition sets are combined into one query that the database orders and pages. `Union` and `Intersect` combine the sets' conditions; only `Except` on a type with a primary key needs a provider that translates a correlated `EXISTS`. Under `ApplyPolicy`, `DwCaps.MaxConditionSets` (default 10) bounds how many sets one request may carry.
@@ -2177,6 +2313,37 @@ All validation errors throw `LogicException` (inherits `Exception`) with one of
 19. **`MaxConditionValues` and `MaxAggregates` Refuse Guarded Requests 3.0 Ran**
     Two more caps new in 3.1.0. `DwCaps.MaxConditionValues` (default 1000) bounds the values one condition carries — the largest condition of the where clause, a summary's `Having` and every segment set is the one compared — because an `In` is one comparison per value and so could build a predicate of any size for the price of one condition and one field. `DwCaps.MaxAggregates` (default 50) bounds the `AggregateBy` entries of one summary, through the summary terminals and the composable `Group` and `Summary`; the group-size floor's own count is not counted. A guarded request over either is refused in both tiers with `PolicyException` `CapExceeded`, `FieldPath` `"*"` and `SourceOrigin` `"MaxConditionValues cap (1000), request had 1001"` or `"MaxAggregates cap (50), request had 51"`, unless the deployment raises the cap. Both refuse a value below 1, freeze with the posture, and bind from `Caps:MaxConditionValues` and `Caps:MaxAggregates`. An aggregate with no field, such as a `Count`, is now charged `DefaultFieldCost` toward `MaxQueryCost`, where it cost nothing, so a summary that sat just under its budget can be refused with `QueryCostExceeded`. Every count cap is now checked before any field name is resolved, so an oversized request that also names a field that does not exist is refused with `CapExceeded`, where 3.0.0 resolved names first and answered `ConditionMustHasValidFieldName`. Only `ApplyPolicy` enforces them: an unguarded query is not affected.
 
+20. **A Guarded Query That Sends No `Selects` Keeps What the Source Carries**
+    A request with no `Selects` returns whole rows, denied fields included, so a guarded query synthesizes a projection when a denied field could reach the result. 3.2.0 changed when it does so and what it keeps; the rules are under [A request that sends no Selects](#a-request-that-sends-no-selects).
+
+    Fixed (security): a field denied only beneath a member, none at the top of `T`, synthesized nothing, so the whole row came back with the denied value in it — in a list or nested object of a row projected before `ApplyPolicy`, in a row held in memory, and in an entity's included, automatically included, lazily loaded or owned member — typed and dynamic, in both tiers, for a `Filter` and a `Segment`. Such a denial now synthesizes the projection whenever its value can reach the result: on an entity, beneath a column, an owned or complex member, or a navigation the query loads through `Include`, an automatic include or a lazy loader; on a projected row, beneath a member the initializer assigns; in memory, beneath any member. A denial beneath a navigation nothing loads never leaves the database, and the entity is read exactly as in 3.1.0.
+
+    Fixed (security): what a query loads was read too narrowly. An include named from the root and reached through `Select(o => o.Customer)`, `SelectMany` or `Join`, a projection behind another `Select`, an initializer after a constructor with arguments, and a lazy loader the constructor takes and keeps in a field or a property of any name each loaded a denied value the gate read as unloaded. An injected `DbContext` or EF Core 7's asynchronous loader delegate did too, and so did a reshaping lambda that got its row from an application's method or from a captured query or object. An application's own collection class hid its own denied members, and a guarded query through a provider wrapping EF Core's, such as LinqKit's `AsExpandable`, ran tracking, so the context filled in navigations it already held and a masked value became a pending change. A field a subtype declares, a derived entity's or a subclass's held by a base-typed member, was not read at all, nor was a `[DwDenied]` on an override, on a member hidden with `new` or on an interface member's implementation, and under a `"*"` deny a path the walk never asked about was allowed. Each came back. Now every navigation counts as loaded on such a chain, the subtypes are read, and such a path is denied. When a type the model derives from `T`, or a loaded subclass of a row in memory, declares a denied field, the rows are projected to `T`, dropping a derived type's allowed fields too; over an abstract `T` the typed terminals fail with `SelectTypeMustHaveParameterlessConstructor` and the dynamic ones return its members.
+
+    Fixed (security): a field denied at the top of `T` whose own type is not a simple value — a byte array, a list, an owned object, a JSON column — synthesized no projection either, so with nothing else denied the whole row came back with it.
+
+    Changed: the projection kept simple fields only, so as soon as any field was denied, every nested object and list of a row projected before `ApplyPolicy` came back null or empty, and so did an entity's columns holding an object, its owned and complex members and its collections of simple values. A row a projection builds now keeps the members its initializer assigns; an entity keeps its mapped columns, converted and JSON ones included, except a converted one that can hold an object of any type, its owned and complex members, and every collection of simple values; rows in memory keep their values. A member holding an object is kept whole when nothing it can hold is denied, narrowed to the allowed fields where the core's narrowing translates, and otherwise left out whole, with a `Dropped` decision whose reason starts `left out whole`. An entity's navigations, included ones too, the objects of a row in memory, and a value EF Core does not map are left out; under `Convenience` name a navigation in `Selects` to get it narrowed, and under `Strict` name its allowed fields. A forced scope beneath a member asks for no projection on its own, and a projection needed for another reason leaves such a member out whole. A typed query needs `T` to have a public parameterless constructor for the projection, as it already did (point 1).
+
+21. **`Selects` Naming a Member Is Gated Against Every Denial Beneath It**
+    When `Selects` names a navigation with a denied field beneath it, the `Convenience` tier replaces the entry with the allowed fields beneath it, and the `Strict` tier refuses it. Since 3.2.0 the gate finds every denial beneath the member, and refuses, with `FieldDeniedForSelect`, a narrowing it cannot build as gated. See [A navigation named in Selects](#a-navigation-named-in-selects).
+
+    Fixed (security): under the convenience tier, a navigation whose key (`Id`) is denied was narrowed to the allowed fields beneath it, and the core's typed projection, which adds the key of every nested node it builds, put the key back. Such a narrowing is refused in both tiers, as naming a sibling of the key already was. A navigation named through another, such as `Main.Lead`, now gates the key of `Main`, which the projection adds; it did not.
+
+    Fixed (security): a member typed as a collection the core does not unwrap — `IReadOnlyList<T>`, `IReadOnlyCollection<T>`, `Collection<T>` or an application's own — returned every field beneath it, denied ones included, in both tiers. The projection gate read collections through a narrower list than the attribute walker and found nothing beneath the member. It now reads them as the walker does, and a narrowing the core cannot project is refused.
+
+    Fixed (security): a member of a projected or in-memory row whose type holds a field denied for `Select` that no path names — deeper than four segments, or inside a framework generic such as `Dictionary<string, T>` — was returned whole. The strict tier refuses it now, and the convenience tier narrows it away; where it cannot be narrowed, both tiers refuse it. Denials beneath a named member are also read from the policy's own rules, so a denied property with no setter and a rule on a path reached through a cycle are found. A member that cannot be narrowed at all — a column, a complex property or a JSON-stored member, a member of a row in memory, or one a projection builds some way the core cannot narrow — is refused in both tiers when something beneath it is denied. A request that sends no `Selects` is not refused for such a member: its synthesized projection narrows it or leaves it out whole.
+
+22. **`DefaultOrder` Reaches a Projection That Builds `T`**
+    In 3.1.0 a `Select` anywhere in the chain kept a guarded query in its own order. Since 3.2.0 only the outermost `Select` counts, and when it builds `T` in an object initializer that assigns every field the default names a column, at every level of a nested path, the default applies: `db.Tickets.Select(t => new TicketRow { Id = t.Id, CreatedAt = t.CreatedAt, Title = t.Title }).ApplyPolicy(caller)` on a `TicketRow` declaring `"CreatedAt desc, Id"` was unordered and is now ordered. A column is a member the EF Core model maps on the entity the `Select` reads, read directly, through reference navigations or through `EF.Property`. A value the projection computes, by any method or operator, a member the model does not map, a constructor with arguments, a default field the initializer does not assign, or a nested path through anything but an initializer still leaves the query in its own order. A `Select`, or a `Filter` with `Selects`, composed on the guarded handle keeps the rest of the chain unordered, and a composed `Filter` that sent orders gets no default later in the chain, even when the policy dropped every one of them, as a composed `Order` already did not. See [Default order](#default-order).
+
+23. **Every Async Terminal Takes a `CancellationToken`**
+    Since 3.2.0 `ToListAsync` and `ToListAsyncDynamic` with a `Filter`, `ToListAsync` with a `Summary`, and `ToListAsync` with a `Segment` have overloads that take a `CancellationToken`, guarded and unguarded, and the token reaches the count and the read. The 3.1 signatures are unchanged, so code compiled against 3.1 still binds, but `ToListAsync(filter, default)`, `ToListAsyncDynamic(filter, default)` and `ToListAsync(summary, default)` no longer compile: `default` fits both `getQueryString` and the token (CS0121). Write `false`, a token, or a named argument. A reflection lookup of `ToListAsyncDynamic` by name alone now finds three methods where it found one, and one of `ToListAsync` finds more than it did. See [Cancellation](#cancellation).
+
+    Changed: `ToListAsyncDynamic` and the async `Summary` read through EF Core's `ToListAsync` instead of Dynamic LINQ's `ToDynamicListAsync`, which had no token to pass on, and the async `Summary` counts through `CountAsync` where it counted synchronously. So on an EF Core query a canceled token now reaches the database. The rows and the counts are the same. A provider that is not EF Core's keeps Dynamic LINQ's read, on the calling thread.
+
+24. **A Type in a Namespace That Starts with `System` Is Policed**
+    The attribute walker does not descend into the framework's own types, which carry no policy attributes. Until 3.2.0 it took any namespace whose name started with `System` for the framework's, so an application namespace such as `SystemsCorp.Payroll` or `SystemX.Domain` got no policy beneath its types, and a `[DwDenied]` field on such a type, reached through a member, was returned, filterable and sortable. Fixed (security): only `System` and the namespaces beneath it are the framework's now, so a guarded request that filtered on, sorted by or selected such a field is refused or dropped, as for any denied field.
+
 ---
 
 ## License
diff --git a/DynamicWhere.ex/DynamicWhere.ex.csproj b/DynamicWhere.ex/DynamicWhere.ex.csproj
index 370045a..80debba 100644
--- a/DynamicWhere.ex/DynamicWhere.ex.csproj
+++ b/DynamicWhere.ex/DynamicWhere.ex.csproj
@@ -34,21 +34,43 @@
   <PropertyGroup>
       <PackageId>DynamicWhere.ex</PackageId>
       <Title>DynamicWhere.ex — JSON-driven queries for EF Core</Title>
-      <Description>JSON-driven queries for Entity Framework Core. A powerful, versatile library for dynamically composing complex filter, sort, paginate, group, aggregate, and set-operation (Union / Intersect / Except) expressions — all driven by simple JSON objects from any front-end or API consumer. Three composable shapes (Filter / Segment / Summary), twenty-one extension methods, nested navigation through references and collections with auto-wrapped .Any() lambdas, heterogeneous Condition.Values with type-safe coercion, and a thread-safe reflection cache with five tuned presets (FIFO / LRU / LFU). Since 3.0 it also carries an opt-in field-level policy layer: attributes and runtime rules decide what each caller may filter, sort, select, group, aggregate and see, with masking, tokenization, forced predicates and a k-anonymity floor. Targets .NET 6+. Free Forever. Full reference, JSON cookbook, and tuning guide at https://doc.dynamicwhere.com.</Description>
+      <Description>JSON-driven queries for Entity Framework Core. A powerful, versatile library for dynamically composing complex filter, sort, paginate, group, aggregate, and set-operation (Union / Intersect / Except) expressions — all driven by simple JSON objects from any front-end or API consumer. Three composable shapes (Filter / Segment / Summary), twenty-eight extension methods, nested navigation through references and collections with auto-wrapped .Any() lambdas, heterogeneous Condition.Values with type-safe coercion, and a thread-safe reflection cache with five tuned presets (FIFO / LRU / LFU). Since 3.0 it also carries an opt-in field-level policy layer: attributes and runtime rules decide what each caller may filter, sort, select, group, aggregate and see, with masking, tokenization, forced predicates and a k-anonymity floor. Targets .NET 6+. Free Forever. Full reference, JSON cookbook, and tuning guide at https://doc.dynamicwhere.com.</Description>
       <Summary>Dynamic filters, sort, paginate, group, aggregate, and set operations for EF Core — driven by JSON.</Summary>
       <PackageTags>DynamicWhere DynamicWhere.ex EFCore EntityFrameworkCore EF-Core LINQ DynamicLinq Filter DynamicFilter JsonFilter Where OrderBy Paging Pagination GroupBy Aggregation Summary Segment Union Intersect Except SetOperations QueryBuilder Query Expression ExpressionTree Reflection Cache JSON Dynamic FieldLevelSecurity DataMasking Tokenization Anonymization KAnonymity Authorization RBAC ABAC Multitenancy DotNet NET6 NET7 NET8 NET9 NET10 CSharp</PackageTags>
       <Authors>Sajjad H. Al-Khafaji</Authors>
       <Company>Sajjad H. Al-Khafaji</Company>
       <Copyright>Free Forever — Copyright © Sajjad H. Al-Khafaji</Copyright>
       <PackageLicenseExpression>MIT</PackageLicenseExpression>
-      <Version>3.1.0</Version>
+      <Version>3.2.0</Version>
       <PackageProjectUrl>https://doc.dynamicwhere.com</PackageProjectUrl>
       <RepositoryType>git</RepositoryType>
       <RepositoryBranch>master</RepositoryBranch>
       <RepositoryUrl>https://github.com/Sajadh92/DynamicWhere.ex</RepositoryUrl>
       <PackageIcon>icon.png</PackageIcon>
       <PackageReadmeFile>README.md</PackageReadmeFile>
-      <PackageReleaseNotes>v3.1.0 — Date comparisons that work on every date member, segments combined in the database, five new caps, a stable code where a sentence used to be, preparation enforced whether or not a store is configured, a policy bypass through members named Root, It or Parent closed, a long In list that ended the process fixed, the names the expression parser keeps refused by name, a strict tier that no longer discloses its trace or which fields exist, forced predicates that can let rows with no value through, a declared default order for guarded queries, and refused queries written to the audit.
+      <PackageReleaseNotes>v3.2.0 — A row projected before ApplyPolicy keeps its nested objects and lists, denials the policy gate could not see are enforced, a declared default order reaches projected rows, and every asynchronous terminal takes a CancellationToken.
+
+Security fix: a field denied for Select only beneath a member was not enforced when the caller sent no Selects. A guarded query synthesizes a projection for a denied field, and it did so only when a simple field at the top of the type was denied. With every denial beneath a member, the whole row came back with the denied value in it: in a list or nested object of a row projected before ApplyPolicy, in a row held in memory, and in an entity's included, automatically included, lazily loaded or owned member, typed and dynamic, in both tiers, for a Filter and a Segment. Such a denial now synthesizes the projection whenever its value can reach the result. On an entity that means beneath a column, an owned or complex member, or a navigation the query loads through Include, an automatic include or a lazy loader; a denial beneath a navigation nothing loads never leaves the database, and the entity is read exactly as before.
+
+Security fix: what a query loads, and what a member holds, was read too narrowly. An include named from the root and reached through Select(o =&gt; o.Customer), SelectMany or Join, a projection behind another Select, an initializer after a constructor with arguments, and a lazy loader the constructor takes and keeps in a field or any property each loaded a denied value the gate read as unloaded. An injected DbContext and EF Core 7's asynchronous loader delegate loaded one too, and so did a reshaping lambda that got its row from an application's method or from a captured query or object. An application's own collection class hid its own denied members, and a guarded query through a provider wrapping EF Core's, such as LinqKit's AsExpandable, ran tracking, so the context filled in navigations it already held and a masked value became a pending change. A field a subtype declares, a derived entity's, a subclass's held by a base-typed member or an open generic one's, was not read at all, nor was a [DwDenied] on an override, on a member hidden with new or on an interface member's implementation, and under a "*" deny with exact allows a path the walk never asked about (past four segments, around a cycle, with no setter) resolved as allowed. Selects naming an entity navigation returned a denial in its owned chain past four segments or in a converted Dictionary&lt;string, T&gt; column. All of these are read now: from the EF Core model for an entity, so only what loads counts, and from every loaded subtype for a projected or in-memory row. Rows whose derived type declares a denied field come back as the queried type. A denial on an override, a public member hidden with new or an implementation, through a variant instantiation too, applies to the base type's or the interface's path, on every row and in every clause.
+
+Security fix: a field denied at the top of a type whose own type is not a simple value, such as a byte array, a list, an owned object or a JSON column, synthesized no projection either, so with nothing else denied it came back.
+
+Security fix: the attribute walker read any namespace starting with "System" as the framework's, so an application namespace such as SystemsCorp.Payroll got no policy beneath its types, and a [DwDenied] field there was returned, filterable and sortable. Only System and the namespaces beneath it are treated as the framework's now.
+
+Security fix: under the convenience tier, Selects naming a navigation whose element key (Id) is denied was narrowed to the allowed fields beneath it, and the core's typed projection added the key back. Such a narrowing is refused with FieldDeniedForSelect in both tiers, as naming a sibling of the key already was. A navigation named through another, such as Main.Lead, now gates the key of Main, which the projection adds; it did not.
+
+Security fix: Selects naming a member typed as a collection the core does not unwrap, such as IReadOnlyList&lt;T&gt;, returned every field beneath it, denied ones included, in both tiers. The projection gate read collections through a narrower list than the attribute walker that puts policy on the fields beneath; it now reads them the same way. Denials beneath a named member are also read from the policy's own rules, so a denied property with no setter and a rule on a path reached through a cycle are found, and a member carrying a field denied where no path reaches it, deeper than the walker, inside a framework collection such as Dictionary&lt;string, T&gt; or on a subtype, is refused under the strict tier, and under the convenience tier narrowed where the core can narrow it and refused where it cannot.
+
+Behaviour change: the projection synthesized for a guarded query that sends no Selects keeps what the source carries. It used to keep simple fields only, so every nested object and list of a row projected before ApplyPolicy came back null or empty as soon as any field was denied. A row a projection builds keeps the members its initializer assigns. An entity keeps its mapped columns, converted and JSON ones included except a converted one that can hold an object of any type, its owned and complex members, and every collection of simple values such as byte[] or List&lt;string&gt;. A member holding an object is kept whole when nothing it can hold is denied, narrowed to the allowed fields where the core's narrowing translates, and otherwise left out whole, recorded as Dropped with a reason starting "left out whole". An entity's navigations, the objects of a row in memory, and a value EF Core does not map are left out, and the type needs a public parameterless constructor for the typed projection, as it already did. A member that can hold an object of any type, a geometry or a JSON bag say, asks for no projection on its own; a member EF Core does not map is read as its type, since its getter can hand out what EF Core loaded; and a chain reaching its rows through a navigation, SelectMany, Join or GroupBy counts every navigation as loaded only when it has an include, or a lambda that builds an object, gets one from an application's method, or captures a query with its own include or projection.
+
+Behaviour change: [DwEntity(DefaultOrder)] applies to a projected source whose outermost Select builds the type in an object initializer and assigns every field the default names a column, at every level of a nested path: a mapped member read directly, through reference navigations or through EF.Property. A computed value or any other projection still leaves the query in its own order. A Select, or a Filter with Selects, composed on the guarded handle keeps the rest of the chain unordered, and a composed Filter that sent orders gets no default later in the chain, as a composed Order already did not.
+
+New: every asynchronous terminal has overloads taking a CancellationToken, guarded and unguarded: ToListAsync and ToListAsyncDynamic with a Filter, ToListAsync with a Summary, and ToListAsync with a Segment. The token reaches both the count and the read. The overloads sit beside the 3.1 signatures, which are unchanged, so code compiled against 3.1 still binds. ToListAsync(filter, default) no longer compiles, because default fits both overloads, and a reflection lookup of one of these methods by name alone finds more overloads than it did.
+
+Change: ToListAsyncDynamic and the asynchronous Summary read through EF Core's ToListAsync instead of Dynamic LINQ's ToDynamicListAsync, which had no token to pass on, and the Summary counts through CountAsync where it counted synchronously. So on an EF Core query a canceled token now reaches the database. A provider that is not EF Core's keeps Dynamic LINQ's read, on the calling thread.
+
+v3.1.0 — Date comparisons that work on every date member, segments combined in the database, five new caps, a stable code where a sentence used to be, preparation enforced whether or not a store is configured, a policy bypass through members named Root, It or Parent closed, a long In list that ended the process fixed, the names the expression parser keeps refused by name, a strict tier that no longer discloses its trace or which fields exist, forced predicates that can let rows with no value through, a declared default order for guarded queries, and refused queries written to the audit.
 
 Security fix: a member named Root, It or Parent was read as a System.Linq.Dynamic.Core keyword. Root.Name and It.Name filtered, sorted, grouped, aggregated and projected the row's own Name, Parent threw, and an alias named root, it or parent failed in Having and Summary orders. Under ApplyPolicy the gate decided on the path the caller named while the query read the row's own column: a dynamic projection of Root.Name returned a [DwDenied] Name, a filter on it tested the denied column, and a [DwForceWhere] scope reached through such a navigation filtered the row's own column. Every expression is now parsed with a library-owned ParsingConfig with the context keywords off. ParsingConfig.Default is no longer read, so a host's changes to it no longer reach DynamicWhere queries.
 
diff --git a/DynamicWhere.ex/Policies/DTOs/PolicyTrace.cs b/DynamicWhere.ex/Policies/DTOs/PolicyTrace.cs
index ae88f09..4f5dd44 100644
--- a/DynamicWhere.ex/Policies/DTOs/PolicyTrace.cs
+++ b/DynamicWhere.ex/Policies/DTOs/PolicyTrace.cs
@@ -64,6 +64,15 @@ public void Add(PolicyDecision decision)
         _decisions.Add(decision);
     }
 
+    /// <summary>How many decisions have been recorded.</summary>
+    internal int Count => _decisions.Count;
+
+    /// <summary>
+    /// Withdraws every decision recorded after the first <paramref name="count"/>: the steps of an action
+    /// that was then not taken, such as members left out of a projection that is not built.
+    /// </summary>
+    internal void Withdraw(int count) => _decisions.RemoveRange(count, _decisions.Count - count);
+
     /// <summary>Remembers that the caller reached a canonical path by writing another name.</summary>
     internal void RecordSpelling(string canonicalPath, string spoken) => _spoken[canonicalPath] = spoken;
 
diff --git a/DynamicWhere.ex/Policies/Resolution/AttributePolicyProvider.cs b/DynamicWhere.ex/Policies/Resolution/AttributePolicyProvider.cs
index 77a409d..f1c0730 100644
--- a/DynamicWhere.ex/Policies/Resolution/AttributePolicyProvider.cs
+++ b/DynamicWhere.ex/Policies/Resolution/AttributePolicyProvider.cs
@@ -6,6 +6,7 @@
 using DynamicWhere.ex.Policies.Context;
 using DynamicWhere.ex.Policies.DTOs;
 using DynamicWhere.ex.Policies.Enums;
+using DynamicWhere.ex.Policies.Source;
 
 namespace DynamicWhere.ex.Policies.Resolution;
 
@@ -13,7 +14,8 @@ namespace DynamicWhere.ex.Policies.Resolution;
 /// Produces policy fragments by reflecting over the attributes on a type.
 /// </summary>
 /// <remarks>
-/// The result is identical for every caller, so it is computed once per type and cached. An
+/// The result is identical for every caller, so it is computed once per type and cached, until an
+/// assembly that could declare a subtype loads (see the denials below). An
 /// attribute with <c>Overridable = false</c> lands at <see cref="PolicyLevel.SealedAttribute"/> and
 /// nothing at runtime can replace it; one with <c>Overridable = true</c> lands at
 /// <see cref="PolicyLevel.OverridableAttribute"/>, the least authoritative level, and acts only as
@@ -21,7 +23,7 @@ namespace DynamicWhere.ex.Policies.Resolution;
 /// </remarks>
 public sealed class AttributePolicyProvider : IDwPolicyProvider
 {
-    private static readonly ConcurrentDictionary<Type, IReadOnlyList<PolicyFragment>> Cache = new();
+    private static readonly ConcurrentDictionary<Type, (int Epoch, IReadOnlyList<PolicyFragment> Fragments)> Cache = new();
 
     /// <summary>
     /// How many navigation segments a generated field path may contain. Matches the default
@@ -38,7 +40,19 @@ public IReadOnlyList<PolicyFragment> GetFragments(Type entityType, DwPolicyConte
             throw new ArgumentNullException(nameof(entityType));
         }
 
-        return Cache.GetOrAdd(entityType, Build);
+        int epoch = KnownSubtypes.Epoch;
+
+        if (Cache.TryGetValue(entityType, out (int Epoch, IReadOnlyList<PolicyFragment> Fragments) known)
+            && known.Epoch == epoch)
+        {
+            return known.Fragments;
+        }
+
+        IReadOnlyList<PolicyFragment> fragments = Build(entityType);
+
+        Cache[entityType] = (epoch, fragments);
+
+        return fragments;
     }
 
     /// <summary>
@@ -107,6 +121,11 @@ private static void Walk(
                 fragments.Add(ToFragment(path, attribute));
             }
 
+            foreach (DwDenyAttribute attribute in DenialsElsewhere(type, property))
+            {
+                fragments.Add(ToFragment(path, attribute));
+            }
+
             foreach (DwOperatorsAttribute attribute in property.GetCustomAttributes<DwOperatorsAttribute>(inherit: true))
             {
                 fragments.Add(ToFragment(path, attribute));
@@ -180,6 +199,224 @@ private static void Walk(
         }
     }
 
+    /// <summary>
+    /// The denials a member carries from another declaration of it: an interface member it implements,
+    /// and, in a type loaded below the one walked, the override, the member hidden with <c>new</c>, or the
+    /// implementation that a row of that type runs.
+    /// </summary>
+    /// <remarks>
+    /// Attributes are read from the declaration walked, and inheritance only reaches up the chain. A row
+    /// read through a base type or an interface is still the subtype it is, though, and its member returns
+    /// what the subtype's declaration returns: a <c>[DwDenied]</c> on <c>override Code</c>, or on the
+    /// class's implementation of <c>IAccount.Iban</c>, was never seen through the base path, which filtered,
+    /// sorted, grouped and returned it. Each such denial applies to the path for every row, since a
+    /// projection cannot withhold a field from some rows only.
+    /// <para>
+    /// Every declaration a row can run counts: an override of either accessor, an implementation declared
+    /// explicitly, inherited from a base class or by an open generic class, and an interface a subtype adds
+    /// over a member it inherits. So does a member a subtype hides with <c>new</c>: whether it reads the
+    /// member it hides cannot be told from outside, and a row serialized as its own type writes it under the
+    /// same name.
+    /// </para>
+    /// </remarks>
+    internal static IReadOnlyList<DwDenyAttribute> DenialsElsewhere(Type type, PropertyInfo property)
+    {
+        int epoch = KnownSubtypes.Epoch;
+
+        if (Elsewhere.TryGetValue((type, property), out (int Epoch, DwDenyAttribute[] Denials) known) && known.Epoch == epoch)
+        {
+            return known.Denials;
+        }
+
+        DwDenyAttribute[] denials = ReadDenialsElsewhere(type, property).ToArray();
+
+        Elsewhere[(type, property)] = (epoch, denials);
+
+        return denials;
+    }
+
+    /// <summary>The denials of each member's other declarations, read once for each type and member until another assembly loads.</summary>
+    private static readonly ConcurrentDictionary<(Type Type, PropertyInfo Property), (int Epoch, DwDenyAttribute[] Denials)> Elsewhere = new();
+
+    private static IEnumerable<DwDenyAttribute> ReadDenialsElsewhere(Type type, PropertyInfo property)
+    {
+        MethodInfo[] accessors = property.GetAccessors(nonPublic: true);
+
+        if (accessors.Length == 0)
+        {
+            yield break;
+        }
+
+        // Many rows reach one declaration, an interface every subtype implements, and it is read once.
+        HashSet<PropertyInfo> read = new() { property };
+
+        foreach (Type row in KnownSubtypes.Of(type).Prepend(type))
+        {
+            if (row.IsInterface)
+            {
+                continue;
+            }
+
+            // What a row of this type runs for the member: the member, or what the row declares in its
+            // place; read through an interface, the row's implementation of it.
+            List<MethodInfo> runs = new();
+
+            if (type.IsInterface)
+            {
+                foreach (PropertyInfo implementation in Implementations(row, type, accessors))
+                {
+                    runs.AddRange(implementation.GetAccessors(nonPublic: true));
+
+                    if (read.Add(implementation))
+                    {
+                        foreach (DwDenyAttribute attribute in implementation.GetCustomAttributes<DwDenyAttribute>(inherit: true))
+                        {
+                            yield return attribute;
+                        }
+                    }
+                }
+            }
+            else
+            {
+                runs.AddRange(accessors);
+
+                if (row != type)
+                {
+                    foreach (PropertyInfo below in Redeclarations(row, property))
+                    {
+                        runs.AddRange(below.GetAccessors(nonPublic: true));
+
+                        if (read.Add(below))
+                        {
+                            foreach (DwDenyAttribute attribute in below.GetCustomAttributes<DwDenyAttribute>(inherit: false))
+                            {
+                                yield return attribute;
+                            }
+                        }
+                    }
+                }
+            }
+
+            foreach (PropertyInfo declared in Declarations(row, runs, accessors))
+            {
+                if (read.Add(declared))
+                {
+                    foreach (DwDenyAttribute attribute in declared.GetCustomAttributes<DwDenyAttribute>(inherit: false))
+                    {
+                        yield return attribute;
+                    }
+                }
+            }
+        }
+    }
+
+    /// <summary>
+    /// What a subtype declares in a member's place: an override of either accessor, or a public member of the
+    /// same name that hides it. Both carry the member's name. One the subtype keeps to itself hides nothing a
+    /// caller reads, and no serializer writes it.
+    /// </summary>
+    private static IEnumerable<PropertyInfo> Redeclarations(Type subtype, PropertyInfo property) =>
+        subtype
+            .GetProperties(BindingFlags.Public | BindingFlags.Instance | BindingFlags.DeclaredOnly)
+            .Where(candidate => candidate.Name == property.Name);
+
+    /// <summary>
+    /// The properties a class implements an interface's member with: through the interface itself, through an
+    /// instantiation variance lets stand for it, IFeed&lt;VisaCard&gt; for IFeed&lt;Card&gt; with <c>out T</c>, and, for
+    /// a class that is itself open generic, through one over its own type parameters, which may be any.
+    /// </summary>
+    private static IEnumerable<PropertyInfo> Implementations(Type row, Type contract, MethodInfo[] accessors)
+    {
+        List<PropertyInfo> found = new();
+
+        foreach (Type implemented in row.GetInterfaces())
+        {
+            bool same = implemented == contract
+                        || (implemented.IsGenericType && contract.IsGenericType
+                            && implemented.GetGenericTypeDefinition() == contract.GetGenericTypeDefinition()
+                            && (implemented.ContainsGenericParameters || contract.ContainsGenericParameters
+                                || contract.IsAssignableFrom(implemented)));
+
+            if (!same || Map(row, implemented) is not { } map)
+            {
+                continue;
+            }
+
+            for (int i = 0; i < map.InterfaceMethods.Length; i++)
+            {
+                if (accessors.Any(accessor => Same(map.InterfaceMethods[i], accessor))
+                    && Declaring(map.TargetMethods[i]) is { } implementation
+                    && !found.Contains(implementation))
+                {
+                    found.Add(implementation);
+                }
+            }
+        }
+
+        return found;
+    }
+
+    /// <summary>
+    /// The interface properties a class implements with any of the accessors it runs, other than the member
+    /// walked itself.
+    /// </summary>
+    private static IEnumerable<PropertyInfo> Declarations(Type row, List<MethodInfo> runs, MethodInfo[] own)
+    {
+        MethodInfo[] roots = runs.Select(accessor => accessor.GetBaseDefinition()).ToArray();
+        List<PropertyInfo> found = new();
+
+        foreach (Type contract in row.GetInterfaces())
+        {
+            if (Map(row, contract) is not { } map)
+            {
+                continue;
+            }
+
+            for (int i = 0; i < map.TargetMethods.Length; i++)
+            {
+                MethodInfo declared = map.InterfaceMethods[i];
+
+                if (roots.Any(root => Same(map.TargetMethods[i].GetBaseDefinition(), root))
+                    && !own.Any(accessor => Same(accessor, declared))
+                    && Declaring(declared) is { } property
+                    && !found.Contains(property))
+                {
+                    found.Add(property);
+                }
+            }
+        }
+
+        return found;
+    }
+
+    /// <summary>
+    /// A class's interface map, or null when the runtime cannot map it, as for some open generic types.
+    /// Read once for each class and interface.
+    /// </summary>
+    private static InterfaceMapping? Map(Type type, Type contract) =>
+        Maps.GetOrAdd((type, contract), static key =>
+        {
+            try
+            {
+                return key.Type.GetInterfaceMap(key.Contract);
+            }
+            catch (Exception exception) when (exception is ArgumentException or InvalidOperationException or NotSupportedException)
+            {
+                return null;
+            }
+        });
+
+    private static readonly ConcurrentDictionary<(Type Type, Type Contract), InterfaceMapping?> Maps = new();
+
+    /// <summary>The property an accessor belongs to, found on the type that declares the accessor.</summary>
+    private static PropertyInfo? Declaring(MethodInfo accessor) =>
+        accessor.DeclaringType?
+            .GetProperties(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.DeclaredOnly)
+            .FirstOrDefault(candidate => candidate.GetAccessors(nonPublic: true).Any(method => Same(method, accessor)));
+
+    private static bool Same(MethodInfo left, MethodInfo right) =>
+        left.MetadataToken == right.MetadataToken && left.Module == right.Module;
+
     /// <summary>
     /// How many collection layers <see cref="NavigationTypeOf"/> peels off a single property type
     /// before it stops and walks whatever it has reached.
@@ -217,7 +454,20 @@ private static void Walk(
     /// followed as well as classes, because these attributes are supported on DTOs, where an
     /// <c>IContact</c> reference or a record struct is ordinary.
     /// </remarks>
-    internal static Type? NavigationTypeOf(Type propertyType)
+    internal static Type? NavigationTypeOf(Type propertyType) => AsNavigation(Peeled(propertyType));
+
+    /// <summary>
+    /// The type a property holds once every collection layer and <see cref="Nullable{T}"/> is peeled
+    /// off: <c>LineDto</c> for <c>IReadOnlyList&lt;LineDto&gt;</c>, <see cref="string"/> for
+    /// <c>List&lt;string&gt;</c>, and the property's own type when it is not a collection.
+    /// </summary>
+    /// <remarks>
+    /// The one reading of a property's shape that the walker and the projection gate share. The gate
+    /// once read collections through a narrower list of its own, and a member typed
+    /// <c>IReadOnlyList&lt;T&gt;</c> hid every denial beneath it from the projection while the walker
+    /// had put a fragment on each of them.
+    /// </remarks>
+    internal static Type Peeled(Type propertyType)
     {
         Type current = Nullable.GetUnderlyingType(propertyType) ?? propertyType;
 
@@ -233,7 +483,32 @@ private static void Walk(
             current = Nullable.GetUnderlyingType(element) ?? element;
         }
 
-        return AsNavigation(current);
+        return current;
+    }
+
+    /// <summary>
+    /// The type a property holds, then each collection layer beneath it, down to the element
+    /// <see cref="Peeled"/> reaches: <c>List&lt;Tags&gt;</c>, then <c>Tags</c>, then <see cref="string"/>.
+    /// </summary>
+    internal static IEnumerable<Type> Layers(Type propertyType)
+    {
+        Type current = Nullable.GetUnderlyingType(propertyType) ?? propertyType;
+
+        yield return current;
+
+        for (int layer = 0; layer < MaxCollectionLayers; layer++)
+        {
+            Type? element = ElementTypeOf(current);
+
+            if (element is null)
+            {
+                yield break;
+            }
+
+            current = Nullable.GetUnderlyingType(element) ?? element;
+
+            yield return current;
+        }
     }
 
     /// <summary>
@@ -296,9 +571,22 @@ private static void Walk(
             return null;
         }
 
-        return type.Namespace?.StartsWith("System", StringComparison.Ordinal) == true ? null : type;
+        return IsFramework(type) ? null : type;
     }
 
+    /// <summary>
+    /// True for a type the framework declares: one in the <c>System</c> namespace or beneath it.
+    /// </summary>
+    /// <remarks>
+    /// The namespace is compared as a whole segment. A prefix match took an application's own
+    /// <c>SystemsCorp.Payroll</c> or <c>SystemX.Domain</c> for the framework, so nothing beneath one of
+    /// its types got a fragment, and a <c>[DwDenied]</c> field there was returned and filtered on as
+    /// though it carried no policy.
+    /// </remarks>
+    internal static bool IsFramework(Type type) =>
+        type.Namespace is { } name
+        && (name == "System" || name.StartsWith("System.", StringComparison.Ordinal));
+
     /// <summary>
     /// Converts one attribute into a fragment at the level its <c>Overridable</c> flag implies.
     /// </summary>
diff --git a/DynamicWhere.ex/Policies/Resolution/PolicyResolver.cs b/DynamicWhere.ex/Policies/Resolution/PolicyResolver.cs
index 53fd442..c5be3b3 100644
--- a/DynamicWhere.ex/Policies/Resolution/PolicyResolver.cs
+++ b/DynamicWhere.ex/Policies/Resolution/PolicyResolver.cs
@@ -373,6 +373,19 @@ public TypePolicy ResolveType(Type entityType, DwPolicyContext context)
         return new TypePolicy(aliases, forced, required, transforms);
     }
 
+    /// <summary>
+    /// Every fragment every provider has for a type and caller, in one list.
+    /// </summary>
+    /// <remarks>
+    /// For the projection gate, which asks whether anything beneath a member is denied. A fragment
+    /// matches a path exactly or matches every path, so the paths these fragments name, and the
+    /// wildcard, are every place a denial can land. Walking the type instead missed the paths a walk
+    /// does not produce: a property with no setter, a type reached again through a cycle, a rule on a
+    /// path deeper than the walk goes.
+    /// </remarks>
+    internal IReadOnlyList<PolicyFragment> Fragments(Type entityType, DwPolicyContext context) =>
+        Sweep(entityType, context).ToList();
+
     /// <summary>
     /// Reads every fragment every provider has for a type, refusing a provider that misbehaves.
     /// </summary>
diff --git a/DynamicWhere.ex/Policies/Source/DefaultOrder.cs b/DynamicWhere.ex/Policies/Source/DefaultOrder.cs
index f2061e6..8884656 100644
--- a/DynamicWhere.ex/Policies/Source/DefaultOrder.cs
+++ b/DynamicWhere.ex/Policies/Source/DefaultOrder.cs
@@ -7,6 +7,8 @@
 using DynamicWhere.ex.Optimization.Cache.Source;
 using DynamicWhere.ex.Policies.Attributes;
 using DynamicWhere.ex.Source;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata;
 
 namespace DynamicWhere.ex.Policies.Source;
 
@@ -86,21 +88,86 @@ or nameof(Queryable.ThenBy) or nameof(Queryable.ThenByDescending))
     }
 
     /// <summary>
-    /// True when a query's rows are a projection made somewhere along the chain that produced it.
+    /// True when a query's rows are built by a projection: the outermost <c>Select</c> of the chain
+    /// constructs each row, in an initializer or with a constructor, so every member holds what the
+    /// projection gave it.
     /// </summary>
     /// <remarks>
-    /// A default names fields of the type, and a projection keeps only the members it assigns, so a
-    /// default ordering it could reach for a member the projection left out and fail to translate:
-    /// <c>Select(["Id", "Title"]).Page(...)</c> on a type ordered by <c>Priority</c> worked before the
-    /// default existed. Such a query is left in whatever order it had.
+    /// A <c>Select</c> that hands back an entity, <c>Select(o =&gt; o.Customer)</c>, builds nothing: its
+    /// rows are entities as EF Core loads them, whose navigations hold a value only when something
+    /// includes them. This answers what the rows are, not whether a default can be applied to them,
+    /// which <see cref="HidesDefault"/> answers.
     /// </remarks>
-    internal static bool IsProjected(Expression expression)
+    internal static bool BuildsRows(Expression expression) =>
+        RowSelect(expression) is { } select
+        && StripQuotes(select.Arguments[1]) is LambdaExpression selector
+        && StripConversions(selector.Body) is MemberInitExpression or NewExpression;
+
+    /// <summary>
+    /// The <c>Select</c> that makes a query's rows: the outermost one, when every call after it hands back
+    /// the rows it was given. Null when nothing projects the rows, or when a call such as a
+    /// <c>SelectMany</c> or a <c>Join</c> reaches the rows through it, so that its members are not theirs.
+    /// </summary>
+    internal static MethodCallExpression? RowSelect(Expression expression)
     {
         for (Expression? node = expression; node is MethodCallExpression call;
              node = call.Arguments.Count > 0 ? call.Arguments[0] : null)
         {
             if ((call.Method.DeclaringType == typeof(Queryable) || call.Method.DeclaringType == typeof(Enumerable))
                 && call.Method.Name == nameof(Queryable.Select))
+            {
+                return call;
+            }
+
+            if (!QueryRoot.KeepsRows(call))
+            {
+                return null;
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// True when a projection along the chain could have left out a field the type's default names.
+    /// </summary>
+    /// <remarks>
+    /// A default names fields of the type, and a projection keeps only the members it assigns, so a
+    /// default ordering one it could reach for a member the projection left out and fail to translate:
+    /// <c>Select(["Id", "Title"]).Page(...)</c> on a type ordered by <c>Priority</c> worked before the
+    /// default existed.
+    /// <para>
+    /// Only the outermost projection is read, because it makes the rows the default orders. It hides
+    /// nothing when it builds the type itself in an initializer — <c>new Row { Code = t.Code }</c> —
+    /// and assigns every field the default names, at every level of a nested path, a column of the
+    /// entity it reads on EF Core. EF Core can then translate the order. Anything else, a constructor
+    /// with arguments, a member it does not assign, a value it computes or a nested path through
+    /// something other than an initializer, leaves the query in whatever order it had.
+    /// </para>
+    /// </remarks>
+    internal static bool HidesDefault(Expression expression, Type type)
+    {
+        if (OutermostSelect(expression) is not { } select)
+        {
+            return false;
+        }
+
+        if (StripQuotes(select.Arguments[1]) is not LambdaExpression selector
+            || StripConversions(selector.Body) is not MemberInitExpression initializer
+            || !type.IsAssignableFrom(initializer.Type))
+        {
+            return true;
+        }
+
+        // On EF Core a default field must be a column the database can order by. In memory anything can
+        // be ordered.
+        ColumnReader? columns = QueryRoot.Model(expression) is { } model
+            ? new ColumnReader(selector.Parameters[0], model.FindEntityType(selector.Parameters[0].Type))
+            : null;
+
+        foreach (Entry entry in For(type))
+        {
+            if (!Assigns(initializer.Bindings, entry.Field.Split('.'), 0, columns))
             {
                 return true;
             }
@@ -109,11 +176,131 @@ internal static bool IsProjected(Expression expression)
         return false;
     }
 
+    /// <summary>The <c>Select</c> nearest the end of the chain, or null when nothing projects it.</summary>
+    internal static MethodCallExpression? OutermostSelect(Expression expression)
+    {
+        for (Expression? node = expression; node is MethodCallExpression call;
+             node = call.Arguments.Count > 0 ? call.Arguments[0] : null)
+        {
+            if ((call.Method.DeclaringType == typeof(Queryable) || call.Method.DeclaringType == typeof(Enumerable))
+                && call.Method.Name == nameof(Queryable.Select))
+            {
+                return call;
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>True when the bindings assign the path, following nested initializers down it.</summary>
+    private static bool Assigns(IEnumerable<MemberBinding> bindings, string[] path, int depth, ColumnReader? columns)
+    {
+        MemberBinding? binding = bindings.FirstOrDefault(
+            candidate => string.Equals(candidate.Member.Name, path[depth], StringComparison.Ordinal));
+
+        if (binding is null)
+        {
+            return false;
+        }
+
+        if (depth == path.Length - 1)
+        {
+            return binding is MemberAssignment { Expression: var assigned }
+                && (columns is null || columns.Column(assigned));
+        }
+
+        return binding switch
+        {
+            MemberAssignment { Expression: var assigned }
+                when StripConversions(assigned) is MemberInitExpression nested =>
+                Assigns(nested.Bindings, path, depth + 1, columns),
+            MemberMemberBinding nested => Assigns(nested.Bindings, path, depth + 1, columns),
+            _ => false
+        };
+    }
+
+    /// <summary>
+    /// Reads whether EF Core can order by what a projection assigns: a column of the entity the
+    /// projection reads, directly, through reference navigations, or through <c>EF.Property</c>.
+    /// </summary>
+    /// <remarks>
+    /// An assigned field is not enough on its own. <c>Label = Decorate(r.Code)</c> assigns the field the
+    /// default names, and EF Core evaluates the application's own method on the client, where it can
+    /// project the value but cannot order by it; so it does <c>Regex.Replace</c>, a member the model does
+    /// not map, and any number of framework methods a given provider cannot translate. Anything but a
+    /// column is therefore left out of the default, as the projection left the query unordered before:
+    /// a default must never be the reason a query that ran unguarded fails.
+    /// </remarks>
+    private sealed class ColumnReader
+    {
+        private readonly ParameterExpression _row;
+        private readonly IEntityType? _source;
+
+        internal ColumnReader(ParameterExpression row, IEntityType? source)
+        {
+            _row = row;
+            _source = source;
+        }
+
+        /// <summary>True when the expression reads one column the model maps.</summary>
+        internal bool Column(Expression expression)
+        {
+            expression = StripConversions(expression);
+
+            return Read(expression) is ({ } owner, { } name) && owner.FindProperty(name) is not null;
+        }
+
+        /// <summary>The entity a navigation expression reaches, through reference navigations only.</summary>
+        private IEntityType? EntityOf(Expression expression)
+        {
+            expression = StripConversions(expression);
+
+            if (expression == _row)
+            {
+                return _source;
+            }
+
+            // A reference, read the way EF Core 6 reads IsCollection: the property that moved in EF Core 8
+            // is not bound, so the check holds on either.
+            return Read(expression) is ({ } owner, { } name)
+                   && owner.FindNavigation(name) is { } navigation
+                   && (navigation.IsOnDependent || navigation.ForeignKey.IsUnique)
+                ? navigation.TargetEntityType
+                : null;
+        }
+
+        /// <summary>The entity a member read is made on, and the member's name.</summary>
+        private (IEntityType? Owner, string? Name) Read(Expression expression) => expression switch
+        {
+            MemberExpression { Member: PropertyInfo property, Expression: { } owner } =>
+                (EntityOf(owner), property.Name),
+            MethodCallExpression { Method.Name: nameof(EF.Property) } call
+                when call.Method.DeclaringType == typeof(EF)
+                     && call.Arguments[1] is ConstantExpression { Value: string name } =>
+                (EntityOf(call.Arguments[0]), name),
+            _ => (null, null)
+        };
+    }
+
+    internal static Expression StripQuotes(Expression expression) =>
+        expression is UnaryExpression { NodeType: ExpressionType.Quote } quote ? quote.Operand : expression;
+
+    internal static Expression StripConversions(Expression expression)
+    {
+        while (expression is UnaryExpression { NodeType: ExpressionType.Convert or ExpressionType.TypeAs } conversion)
+        {
+            expression = conversion.Operand;
+        }
+
+        return expression;
+    }
+
     /// <summary>
     /// True when a guarded query over this source takes the type's default: nothing has ordered it and
-    /// nothing has projected it.
+    /// no projection hides a field the default names.
     /// </summary>
-    internal static bool Applies(Expression expression) => !IsOrdered(expression) && !IsProjected(expression);
+    internal static bool Applies(Expression expression, Type type) =>
+        !IsOrdered(expression) && !HidesDefault(expression, type);
 
     /// <summary>
     /// Everything wrong with a type's declared default: entries that cannot be read, fields no query can
diff --git a/DynamicWhere.ex/Policies/Source/FilterSanitizer.cs b/DynamicWhere.ex/Policies/Source/FilterSanitizer.cs
index 189e7d0..ede7cac 100644
--- a/DynamicWhere.ex/Policies/Source/FilterSanitizer.cs
+++ b/DynamicWhere.ex/Policies/Source/FilterSanitizer.cs
@@ -1,9 +1,12 @@
-using System.Reflection;
+using System.Collections;
+using System.Collections.Concurrent;
+using System.Reflection;
 using DynamicWhere.ex.Classes.Complex;
 using DynamicWhere.ex.Classes.Core;
 using DynamicWhere.ex.Enums;
 using DynamicWhere.ex.Exceptions;
 using DynamicWhere.ex.Optimization.Cache.Source;
+using DynamicWhere.ex.Policies.Attributes;
 using DynamicWhere.ex.Policies.Audit;
 using DynamicWhere.ex.Policies.Config;
 using DynamicWhere.ex.Policies.Context;
@@ -58,6 +61,10 @@ internal static class FilterSanitizer
     /// field this caller may not order by. False for a clause composed on its own, which orders
     /// nothing the caller did not ask it to.
     /// </param>
+    /// <param name="rows">
+    /// What the query's source puts in the members of its rows, which decides what a synthesized
+    /// projection keeps. Null for an entity query whose model is unknown.
+    /// </param>
     /// <returns>A sanitized copy, safe to hand to the existing pipeline.</returns>
     /// <exception cref="ArgumentNullException">Thrown when any argument is null.</exception>
     /// <exception cref="LogicException">
@@ -75,7 +82,8 @@ internal static Filter Sanitize<T>(
         DwPolicyOptions options,
         PolicyTrace trace,
         bool synthesizeProjection = true,
-        bool applyDefaultOrder = true)
+        bool applyDefaultOrder = true,
+        RowShape? rows = null)
         where T : class
     {
         if (filter is null)
@@ -141,7 +149,7 @@ internal static Filter Sanitize<T>(
             working.Orders = defaults;
         }
 
-        GateSelects(working, gate, synthesizeProjection);
+        GateSelects(working, gate, synthesizeProjection, rows ?? RowShape.Unknown);
 
         // The strict tier checks the bill once every field has passed its gate. It drops nothing, so a
         // request still here names no field the caller may not use, and a weighted field the caller may
@@ -610,6 +618,10 @@ private static void GateSummaryOrders(
     /// When true and the caller sent no orders, the type's declared default order is added, less every
     /// field this caller may not order by.
     /// </param>
+    /// <param name="rows">
+    /// What the query's source puts in the members of its rows, which decides what a synthesized
+    /// projection keeps. Null for an entity query whose model is unknown.
+    /// </param>
     /// <remarks>
     /// Every condition set is gated independently, because each one becomes its own subquery and a
     /// field refused in one must not be reachable through another.
@@ -626,7 +638,8 @@ internal static Segment Sanitize<T>(
         DwPolicyContext context,
         DwPolicyOptions options,
         PolicyTrace trace,
-        bool applyDefaultOrder = true)
+        bool applyDefaultOrder = true,
+        RowShape? rows = null)
         where T : class
     {
         if (segment is null)
@@ -720,7 +733,7 @@ internal static Segment Sanitize<T>(
             working.Orders = defaults;
         }
 
-        GateSegmentSelects(working, gate);
+        GateSegmentSelects(working, gate, rows ?? RowShape.Unknown);
 
         // The strict tier checks the bill once every field has passed its gate. It drops nothing, so a
         // request still here names no field the caller may not use, and a weighted field the caller may
@@ -964,11 +977,11 @@ private static void GateSegmentOrders(Segment segment, Gate gate)
     /// materializes.
     /// </para>
     /// </remarks>
-    private static void GateSegmentSelects(Segment segment, Gate gate)
+    private static void GateSegmentSelects(Segment segment, Gate gate, RowShape rows)
     {
         if (segment.Selects is null || segment.Selects.Count == 0)
         {
-            if (SynthesizedProjection(gate) is List<string> synthesized)
+            if (SynthesizedProjection(gate, rows) is List<string> synthesized)
             {
                 segment.Selects = synthesized;
             }
@@ -976,7 +989,7 @@ private static void GateSegmentSelects(Segment segment, Gate gate)
             return;
         }
 
-        List<string> kept = GateProjection(segment.Selects, gate);
+        List<string> kept = GateProjection(segment.Selects, gate, rows);
 
         if (kept.Count == 0)
         {
@@ -1604,7 +1617,7 @@ private static List<OrderBy> DefaultOrders<T>(Gate gate, bool segment = false) w
     /// entity — turning the strictest possible policy into the widest possible result.
     /// </para>
     /// </remarks>
-    private static void GateSelects(Filter filter, Gate gate, bool synthesize)
+    private static void GateSelects(Filter filter, Gate gate, bool synthesize, RowShape rows)
     {
         if (filter.Selects is null || filter.Selects.Count == 0)
         {
@@ -1613,13 +1626,13 @@ private static void GateSelects(Filter filter, Gate gate, bool synthesize)
             // refuse the call outright on a type whose every field is denied for select.
             if (synthesize)
             {
-                SynthesizeSelects(filter, gate);
+                SynthesizeSelects(filter, gate, rows);
             }
 
             return;
         }
 
-        List<string> kept = GateProjection(filter.Selects, gate);
+        List<string> kept = GateProjection(filter.Selects, gate, rows);
 
         if (kept.Count == 0)
         {
@@ -1644,8 +1657,14 @@ private static void GateSelects(Filter filter, Gate gate, bool synthesize)
     /// expansion happens only where there is something to narrow, so a type the policy has no
     /// opinion about still generates the SQL the unguarded path would.
     /// </para>
+    /// <para>
+    /// A narrowing the core cannot build as written is refused rather than handed over. The builder
+    /// adds the key of every node it narrows, so dropping a denied key from the list put it straight
+    /// back; and a path through a collection the core does not unwrap, such as an
+    /// <c>IReadOnlyList&lt;T&gt;</c>, failed validation with an error about the caller's field names.
+    /// </para>
     /// </remarks>
-    private static List<string> GateProjection(IEnumerable<string> selects, Gate gate)
+    private static List<string> GateProjection(IEnumerable<string> selects, Gate gate, RowShape rows)
     {
         List<string> kept = new();
 
@@ -1657,19 +1676,14 @@ void Keep(string path)
             }
         }
 
-        bool Allowed(string path)
-        {
-            FieldPolicy policy = gate.PolicyFor(path, PolicyFeature.Select);
-
-            return policy.Allows(PolicyFeature.Select)
-                || !gate.Refuse(path, PolicyFeature.Select, PolicyErrorCode.FieldDeniedForSelect, policy);
-        }
-
         foreach (string field in selects)
         {
             // The field's own decision first. A navigation that is itself denied is refused as it
             // stands; what it carries is only asked about once it has survived on its own account.
-            if (!Allowed(field))
+            FieldPolicy own = gate.PolicyFor(field, PolicyFeature.Select);
+
+            if (!own.Allows(PolicyFeature.Select)
+                && gate.Refuse(field, PolicyFeature.Select, PolicyErrorCode.FieldDeniedForSelect, own))
             {
                 continue;
             }
@@ -1682,30 +1696,92 @@ bool Allowed(string path)
                 continue;
             }
 
-            IReadOnlyList<string> carried = gate.ProjectionUnder(field);
-            List<string> survivors = new(carried.Count);
-            bool narrowed = false;
+            (List<string> survivors, List<(string Path, FieldPolicy Policy)> denied) =
+                gate.Beneath(field, PolicyFeature.Select);
+
+            // Each denied path, as a denial beneath a named navigation always was: refused under the
+            // strict tier, dropped from the narrowing otherwise, left in place in a dry run.
+            (string Path, FieldPolicy Policy)? cause = null;
 
-            foreach (string path in carried)
+            foreach ((string path, FieldPolicy policy) in denied)
             {
-                if (Allowed(path))
-                {
-                    survivors.Add(path);
-                }
-                else
+                if (gate.Refuse(path, PolicyFeature.Select, PolicyErrorCode.FieldDeniedForSelect, policy))
                 {
-                    narrowed = true;
+                    cause ??= (path, policy);
                 }
             }
 
-            if (!narrowed)
+            // A member can carry a denied field no path names: beyond the walker's depth, inside a
+            // framework collection, declared by a subtype, or, under a policy that denies whatever it
+            // does not name, anywhere the walk does not reach. On an entity, only what loads counts.
+            bool hidden = cause is null
+                          && gate.Unnamed(field, rows).DeniesSelect
+                          && gate.RefuseHidden(field);
+
+            if (cause is null && !hidden && !gate.ReadOnlyTransformBeneath(field))
             {
                 Keep(field);
 
+                // Kept whole, a navigation reached through others still passes through their nodes, and
+                // the builder adds each one's key.
+                KeepCarriedKeys(field, gate, Keep);
+
+                continue;
+            }
+
+            (string Path, FieldPolicy? Policy) blame = cause is { } found ? (found.Path, found.Policy) : (field, null);
+
+            if (!rows.Narrows(field.Split(SegmentSeparator)[0]))
+            {
+                // Narrowed only to keep a transform off a property it could not write: nothing is withheld
+                // by keeping it whole, as it always was kept.
+                if (cause is null && !hidden)
+                {
+                    Keep(field);
+                    KeepCarriedKeys(field, gate, Keep);
+
+                    continue;
+                }
+
+                gate.RefuseNarrowing(blame.Path, blame.Policy, $"'{field}' cannot be narrowed: {rows.WhyNotNarrowed(field)}");
+
                 continue;
             }
 
+            List<string> narrowed = new(survivors.Count);
+
             foreach (string path in survivors)
+            {
+                // Projected whole by the core, a field holding a framework collection of a policed type
+                // carries the denied fields the policy cannot name inside it.
+                if (gate.DeclaredType(path) is { } leaf && !Gate.HoldsValue(leaf) && gate.Unnamed(path, rows).DeniesSelect
+                    && gate.RefuseHidden(path))
+                {
+                    continue;
+                }
+
+                narrowed.Add(path);
+            }
+
+            if (gate.DeniedKey(narrowed) is { } key)
+            {
+                gate.RefuseNarrowing(
+                    key.Path, key.Policy,
+                    $"'{field}' was narrowed, and the projection builder adds this key to every node it narrows");
+
+                continue;
+            }
+
+            if (gate.Unprojectable(narrowed) is { } unbuilt)
+            {
+                gate.RefuseNarrowing(
+                    blame.Path, blame.Policy,
+                    $"'{field}' cannot be narrowed around it: the core cannot project '{unbuilt}'");
+
+                continue;
+            }
+
+            foreach (string path in narrowed)
             {
                 Keep(path);
             }
@@ -1760,7 +1836,7 @@ private static void KeepCarriedKeys(string path, Gate gate, Action<string> keep)
     /// denied.
     /// </summary>
     /// <remarks>
-    /// A caller who sends no projection gets the whole entity, denied columns included, because
+    /// A caller who sends no projection gets the whole row, denied columns included, because
     /// the pipeline only projects when <c>Selects</c> is non-null. Gating the list alone would
     /// therefore enforce deny-select against precisely the callers who volunteered one, and leave
     /// it bypassable by asking for less.
@@ -1771,19 +1847,14 @@ private static void KeepCarriedKeys(string path, Gate gate, Action<string> keep)
     /// one that rewrites every query in the application.
     /// </para>
     /// <para>
-    /// Scalars only. A navigation is not loaded by an unguarded call in the first place, and
-    /// projecting one whole would carry every field beneath it — reopening the same hole one level
-    /// down. Where a caller had eagerly loaded one, narrowing it away fails closed.
-    /// </para>
-    /// <para>
     /// This never throws in the strict tier for a denied field. Strict refuses what a caller asks
     /// for, and here the caller named nothing; throwing would fail every strict query against a
     /// type carrying any denied field at all.
     /// </para>
     /// </remarks>
-    private static void SynthesizeSelects(Filter filter, Gate gate)
+    private static void SynthesizeSelects(Filter filter, Gate gate, RowShape rows)
     {
-        if (SynthesizedProjection(gate) is List<string> allowed)
+        if (SynthesizedProjection(gate, rows) is List<string> allowed)
         {
             filter.Selects = allowed;
         }
@@ -1795,33 +1866,181 @@ private static void SynthesizeSelects(Filter filter, Gate gate)
     /// <remarks>
     /// Shared by the filter and the segment paths, because they are closing the same hole and a
     /// second copy of this is a second place to forget.
+    /// <para>
+    /// What an unguarded call would return, less what the policy withholds. A member that holds a
+    /// value is kept when it is allowed. A member that holds an object, or a list of them, is kept
+    /// whole when nothing beneath it is denied, and narrowed the way a caller naming it would have it
+    /// narrowed when something is — but only where the source carries it: every member of a
+    /// projected row or a row in memory, and the owned and complex members of an entity. An entity's
+    /// other navigations are left out, since an unguarded call loads them only when something includes
+    /// them, and projecting one would load it.
+    /// </para>
+    /// <para>
+    /// Everything beneath every object member is asked about, whether or not the source carries it.
+    /// A denial only beneath a member used to synthesize nothing, so the row came back whole, and an
+    /// included navigation, an owned member, a projected list or an object in memory carried the
+    /// denied value out with it. An entity query does not say what it loads: an include, an automatic
+    /// include and a lazy loader all fill a navigation the query text never names.
+    /// </para>
+    /// <para>
+    /// A member that cannot be narrowed as the projection would build it is left out whole: in
+    /// memory, where the core's narrowing of a reference reads it through EF Core; an EF Core complex
+    /// property, which the narrowing compares to null; where the builder would add a denied key back;
+    /// and where the core cannot project a path beneath it.
+    /// </para>
     /// </remarks>
-    private static List<string>? SynthesizedProjection(Gate gate)
+    private static List<string>? SynthesizedProjection(Gate gate, RowShape rows)
     {
         List<string> allowed = new();
+        List<(string Member, string Reason)> uncarried = new();
         bool anyDenied = false;
+        int recorded = gate.TraceCount;
 
-        foreach (string field in gate.ProjectableFields())
+        foreach (PropertyInfo member in gate.Members())
         {
-            FieldPolicy policy = gate.PolicyFor(field, PolicyFeature.None);
+            string name = member.Name;
+            FieldPolicy policy = gate.PolicyFor(name, PolicyFeature.None);
+
+            if (!policy.Allows(PolicyFeature.Select))
+            {
+                anyDenied = true;
+
+                gate.Record(name, PolicyFeature.Select, PolicyAction.Dropped, policy);
+
+                continue;
+            }
+
+            // Two members share the name, one hidden with new under another type or spelled in another case:
+            // the core reads one of them, and a row carries both. What either can hold is asked about, and a
+            // projection, which cannot tell them apart, leaves the name out.
+            if (gate.SharedName(name, rows) is { Shared: true } shared
+                && (shared.Denies || gate.Beneath(name, PolicyFeature.None).Denied.Any(d => rows.Materializes(d.Path))))
+            {
+                anyDenied = true;
+
+                gate.LeaveOut(name, "left out: the type declares more than one member of this name, which a projection cannot tell apart");
+
+                continue;
+            }
+
+            // A projection assigns only a member with a setter, and no path can name a member the
+            // expression parser keeps a word for; such a member is still asked about below.
+            bool assignable = member.CanWrite && !ReservedNames.Starts(name);
+
+            if (Gate.HoldsValue(member.PropertyType))
+            {
+                if (assignable && rows.CarriesValue(name))
+                {
+                    allowed.Add(name);
+                }
+
+                continue;
+            }
+
+            (List<string> survivors, List<(string Path, FieldPolicy Policy)> denied) =
+                gate.Beneath(name, PolicyFeature.None);
+
+            // Only a denial whose value can reach the result asks for a projection: one beneath a
+            // navigation nothing loads never leaves the database. What no path names is asked about
+            // only where the source carries the member at all, and on an entity only where it loads.
+            List<(string Path, FieldPolicy Policy)> reached = denied.Where(d => rows.Materializes(d.Path)).ToList();
+            Gate.TypeFacts unnamed = rows.Materializes(name + SegmentSeparator + name)
+                ? gate.Unnamed(name, rows)
+                : default;
+            bool forced = gate.ForcedBeneath(name);
+
+            foreach ((string path, FieldPolicy beneath) in reached)
+            {
+                gate.Record(path, PolicyFeature.Select, PolicyAction.Dropped, beneath);
+            }
+
+            // A forced scope beneath a member does not ask for a projection on its own. It filters the
+            // rows that hold the member, which is what it has always done for a list returned whole,
+            // and asking would leave out every included list of a scoped child type. Nor does a member
+            // that can hold an object of any type: the policy cannot see into it whether or not a
+            // projection is built, and asking would drop every such column of every query.
+            if (reached.Count > 0 || unnamed.DeniesSelect)
+            {
+                anyDenied = true;
+            }
+
+            if (!assignable || !rows.Carries(name))
+            {
+                // Left out because a projection cannot keep it. Worth a line in the trace only where the
+                // unguarded call would have returned it: an included navigation, an object in memory.
+                if (rows.Materializes(name + SegmentSeparator + name))
+                {
+                    uncarried.Add((name, !assignable
+                        ? "left out: a projection cannot assign it"
+                        : rows.Kind == RowKind.InMemory
+                            ? "left out: a projection cannot keep an object a row in memory holds"
+                            : "left out: it is a navigation, which projecting would load"));
+                }
+
+                continue;
+            }
 
-            if (policy.Allows(PolicyFeature.Select))
+            if (reached.Count == 0 && !unnamed.Opaque && !forced && !gate.ReadOnlyTransformBeneath(name))
             {
-                allowed.Add(field);
+                allowed.Add(name);
 
                 continue;
             }
 
+            string? reason = forced
+                ? "left out whole: a scope forced beneath it cannot be applied to what it holds"
+                : rows.Narrows(name)
+                    ? Narrowed(name, survivors, gate, rows, allowed)
+                    : reached.Count == 0 && !unnamed.DeniesSelect && unnamed.HoldsObject
+                        ? "left out whole: it can hold what the policy cannot name"
+                        : "left out whole: " + rows.WhyNotNarrowed(name);
+
+            if (reason is not null)
+            {
+                gate.LeaveOut(name, reason);
+            }
+        }
+
+        // A row can be a subtype of T, whose own members T's never name. The projection builds T, so it
+        // leaves them out; one this caller may not have is what asks for it.
+        foreach (string path in gate.DerivedDenials(rows))
+        {
             anyDenied = true;
 
-            gate.Record(field, PolicyFeature.Select, PolicyAction.Dropped, policy);
+            gate.LeaveOut(path, "left out: a type derived from the row's type declares it, and the projection builds the row's type");
+        }
+
+        // A member a base type declares and T hides with new is still held by a row in memory, and read by
+        // anyone reading the row as the base type. A projection builds T and leaves it out.
+        if (rows.Kind == RowKind.InMemory)
+        {
+            foreach (string name in gate.HiddenDenials())
+            {
+                anyDenied = true;
+
+                gate.LeaveOut(name, "left out: a base type's member of this name, which the row's own member hides");
+            }
+        }
+
+        // A member that asks for nothing itself is still left out, or narrowed, as the projection would build
+        // it. With no projection built nothing was, and the trace says what the query did.
+        if (!anyDenied)
+        {
+            gate.WithdrawTrace(recorded);
+
+            return null;
         }
 
-        if (!anyDenied || gate.IsDryRun)
+        if (gate.IsDryRun)
         {
             return null;
         }
 
+        foreach ((string name, string reason) in uncarried)
+        {
+            gate.LeaveOut(name, reason);
+        }
+
         if (allowed.Count == 0)
         {
             throw gate.Exception(WholeClause, PolicyFeature.Select, PolicyErrorCode.AllSelectsDenied, null);
@@ -1830,6 +2049,57 @@ private static void SynthesizeSelects(Filter filter, Gate gate)
         return allowed;
     }
 
+    /// <summary>
+    /// Narrows a member for a synthesized projection, adding what survives to <paramref name="allowed"/>,
+    /// or returns why the member is left out whole instead.
+    /// </summary>
+    /// <remarks>
+    /// A field whose type can hold what the policy cannot name, a framework collection of a policed
+    /// type or a member typed <see cref="object"/>, is left out of the narrowing: the core projects it
+    /// whole. The builder adds the key of every node it narrows, so a denied key leaves the member out,
+    /// and so does a path the core cannot project.
+    /// </remarks>
+    private static string? Narrowed(string member, List<string> survivors, Gate gate, RowShape rows, List<string> allowed)
+    {
+        List<string> kept = new(survivors.Count);
+
+        foreach (string path in survivors)
+        {
+            if (gate.DeclaredType(path) is { } type && !Gate.HoldsValue(type) && gate.Unnamed(path, rows).Opaque)
+            {
+                gate.LeaveOut(path, "left out whole: it can hold what the policy cannot name");
+
+                continue;
+            }
+
+            kept.Add(path);
+        }
+
+        if (gate.DeniedKey(kept) is { } key)
+        {
+            return $"left out whole: the projection would add its key '{key.Path}', which is denied";
+        }
+
+        if (gate.Unprojectable(kept) is { } unbuilt)
+        {
+            return $"left out whole: the core cannot project '{unbuilt}'";
+        }
+
+        if (gate.Unbuildable(member, kept) is { } node)
+        {
+            return $"left out whole: the core cannot build '{node.Name}', which it narrows into";
+        }
+
+        if (kept.Count == 0)
+        {
+            return "left out whole: nothing beneath it may be selected";
+        }
+
+        allowed.AddRange(kept);
+
+        return null;
+    }
+
     /// <summary>
     /// Refuses a request that fails to supply a filter the policy requires.
     /// </summary>
@@ -2347,6 +2617,10 @@ private sealed class Gate
         // where a denied field is, as a denied field is.
         private readonly HashSet<string> _unknown = new(StringComparer.Ordinal);
 
+        // What a projection of each navigation carries, per root type and path. Reflection only, so it
+        // is the same for every caller and every query.
+        private static readonly ConcurrentDictionary<(Type Root, string Path), IReadOnlyList<string>> CarriedPaths = new();
+
         internal Gate(
             Type entityType,
             PolicyResolver resolver,
@@ -2447,27 +2721,141 @@ internal string Unknown(string name)
         internal bool IsDryRun => _options.DryRun || _context.DryRun;
 
         /// <summary>
-        /// The scalar properties of the entity that a typed projection can actually assign.
+        /// The members of the entity: every readable property that is not an indexer.
         /// </summary>
         /// <remarks>
         /// Read through the same reflection cache the validator uses, so a synthesized projection
-        /// cannot name a field the pipeline would then reject. Write-only and indexed members are
-        /// excluded because a typed projection assigns into them.
+        /// cannot name a field the pipeline would then reject. A projection assigns only the writable
+        /// ones, but a read-only one is still asked about: a denial on it, or beneath it, still needs a
+        /// projection, or the row comes back holding it.
         /// </remarks>
-        internal IEnumerable<string> ProjectableFields()
+        internal IEnumerable<PropertyInfo> Members()
         {
             foreach (KeyValuePair<string, PropertyInfo> entry in CacheReflection.GetTypeProperties(_entityType))
             {
                 PropertyInfo property = entry.Value;
 
-                if (property.CanRead
-                    && property.CanWrite
-                    && property.GetIndexParameters().Length == 0
-                    && CacheReflection.IsSimpleType(property.PropertyType))
+                if (property.CanRead && property.GetIndexParameters().Length == 0)
+                {
+                    yield return property;
+                }
+            }
+        }
+
+        /// <summary>
+        /// True when a member of this type holds a value rather than an object: a scalar, or a
+        /// collection of scalars such as <c>List&lt;string&gt;</c> or <c>byte[]</c>.
+        /// </summary>
+        /// <remarks>
+        /// A collection of scalars is a value the projection assigns whole. Nothing beneath it can
+        /// carry a policy, and on an entity it is a column the unguarded call loads.
+        /// </remarks>
+        internal static bool HoldsValue(Type type) =>
+            CacheReflection.IsSimpleType(AttributePolicyProvider.Peeled(type))
+            && !AttributePolicyProvider.Layers(type).Any(layer => OwnsMembers(layer) && Facts(layer).DeniesSelect);
+
+        /// <summary>
+        /// True for an application's own collection class, one deriving from <c>List&lt;string&gt;</c> or a
+        /// <c>Dictionary</c> say, that declares members beside the elements it holds. A collection of values
+        /// stays a value unless a member of its own is denied.
+        /// </summary>
+        private static bool OwnsMembers(Type type) =>
+            type.IsClass
+            && !type.IsArray
+            && !AttributePolicyProvider.IsFramework(type)
+            && AttributePolicyProvider.Peeled(type) != type
+            && type.GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                .Any(property => property.GetIndexParameters().Length == 0
+                                 && property.DeclaringType is { } declaring
+                                 && !AttributePolicyProvider.IsFramework(declaring));
+
+        /// <summary>
+        /// The names of members a base type of T declares, T hides with <c>new</c>, and this caller may not have,
+        /// or that hold a denied field no path names.
+        /// </summary>
+        internal List<string> HiddenDenials()
+        {
+            List<string> found = new();
+            PropertyInfo[] shown = _entityType.GetProperties(BindingFlags.Public | BindingFlags.Instance);
+
+            for (Type? declaring = _entityType.BaseType; declaring is not null && declaring != typeof(object); declaring = declaring.BaseType)
+            {
+                foreach (PropertyInfo hidden in declaring.GetProperties(BindingFlags.Public | BindingFlags.Instance | BindingFlags.DeclaredOnly))
                 {
-                    yield return property.Name;
+                    if (!hidden.CanRead
+                        || hidden.GetIndexParameters().Length != 0
+                        || found.Contains(hidden.Name, StringComparer.Ordinal)
+                        || shown.Any(member => member.Name == hidden.Name && SameSlot(member, hidden)))
+                    {
+                        continue;
+                    }
+
+                    if (DeclaresDenial(hidden)
+                        || (!HoldsValue(hidden.PropertyType) && Carried(hidden.PropertyType, hidden.Name, exact: false).DeniesSelect))
+                    {
+                        found.Add(hidden.Name);
+                    }
                 }
             }
+
+            return found;
+        }
+
+        /// <summary>True when two properties' getters are one method, or one overrides the other.</summary>
+        private static bool SameSlot(PropertyInfo left, PropertyInfo right) =>
+            left.GetGetMethod() is { } first
+            && right.GetGetMethod() is { } second
+            && first.GetBaseDefinition() is { } a
+            && second.GetBaseDefinition() is { } b
+            && a.MetadataToken == b.MetadataToken
+            && a.Module == b.Module;
+
+        /// <summary>The names more than one readable member of a type shares, compared as the core compares names.</summary>
+        private static readonly ConcurrentDictionary<Type, HashSet<string>> SharedNames = new();
+
+        private static HashSet<string> ReadSharedNames(Type type) =>
+            new(type.GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                    .Where(property => property.CanRead && property.GetIndexParameters().Length == 0)
+                    .GroupBy(property => property.Name, StringComparer.OrdinalIgnoreCase)
+                    .Where(group => group.Count() > 1)
+                    .Select(group => group.Key),
+                StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>
+        /// Whether T declares more than one member of a name, as the core compares names, one of them holding
+        /// more than a value; and if so, whether what one of them holds is denied.
+        /// </summary>
+        /// <remarks>
+        /// A member hidden with <c>new</c> under another type, or two names differing only in case. The core
+        /// reads one of them by name, and a row carries every one, which a serializer writes.
+        /// </remarks>
+        internal (bool Shared, bool Denies) SharedName(string name, RowShape rows)
+        {
+            if (!SharedNames.GetOrAdd(_entityType, ReadSharedNames).Contains(name))
+            {
+                return (false, false);
+            }
+
+            List<PropertyInfo> variants = _entityType
+                .GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                .Where(property => property.CanRead
+                                   && property.GetIndexParameters().Length == 0
+                                   && string.Equals(property.Name, name, StringComparison.OrdinalIgnoreCase))
+                .ToList();
+
+            if (variants.TrueForAll(variant => HoldsValue(variant.PropertyType)))
+            {
+                return (false, false);
+            }
+
+            // An entity's model says which of them EF Core maps and what loads beneath it; any other row can
+            // hold what either type can.
+            bool beneath = rows.LoadedBeneath(name) is not null
+                ? Unnamed(name, rows).DeniesSelect
+                : variants.Exists(variant => !HoldsValue(variant.PropertyType)
+                                             && Carried(variant.PropertyType, name, exact: false).DeniesSelect);
+
+            return (true, beneath || variants.Exists(variant => Denies(name, variant)));
         }
 
         /// <summary>
@@ -2499,30 +2887,38 @@ internal bool HasKey(string path)
         /// deny-select against whoever spelled the child out in full and leaves it bypassable by
         /// asking for its parent instead — the same shape as sending no projection at all.
         /// <para>
-        /// The walk stops where <see cref="AttributePolicyProvider"/>'s does, and carries the same
-        /// cycle guard. Nothing below that depth holds a fragment, so there is no decision down
-        /// there to enforce and descending further would only enumerate paths the resolver cannot
-        /// speak about.
+        /// A type is read the way <see cref="AttributePolicyProvider"/> reads it, through
+        /// <see cref="AttributePolicyProvider.NavigationTypeOf"/>, and no path is longer than the
+        /// longest the walker puts a fragment on. It once read collections through a narrower list of
+        /// its own, so a member typed <c>IReadOnlyList&lt;T&gt;</c> hid every denial beneath it, and it
+        /// went a level deeper than the walker, so a narrowing projected fields no policy could speak
+        /// about. It does not follow a type back into itself along one path: a narrowing leaves such a
+        /// region out.
         /// </para>
         /// </remarks>
-        internal IReadOnlyList<string> ProjectionUnder(string path)
+        internal IReadOnlyList<string> ProjectionUnder(string path) =>
+            CarriedPaths.GetOrAdd((_entityType, path), key => Enumerate(key.Root, key.Path));
+
+        private static IReadOnlyList<string> Enumerate(Type root, string path)
         {
             List<string> paths = new();
-            Type? type = TypeAt(path);
 
-            if (type is not null)
+            if (DeclaredType(root, path) is { } declared
+                && AttributePolicyProvider.NavigationTypeOf(declared) is { } type)
             {
-                Descend(path, type, 1, paths, new HashSet<Type>());
+                Descend(path, type, path.Split(SegmentSeparator).Length, paths, new HashSet<Type>());
             }
 
             return paths;
         }
 
+        // depth is how many segments prefix has; a child has one more.
         private static void Descend(
             string prefix, Type type, int depth, List<string> paths, HashSet<Type> seen)
         {
-            // A type reachable from itself would otherwise enumerate until the stack ran out.
-            if (!seen.Add(type))
+            // A child would be longer than any path the walker gives a fragment, or the type is one this
+            // path already passed through and would otherwise enumerate until the stack ran out.
+            if (depth >= AttributePolicyProvider.MaxDepth || !seen.Add(type))
             {
                 return;
             }
@@ -2540,57 +2936,763 @@ private static void Descend(
 
                 string child = $"{prefix}.{property.Name}";
 
-                if (CacheReflection.IsSimpleType(property.PropertyType))
+                // A value, a collection of values, or a type the walker does not enter: projected
+                // whole, and nothing beneath it has a path of its own.
+                if (AttributePolicyProvider.NavigationTypeOf(property.PropertyType) is not { } nested)
                 {
                     paths.Add(child);
 
                     continue;
                 }
 
-                Type nested = CacheReflection.GetCollectionElementType(property.PropertyType)
-                    ?? property.PropertyType;
+                Descend(child, nested, depth + 1, paths, seen);
+            }
+
+            seen.Remove(type);
+        }
+
+        /// <summary>
+        /// What lies beneath a member, as the policy sees it: the fields a narrowing of it could keep,
+        /// and every path beneath it this caller may not select.
+        /// </summary>
+        /// <param name="member">The member's path.</param>
+        /// <param name="use">
+        /// <see cref="PolicyFeature.Select"/> when the caller named the member, so an audited field a
+        /// narrowing would carry is recorded as used; <see cref="PolicyFeature.None"/> otherwise.
+        /// </param>
+        /// <remarks>
+        /// The denials come from two places. The walk above finds every field a projection of the
+        /// member could hold. The fragments the providers hold find the rest: a fragment matches a path
+        /// exactly or matches every path, so a denied path the walk never produced, beneath a property
+        /// with no setter, around a cycle, or deeper than the walk goes, is still one of them.
+        /// </remarks>
+        internal (List<string> Survivors, List<(string Path, FieldPolicy Policy)> Denied) Beneath(
+            string member, PolicyFeature use)
+        {
+            List<string> survivors = new();
+            List<(string Path, FieldPolicy Policy)> denied = new();
+            HashSet<string> asked = new(StringComparer.OrdinalIgnoreCase);
+
+            foreach (string path in ProjectionUnder(member))
+            {
+                asked.Add(path);
+
+                FieldPolicy policy = PolicyFor(path, use);
 
-                // A collection of a primitive is a value the projection assigns whole, not a
-                // navigation into its element type. Descending into byte would enumerate nothing
-                // and drop the member from an expansion that is supposed to preserve it.
-                if (CacheReflection.IsSimpleType(nested))
+                if (policy.Allows(PolicyFeature.Select))
                 {
-                    paths.Add(child);
+                    survivors.Add(path);
+                }
+                else
+                {
+                    denied.Add((path, policy));
+                }
+            }
+
+            string prefix = member + SegmentSeparator;
 
+            foreach (PolicyFragment fragment in Fragments)
+            {
+                // A rule on a path the type does not have, one written for a member since removed, holds
+                // nothing a projection could carry.
+                if (fragment.IsWildcard
+                    || !fragment.FieldPath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)
+                    || !asked.Add(fragment.FieldPath)
+                    || !Resolves(_entityType, fragment.FieldPath))
+                {
                     continue;
                 }
 
-                if (depth >= AttributePolicyProvider.MaxDepth)
+                FieldPolicy policy = PolicyFor(fragment.FieldPath, PolicyFeature.None);
+
+                if (!policy.Allows(PolicyFeature.Select))
                 {
-                    continue;
+                    denied.Add((fragment.FieldPath, policy));
                 }
+            }
 
-                Descend(child, nested, depth + 1, paths, seen);
+            return (survivors, denied);
+        }
+
+        /// <summary>
+        /// True when a path names a member, in any letter case, of the type or of any subtype a value along
+        /// it can be: a rule on <c>Org.Swift</c> names a field of the bank a member declared as an
+        /// organisation holds, and a type with both <c>Info</c> and <c>INFO</c> has two members the path
+        /// could name.
+        /// </summary>
+        private static bool Resolves(Type root, string path)
+        {
+            List<Type> current = new() { root };
+            string[] segments = path.Split(SegmentSeparator);
+
+            for (int i = 0; i < segments.Length; i++)
+            {
+                List<Type> next = new();
+                bool named = false;
+
+                foreach (Type type in current)
+                {
+                    foreach (Type candidate in KnownSubtypes.Of(type).Prepend(type))
+                    {
+                        foreach (PropertyInfo property in candidate.GetProperties(BindingFlags.Public | BindingFlags.Instance))
+                        {
+                            if (!string.Equals(property.Name, segments[i], StringComparison.OrdinalIgnoreCase))
+                            {
+                                continue;
+                            }
+
+                            named = true;
+
+                            if (AttributePolicyProvider.NavigationTypeOf(property.PropertyType) is { } nested
+                                && !next.Contains(nested))
+                            {
+                                next.Add(nested);
+                            }
+                        }
+                    }
+                }
+
+                if (!named || (i < segments.Length - 1 && next.Count == 0))
+                {
+                    return false;
+                }
+
+                current = next;
             }
 
-            seen.Remove(type);
+            return true;
         }
 
-        /// <summary>The type a validated path names, or null when it names nothing.</summary>
-        private Type? TypeAt(string path)
+        /// <summary>
+        /// The first type a narrowing would build a node as that the core's typed projection cannot
+        /// construct, an interface, an abstract class or one without a public parameterless constructor,
+        /// which it skips; null when it can build them all.
+        /// </summary>
+        internal Type? Unbuildable(string member, IEnumerable<string> paths)
         {
-            try
+            HashSet<string> nodes = new(StringComparer.OrdinalIgnoreCase) { member };
+
+            foreach (string path in paths)
             {
-                return CacheReflection.GetFieldType(_entityType, path);
+                for (int cut = path.IndexOf(SegmentSeparator); cut >= 0; cut = path.IndexOf(SegmentSeparator, cut + 1))
+                {
+                    nodes.Add(path[..cut]);
+                }
             }
-            catch (LogicException)
+
+            foreach (string node in nodes)
             {
-                return null;
+                if (DeclaredType(node) is { } declared
+                    && AttributePolicyProvider.NavigationTypeOf(declared) is { } type
+                    && (type.IsAbstract || type.GetConstructor(Type.EmptyTypes) is null))
+                {
+                    return type;
+                }
             }
+
+            return null;
         }
 
+        /// <summary>Every fragment the providers hold for this type and caller, read once per query.</summary>
+        private IReadOnlyList<PolicyFragment> Fragments => _fragments ??= _resolver.Fragments(_entityType, _context);
+
+        private IReadOnlyList<PolicyFragment>? _fragments;
+
         /// <summary>
-        /// What one reference to a field spends.
+        /// True when a forced predicate reaches beneath the member. A projection cannot apply it to the
+        /// elements the member holds: the scope filters the rows of the query, and a list kept whole or
+        /// narrowed carries every element, those the scope excludes included.
         /// </summary>
-        /// <remarks>
-        /// The field's own weight when something weighs it, and the standing default otherwise.
-        /// Null and zero are different answers here: null is "nobody weighed this field", which the
-        /// host's default decides, and zero is "this field is free", which the host's default must
+        internal bool ForcedBeneath(string member)
+        {
+            string prefix = member + SegmentSeparator;
+
+            return TypePolicy.Forced.Any(
+                forced => forced.FieldPath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase));
+        }
+
+        /// <summary>
+        /// True when a transform beneath the member lands on a property with no setter, which the
+        /// outbound walk could not write back: a narrowing leaves such a property out.
+        /// </summary>
+        internal bool ReadOnlyTransformBeneath(string member)
+        {
+            string prefix = member + SegmentSeparator;
+
+            foreach (string path in TypePolicy.Transforms.Keys)
+            {
+                if (path.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)
+                    && Property(_entityType, path) is { CanWrite: false })
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
+        /// <summary>
+        /// What the value of a member can carry that the paths the walk asks about do not name: a field
+        /// denied for Select, and a member that can hold an object of any type.
+        /// </summary>
+        /// <remarks>
+        /// On an entity query the model says what loads beneath the member
+        /// (<see cref="RowShape.LoadedBeneath"/>). Each loaded member is asked about by its path, and by
+        /// its own attribute where no fragment reaches it: deeper than the walker goes, or declared by a
+        /// type the model derives. A value EF Core reads whole is read through its type. What EF Core
+        /// materializes from the database holds no object of the application's; what a value converter
+        /// hands back is the application's code, and holds what its type allows. A
+        /// projection's member is read as the type the projection constructs it as, when it says. Any
+        /// other value can carry whatever the member's type can hold, its subtypes included.
+        /// Under a policy that denies every field it does not name, a path the walk never asks about is a
+        /// denied one unless the policy names it.
+        /// </remarks>
+        internal TypeFacts Unnamed(string member, RowShape rows)
+        {
+            if (rows.LoadedBeneath(member) is { } loaded)
+            {
+                bool denies = false;
+                bool holdsObject = false;
+
+                foreach (Loaded entry in loaded)
+                {
+                    TypeFacts carried = entry.Whole && !HoldsValue(entry.Property.PropertyType)
+                        ? Carried(entry.Property.PropertyType, entry.Path, exact: false)
+                        : default;
+
+                    denies |= Denies(entry.Path, entry.Property) || carried.DeniesSelect;
+                    holdsObject |= entry.Converted && carried.HoldsObject;
+                }
+
+                return new TypeFacts(denies, holdsObject, loaded.Count > 0);
+            }
+
+            if (!member.Contains(SegmentSeparator) && rows.BuiltType(member) is { } built)
+            {
+                return Carried(built, member, exact: true);
+            }
+
+            // A path that names nothing is refused long before this; were it not, nothing is shown clean.
+            return DeclaredType(member) is { } type
+                ? Carried(type, member, exact: false)
+                : new TypeFacts(true, true, true);
+        }
+
+        /// <summary>
+        /// What a value of a type, held at a path, can carry that no path names. An exact type is the one
+        /// the value was constructed as, so its own subtypes cannot be it.
+        /// </summary>
+        private TypeFacts Carried(Type type, string path, bool exact)
+        {
+            TypeFacts facts = Facts(type, exact);
+
+            return DeniesByDefault && !Granted(type, path, exact)
+                ? facts with { DeniesSelect = true }
+                : facts;
+        }
+
+        /// <summary>
+        /// True when this caller may not select a member reached along a path: its policy says so, or,
+        /// where no fragment reaches the path, an attribute on the member does.
+        /// </summary>
+        /// <remarks>
+        /// The walker puts a fragment on every path of the declared types up to its depth, a member
+        /// with no setter, a path around a cycle, and a denial an override or an implementation declares
+        /// included. Past its depth, or on a member only a derived type declares, the attributes are all
+        /// there is, read from every declaration a row can run.
+        /// </remarks>
+        private bool Denies(string path, PropertyInfo property)
+        {
+            if (!PolicyFor(path, PolicyFeature.None).Allows(PolicyFeature.Select))
+            {
+                return true;
+            }
+
+            return (path.Split(SegmentSeparator).Length > AttributePolicyProvider.MaxDepth
+                    || Property(_entityType, path) is null)
+                   && DeclaresDenial(property);
+        }
+
+        /// <summary>
+        /// True when a member's attributes deny Select: its own, inherited ones, and those of another
+        /// declaration a row of the type it was read from can run, an interface member or a subtype's
+        /// override among them. Read once for each member, and again once another assembly has loaded.
+        /// </summary>
+        private static bool DeclaresDenial(PropertyInfo property)
+        {
+            int epoch = KnownSubtypes.Epoch;
+
+            if (DenialsByMember.TryGetValue(property, out (int Epoch, bool Denies) known) && known.Epoch == epoch)
+            {
+                return known.Denies;
+            }
+
+            bool denies = property.GetCustomAttributes<DwDenyAttribute>(inherit: true)
+                .Concat(AttributePolicyProvider.DenialsElsewhere(property.ReflectedType ?? property.DeclaringType!, property))
+                .Any(attribute => (attribute.Features & PolicyFeature.Select) != 0);
+
+            DenialsByMember[property] = (epoch, denies);
+
+            return denies;
+        }
+
+        private static readonly ConcurrentDictionary<PropertyInfo, (int Epoch, bool Denies)> DenialsByMember = new();
+
+        /// <summary>
+        /// Every member a type derived from T declares that a row can carry and this caller may not
+        /// have, or that carries a denied field no path names. A projection builds T itself and leaves
+        /// them all out, so each is a reason to project.
+        /// </summary>
+        /// <remarks>
+        /// A projection builds the type its initializer constructs, which may be a subtype of T. An entity
+        /// query materializes each row as the type the database says it is, which the model knows. Any
+        /// other source can hold any subtype loaded.
+        /// </remarks>
+        internal List<string> DerivedDenials(RowShape rows)
+        {
+            List<string> found = new();
+
+            if (rows.Kind == RowKind.Projected)
+            {
+                if (rows.Built is { } built && built != _entityType && _entityType.IsAssignableFrom(built))
+                {
+                    Declared(built, found);
+                }
+
+                return found;
+            }
+
+            if (rows.LoadedByDerived() is { } loaded)
+            {
+                foreach (Loaded entry in loaded)
+                {
+                    if (Denies(entry.Path, entry.Property)
+                        || (entry.Whole && !HoldsValue(entry.Property.PropertyType)
+                                        && Carried(entry.Property.PropertyType, entry.Path, exact: false).DeniesSelect))
+                    {
+                        found.Add(entry.Path);
+                    }
+                }
+
+                return found;
+            }
+
+            foreach (Type subtype in KnownSubtypes.Of(_entityType))
+            {
+                Declared(subtype, found);
+            }
+
+            return found;
+        }
+
+        /// <summary>Adds each member a subtype declares below T that this caller may not have.</summary>
+        private void Declared(Type subtype, List<string> found)
+        {
+            foreach (PropertyInfo property in subtype.GetProperties(BindingFlags.Public | BindingFlags.Instance))
+            {
+                if (!property.CanRead
+                    || property.GetIndexParameters().Length != 0
+                    || property.DeclaringType!.IsAssignableFrom(_entityType)
+                    || found.Contains(property.Name, StringComparer.Ordinal))
+                {
+                    continue;
+                }
+
+                if (Denies(property.Name, property)
+                    || (!HoldsValue(property.PropertyType)
+                        && Carried(property.PropertyType, property.Name, exact: false).DeniesSelect))
+                {
+                    found.Add(property.Name);
+                }
+            }
+        }
+
+        /// <summary>
+        /// True when a <c>"*"</c> rule denies Select on every field this caller is not granted by name,
+        /// so that a path the walk never asks about is a denied one.
+        /// </summary>
+        internal bool DeniesByDefault =>
+            _deniesByDefault ??= Fragments.Any(fragment => fragment.IsWildcard)
+                                 && !PolicyFor(UnnamedPath, PolicyFeature.None).Allows(PolicyFeature.Select);
+
+        private bool? _deniesByDefault;
+
+        /// <summary>A path no member can have, so that only the <c>"*"</c> rules match it.</summary>
+        private const string UnnamedPath = "<unnamed>";
+
+        /// <summary>
+        /// Under a policy denying every field it does not name, true when every path beneath a member of
+        /// this type that the walk never asks about is one the policy grants by name.
+        /// </summary>
+        /// <remarks>
+        /// The walk skips a property with no setter, stops four segments deep and at a type it already
+        /// passed through, reads declared types only and takes a framework type whole. Each path it skips
+        /// is asked about here, a subtype's members included; one the policy does not name is denied.
+        /// Around a cycle the paths never end, and inside a framework type holding an application type's
+        /// members no path can name them, so neither is ever granted.
+        /// </remarks>
+        private bool Granted(Type type, string path, bool exact)
+        {
+            if (!_granted.TryGetValue((type, path, exact), out bool granted))
+            {
+                granted = Grant(type, path, exact, new HashSet<Type>());
+                _granted[(type, path, exact)] = granted;
+            }
+
+            return granted;
+        }
+
+        private readonly Dictionary<(Type, string, bool), bool> _granted = new();
+
+        private bool Grant(Type type, string path, bool exact, HashSet<Type> onPath)
+        {
+            // A value, a collection of them among values, holds no path to name.
+            if (HoldsValue(type))
+            {
+                return true;
+            }
+
+            if (AttributePolicyProvider.NavigationTypeOf(type) is not { } node)
+            {
+                TypeFacts facts = Facts(type, exact: false);
+
+                return !facts.HoldsObject && !facts.HoldsMembers;
+            }
+
+            if (!onPath.Add(node))
+            {
+                return false;
+            }
+
+            int depth = path.Split(SegmentSeparator).Length;
+            IEnumerable<(PropertyInfo Property, bool Declared)> members = node
+                .GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                .Select(property => (property, true));
+
+            if (!exact)
+            {
+                members = members.Concat(KnownSubtypes.Of(node)
+                    .SelectMany(subtype => subtype.GetProperties(BindingFlags.Public | BindingFlags.Instance))
+                    .Where(property => !property.DeclaringType!.IsAssignableFrom(node))
+                    .Select(property => (property, false)));
+            }
+
+            foreach ((PropertyInfo property, bool declared) in members)
+            {
+                if (!property.CanRead || property.GetIndexParameters().Length != 0)
+                {
+                    continue;
+                }
+
+                string child = $"{path}{SegmentSeparator}{property.Name}";
+                bool walked = declared && property.CanWrite && depth < AttributePolicyProvider.MaxDepth;
+
+                if ((!walked && Denies(child, property))
+                    || (!HoldsValue(property.PropertyType) && !Grant(property.PropertyType, child, false, onPath)))
+                {
+                    return false;
+                }
+            }
+
+            onPath.Remove(node);
+
+            return true;
+        }
+
+        /// <summary>
+        /// What a type can hold that no path of the policy's reaches, read once per type and again once
+        /// another assembly has loaded, since that can add subtypes. An exact type is the one a value was
+        /// constructed as, so its own subtypes are not read.
+        /// </summary>
+        internal static TypeFacts Facts(Type type, bool exact = false)
+        {
+            int epoch = KnownSubtypes.Epoch;
+
+            if (FactsByType.TryGetValue((type, exact), out (int Epoch, TypeFacts Facts) known) && known.Epoch == epoch)
+            {
+                return known.Facts;
+            }
+
+            TypeFacts facts = Scan(type, exact);
+
+            FactsByType[(type, exact)] = (epoch, facts);
+
+            return facts;
+        }
+
+        private static readonly ConcurrentDictionary<(Type, bool), (int Epoch, TypeFacts Facts)> FactsByType = new();
+
+        /// <summary>
+        /// Reads every type a value of this type can hold, however deep, for a field denied for Select
+        /// and for a member that can hold an object of any type.
+        /// </summary>
+        /// <remarks>
+        /// Wider than the walker on purpose. The walker stops four segments deep, does not enter a
+        /// framework type and reads declared types only, so a field denied beneath any of those has no
+        /// path, and resolves as allowed. This follows every property, a read-only one included, every
+        /// collection, the type arguments of a framework generic such as <c>Dictionary&lt;string, T&gt;</c>,
+        /// and every loaded subtype of a type it reads, a framework class's included, and remembers the
+        /// types it has read rather than counting levels. A member that can hold anything is reported
+        /// rather than read.
+        /// </remarks>
+        private static TypeFacts Scan(Type type, bool exact)
+        {
+            bool denies = false;
+            bool holdsObject = false;
+            bool holdsMembers = false;
+            HashSet<Type> seen = new();
+            Stack<Type> pending = new();
+
+            void Read(Type candidate)
+            {
+                if (seen.Add(candidate))
+                {
+                    pending.Push(candidate);
+                }
+            }
+
+            void Subtypes(Type of)
+            {
+                foreach (Type subtype in KnownSubtypes.Of(of))
+                {
+                    holdsMembers = true;
+
+                    Read(subtype);
+                }
+            }
+
+            void Enqueue(Type candidate, bool root)
+            {
+                Type peeled = AttributePolicyProvider.Peeled(candidate);
+
+                // An application's own collection class declares members beside the elements it holds, at any
+                // layer: the member's own type, or the element of a list or an array of it.
+                foreach (Type layer in AttributePolicyProvider.Layers(candidate))
+                {
+                    if (OwnsMembers(layer))
+                    {
+                        holdsMembers = true;
+
+                        Read(layer);
+
+                        if (!(root && exact))
+                        {
+                            Subtypes(layer);
+                        }
+                    }
+                }
+
+                if (HoldsAnything(peeled))
+                {
+                    holdsObject = true;
+
+                    // An application's own collection that is not generic can hold anything, and it still
+                    // declares members of its own, which are read as any other type's are.
+                    if (peeled.IsGenericParameter || AttributePolicyProvider.IsFramework(peeled))
+                    {
+                        return;
+                    }
+                }
+
+                if (AttributePolicyProvider.NavigationTypeOf(candidate) is { } navigation)
+                {
+                    holdsMembers = true;
+
+                    Read(navigation);
+
+                    if (!(root && exact))
+                    {
+                        Subtypes(navigation);
+                    }
+                }
+                else if (peeled.IsClass && !peeled.IsSealed && !peeled.IsGenericType && !(root && exact))
+                {
+                    // A framework class an application can derive from, an Exception or a Stream: the
+                    // subtype a value holds is read, since the class itself carries no policy.
+                    Subtypes(peeled);
+                }
+
+                if (peeled.IsGenericType && AttributePolicyProvider.IsFramework(peeled))
+                {
+                    foreach (Type argument in peeled.GetGenericArguments())
+                    {
+                        Enqueue(argument, false);
+                    }
+                }
+            }
+
+            Enqueue(type, true);
+
+            while (pending.Count > 0 && !(denies && holdsObject))
+            {
+                foreach (PropertyInfo property in pending.Pop().GetProperties(BindingFlags.Public | BindingFlags.Instance))
+                {
+                    if (property.GetIndexParameters().Length != 0)
+                    {
+                        continue;
+                    }
+
+                    if (!denies && DeclaresDenial(property))
+                    {
+                        denies = true;
+                    }
+
+                    Enqueue(property.PropertyType, false);
+                }
+            }
+
+            return new TypeFacts(denies, holdsObject, holdsMembers);
+        }
+
+        /// <summary>
+        /// True for a type whose value can be an object of any type: <see cref="object"/> itself, a type
+        /// parameter an open generic subtype leaves unbound, a framework interface such as
+        /// <c>IComparable</c>, and a collection that is not generic, such as <c>ArrayList</c>,
+        /// <c>IEnumerable</c>, <see cref="Array"/> or an application's own.
+        /// </summary>
+        private static bool HoldsAnything(Type peeled) =>
+            peeled == typeof(object)
+            || peeled == typeof(ValueType)
+            || peeled.IsGenericParameter
+            || (!peeled.IsGenericType
+                && ((AttributePolicyProvider.IsFramework(peeled) && peeled.IsInterface)
+                    || (peeled != typeof(string) && typeof(IEnumerable).IsAssignableFrom(peeled)
+                                                 && !ValueCollections.Contains(peeled))));
+
+        /// <summary>The framework's collections that are not generic yet hold values only: bits and strings.</summary>
+        private static readonly HashSet<Type> ValueCollections = new()
+        {
+            typeof(BitArray),
+            typeof(System.Collections.Specialized.StringCollection),
+            typeof(System.Collections.Specialized.StringDictionary),
+            typeof(System.Collections.Specialized.NameValueCollection)
+        };
+
+        /// <summary>
+        /// What a type can hold that the policy cannot name a path to.
+        /// </summary>
+        /// <param name="DeniesSelect">A field denied for Select somewhere in what it can hold.</param>
+        /// <param name="HoldsObject">A member that can hold an object of any type somewhere in what it can hold.</param>
+        /// <param name="HoldsMembers">An application type's members somewhere in what it can hold.</param>
+        internal readonly record struct TypeFacts(bool DeniesSelect, bool HoldsObject, bool HoldsMembers)
+        {
+            /// <summary>True when either fact holds, so the type cannot be shown to be free of policy.</summary>
+            internal bool Opaque => DeniesSelect || HoldsObject;
+        }
+
+        /// <summary>
+        /// The declared type at a path, read the way the walker reads it: through any collection, one
+        /// segment at a time. Null when a segment names nothing.
+        /// </summary>
+        internal Type? DeclaredType(string path) => DeclaredType(_entityType, path);
+
+        private static Type? DeclaredType(Type root, string path) => Property(root, path)?.PropertyType;
+
+        private static PropertyInfo? Property(Type root, string path)
+        {
+            Type? current = root;
+            PropertyInfo? property = null;
+
+            foreach (string segment in path.Split(SegmentSeparator))
+            {
+                if (current is null || CacheReflection.FindProperty(current, segment) is not { } next)
+                {
+                    return null;
+                }
+
+                property = next;
+                current = AttributePolicyProvider.NavigationTypeOf(next.PropertyType);
+            }
+
+            return property;
+        }
+
+        /// <summary>
+        /// The key the projection builder would add to a node that a list of narrowed paths passes
+        /// through, when this caller may not select it; null when every such key is allowed.
+        /// </summary>
+        /// <remarks>
+        /// The builder adds the key of each nested node it builds whether the list names it or not,
+        /// so a narrowing that dropped a denied key would carry it anyway.
+        /// </remarks>
+        internal (string Path, FieldPolicy Policy)? DeniedKey(IEnumerable<string> paths)
+        {
+            HashSet<string> nodes = new(StringComparer.Ordinal);
+
+            foreach (string path in paths)
+            {
+                for (int cut = path.IndexOf(SegmentSeparator); cut >= 0; cut = path.IndexOf(SegmentSeparator, cut + 1))
+                {
+                    string node = path[..cut];
+
+                    if (!nodes.Add(node)
+                        || TypeAt(_entityType, node) is not { } type
+                        || CacheReflection.FindProperty(type, "Id") is not { } key)
+                    {
+                        continue;
+                    }
+
+                    string keyPath = $"{node}.{key.Name}";
+                    FieldPolicy policy = PolicyFor(keyPath, PolicyFeature.None);
+
+                    if (!policy.Allows(PolicyFeature.Select))
+                    {
+                        return (keyPath, policy);
+                    }
+                }
+            }
+
+            return null;
+        }
+
+        /// <summary>
+        /// The first of a list of narrowed paths that the core's own validation refuses, or null when
+        /// it accepts them all.
+        /// </summary>
+        /// <remarks>
+        /// The walk above reads collections the way the policy does, and the core reads a narrower
+        /// set of them: a path through an <c>IReadOnlyList&lt;T&gt;</c> is one the policy can deny and
+        /// the core cannot project.
+        /// </remarks>
+        internal string? Unprojectable(IEnumerable<string> paths)
+        {
+            foreach (string path in paths)
+            {
+                try
+                {
+                    CacheReflection.ValidatePropertyPath(_entityType, path);
+                }
+                catch (LogicException)
+                {
+                    return path;
+                }
+            }
+
+            return null;
+        }
+
+        /// <summary>The type a validated path names, or null when it names nothing.</summary>
+        private Type? TypeAt(string path) => TypeAt(_entityType, path);
+
+        private static Type? TypeAt(Type root, string path)
+        {
+            try
+            {
+                return CacheReflection.GetFieldType(root, path);
+            }
+            catch (LogicException)
+            {
+                return null;
+            }
+        }
+
+        /// <summary>
+        /// What one reference to a field spends.
+        /// </summary>
+        /// <remarks>
+        /// The field's own weight when something weighs it, and the standing default otherwise.
+        /// Null and zero are different answers here: null is "nobody weighed this field", which the
+        /// host's default decides, and zero is "this field is free", which the host's default must
         /// not override.
         /// </remarks>
         internal int CostOf(string fieldPath) =>
@@ -2907,6 +4009,66 @@ internal void DenySegmentInference(string fieldPath, FieldPolicy policy)
             throw Exception(fieldPath, PolicyFeature.Segment, PolicyErrorCode.FieldDeniedForSegment, policy);
         }
 
+        /// <summary>How many decisions the query's trace holds.</summary>
+        internal int TraceCount => _trace.Count;
+
+        /// <summary>Withdraws the decisions recorded after the first <paramref name="count"/>.</summary>
+        internal void WithdrawTrace(int count) => _trace.Withdraw(count);
+
+        /// <summary>
+        /// Records that a synthesized projection left a member out whole, and why: something beneath it
+        /// is denied and the member cannot be narrowed.
+        /// </summary>
+        internal void LeaveOut(string fieldPath, string reason) =>
+            _trace.Add(new PolicyDecision(fieldPath, PolicyFeature.Select, PolicyAction.Dropped, reason));
+
+        /// <summary>
+        /// Refuses, in either tier, a projection that would have to be narrowed around a denied field
+        /// and cannot be built that way.
+        /// </summary>
+        /// <remarks>
+        /// Dropping is not an option here, for the reason it is not for a carried key: the projection
+        /// that would be built is not the one that was gated, so the only way to honour the denial is
+        /// to decline to build it.
+        /// </remarks>
+        internal void RefuseNarrowing(string fieldPath, FieldPolicy? policy, string reason)
+        {
+            _trace.Add(new PolicyDecision(fieldPath, PolicyFeature.Select, PolicyAction.Denied, reason));
+
+            if (IsDryRun)
+            {
+                return;
+            }
+
+            throw Exception(fieldPath, PolicyFeature.Select, PolicyErrorCode.FieldDeniedForSelect, policy);
+        }
+
+        /// <summary>
+        /// Applies a denial the policy cannot name a path to: a field denied for Select that a named
+        /// member holds beyond the walker's depth or inside a framework collection. Throws in the strict
+        /// tier, as a denied field beneath a named navigation does, and otherwise records the drop.
+        /// </summary>
+        /// <returns>True when the caller must narrow it away. False in a dry run.</returns>
+        internal bool RefuseHidden(string fieldPath)
+        {
+            const string origin = "it holds a field denied for Select where no path can name it";
+
+            _trace.Add(new PolicyDecision(
+                fieldPath, PolicyFeature.Select, IsStrict ? PolicyAction.Denied : PolicyAction.Dropped, origin));
+
+            if (IsDryRun)
+            {
+                return false;
+            }
+
+            if (IsStrict)
+            {
+                throw Exception(fieldPath, PolicyFeature.Select, PolicyErrorCode.FieldDeniedForSelect, null);
+            }
+
+            return true;
+        }
+
         /// <summary>Records that a field of the type's default order was left out for this caller.</summary>
         internal void SkipDefaultOrder(string fieldPath, FieldPolicy policy)
         {
diff --git a/DynamicWhere.ex/Policies/Source/KnownSubtypes.cs b/DynamicWhere.ex/Policies/Source/KnownSubtypes.cs
new file mode 100644
index 0000000..4b111e1
--- /dev/null
+++ b/DynamicWhere.ex/Policies/Source/KnownSubtypes.cs
@@ -0,0 +1,251 @@
+using System.Collections.Concurrent;
+using System.Reflection;
+
+namespace DynamicWhere.ex.Policies.Source;
+
+/// <summary>
+/// The types loaded into the process that derive from a type or implement it: what a member declared as
+/// that type can hold at run time.
+/// </summary>
+/// <remarks>
+/// A policy is read from declared types, and a member declared as a base class or an interface holds
+/// whichever subtype its value is. A <c>[DwDenied]</c> field a subtype declares is therefore carried by a
+/// member the policy reads as clean, unless the subtypes are read too.
+/// <para>
+/// Every object's type is loaded before the object exists, so the loaded assemblies are the whole answer
+/// for any value a query returns. The framework's own assemblies are left out: none of them declares a
+/// subtype of an application's type, and a framework type carries no policy. Every other assembly is
+/// indexed once, each type under every base class and interface it has, so a search is a lookup. A
+/// generic type is indexed under its definition as well as its own instantiation, and a subtype that is
+/// itself generic is returned open, since the instantiation a row holds is not known.
+/// </para>
+/// <para>
+/// Loading another such assembly may add subtypes, so the index is rebuilt after one loads. An assembly
+/// emitted at run time, or one holding only resources, cannot declare one.
+/// </para>
+/// </remarks>
+internal static class KnownSubtypes
+{
+    private static readonly object Building = new();
+
+    /// <summary>Every assembly seen loading, in case one raises its event before the domain lists it.</summary>
+    private static readonly ConcurrentDictionary<Assembly, byte> SeenLoading = new();
+
+    private static int _epoch;
+
+    private static Index? _index;
+
+    static KnownSubtypes() =>
+        AppDomain.CurrentDomain.AssemblyLoad += (_, loaded) =>
+        {
+            if (Searched(loaded.LoadedAssembly))
+            {
+                SeenLoading.TryAdd(loaded.LoadedAssembly, 0);
+                Interlocked.Increment(ref _epoch);
+            }
+        };
+
+    /// <summary>Changes whenever an assembly that could declare a subtype loads, and with it every answer read from one.</summary>
+    internal static int Epoch => Volatile.Read(ref _epoch);
+
+    /// <summary>Every loaded type, other than the type itself, whose values the type's members can hold.</summary>
+    internal static IReadOnlyList<Type> Of(Type type)
+    {
+        if (type.IsSealed || type.IsValueType || type.IsGenericParameter || type == typeof(object))
+        {
+            return Array.Empty<Type>();
+        }
+
+        Index index = Current();
+        List<Type>? found = null;
+
+        if (index.Descendants.TryGetValue(type, out Type[]? direct))
+        {
+            found = new List<Type>(direct);
+        }
+
+        // A subtype declared over the definition, class Tagged<T> : Base<T>, may be any instantiation of it;
+        // and a type still open itself may be any instantiation, so every subtype of the definition counts.
+        if (type.IsGenericType
+            && index.Descendants.TryGetValue(type.GetGenericTypeDefinition(), out Type[]? byDefinition))
+        {
+            found ??= new List<Type>();
+
+            foreach (Type candidate in byDefinition)
+            {
+                if ((type.ContainsGenericParameters || CanBe(candidate, type)) && !found.Contains(candidate))
+                {
+                    found.Add(candidate);
+                }
+            }
+        }
+
+        return found is null ? Array.Empty<Type>() : found;
+    }
+
+    /// <summary>
+    /// True when a type indexed under a generic type's definition can be a value of one instantiation of it.
+    /// A closed type can when the runtime says so, which reads variance: a member typed
+    /// IFeed&lt;Card&gt;, with <c>out T</c>, holds an IFeed&lt;VisaCard&gt;. An open generic one can when its own
+    /// base or interface of that definition is still open, or is one of those. One over another
+    /// instantiation, class Fixed&lt;T&gt; : Base&lt;string&gt;, never holds a Base&lt;int&gt;.
+    /// </summary>
+    private static bool CanBe(Type candidate, Type type)
+    {
+        if (!candidate.ContainsGenericParameters)
+        {
+            return type.IsAssignableFrom(candidate);
+        }
+
+        Type definition = type.GetGenericTypeDefinition();
+        IEnumerable<Type> ancestors = type.IsInterface ? Interfaces(candidate) : BaseTypes(candidate);
+
+        return ancestors.Any(ancestor => ancestor.IsGenericType
+                                         && ancestor.GetGenericTypeDefinition() == definition
+                                         && (ancestor.ContainsGenericParameters || type.IsAssignableFrom(ancestor)));
+    }
+
+    private static IEnumerable<Type> BaseTypes(Type type)
+    {
+        for (Type? ancestor = type.BaseType; ancestor is not null; ancestor = ancestor.BaseType)
+        {
+            yield return ancestor;
+        }
+    }
+
+    /// <summary>The index for the assemblies loaded now, built once for each epoch.</summary>
+    private static Index Current()
+    {
+        if (Volatile.Read(ref _index) is { } index && index.Epoch == Epoch)
+        {
+            return index;
+        }
+
+        lock (Building)
+        {
+            if (_index is { } built && built.Epoch == Epoch)
+            {
+                return built;
+            }
+
+            // The epoch is read before the assemblies, so one loading meanwhile rebuilds the index again.
+            int epoch = Epoch;
+            Index fresh = Build(epoch);
+
+            Volatile.Write(ref _index, fresh);
+
+            return fresh;
+        }
+    }
+
+    private static Index Build(int epoch)
+    {
+        HashSet<Assembly> assemblies = new(AppDomain.CurrentDomain.GetAssemblies().Where(Searched));
+
+        // One the domain lists now needs no holding on to: this index reads it, and every later one will.
+        foreach (Assembly seen in SeenLoading.Keys)
+        {
+            if (!assemblies.Add(seen))
+            {
+                SeenLoading.TryRemove(seen, out _);
+            }
+        }
+
+        Dictionary<Type, List<Type>> descendants = new();
+
+        void Add(Type ancestor, Type type)
+        {
+            Type key = ancestor.IsGenericType && ancestor.ContainsGenericParameters
+                ? ancestor.GetGenericTypeDefinition()
+                : ancestor;
+
+            if (!descendants.TryGetValue(key, out List<Type>? list))
+            {
+                descendants[key] = list = new List<Type>();
+            }
+
+            list.Add(type);
+
+            if (key != ancestor || !ancestor.IsGenericType)
+            {
+                return;
+            }
+
+            // A closed ancestor, Base<int>, is also one instantiation of its definition.
+            Type definition = ancestor.GetGenericTypeDefinition();
+
+            if (!descendants.TryGetValue(definition, out List<Type>? byDefinition))
+            {
+                descendants[definition] = byDefinition = new List<Type>();
+            }
+
+            byDefinition.Add(type);
+        }
+
+        foreach (Assembly assembly in assemblies)
+        {
+            foreach (Type type in TypesOf(assembly))
+            {
+                for (Type? ancestor = type.BaseType; ancestor is not null && ancestor != typeof(object); ancestor = ancestor.BaseType)
+                {
+                    Add(ancestor, type);
+                }
+
+                foreach (Type contract in Interfaces(type))
+                {
+                    Add(contract, type);
+                }
+            }
+        }
+
+        return new Index(epoch, descendants.ToDictionary(entry => entry.Key, entry => entry.Value.Distinct().ToArray()));
+    }
+
+    /// <summary>An assembly that can declare a subtype of an application's type.</summary>
+    private static bool Searched(Assembly assembly)
+    {
+        if (assembly.IsDynamic)
+        {
+            return false;
+        }
+
+        AssemblyName name = assembly.GetName();
+
+        if (!string.IsNullOrEmpty(name.CultureName))
+        {
+            return false;
+        }
+
+        string simple = name.Name ?? string.Empty;
+
+        return !(simple is "mscorlib" or "netstandard" or "System" or "WindowsBase"
+                 || simple.StartsWith("System.", StringComparison.Ordinal)
+                 || simple.StartsWith("Microsoft.", StringComparison.Ordinal));
+    }
+
+    private static Type[] TypesOf(Assembly assembly)
+    {
+        try
+        {
+            return assembly.GetTypes();
+        }
+        catch (ReflectionTypeLoadException partial)
+        {
+            return partial.Types.OfType<Type>().ToArray();
+        }
+    }
+
+    private static Type[] Interfaces(Type type)
+    {
+        try
+        {
+            return type.GetInterfaces();
+        }
+        catch (TypeLoadException)
+        {
+            return Array.Empty<Type>();
+        }
+    }
+
+    private sealed record Index(int Epoch, Dictionary<Type, Type[]> Descendants);
+}
diff --git a/DynamicWhere.ex/Policies/Source/PolicyQueryable.cs b/DynamicWhere.ex/Policies/Source/PolicyQueryable.cs
index 9501871..fb617ea 100644
--- a/DynamicWhere.ex/Policies/Source/PolicyQueryable.cs
+++ b/DynamicWhere.ex/Policies/Source/PolicyQueryable.cs
@@ -11,6 +11,8 @@
 using DynamicWhere.ex.Source;
 using Microsoft.EntityFrameworkCore;
 using System.Linq.Dynamic.Core;
+using System.Linq.Expressions;
+using System.Reflection;
 
 namespace DynamicWhere.ex.Policies.Source;
 
@@ -42,6 +44,11 @@ public sealed class PolicyQueryable<T> where T : class
     // gate. A caller whose orders were all dropped still sent orders, and gets no default in their place.
     private readonly bool _ordered;
 
+    // True once a composed Select, or a composed Filter carrying a projection, has run on this chain.
+    // Such a chain stays in whatever order it had: the default is for the rows the caller's source
+    // makes, and a projection the caller composes afterwards is theirs to order.
+    private readonly bool _projected;
+
     private TypePolicy? _typePolicy;
 
     /// <summary>
@@ -53,7 +60,8 @@ internal PolicyQueryable(
         PolicyResolver resolver,
         DwPolicyOptions options,
         PolicyTrace? carried = null,
-        bool ordered = false)
+        bool ordered = false,
+        bool projected = false)
     {
         _source = source;
         _context = context;
@@ -61,6 +69,7 @@ internal PolicyQueryable(
         _options = options;
         _carried = carried;
         _ordered = ordered;
+        _projected = projected;
     }
 
     /// <summary>
@@ -123,7 +132,27 @@ public FilterResult<T> ToList(Filter filter, bool getQueryString = false)
     /// <param name="getQueryString">When true, includes the generated SQL in the result.</param>
     /// <exception cref="ArgumentNullException">Thrown when <paramref name="filter"/> is null.</exception>
     /// <exception cref="PolicyException">Thrown when the policy refuses part of the filter.</exception>
-    public async Task<FilterResult<T>> ToListAsync(Filter filter, bool getQueryString = false)
+    public Task<FilterResult<T>> ToListAsync(Filter filter, bool getQueryString = false) =>
+        ToListAsync(filter, getQueryString, CancellationToken.None);
+
+    /// <summary>Applies a filter asynchronously and returns the matching page.</summary>
+    /// <param name="filter">The caller's filter. Never modified.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="filter"/> is null.</exception>
+    /// <exception cref="PolicyException">Thrown when the policy refuses part of the filter.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public Task<FilterResult<T>> ToListAsync(Filter filter, CancellationToken cancellationToken) =>
+        ToListAsync(filter, false, cancellationToken);
+
+    /// <summary>Applies a filter asynchronously and returns the matching page.</summary>
+    /// <param name="filter">The caller's filter. Never modified.</param>
+    /// <param name="getQueryString">When true, includes the generated SQL in the result.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="filter"/> is null.</exception>
+    /// <exception cref="PolicyException">Thrown when the policy refuses part of the filter.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public async Task<FilterResult<T>> ToListAsync(
+        Filter filter, bool getQueryString, CancellationToken cancellationToken)
     {
         try
         {
@@ -134,7 +163,7 @@ public async Task<FilterResult<T>> ToListAsync(Filter filter, bool getQueryStrin
 
             using (PolicyScope.Enter(_context, LastTrace))
             {
-                FilterResult<T> result = await Guarded().ToListAsync(sanitized, getQueryString);
+                FilterResult<T> result = await Guarded().ToListAsync(sanitized, getQueryString, cancellationToken);
 
                 ResultTransformer.Rows(
                     result.Data, TypePolicy, sanitized.Selects, _context, _options, trace);
@@ -192,7 +221,27 @@ public FilterResult<dynamic> ToListDynamic(Filter filter, bool getQueryString =
     /// <param name="getQueryString">When true, includes the generated SQL in the result.</param>
     /// <exception cref="ArgumentNullException">Thrown when <paramref name="filter"/> is null.</exception>
     /// <exception cref="PolicyException">Thrown when the policy refuses part of the filter.</exception>
-    public async Task<FilterResult<dynamic>> ToListAsyncDynamic(Filter filter, bool getQueryString = false)
+    public Task<FilterResult<dynamic>> ToListAsyncDynamic(Filter filter, bool getQueryString = false) =>
+        ToListAsyncDynamic(filter, getQueryString, CancellationToken.None);
+
+    /// <summary>Applies a filter asynchronously and returns the matching page as dynamic objects.</summary>
+    /// <param name="filter">The caller's filter. Never modified.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="filter"/> is null.</exception>
+    /// <exception cref="PolicyException">Thrown when the policy refuses part of the filter.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public Task<FilterResult<dynamic>> ToListAsyncDynamic(Filter filter, CancellationToken cancellationToken) =>
+        ToListAsyncDynamic(filter, false, cancellationToken);
+
+    /// <summary>Applies a filter asynchronously and returns the matching page as dynamic objects.</summary>
+    /// <param name="filter">The caller's filter. Never modified.</param>
+    /// <param name="getQueryString">When true, includes the generated SQL in the result.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="filter"/> is null.</exception>
+    /// <exception cref="PolicyException">Thrown when the policy refuses part of the filter.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public async Task<FilterResult<dynamic>> ToListAsyncDynamic(
+        Filter filter, bool getQueryString, CancellationToken cancellationToken)
     {
         try
         {
@@ -203,7 +252,7 @@ public async Task<FilterResult<dynamic>> ToListAsyncDynamic(Filter filter, bool
 
             using (PolicyScope.Enter(_context, LastTrace))
             {
-                FilterResult<dynamic> result = await Guarded().ToListAsyncDynamic(sanitized, getQueryString);
+                FilterResult<dynamic> result = await Guarded().ToListAsyncDynamic(sanitized, getQueryString, cancellationToken);
 
                 ResultTransformer.Rows(
                     result.Data, TypePolicy, sanitized.Selects, _context, _options, trace);
@@ -280,7 +329,27 @@ public SummaryResult ToList(Summary summary, bool getQueryString = false)
     /// <param name="getQueryString">When true, includes the generated SQL in the result.</param>
     /// <exception cref="ArgumentNullException">Thrown when <paramref name="summary"/> is null.</exception>
     /// <exception cref="PolicyException">Thrown when the policy refuses part of the summary.</exception>
-    public async Task<SummaryResult> ToListAsync(Summary summary, bool getQueryString = false)
+    public Task<SummaryResult> ToListAsync(Summary summary, bool getQueryString = false) =>
+        ToListAsync(summary, getQueryString, CancellationToken.None);
+
+    /// <summary>Applies a summary asynchronously and returns the grouped page.</summary>
+    /// <param name="summary">The caller's summary. Never modified.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="summary"/> is null.</exception>
+    /// <exception cref="PolicyException">Thrown when the policy refuses part of the summary.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public Task<SummaryResult> ToListAsync(Summary summary, CancellationToken cancellationToken) =>
+        ToListAsync(summary, false, cancellationToken);
+
+    /// <summary>Applies a summary asynchronously and returns the grouped page.</summary>
+    /// <param name="summary">The caller's summary. Never modified.</param>
+    /// <param name="getQueryString">When true, includes the generated SQL in the result.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="summary"/> is null.</exception>
+    /// <exception cref="PolicyException">Thrown when the policy refuses part of the summary.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public async Task<SummaryResult> ToListAsync(
+        Summary summary, bool getQueryString, CancellationToken cancellationToken)
     {
         try
         {
@@ -291,7 +360,7 @@ public async Task<SummaryResult> ToListAsync(Summary summary, bool getQueryStrin
 
             using (PolicyScope.Enter(_context, LastTrace))
             {
-                SummaryResult result = await Guarded().ToListAsync(sanitized, getQueryString);
+                SummaryResult result = await Guarded().ToListAsync(sanitized, getQueryString, cancellationToken);
 
                 // First of the three, and the order matters. A group below the floor is one the caller
                 // may not see at all, so nothing downstream should form an opinion about it: transformed
@@ -330,7 +399,16 @@ public async Task<SummaryResult> ToListAsync(Summary summary, bool getQueryStrin
     /// <param name="segment">The caller's segment. Never modified.</param>
     /// <exception cref="ArgumentNullException">Thrown when <paramref name="segment"/> is null.</exception>
     /// <exception cref="PolicyException">Thrown when the policy refuses part of the segment.</exception>
-    public async Task<SegmentResult<T>> ToListAsync(Segment segment)
+    public Task<SegmentResult<T>> ToListAsync(Segment segment) =>
+        ToListAsync(segment, CancellationToken.None);
+
+    /// <summary>Applies a set operation asynchronously and returns the combined page.</summary>
+    /// <param name="segment">The caller's segment. Never modified.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="segment"/> is null.</exception>
+    /// <exception cref="PolicyException">Thrown when the policy refuses part of the segment.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public async Task<SegmentResult<T>> ToListAsync(Segment segment, CancellationToken cancellationToken)
     {
         try
         {
@@ -338,13 +416,14 @@ public async Task<SegmentResult<T>> ToListAsync(Segment segment)
 
             Segment sanitized = FilterSanitizer.Sanitize<T>(
                 segment, _resolver, _context, _options, trace,
-                applyDefaultOrder: TakesDefaultOrder);
+                applyDefaultOrder: TakesDefaultOrder,
+                rows: RowShape.Of(_source));
 
             LastTrace = trace;
 
             using (PolicyScope.Enter(_context, LastTrace))
             {
-                SegmentResult<T> result = await Guarded().ToListAsync(sanitized);
+                SegmentResult<T> result = await Guarded().ToListAsync(sanitized, cancellationToken);
 
                 ResultTransformer.Rows(
                     result.Data, TypePolicy, sanitized.Selects, _context, _options, trace);
@@ -373,7 +452,7 @@ public PolicyQueryable<T> Select(List<string> fields)
 
             using (PolicyScope.Enter(_context, LastTrace))
             {
-                return Chain(Scoped(sanitized).Select(sanitized.Selects!));
+                return Chain(Scoped(sanitized).Select(sanitized.Selects!), projected: true);
             }
         }
         catch (PolicyException refusal) when (Refused(refusal))
@@ -551,7 +630,12 @@ public PolicyQueryable<T> Filter(Filter filter)
 
             using (PolicyScope.Enter(_context, LastTrace))
             {
-                return Chain(Guarded().Filter(sanitized));
+                // A caller who sent orders gets no default later in the chain, whether or not any of
+                // them survived, exactly as a composed Order does.
+                return Chain(
+                    Guarded().Filter(sanitized),
+                    ordered: filter.Orders is { Count: > 0 },
+                    projected: sanitized.Selects is not null);
             }
         }
         catch (PolicyException refusal) when (Refused(refusal))
@@ -651,10 +735,30 @@ static bool IsGroupSize(AggregateBy aggregate) =>
     /// point every guarded query passes through, so no individual method can forget it.
     /// <para>
     /// Harmless on a non-EF source: the EF extension returns the query unchanged when the provider
-    /// is not one of its own.
+    /// is not one of its own. A provider that wraps EF Core's, as LinqKit's <c>AsExpandable</c> and
+    /// DelegateDecompiler's <c>Decompile</c> do, is not one of its own either, and passes the query on to
+    /// EF Core with tracking still on: the tracked entities' navigations were then filled in on the rows,
+    /// and a masked value became a pending change. On such a query the call goes into the query itself,
+    /// where EF Core reads it.
     /// </para>
     /// </remarks>
-    private IQueryable<T> Guarded() => _source.AsNoTracking();
+    private IQueryable<T> Guarded()
+    {
+        IQueryable<T> untracked = _source.AsNoTracking();
+
+        if (!ReferenceEquals(untracked, _source) || QueryRoot.Model(_source.Expression) is null)
+        {
+            return untracked;
+        }
+
+        return _source.Provider.CreateQuery<T>(
+            Expression.Call(null, AsNoTrackingMethod.MakeGenericMethod(typeof(T)), _source.Expression));
+    }
+
+    private static readonly MethodInfo AsNoTrackingMethod = typeof(EntityFrameworkQueryableExtensions)
+        .GetMethods()
+        .Single(method => method.Name == nameof(EntityFrameworkQueryableExtensions.AsNoTracking)
+                          && method.GetParameters().Length == 1);
 
     /// <summary>
     /// Returns the query as a plain <see cref="IQueryable{T}"/>, outside the guard.
@@ -674,15 +778,18 @@ static bool IsGroupSize(AggregateBy aggregate) =>
 
     /// <summary>Wraps a composed query back into a handle, carrying the trace so far.</summary>
     /// <param name="composed">The composed query.</param>
-    /// <param name="ordered">True when the composing call was an <c>Order</c>.</param>
-    private PolicyQueryable<T> Chain(IQueryable<T> composed, bool ordered = false) =>
-        new(composed, _context, _resolver, _options, LastTrace, _ordered || ordered);
+    /// <param name="ordered">True when the composing call sent orders.</param>
+    /// <param name="projected">True when the composing call projected the rows.</param>
+    private PolicyQueryable<T> Chain(IQueryable<T> composed, bool ordered = false, bool projected = false) =>
+        new(composed, _context, _resolver, _options, LastTrace, _ordered || ordered, _projected || projected);
 
     /// <summary>
     /// True when a query over this handle takes the type's default order: the caller composed no
-    /// <c>Order</c>, and nothing ordered or projected the source.
+    /// <c>Order</c> and no projection, nothing ordered the source, and no projection in the source hides
+    /// a field the default names.
     /// </summary>
-    private bool TakesDefaultOrder => !_ordered && DefaultOrder.Applies(_source.Expression);
+    private bool TakesDefaultOrder =>
+        !_ordered && !_projected && DefaultOrder.Applies(_source.Expression, typeof(T));
 
     /// <summary>
     /// Refuses a method that hands back a query the caller materializes, when this type's values
@@ -789,7 +896,9 @@ private Filter Sanitize(Filter filter, PolicyTrace trace)
     {
         // A source the caller ordered before guarding it keeps that order: a default would replace it.
         Filter sanitized = FilterSanitizer.Sanitize<T>(
-            filter, _resolver, _context, _options, trace, applyDefaultOrder: TakesDefaultOrder);
+            filter, _resolver, _context, _options, trace,
+            applyDefaultOrder: TakesDefaultOrder,
+            rows: RowShape.Of(_source));
 
         LastTrace = trace;
 
diff --git a/DynamicWhere.ex/Policies/Source/RowShape.cs b/DynamicWhere.ex/Policies/Source/RowShape.cs
new file mode 100644
index 0000000..131f939
--- /dev/null
+++ b/DynamicWhere.ex/Policies/Source/RowShape.cs
@@ -0,0 +1,862 @@
+using System.Collections;
+using System.Collections.Concurrent;
+using System.Linq.Expressions;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using DynamicWhere.ex.Optimization.Cache.Source;
+using DynamicWhere.ex.Source;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Metadata;
+using Microsoft.EntityFrameworkCore.Query;
+
+namespace DynamicWhere.ex.Policies.Source;
+
+/// <summary>
+/// What a guarded query's source puts in the members of its rows, as far as a projection the library
+/// synthesizes is concerned.
+/// </summary>
+/// <remarks>
+/// A caller who sends no projection is owed what an unguarded call would return, less what the policy
+/// withholds. Which members hold what depends on the source, and so does which denied value could
+/// reach the result at all:
+/// <list type="bullet">
+///   <item><description>
+///     An entity query loads the entity's columns, its owned and complex members, and a navigation
+///     only when something loads it: an <c>Include</c>, an automatic include or a lazy loader. A value
+///     beneath a navigation nothing loads never reaches the result, so a denial there needs no
+///     projection; and projecting the navigation would load it. A member the model does not map is
+///     computed by the class, from whatever EF Core loaded into it, so it counts as holding its type.
+///   </description></item>
+///   <item><description>
+///     A projection holds exactly the members its initializer assigns. The others hold defaults, and
+///     narrowing one reads it through <c>EF.Property</c>, which EF Core cannot translate for a member
+///     the initializer never bound.
+///   </description></item>
+///   <item><description>
+///     Rows in memory hold everything, and a member kept from them is the caller's own object, which
+///     a transform would then change in place.
+///   </description></item>
+/// </list>
+/// Read from the query itself, never from the rows, so the sanitizer stays pure: this is decided
+/// once, before it runs. Where the query does not say, every value counts as reaching the result.
+/// </remarks>
+internal sealed class RowShape
+{
+    /// <summary>The key EF Core's relational layer gives an owned type stored in a JSON column.</summary>
+    private const string JsonContainer = "Relational:ContainerColumnName";
+
+    /// <summary>
+    /// A source this library cannot read: no model, not a projection it can see into, not rows in
+    /// memory. Every value beneath a member is taken to reach the result.
+    /// </summary>
+    internal static readonly RowShape Unknown = new(RowKind.Entity);
+
+    /// <summary>Rows in memory.</summary>
+    internal static readonly RowShape InMemory = new(RowKind.InMemory);
+
+    /// <summary>Whether a class can be handed a lazy loader, read once per class.</summary>
+    private static readonly ConcurrentDictionary<Type, bool> TakesLoader = new();
+
+    /// <summary>The complex properties of each entity type, read once per entity type.</summary>
+    private static readonly ConditionalWeakTable<IEntityType, HashSet<string>> ComplexByType = new();
+
+    private readonly HashSet<string>? _assigned;
+    private readonly Dictionary<string, Type> _built = new(StringComparer.OrdinalIgnoreCase);
+    private readonly HashSet<string> _narrowable = new(StringComparer.OrdinalIgnoreCase);
+    private readonly HashSet<string> _kept = new(StringComparer.OrdinalIgnoreCase);
+    private readonly HashSet<string> _includes = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<string, string> _loadedWhole = new(StringComparer.OrdinalIgnoreCase);
+    private readonly IEntityType? _entity;
+    private readonly bool _includeUnknown;
+
+    private RowShape(RowKind kind) => Kind = kind;
+
+    private RowShape(
+        RowKind kind, HashSet<string>? assigned, IEnumerable<string> narrowable, Type? built, IDictionary<string, Type> members)
+        : this(kind)
+    {
+        _assigned = assigned;
+        _narrowable.UnionWith(narrowable);
+        Built = built;
+
+        foreach (KeyValuePair<string, Type> member in members)
+        {
+            _built[member.Key] = member.Value;
+        }
+    }
+
+    private RowShape(IEntityType entity, IEnumerable<string> includes, bool includeUnknown)
+        : this(RowKind.Entity)
+    {
+        _entity = entity;
+        _includes.UnionWith(includes);
+        _includeUnknown = includeUnknown;
+
+        foreach (IProperty property in entity.GetProperties())
+        {
+            _kept.Add(property.Name);
+            _loadedWhole[property.Name] = "it is a column, which EF Core reads whole";
+        }
+
+        foreach (INavigation navigation in entity.GetNavigations())
+        {
+            if (IsJson(navigation.TargetEntityType))
+            {
+                _loadedWhole[navigation.Name] = "it is stored as JSON, which EF Core cannot narrow";
+            }
+            else
+            {
+                // An owned member is kept and narrowed; any other navigation is only ever narrowed for a
+                // caller who names it, since a synthesized projection leaves it out.
+                _narrowable.Add(navigation.Name);
+            }
+
+            if (IsOwned(navigation))
+            {
+                _kept.Add(navigation.Name);
+            }
+        }
+
+        foreach (ISkipNavigation navigation in entity.GetSkipNavigations())
+        {
+            _narrowable.Add(navigation.Name);
+        }
+
+        foreach (string complex in ComplexProperties(entity))
+        {
+            _kept.Add(complex);
+            _loadedWhole[complex] = "it is a complex property, which EF Core cannot narrow";
+        }
+    }
+
+    /// <summary>Where the rows come from.</summary>
+    internal RowKind Kind { get; }
+
+    /// <summary>
+    /// The type a projection constructs its rows as, which may be a subtype of the query's element type;
+    /// null for any other source.
+    /// </summary>
+    internal Type? Built { get; }
+
+    /// <summary>
+    /// The type a projection constructs a member's value as, or each element of a list it builds, when
+    /// the initializer says: <c>Contact = new ContactRow { … }</c> holds a <c>ContactRow</c> whatever the
+    /// member is declared as. Null when the value is read from somewhere else.
+    /// </summary>
+    internal Type? BuiltType(string member) =>
+        Kind == RowKind.Projected && _built.TryGetValue(member, out Type? type) ? type : null;
+
+    /// <summary>
+    /// True when a synthesized projection may keep a member holding an object: one a projection
+    /// assigned, or an entity's column, owned or complex member. Never an entity's navigation, which
+    /// projecting would load, and never an object held by a row in memory.
+    /// </summary>
+    internal bool Carries(string member) => Kind switch
+    {
+        RowKind.Projected => _assigned is null || _assigned.Contains(member),
+        RowKind.Entity => _entity is not null && _kept.Contains(member),
+        _ => false
+    };
+
+    /// <summary>
+    /// True when a synthesized projection may keep a member that holds a value. An entity keeps only
+    /// its mapped ones: a value EF Core does not map makes it read the whole entity to compute it, the
+    /// columns the policy denies included, and holds only its initial value anyway.
+    /// </summary>
+    internal bool CarriesValue(string member) => Kind switch
+    {
+        RowKind.Projected => _assigned is null || _assigned.Contains(member),
+        RowKind.Entity => _entity is null || _kept.Contains(member),
+        _ => true
+    };
+
+    /// <summary>
+    /// True when the core's projection can narrow the member to some of the fields beneath it. Only on
+    /// EF Core: its narrowing of a reference reads it through <c>EF.Property</c>. Not a column or a
+    /// complex property, which EF Core loads whole, not an owned type stored as JSON, and not a member
+    /// a projection built in a way the narrowing cannot reach. A source this cannot read narrows as it
+    /// always did, and leaves the core to refuse what it cannot build.
+    /// </summary>
+    internal bool Narrows(string member) =>
+        (Kind == RowKind.Entity && _entity is null) || _narrowable.Contains(member);
+
+    /// <summary>Why the core cannot narrow a member this source carries, for the trace.</summary>
+    internal string WhyNotNarrowed(string member) => Kind switch
+    {
+        RowKind.InMemory => "the rows are in memory, and narrowing it needs EF Core",
+        RowKind.Projected => "the projection builds it in a way the core cannot narrow",
+        _ => _loadedWhole.TryGetValue(member, out string? reason) ? reason : "narrowing it needs EF Core"
+    };
+
+    /// <summary>
+    /// True when the value at a path beneath the root can reach the result: every one in memory or in
+    /// a projection's assigned member, and, on an entity, one every navigation on the way to is loaded.
+    /// </summary>
+    /// <remarks>
+    /// A navigation is loaded when it is owned, included, automatically included, or reachable by a
+    /// lazy loader. A member the model does not map is computed by the class, and a getter over a mapped
+    /// field or a private navigation hands out what EF Core loaded, so it counts as loaded too. Anything
+    /// the model cannot answer for counts as loaded, which only ever asks for a projection that turns out
+    /// not to be needed. A rule may spell a path in any letter case, so each segment is read through the
+    /// member it names.
+    /// </remarks>
+    internal bool Materializes(string path)
+    {
+        string[] segments = path.Split('.');
+
+        if (Kind == RowKind.InMemory)
+        {
+            return true;
+        }
+
+        if (Kind == RowKind.Projected)
+        {
+            return _assigned is null || _assigned.Contains(segments[0]);
+        }
+
+        IEntityType? current = _entity;
+        string prefix = string.Empty;
+
+        for (int i = 0; i < segments.Length - 1; i++)
+        {
+            if (current is null || CacheReflection.FindProperty(current.ClrType, segments[i]) is not { } member)
+            {
+                return true;
+            }
+
+            string name = member.Name;
+
+            prefix = i == 0 ? name : $"{prefix}.{name}";
+
+            // A column holding an object, or a complex property, is read whole with its row.
+            if (current.FindProperty(name) is not null || ComplexProperties(current).Contains(name))
+            {
+                return true;
+            }
+
+            INavigationBase? navigation =
+                (INavigationBase?)current.FindNavigation(name) ?? current.FindSkipNavigation(name);
+
+            if (navigation is null)
+            {
+                return true;
+            }
+
+            if (!Loads(current, navigation, prefix))
+            {
+                return false;
+            }
+
+            current = navigation.TargetEntityType;
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// Every member the value at a path loads beneath it, each with its path from the root, when an
+    /// entity query's model can say; null when the value can carry anything its type holds.
+    /// </summary>
+    /// <remarks>
+    /// Naming a member in a projection loads it, so the path's own segments are not asked about. Beneath
+    /// it the model decides: an entity's columns, owned and complex members, and the navigations
+    /// something loads, and the same for every type the model derives from it, whose rows EF Core
+    /// materializes as that type. A member the model does not map is read whole, as a column is: its
+    /// getter can hand out anything the entity holds. A lazy loader in reach can fill any navigation,
+    /// which bounds nothing, and so does a query whose includes cannot be read.
+    /// </remarks>
+    internal List<Loaded>? LoadedBeneath(string path)
+    {
+        if (Kind != RowKind.Entity || _entity is null || _includeUnknown)
+        {
+            return null;
+        }
+
+        IEntityType entity = _entity;
+        string prefix = string.Empty;
+        string[] segments = path.Split('.');
+
+        for (int i = 0; i < segments.Length; i++)
+        {
+            if (CacheReflection.FindProperty(entity.ClrType, segments[i]) is not { } member)
+            {
+                return null;
+            }
+
+            prefix = i == 0 ? member.Name : $"{prefix}.{member.Name}";
+
+            // A value read whole: what it holds is its type's to say, and a path inside it names part of it.
+            if (entity.FindProperty(member.Name) is not null || ComplexProperties(entity).Contains(member.Name))
+            {
+                return i == segments.Length - 1 ? new List<Loaded> { new(prefix, member, true, Converted(entity, member.Name)) } : null;
+            }
+
+            INavigationBase? navigation =
+                (INavigationBase?)entity.FindNavigation(member.Name) ?? entity.FindSkipNavigation(member.Name);
+
+            // A member the model does not map holds what its getter computes: read it whole, as its type.
+            if (navigation is null)
+            {
+                return i == segments.Length - 1 ? new List<Loaded> { new(prefix, member, true) } : null;
+            }
+
+            entity = navigation.TargetEntityType;
+        }
+
+        List<Loaded> loaded = new();
+
+        return Collect(entity, prefix, loaded, new HashSet<(IEntityType, string?)>(), derivedOnly: false)
+            ? loaded
+            : null;
+    }
+
+    /// <summary>
+    /// Every member an entity query's rows load that a type the model derives from the root declares,
+    /// each with what it loads beneath it; null when a lazy loader or an unreadable include bounds
+    /// nothing, and for any other source.
+    /// </summary>
+    /// <remarks>
+    /// EF Core materializes each row as the type the database says it is, so a query over the root of a
+    /// hierarchy returns the derived types' columns too, which the root's own members never name.
+    /// </remarks>
+    internal List<Loaded>? LoadedByDerived()
+    {
+        if (Kind != RowKind.Entity || _entity is null || _includeUnknown)
+        {
+            return null;
+        }
+
+        List<Loaded> loaded = new();
+
+        return Collect(_entity, string.Empty, loaded, new HashSet<(IEntityType, string?)>(), derivedOnly: true)
+            ? loaded
+            : null;
+    }
+
+    /// <summary>
+    /// Collects what an entity loads beneath a path, its derived types' members included. False when a
+    /// lazy loader can fill any of its navigations.
+    /// </summary>
+    private bool Collect(
+        IEntityType entity, string prefix, List<Loaded> loaded, HashSet<(IEntityType, string?)> seen, bool derivedOnly)
+    {
+        // Off an include's path, what loads depends only on the type, so a type is read once there.
+        if (!seen.Add((entity, _includes.Contains(prefix) ? prefix : null)))
+        {
+            return true;
+        }
+
+        foreach (IEntityType type in entity.GetDerivedTypesInclusive())
+        {
+            if (derivedOnly && type == entity)
+            {
+                continue;
+            }
+
+            if (LoadsLazily(type))
+            {
+                return false;
+            }
+
+            foreach (PropertyInfo member in type.ClrType.GetProperties(BindingFlags.Public | BindingFlags.Instance))
+            {
+                // A derived type's inherited members are the base type's, read once from there.
+                if (!member.CanRead
+                    || member.GetIndexParameters().Length != 0
+                    || (type != entity && member.DeclaringType!.IsAssignableFrom(entity.ClrType)))
+                {
+                    continue;
+                }
+
+                string path = prefix.Length == 0 ? member.Name : $"{prefix}.{member.Name}";
+
+                if (type.FindProperty(member.Name) is not null || ComplexProperties(type).Contains(member.Name))
+                {
+                    loaded.Add(new Loaded(path, member, true, Converted(type, member.Name)));
+
+                    continue;
+                }
+
+                INavigationBase? navigation =
+                    (INavigationBase?)type.FindNavigation(member.Name) ?? type.FindSkipNavigation(member.Name);
+
+                // Not mapped: whatever its getter computes from what EF Core loaded, read as its type.
+                if (navigation is null)
+                {
+                    loaded.Add(new Loaded(path, member, true));
+
+                    continue;
+                }
+
+                if (!Loads(type, navigation, path))
+                {
+                    continue;
+                }
+
+                loaded.Add(new Loaded(path, member, false));
+
+                if (!Collect(navigation.TargetEntityType, path, loaded, seen, derivedOnly: false))
+                {
+                    return false;
+                }
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// True when a column's value comes from a value converter, which is the application's code and can hand
+    /// back an object of any type its member's type allows; for a complex property, when a member of it does.
+    /// </summary>
+    private static bool Converted(IEntityType type, string name) =>
+        type.FindProperty(name)?.GetValueConverter() is not null || ConvertedComplex(type).Contains(name);
+
+    /// <summary>The complex properties of an entity type with a converted member at any depth.</summary>
+    private static HashSet<string> ConvertedComplex(IEntityType entityType) =>
+        ConvertedComplexByType.GetValue(entityType, ReadConvertedComplex);
+
+    private static readonly ConditionalWeakTable<IEntityType, HashSet<string>> ConvertedComplexByType = new();
+
+    /// <summary>
+    /// Reads, through reflection since EF Core 6 has none, the complex properties whose type holds a converted
+    /// property. One that cannot be read counts as converted.
+    /// </summary>
+    private static HashSet<string> ReadConvertedComplex(IEntityType entityType)
+    {
+        HashSet<string> names = new(StringComparer.OrdinalIgnoreCase);
+
+        foreach (object complex in Items(entityType, "GetComplexProperties"))
+        {
+            if (complex.GetType().GetProperty("Name")?.GetValue(complex) is string name && HoldsConverted(complex, depth: 0))
+            {
+                names.Add(name);
+            }
+        }
+
+        return names;
+    }
+
+    private static bool HoldsConverted(object complex, int depth)
+    {
+        if (depth > MaxComplexDepth || complex.GetType().GetProperty("ComplexType")?.GetValue(complex) is not { } type)
+        {
+            return true;
+        }
+
+        return Items(type, "GetProperties").Any(property => property is not IReadOnlyProperty column || column.GetValueConverter() is not null)
+               || Items(type, "GetComplexProperties").Any(nested => HoldsConverted(nested, depth + 1));
+    }
+
+    /// <summary>How deep complex properties are read inside one another before the rest counts as converted.</summary>
+    private const int MaxComplexDepth = 8;
+
+    /// <summary>What a model object's parameterless method of the name returns, for a method some interface of it declares.</summary>
+    private static IEnumerable<object> Items(object model, string method)
+    {
+        foreach (Type contract in model.GetType().GetInterfaces())
+        {
+            if (contract.GetMethod(method, Type.EmptyTypes) is { } found && found.Invoke(model, null) is IEnumerable items)
+            {
+                return items.Cast<object>().ToList();
+            }
+        }
+
+        return Array.Empty<object>();
+    }
+
+    /// <summary>True when something loads a navigation of an entity reached along a path.</summary>
+    private bool Loads(IEntityType owner, INavigationBase navigation, string path) =>
+        (navigation is INavigation owned && IsOwned(owned))
+        || navigation.IsEagerLoaded
+        || _includeUnknown
+        || _includes.Contains(path)
+        || LoadsLazily(owner);
+
+    /// <summary>Reads the shape of a guarded query's source.</summary>
+    /// <remarks>
+    /// Rows in memory first, because a projection over them is still in memory. Then a projection that
+    /// builds its rows, which is how a caller makes its own row type out of entities. What is left is an
+    /// entity query, read from the EF Core model; without one, the source is <see cref="Unknown"/>. A
+    /// chain that reaches its rows through anything but the root's own, <c>Select(o =&gt; o.Customer)</c>,
+    /// a <c>SelectMany</c>, a <c>Join</c> or a <c>GroupBy</c>, holds entities EF Core loaded along
+    /// another path. Its includes name paths from another root, which EF Core still applies, and a
+    /// projection inside it, such as one behind an identity <c>Select</c>, loads whatever it assigns: with
+    /// either, every navigation counts as loaded. With neither, only an automatic include or a lazy
+    /// loader fills one, which the model says.
+    /// </remarks>
+    internal static RowShape Of<T>(IQueryable<T> source) where T : class
+    {
+        if (source.Provider is EnumerableQuery)
+        {
+            return InMemory;
+        }
+
+        if (DefaultOrder.BuildsRows(source.Expression))
+        {
+            return Projected(source);
+        }
+
+        if (QueryRoot.EntityType(source.Expression, typeof(T)) is not { } entity)
+        {
+            return Unknown;
+        }
+
+        HashSet<string> includes = new(StringComparer.OrdinalIgnoreCase);
+        bool unknown = !ReadIncludes(source.Expression, includes, out int included)
+                       || (QueryRoot.Reshapes(source.Expression) && (included > 0 || QueryRoot.Builds(source.Expression)));
+
+        return new RowShape(entity, includes, unknown);
+    }
+
+    /// <summary>
+    /// A projection that builds its rows: which members its outermost initializer assigns, and which of
+    /// those the core can narrow.
+    /// </summary>
+    private static RowShape Projected<T>(IQueryable<T> source) where T : class
+    {
+        MethodCallExpression select = DefaultOrder.RowSelect(source.Expression)!;
+        LambdaExpression selector = (LambdaExpression)DefaultOrder.StripQuotes(select.Arguments[1]);
+        Expression body = DefaultOrder.StripConversions(selector.Body);
+        Dictionary<string, Type> built = new(StringComparer.OrdinalIgnoreCase);
+
+        if (body is not MemberInitExpression initializer)
+        {
+            // A constructor with arguments says nothing about which member each argument sets: every
+            // member counts as assigned, and none can be narrowed.
+            return new RowShape(RowKind.Projected, null, Array.Empty<string>(), body.Type, built);
+        }
+
+        List<string> narrowable = new();
+
+        ParameterExpression row = selector.Parameters[0];
+        bool efCore = source.Provider is IAsyncQueryProvider;
+        IEntityType? rowSource = efCore ? QueryRoot.EntityType(source.Expression, row.Type) : null;
+        HashSet<string>? assigned = initializer.NewExpression.Arguments.Count > 0
+            ? null
+            : new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        foreach (MemberBinding binding in initializer.Bindings)
+        {
+            // After a constructor with arguments every member counts as assigned, since the constructor
+            // may set any of them; the initializer's own bindings still say what they hold.
+            assigned?.Add(binding.Member.Name);
+
+            if (binding is not MemberAssignment assignment)
+            {
+                continue;
+            }
+
+            if (BuiltBy(assignment.Expression) is { } type)
+            {
+                built[binding.Member.Name] = type;
+            }
+
+            // The narrowing reads the member through EF.Property, so only EF Core can run it.
+            if (efCore && CanNarrow(assignment, row, rowSource))
+            {
+                narrowable.Add(binding.Member.Name);
+            }
+        }
+
+        return new RowShape(RowKind.Projected, assigned, narrowable, initializer.Type, built);
+    }
+
+    /// <summary>
+    /// The type an assigned value is constructed as, <c>new ContactRow { … }</c>, or each element of a
+    /// list a subquery builds, <c>o.Lines.Select(l =&gt; new LineRow { … }).ToList()</c>; null otherwise.
+    /// </summary>
+    private static Type? BuiltBy(Expression expression)
+    {
+        Expression value = DefaultOrder.StripConversions(expression);
+
+        if (value is MemberInitExpression or NewExpression)
+        {
+            return value.Type;
+        }
+
+        if (value is MethodCallExpression { Method.Name: "ToList" or "ToArray" or "ToHashSet" } read
+            && (read.Method.DeclaringType == typeof(Enumerable) || read.Method.DeclaringType == typeof(Queryable))
+            && DefaultOrder.StripConversions(read.Arguments[0]) is MethodCallExpression { Method.Name: "Select" } select
+            && select.Arguments.Count == 2
+            && DefaultOrder.StripQuotes(select.Arguments[1]) is LambdaExpression { Body: var element }
+            && DefaultOrder.StripConversions(element) is MemberInitExpression or NewExpression)
+        {
+            return DefaultOrder.StripConversions(element).Type;
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// True when the core's narrowing of an assigned member translates: an object the initializer
+    /// builds, a list a subquery reads into one the core can bind, or a navigation of the entity the
+    /// projection reads that is neither complex nor stored as JSON.
+    /// </summary>
+    private static bool CanNarrow(MemberAssignment assignment, ParameterExpression row, IEntityType? rowSource)
+    {
+        Type memberType = assignment.Member is PropertyInfo property ? property.PropertyType : typeof(object);
+
+        // The core builds a List<T> for a narrowed collection and skips a member that cannot hold one.
+        if (CacheReflection.GetCollectionElementType(memberType) is { } element
+            && !memberType.IsAssignableFrom(typeof(List<>).MakeGenericType(element)))
+        {
+            return false;
+        }
+
+        Expression value = DefaultOrder.StripConversions(assignment.Expression);
+
+        if (value is MemberInitExpression)
+        {
+            return true;
+        }
+
+        if (value is MethodCallExpression { Method.Name: "ToList" or "ToArray" or "ToHashSet" } read
+            && (read.Method.DeclaringType == typeof(Enumerable) || read.Method.DeclaringType == typeof(Queryable)))
+        {
+            return true;
+        }
+
+        if (value is MemberExpression { Member: PropertyInfo member, Expression: { } owner }
+            && DefaultOrder.StripConversions(owner) == row
+            && rowSource?.FindNavigation(member.Name) is { } navigation)
+        {
+            return !IsJson(navigation.TargetEntityType);
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Collects every navigation path an <c>Include</c> or <c>ThenInclude</c> on the chain loads, each
+    /// with its prefixes. False when one names its path in a form this cannot read, so every navigation
+    /// counts as loaded.
+    /// </summary>
+    private static bool ReadIncludes(Expression expression, HashSet<string> includes, out int included)
+    {
+        List<MethodCallExpression> calls = new();
+
+        for (Expression? node = expression; node is MethodCallExpression call;
+             node = call.Arguments.Count > 0 ? call.Arguments[0] : null)
+        {
+            if (IsInclude(call))
+            {
+                calls.Add(call);
+            }
+        }
+
+        // An include somewhere else in the tree, in the other branch of a Concat or a Union, loads a
+        // navigation of rows this chain returns, and nothing here can say which.
+        IncludeCounter counter = new();
+
+        counter.Visit(expression);
+
+        included = counter.Count;
+
+        bool readable = counter.Count == calls.Count;
+        string? current = null;
+
+        for (int i = calls.Count - 1; i >= 0; i--)
+        {
+            MethodCallExpression call = calls[i];
+            bool then = call.Method.Name == nameof(EntityFrameworkQueryableExtensions.ThenInclude);
+            string? path = null;
+            bool named = false;
+
+            if (!then && call.Arguments[1] is ConstantExpression { Value: string text })
+            {
+                path = string.Join('.', text.Split('.', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries));
+                named = true;
+            }
+            else if (DefaultOrder.StripQuotes(call.Arguments[1]) is LambdaExpression lambda
+                     && MemberChain(lambda.Body, lambda.Parameters[0]) is { } chain)
+            {
+                path = then ? (current is null ? null : $"{current}.{chain}") : chain;
+            }
+
+            if (string.IsNullOrEmpty(path))
+            {
+                readable = false;
+                current = null;
+
+                continue;
+            }
+
+            string[] segments = path.Split('.');
+
+            for (int j = 1; j <= segments.Length; j++)
+            {
+                includes.Add(string.Join('.', segments, 0, j));
+            }
+
+            // A ThenInclude continues a lambda Include; one named by a string starts nothing to continue.
+            current = named ? null : path;
+        }
+
+        return readable;
+    }
+
+    private static bool IsInclude(MethodCallExpression call) =>
+        call.Method.DeclaringType == typeof(EntityFrameworkQueryableExtensions)
+        && call.Method.Name is nameof(EntityFrameworkQueryableExtensions.Include)
+            or nameof(EntityFrameworkQueryableExtensions.ThenInclude);
+
+    /// <summary>Counts every <c>Include</c> and <c>ThenInclude</c> anywhere in a query.</summary>
+    private sealed class IncludeCounter : ExpressionVisitor
+    {
+        internal int Count { get; private set; }
+
+        protected override Expression VisitMethodCall(MethodCallExpression node)
+        {
+            if (IsInclude(node))
+            {
+                Count++;
+            }
+
+            return base.VisitMethodCall(node);
+        }
+    }
+
+    /// <summary>
+    /// The member path a navigation lambda reads, <c>o =&gt; o.Lines</c> or <c>o =&gt; o.Customer.Address</c>,
+    /// through casts and a filtered include's operators; null for any other shape.
+    /// </summary>
+    private static string? MemberChain(Expression body, ParameterExpression parameter)
+    {
+        Expression node = DefaultOrder.StripConversions(body);
+
+        // A filtered include reads the navigation through Where, OrderBy, Skip, Take and their kin.
+        while (node is MethodCallExpression call
+               && (call.Method.DeclaringType == typeof(Enumerable) || call.Method.DeclaringType == typeof(Queryable))
+               && call.Arguments.Count > 0)
+        {
+            node = DefaultOrder.StripConversions(call.Arguments[0]);
+        }
+
+        List<string> names = new();
+
+        while (node is MemberExpression { Member: PropertyInfo or FieldInfo, Expression: { } owner } member)
+        {
+            names.Add(member.Member.Name);
+            node = DefaultOrder.StripConversions(owner);
+        }
+
+        if (node != parameter || names.Count == 0)
+        {
+            return null;
+        }
+
+        names.Reverse();
+
+        return string.Join('.', names);
+    }
+
+    /// <summary>True for a navigation to a type the entity owns.</summary>
+    private static bool IsOwned(INavigation navigation) =>
+        navigation.ForeignKey.IsOwnership && !navigation.IsOnDependent;
+
+    /// <summary>True for an owned type EF Core stores in a JSON column, which it cannot project into.</summary>
+    private static bool IsJson(IEntityType entity) => entity.FindAnnotation(JsonContainer)?.Value is not null;
+
+    /// <summary>
+    /// True when a lazy loader can fill this entity's navigations after the query: EF Core's proxies and
+    /// an injected <c>ILazyLoader</c> give it a service property, and a loader the class takes in its
+    /// constructor, either delegate form above all, may be kept in a field or a property of any name,
+    /// where the model has no record of it. An injected <c>DbContext</c> can load anything.
+    /// </summary>
+    private static bool LoadsLazily(IEntityType entity) =>
+        entity.GetServiceProperties().Any(service => IsLoader(service.ClrType))
+        || TakesLoader.GetOrAdd(entity.ClrType, HoldsLoader);
+
+    private static bool HoldsLoader(Type type)
+    {
+        const BindingFlags any = BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance;
+
+        if (type.GetConstructors(any).Any(constructor => constructor.GetParameters().Any(p => IsLoader(p.ParameterType))))
+        {
+            return true;
+        }
+
+        for (Type? current = type; current is not null && current != typeof(object); current = current.BaseType)
+        {
+            if (current.GetFields(any | BindingFlags.DeclaredOnly).Any(field => IsLoader(field.FieldType))
+                || current.GetProperties(any | BindingFlags.DeclaredOnly).Any(property => IsLoader(property.PropertyType)))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool IsLoader(Type type) =>
+        type == typeof(ILazyLoader)
+        || type == typeof(Action<object, string>)
+        || type == typeof(Func<object, CancellationToken, string, Task>)
+        || typeof(DbContext).IsAssignableFrom(type);
+
+    /// <summary>
+    /// The names of an entity type's complex properties, which EF Core 8 introduced and loads with the
+    /// entity. None on an earlier version, where the method does not exist.
+    /// </summary>
+    /// <remarks>
+    /// Read by reflection because the library compiles against EF Core 6. The method is declared on an
+    /// interface the entity type implements, so the interfaces are searched rather than the class.
+    /// </remarks>
+    private static HashSet<string> ComplexProperties(IEntityType entityType) =>
+        ComplexByType.GetValue(entityType, ReadComplexProperties);
+
+    private static HashSet<string> ReadComplexProperties(IEntityType entityType)
+    {
+        HashSet<string> names = new(StringComparer.OrdinalIgnoreCase);
+
+        foreach (Type contract in entityType.GetType().GetInterfaces())
+        {
+            MethodInfo? method = contract.GetMethod("GetComplexProperties", Type.EmptyTypes);
+
+            if (method is null)
+            {
+                continue;
+            }
+
+            if (method.Invoke(entityType, null) is IEnumerable properties)
+            {
+                foreach (object? property in properties)
+                {
+                    if (property?.GetType().GetProperty("Name")?.GetValue(property) is string name)
+                    {
+                        names.Add(name);
+                    }
+                }
+            }
+
+            break;
+        }
+
+        return names;
+    }
+}
+
+/// <summary>A member a value loads, with its path from the root.</summary>
+/// <param name="Path">The member's path from the root.</param>
+/// <param name="Property">The member.</param>
+/// <param name="Whole">True when EF Core reads it whole: a column or a complex property.</param>
+/// <param name="Converted">
+/// True when a value converter hands back its value: the application's code, which can return an object of any
+/// type the member's type allows.
+/// </param>
+internal readonly record struct Loaded(string Path, PropertyInfo Property, bool Whole, bool Converted = false);
+
+/// <summary>Where a guarded query's rows come from.</summary>
+internal enum RowKind
+{
+    /// <summary>An entity query: a navigation holds a value only when something loads it.</summary>
+    Entity,
+
+    /// <summary>A projection that builds its rows: every member holds what the projection gave it.</summary>
+    Projected,
+
+    /// <summary>A sequence in memory: every member holds whatever the object holds.</summary>
+    InMemory
+}
diff --git a/DynamicWhere.ex/Policies/Validation/PolicyModelValidator.cs b/DynamicWhere.ex/Policies/Validation/PolicyModelValidator.cs
index 8779dc7..5b9b16f 100644
--- a/DynamicWhere.ex/Policies/Validation/PolicyModelValidator.cs
+++ b/DynamicWhere.ex/Policies/Validation/PolicyModelValidator.cs
@@ -195,15 +195,18 @@ private static void CheckDefaultOrder(Type type, List<string> errors, List<strin
     }
 
     /// <summary>
-    /// True when the member a path ends on is denied a feature by its own attributes, and every one of
-    /// those attributes is overridable.
+    /// True when the member a path ends on is denied a feature by its attributes, and every one of those
+    /// attributes is overridable. They include those of the member's other declarations: an interface
+    /// member it implements, and a subtype's override.
     /// </summary>
     private static bool DeniedOnlyOverridably(Type type, string path, PolicyFeature feature)
     {
         PropertyInfo? member = null;
+        Type owner = type;
 
         foreach (string segment in path.Split('.'))
         {
+            owner = type;
             member = CacheReflection.FindProperty(type, segment);
 
             if (member is null)
@@ -216,6 +219,7 @@ private static bool DeniedOnlyOverridably(Type type, string path, PolicyFeature
 
         List<DwDenyAttribute> denials = member!
             .GetCustomAttributes<DwDenyAttribute>(inherit: true)
+            .Concat(Resolution.AttributePolicyProvider.DenialsElsewhere(owner, member!))
             .Where(attribute => (attribute.Features & feature) == feature)
             .ToList();
 
diff --git a/DynamicWhere.ex/Source/AsyncReads.cs b/DynamicWhere.ex/Source/AsyncReads.cs
new file mode 100644
index 0000000..47692f2
--- /dev/null
+++ b/DynamicWhere.ex/Source/AsyncReads.cs
@@ -0,0 +1,82 @@
+using System.Collections;
+using System.Linq.Dynamic.Core;
+using System.Reflection;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Query;
+
+namespace DynamicWhere.ex.Source;
+
+/// <summary>
+/// Asynchronous reads of a query whose element type is only known at run time: a dynamic projection or
+/// a grouping.
+/// </summary>
+/// <remarks>
+/// EF Core's own asynchronous operators are generic in the element type, and a dynamic query's element
+/// type is only known at run time, so they are reached by reflection. Through them a cancellation reaches
+/// the database. They replace System.Linq.Dynamic.Core's <c>ToDynamicListAsync</c> on an EF Core query, and
+/// <c>Count()</c>, which counted a grouping synchronously.
+/// <para>
+/// Any other provider, rows in memory among them, keeps <c>ToDynamicListAsync</c>, which reads on the
+/// calling thread.
+/// </para>
+/// </remarks>
+internal static class AsyncReads
+{
+    /// <summary><c>EntityFrameworkQueryableExtensions.ToListAsync&lt;TSource&gt;(source, cancellationToken)</c>.</summary>
+    private static readonly MethodInfo ToListAsyncMethod = typeof(EntityFrameworkQueryableExtensions)
+        .GetMethods(BindingFlags.Public | BindingFlags.Static)
+        .Single(method => method.Name == nameof(EntityFrameworkQueryableExtensions.ToListAsync)
+                          && method.GetParameters().Length == 2);
+
+    /// <summary><c>EntityFrameworkQueryableExtensions.CountAsync&lt;TSource&gt;(source, cancellationToken)</c>.</summary>
+    private static readonly MethodInfo CountAsyncMethod = typeof(EntityFrameworkQueryableExtensions)
+        .GetMethods(BindingFlags.Public | BindingFlags.Static)
+        .Single(method => method.Name == nameof(EntityFrameworkQueryableExtensions.CountAsync)
+                          && method.GetParameters().Length == 2
+                          && method.GetParameters()[1].ParameterType == typeof(CancellationToken));
+
+    /// <summary>Reads every row of a query into a list of dynamic objects.</summary>
+    internal static async Task<List<dynamic>> ToDynamicListAsync(IQueryable query, CancellationToken cancellationToken)
+    {
+        if (query.Provider is not IAsyncQueryProvider)
+        {
+            return await query.ToDynamicListAsync(cancellationToken);
+        }
+
+        Task read = (Task)Call(ToListAsyncMethod, query, cancellationToken);
+
+        await read;
+
+        IList rows = (IList)read.GetType().GetProperty(nameof(Task<object>.Result))!.GetValue(read)!;
+        List<dynamic> list = new(rows.Count);
+
+        foreach (object? row in rows)
+        {
+            list.Add(row!);
+        }
+
+        return list;
+    }
+
+    /// <summary>Counts the rows of a query.</summary>
+    internal static async Task<int> CountAsync(IQueryable query, CancellationToken cancellationToken)
+    {
+        if (query.Provider is not IAsyncQueryProvider)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+
+            return query.Count();
+        }
+
+        return await (Task<int>)Call(CountAsyncMethod, query, cancellationToken);
+    }
+
+    /// <summary>
+    /// Calls one of EF Core's operators for the query's element type, letting whatever it throws leave as
+    /// itself: a query EF Core cannot translate fails with its own exception, not one wrapped by reflection.
+    /// </summary>
+    private static object Call(MethodInfo operatorMethod, IQueryable query, CancellationToken cancellationToken) =>
+        operatorMethod
+            .MakeGenericMethod(query.ElementType)
+            .Invoke(null, BindingFlags.DoNotWrapExceptions, null, new object[] { query, cancellationToken }, null)!;
+}
diff --git a/DynamicWhere.ex/Source/Extention.cs b/DynamicWhere.ex/Source/Extention.cs
index 05f3d45..9149c40 100644
--- a/DynamicWhere.ex/Source/Extention.cs
+++ b/DynamicWhere.ex/Source/Extention.cs
@@ -681,7 +681,36 @@ public static FilterResult<dynamic> ToListDynamic<T>(this IEnumerable<T> query,
     /// <returns>A <see cref="FilterResult{T}"/> containing entities that match the filter conditions in the <see cref="Filter"/> with pagination information.</returns>
     /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="filter"/> is null.</exception>
     /// <exception cref="LogicException">Thrown when <paramref name="filter"/> contains invalid data.</exception>
-    public static async Task<FilterResult<T>> ToListAsync<T>(this IQueryable<T> query, Filter filter, bool getQueryString = false) where T : class
+    public static Task<FilterResult<T>> ToListAsync<T>(this IQueryable<T> query, Filter filter, bool getQueryString = false) where T : class =>
+        query.ToListAsync(filter, getQueryString, CancellationToken.None);
+
+    /// <summary>
+    /// Asynchronously retrieves a list of entities from the <see cref="IQueryable{T}"/> with optional filtering based on a <see cref="Filter"/>.
+    /// </summary>
+    /// <typeparam name="T">The entity type.</typeparam>
+    /// <param name="query">The <see cref="IQueryable{T}"/> to retrieve entities from.</param>
+    /// <param name="filter">The <see cref="Filter"/> containing filter conditions and optional pagination settings.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <returns>A <see cref="FilterResult{T}"/> containing entities that match the filter conditions in the <see cref="Filter"/> with pagination information.</returns>
+    /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="filter"/> is null.</exception>
+    /// <exception cref="LogicException">Thrown when <paramref name="filter"/> contains invalid data.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public static Task<FilterResult<T>> ToListAsync<T>(this IQueryable<T> query, Filter filter, CancellationToken cancellationToken) where T : class =>
+        query.ToListAsync(filter, false, cancellationToken);
+
+    /// <summary>
+    /// Asynchronously retrieves a list of entities from the <see cref="IQueryable{T}"/> with optional filtering based on a <see cref="Filter"/>.
+    /// </summary>
+    /// <typeparam name="T">The entity type.</typeparam>
+    /// <param name="query">The <see cref="IQueryable{T}"/> to retrieve entities from.</param>
+    /// <param name="filter">The <see cref="Filter"/> containing filter conditions and optional pagination settings.</param>
+    /// <param name="getQueryString">If true, includes the generated query string in the result.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <returns>A <see cref="FilterResult{T}"/> containing entities that match the filter conditions in the <see cref="Filter"/> with pagination information.</returns>
+    /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="filter"/> is null.</exception>
+    /// <exception cref="LogicException">Thrown when <paramref name="filter"/> contains invalid data.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public static async Task<FilterResult<T>> ToListAsync<T>(this IQueryable<T> query, Filter filter, bool getQueryString, CancellationToken cancellationToken) where T : class
     {
         // Refuse a type that requires a policy context when the call is not inside one.
         PolicyScope.Require<T>();
@@ -730,7 +759,7 @@ public static async Task<FilterResult<T>> ToListAsync<T>(this IQueryable<T> quer
         }
 
         // Calculate the total count of entities before pagination.
-        int totalCount = await query.CountAsync();
+        int totalCount = await query.CountAsync(cancellationToken);
 
         // Calculate the total page count based on the page size. An unpaged query is one page of
         // everything: dividing by one reported as many pages as there were rows, which read as a
@@ -748,7 +777,7 @@ public static async Task<FilterResult<T>> ToListAsync<T>(this IQueryable<T> quer
             TotalCount = totalCount,
 
             // Execute the query to retrieve the data.
-            Data = await newQuery.ToListAsync(),
+            Data = await newQuery.ToListAsync(cancellationToken),
             QueryString = getQueryString ? newQuery.ToQueryString() : null
         };
     }
@@ -764,7 +793,38 @@ public static async Task<FilterResult<T>> ToListAsync<T>(this IQueryable<T> quer
     /// <returns>A <see cref="FilterResult{T}"/> of <c>dynamic</c> containing dynamic objects that match the filter conditions with pagination information.</returns>
     /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="filter"/> is null.</exception>
     /// <exception cref="LogicException">Thrown when <paramref name="filter"/> contains invalid data.</exception>
-    public static async Task<FilterResult<dynamic>> ToListAsyncDynamic<T>(this IQueryable<T> query, Filter filter, bool getQueryString = false) where T : class
+    public static Task<FilterResult<dynamic>> ToListAsyncDynamic<T>(this IQueryable<T> query, Filter filter, bool getQueryString = false) where T : class =>
+        query.ToListAsyncDynamic(filter, getQueryString, CancellationToken.None);
+
+    /// <summary>
+    /// Asynchronously retrieves a list of dynamic objects from the <see cref="IQueryable{T}"/> with optional filtering based on a <see cref="Filter"/>,
+    /// using <see cref="SelectDynamic{T}"/> for the field projection.
+    /// </summary>
+    /// <typeparam name="T">The entity type.</typeparam>
+    /// <param name="query">The <see cref="IQueryable{T}"/> to retrieve entities from.</param>
+    /// <param name="filter">The <see cref="Filter"/> containing filter conditions and optional pagination settings.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <returns>A <see cref="FilterResult{T}"/> of <c>dynamic</c> containing dynamic objects that match the filter conditions with pagination information.</returns>
+    /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="filter"/> is null.</exception>
+    /// <exception cref="LogicException">Thrown when <paramref name="filter"/> contains invalid data.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public static Task<FilterResult<dynamic>> ToListAsyncDynamic<T>(this IQueryable<T> query, Filter filter, CancellationToken cancellationToken) where T : class =>
+        query.ToListAsyncDynamic(filter, false, cancellationToken);
+
+    /// <summary>
+    /// Asynchronously retrieves a list of dynamic objects from the <see cref="IQueryable{T}"/> with optional filtering based on a <see cref="Filter"/>,
+    /// using <see cref="SelectDynamic{T}"/> for the field projection.
+    /// </summary>
+    /// <typeparam name="T">The entity type.</typeparam>
+    /// <param name="query">The <see cref="IQueryable{T}"/> to retrieve entities from.</param>
+    /// <param name="filter">The <see cref="Filter"/> containing filter conditions and optional pagination settings.</param>
+    /// <param name="getQueryString">If true, includes the generated query string in the result.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <returns>A <see cref="FilterResult{T}"/> of <c>dynamic</c> containing dynamic objects that match the filter conditions with pagination information.</returns>
+    /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="filter"/> is null.</exception>
+    /// <exception cref="LogicException">Thrown when <paramref name="filter"/> contains invalid data.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public static async Task<FilterResult<dynamic>> ToListAsyncDynamic<T>(this IQueryable<T> query, Filter filter, bool getQueryString, CancellationToken cancellationToken) where T : class
     {
         // Refuse a type that requires a policy context when the call is not inside one.
         PolicyScope.Require<T>();
@@ -786,7 +846,7 @@ public static async Task<FilterResult<dynamic>> ToListAsyncDynamic<T>(this IQuer
         }
 
         // Calculate the total count of entities before pagination.
-        int totalCount = await query.CountAsync();
+        int totalCount = await query.CountAsync(cancellationToken);
 
         // Create a new query to apply ordering and pagination.
         IQueryable<T> newQuery = query;
@@ -830,7 +890,7 @@ public static async Task<FilterResult<dynamic>> ToListAsyncDynamic<T>(this IQuer
             TotalCount = totalCount,
 
             // Execute the query to retrieve the dynamic data asynchronously.
-            Data = await result.ToDynamicListAsync(),
+            Data = await AsyncReads.ToDynamicListAsync(result, cancellationToken),
             QueryString = getQueryString ? result.ToQueryString() : null
         };
     }
@@ -1038,7 +1098,36 @@ public static SummaryResult ToList<T>(this IEnumerable<T> query, Summary summary
     /// <returns>A <see cref="SummaryResult"/> containing grouped entities that match the summary criteria with pagination information.</returns>
     /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="summary"/> is null.</exception>
     /// <exception cref="LogicException">Thrown when <paramref name="summary"/> contains invalid data.</exception>
-    public static async Task<SummaryResult> ToListAsync<T>(this IQueryable<T> query, Summary summary, bool getQueryString = false) where T : class
+    public static Task<SummaryResult> ToListAsync<T>(this IQueryable<T> query, Summary summary, bool getQueryString = false) where T : class =>
+        query.ToListAsync(summary, getQueryString, CancellationToken.None);
+
+    /// <summary>
+    /// Asynchronously retrieves a list of dynamic grouped entities from the <see cref="IQueryable{T}"/> with optional filtering based on a <see cref="Classes.Complex.Summary"/>.
+    /// </summary>
+    /// <typeparam name="T">The entity type.</typeparam>
+    /// <param name="query">The <see cref="IQueryable{T}"/> to retrieve grouped entities from.</param>
+    /// <param name="summary">The <see cref="Classes.Complex.Summary"/> containing filter conditions, group-by criteria, and optional pagination settings.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <returns>A <see cref="SummaryResult"/> containing grouped entities that match the summary criteria with pagination information.</returns>
+    /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="summary"/> is null.</exception>
+    /// <exception cref="LogicException">Thrown when <paramref name="summary"/> contains invalid data.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public static Task<SummaryResult> ToListAsync<T>(this IQueryable<T> query, Summary summary, CancellationToken cancellationToken) where T : class =>
+        query.ToListAsync(summary, false, cancellationToken);
+
+    /// <summary>
+    /// Asynchronously retrieves a list of dynamic grouped entities from the <see cref="IQueryable{T}"/> with optional filtering based on a <see cref="Classes.Complex.Summary"/>.
+    /// </summary>
+    /// <typeparam name="T">The entity type.</typeparam>
+    /// <param name="query">The <see cref="IQueryable{T}"/> to retrieve grouped entities from.</param>
+    /// <param name="summary">The <see cref="Classes.Complex.Summary"/> containing filter conditions, group-by criteria, and optional pagination settings.</param>
+    /// <param name="getQueryString">If true, includes the generated query string in the result.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <returns>A <see cref="SummaryResult"/> containing grouped entities that match the summary criteria with pagination information.</returns>
+    /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="summary"/> is null.</exception>
+    /// <exception cref="LogicException">Thrown when <paramref name="summary"/> contains invalid data.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    public static async Task<SummaryResult> ToListAsync<T>(this IQueryable<T> query, Summary summary, bool getQueryString, CancellationToken cancellationToken) where T : class
     {
         // Refuse a type that requires a policy context when the call is not inside one.
         PolicyScope.Require<T>();
@@ -1077,7 +1166,7 @@ public static async Task<SummaryResult> ToListAsync<T>(this IQueryable<T> query,
         }
 
         // Calculate the total count of grouped entities before pagination.
-        int totalCount = result.Count();
+        int totalCount = await AsyncReads.CountAsync(result, cancellationToken);
 
         // Create a new query to apply ordering and pagination.
         IQueryable newResult = result;
@@ -1126,7 +1215,7 @@ public static async Task<SummaryResult> ToListAsync<T>(this IQueryable<T> query,
             TotalCount = totalCount,
 
             // Execute the query to retrieve the data asynchronously.
-            Data = await newResult.ToDynamicListAsync(),
+            Data = await AsyncReads.ToDynamicListAsync(newResult, cancellationToken),
             QueryString = getQueryString ? newResult.ToQueryString() : null
         };
     }
@@ -1147,7 +1236,25 @@ public static async Task<SummaryResult> ToListAsync<T>(this IQueryable<T> query,
     /// the total count then run exactly as they do for a <see cref="Filter"/>, so only the requested page
     /// is read.
     /// </remarks>
-    public static async Task<SegmentResult<T>> ToListAsync<T>(this IQueryable<T> query, Segment segment) where T : class
+    public static Task<SegmentResult<T>> ToListAsync<T>(this IQueryable<T> query, Segment segment) where T : class =>
+        query.ToListAsync(segment, CancellationToken.None);
+
+    /// <summary>
+    /// Asynchronously retrieves a list of entities from the <see cref="IQueryable{T}"/> with optional filtering based on a <see cref="Segment"/>.
+    /// </summary>
+    /// <typeparam name="T">The entity type.</typeparam>
+    /// <param name="query">The <see cref="IQueryable{T}"/> to retrieve entities from.</param>
+    /// <param name="segment">The <see cref="Segment"/> containing filter conditions and optional pagination settings.</param>
+    /// <param name="cancellationToken">Cancels the count and the read.</param>
+    /// <returns>A <see cref="SegmentResult{T}"/> containing entities that match the filter conditions in the <see cref="Segment"/> with pagination information.</returns>
+    /// <exception cref="ArgumentNullException">Thrown if either <paramref name="query"/> or <paramref name="segment"/> is null.</exception>
+    /// <exception cref="LogicException">Thrown when <paramref name="segment"/> contains invalid data.</exception>
+    /// <exception cref="OperationCanceledException">Thrown when <paramref name="cancellationToken"/> is canceled.</exception>
+    /// <remarks>
+    /// The condition sets become one query, which the database answers, exactly as they do for the
+    /// overload without a token.
+    /// </remarks>
+    public static async Task<SegmentResult<T>> ToListAsync<T>(this IQueryable<T> query, Segment segment, CancellationToken cancellationToken) where T : class
     {
         // Refuse a type that requires a policy context when the call is not inside one.
         PolicyScope.Require<T>();
@@ -1178,7 +1285,7 @@ public static async Task<SegmentResult<T>> ToListAsync<T>(this IQueryable<T> que
             Page = segment.Page
         };
 
-        FilterResult<T> fresult = await combined.ToListAsync<T>(filter);
+        FilterResult<T> fresult = await combined.ToListAsync<T>(filter, false, cancellationToken);
 
         // Return the results as a SegmentResult.
         return new()
diff --git a/DynamicWhere.ex/Source/QueryRoot.cs b/DynamicWhere.ex/Source/QueryRoot.cs
new file mode 100644
index 0000000..850c3c0
--- /dev/null
+++ b/DynamicWhere.ex/Source/QueryRoot.cs
@@ -0,0 +1,497 @@
+using System.Collections.Concurrent;
+using System.Linq.Expressions;
+using System.Reflection;
+using DynamicWhere.ex.Optimization.Cache.Source;
+using DynamicWhere.ex.Policies.Resolution;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata;
+
+namespace DynamicWhere.ex.Source;
+
+/// <summary>
+/// The EF Core model behind a query, read from the query's root.
+/// </summary>
+/// <remarks>
+/// The root expression's type differs between EF Core versions — <c>QueryRootExpression</c> in 6,
+/// <c>EntityQueryRootExpression</c> from 7 — and both carry the entity type in a property named
+/// <c>EntityType</c>, so the property is found by name. Any root reaches the model, and the model is
+/// asked for the type the caller names, which also answers for a derived type queried through
+/// <c>OfType</c>.
+/// </remarks>
+internal static class QueryRoot
+{
+    /// <summary>The <c>EntityType</c> property of each query-root expression type, or null for a type with none.</summary>
+    private static readonly ConcurrentDictionary<Type, PropertyInfo?> RootEntityTypeProperties = new();
+
+    /// <summary>
+    /// The entity type the model maps for <paramref name="type"/>, or null when the query is not an
+    /// EF Core query or the model does not map that type.
+    /// </summary>
+    internal static IEntityType? EntityType(Expression expression, Type type) => Model(expression)?.FindEntityType(type);
+
+    /// <summary>The EF Core model behind a query, or null when the query is not an EF Core query.</summary>
+    internal static IModel? Model(Expression expression)
+    {
+        RootFinder finder = new();
+
+        finder.Visit(expression);
+
+        return finder.EntityType?.Model;
+    }
+
+    /// <summary>
+    /// True when a call along a query's chain hands back the rows it was given, fewer of them or in
+    /// another order, rather than rows it builds or reaches through them.
+    /// </summary>
+    /// <remarks>
+    /// A method this does not know counts as building its rows, which only ever reads a query more
+    /// warily than it needs.
+    /// </remarks>
+    internal static bool KeepsRows(MethodCallExpression call)
+    {
+        Type? declaring = call.Method.DeclaringType;
+
+        if (declaring == typeof(Queryable) || declaring == typeof(Enumerable))
+        {
+            return call.Method.Name switch
+            {
+                nameof(Queryable.Where) or nameof(Queryable.OrderBy) or nameof(Queryable.OrderByDescending)
+                    or nameof(Queryable.ThenBy) or nameof(Queryable.ThenByDescending) or "Order" or "OrderDescending"
+                    or nameof(Queryable.Skip) or nameof(Queryable.Take) or nameof(Queryable.SkipWhile)
+                    or nameof(Queryable.TakeWhile) or "SkipLast" or "TakeLast" or nameof(Queryable.Distinct)
+                    or "DistinctBy" or nameof(Queryable.Reverse) or nameof(Queryable.AsQueryable)
+                    or nameof(Queryable.OfType) or nameof(Queryable.Cast) => true,
+
+                // Each of these returns the rows of both sources, and the other one is read the same way.
+                nameof(Queryable.Concat) or nameof(Queryable.Union) or "UnionBy" or nameof(Queryable.Intersect)
+                    or "IntersectBy" or nameof(Queryable.Except) or "ExceptBy" => true,
+
+                // With no argument of its own, only a missing row is added.
+                nameof(Queryable.DefaultIfEmpty) => call.Arguments.Count == 1,
+
+                _ => false
+            };
+        }
+
+        // EF Core's own operators that load, track or tag the rows without changing which they are.
+        return declaring?.Namespace == "Microsoft.EntityFrameworkCore"
+               && call.Method.Name is "Include" or "ThenInclude" or "AsNoTracking"
+                   or "AsNoTrackingWithIdentityResolution" or "AsTracking" or "IgnoreQueryFilters"
+                   or "IgnoreAutoIncludes" or "TagWith" or "TagWithCallSite" or "AsSplitQuery" or "AsSingleQuery";
+    }
+
+    /// <summary>
+    /// True when some call along the chain, or along the other source of a set operation, builds its
+    /// rows or reaches them through the rows it was given: a <c>Select</c>, a <c>SelectMany</c>, a
+    /// <c>Join</c>, a <c>GroupBy</c>, or anything <see cref="KeepsRows"/> does not know.
+    /// </summary>
+    internal static bool Reshapes(Expression expression)
+    {
+        for (Expression? node = expression; node is MethodCallExpression call;
+             node = call.Arguments.Count > 0 ? call.Arguments[0] : null)
+        {
+            if (!KeepsRows(call))
+            {
+                return true;
+            }
+
+            if (call.Arguments.Count > 1
+                && call.Method.Name is nameof(Queryable.Concat) or nameof(Queryable.Union) or "UnionBy"
+                    or nameof(Queryable.Intersect) or "IntersectBy" or nameof(Queryable.Except) or "ExceptBy"
+                && Reshapes(call.Arguments[1]))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// True when a call along the chain that <see cref="KeepsRows"/> does not know can hand its rows an
+    /// object the query's own includes do not account for: one a lambda constructs, one an application's
+    /// method returns, and one a lambda captured, another query's rows among them.
+    /// </summary>
+    /// <remarks>
+    /// A projection, such as the one behind <c>Select(x =&gt; x)</c>, an anonymous row or a conditional,
+    /// assigns what it builds, and loads whatever navigation it assigns. A method can return anything. A
+    /// query captured in a variable becomes part of the query EF Core runs, with its own includes and
+    /// projections, and an object captured from memory holds whatever it holds. A value, such as a
+    /// predicate's result, a key or a date, carries none of them, so what only feeds one is not read.
+    /// </remarks>
+    internal static bool Builds(Expression expression) => Builds(expression, depth: 0);
+
+    private static bool Builds(Expression expression, int depth)
+    {
+        // A captured query that captures itself would never end; one this deep is counted as building.
+        if (depth > MaxCapturedDepth)
+        {
+            return true;
+        }
+
+        ForeignFinder finder = new(depth);
+
+        for (Expression? node = expression; node is MethodCallExpression call;
+             node = call.Arguments.Count > 0 ? call.Arguments[0] : null)
+        {
+            if (call.Arguments.Count > 1
+                && call.Method.Name is nameof(Queryable.Concat) or nameof(Queryable.Union) or "UnionBy"
+                    or nameof(Queryable.Intersect) or "IntersectBy" or nameof(Queryable.Except) or "ExceptBy"
+                && Builds(call.Arguments[1], depth))
+            {
+                return true;
+            }
+
+            if (KeepsRows(call))
+            {
+                continue;
+            }
+
+            foreach (Expression argument in call.Arguments.Skip(1))
+            {
+                finder.Visit(argument);
+
+                if (finder.Found)
+                {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>How many captured queries deep <see cref="Builds(Expression)"/> reads before it stops.</summary>
+    private const int MaxCapturedDepth = 8;
+
+    /// <summary>
+    /// Finds, anywhere in an expression, what can hand a row an object its query does not load: an object
+    /// constructed, an application's method's result, and an object or a query captured from outside.
+    /// </summary>
+    private sealed class ForeignFinder : ExpressionVisitor
+    {
+        private readonly int _depth;
+
+        internal ForeignFinder(int depth) => _depth = depth;
+
+        internal bool Found { get; private set; }
+
+        public override Expression? Visit(Expression? node) =>
+            Found || node is null || IsValue(node.Type) ? node : base.Visit(node);
+
+        protected override Expression VisitNew(NewExpression node)
+        {
+            // An anonymous object carries what it is given, the range variables of a query-syntax join or
+            // let, or the parts of a composite key, and builds nothing of its own: what it carries is read.
+            if (IsAnonymous(node.Type))
+            {
+                return base.VisitNew(node);
+            }
+
+            Found = true;
+
+            return node;
+        }
+
+        protected override Expression VisitMemberInit(MemberInitExpression node)
+        {
+            Found = true;
+
+            return node;
+        }
+
+        protected override Expression VisitListInit(ListInitExpression node)
+        {
+            Found = true;
+
+            return node;
+        }
+
+        protected override Expression VisitNewArray(NewArrayExpression node)
+        {
+            Found = true;
+
+            return node;
+        }
+
+        protected override Expression VisitMethodCall(MethodCallExpression node)
+        {
+            // A call that reads nothing of the lambda's and hands back a query or an expression, a
+            // repository's query, a specification or FromSql, is evaluated before the query runs, as EF
+            // Core evaluates it, and what it returns is read.
+            if (Evaluable(node))
+            {
+                Found = !TryEvaluate(node, out object? value) || Holds(value, _depth);
+
+                return node;
+            }
+
+            if (Reads(node.Method))
+            {
+                return base.VisitMethodCall(node);
+            }
+
+            // Any other method's result is its own to say.
+            Found = true;
+
+            return node;
+        }
+
+        protected override Expression VisitMember(MemberExpression node)
+        {
+            if (!IsCaptured(node))
+            {
+                return base.VisitMember(node);
+            }
+
+            Found = !TryEvaluate(node, out object? value) || Holds(value, _depth);
+
+            return node;
+        }
+
+        protected override Expression VisitConstant(ConstantExpression node)
+        {
+            Found = Holds(node.Value, _depth);
+
+            return node;
+        }
+    }
+
+    /// <summary>
+    /// True for a method that hands back what it was given, or reads it: LINQ's operators, EF Core's
+    /// <c>EF.Property</c> and query operators, a context's <c>Set</c>, which names a query root, and a
+    /// context's own method returning a query, which EF Core translates only as a function the model maps.
+    /// </summary>
+    private static bool Reads(MethodInfo method)
+    {
+        Type? declaring = method.DeclaringType;
+
+        return declaring == typeof(Queryable)
+               || declaring == typeof(Enumerable)
+               || declaring == typeof(EF)
+               || declaring == typeof(EntityFrameworkQueryableExtensions)
+               || (declaring == typeof(DbContext) && method.Name == nameof(DbContext.Set))
+               || (declaring is not null && typeof(DbContext).IsAssignableFrom(declaring)
+                                        && typeof(IQueryable).IsAssignableFrom(method.ReturnType));
+    }
+
+    /// <summary>True for a type the compiler generates for an anonymous object.</summary>
+    private static bool IsAnonymous(Type type) =>
+        type.IsDefined(typeof(System.Runtime.CompilerServices.CompilerGeneratedAttribute), inherit: false)
+        && type.Name.Contains("AnonymousType", StringComparison.Ordinal);
+
+    /// <summary>
+    /// True for a call EF Core evaluates before it translates the query: one that reads no parameter of the
+    /// lambdas around it and hands back a query or an expression, which the query then holds. A query the
+    /// tree already holds inline, over a root EF Core put there, is read where it stands.
+    /// </summary>
+    private static bool Evaluable(MethodCallExpression call)
+    {
+        if (!typeof(IQueryable).IsAssignableFrom(call.Type) && !typeof(Expression).IsAssignableFrom(call.Type))
+        {
+            return false;
+        }
+
+        ParameterFinder parameters = new();
+
+        parameters.Visit(call);
+
+        return !parameters.Found;
+    }
+
+    /// <summary>Finds a parameter of a lambda outside the expression it is given, or a query root.</summary>
+    private sealed class ParameterFinder : ExpressionVisitor
+    {
+        private readonly HashSet<ParameterExpression> _declared = new();
+
+        internal bool Found { get; private set; }
+
+        public override Expression? Visit(Expression? node) => Found ? node : base.Visit(node);
+
+        protected override Expression VisitLambda<TDelegate>(Expression<TDelegate> node)
+        {
+            _declared.UnionWith(node.Parameters);
+
+            return base.VisitLambda(node);
+        }
+
+        protected override Expression VisitParameter(ParameterExpression node)
+        {
+            Found |= !_declared.Contains(node);
+
+            return node;
+        }
+
+        protected override Expression VisitExtension(Expression node)
+        {
+            Found = true;
+
+            return node;
+        }
+    }
+
+    /// <summary>Runs a call EF Core would evaluate itself, and reads what it returns.</summary>
+    private static bool TryEvaluate(MethodCallExpression call, out object? value)
+    {
+        try
+        {
+            value = Expression.Lambda<Func<object?>>(Expression.Convert(call, typeof(object)))
+                .Compile(preferInterpretation: true)();
+
+            return true;
+        }
+        catch (Exception)
+        {
+            // Whatever it throws, EF Core would throw when it ran the query; read here, it only means the
+            // call counts as handing the rows anything.
+            value = null;
+
+            return false;
+        }
+    }
+
+    /// <summary>True when a value of the type holds only values: a string, a number, a date, or a collection of them.</summary>
+    private static bool IsValue(Type type) => CacheReflection.IsSimpleType(AttributePolicyProvider.Peeled(type));
+
+    /// <summary>True for a member read off something the lambda captured, or off nothing, rather than off its parameters.</summary>
+    private static bool IsCaptured(MemberExpression node)
+    {
+        Expression? target = node.Expression;
+
+        while (target is MemberExpression member)
+        {
+            target = member.Expression;
+        }
+
+        return target is null or ConstantExpression;
+    }
+
+    /// <summary>Reads a captured member's value as EF Core does before it runs the query.</summary>
+    private static bool TryEvaluate(MemberExpression node, out object? value)
+    {
+        value = null;
+
+        object? target = null;
+
+        if (node.Expression is ConstantExpression constant)
+        {
+            target = constant.Value;
+        }
+        else if (node.Expression is MemberExpression member && !TryEvaluate(member, out target))
+        {
+            return false;
+        }
+
+        try
+        {
+            value = node.Member switch
+            {
+                FieldInfo field => field.GetValue(target),
+                PropertyInfo property => property.GetValue(target),
+                _ => null
+            };
+
+            return node.Member is FieldInfo or PropertyInfo;
+        }
+        catch (Exception exception) when (exception is TargetException or TargetInvocationException
+                                              or ArgumentException or InvalidOperationException
+                                              or NotSupportedException or MemberAccessException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// True when a captured value can hand a row an object its query does not load: an object in memory,
+    /// or a query with its own includes or projections, or one over rows in memory.
+    /// </summary>
+    private static bool Holds(object? value, int depth)
+    {
+        if (value is null || value is DbContext || IsValue(value.GetType()))
+        {
+            return false;
+        }
+
+        if (depth > MaxCapturedDepth)
+        {
+            return true;
+        }
+
+        // An expression, a specification say, becomes part of the query, and is read as though written there.
+        if (value is Expression expression)
+        {
+            ForeignFinder finder = new(depth + 1);
+
+            finder.Visit(expression);
+
+            return finder.Found;
+        }
+
+        if (value is not IQueryable query)
+        {
+            return true;
+        }
+
+        if (query.Provider is EnumerableQuery)
+        {
+            return !IsValue(query.ElementType);
+        }
+
+        IncludeFinder includes = new();
+
+        includes.Visit(query.Expression);
+
+        return includes.Found || Builds(query.Expression, depth + 1);
+    }
+
+    /// <summary>Finds an <c>Include</c> or a <c>ThenInclude</c> anywhere in a query.</summary>
+    private sealed class IncludeFinder : ExpressionVisitor
+    {
+        internal bool Found { get; private set; }
+
+        public override Expression? Visit(Expression? node) => Found ? node : base.Visit(node);
+
+        protected override Expression VisitMethodCall(MethodCallExpression node)
+        {
+            if (node.Method.DeclaringType == typeof(EntityFrameworkQueryableExtensions)
+                && node.Method.Name is nameof(EntityFrameworkQueryableExtensions.Include)
+                    or nameof(EntityFrameworkQueryableExtensions.ThenInclude))
+            {
+                Found = true;
+
+                return node;
+            }
+
+            return base.VisitMethodCall(node);
+        }
+    }
+
+    /// <summary>Finds the first query root that names an entity type.</summary>
+    private sealed class RootFinder : ExpressionVisitor
+    {
+        public IEntityType? EntityType { get; private set; }
+
+        public override Expression? Visit(Expression? node) => EntityType is null ? base.Visit(node) : node;
+
+        protected override Expression VisitExtension(Expression node)
+        {
+            // Enumerated rather than looked up by name, which throws when a derived root hides the
+            // property with a new one.
+            PropertyInfo? property = RootEntityTypeProperties.GetOrAdd(
+                node.GetType(),
+                type => type
+                    .GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                    .FirstOrDefault(candidate => candidate.Name == "EntityType"
+                                                 && candidate.GetIndexParameters().Length == 0));
+
+            if (property?.GetValue(node) is IEntityType entityType)
+            {
+                EntityType = entityType;
+
+                return node;
+            }
+
+            return base.VisitExtension(node);
+        }
+    }
+}
diff --git a/DynamicWhere.ex/Source/SegmentComposer.cs b/DynamicWhere.ex/Source/SegmentComposer.cs
index f40b015..f3b69a4 100644
--- a/DynamicWhere.ex/Source/SegmentComposer.cs
+++ b/DynamicWhere.ex/Source/SegmentComposer.cs
@@ -1,4 +1,3 @@
-using System.Collections.Concurrent;
 using System.Linq.Expressions;
 using System.Reflection;
 using DynamicWhere.ex.Classes.Core;
@@ -40,9 +39,6 @@ namespace DynamicWhere.ex.Source;
 /// </remarks>
 internal static class SegmentComposer
 {
-    /// <summary>The <c>EntityType</c> property of each query-root expression type, or null for a type with none.</summary>
-    private static readonly ConcurrentDictionary<Type, PropertyInfo?> RootEntityTypeProperties = new();
-
     /// <summary>
     /// Combines validated condition sets, already in <c>Sort</c> order, into one query.
     /// </summary>
@@ -205,50 +201,8 @@ private static Expression SameValue(Expression left, Expression right)
     /// The primary key EF Core maps for <typeparamref name="T"/>, or null when the query is not an EF Core
     /// query or the type has none.
     /// </summary>
-    /// <remarks>
-    /// Read from the model behind the query's root. The root expression's type differs between EF Core
-    /// versions — <c>QueryRootExpression</c> in 6, <c>EntityQueryRootExpression</c> from 7 — and both
-    /// carry the entity type in a property named <c>EntityType</c>, so the property is found by name.
-    /// Any root reaches the model, and the model is asked for <typeparamref name="T"/> itself, which
-    /// also answers for a derived type queried through <c>OfType</c>.
-    /// </remarks>
-    private static IReadOnlyList<IProperty>? PrimaryKey<T>(IQueryable<T> query)
-    {
-        RootFinder finder = new();
-
-        finder.Visit(query.Expression);
-
-        return finder.EntityType?.Model.FindEntityType(typeof(T))?.FindPrimaryKey()?.Properties;
-    }
-
-    /// <summary>Finds the first query root that names an entity type.</summary>
-    private sealed class RootFinder : ExpressionVisitor
-    {
-        public IEntityType? EntityType { get; private set; }
-
-        public override Expression? Visit(Expression? node) => EntityType is null ? base.Visit(node) : node;
-
-        protected override Expression VisitExtension(Expression node)
-        {
-            // Enumerated rather than looked up by name, which throws when a derived root hides the
-            // property with a new one.
-            PropertyInfo? property = RootEntityTypeProperties.GetOrAdd(
-                node.GetType(),
-                type => type
-                    .GetProperties(BindingFlags.Public | BindingFlags.Instance)
-                    .FirstOrDefault(candidate => candidate.Name == "EntityType"
-                                                 && candidate.GetIndexParameters().Length == 0));
-
-            if (property?.GetValue(node) is IEntityType entityType)
-            {
-                EntityType = entityType;
-
-                return node;
-            }
-
-            return base.VisitExtension(node);
-        }
-    }
+    private static IReadOnlyList<IProperty>? PrimaryKey<T>(IQueryable<T> query) =>
+        QueryRoot.EntityType(query.Expression, typeof(T))?.FindPrimaryKey()?.Properties;
 
     /// <summary>Replaces one lambda parameter with another expression.</summary>
     private sealed class ParameterSwap : ExpressionVisitor
diff --git a/OfficialWebsite/app/docs/ai/page.tsx b/OfficialWebsite/app/docs/ai/page.tsx
index ccb5646..fbc40d9 100644
--- a/OfficialWebsite/app/docs/ai/page.tsx
+++ b/OfficialWebsite/app/docs/ai/page.tsx
@@ -84,7 +84,7 @@ DynamicWhere.ex code. It is the complete API surface.`}</Code>
           <code>m</code> spelling of <code>Sumation</code>.
         </li>
         <li>
-          <strong>All twenty-one extension methods</strong> with their real
+          <strong>All twenty-eight extension methods</strong> with their real
           signatures, what each one validates, and which have no synchronous or
           in-memory form. Plus the generated predicate for every operator, value
           coercion per <code>DataType</code>, and how field paths resolve.
@@ -136,8 +136,8 @@ DynamicWhere.ex code. It is the complete API surface.`}</Code>
       <CopyBlock text={text} lines={lines} />
 
       <Callout tone="warn" title="It says what the library does, not what it should do">
-        The reference is generated against version 3.1.0 from the source, and
-        checked by running the library, so it states behaviour — including the
+        The reference is written against version 3.2.0 from the source, by
+        hand, and checked by running the library, so it states behaviour — including the
         parts that are deliberately blunt, such as neither hashing nor
         tokenization hiding equality. Where a page in these docs disagrees with it,
         the file is the one to trust. For the reasoning behind a rule, the human
diff --git a/OfficialWebsite/app/docs/breaking-changes/page.tsx b/OfficialWebsite/app/docs/breaking-changes/page.tsx
index 743efb8..c01874a 100644
--- a/OfficialWebsite/app/docs/breaking-changes/page.tsx
+++ b/OfficialWebsite/app/docs/breaking-changes/page.tsx
@@ -17,10 +17,29 @@ export default function Page() {
       <h1>Breaking Changes & Known Limitations</h1>
       <p>
         DynamicWhere.ex is intentionally opinionated about how queries are shaped.
-        The twenty-four points below cover constraints, surprises, and corner cases —
+        The twenty-nine points below cover constraints, surprises, and corner cases —
         read them before designing an API around the library so you can pick the
         right entry points and avoid runtime exceptions in production.
       </p>
+      <Callout tone="danger" title="Behaviour changes in 3.2.0">
+        Points&nbsp;25 to 29 changed in <strong>3.2.0</strong>, and each is
+        visible to code written for 3.1.0. A guarded query that sends no{" "}
+        <code>Selects</code> synthesizes its projection whenever a denied value
+        can reach the result, and the projection keeps what the source carries:
+        the assigned members of a projected row, and an entity&apos;s columns,
+        owned and complex members, while an entity&apos;s navigations and the
+        objects of a row in memory are left out (point&nbsp;25).{" "}
+        <code>Selects</code> naming a member is gated against every denial
+        beneath it, and a narrowing that cannot be built is refused
+        (point&nbsp;26). A declared default order reaches a projection that
+        builds <code>T</code> and assigns every field the default names
+        (point&nbsp;27). Every async terminal gains overloads that take a{" "}
+        <code>CancellationToken</code>, so <code>ToListAsync(filter, default)</code>{" "}
+        no longer compiles, and the async dynamic <code>Filter</code> and the
+        async <code>Summary</code> read through EF Core&apos;s asynchronous
+        operators (point&nbsp;28). And a type in an application namespace that
+        starts with <code>System</code> is policed (point&nbsp;29).
+      </Callout>
       <Callout tone="danger" title="Behaviour changes in 3.1.0">
         Eleven behaviours changed in <strong>3.1.0</strong>. Each one fixes a defect,
         and each one is visible to a caller that depended on the old shape. Date
@@ -594,10 +613,13 @@ export default function Page() {
       </Callout>
       <Callout tone="note" title="Guarded queries reach it too">
         A member carrying <code>[DwNoSelect]</code> makes the policy layer
-        synthesize a projection for a query that sent none, so a typed guarded
-        query on a type with no parameterless constructor raises the same code —
-        even though the caller never asked for a <code>Select</code>. The dynamic
-        terminals project through <code>SelectDynamic</code> and are not affected.
+        synthesize a projection for a query that sent none — since 3.2.0
+        whatever the member holds, and beneath another member when its value
+        can reach the result (point&nbsp;25) — so a typed guarded query on a
+        type with no parameterless constructor raises
+        the same code, even though the caller never asked for a{" "}
+        <code>Select</code>. The dynamic terminals project through{" "}
+        <code>SelectDynamic</code> and are not affected.
       </Callout>
 
       <h2 id="policy-prepared">18. A Guarded Query Requires a Prepared Context</h2>
@@ -1077,6 +1099,353 @@ PolicyTrace? recorded = guarded.LastTrace;  // recorded whatever the setting say
 }`}</Code>
       </Callout>
 
+      <h2 id="synthesized-projection">25. A Guarded Query That Sends No <code>Selects</code> Keeps What the Source Carries</h2>
+      <p>
+        A request with no <code>Selects</code> returns whole rows, denied fields
+        included, so a guarded query synthesizes a projection when a denied
+        field could reach the result. <strong>3.2.0</strong> changed when it
+        does so and what the projection keeps. The rules are on{" "}
+        <Link href="/docs/policies/configuration#no-selects">Policy configuration</Link>.
+      </p>
+      <ul>
+        <li>
+          <strong>When.</strong> A field denied at the top of <code>T</code>{" "}
+          asks for it whatever the field holds. A field denied beneath a member
+          asks for it when its value can reach the result: on an entity, beneath
+          a column, an owned or complex member, or a navigation the query loads
+          through an <code>Include</code>, an automatic include or a lazy
+          loader; on a projected row, beneath a member the initializer assigns;
+          in memory, beneath any member. A chain that reaches its rows through
+          a navigation, a <code>SelectMany</code>, a <code>Join</code> or a{" "}
+          <code>GroupBy</code> counts every navigation as loaded when it also has
+          an include, or a lambda that builds an object, gets one from an
+          application&apos;s method, or captures a query with its own include or
+          projection. A field a subtype of{" "}
+          <code>T</code> declares, one a subtype of a member&apos;s type
+          declares, and one beneath a member EF Core does not map, count too. A
+          member that can hold an object of any type asks for nothing on its
+          own. It does so in both tiers, typed and dynamic, for a{" "}
+          <code>Filter</code> and a <code>Segment</code>. Until 3.2.0 only a
+          simple field denied at the top of <code>T</code> asked for one. A
+          denial beneath a navigation nothing loads never leaves the database, so
+          an entity whose only denials sit there is read exactly as in 3.1.0.
+        </li>
+        <li>
+          <strong>What.</strong> The allowed members, which replace the allowed
+          scalars. A row a projection builds keeps the members its initializer
+          assigns. An entity keeps its mapped columns, converted and JSON ones
+          included except a converted one that can hold an object of any type,
+          its owned and complex members, and every collection of
+          simple values such as <code>byte[]</code> or{" "}
+          <code>List&lt;string&gt;</code>. Rows in memory keep their values. A
+          member holding an object is kept whole when nothing it can hold is
+          denied, narrowed to the allowed fields where the core&apos;s narrowing
+          translates, and otherwise left out whole.
+        </li>
+      </ul>
+      <Callout tone="danger" title="Fixed (security): a denial beneath a member was not enforced">
+        With every denied field beneath a member and none at the top of{" "}
+        <code>T</code>, nothing was synthesized, and the whole row came back
+        with the denied value in it: in a list or nested object of a row
+        projected before <code>ApplyPolicy</code>, in a row held in memory, and
+        in an entity&apos;s included, automatically included, lazily loaded or
+        owned member — typed and dynamic, in both tiers, for a{" "}
+        <code>Filter</code> and a <code>Segment</code>.
+      </Callout>
+      <Callout tone="danger" title="Fixed (security): what a query loads was read too narrowly">
+        An include named from the root and reached through{" "}
+        <code>{`Select(o => o.Customer)`}</code>, <code>SelectMany</code> or{" "}
+        <code>Join</code>, a projection behind another <code>Select</code>, an
+        initializer after a constructor with arguments, and a lazy loader the
+        constructor takes and keeps in a field or a property of any name each
+        loaded a denied value the gate read as unloaded, and so did an injected{" "}
+        <code>DbContext</code> or EF Core 7&apos;s asynchronous loader delegate,
+        and a reshaping lambda that got its row from an application&apos;s
+        method or from a captured query or object. An application&apos;s own
+        collection class hid its own denied members, and a guarded query
+        through a provider wrapping EF Core&apos;s, such as LinqKit&apos;s{" "}
+        <code>AsExpandable</code>, ran tracking, so the context filled in
+        navigations it already held and a masked value became a pending change.
+        A field a subtype declares — a derived entity&apos;s, or a
+        subclass&apos;s held by a base-typed member — was not read at all, nor
+        was a <code>[DwDenied]</code> on an override, on a public member hidden
+        with <code>new</code> or on an interface member&apos;s implementation,
+        and
+        under a{" "}
+        <code>&quot;*&quot;</code> deny a path the walk never asked about was
+        allowed. Each came back.
+      </Callout>
+      <Callout tone="danger" title="Rows of a derived type come back as T">
+        When a type the model derives from <code>T</code>, or a loaded subclass
+        of a row in memory, declares a denied field, the rows are projected to{" "}
+        <code>T</code>, so a derived type&apos;s allowed fields are dropped too,
+        and a member declared as a base type is narrowed to it. Over an abstract{" "}
+        <code>T</code> the typed terminals fail with{" "}
+        <code>SelectTypeMustHaveParameterlessConstructor</code>; the dynamic ones
+        return its members. Query the derived type,{" "}
+        <code>{`OfType<Company>()`}</code>, to keep its fields. Rows in memory
+        can be any loaded subtype, so there the rows are projected whenever one
+        declares a denied field. A <code>[DwDenied]</code> on an override, on a
+        public member a subtype hides with <code>new</code>, or on an interface
+        member&apos;s implementation, through a variant instantiation too,
+        denies the base path for every row, in every clause.
+      </Callout>
+      <Callout tone="danger" title="Fixed (security): a denied member that holds no simple value came back">
+        A field denied at the top of <code>T</code> whose own type is not a
+        simple value — a byte array, a list, an owned object, a JSON column —
+        synthesized no projection either, so with nothing else denied the whole
+        row came back with it.
+      </Callout>
+      <Callout tone="danger" title="Nested objects and lists come back">
+        In 3.1.0, as soon as any field was denied, every nested object and list
+        of a row projected before <code>ApplyPolicy</code> came back null or
+        empty, and so did an entity&apos;s columns holding an object, its owned
+        and complex members and its collections of simple values. They are
+        returned now, whole or narrowed, except a converted value that can hold
+        an object of any type, which the policy cannot see into. A member that cannot be narrowed is
+        left out whole, and the trace records a <code>Dropped</code> decision
+        whose reason starts <code>left out whole</code>.
+      </Callout>
+      <Callout tone="danger" title="What a projection leaves out">
+        Once a projection is needed it leaves out an entity&apos;s navigations,
+        included ones too, since projecting one would load it: under{" "}
+        <code>Convenience</code> name the navigation in <code>Selects</code> to
+        get it narrowed, and under <code>Strict</code> name its allowed fields.
+        It leaves out
+        the objects a row in memory holds, since a kept object is the
+        caller&apos;s own and a transform would change it in place, and a value
+        EF Core does not map, which EF Core could compute only by reading the
+        whole entity, the denied columns included. A member with no setter and
+        a member named with one of the parser&apos;s words are left out too. A
+        typed query projects into <code>T</code>, so <code>T</code> needs a
+        public parameterless constructor for it, as it already did
+        (point&nbsp;1).
+      </Callout>
+      <Callout tone="warn" title="A forced scope on a list's element type filters rows, not elements">
+        A forced scope declared on a list&apos;s element type asks for no
+        projection on its own. It filters the rows that hold the list, never its
+        elements, so <code>Selects</code> naming the list returns every element,
+        those the scope excludes included, as in every release. A projection
+        needed for another reason leaves such a list out whole. Scope the
+        elements where the row is built.
+      </Callout>
+
+      <h2 id="selects-beneath">26. <code>Selects</code> Naming a Member Is Gated Against Every Denial Beneath It</h2>
+      <p>
+        When <code>Selects</code> names a navigation with a denied field beneath
+        it, the <code>Convenience</code> tier replaces the entry with the
+        allowed fields beneath it, and the <code>Strict</code> tier refuses it.
+        Since <strong>3.2.0</strong> the gate finds every denial beneath the
+        member, and refuses, with <code>FieldDeniedForSelect</code>, a narrowing
+        it cannot build as gated. See{" "}
+        <Link href="/docs/policies/configuration#navigation-selects">A navigation named in Selects</Link>.
+      </p>
+      <table>
+        <thead>
+          <tr><th><code>Selects</code> names</th><th>Until 3.1.0</th><th>Since 3.2.0</th></tr>
+        </thead>
+        <tbody>
+          <tr>
+            <td>A navigation whose key, <code>Id</code>, is denied</td>
+            <td>
+              The convenience tier narrowed the key away, and the core&apos;s
+              typed projection, which adds the key of every nested node it
+              builds, put it back.
+            </td>
+            <td>
+              Refused in both tiers, as naming a sibling of the key already
+              was.
+            </td>
+          </tr>
+          <tr>
+            <td>A navigation named through another, <code>Main.Lead</code>, when <code>Main.Id</code> is denied</td>
+            <td>Kept, and the projection added <code>Main</code>&apos;s key.</td>
+            <td>Refused: the key of every node the path passes through is gated.</td>
+          </tr>
+          <tr>
+            <td>
+              A member typed as a collection the core does not unwrap —{" "}
+              <code>IReadOnlyList&lt;T&gt;</code>,{" "}
+              <code>IReadOnlyCollection&lt;T&gt;</code>,{" "}
+              <code>Collection&lt;T&gt;</code> or an application&apos;s own —
+              with a denied field beneath it
+            </td>
+            <td>
+              Every field beneath it came back, the denied ones included, in both
+              tiers: the projection gate read collections through a narrower list
+              than the attribute walker, and found nothing beneath the member.
+            </td>
+            <td>
+              The gate reads collections the way the walker does. The strict
+              tier refuses the denied field, and the convenience tier&apos;s
+              narrowing, which the core cannot project, is refused too.
+            </td>
+          </tr>
+          <tr>
+            <td>
+              A member that carries a field denied where no path reaches it:
+              deeper than four segments, inside a framework generic such as{" "}
+              <code>Dictionary&lt;string, T&gt;</code>, declared by a subtype of
+              its type, in an entity navigation&apos;s owned chain or converted
+              column, or, under a <code>&quot;*&quot;</code> deny, on a path the
+              walk never asks about
+            </td>
+            <td>Returned, the denied field included.</td>
+            <td>
+              Refused under <code>Strict</code>. Under <code>Convenience</code>{" "}
+              narrowed where the core can narrow it, which builds the declared
+              type, and refused where it cannot.
+            </td>
+          </tr>
+          <tr>
+            <td>A member with a denied property that has no setter beneath it, or a rule on a path reached through a cycle</td>
+            <td>Not found, so the member came back with it.</td>
+            <td>Found: the gate reads the providers&apos; rules as well as the walk.</td>
+          </tr>
+        </tbody>
+      </table>
+      <p>
+        A member that cannot be narrowed at all — a column, a complex property
+        or a member stored as JSON, a member of a row in memory, or one a
+        projection builds some way the core cannot narrow — is refused in both
+        tiers when something beneath it is denied.
+      </p>
+      <Callout tone="danger" title="Fixed (security): named members carried denied values out">
+        A request that ran on 3.1.0 can now be refused. Under the{" "}
+        <code>Convenience</code> tier the refusal names the denied key, the
+        first denied field beneath the member, or, for a denial no path names,
+        the member itself; under <code>Strict</code> its <code>FieldPath</code>{" "}
+        is <code>&quot;*&quot;</code>. A request that sends no{" "}
+        <code>Selects</code> is not refused for such a member: its synthesized
+        projection narrows the member or leaves it out whole (point&nbsp;25).
+      </Callout>
+      <Callout tone="warn" title="What the policy cannot see into">
+        A member typed <code>object</code>, a framework interface or a
+        collection that is not generic, such as <code>IEnumerable</code>,{" "}
+        <code>ArrayList</code> or an application&apos;s own, is opaque to the
+        policy: it never asks for a projection, a synthesized projection over a
+        projected row or rows in memory leaves it out, and naming it returns
+        whatever it holds. A framework generic holding a policed type, such as{" "}
+        <code>Dictionary&lt;string, LineDto&gt;</code>, has no paths beneath it:
+        naming it is refused in both tiers where the core cannot narrow it,
+        narrowed away under <code>Convenience</code> beneath a navigation, and a
+        synthesized projection leaves it out. Hold such values in a list of the
+        policed type instead.
+      </Callout>
+
+      <h2 id="default-order-projection">27. <code>DefaultOrder</code> Reaches a Projection That Builds <code>T</code></h2>
+      <p>
+        In 3.1.0 a <code>Select</code> anywhere in the chain kept a guarded query
+        in its own order, because a default applied after a projection could
+        name a field the projection left out, which EF Core cannot translate.
+        Since <strong>3.2.0</strong> only the outermost <code>Select</code>{" "}
+        counts, because it makes the rows the default orders. When it builds{" "}
+        <code>T</code> in an object initializer and assigns every field the{" "}
+        <Link href="/docs/policies/attributes#default-order"><code>[DwEntity(DefaultOrder)]</code></Link>{" "}
+        names a column, at every level of a nested path, the default applies. A
+        column is a member the EF Core model maps on the entity the{" "}
+        <code>Select</code> reads, read directly, through reference navigations
+        or through <code>EF.Property</code>; in memory any assigned field is
+        one. A value the projection computes, by any method or operator, even
+        one EF Core could translate, a member the model does not map, a
+        constructor with arguments, a default field the initializer does not
+        assign, or a nested path through anything but an initializer still
+        leaves the query in its own order: ordering by it could fail where the
+        unguarded query ran.
+      </p>
+      <Code lang="csharp">{`[DwEntity(DefaultOrder = "CreatedAt desc, Id")]
+public class TicketRow
+{
+    public int Id { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public string Title { get; set; } = string.Empty;
+}
+
+// 3.1.0: unordered. 3.2.0: ordered by CreatedAt desc, Id.
+var rows = db.Tickets
+    .Select(t => new TicketRow { Id = t.Id, CreatedAt = t.CreatedAt, Title = t.Title })
+    .ApplyPolicy(caller)
+    .ToList(new Filter());`}</Code>
+      <ul>
+        <li>
+          A projection composed on the guarded handle — the guarded{" "}
+          <code>Select</code>, or a guarded <code>Filter</code> whose{" "}
+          <code>Selects</code> is set — keeps the rest of the chain unordered,
+          even when it keeps every default field. So{" "}
+          <code>{`guarded.Select(["Id", "Title"]).Page(page)`}</code> pages as it
+          did in 3.0.0, unordered.
+        </li>
+        <li>
+          A <code>Filter</code> composed on the handle that sent orders gets no
+          default later in the chain, even when the policy dropped every one of
+          them, as a composed <code>Order</code> already did not.
+        </li>
+      </ul>
+      <Callout tone="danger" title="A projected query that ran unordered can now be ordered">
+        A guarded query over such a projection that sends no orders now comes
+        back in the declared order, where it used to come back in the
+        database&apos;s. Paging through it is stable if the default ends with a
+        unique field.
+      </Callout>
+
+      <h2 id="cancellation-token">28. Every Async Terminal Takes a <code>CancellationToken</code></h2>
+      <p>
+        Since <strong>3.2.0</strong> every asynchronous terminal, guarded and
+        unguarded, has overloads that take a <code>CancellationToken</code>:{" "}
+        <Link href="/docs/extensions/to-list-async-filter"><code>ToListAsync</code></Link>{" "}
+        and{" "}
+        <Link href="/docs/extensions/to-list-async-dynamic-filter"><code>ToListAsyncDynamic</code></Link>{" "}
+        with a <code>Filter</code>,{" "}
+        <Link href="/docs/extensions/to-list-async-summary"><code>ToListAsync</code></Link>{" "}
+        with a <code>Summary</code>, and{" "}
+        <Link href="/docs/extensions/to-list-async-segment"><code>ToListAsync</code></Link>{" "}
+        with a <code>Segment</code>. The token reaches the count and the read. The
+        overloads sit beside the 3.1 signatures, which are unchanged, so code
+        compiled against 3.1 still binds. That brings the extension methods to
+        28. A reflection lookup by name alone finds more overloads than it did,
+        and where it found one — <code>ToListAsyncDynamic</code>, on the
+        extension class and on the guarded handle — it now finds several, so{" "}
+        <code>Type.GetMethod</code> given only the name throws{" "}
+        <code>AmbiguousMatchException</code>; pass the parameter types.
+      </p>
+      <Callout tone="danger" title="ToListAsync(filter, default) no longer compiles">
+        <code>default</code> fits both <code>bool getQueryString</code> and the
+        new <code>CancellationToken</code> overload, so the call is ambiguous
+        (CS0121). So are <code>ToListAsyncDynamic(filter, default)</code> and{" "}
+        <code>ToListAsync(summary, default)</code>, on a query and on the guarded
+        handle alike. Write <code>false</code>, a token, or a named argument.
+        <Code lang="csharp">{`await query.ToListAsync(filter, default);              // CS0121 since 3.2.0
+await query.ToListAsync(filter, false);                // as 3.1 read it
+await query.ToListAsync(filter, cancellationToken);    // the new overload`}</Code>
+      </Callout>
+      <Callout tone="warn" title="The dynamic and summary reads go through EF Core">
+        <code>ToListAsyncDynamic</code> and the async <code>Summary</code> read
+        through EF Core&apos;s <code>ToListAsync</code> instead of Dynamic
+        LINQ&apos;s <code>ToDynamicListAsync</code>, which had no token to pass
+        on, and the async <code>Summary</code> counts through{" "}
+        <code>CountAsync</code> where it counted synchronously. So on an EF Core
+        query a canceled token now reaches the database. The rows and the counts
+        are the same. A provider that is not EF Core&apos;s keeps Dynamic
+        LINQ&apos;s read, on the calling thread.
+      </Callout>
+
+      <h2 id="system-namespace">29. A Type in a Namespace That Starts with <code>System</code> Is Policed</h2>
+      <p>
+        The attribute walker does not descend into the framework&apos;s own
+        types, which carry no policy attributes. Until <strong>3.2.0</strong>{" "}
+        it took any namespace whose name started with <code>System</code> for
+        the framework&apos;s, so an application namespace such as{" "}
+        <code>SystemsCorp.Payroll</code> or <code>SystemX.Domain</code> got no
+        policy beneath its types. A <code>[DwDenied]</code> field on such a type,
+        reached through a member, was returned, filterable and sortable. Only{" "}
+        <code>System</code> and the namespaces beneath it are the
+        framework&apos;s now.
+      </p>
+      <Callout tone="danger" title="Fixed (security): an application namespace was read as the framework's">
+        A guarded request that filtered on, sorted by or selected such a field
+        ran on 3.1.0. It is now refused or dropped, as for any denied field.
+      </Callout>
+
       <h2 id="next">See also</h2>
       <ul>
         <li>
@@ -1110,12 +1479,22 @@ PolicyTrace? recorded = guarded.LastTrace;  // recorded whatever the setting say
         </li>
         <li>
           <Link href="/docs/policies/configuration">Policy configuration →</Link>{" "}
-          context for points 21, 22, 23 and 24: the caps, the trace on a result,
-          and what a strict refusal carries.
+          context for points 21 to 26: the caps, the trace on a result, what a
+          strict refusal carries, and what a denied field does to a projection.
         </li>
         <li>
           <Link href="/docs/policies/security#probing">Security &amp; k-anonymity →</Link>{" "}
-          why the strict tier hides which fields exist (point 23).
+          why the strict tier hides which fields exist (point 23), and{" "}
+          <Link href="/docs/policies/security#beneath">the denials the gate could not see</Link>{" "}
+          (points 25, 26 and 29).
+        </li>
+        <li>
+          <Link href="/docs/policies/attributes#default-order">Default order →</Link>{" "}
+          context for point 27.
+        </li>
+        <li>
+          <Link href="/docs/extensions#materialization">Materialization →</Link>{" "}
+          context for point 28: every async terminal and its overloads.
         </li>
       </ul>
     </DocPage>
diff --git a/OfficialWebsite/app/docs/errors/page.tsx b/OfficialWebsite/app/docs/errors/page.tsx
index 11d0cd6..7ac4933 100644
--- a/OfficialWebsite/app/docs/errors/page.tsx
+++ b/OfficialWebsite/app/docs/errors/page.tsx
@@ -340,8 +340,10 @@ export default function Page() {
               <code>T</code> the projection cannot construct — a positional record,
               most often. The type&apos;s name is on{" "}
               <code>Subject</code>, not in the message. Also reached by a typed
-              guarded query whose policy denies a field for <code>Select</code>,
-              since the deny synthesizes a projection
+              guarded query whose policy denies a field for <code>Select</code>{" "}
+              — since 3.2.0 whatever the field holds, and beneath a member where
+              its value can reach the result — because the deny synthesizes a
+              projection
             </td>
           </tr>
         </tbody>
diff --git a/OfficialWebsite/app/docs/extensions/page.tsx b/OfficialWebsite/app/docs/extensions/page.tsx
index 813f08d..253a81f 100644
--- a/OfficialWebsite/app/docs/extensions/page.tsx
+++ b/OfficialWebsite/app/docs/extensions/page.tsx
@@ -165,13 +165,16 @@ export default function Page() {
       <h2 id="materialization">Materialization</h2>
       <p>
         Execute the composed query and return a paginated result — typed,
-        dynamic, summary, or segment. The two <code>Filter</code> async
-        terminals count with EF Core&apos;s <code>CountAsync</code> and read
-        with <code>ToListAsync</code> / <code>ToDynamicListAsync</code>;{" "}
-        <code>ToListAsync(Summary)</code> counts synchronously and only awaits
-        the read, and <code>ToListAsync(Segment)</code> combines its sets into
-        one query and then counts and reads it exactly as a{" "}
-        <code>Filter</code> does.
+        dynamic, summary, or segment. The async terminals count with EF
+        Core&apos;s <code>CountAsync</code> and read with EF Core&apos;s{" "}
+        <code>ToListAsync</code>. Since 3.2.0 that includes the dynamic{" "}
+        <code>Filter</code>&apos;s read and the <code>Summary</code>&apos;s count
+        and read: the count used to run synchronously, and the reads through
+        Dynamic LINQ, with no token to pass on.{" "}
+        <code>ToListAsync(Summary)</code> on a provider that is not EF
+        Core&apos;s keeps its synchronous count and Dynamic LINQ&apos;s read, and{" "}
+        <code>ToListAsync(Segment)</code> combines its sets into one query and
+        then counts and reads it exactly as a <code>Filter</code> does.
       </p>
       <table>
         <thead>
@@ -198,6 +201,16 @@ export default function Page() {
             <td>Yes</td>
             <td><Link href="/docs/extensions/to-list-async-filter">Docs</Link></td>
           </tr>
+          <tr>
+            <td><code>ToListAsync</code> (Filter, token)</td>
+            <td>
+              <code>.ToListAsync&lt;T&gt;(Filter, CancellationToken)</code> /{" "}
+              <code>.ToListAsync&lt;T&gt;(Filter, bool getQueryString, CancellationToken)</code>
+            </td>
+            <td><code>Task&lt;FilterResult&lt;T&gt;&gt;</code></td>
+            <td>Yes</td>
+            <td><Link href="/docs/extensions/to-list-async-filter#cancellation">Docs</Link></td>
+          </tr>
           <tr>
             <td><code>ToListDynamic</code> (Filter)</td>
             <td><code>.ToListDynamic&lt;T&gt;(Filter, bool getQueryString = false)</code></td>
@@ -212,6 +225,16 @@ export default function Page() {
             <td>Yes</td>
             <td><Link href="/docs/extensions/to-list-async-dynamic-filter">Docs</Link></td>
           </tr>
+          <tr>
+            <td><code>ToListAsyncDynamic</code> (Filter, token)</td>
+            <td>
+              <code>.ToListAsyncDynamic&lt;T&gt;(Filter, CancellationToken)</code> /{" "}
+              <code>.ToListAsyncDynamic&lt;T&gt;(Filter, bool getQueryString, CancellationToken)</code>
+            </td>
+            <td><code>Task&lt;FilterResult&lt;dynamic&gt;&gt;</code></td>
+            <td>Yes</td>
+            <td><Link href="/docs/extensions/to-list-async-dynamic-filter#cancellation">Docs</Link></td>
+          </tr>
           <tr>
             <td><code>ToList</code> (Summary)</td>
             <td><code>.ToList&lt;T&gt;(Summary, bool getQueryString = false)</code></td>
@@ -226,6 +249,16 @@ export default function Page() {
             <td>Yes</td>
             <td><Link href="/docs/extensions/to-list-async-summary">Docs</Link></td>
           </tr>
+          <tr>
+            <td><code>ToListAsync</code> (Summary, token)</td>
+            <td>
+              <code>.ToListAsync&lt;T&gt;(Summary, CancellationToken)</code> /{" "}
+              <code>.ToListAsync&lt;T&gt;(Summary, bool getQueryString, CancellationToken)</code>
+            </td>
+            <td><code>Task&lt;SummaryResult&gt;</code></td>
+            <td>Yes</td>
+            <td><Link href="/docs/extensions/to-list-async-summary#cancellation">Docs</Link></td>
+          </tr>
           <tr>
             <td><code>ToListAsync</code> (Segment)</td>
             <td><code>.ToListAsync&lt;T&gt;(Segment segment)</code></td>
@@ -233,9 +266,34 @@ export default function Page() {
             <td>Yes (only)</td>
             <td><Link href="/docs/extensions/to-list-async-segment">Docs</Link></td>
           </tr>
+          <tr>
+            <td><code>ToListAsync</code> (Segment, token)</td>
+            <td><code>.ToListAsync&lt;T&gt;(Segment, CancellationToken)</code></td>
+            <td><code>Task&lt;SegmentResult&lt;T&gt;&gt;</code></td>
+            <td>Yes (only)</td>
+            <td><Link href="/docs/extensions/to-list-async-segment">Docs</Link></td>
+          </tr>
         </tbody>
       </table>
 
+      <Callout tone="note" title="A CancellationToken on every async terminal (3.2.0)">
+        <code>ToListAsync</code> and <code>ToListAsyncDynamic</code> with a{" "}
+        <code>Filter</code>, <code>ToListAsync</code> with a{" "}
+        <code>Summary</code> and <code>ToListAsync</code> with a{" "}
+        <code>Segment</code> each have overloads that take a{" "}
+        <code>CancellationToken</code>. The token reaches the count and the
+        read. The overloads sit beside the 3.1 signatures, which are unchanged,
+        so code compiled against 3.1 still binds.{" "}
+        <code>ToListAsync(filter, default)</code> no longer compiles, because{" "}
+        <code>default</code> fits both <code>getQueryString</code> and the
+        token; neither do <code>ToListAsyncDynamic(filter, default)</code> and{" "}
+        <code>ToListAsync(summary, default)</code>. Write <code>false</code>, a
+        token, or a named argument. And a reflection lookup of{" "}
+        <code>ToListAsyncDynamic</code> by name alone now finds three methods
+        where it found one: pass the parameter types to{" "}
+        <code>Type.GetMethod</code>.
+      </Callout>
+
       <Callout tone="warn">
         Segment operations are <strong>async-only</strong>. There is no
         synchronous <code>ToList&lt;T&gt;(Segment)</code> variant. The set
@@ -254,7 +312,9 @@ export default function Page() {
         for unit tests and in-process pipelines. Nothing else has one: there is
         no <code>ToListDynamic(Summary)</code>, and no async or composable
         method works on an <code>IEnumerable&lt;T&gt;</code> source. Counting
-        those three, the library ships <strong>21</strong> extension methods.
+        those three and the seven overloads that take a{" "}
+        <code>CancellationToken</code>, the library ships <strong>28</strong>{" "}
+        extension methods.
       </p>
 
       <Callout tone="note">
@@ -268,7 +328,7 @@ export default function Page() {
       </Callout>
 
       <Callout tone="note">
-        Every one of the 21 begins by asking the policy layer whether this type
+        Every one of the 28 begins by asking the policy layer whether this type
         may be queried at all. A type marked{" "}
         <code>[DwEntity(RequirePolicy = true)]</code> throws{" "}
         <code>PolicyException</code> with <code>PolicyRequired</code> when it is
diff --git a/OfficialWebsite/app/docs/extensions/to-list-async-dynamic-filter/page.tsx b/OfficialWebsite/app/docs/extensions/to-list-async-dynamic-filter/page.tsx
index 6596940..f8e595c 100644
--- a/OfficialWebsite/app/docs/extensions/to-list-async-dynamic-filter/page.tsx
+++ b/OfficialWebsite/app/docs/extensions/to-list-async-dynamic-filter/page.tsx
@@ -7,7 +7,7 @@ import Callout from "@/components/Callout";
 export const metadata: Metadata = {
   title: ".ToListAsyncDynamic<T>(Filter)",
   description:
-    "Async EF Core entry — materialize a Filter using SelectDynamic and ToDynamicListAsync, returning Task<FilterResult<dynamic>>.",
+    "Async EF Core entry — materialize a Filter using SelectDynamic, EF Core's CountAsync and ToListAsync, returning Task<FilterResult<dynamic>>, with overloads that take a CancellationToken.",
   alternates: { canonical: "https://doc.dynamicwhere.com/docs/extensions/to-list-async-dynamic-filter/" },
 };
 
@@ -20,8 +20,9 @@ export default function Page() {
         <Link href="/docs/extensions/to-list-dynamic-filter">
           <code>.ToListDynamic&lt;T&gt;(Filter)</code>
         </Link>
-        . Uses EF Core's <code>CountAsync()</code> and{" "}
-        <code>ToDynamicListAsync()</code> under the hood.
+        . Counts with EF Core's <code>CountAsync()</code> and reads with EF
+        Core's own <code>ToListAsync()</code>. Since 3.2.0 two more overloads
+        take a <code>CancellationToken</code>, which reaches both.
       </p>
 
       <h2 id="signature">Signature</h2>
@@ -29,6 +30,20 @@ export default function Page() {
     this IQueryable<T> query,
     Filter filter,
     bool getQueryString = false)
+    where T : class
+
+// 3.2.0
+public static Task<FilterResult<dynamic>> ToListAsyncDynamic<T>(
+    this IQueryable<T> query,
+    Filter filter,
+    CancellationToken cancellationToken)
+    where T : class
+
+public static Task<FilterResult<dynamic>> ToListAsyncDynamic<T>(
+    this IQueryable<T> query,
+    Filter filter,
+    bool getQueryString,
+    CancellationToken cancellationToken)
     where T : class`}</Code>
 
       <table>
@@ -58,6 +73,15 @@ export default function Page() {
               <code>QueryString</code>
             </td>
           </tr>
+          <tr>
+            <td><code>cancellationToken</code></td>
+            <td><code>CancellationToken</code></td>
+            <td>–</td>
+            <td>
+              Cancels the count and the read. The overload without it passes{" "}
+              <code>CancellationToken.None</code>
+            </td>
+          </tr>
         </tbody>
       </table>
 
@@ -65,14 +89,29 @@ export default function Page() {
       <ul>
         <li><code>Where</code> applied on the typed query.</li>
         <li>
-          <code>CountAsync()</code> on the typed query → <code>TotalCount</code>.
+          <code>CountAsync(cancellationToken)</code> on the typed query →{" "}
+          <code>TotalCount</code>.
         </li>
         <li><code>Order</code> applied on the typed query.</li>
         <li><code>Page</code> applied on the typed query.</li>
         <li><code>SelectDynamic</code> projection applied last.</li>
-        <li><code>ToDynamicListAsync()</code> materializes the result.</li>
+        <li>
+          EF Core&apos;s <code>ToListAsync(cancellationToken)</code> materializes
+          the result, called for the query&apos;s element type: the class the
+          projection generates, or <code>T</code> when <code>Selects</code> is
+          null.
+        </li>
       </ul>
 
+      <Callout tone="warn" title="Changed in 3.2.0: the read goes through EF Core">
+        The read used to run Dynamic LINQ&apos;s{" "}
+        <code>ToDynamicListAsync()</code>, asynchronous as well but with no token
+        to pass on. On an EF Core query it now runs through EF Core&apos;s{" "}
+        <code>ToListAsync()</code>, so a canceled token reaches the database. The
+        rows are the same. Only the count needs an EF Core async provider; on
+        any other provider the read falls back to Dynamic LINQ&apos;s.
+      </Callout>
+
       <Callout tone="warn">
         Ordering and pagination are applied on the strongly-typed{" "}
         <code>IQueryable&lt;T&gt;</code> <strong>before</strong> the dynamic
@@ -89,6 +128,32 @@ export default function Page() {
         nested dynamic objects and collections.
       </Callout>
 
+      <h2 id="cancellation">Cancellation</h2>
+      <p>
+        The two overloads that take a <code>CancellationToken</code> are new in
+        3.2.0. The token reaches the count and the read, so a canceled token
+        stops whichever of the two is running, and the call throws{" "}
+        <code>OperationCanceledException</code>. EF Core&apos;s{" "}
+        <code>TaskCanceledException</code> derives from it. The overload without
+        a token passes <code>CancellationToken.None</code>.
+      </p>
+      <p>
+        They are overloads, not an optional parameter added to the old
+        signature. The 3.1 signature is unchanged, so code compiled against 3.1
+        still binds. The guarded handle that{" "}
+        <Link href="/docs/policies#handle"><code>ApplyPolicy</code></Link>{" "}
+        returns has the same overloads.
+      </p>
+      <Callout tone="warn" title="ToListAsyncDynamic(filter, default) does not compile">
+        <code>default</code> fits both <code>bool getQueryString</code> and{" "}
+        <code>CancellationToken</code>, so the compiler reports the call as
+        ambiguous (CS0121). Write <code>false</code>, a token, or a named
+        argument.
+      </Callout>
+      <Code lang="csharp">{`await db.Products.ToListAsyncDynamic(filter, default);                   // CS0121: ambiguous
+await db.Products.ToListAsyncDynamic(filter, cancellationToken);         // the token overload
+await db.Products.ToListAsyncDynamic(filter, true, cancellationToken);   // the SQL and a token`}</Code>
+
       <h2 id="returns">Returns</h2>
       <p>
         <code>Task&lt;FilterResult&lt;dynamic&gt;&gt;</code>.
diff --git a/OfficialWebsite/app/docs/extensions/to-list-async-filter/page.tsx b/OfficialWebsite/app/docs/extensions/to-list-async-filter/page.tsx
index ac8eb3c..fd218cf 100644
--- a/OfficialWebsite/app/docs/extensions/to-list-async-filter/page.tsx
+++ b/OfficialWebsite/app/docs/extensions/to-list-async-filter/page.tsx
@@ -7,7 +7,7 @@ import Callout from "@/components/Callout";
 export const metadata: Metadata = {
   title: ".ToListAsync<T>(Filter)",
   description:
-    "Async EF Core entry point — materialize a Filter against an IQueryable<T> using CountAsync and ToListAsync.",
+    "Async EF Core entry point — materialize a Filter against an IQueryable<T> using CountAsync and ToListAsync, with overloads that take a CancellationToken.",
   alternates: { canonical: "https://doc.dynamicwhere.com/docs/extensions/to-list-async-filter/" },
 };
 
@@ -21,7 +21,8 @@ export default function Page() {
           <code>.ToList&lt;T&gt;(Filter)</code>
         </Link>
         . Uses EF Core's <code>CountAsync()</code> and{" "}
-        <code>ToListAsync()</code> under the hood.
+        <code>ToListAsync()</code> under the hood. Since 3.2.0 two more
+        overloads take a <code>CancellationToken</code>, which reaches both.
       </p>
 
       <h2 id="signature">Signature</h2>
@@ -29,6 +30,20 @@ export default function Page() {
     this IQueryable<T> query,
     Filter filter,
     bool getQueryString = false)
+    where T : class
+
+// 3.2.0
+public static Task<FilterResult<T>> ToListAsync<T>(
+    this IQueryable<T> query,
+    Filter filter,
+    CancellationToken cancellationToken)
+    where T : class
+
+public static Task<FilterResult<T>> ToListAsync<T>(
+    this IQueryable<T> query,
+    Filter filter,
+    bool getQueryString,
+    CancellationToken cancellationToken)
     where T : class`}</Code>
 
       <table>
@@ -58,6 +73,15 @@ export default function Page() {
               <code>FilterResult.QueryString</code>
             </td>
           </tr>
+          <tr>
+            <td><code>cancellationToken</code></td>
+            <td><code>CancellationToken</code></td>
+            <td>–</td>
+            <td>
+              Cancels the count and the read. The overload without it passes{" "}
+              <code>CancellationToken.None</code>
+            </td>
+          </tr>
         </tbody>
       </table>
 
@@ -65,12 +89,13 @@ export default function Page() {
       <ul>
         <li><code>Where</code> applied on the typed query.</li>
         <li>
-          <code>CountAsync()</code> on the typed query → <code>TotalCount</code>.
+          <code>CountAsync(cancellationToken)</code> on the typed query →{" "}
+          <code>TotalCount</code>.
         </li>
         <li><code>Order</code> applied on the typed query.</li>
         <li><code>Page</code> applied on the typed query.</li>
         <li><code>Select</code> projection applied last.</li>
-        <li><code>ToListAsync()</code> materializes the result.</li>
+        <li><code>ToListAsync(cancellationToken)</code> materializes the result.</li>
       </ul>
 
       <Callout tone="warn">
@@ -86,6 +111,33 @@ export default function Page() {
         database provider.
       </Callout>
 
+      <h2 id="cancellation">Cancellation</h2>
+      <p>
+        The two overloads that take a <code>CancellationToken</code> are new in
+        3.2.0. The token reaches the count and the read, so a canceled token
+        stops whichever of the two is running, and the call throws{" "}
+        <code>OperationCanceledException</code>. EF Core&apos;s{" "}
+        <code>TaskCanceledException</code> derives from it. The overload without
+        a token passes <code>CancellationToken.None</code>.
+      </p>
+      <p>
+        They are overloads, not an optional parameter added to the old
+        signature. The 3.1 signature is unchanged, so code compiled against 3.1
+        still binds. The guarded handle that{" "}
+        <Link href="/docs/policies#handle"><code>ApplyPolicy</code></Link>{" "}
+        returns has the same overloads.
+      </p>
+      <Callout tone="warn" title="ToListAsync(filter, default) does not compile">
+        <code>default</code> fits both <code>bool getQueryString</code> and{" "}
+        <code>CancellationToken</code>, so the compiler reports the call as
+        ambiguous (CS0121). Write <code>false</code>, a token, or a named
+        argument.
+      </Callout>
+      <Code lang="csharp">{`await db.Customers.ToListAsync(filter, default);                   // CS0121: ambiguous
+await db.Customers.ToListAsync(filter, cancellationToken);         // the token overload
+await db.Customers.ToListAsync(filter, getQueryString: false);     // no token
+await db.Customers.ToListAsync(filter, true, cancellationToken);   // the SQL and a token`}</Code>
+
       <h2 id="returns">Returns</h2>
       <p>
         <code>Task&lt;</code>
@@ -115,6 +167,18 @@ Console.WriteLine(result.QueryString);`}</Code>
     return Results.Ok(result);
 });`}</Code>
 
+      <p>
+        <strong>Cancel with the request.</strong> A minimal API binds a{" "}
+        <code>CancellationToken</code> parameter to{" "}
+        <code>HttpContext.RequestAborted</code>, so a client that disconnects
+        cancels the count or the read.
+      </p>
+      <Code lang="csharp">{`app.MapPost("/customers/search", async (Filter filter, AppDbContext db, CancellationToken cancellationToken) =>
+{
+    var result = await db.Customers.ToListAsync(filter, cancellationToken);
+    return Results.Ok(result);
+});`}</Code>
+
       <h2 id="see-also">See also</h2>
       <ul>
         <li>
diff --git a/OfficialWebsite/app/docs/extensions/to-list-async-segment/page.tsx b/OfficialWebsite/app/docs/extensions/to-list-async-segment/page.tsx
index 9c50828..9429240 100644
--- a/OfficialWebsite/app/docs/extensions/to-list-async-segment/page.tsx
+++ b/OfficialWebsite/app/docs/extensions/to-list-async-segment/page.tsx
@@ -7,7 +7,7 @@ import Callout from "@/components/Callout";
 export const metadata: Metadata = {
   title: ".ToListAsync<T>(Segment)",
   description:
-    "Async-only segment entry — combine the ConditionSets with Union / Intersect / Except into one query, then order, page and project it in the database like a filter.",
+    "Async-only segment entry — combine the ConditionSets with Union / Intersect / Except into one query, then order, page and project it in the database like a filter. An overload takes a CancellationToken.",
   alternates: { canonical: "https://doc.dynamicwhere.com/docs/extensions/to-list-async-segment/" },
 };
 
@@ -38,6 +38,13 @@ export default function Page() {
       <Code lang="csharp">{`public static Task<SegmentResult<T>> ToListAsync<T>(
     this IQueryable<T> query,
     Segment segment)
+    where T : class
+
+// 3.2.0
+public static Task<SegmentResult<T>> ToListAsync<T>(
+    this IQueryable<T> query,
+    Segment segment,
+    CancellationToken cancellationToken)
     where T : class`}</Code>
 
       <table>
@@ -59,6 +66,14 @@ export default function Page() {
               <code>Selects</code>, <code>Orders</code>, <code>Page</code>
             </td>
           </tr>
+          <tr>
+            <td><code>cancellationToken</code></td>
+            <td><code>CancellationToken</code></td>
+            <td>
+              Cancels the count and the read. New in 3.2.0; the overload
+              without it passes <code>CancellationToken.None</code>
+            </td>
+          </tr>
         </tbody>
       </table>
 
@@ -85,7 +100,18 @@ export default function Page() {
           Only the requested page is read, and an order field need not be
           selected.
         </li>
+        <li>
+          The overload that takes a <code>CancellationToken</code> passes it to
+          that count and that read. A canceled token stops whichever of the two
+          is running, and the call throws <code>OperationCanceledException</code>.
+        </li>
       </ul>
+      <p>
+        A segment takes no <code>getQueryString</code>, so{" "}
+        <code>ToListAsync(segment, default)</code> is not ambiguous: it binds
+        the token overload and passes <code>CancellationToken.None</code>. The
+        3.1 signature is unchanged, so code compiled against 3.1 still binds.
+      </p>
       <p>
         Which rows belong is decided in the database, not by object reference, so
         a tracking query, an <code>AsNoTracking()</code> query and a query with{" "}
diff --git a/OfficialWebsite/app/docs/extensions/to-list-async-summary/page.tsx b/OfficialWebsite/app/docs/extensions/to-list-async-summary/page.tsx
index cf97876..3a309d3 100644
--- a/OfficialWebsite/app/docs/extensions/to-list-async-summary/page.tsx
+++ b/OfficialWebsite/app/docs/extensions/to-list-async-summary/page.tsx
@@ -7,7 +7,7 @@ import Callout from "@/components/Callout";
 export const metadata: Metadata = {
   title: ".ToListAsync<T>(Summary)",
   description:
-    "Async EF Core entry — materialize a Summary against an IQueryable<T> and return Task<SummaryResult>.",
+    "Async EF Core entry — materialize a Summary against an IQueryable<T> and return Task<SummaryResult>, with overloads that take a CancellationToken.",
   alternates: { canonical: "https://doc.dynamicwhere.com/docs/extensions/to-list-async-summary/" },
 };
 
@@ -20,8 +20,10 @@ export default function Page() {
         <Link href="/docs/extensions/to-list-summary">
           <code>.ToList&lt;T&gt;(Summary)</code>
         </Link>
-        . The group count runs synchronously; only the data read is async, via
-        Dynamic LINQ's <code>ToDynamicListAsync()</code>.
+        . On an EF Core query it counts the groups with EF Core&apos;s{" "}
+        <code>CountAsync()</code> and reads them with EF Core&apos;s{" "}
+        <code>ToListAsync()</code>. Since 3.2.0 two more overloads take a{" "}
+        <code>CancellationToken</code>, which reaches both.
       </p>
 
       <h2 id="signature">Signature</h2>
@@ -29,6 +31,20 @@ export default function Page() {
     this IQueryable<T> query,
     Summary summary,
     bool getQueryString = false)
+    where T : class
+
+// 3.2.0
+public static Task<SummaryResult> ToListAsync<T>(
+    this IQueryable<T> query,
+    Summary summary,
+    CancellationToken cancellationToken)
+    where T : class
+
+public static Task<SummaryResult> ToListAsync<T>(
+    this IQueryable<T> query,
+    Summary summary,
+    bool getQueryString,
+    CancellationToken cancellationToken)
     where T : class`}</Code>
 
       <table>
@@ -58,6 +74,15 @@ export default function Page() {
               <code>SummaryResult.QueryString</code>
             </td>
           </tr>
+          <tr>
+            <td><code>cancellationToken</code></td>
+            <td><code>CancellationToken</code></td>
+            <td>–</td>
+            <td>
+              Cancels the count and the read. The overload without it passes{" "}
+              <code>CancellationToken.None</code>
+            </td>
+          </tr>
         </tbody>
       </table>
 
@@ -67,13 +92,32 @@ export default function Page() {
         <li><code>Group</code> applied — produces grouped dynamic intermediate.</li>
         <li><code>Having</code> applied — fields must reference aggregate aliases.</li>
         <li>
-          <code>Count()</code> on the grouped query → <code>TotalCount</code>.
-          This count is <strong>synchronous</strong>, not awaited.
+          The grouped query is counted → <code>TotalCount</code>. On an EF Core
+          query this is EF Core&apos;s <code>CountAsync(cancellationToken)</code>.
         </li>
         <li><code>Order</code> applied on the grouped query.</li>
         <li><code>Page</code> applied on the grouped query.</li>
-        <li>Async materialization as <code>List&lt;dynamic&gt;</code>.</li>
+        <li>
+          Async materialization as <code>List&lt;dynamic&gt;</code>. On an EF
+          Core query this is EF Core&apos;s{" "}
+          <code>ToListAsync(cancellationToken)</code>.
+        </li>
       </ul>
+      <p>
+        A source whose provider is not EF Core&apos;s — rows in memory through{" "}
+        <code>AsQueryable()</code>, for one — keeps the reads it had in 3.1: a
+        synchronous <code>Count()</code>, then Dynamic LINQ&apos;s{" "}
+        <code>ToDynamicListAsync()</code>, which reads on the calling thread. A
+        token that is already canceled still stops it before the count.
+      </p>
+
+      <Callout tone="warn" title="Changed in 3.2.0: the count and the read are asynchronous on EF Core">
+        Until 3.2.0 the group count ran synchronously, and the read went through
+        Dynamic LINQ&apos;s <code>ToDynamicListAsync()</code>, which had no token
+        to pass on, on every provider. On an EF Core query both now run through
+        EF Core&apos;s asynchronous operators, so a canceled token reaches the
+        database. The count and the rows are the same.
+      </Callout>
 
       <Callout tone="note">
         Dotted <code>GroupBy</code> fields like <code>Category.Name</code>{" "}
@@ -82,6 +126,32 @@ export default function Page() {
         use the dotted form — the library handles alias mapping internally.
       </Callout>
 
+      <h2 id="cancellation">Cancellation</h2>
+      <p>
+        The two overloads that take a <code>CancellationToken</code> are new in
+        3.2.0. The token reaches the count and the read. On an EF Core query a
+        canceled token stops whichever of the two is running, and the call
+        throws <code>OperationCanceledException</code>. EF Core&apos;s{" "}
+        <code>TaskCanceledException</code> derives from it. The overload without
+        a token passes <code>CancellationToken.None</code>.
+      </p>
+      <p>
+        They are overloads, not an optional parameter added to the old
+        signature. The 3.1 signature is unchanged, so code compiled against 3.1
+        still binds. The guarded handle that{" "}
+        <Link href="/docs/policies#handle"><code>ApplyPolicy</code></Link>{" "}
+        returns has the same overloads.
+      </p>
+      <Callout tone="warn" title="ToListAsync(summary, default) does not compile">
+        <code>default</code> fits both <code>bool getQueryString</code> and{" "}
+        <code>CancellationToken</code>, so the compiler reports the call as
+        ambiguous (CS0121). Write <code>false</code>, a token, or a named
+        argument.
+      </Callout>
+      <Code lang="csharp">{`await db.Products.ToListAsync(summary, default);                   // CS0121: ambiguous
+await db.Products.ToListAsync(summary, cancellationToken);         // the token overload
+await db.Products.ToListAsync(summary, true, cancellationToken);   // the SQL and a token`}</Code>
+
       <h2 id="returns">Returns</h2>
       <p>
         <code>Task&lt;</code>
diff --git a/OfficialWebsite/app/docs/installation/page.tsx b/OfficialWebsite/app/docs/installation/page.tsx
index aafdb54..88a27ce 100644
--- a/OfficialWebsite/app/docs/installation/page.tsx
+++ b/OfficialWebsite/app/docs/installation/page.tsx
@@ -28,14 +28,14 @@ export default function Page() {
       </p>
 
       <h2 id="cli">dotnet CLI</h2>
-      <Code lang="bash">{`dotnet add package DynamicWhere.ex --version 3.1.0`}</Code>
+      <Code lang="bash">{`dotnet add package DynamicWhere.ex --version 3.2.0`}</Code>
 
       <h2 id="package-manager">Package Manager (Visual Studio)</h2>
-      <Code lang="powershell">{`Install-Package DynamicWhere.ex -Version 3.1.0`}</Code>
+      <Code lang="powershell">{`Install-Package DynamicWhere.ex -Version 3.2.0`}</Code>
 
       <h2 id="package-reference">PackageReference (csproj)</h2>
       <Code lang="xml">{`<ItemGroup>
-  <PackageReference Include="DynamicWhere.ex" Version="3.1.0" />
+  <PackageReference Include="DynamicWhere.ex" Version="3.2.0" />
 </ItemGroup>`}</Code>
 
       <h2 id="dependencies">Dependencies</h2>
diff --git a/OfficialWebsite/app/docs/page.tsx b/OfficialWebsite/app/docs/page.tsx
index d928124..8101e10 100644
--- a/OfficialWebsite/app/docs/page.tsx
+++ b/OfficialWebsite/app/docs/page.tsx
@@ -30,7 +30,7 @@ export default function Page() {
       </p>
 
       <p>
-        Version <strong>3.1.0</strong>. Target framework <strong>.NET 6+</strong>.
+        Version <strong>3.2.0</strong>. Target framework <strong>.NET 6+</strong>.
         License <strong>MIT</strong> — free forever, for commercial and personal use.
       </p>
 
@@ -83,7 +83,7 @@ export default function Page() {
 
       <h2 id="thirty-second-tour">30-second tour</h2>
       <p>Install the package:</p>
-      <Code lang="bash">{`dotnet add package DynamicWhere.ex --version 3.1.0`}</Code>
+      <Code lang="bash">{`dotnet add package DynamicWhere.ex --version 3.2.0`}</Code>
 
       <p>Build a filter from a JSON body and apply it to a DbSet:</p>
       <Code lang="csharp">{`using DynamicWhere.ex.Source;
diff --git a/OfficialWebsite/app/docs/policies/admin/page.tsx b/OfficialWebsite/app/docs/policies/admin/page.tsx
index e087a85..bb4f0f5 100644
--- a/OfficialWebsite/app/docs/policies/admin/page.tsx
+++ b/OfficialWebsite/app/docs/policies/admin/page.tsx
@@ -15,7 +15,7 @@ export default function Page() {
   return (
     <DocPage pathname="/docs/policies/admin">
       <h1>Admin API</h1>
-      <Code lang="bash">{`dotnet add package DynamicWhere.ex.Policies.AspNetCore --version 3.1.0`}</Code>
+      <Code lang="bash">{`dotnet add package DynamicWhere.ex.Policies.AspNetCore --version 3.2.0`}</Code>
       <Code lang="csharp">{`app.MapDwPolicyAdmin(options =>
 {
     options.RoutePrefix  = "/dw-policies";    // the default; mount it anywhere
@@ -169,6 +169,20 @@ export default function Page() {
         <strong>nothing is audited</strong>, so an operator checking a rule does
         not fill the audit trail with reads that never happened.
       </p>
+      <p>
+        A simulation has no source, so it reads the type as a source it cannot
+        see into. That shows in a clause that sends no <code>Selects</code>:
+        every denial beneath a member counts, and the projection it shows keeps
+        only the members that hold a value, a collection of values included. A
+        guarded query keeps what its own source carries — over a projected row,
+        the objects its initializer assigns; over an entity, its columns, owned
+        and complex members, asking only about the denials whose value it
+        loads; over rows in memory, values only. So the simulated clause can
+        list fewer members than the query returns, and can show a projection
+        an entity query does not need. <code>PolicySimulator</code> reads a
+        type the same way. See{" "}
+        <Link href="/docs/policies/configuration#no-selects">A request that sends no Selects</Link>.
+      </p>
 
       <h2 id="claims">From a ClaimsPrincipal</h2>
       <Code lang="csharp">{`var caller = await httpContext.GetPolicyContextAsync(claimsOptions);
diff --git a/OfficialWebsite/app/docs/policies/attributes/page.tsx b/OfficialWebsite/app/docs/policies/attributes/page.tsx
index 15e1b2c..0365614 100644
--- a/OfficialWebsite/app/docs/policies/attributes/page.tsx
+++ b/OfficialWebsite/app/docs/policies/attributes/page.tsx
@@ -72,7 +72,8 @@ public class Ticket
           and <code>ToListAsyncDynamic</code> with a <code>Filter</code>, to{" "}
           <code>ToListAsync</code> with a <code>Segment</code>, to the composable{" "}
           <code>Filter</code> and <code>FilterDynamic</code>, and to the composable{" "}
-          <code>Page</code> on a source nothing has ordered or projected.
+          <code>Page</code> on a source nothing has ordered and whose projection
+          hides no field the default names.
         </li>
         <li>
           It never applies outside the guarded handle. A core method on a plain{" "}
@@ -89,7 +90,8 @@ public class Ticket
           <code>{`db.Tickets.OrderBy(t => t.Title).ApplyPolicy(caller)`}</code> — or
           an <code>Order</code> was composed on the guarded handle first, as in{" "}
           <code>{`guarded.Order(order).Page(page)`}</code> — even when the policy
-          dropped every order that call sent. An in-memory
+          dropped every order that call sent. Since 3.2.0 a <code>Filter</code>{" "}
+          composed on the handle with orders counts the same way. An in-memory
           sequence sorted before <code>ApplyPolicy</code> is not recognised as
           ordered, because it reaches the policy as a query with no{" "}
           <code>OrderBy</code> in it, so it takes the default; send that order with
@@ -98,14 +100,62 @@ public class Ticket
           <code>Order</code>.
         </li>
         <li>
-          A projected query takes no default. A <code>Select</code> anywhere in the
-          chain — the guarded <code>Select</code>, as in{" "}
-          <code>{`guarded.Select(fields).Page(page)`}</code>, or a projection made
-          before <code>ApplyPolicy</code> — leaves the query in its own order: a
-          default applied after a projection can name a field the projection left
-          out, which EF Core cannot translate.
+          A projection made before <code>ApplyPolicy</code> takes the default only
+          when it cannot hide a field the default names. Only the outermost{" "}
+          <code>Select</code> of the chain counts, because it makes the rows the
+          default orders. Since 3.2.0 it hides nothing when it builds{" "}
+          <code>T</code> itself in an object initializer and assigns every field
+          the default names a column, at every level of a nested path:{" "}
+          <code>&quot;Owner.Name&quot;</code> needs{" "}
+          <code>{`Owner = new OwnerRow { Name = … }`}</code>. On EF Core a column
+          is a member the model maps on the entity the <code>Select</code> reads,
+          read directly (<code>t.Code</code>), through reference navigations
+          (<code>t.Owner.Name</code>) or through <code>EF.Property</code>, a
+          shadow property included; in memory any assigned field is one. EF Core
+          then translates the order. A projection over an anonymous or other
+          intermediate row reads no entity, so it takes no default.
+        </li>
+        <li>
+          Any other projection leaves the query in its own order, as every
+          projection did in 3.1.0: a constructor with arguments, a default field
+          the initializer does not assign, a nested path through anything but an
+          initializer, a member the model does not map, or a default field the
+          projection computes, by the application&apos;s own method{" "}
+          (<code>{`Label = Decorate(r.Code)`}</code>), a framework one such as{" "}
+          <code>Regex.Replace</code> or <code>ToUpper</code>, or an operator. EF
+          Core evaluates some of these on the client, where it can project the
+          value but cannot order by it, and which ones it translates depends on
+          the provider, so none is ordered by: a default must never be the reason
+          a query that ran unguarded fails.
+        </li>
+        <li>
+          A projection composed on the guarded handle takes no default, even when
+          it keeps every field the default names. The guarded{" "}
+          <code>Select</code>, as in{" "}
+          <code>{`guarded.Select(fields).Page(page)`}</code>, and a guarded{" "}
+          <code>Filter</code> whose <code>Selects</code> is set leave the rest of
+          the chain unordered. The default is for the rows the caller&apos;s
+          source makes.
         </li>
       </ul>
+      <Code lang="csharp">{`[DwEntity(RequirePolicy = true, DefaultOrder = "CreatedAt desc, Id")]
+public class TicketRow
+{
+    public int Id { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public string Title { get; set; } = string.Empty;
+}
+
+// Takes the default: the initializer builds TicketRow and assigns CreatedAt and Id.
+var ordered = db.Tickets
+    .Select(t => new TicketRow { Id = t.Id, CreatedAt = t.CreatedAt, Title = t.Title })
+    .ApplyPolicy(caller);
+
+// Keeps its own order: CreatedAt is not assigned, so the default could name
+// a member these rows do not carry.
+var unordered = db.Tickets
+    .Select(t => new TicketRow { Id = t.Id, Title = t.Title })
+    .ApplyPolicy(caller);`}</Code>
       <p>
         The default is gated like any order. A field in it that this caller may not
         order by is left out — never refused, because the caller did not send it —
@@ -176,6 +226,26 @@ public class Ticket
 // and cannot sweep for one it does not.
 [DwOperators(Allow = new[] { Operator.Equal, Operator.In })]
 public string EmployeeCode { get; set; }`}</Code>
+      <Callout tone="note" title="A denial for Select reaches a request that names nothing">
+        A request that sends no <code>Selects</code> would return the whole row.
+        So a field denied for <code>Select</code> — at the top of the type, or
+        beneath a member where its value can reach the result — makes a guarded
+        query project the allowed members instead. See{" "}
+        <Link href="/docs/policies/configuration#no-selects">A request that sends no Selects</Link>.
+      </Callout>
+      <Callout tone="note" title="A denial on an override or an implementation (3.2.0)">
+        An access-control attribute on another declaration of a member applies
+        to its path too: on the interface member a class or its subtype
+        implements with it, on an override of either accessor a subtype
+        declares, on a public member a subtype hides with <code>new</code>, and
+        on the implementation a type gives an interface member, explicit,
+        inherited or declared by an open generic class, through a variant
+        instantiation too. A row read through the base type or
+        the interface is still that subtype, so the denial holds for the path on
+        every row, in every clause. Until 3.2.0 only the declaration walked, and
+        the attributes above it, were read. The other attributes are still read
+        from the declaration walked only.
+      </Callout>
 
       <h2 id="injection">Injection</h2>
       <table>
diff --git a/OfficialWebsite/app/docs/policies/configuration/page.tsx b/OfficialWebsite/app/docs/policies/configuration/page.tsx
index 4377193..8867c36 100644
--- a/OfficialWebsite/app/docs/policies/configuration/page.tsx
+++ b/OfficialWebsite/app/docs/policies/configuration/page.tsx
@@ -6,7 +6,7 @@ import Callout from "@/components/Callout";
 
 export const metadata: Metadata = {
   title: "Policy Configuration — options, caps, tiers and defaults",
-  description: "Every DynamicWhere.ex policy option and cap with its default: tiers, dry run, the trace on a result, refusal auditing, hash salt, store failure modes, query cost budget, MinGroupSize, plus startup validation and the twenty-two error codes.",
+  description: "Every DynamicWhere.ex policy option and cap with its default: tiers, what a denied field does to a projection, dry run, the trace on a result, refusal auditing, hash salt, store failure modes, query cost budget, MinGroupSize, plus startup validation and the twenty-two error codes.",
   keywords: ["DwPolicyOptions", "DwCaps", "MaxQueryCost", "MinGroupSize", "policy configuration"],
   alternates: { canonical: "https://doc.dynamicwhere.com/docs/policies/configuration/" },
 };
@@ -64,6 +64,400 @@ export default function Page() {
         <code>IncludeTraceInResult</code> is <code>false</code>.
       </p>
 
+      <h2 id="navigation-selects">A navigation named in Selects</h2>
+      <p>
+        A <code>Selects</code> entry can name a navigation, such as{" "}
+        <code>&quot;Lines&quot;</code>, rather than the fields beneath it. With
+        nothing denied beneath it, the entry is kept as written. With a denied
+        field beneath it, the <code>Convenience</code> tier replaces the entry
+        with the allowed fields beneath it, and the <code>Strict</code> tier
+        refuses it.
+      </p>
+      <table>
+        <thead><tr><th><code>Selects</code> names a navigation</th><th><code>Convenience</code></th><th><code>Strict</code></th></tr></thead>
+        <tbody>
+          <tr><td>with nothing denied beneath it</td><td>Kept whole, or narrowed around a transform that lands on a property with no setter (3.2.0)</td><td>Kept whole, or narrowed the same way</td></tr>
+          <tr><td>with a denied field beneath it</td><td>Replaced by the allowed fields beneath it</td><td><code>FieldDeniedForSelect</code></td></tr>
+          <tr><td>whose key, <code>Lines.Id</code>, is denied (3.2.0)</td><td><code>FieldDeniedForSelect</code></td><td><code>FieldDeniedForSelect</code></td></tr>
+          <tr><td>with a denied field beneath it, where the narrowing cannot be built (3.2.0)</td><td><code>FieldDeniedForSelect</code></td><td><code>FieldDeniedForSelect</code></td></tr>
+          <tr><td>that can carry a field denied for <code>Select</code> that no path names: past four segments, in a framework generic, on a subtype, or unasked under a <code>&quot;*&quot;</code> deny (3.2.0)</td><td>Narrowed to the allowed fields where the core can narrow it; <code>FieldDeniedForSelect</code> where it cannot</td><td><code>FieldDeniedForSelect</code></td></tr>
+        </tbody>
+      </table>
+      <ul>
+        <li>
+          The fields beneath a member are read the way the attribute walker
+          reads them: through any collection type, and no deeper than its four
+          segments. Since 3.2.0 a member typed{" "}
+          <code>IReadOnlyList&lt;T&gt;</code>,{" "}
+          <code>IReadOnlyCollection&lt;T&gt;</code>,{" "}
+          <code>Collection&lt;T&gt;</code> or an application&apos;s own
+          collection no longer hides the denials beneath it. The providers&apos;
+          own rules are asked too, so a denied property with no setter and a
+          rule on a path reached through a cycle count.
+        </li>
+        <li>
+          A narrowing that cannot be built as it was gated is refused in both
+          tiers (3.2.0). The core&apos;s typed projection adds the key,{" "}
+          <code>Id</code>, of every nested node it builds, so a navigation
+          narrowed around its own denied key would get the key back. The core
+          reads a path only through an array, <code>List&lt;T&gt;</code>,{" "}
+          <code>IList&lt;T&gt;</code>, <code>ICollection&lt;T&gt;</code>,{" "}
+          <code>IEnumerable&lt;T&gt;</code>, <code>HashSet&lt;T&gt;</code> or{" "}
+          <code>ISet&lt;T&gt;</code>, so a narrowing through any other
+          collection fails its validation. And some members cannot be narrowed
+          at all: a column, a complex property or a member stored as JSON, which
+          EF Core reads whole; a member of a row in memory; and a member a
+          projection builds some way the core cannot narrow.
+        </li>
+        <li>
+          A named member can also carry a field denied for <code>Select</code>{" "}
+          that no path names (3.2.0): one deeper than four segments, one inside a
+          framework generic such as <code>Dictionary&lt;string, T&gt;</code>, or
+          one a subtype of the member&apos;s type declares — a derived entity, a
+          subclass, an interface&apos;s implementation. What it can carry is read
+          from the source. On an entity it is read from the EF Core model, so
+          only what loads counts: the navigation&apos;s columns, a converted one
+          included, its owned chain at any depth, the navigations beneath it an
+          include, an automatic include or a lazy loader fills, and each member
+          the model does not map, read as its type, since its getter can hand
+          out what EF Core loaded — for its type and every type the model
+          derives from it. On a projected row it is the type the initializer
+          constructs the member as, when it says, and otherwise the
+          member&apos;s type and every loaded subtype of it, as on a row in
+          memory. Under a policy with a <code>&quot;*&quot;</code> deny, a path the
+          walk never asks about — past four segments, with no setter, or on a
+          subtype — is a denied one unless the policy names it; around a cycle it
+          always is. The <code>Strict</code> tier refuses
+          such a member. The <code>Convenience</code> tier narrows it where the
+          core can, which builds the declared type and so drops a subtype&apos;s
+          fields; a path naming a framework generic itself narrows to nothing and
+          is dropped. Where the core cannot narrow it — a column at the top of{" "}
+          <code>T</code>, a member of a row in memory — both tiers refuse it.
+        </li>
+        <li>
+          A navigation named through another, <code>Main.Lead</code>, gates the
+          key of every node it passes through, which the core&apos;s projection
+          adds, as a dotted path to a value always did (3.2.0). A denied key
+          refuses the projection. Naming a field beside a denied key,{" "}
+          <code>Lines.Name</code> when <code>Lines.Id</code> is denied, was
+          already refused in both tiers.
+        </li>
+        <li>
+          Under <code>Convenience</code> the refusal names the denied key, the
+          first denied field beneath the member, or, for a denial no path names,
+          the member itself. Under <code>Strict</code> its{" "}
+          <code>FieldPath</code> is <code>&quot;*&quot;</code>, as on every field
+          refusal. The trace records the reason either way.
+        </li>
+      </ul>
+
+      <h2 id="no-selects">A request that sends no Selects</h2>
+      <p>
+        A request that sends no <code>Selects</code> returns whole rows, denied
+        fields included, because the core projects only when{" "}
+        <code>Selects</code> is set. So when a field denied for{" "}
+        <code>Select</code> could reach the result, a guarded query synthesizes
+        the projection itself. It does so in both tiers, typed and dynamic, for
+        a whole <code>Filter</code> and for a <code>Segment</code>. A clause
+        composed on its own, such as <code>Where</code>, <code>Order</code> or{" "}
+        <code>Page</code>, synthesizes nothing.
+      </p>
+      <p>
+        The projection keeps the <strong>allowed members</strong>: what an
+        unguarded call would return, less what the policy withholds. Before
+        3.2.0 it kept the allowed scalars only, and only a simple field denied
+        at the top of the type asked for it — see{" "}
+        <Link href="/docs/breaking-changes#synthesized-projection">breaking changes</Link>.
+      </p>
+
+      <h3 id="no-selects-when">When a projection is needed</h3>
+      <ul>
+        <li>
+          A field denied at the top of <code>T</code> always asks for one,
+          whatever it holds: a scalar, a blob, a list, an owned object or a JSON
+          column.
+        </li>
+        <li>
+          A field denied beneath a member asks for one when its value can reach
+          the result. On an entity, that is beneath a column, an owned or
+          complex member, or a navigation something loads: an{" "}
+          <code>Include</code> or <code>ThenInclude</code> on the query, an
+          automatic include, or a lazy loader — EF Core&apos;s proxies, an
+          injected <code>ILazyLoader</code>, a loader delegate or{" "}
+          <code>ILazyLoader</code> the constructor takes and keeps in a field or
+          any property, the asynchronous loader delegate of EF Core 7, or an
+          injected <code>DbContext</code> — which fills a navigation after the
+          query. On a row a projection builds, it is beneath a member the
+          initializer assigns; a constructor with arguments counts every member
+          as assigned, and an initializer after it still says what its own
+          bindings hold. On a row in memory, it is beneath any member. A rule may
+          spell the path in any letter case.
+        </li>
+        <li>
+          Every navigation counts as loaded where the library cannot read which
+          the query loads: an <code>Include</code> in a form it cannot read, one
+          off the query&apos;s own chain, and a chain that reaches its rows
+          through anything but the root&apos;s own rows —{" "}
+          <code>{`Select(o => o.Customer)`}</code>, a <code>SelectMany</code>, a{" "}
+          <code>Join</code>, a <code>GroupBy</code> — when it also has an
+          include, which EF Core applies from the root to the entities it
+          reaches, or when one of its lambdas hands its rows an object: one it
+          builds, as a projection behind an identity <code>Select</code>, or an
+          object built inside an anonymous row or a conditional, does; one an
+          application&apos;s method returns from what the lambda gives it; or
+          one it captured, another query with its own include or projection, or
+          an object in memory. A call that reads nothing of the lambda&apos;s and
+          returns a query or an expression (a specification, a repository&apos;s
+          query, <code>FromSql</code>) is evaluated as EF Core evaluates it, and
+          what it returns is read; a context&apos;s own query function is a query
+          root; an anonymous object that only carries what the rows hold, range
+          variables or a composite key, builds nothing; and what only feeds a
+          predicate or a key is a value. Such a chain with none of these is read
+          from the model.
+        </li>
+        <li>
+          A denial beneath a navigation nothing loads never leaves the database,
+          so it asks for no projection. An entity whose only denials sit beneath
+          such navigations is read as it was in 3.1.0.
+        </li>
+        <li>
+          A member whose value can hold a field denied for <code>Select</code>{" "}
+          that no path names — deeper than the walker&apos;s four segments,
+          inside a framework generic such as{" "}
+          <code>Dictionary&lt;string, T&gt;</code>, or declared by a subtype of
+          its type — asks for one too, read as for a named member, so on an
+          entity only what loads counts. Under a{" "}
+          <code>&quot;*&quot;</code> deny, so does a member whose value can hold a
+          path the walk never asks about and the policy does not name.
+        </li>
+        <li>
+          A member that can hold an object of any type — one typed{" "}
+          <code>object</code>, a framework interface such as{" "}
+          <code>IComparable</code>, or a collection that is not generic, such
+          as <code>IEnumerable</code>, <code>ArrayList</code> or an
+          application&apos;s own — asks for nothing on its own: the policy cannot
+          see into it whether or not a projection is built.
+        </li>
+        <li>
+          A row can be a subtype of <code>T</code>. On an entity, a member a type
+          the model derives from <code>T</code> declares, and what loads beneath
+          it, counts as one of <code>T</code>&apos;s own would; on a row in memory,
+          a member any loaded subtype declares does; on a row a projection
+          builds, a member the type its initializer constructs declares below{" "}
+          <code>T</code>. The projection builds <code>T</code> and leaves them
+          out, recorded with a reason starting{" "}
+          <code>left out: a type derived</code>. A subtype is any type loaded
+          outside the framework&apos;s assemblies that derives from the type or
+          implements it, an open generic one and an application&apos;s subclass
+          of <code>Exception</code> included; a rule on a path through a
+          subtype&apos;s member counts as a rule on the declared type&apos;s own
+          path does.
+        </li>
+        <li>
+          A member EF Core does not map counts as loaded: its getter can hand out
+          a mapped field or a private navigation, so its type is read whole.
+        </li>
+        <li>
+          The denials beneath a member come from the providers&apos; rules as
+          well as from walking the type, so a denied property with no setter, a
+          rule on a path reached through a cycle, and a rule deeper than the
+          walk all count.
+        </li>
+        <li>
+          A forced scope beneath a member asks for no projection on its own. It
+          filters the rows that hold the member, as it always has. When a
+          projection is needed anyway, the member is left out whole.
+        </li>
+      </ul>
+
+      <h3 id="no-selects-kept">What it keeps</h3>
+      <p>
+        A member holding a value — a simple type, or a collection of one such as{" "}
+        <code>byte[]</code>, <code>string[]</code> or{" "}
+        <code>List&lt;string&gt;</code> — is kept when it is allowed and the
+        source carries it. A member holding an object, or a list of them, is
+        kept whole, narrowed or left out whole, as below, and only where the
+        source carries it:
+      </p>
+      <table>
+        <thead><tr><th>Source</th><th>Values kept</th><th>Objects kept</th></tr></thead>
+        <tbody>
+          <tr>
+            <td>A projection that builds its rows before <code>ApplyPolicy</code>: the outermost <code>Select</code> constructs the row, in an object initializer or with a constructor, as in <code>{`db.Roles.Select(r => new RoleRow { … })`}</code></td>
+            <td>Every member the initializer assigns; every member when a constructor with arguments builds the row, with or without an initializer after it</td>
+            <td>The same</td>
+          </tr>
+          <tr>
+            <td>An entity query, or a <code>Select</code> that hands back an entity, as in <code>{`db.Orders.Select(o => o.Customer)`}</code></td>
+            <td>Every member EF Core maps</td>
+            <td>Its columns, converted and JSON ones included, its owned members and, on EF Core 8 or later, its complex properties, read from the EF Core model; a converted value that can hold an object of any type is left out</td>
+          </tr>
+          <tr>
+            <td>Rows in memory, as in <code>roles.ApplyPolicy(caller)</code></td>
+            <td>Every member</td>
+            <td>None</td>
+          </tr>
+        </tbody>
+      </table>
+      <p>
+        A value EF Core does not map is left out: computing it would make EF
+        Core read the whole entity, the denied columns included, and it holds
+        only its initial value anyway. A source the library cannot read — no EF
+        Core model, and neither a projection it can see into nor rows in memory
+        — keeps values only, as in 3.1.0, and every denial beneath a member
+        counts.
+      </p>
+
+      <h3 id="no-selects-whole">Whole, narrowed or left out whole</h3>
+      <p>A member holding an object that the source carries is:</p>
+      <ul>
+        <li>
+          <strong>kept whole</strong> when nothing beneath it is denied, nothing
+          its value can hold is denied (its subtypes included), it cannot hold an
+          object of any type (asked of a projected row, a row in memory, and an
+          entity&apos;s column a value converter hands back, directly or inside a
+          complex property: what EF Core materializes itself never holds one),
+          under a{" "}
+          <code>&quot;*&quot;</code> deny every path beneath it the walk skips is
+          one the policy names, no forced scope is beneath it, and no transform
+          beneath it lands on a property with no setter;
+        </li>
+        <li>
+          <strong>narrowed</strong> otherwise, to the allowed fields beneath it,
+          four segments deep, as a caller naming it would get it, where the
+          core&apos;s narrowing translates: an object the projection&apos;s
+          initializer builds, a list a subquery reads into a type the core can
+          bind (not an array or a set), a navigation that is neither complex nor
+          stored as JSON, or an entity&apos;s owned member not stored as JSON.
+          The narrowing builds the declared type, so a subtype&apos;s fields are
+          dropped. A field beneath it that can hold what the policy cannot name
+          is left out;
+        </li>
+        <li>
+          <strong>left out whole</strong> otherwise, and recorded as{" "}
+          <code>Dropped</code> on <code>Select</code> with a reason that starts{" "}
+          <code>left out whole</code>.
+        </li>
+      </ul>
+      <Code lang="text">{`left out whole: a scope forced beneath it cannot be applied to what it holds
+left out whole: it is a column, which EF Core reads whole
+left out whole: it is a complex property, which EF Core cannot narrow
+left out whole: it is stored as JSON, which EF Core cannot narrow
+left out whole: the projection builds it in a way the core cannot narrow
+left out whole: the projection would add its key 'Contents.Id', which is denied
+left out whole: the core cannot project 'Contents.Code'
+left out whole: the core cannot build 'IContact', which it narrows into
+left out whole: nothing beneath it may be selected
+left out whole: it can hold what the policy cannot name`}</Code>
+      <p>
+        The last one is recorded on the field beneath the member that the
+        narrowing leaves out.
+      </p>
+
+      <h3 id="no-selects-never">Never kept</h3>
+      <ul>
+        <li>
+          An entity&apos;s navigation, included or not: projecting it would load
+          it. So once a denial needs a projection, an included or automatically
+          included navigation is not returned, and the trace records it as{" "}
+          <code>Dropped</code> with a reason starting <code>left out:</code>.
+          Under <code>Convenience</code>, name it in <code>Selects</code> to get
+          it narrowed; under <code>Strict</code>, name its allowed fields.
+        </li>
+        <li>
+          An object held by a row in memory: a kept object is the caller&apos;s
+          own, and a transform beneath it would change it in place. The
+          projection&apos;s rows are new and hold no member of an object type,
+          so the source objects are left as they were.
+        </li>
+        <li>
+          A member with no setter, and a member named with one of the
+          expression parser&apos;s own words.
+        </li>
+      </ul>
+
+      <h3 id="no-selects-other">Other rules</h3>
+      <ul>
+        <li>
+          A narrowed reference that is null in the source comes back as an empty
+          object, as it does for a caller&apos;s own dotted{" "}
+          <code>Selects</code>.
+        </li>
+        <li>
+          A narrowed member carries every allowed field beneath it. An entity
+          reached beneath it therefore has its own navigations projected, and so
+          loaded, whether or not the source included them, exactly as when{" "}
+          <code>Selects</code> names the member.
+        </li>
+        <li>
+          Each denied field whose value can reach the result, at the top or
+          beneath, is recorded as <code>Dropped</code> on <code>Select</code>.
+        </li>
+        <li>
+          It never throws for a denied field, in either tier. It throws{" "}
+          <code>AllSelectsDenied</code> only when no field is left. When nothing
+          asks for a projection, <code>Selects</code> stays null and the query is
+          the one an unguarded call runs.
+        </li>
+        <li>
+          A typed query projects into <code>T</code>, so <code>T</code> needs a
+          public parameterless constructor, or the query fails with{" "}
+          <code>SelectTypeMustHaveParameterlessConstructor</code>. The dynamic
+          terminals do not need one.
+        </li>
+        <li>
+          A dry run synthesizes nothing. It records the denials and returns the
+          rows whole.
+        </li>
+        <li>
+          A simulation has no source, so it reads <code>T</code> as a source it
+          cannot see into: every denial beneath a member counts, and the
+          projection it shows keeps only members holding a value — see{" "}
+          <Link href="/docs/policies/admin#simulate">Simulate</Link>.
+        </li>
+      </ul>
+      <Callout tone="warn" title="What the policy cannot see into">
+        A member typed <code>object</code>, a framework interface or a
+        collection that is not generic, such as <code>IEnumerable</code>,{" "}
+        <code>ArrayList</code> or an application&apos;s own, is opaque to the
+        policy. It never asks for a projection; when one is needed anyway, a
+        projected row, a row in memory, and an entity&apos;s converted column
+        leave it out, and an entity&apos;s other columns keep it;
+        and naming it returns whatever it holds. A converter returning an
+        application type through a column typed <code>object</code> is opaque
+        the same way, so type the member as what it holds.{" "}
+        <code>BitArray</code> and the framework&apos;s string collections hold
+        values. An application&apos;s own collection class, generic or not,
+        still has its own members read, and a collection of values stays a
+        value unless one of them is denied. Two members sharing a name are left
+        out when either holds a denial. A framework generic holding a
+        policed type, such as <code>Dictionary&lt;string, LineDto&gt;</code>, has
+        no paths beneath it: naming it is refused in both tiers where the core
+        cannot narrow it, narrowed away under <code>Convenience</code> beneath a
+        navigation, and a synthesized projection leaves it out. Hold such values
+        in a list of the policed type instead.
+      </Callout>
+      <Callout tone="warn" title="A projection builds the declared type">
+        A query over the root of a hierarchy whose derived type declares a
+        denied field comes back as root-type rows, the derived types&apos;
+        allowed fields dropped too. Over an abstract root the typed terminals
+        fail with <code>SelectTypeMustHaveParameterlessConstructor</code>, and
+        the dynamic ones return the root&apos;s members. Query the derived type,{" "}
+        <code>{`OfType<Company>()`}</code>, to keep its fields. Rows in memory
+        can be any loaded subtype, and the policy does not look at the rows:
+        when a subtype declares a denied field, they are projected and their
+        objects left out, even if no row is that subtype. Under a{" "}
+        <code>&quot;*&quot;</code> deny, a member is kept whole only when every
+        path beneath it the walk skips is one the policy names.
+      </Callout>
+      <Callout tone="warn" title="A forced scope on a list's element type filters rows, not elements">
+        A forced scope declared on a list&apos;s element type filters the rows
+        that hold the list, never its elements. <code>Selects</code> naming the
+        list returns every element, those the scope excludes included, as in
+        every release; a synthesized projection leaves such a list out. Scope
+        the elements where the row is built.
+      </Callout>
+
       <h2 id="trace">The trace on a result</h2>
       <p>
         Every guarded query records a <code>PolicyTrace</code>: what the policy
diff --git a/OfficialWebsite/app/docs/policies/page.tsx b/OfficialWebsite/app/docs/policies/page.tsx
index ef2ef98..eb6b86e 100644
--- a/OfficialWebsite/app/docs/policies/page.tsx
+++ b/OfficialWebsite/app/docs/policies/page.tsx
@@ -95,6 +95,45 @@ public class Employee
     public JsonDocument? WorkSchedule { get; set; }
 }`}</Code>
 
+      <h2 id="handle">The guarded handle</h2>
+      <p>
+        <code>ApplyPolicy</code> returns a <code>PolicyQueryable&lt;T&gt;</code>.
+        Its terminals mirror the core&apos;s: <code>ToList</code>,{" "}
+        <code>ToListAsync</code>, <code>ToListDynamic</code> and{" "}
+        <code>ToListAsyncDynamic</code> with a <code>Filter</code>,{" "}
+        <code>ToList</code> and <code>ToListAsync</code> with a{" "}
+        <code>Summary</code>, and <code>ToListAsync</code> with a{" "}
+        <code>Segment</code>. Each one sanitizes the request, runs it, and
+        transforms the rows.
+      </p>
+      <p>
+        Since 3.2.0 every asynchronous terminal on the handle also has
+        overloads that take a <code>CancellationToken</code>, as the{" "}
+        <Link href="/docs/extensions#materialization">core&apos;s do</Link>. The
+        policy is applied first, so a refusal is thrown whatever the token
+        says. The token then reaches the count and the read. The overloads sit
+        beside the 3.1 signatures, which are unchanged.
+      </p>
+      <Code lang="csharp">{`// PolicyQueryable<T>: new in 3.2.0, beside the overloads without a token
+Task<FilterResult<T>>       ToListAsync(Filter filter, CancellationToken cancellationToken)
+Task<FilterResult<T>>       ToListAsync(Filter filter, bool getQueryString, CancellationToken cancellationToken)
+Task<FilterResult<dynamic>> ToListAsyncDynamic(Filter filter, CancellationToken cancellationToken)
+Task<FilterResult<dynamic>> ToListAsyncDynamic(Filter filter, bool getQueryString, CancellationToken cancellationToken)
+Task<SummaryResult>         ToListAsync(Summary summary, CancellationToken cancellationToken)
+Task<SummaryResult>         ToListAsync(Summary summary, bool getQueryString, CancellationToken cancellationToken)
+Task<SegmentResult<T>>      ToListAsync(Segment segment, CancellationToken cancellationToken)`}</Code>
+      <Code lang="csharp">{`// In a minimal API, a CancellationToken parameter is the request's own:
+// a client that disconnects cancels the count or the read.
+var result = await db.Employees.ApplyPolicy(caller).ToListAsync(filter, cancellationToken);`}</Code>
+      <Callout tone="warn" title="ToListAsync(filter, default) does not compile">
+        <code>default</code> fits both <code>bool getQueryString</code> and{" "}
+        <code>CancellationToken</code>, on the handle as on the core, so the
+        call is ambiguous. The same goes for{" "}
+        <code>ToListAsyncDynamic(filter, default)</code> and{" "}
+        <code>ToListAsync(summary, default)</code>. Write <code>false</code>, a
+        token, or a named argument.
+      </Callout>
+
       <h2 id="features">Six features, per field</h2>
       <p>
         Every decision is made for one field and one feature:{" "}
diff --git a/OfficialWebsite/app/docs/policies/providers/page.tsx b/OfficialWebsite/app/docs/policies/providers/page.tsx
index ba2f1d9..1cdead2 100644
--- a/OfficialWebsite/app/docs/policies/providers/page.tsx
+++ b/OfficialWebsite/app/docs/policies/providers/page.tsx
@@ -22,7 +22,7 @@ export default function Page() {
       </p>
 
       <h2 id="redis">Redis</h2>
-      <Code lang="bash">{`dotnet add package DynamicWhere.ex.Policies.Redis --version 3.1.0`}</Code>
+      <Code lang="bash">{`dotnet add package DynamicWhere.ex.Policies.Redis --version 3.2.0`}</Code>
       <Code lang="csharp">{`var redis = await ConnectionMultiplexer.ConnectAsync(connectionString);
 var store = new RedisPolicyStore(redis);
 
@@ -37,7 +37,7 @@ DwPolicy.Configure(options, provider);`}</Code>
       </Callout>
 
       <h2 id="ef">Entity Framework Core</h2>
-      <Code lang="bash">{`dotnet add package DynamicWhere.ex.Policies.EntityFrameworkCore --version 3.1.0`}</Code>
+      <Code lang="bash">{`dotnet add package DynamicWhere.ex.Policies.EntityFrameworkCore --version 3.2.0`}</Code>
       <Code lang="csharp">{`var policyDbOptions = new DbContextOptionsBuilder<DwPolicyDbContext>()
     .UseNpgsql(connection, sql => sql.MigrationsAssembly("YourProject"))
     .Options;
diff --git a/OfficialWebsite/app/docs/policies/security/page.tsx b/OfficialWebsite/app/docs/policies/security/page.tsx
index ef0580a..40fbf3d 100644
--- a/OfficialWebsite/app/docs/policies/security/page.tsx
+++ b/OfficialWebsite/app/docs/policies/security/page.tsx
@@ -6,7 +6,7 @@ import Callout from "@/components/Callout";
 
 export const metadata: Metadata = {
   title: "Security & k-anonymity — the eight inference channels",
-  description: "How DynamicWhere.ex closes the disclosure channels no per-field rule closes on its own: set-operation reconstruction, singleton-group aggregates, cardinality probes, sort-and-page binary search, SQL leakage, and schema probing through refusals.",
+  description: "How DynamicWhere.ex closes the disclosure channels no per-field rule closes on its own — set-operation reconstruction, singleton-group aggregates, cardinality probes, sort-and-page binary search, SQL leakage, and schema probing through refusals — and the denials the gate could not see until 3.2.0.",
   keywords: ["k-anonymity", "MinGroupSize", "inference attack", "data disclosure", "aggregate disclosure", "EF Core security"],
   alternates: { canonical: "https://doc.dynamicwhere.com/docs/policies/security/" },
 };
@@ -18,8 +18,9 @@ export default function Page() {
       <p>
         Denying a field is easy. The hard part is the set of ways a caller can
         learn a value <em>without</em> reading it. Six such channels follow, then
-        two bypasses that are not channels; each has a test that reproduces the
-        attack and goes red if the control is removed.
+        two bypasses that are not channels, then the requests that, until
+        3.2.0, carried out a denied value the gate could not see; each has a
+        test that reproduces the attack and goes red if the control is removed.
       </p>
 
       <Callout tone="warn" title="MinGroupSize ships on, at 5">
@@ -198,6 +199,172 @@ true order. Add [DwNoOrder] unless that is intended.`}</Code>
         </tbody>
       </table>
 
+      <h2 id="beneath">Denials the gate could not see</h2>
+      <p>
+        A denied field often sits on a type the query reaches through a member:
+        a secret on each line of an order, a code inside a nested object. The
+        denial holds on every path that reaches it, and it has to hold whether
+        or not the caller names the member. Until 3.2.0 each request below
+        carried a denied value out. All are closed.
+      </p>
+      <table>
+        <thead><tr><th>Attack</th><th>Control</th></tr></thead>
+        <tbody>
+          <tr>
+            <td>Send no <code>Selects</code>, on a type whose only denied fields sit beneath a member</td>
+            <td>
+              A guarded query synthesizes a projection whenever the denied value
+              can reach the result, and narrows the member around it or leaves
+              the member out. Only a simple field denied at the top of{" "}
+              <code>T</code> used to synthesize one, so the whole row came back
+              with the denied value in it: in a list or nested object of a row
+              projected before <code>ApplyPolicy</code>, in a row held in memory,
+              and in an entity&apos;s included, automatically included, lazily
+              loaded or owned member — in both tiers. A denial beneath a
+              navigation nothing loads never leaves the database, so it asks for
+              nothing. See{" "}
+              <Link href="/docs/policies/configuration#no-selects">A request that sends no Selects</Link>.
+            </td>
+          </tr>
+          <tr>
+            <td>Send no <code>Selects</code>, on a type whose denied field holds no simple value: a blob, a list, an owned object, a JSON column</td>
+            <td>
+              A field denied at the top of <code>T</code> asks for the projection
+              whatever it holds. Such a field used to be passed over, so with
+              nothing else denied the whole row came back with it.
+            </td>
+          </tr>
+          <tr>
+            <td>Name a navigation whose key, <code>Id</code>, is denied</td>
+            <td>
+              Refused with <code>FieldDeniedForSelect</code> in both tiers. The
+              core&apos;s typed projection adds the key of every nested node it
+              builds, so the convenience tier used to narrow the key away and
+              get it back. A navigation named through another,{" "}
+              <code>Main.Lead</code>, now gates the key of <code>Main</code> as
+              well, which the projection adds.
+            </td>
+          </tr>
+          <tr>
+            <td>Name a member typed <code>IReadOnlyList&lt;T&gt;</code>, or another collection the core does not unwrap, with a denied field beneath it</td>
+            <td>
+              Refused with <code>FieldDeniedForSelect</code> in both tiers. The
+              projection gate now reads collections the way the attribute walker
+              does. It used to read them through a narrower list, found nothing
+              beneath such a member, and returned every field, the denied ones
+              included, in both tiers.
+            </td>
+          </tr>
+          <tr>
+            <td>Name a member that carries a denied field no path reaches: deeper than four segments, inside a framework generic such as <code>Dictionary&lt;string, T&gt;</code>, or, on an entity&apos;s navigation, in its owned chain or a converted column</td>
+            <td>
+              Refused under <code>Strict</code>. Under <code>Convenience</code> it
+              is narrowed where the core can narrow it and refused where it
+              cannot. What the member carries is read from the source — from the
+              EF Core model for an entity, so only what loads counts. The gate
+              also reads the rules themselves, so a denied property with no
+              setter and a rule on a path reached through a cycle are found
+              beneath a named member too.
+            </td>
+          </tr>
+          <tr>
+            <td>Include a navigation from the root, then reach the rows through it — <code>{`Select(o => o.Customer)`}</code>, <code>SelectMany</code>, <code>Join</code> — or hide a projection behind another <code>Select</code></td>
+            <td>
+              Every navigation counts as loaded on such a chain, since EF Core
+              still applies includes named from the root to the entities it
+              reaches, and the library cannot read which. The includes used to be
+              read against the wrong root, so the denied value beneath them was
+              returned.
+            </td>
+          </tr>
+          <tr>
+            <td>Let a lazy loader fill a navigation after the query: a loader delegate or <code>ILazyLoader</code> the constructor takes, kept in a field or a property of any name</td>
+            <td>
+              Counts as loading every navigation, as EF Core&apos;s proxies and an
+              injected <code>ILazyLoader</code> property already did. The model
+              keeps no record of such a loader, so the navigation it filled came
+              back with the denied value.
+            </td>
+          </tr>
+          <tr>
+            <td>Declare the denied field on a subtype — a derived entity, a subclass, an interface&apos;s implementation — and read it through the base type: a query over the hierarchy&apos;s root, or a member declared as the base type</td>
+            <td>
+              The subtypes are read too: the types the EF Core model derives for
+              an entity, and for a projected or in-memory row every loaded
+              subtype, an open generic one and an application&apos;s subclass of a
+              framework class such as <code>Exception</code> included. Such rows
+              are projected to <code>T</code> and such members narrowed to the
+              declared type; a named one is refused under <code>Strict</code>. A
+              projection constructing a subtype of <code>T</code> is read as it,
+              and a rule on a subtype&apos;s field through a base-typed member is
+              enforced. The policy used to read the declared type only.
+            </td>
+          </tr>
+          <tr>
+            <td>Put the <code>[DwDenied]</code> on an override, on a public member a subtype hides with <code>new</code>, or on a class&apos;s implementation of an interface member, and read the member through the base type or the interface, a variant instantiation of it included</td>
+            <td>
+              The denial applies to the path for every row, in every clause. The
+              attribute walker read the declaration it walked and the attributes
+              above it, never an override, a hiding member or an implementation
+              below, so the base path filtered, sorted, grouped and returned the
+              value.
+            </td>
+          </tr>
+          <tr>
+            <td>Guard a query through a provider that wraps EF Core&apos;s, as LinqKit&apos;s <code>AsExpandable</code> or DelegateDecompiler&apos;s <code>Decompile</code> do</td>
+            <td>
+              The query runs untracked. EF Core&apos;s <code>AsNoTracking</code>{" "}
+              hands such a query back unchanged, so it tracked: the context filled
+              in navigations it already held, the denied ones included, and a
+              masked value became a pending change the next{" "}
+              <code>SaveChanges</code> would write. The call now goes into the
+              query itself.
+            </td>
+          </tr>
+          <tr>
+            <td>Under a <code>&quot;*&quot;</code> deny with exact allows, reach a path the walk never asks about: past four segments, around a cycle, a property with no setter</td>
+            <td>
+              Such a path is denied, so a member holding one is narrowed, left out
+              or refused. It used to resolve as allowed, so the member was
+              returned whole, named or not.
+            </td>
+          </tr>
+          <tr>
+            <td>Put the policed type in an application namespace that starts with <code>System</code>, such as <code>SystemsCorp.Payroll</code></td>
+            <td>
+              Policed. The walker read any namespace starting with{" "}
+              <code>System</code> as the framework&apos;s and put no policy
+              beneath its types, so a <code>[DwDenied]</code> field there was
+              returned, filterable and sortable. Only <code>System</code> and the
+              namespaces beneath it are the framework&apos;s now.
+            </td>
+          </tr>
+        </tbody>
+      </table>
+      <Callout tone="warn" title="What the policy cannot see into">
+        A member typed <code>object</code>, a framework interface or a
+        collection that is not generic, such as <code>IEnumerable</code>,{" "}
+        <code>ArrayList</code> or an application&apos;s own, is opaque to the
+        policy: it never asks for a projection, a synthesized projection over a
+        projected row or rows in memory leaves it out, and naming it returns
+        whatever it holds. A framework generic holding a policed type, such as{" "}
+        <code>Dictionary&lt;string, LineDto&gt;</code>, has no paths beneath it:
+        naming it is refused in both tiers where the core cannot narrow it,
+        narrowed away under <code>Convenience</code> beneath a navigation, and a
+        synthesized projection leaves it out. Hold such values in a list of the
+        policed type instead. A member EF Core does not map is read as its type,
+        since its getter can hand out what EF Core loaded; a getter that copies a
+        denied column into a type with no denial is the application&apos;s to
+        withhold.
+      </Callout>
+      <Callout tone="warn" title="A forced scope on a list's element type filters rows, not elements">
+        A forced scope declared on a list&apos;s element type filters the rows
+        that hold the list, never its elements. <code>Selects</code> naming the
+        list returns every element, those the scope excludes included, as in
+        every release; a synthesized projection leaves such a list out. Scope
+        the elements where the row is built.
+      </Callout>
+
       <h2 id="posture">Getting the posture right</h2>
       <ul>
         <li>Use <code>DwTier.Strict</code> unless you need <code>getQueryString</code>.</li>
@@ -208,6 +375,8 @@ true order. Add [DwNoOrder] unless that is intended.`}</Code>
         <li>Run <code>DwPolicy.ValidateModel(...)</code> at startup and treat its warnings as a checklist.</li>
         <li>Put <code>[DwEntity(RequirePolicy = true)]</code> on anything sensitive, so a DynamicWhere call that forgets <code>ApplyPolicy</code> fails loudly.</li>
         <li>Prefer <code>[DwOperators]</code> over allowing free filtering on a protected field.</li>
+        <li>Hold a policed type in a list, never in a dictionary, another framework generic or a member typed <code>object</code>. The policy has no paths into any of them.</li>
+        <li>Scope a list&apos;s elements where the row is built. A forced scope on the element type filters the rows that hold the list, never the elements.</li>
         <li>Set <code>DwCaps.DefaultPageSize</code> if the API does not page for itself. It ships off, and the request <code>MaxPageSize</code> never bounded is the one that sent no page at all.</li>
         <li>Keep <code>DwCaps.MaxConditionSets</code> near the number of sets your clients really send. A set with no conditions passes every other cap, and every set adds a condition or a subquery to the statement a segment becomes.</li>
       </ul>
diff --git a/OfficialWebsite/app/page.tsx b/OfficialWebsite/app/page.tsx
index 1395e6a..f508894 100644
--- a/OfficialWebsite/app/page.tsx
+++ b/OfficialWebsite/app/page.tsx
@@ -219,7 +219,7 @@ export default function HomePage() {
               Everything you need to query dynamically
             </h2>
             <p className="mx-auto mt-3 max-w-[560px] text-[15px] text-[var(--color-fg-2)]">
-              Four packages. Seventeen extension methods. Three composable shapes (Filter, Segment, Summary), and a policy layer deciding who sees what.
+              Four packages. Twenty-eight extension methods. Three composable shapes (Filter, Segment, Summary), and a policy layer deciding who sees what.
             </p>
           </div>
 
@@ -309,7 +309,7 @@ export default function HomePage() {
             {[
               { title: "Installation", desc: "Add to your project in seconds.", href: "/docs/installation" },
               { title: "Quick Start", desc: "A working filter in 30 lines.", href: "/docs/quick-start" },
-              { title: "Extension Methods", desc: "All 17 methods, one place.", href: "/docs/extensions" },
+              { title: "Extension Methods", desc: "All 28 methods, one place.", href: "/docs/extensions" },
               { title: "JSON Cookbook", desc: "13 copy-pasteable examples.", href: "/docs/examples" },
               { title: "Enums Reference", desc: "Every DataType & Operator.", href: "/docs/enums" },
               { title: "Classes Reference", desc: "Condition → Filter → Result.", href: "/docs/classes" },
diff --git a/OfficialWebsite/lib/nav.ts b/OfficialWebsite/lib/nav.ts
index f1c8223..077ead3 100644
--- a/OfficialWebsite/lib/nav.ts
+++ b/OfficialWebsite/lib/nav.ts
@@ -8,7 +8,7 @@ export const SITE = {
     "DynamicWhere.ex is a free .NET library for building dynamic, JSON-driven LINQ queries on Entity Framework Core — filter, sort, paginate, project, group, aggregate, and run UNION / INTERSECT / EXCEPT set operations from your front-end. Works with ASP.NET Core on .NET 6, 7, 8, 9, and 10.",
   shortDescription:
     "Dynamic JSON filter, sort, paginate, group, aggregate, and set operations for EF Core. .NET 6/7/8/9/10.",
-  version: "3.1.0",
+  version: "3.2.0",
   domain: "doc.dynamicwhere.com",
   repo: "https://github.com/Sajadh92/DynamicWhere.ex",
   nuget: "https://www.nuget.org/packages/DynamicWhere.ex",
diff --git a/OfficialWebsite/package.json b/OfficialWebsite/package.json
index 9843f75..f17a1de 100644
--- a/OfficialWebsite/package.json
+++ b/OfficialWebsite/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dynamicwhere-docs",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "private": true,
   "scripts": {
     "dev": "next dev",
diff --git a/OfficialWebsite/public/llms.txt b/OfficialWebsite/public/llms.txt
index a7f3129..4149939 100644
--- a/OfficialWebsite/public/llms.txt
+++ b/OfficialWebsite/public/llms.txt
@@ -4,7 +4,7 @@
 > opt-in field-level policy layer that decides what each caller may filter, sort, select, group,
 > aggregate and see, and a reflection cache that needs no setup.
 >
-> Version 3.1.0 · targets net6.0 · runs on .NET 6, 7, 8, 9, 10 · EF Core 6+ · MIT
+> Version 3.2.0 · targets net6.0 · runs on .NET 6, 7, 8, 9, 10 · EF Core 6+ · MIT
 > Docs: https://doc.dynamicwhere.com · Source: https://github.com/Sajadh92/DynamicWhere.ex
 
 This file is the whole library in one pass: every public type and member of the four packages, the
@@ -14,7 +14,7 @@ library. No other page is needed; where another page disagrees with this file, t
 Where a name is not in this file, it does not exist — do not invent members.
 
 ```
-dotnet add package DynamicWhere.ex --version 3.1.0
+dotnet add package DynamicWhere.ex --version 3.2.0
 dotnet add package DynamicWhere.ex.Policies.Redis                 # optional, same version as the core
 dotnet add package DynamicWhere.ex.Policies.EntityFrameworkCore   # optional, same version as the core
 dotnet add package DynamicWhere.ex.Policies.AspNetCore            # optional, same version as the core
@@ -619,7 +619,8 @@ Path                              Where predicate generated
 ## 6. Extension methods
 
 `public static class Extension`, namespace `DynamicWhere.ex.Source` (the source file is spelled `Extention.cs`;
-the class is `Extension`). 21 public methods, all generic with `where T : class`. None takes a `CancellationToken`.
+the class is `Extension`). 28 public methods, all generic with `where T : class`. Every asynchronous one also has
+overloads taking a `CancellationToken` (3.2.0).
 
 ```
 On IQueryable<T> query — composable (validates and builds, executes nothing)
@@ -644,6 +645,15 @@ On IQueryable<T> query — terminal
   ToListAsync<T>(Summary summary, bool getQueryString = false)       -> Task<SummaryResult>
   ToListAsync<T>(Segment segment)                                    -> Task<SegmentResult<T>>
 
+On IQueryable<T> query — terminal, cancellable (3.2.0)
+  ToListAsync<T>(Filter filter, CancellationToken cancellationToken)                             -> Task<FilterResult<T>>
+  ToListAsync<T>(Filter filter, bool getQueryString, CancellationToken cancellationToken)        -> Task<FilterResult<T>>
+  ToListAsyncDynamic<T>(Filter filter, CancellationToken cancellationToken)                      -> Task<FilterResult<dynamic>>
+  ToListAsyncDynamic<T>(Filter filter, bool getQueryString, CancellationToken cancellationToken) -> Task<FilterResult<dynamic>>
+  ToListAsync<T>(Summary summary, CancellationToken cancellationToken)                           -> Task<SummaryResult>
+  ToListAsync<T>(Summary summary, bool getQueryString, CancellationToken cancellationToken)      -> Task<SummaryResult>
+  ToListAsync<T>(Segment segment, CancellationToken cancellationToken)                           -> Task<SegmentResult<T>>
+
 On IEnumerable<T> query — terminal, in memory
   ToList<T>(Filter filter, bool getQueryString = false)              -> FilterResult<T>
   ToListDynamic<T>(Filter filter, bool getQueryString = false)       -> FilterResult<dynamic>
@@ -651,7 +661,9 @@ On IEnumerable<T> query — terminal, in memory
 ```
 
 These do not exist: a synchronous `ToList<T>(Segment)`, `getQueryString` on Segment, any async or composable
-method on `IEnumerable<T>`, names such as `ToListFilter` / `ToListAsyncSegment`, and a `new()` constraint.
+method on `IEnumerable<T>`, names such as `ToListFilter` / `ToListAsyncSegment`, a `new()` constraint, and a
+`CancellationToken` parameter on the 3.1 signatures: the token overloads are separate methods, so code compiled
+against 3.1 still binds.
 
 ### Rules for every method
 
@@ -791,10 +803,17 @@ ToListDynamic, ToListAsyncDynamic   Where -> COUNT(where-only query) -> build Or
 
 - Every call runs two queries: a count of the filtered set (ignoring Page) and the data query.
 - In the dynamic pair an invalid `Orders`, `Page` or `Selects` throws after the count has already run.
-- `ToListAsync` uses EF Core `CountAsync` / `ToListAsync`; `ToListAsyncDynamic` uses EF Core `CountAsync` and
-  Dynamic LINQ `ToDynamicListAsync`. Both need an EF Core async provider: on a plain `list.AsQueryable()` they throw
-  `InvalidOperationException` ("The provider for the source 'IQueryable' doesn't implement 'IAsyncQueryProvider'…").
-  Use the synchronous methods in memory.
+- `ToListAsync` uses EF Core `CountAsync` / `ToListAsync`. `ToListAsyncDynamic` uses EF Core `CountAsync`, then
+  EF Core's `ToListAsync` over the query's element type: `T` when `Selects` is null, the projection's generated
+  class otherwise (3.2.0). It used to read through Dynamic LINQ's `ToDynamicListAsync`, asynchronous as well but
+  with no token to pass on. Both need an EF Core async provider for the count: on a plain
+  `list.AsQueryable()` they throw `InvalidOperationException` ("The provider for the source 'IQueryable' doesn't
+  implement 'IAsyncQueryProvider'…"). Use the synchronous methods in memory.
+- The overloads taking a `CancellationToken` (3.2.0) pass it to the count and to the read, so a canceled token stops
+  whichever is running and the call throws `OperationCanceledException` (EF Core's `TaskCanceledException` derives
+  from it). The overloads without a token pass `CancellationToken.None`.
+  - `ToListAsync(filter, default)` does not compile: `default` fits both `bool getQueryString` and
+    `CancellationToken`. Write `false`, `CancellationToken.None` or a named argument.
 - `ToListDynamic` rows are `DynamicClass` objects when `Selects` is set, and T instances when it is null.
 
 ### ToListAsync<T>(Segment)
@@ -828,7 +847,8 @@ then exactly as ToListAsync(Filter): Order(Orders) -> Page(Page) -> Select(Selec
   a set with a null `ConditionGroup` → `ArgumentNullException`. Every clause is validated before the database is
   queried.
 - Empty or null `ConditionSets` runs `ToListAsync(new Filter { Selects, Orders, Page })`: there is nothing to combine.
-- No synchronous version, no `getQueryString`; needs an EF Core async provider. Only `Except` on a type with a
+- No synchronous version, no `getQueryString`; needs an EF Core async provider. An overload takes a
+  `CancellationToken` (3.2.0) and passes it to the count and the read. Only `Except` on a type with a
   primary key needs the provider to translate a correlated `EXISTS`; `Union` and `Intersect` there are plain `OR` and
   `AND`.
 
@@ -865,7 +885,8 @@ GroupBy.Fields                  emitted
   key's own type (an enum key stays an enum), then one property per `AggregateBy.Alias`, in list order. Rows are
   `DynamicClass` objects; `SummaryResult.Data` is `List<dynamic>`.
 - A null group key is its own group (`{ "categoryName": null, … }`).
-- `ToListAsync(Summary)` counts synchronously; only the data read is async.
+- `ToListAsync(Summary)` counts and reads through EF Core's `CountAsync` and `ToListAsync` (3.2.0; it used to count
+  synchronously). On a provider that is not EF Core's, rows in memory among them, it counts and reads synchronously.
 
 ```
 Aggregator      Emitted per group                                  Field accepted                       Result type
@@ -1316,10 +1337,11 @@ Each of these compiles, passes validation, and returns something other than what
 10. **Summary column names collide silently.** Two group fields ending in the same segment (`Name`, `Category.Name`)
     throw `InvalidOperationException` at run time, and an alias equal to a dot-stripped group field (`CategoryName`
     beside `Category.Name`) silently drops a column.
-11. **In-memory sources behave differently from EF Core.** The async terminals throw; typed `Select` through a
+11. **In-memory sources behave differently from EF Core.** The async Filter and Segment terminals throw; typed `Select` through a
     reference navigation throws; a null navigation inside a path throws `NullReferenceException`; ordering by a
     navigation throws; `getQueryString` returns a placeholder sentence instead of SQL.
-12. **No method takes a `CancellationToken`.** `ToListAsync(filter, ct)` does not compile, and nothing can cancel a query.
+12. **`ToListAsync(filter, default)` is ambiguous (3.2.0).** `default` fits both `getQueryString` and the new
+    `CancellationToken` overload, and the call does not compile. Write `false`, a token, or a named argument.
 13. **`Selects: []` throws `MustHasFields`.** Omit the property (null) to return whole entities.
 14. **A null inside `Values` is the empty string, not NULL.** Test for NULL with `IsNull` / `IsNotNull` and no values.
 15. **`Page` does not order.** Paging without `Orders` returns whatever order the database chooses; always send an
@@ -1728,6 +1750,15 @@ Terminal: sanitize, run, transform, set result.Policy (null under Strict unless
   ToListAsync(Summary summary, bool getQueryString = false)       -> Task<SummaryResult>
   ToListAsync(Segment segment)                                    -> Task<SegmentResult<T>>
 
+Terminal, cancellable (3.2.0): the same, with the token passed to the count and the read
+  ToListAsync(Filter filter, CancellationToken cancellationToken)                             -> Task<FilterResult<T>>
+  ToListAsync(Filter filter, bool getQueryString, CancellationToken cancellationToken)        -> Task<FilterResult<T>>
+  ToListAsyncDynamic(Filter filter, CancellationToken cancellationToken)                      -> Task<FilterResult<dynamic>>
+  ToListAsyncDynamic(Filter filter, bool getQueryString, CancellationToken cancellationToken) -> Task<FilterResult<dynamic>>
+  ToListAsync(Summary summary, CancellationToken cancellationToken)                           -> Task<SummaryResult>
+  ToListAsync(Summary summary, bool getQueryString, CancellationToken cancellationToken)      -> Task<SummaryResult>
+  ToListAsync(Segment segment, CancellationToken cancellationToken)                           -> Task<SegmentResult<T>>
+
 Composable: sanitize one clause, apply the type's forced predicates, return a new handle
   Select(List<string> fields)         -> PolicyQueryable<T>
   Where(Condition condition)          -> PolicyQueryable<T>
@@ -1756,8 +1787,11 @@ How this differs from the unguarded surface:
 
 Rules:
 - Every guarded query runs over `AsNoTracking()`. Returned EF Core entities are detached, so a masked value is never
-  saved back. An in-memory source has no such copy: without `Selects`, the rows returned are the source objects
-  themselves, transformed in place.
+  saved back. Through a provider that wraps EF Core's, as LinqKit's `AsExpandable` and DelegateDecompiler's
+  `Decompile` do, EF Core's extension would hand the query back still tracking, so the call is put into the query
+  itself (3.2.0). An in-memory source has no such copy: without `Selects` and with nothing denied, the rows returned are
+  the source objects themselves, transformed in place. When a projection is synthesized the rows are new, and they
+  hold no member of an object type, so the source objects are left as they were.
 - Chaining keeps decisions: each composable returns a new handle, and the terminal's trace includes the earlier links' decisions.
 - The terminal's trace is on `result.Policy` only when `DwPolicyOptions.IncludeTraceInResult` allows it: null follows the tier (off under `Strict`, on under `Convenience`), and `true` or `false` overrides it (3.1.0). `LastTrace` holds it whatever the setting.
 - `getQueryString: true` under `Strict` → `QueryStringDenied` (14). This is checked before sanitizing; dry run records it instead.
@@ -1793,7 +1827,7 @@ public class Ticket { … }
   entry, such as the one a trailing comma leaves, is ignored, and a field named twice is used once.
 - Applied only under `ApplyPolicy`, when `Orders` is null or empty: `ToList`, `ToListAsync`, `ToListDynamic` and
   `ToListAsyncDynamic` with a `Filter`; `ToListAsync(Segment)`; the composable `Filter` and `FilterDynamic`; and the
-  composable `Page` on a source nothing has ordered or projected.
+  composable `Page` on a source nothing has ordered and whose projection hides no default field.
 - Never applied:
   - by an unguarded call. The core methods of section 6 on a plain `IQueryable<T>` or `IEnumerable<T>`, `Page`
     included, never read the attribute and order only as their caller asks, exactly as in 3.0; so does a DynamicWhere
@@ -1801,12 +1835,24 @@ public class Ticket { … }
   - when the caller sends orders: the default is not appended as a tiebreak;
   - to a source already ordered, before it was guarded (`db.Tickets.OrderBy(t => t.Title).ApplyPolicy(ctx)`) or by
     a composed `Order` earlier in the chain — even one whose every order the policy dropped, because the caller
-    still sent orders. Only the query's expression is read, so a sequence sorted in memory before
-    `ApplyPolicy(IEnumerable<T>)` does not count as ordered: send `Orders` for it;
-  - to a projected source: a `Select` anywhere in the query's chain, whether the guarded composable `Select`
-    or a projection before `ApplyPolicy`, leaves the query in its own order. A default applied after a projection could
-    name a field the projection left out, which EF Core cannot translate, so `guarded.Select(["Id", "Title"]).Page(page)`
-    pages as it did in 3.0.0, unordered;
+    still sent orders. A composed `Filter` that sent orders counts the same way (3.2.0). Only the query's expression
+    is read, so a sequence sorted in memory before `ApplyPolicy(IEnumerable<T>)` does not count as ordered: send
+    `Orders` for it;
+  - to a source whose projection could hide a default field. Only the outermost `Select` of the chain counts, because
+    it makes the rows the default orders. Since 3.2.0 it hides nothing when it builds T itself in an object
+    initializer, `Select(t => new Row { Code = t.Code, … })`, and assigns every field the default names, at every
+    level of a nested path (`"Owner.Name"` needs `Owner = new OwnerRow { Name = … }`), a column. On EF Core a column
+    is a member the model maps on the entity the `Select` reads, read directly, through reference navigations
+    (`t.Owner.Name`) or through `EF.Property` (a shadow property included); the default then applies, because EF
+    Core translates an order by a column the projection assigned. In memory any assigned field is ordered by. A
+    value the projection computes, by a method (`Regex.Replace`, `ToUpper`, the application's own) or an operator
+    (`t.First + " " + t.Last`), a member the model does not map, a constructor with arguments, a default field the
+    initializer does not assign, or a nested path through anything but an initializer leaves the query in its own
+    order, as every projection did in 3.1.0: ordering by it could fail where the unguarded query ran;
+  - after a projection composed on the handle: the guarded `Select`, or a guarded `Filter` whose `Selects` is set,
+    leaves the rest of the chain unordered even when it keeps every default field, so
+    `guarded.Select(["Id", "Title"]).Page(page)` pages as it did in 3.0.0, unordered. The default is for the rows the
+    caller's source makes;
   - to a `Summary`, or by the composable `Where`, `Select` and `Order`.
 - A type that declares no `DefaultOrder` is never ordered by the library, guarded or not; only a caller's own
   orders apply. End a default with a unique field, such as the key, or rows sharing the leading values can still
@@ -1836,7 +1882,7 @@ public class Ticket { … }
 
 ### [DwEntity(RequirePolicy = true)] enforcement
 
-- All 21 public methods of `DynamicWhere.ex.Source.Extension` (the `IQueryable<T>` and `IEnumerable<T>` overloads) run the guard first.
+- All 28 public methods of `DynamicWhere.ex.Source.Extension` (the `IQueryable<T>` and `IEnumerable<T>` overloads) run the guard first.
   - They throw `PolicyException` with `ErrorCode = PolicyRequired` (10) when `T` requires a policy and the call is not running inside a `PolicyQueryable<T>` method.
 - Composables such as `Select` and `Where` throw when called, not when enumerated.
 - The exception carries:
@@ -1932,6 +1978,16 @@ No named attribute refuses `Segment`: write `[DwDeny(PolicyFeature.Segment)]`.
 - `[DwDeny(PolicyFeature.None)]` refuses nothing, and nothing reports it.
 - `[DwNoSelect]` leaves the field filterable, sortable, groupable and aggregatable, so it can still be
   counted.
+- One on another declaration of the member applies to the path too (3.2.0): on the interface member a class, or a
+  loaded subtype of it, implements with the member; on an override of either accessor a loaded subtype declares; on
+  a public member a loaded subtype hides with `new`; and on the implementation a loaded type gives an interface
+  member, explicit, inherited from a base class or declared by an open generic class, through that interface or an
+  instantiation variance lets stand for it (`IFeed<VisaCard>` for a member typed `IFeed<Card>`, with `out T`). A row read through the base type or
+  the interface is still that subtype, and its member returns what the subtype's declaration returns, so the denial
+  holds for the path on every row, Where, Order, Group and Select alike. A member hidden with `new` counts because
+  whether it reads the member it hides cannot be told from outside, and a row serialized as its own type writes it
+  under the same name. Only the deny family is read this way; aliases, transforms and the other attributes are read
+  from the declaration walked.
 
 ### DwOperators
 
@@ -2238,9 +2294,17 @@ HAVING through a key or alias of such a field or operator    throw             t
 ORDER BY a field denied for Order (also a summary key/alias) drop              throw    FieldDeniedForOrder
 SELECT a field denied for Select                             drop              throw    FieldDeniedForSelect
 SELECT a navigation with a denied field beneath it           allowed leaves    throw    FieldDeniedForSelect
+SELECT a navigation that cannot be narrowed around a denied
+  field: its key a.Id is denied, or a path through it is one
+  the core cannot project (3.2.0)                            throw             throw    FieldDeniedForSelect
 SELECT a.b when the key a.Id is denied                       throw             throw    FieldDeniedForSelect
+SELECT a member that can carry a denied field no path names:
+  past four segments, in a framework generic, on a subtype,
+  or unasked under a "*" deny (3.2.0)                        allowed leaves,   throw    FieldDeniedForSelect
+                                                             or throw where it
+                                                             cannot be narrowed
 every requested SELECT dropped                               throw             -        AllSelectsDenied
-no Selects while some field is denied for Select             allowed scalars   allowed scalars
+no Selects while a denied field can reach the result (3.2.0) allowed members   allowed members
 GROUP BY a denied field                                      throw             throw    FieldDeniedForGroup
 AGGREGATE a denied field, or a transformed field lacking
   AllowAggregate on a stage                                  throw             throw    FieldDeniedForAggregate
@@ -2263,14 +2327,128 @@ DefaultOrder field denied for Segment, in a Segment (3.1.0)  left out          l
 
 - "drop" removes the entry and records `Dropped`. A Strict throw records `Denied`.
 - The guarded composable `Order(...)` and `Select(...)` drop and throw the same way.
-- "allowed leaves": when `Selects` names a navigation, it is replaced by the allowed leaf paths beneath it.
-- "allowed scalars" applies when `Selects` is null or empty and some field is denied for Select. It runs
-  for a whole-`Filter` terminal and for a Segment, not for a single-clause composable call.
-  - The projection becomes every allowed property that is readable, writable and not an indexer, and whose
-    type is simple: primitive, enum, `string`, `decimal`, `DateTime`, `DateOnly`, `TimeOnly`,
-    `DateTimeOffset`, `TimeSpan` or `Guid`. Navigations are left out.
-  - It never throws for the denied field. It throws `AllSelectsDenied` only when no field is left.
-  - With nothing denied, `Selects` stays null.
+- "allowed leaves": when `Selects` names a navigation with a denied field beneath it, it is replaced by the allowed
+  leaf paths beneath it. A navigation with nothing denied beneath it is kept as written, unless a transform beneath it
+  lands on a property with no setter, which the outbound walk could not write back: it is then narrowed around that
+  property (3.2.0).
+  - The fields beneath are read the way the attribute walker reads them (3.2.0): through any collection type, so a
+    member typed `IReadOnlyList<T>` or an application's own collection no longer hides its denied fields, and no
+    deeper than the walker's four segments. The providers' fragments are asked too, so a denied property with no
+    setter and a rule on a path reached through a cycle count (3.2.0).
+  - A named member can also carry a field denied for Select that no path names (3.2.0): deeper than four segments,
+    inside a framework generic such as `Dictionary<string, T>`, or declared by a subtype of the member's type (a
+    derived entity, a subclass, an interface's implementation). What it can carry is read from the source. On an
+    entity it is read from the EF Core model, so only what loads counts: the navigation's columns, a converted one
+    included, its owned chain at any depth, the navigations beneath it that an include, an automatic include or a
+    lazy loader fills, and each member the model does not map, read as its type, since its getter can hand out what
+    EF Core loaded; for its type and every type the model derives from it. On a projected row it is the type the
+    initializer constructs the member as, when it says (`Contact = new ContactRow { … }`), and otherwise the
+    member's type and every loaded subtype of it, as on a row in memory. Under a policy with a `"*"` deny, a path
+    the walk never asks about (past four segments, with no setter, or on a subtype) is a denied one unless the
+    policy names it; around a cycle, where the paths never end, it always is.
+  - Such a member is refused with `FieldDeniedForSelect` under Strict. Under Convenience it is narrowed to the
+    allowed leaves where the core can narrow the path's first member, which builds the declared type and so drops a
+    subtype's fields; a path that names a framework generic itself narrows to nothing and is dropped. Where the core
+    cannot narrow it (a column, complex or JSON member at the top of T, or a member of a row in memory) it is
+    refused in both tiers.
+  - A narrowing that cannot be built as gated is refused with `FieldDeniedForSelect`, in both tiers (3.2.0). The
+    core's typed projection adds the key (`Id`) of every nested node it builds, so a narrowing whose nodes carry a
+    denied key would return it; a path through a collection the core does not unwrap fails its validation; and a
+    column, complex property or JSON-stored member, a member of a row in memory, or one a projection builds some way
+    the core cannot narrow, cannot be narrowed at all.
+  - A navigation named through another, `Main.Lead`, gates the key of every node it passes through, which the
+    builder adds, as a dotted path to a value always did (3.2.0). A denied one refuses the projection.
+- "allowed members" (3.2.0; "allowed scalars" before) applies when `Selects` is null or empty and a field is denied
+  for Select where its value can reach the result. It runs for a whole-`Filter` terminal and for a Segment, not for a
+  single-clause composable call.
+  - A denial at the top of T always counts, whatever the member holds: a scalar, a blob, a list, an owned object, a
+    JSON column (3.2.0; 3.1.0 asked only about simple members, so a denied `byte[]` or owned member came back).
+  - A denial beneath a member counts when its value can reach the result. A rule may spell its path in any letter
+    case.
+    - On an entity: beneath a column, an owned or complex member, or a navigation something loads. That is an
+      `Include` or `ThenInclude` on the query, an automatic include, or a lazy loader: proxies, an injected
+      `ILazyLoader`, a loader delegate or `ILazyLoader` the constructor takes, kept in a field or any property, the
+      asynchronous loader delegate EF Core 7 added, or an injected `DbContext`, any of which fills a navigation
+      after the query. Every navigation counts as loaded when the library cannot read which the query loads: an
+      include in a form it cannot read, an include off the query's own chain (on a join's inner source, say), and a
+      chain that reaches its rows through anything but the root's own rows (`Select(o => o.Customer)`, a
+      `SelectMany`, a `Join`, a `GroupBy`) when it also has an include, which EF Core applies from the root to the
+      entities it reaches, or when one of its lambdas hands its rows an object: one it builds (a projection behind an
+      identity `Select`, or an object built inside an anonymous row or a conditional), which loads whatever it
+      assigns; one an application's method returns from what the lambda gives it; or one it captured, another query
+      with its own include or projection, or an object in memory. A call that reads nothing of the lambda's and returns
+      a query or an expression (a specification, a repository's query, `FromSql`, a context's `Set` through an
+      interface) is evaluated as EF Core evaluates it, and what it returns is read; a context's own query function is a
+      query root; an anonymous object that only carries what the rows hold (query-syntax range variables, a
+      composite key) builds nothing; and what only feeds a predicate or a key is a value and hands a row nothing. Such
+      a chain with none of these is read from the model. A denial beneath a navigation nothing loads never leaves the database
+      and needs no projection,
+      so a connected model is read as it was in 3.1.0. A member EF Core does not map counts as loaded: its getter can
+      hand out a mapped field or a private navigation, so its type is read whole.
+    - On a row a projection builds: beneath a member its initializer assigns. A constructor with arguments counts
+      every member as assigned; an initializer after it still says what its own bindings hold.
+    - On a row in memory: beneath any member.
+  - So does a member whose value can hold a field denied for Select that no path names (deeper than the walker's
+    four segments, inside a framework generic such as `Dictionary<string, T>`, or declared by a subtype of its
+    type), read as for a named member above, so on an entity only what loads counts. Under a policy with a `"*"`
+    deny, so does a member whose value can hold a path the walk never asks about and the policy does not name.
+  - A member that can hold an object of any type, one typed `object`, a framework interface such as `IComparable`,
+    an unbound type parameter, or a collection that is not generic (`IEnumerable`, `ArrayList`, `Array`, an
+    application's own), asks for nothing on its own: the policy cannot see into it whether or not a projection is
+    built. An application's own such collection still has its own members read, as any type's are.
+  - A row can be a subtype of T. On an entity, each member a type the model derives from T declares, and what loads
+    beneath it, counts as one of T's own would; on a row in memory, each member any loaded subtype declares; on a
+    row a projection builds, each member the type its initializer constructs declares below T. The projection builds
+    T, so it leaves them all out, recorded as `Dropped` with a reason starting `left out: a type derived`.
+  - A subtype is any type loaded outside the framework's own assemblies that derives from the type or implements it:
+    an open generic one, `Tagged<T> : Creature`, and an application's subclass of a framework class, an `Exception`
+    or a `Stream`, included. A rule on a path through a subtype's member (`Org.Swift`, where `Swift` is the bank's),
+    or through one of two members whose names differ only in letter case, counts beneath a member as a rule on the
+    declared type's own path does.
+  - The denials beneath a member come from the providers' fragments as well as from walking the type, so a denied
+    property with no setter, a rule on a path reached through a cycle, and a rule deeper than the walk all count.
+  - A forced scope beneath a member asks for no projection on its own: it filters the rows that hold the member, as it
+    always has. When a projection is needed anyway, the member is left out whole (below).
+  - The projection is what an unguarded call would return, less what the policy withholds:
+    - every allowed member holding a value, a simple type (primitive, enum, `string`, `decimal`, `DateTime`,
+      `DateOnly`, `TimeOnly`, `DateTimeOffset`, `TimeSpan`, `Guid`) or a collection of one (`byte[]`, `string[]`,
+      `List<string>`), that the source carries: every one a projection assigns, every one of a row in memory, and
+      every one EF Core maps on an entity. A value EF Core does not map is left out: computing it would make EF Core
+      read the whole entity, the denied columns included, and it holds only its initial value anyway;
+    - every allowed member holding an object or a list of them that the source carries: a member a projection's
+      initializer assigns, and an entity's columns (converted or JSON), owned and complex members. It is kept whole
+      when nothing beneath it is denied, nothing its value can hold is denied, it cannot hold an object of any type
+      (asked of a projected row, a row in memory, and an entity's column a value converter hands back, directly or
+      inside a complex property: what EF Core materializes itself never holds one), under a
+      `"*"` deny every path beneath it the walk skips is one the policy names, no forced scope is beneath it, and no
+      transform beneath it lands on a property with no setter;
+    - otherwise it is narrowed to the allowed leaves beneath it, to four segments, as a caller naming it would get,
+      when the core's narrowing translates: an object the projection's initializer builds, a list a subquery reads
+      into a type the core can bind (not an array or a set), a navigation that is neither complex nor stored as JSON,
+      or an entity's owned member not stored as JSON. The narrowing builds the member's declared type, so a
+      subtype's fields are dropped. A leaf that can hold what the policy cannot name is left out;
+    - otherwise it is left out whole, recorded as `Dropped` on `Select` with a reason starting `left out whole`: a
+      scope forced beneath it; a column, complex property or JSON-stored member, which EF Core reads whole; one the
+      projection builds some other way, by a constructor with arguments, a conditional or an unassigned member; a
+      denied key the core's projection would add back; a path the core cannot project; a node type the core cannot
+      construct (an interface, an abstract class, one with no public parameterless constructor); nothing beneath it
+      left to select;
+  - Never kept: an entity's navigation, included or not, since projecting it would load it (under Convenience, name
+    it in `Selects` to get it narrowed; under Strict, name its allowed fields); an object held by a row in memory,
+    since a kept object is the caller's own and a transform would change it in place; a member with no setter; a
+    member named with one of the parser's words. Each one the unguarded call would have returned, an included
+    navigation or an object in memory, is recorded as `Dropped` with a reason starting `left out:` (3.2.0).
+  - A `Select` handing back an entity, `Select(o => o.Customer)`, builds no row and is read as an entity query, with
+    every navigation counted as loaded when the query has an include (above).
+  - A narrowed reference that is null in the source comes back as an empty object, as it does for a caller's own
+    dotted `Selects`.
+  - A narrowed member carries every allowed leaf beneath it. An entity reached beneath it has its own navigations
+    projected and so loaded, which the source may not have included, exactly as `Selects` naming the member does.
+  - Each denied field whose value can reach the result, at the top or beneath, is recorded as `Dropped` on `Select`.
+  - It never throws for the denied field. It throws `AllSelectsDenied` only when no field is left. A typed terminal
+    projects into T, so a T with no public parameterless constructor, an abstract one among them, fails there with
+    `SelectTypeMustHaveParameterlessConstructor`; the dynamic terminals build their own class.
+  - With nothing counted, `Selects` stays null and the query is the one an unguarded call runs.
 - A path that matches nothing on `T` (3.1.0):
   - Convenience, and dry run in either tier: validation throws `LogicException`
     `ConditionMustHasValidFieldName` before any policy decision, as it does unguarded.
@@ -2619,7 +2797,8 @@ Errors:
   - a field no query can order by, a path ending on a collection of entities:
     `"{Type}: DefaultOrder names '{field}', which no query can order by, so guarded queries skip it."`
   - a field the type's own attributes deny for ordering, unless every one of those denials is `Overridable` (then a
-    warning, below):
+    warning, below). The attributes include those of the member's other declarations, an interface member it
+    implements, a subtype's override and a public member a subtype hides with `new` (3.2.0):
     `"{Type}: DefaultOrder names '{field}', which its attributes deny for ordering, so every guarded query leaves it out."`
 - a stage that cannot be built:
   - `Round` or `Bucket` with `Step <= 0`, or `Truncate` with `Decimals < 0`
@@ -2695,6 +2874,15 @@ What is recorded
   Dropped      a field removed from a Convenience request (Select, Order); one per field
   Dropped      a DefaultOrder field left out for this caller (Order), both tiers, and in a Segment a field
                denied for Segment too; Reason starts "left out of the default order" (3.1.0)
+  Dropped      a denied field a synthesized projection leaves out (Select), at the top or beneath a member;
+               Reason names the policy's sources, such as "DwDeniedAttribute (sealed)" (3.2.0)
+  Dropped      a member a synthesized projection leaves out whole (Select); Reason starts "left out whole" (3.2.0)
+  Dropped      a member a type derived from T declares, which a synthesized projection building T leaves out
+               (Select); Reason starts "left out: a type derived" (3.2.0)
+  Dropped      a member a synthesized projection cannot keep that the unguarded call would have returned, an
+               included navigation or an object of a row in memory (Select); Reason starts "left out:" (3.2.0)
+  Dropped      a member a Convenience caller named that can hold a denied field no path names (Select); Reason
+               "it holds a field denied for Select where no path can name it" (3.2.0)
   Denied       a refusal: Strict denial, cap, cost, query string ("*"), required filter, segment inference,
                MaxAuditEvents; the throw follows unless dry run. Under Strict a name that matches nothing
                is Denied under that name, Reason "names nothing on <TypeName>" (3.1.0)
@@ -3081,6 +3269,10 @@ if (!sim.WouldRun) logger.LogInformation("{Code}", sim.Refusal!.ErrorCode);
 - A `PolicyException` becomes `Refusal`. Any other exception propagates, unwrapped even from the runtime overload.
   - Under `Strict`, outside dry run, a path that matches nothing is therefore a `Refusal` with the clause's `FieldDeniedFor*` code and `FieldPath` `"*"`, not a `LogicException` (3.1.0). The `Trace` names it.
 - A simulated `Filter` or `Segment` that sends no orders gets the type's `DefaultOrder` in `Clause.Orders`, less the fields the caller may not order by (3.1.0).
+- A simulation has no source, so it reads T as a source it cannot see into (3.2.0): every denial beneath a member
+  counts, and with no `Selects` a synthesized `Clause.Selects` keeps only members holding a value. The guarded query
+  over a projected row keeps its assigned objects, one over an entity keeps its columns, owned and complex members
+  and asks only about denials whose value it loads, and one in memory keeps values only.
 - Runtime overload errors:
   - a value-type `entityType`, or a `TClause` other than `Filter`, `Summary` or `Segment` → `ArgumentException`;
   - null entity, context or options → `ArgumentNullException`.
@@ -4131,8 +4323,10 @@ Read before generating policy attributes.
     ignore it. A caller who sends any `Orders` gets exactly those, so rows tied on them can still move between
     pages, and an `IQueryable` ordered before `ApplyPolicy`, or by a composed `Order` before `Page`, keeps its own
     order; a list sorted in memory before `ApplyPolicy` is not seen as ordered and gets the default, so send the
-    order with the filter. A projected query — a `Select` before `ApplyPolicy` or the guarded `Select` — takes no
-    default at all. A default field the caller may not order by is left out without an error. End every
+    order with the filter. A projected query takes the default only when its outermost `Select` builds T in an
+    object initializer assigning every default field a column (3.2.0); a computed value, even one EF Core could
+    translate, leaves it unordered, and the guarded `Select` composed afterwards never takes it.
+    A default field the caller may not order by is left out without an error. End every
     order meant for paging with a unique field, such as the key.
 38. **A `[DwEntity]` on a derived type replaces its base type's.** The attribute allows one per type, and .NET
     inheritance hands a derived type its own when it declares one, so the base type's `RequirePolicy` and
@@ -4580,6 +4774,104 @@ MemoryCalculationInput
 ### History
 
 ```
+3.2.0   A projected row keeps its members, denials the gate could not see are enforced, a default order that
+        reaches projected rows, and a CancellationToken on every async terminal. The security fixes refuse or
+        withhold what 3.1.0 returned; the bullets marked "Behaviour change" also change what a correct query
+        returns; and one call form stops compiling (the token bullet).
+        - Security fix and behaviour change. With no Selects, a field denied for Select only beneath a member, none at
+          the top of T, synthesized no projection, so the whole row came back with the denied value in it: in a list or
+          nested object of a row projected before ApplyPolicy, in a row in memory, and in an entity's included,
+          automatically included, lazily loaded or owned member. Such a denial now synthesizes the projection when its
+          value can reach the result, in both tiers, typed and dynamic, for a Filter and a Segment. On an entity that
+          means beneath a column, an owned or complex member, or a navigation the query loads; a denial beneath a
+          navigation nothing loads never leaves the database, and the entity is read as in 3.1.0.
+        - Security fix. Where the query hides what loads, every navigation now counts as loaded: an include named from
+          the root and re-rooted by Select(o => o.Customer), SelectMany or Join, which EF Core still applies, and a
+          projection behind another Select (an identity Select, a member of an anonymous row, a conditional). So does
+          a lazy loader the constructor takes, delegate or ILazyLoader, kept in a field or a property of any name, and
+          an initializer after a constructor with arguments counts every member as assigned. So do an injected
+          DbContext and EF Core 7's asynchronous loader delegate. So does a reshaped chain whose lambda hands its rows
+          an object an application's method returns from the row, or one it captured: another query with its own
+          include or projection, or an object in memory. Each returned the denied value. A reshaped chain with none of
+          these is still read from the model, so it is not projected for a denial beneath a navigation it does not
+          load. A specification, a repository's query, FromSql and a context's Set through an interface are evaluated
+          as EF Core evaluates them, a context's query function is a query root, and an anonymous object carrying
+          range variables or a composite key, or a value that only feeds a predicate or a key, builds nothing.
+        - Security fix. A guarded query through a provider that wraps EF Core's, LinqKit's AsExpandable or
+          DelegateDecompiler's Decompile, ran tracking: EF Core's AsNoTracking hands such a query back unchanged. The
+          rows' navigations were then filled from entities the context already tracked, the denied ones included,
+          and a masked value became a pending change the next SaveChanges would write. AsNoTracking now goes into the
+          query itself.
+        - Security fix and behaviour change. A member declared as a base type or an interface holds its subtypes,
+          whose denied fields the declared type never names. They are read now: the types the EF Core model derives,
+          for an entity, and every loaded subtype for a projected or in-memory row, an open generic one and an
+          application's subclass of a framework class included. A query over the root of a hierarchy whose derived
+          type declares a denied field, an included or named base-typed navigation, a base-typed member of a row, and
+          a projection constructing a subtype of T, all returned it. Such rows are projected to T and such members
+          narrowed to the declared type, which drops the subtype's fields, allowed ones too. Over an abstract T the
+          typed terminals then fail with SelectTypeMustHaveParameterlessConstructor, as for any T they cannot build;
+          the dynamic terminals return the root's allowed members. A rule on a subtype's field through a base-typed
+          member was dropped as naming nothing; it is enforced.
+        - Security fix. A deny-family attribute on an override, on a public member a subtype hides with new, on the
+          implementation of an interface member (through a variant instantiation too), or on the interface member a
+          class implements, was read only from its own declaration, so the base type's or the interface's path
+          filtered, sorted, grouped and returned the value. It applies to the path now.
+        - Security fix. Under a "*" deny with exact allows, a path the walk never asked about (past four segments,
+          around a cycle, with no setter, on a subtype) resolved as allowed, so a member holding one was returned
+          whole, named or not. Each such path is asked of the policy now; one it does not name is denied, and a
+          member holding one is refused, narrowed or projected as one with a denial beneath it is.
+        - Security fix. A field denied at the top of T whose type is not a simple value (a blob, a list, an owned
+          object or a JSON column, say) synthesized no projection either, so with nothing else denied it came back.
+        - Security fix. The attribute walker read any namespace starting with "System" as the framework's, so an
+          application's SystemsCorp.Payroll got no fragment beneath its types, and a [DwDenied] field there was
+          returned, filterable and sortable. Only System and the namespaces beneath it are the framework's now.
+        - Security fix. Under Convenience, Selects naming a navigation whose element key (Id) is denied narrowed the
+          key away, and the core's typed projection added it back. Such a narrowing is refused with
+          FieldDeniedForSelect in both tiers, as naming a sibling of the key already was. A navigation named through
+          another, Main.Lead, now gates Main's key, which the builder adds; it did not.
+        - Security fix. Selects naming a member typed as a collection the core does not unwrap (IReadOnlyList<T>,
+          IReadOnlyCollection<T>, Collection<T> or an application's own) returned every field beneath it, denied ones
+          included, in both tiers: the projection gate read collections through a narrower list than the attribute
+          walker. It reads them as the walker does, and a narrowing the core cannot project is refused.
+        - Security fix. Selects naming a member that carries a field denied for Select no path names returned it:
+          deeper than four segments, inside a framework generic such as Dictionary<string, T>, or, on a named entity
+          navigation, in its owned chain or a converted column. What a member carries is read from the source, from
+          the EF Core model for an entity. Strict refuses it; Convenience narrows it where the core can, and refuses it
+          where it cannot. A denied property with no setter, and a rule on a path reached through a cycle, are found
+          beneath a named member too.
+        - Behaviour change. The synthesized projection keeps what the source carries. A row a projection builds keeps
+          its assigned nested objects and lists; an entity keeps its columns, converted and JSON ones included, and its
+          owned and complex members, and every member holding a collection of simple values (byte[], List<string>). In
+          3.1.0 all of these came back null or empty whenever a field was denied. A member is kept whole when nothing
+          it can hold is denied, narrowed around a denial where the core's narrowing translates, and otherwise left out
+          whole with a "left out whole" Dropped decision. An entity's navigations and the objects of a row in memory
+          are left out, as before, and each one the unguarded call would have returned is recorded as Dropped; a
+          value EF Core does not map is left out too. A member that can hold an object of any type, a geometry or a
+          JSON bag say, asks for no projection on its own, and an entity keeps it whole, unless a value converter
+          hands back its value, directly or inside a complex property: a converter is the application's code, so
+          such a column is left out. BitArray and the framework's string collections hold values. An application's
+          own collection class, generic or not, has its own members read; a collection of values stays a value unless
+          one of them is denied. Two members sharing a name, one hidden with new under another type or spelled in
+          another case, are left out when either holds a denial, since the core reads one and a row carries both.
+          Rows in memory are projected when a member a base type declares, and the row type hides with new, is
+          denied. A projected member is read as the type its initializer constructs, and an
+          initializer after a constructor with arguments narrows its own bindings. The trace records a member left
+          out only when a projection is built, or, in a dry run, would be.
+        - Behaviour change. [DwEntity(DefaultOrder)] applies to a projected source whose outermost Select builds T
+          in an object initializer assigning every field the default names a column: a mapped member, read directly,
+          through reference navigations or through EF.Property. A computed value or any other projection still leaves
+          the query in its own order. A Select, or a Filter with Selects, composed on the guarded handle keeps the rest
+          of the chain unordered. A composed Filter that sent orders gets no default later in the chain, as a composed
+          Order already did not.
+        - Every async terminal has overloads taking a CancellationToken, guarded and unguarded: ToListAsync and
+          ToListAsyncDynamic with a Filter, ToListAsync with a Summary, and ToListAsync with a Segment. The 3.1
+          signatures are unchanged, so code compiled against 3.1 still binds. The token reaches the count and the
+          read. ToListAsync(filter, default) no longer compiles, since default fits both bool and CancellationToken,
+          and a reflection lookup of one of these methods by name alone finds more overloads than it did.
+        - Behaviour change. The async Summary counts through EF Core's CountAsync, where it counted synchronously, and
+          it and ToListAsyncDynamic read through EF Core's ToListAsync instead of Dynamic LINQ's ToDynamicListAsync,
+          so on an EF Core query a canceled token reaches the database. A provider that is not EF Core's keeps Dynamic
+          LINQ's read, on the calling thread.
 3.1.0   Dates rebuilt, segments combined in the database, five new caps, two new error codes, preparation enforced,
         a strict tier that discloses less, declared default orders, forced predicates that admit null, audited
         refusals, and long In lists that no longer end the process. The eleven bullets marked "Behaviour change"
@@ -4733,7 +5025,59 @@ MemoryCalculationInput
 - Enum filtering works whether the column stores names or numbers: the parser converts the name to the enum value
   before EF Core translates it. `Contains` / `StartsWith` / `EndsWith` work only on string members.
 - Cache configuration changes are eventually consistent: calls already running finish with the options they read.
-- Nothing accepts a `CancellationToken`.
+- With no `Selects`, a guarded query over an entity leaves out every navigation EF Core does not own once a denial
+  needs a projection (section 17), an included one too. Under Convenience, name the navigation in `Selects` to get
+  it narrowed; under Strict, name its allowed fields.
+- A forced scope declared on a list's element type filters the rows that hold the list, never its elements. Selects
+  naming the list returns every element, those the scope excludes included, as in every release; a synthesized
+  projection leaves such a list out. Scope the elements where the row is built.
+- A member typed `object`, a framework interface or a collection that is not generic (`IEnumerable`, `ArrayList`,
+  `Array`, an application's own) is opaque to the policy. It never asks for a projection; when one is needed anyway,
+  a projected row, a row in memory, and an entity's converted column leave it out, and an entity's other columns
+  keep it (what EF Core materializes itself holds no application object); and naming it
+  returns whatever it holds. A converted column counts as able to hold anything when its type can: `object`, a
+  `Dictionary<string, object>`, or a type with such a member. `BitArray`, `StringCollection`, `StringDictionary` and
+  `NameValueCollection` hold values. A value converter that returns an application type through a column typed
+  `object`, and an unmapped getter typed `object` over a private navigation, are opaque the same way: with nothing
+  else denied the row comes back as loaded. Type the member as what it holds.
+  A framework generic holding a policed type (`Dictionary<string, LineDto>`) has no paths beneath it: naming it is
+  refused in both tiers where the core cannot narrow it (at the top of T, or on a row in memory), narrowed away
+  under Convenience beneath a navigation, and a synthesized projection leaves it out.
+- A projection builds the declared type. A query over the root of a hierarchy whose derived type declares a denied
+  field comes back as root-type rows, the derived types' allowed fields dropped too; over an abstract root the typed
+  terminals fail with `SelectTypeMustHaveParameterlessConstructor` and the dynamic ones return the root's members.
+  Query the derived type (`OfType<T>()`) to keep its fields. Subtypes are read from the assemblies loaded
+  when the query runs, which hold every type a row can have.
+- Under a `"*"` deny, a member is kept whole only when every path beneath it the walk skips, one with no setter,
+  on a subtype or past four segments, is one the policy names; around a cycle it never is. Otherwise it is
+  narrowed, left out or refused.
+- A member EF Core does not map counts as loaded and is read as its type, since its getter can hand out what EF
+  Core loaded: a denied field in its type asks for a projection, which leaves the member out, since the projection
+  cannot assign it. A getter that copies a denied column into a type with no denial is the application's to
+  withhold.
+- Rows in memory can be any loaded subtype, and the policy does not look at the rows. When a subtype of T declares
+  a denied field, or a subtype or implementation of a member's type does, the rows are projected and their objects
+  left out, even if no row is that subtype.
+- A deny-family attribute on an override, or on a member a subtype hides with `new`, denies the base path for every
+  subtype loaded, not only those the EF Core model maps: a view model deriving from an entity and overriding one of
+  its members decides the entity's own path. Declare such a class apart from the entity to keep the path open.
+- Types from an unloadable `AssemblyLoadContext` stay referenced by the policy's caches, so the context is not
+  collected while the process runs.
+- A method or property in a reshaping lambda that builds a query from captured values (a repository's query, a
+  specification) runs once more per guarded read, when the guard reads what it returns; one that returns a different
+  query on each call is enforced as it answered the guard.
+- A provider that wraps EF Core's gets `AsNoTracking` only when its query's expression shows the EF Core root, as
+  LinqKit's and DelegateDecompiler's do; one that hides it behind its own expression runs tracking.
+- A member declared as a framework collection (`IEnumerable<string>`, `List<string>`) that holds an application's own
+  collection class at run time is read as the framework type, so that class's own members are not read. Serializers
+  write only the elements.
+- On EF Core 6, a reshaped query whose projection EF Core 6 cannot translate (a count over `GroupBy`/`First`, a
+  `SelectMany` over a captured query that builds its rows) fails guarded, where it ran unguarded; EF Core 7 and later
+  translate it.
+- A default order reaches a projected row only through columns of the entity its `Select` reads: a projection over
+  an anonymous or other intermediate row takes no default.
+- A simulation reads T as a source it cannot see into (section 23): every denial beneath a member counts, and a
+  synthesized `Clause.Selects` keeps only members holding a value.
 
 ---
 
diff --git a/README.md b/README.md
index 664106e..663e9fe 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ Stop concatenating LINQ predicates by hand. Your front-end sends one JSON shape;
 
 - **JSON in → `IQueryable<T>` out.** No string LINQ. No manual expression trees.
 - **Three composable shapes** — `Filter`, `Segment`, `Summary` — cover where, set operations, and group-by reporting.
-- **Twenty-one extension methods** on `IQueryable<T>` and `IEnumerable<T>`.
+- **Twenty-eight extension methods** on `IQueryable<T>` and `IEnumerable<T>`, every async one with overloads that take a `CancellationToken`.
 - **Nested navigation** through references and collections, with auto-wrapped `.Any()` lambdas where needed.
 - **Heterogeneous `Condition.Values`** — pass raw numbers, booleans, strings; normalized per `DataType`.
 - **Thread-safe reflection cache** with FIFO / LRU / LFU eviction and five tuned presets.
@@ -47,13 +47,13 @@ Stop concatenating LINQ predicates by hand. Your front-end sends one JSON shape;
 ## Install
 
 ```bash
-dotnet add package DynamicWhere.ex --version 3.1.0
+dotnet add package DynamicWhere.ex --version 3.2.0
 ```
 
 Or via Package Manager:
 
 ```powershell
-Install-Package DynamicWhere.ex -Version 3.1.0
+Install-Package DynamicWhere.ex -Version 3.2.0
 ```
 
 Dependencies (restored automatically):
@@ -140,7 +140,7 @@ That's the whole loop. Full walk-through in **[Quick Start](https://doc.dynamicw
 | **[`Segment`](https://doc.dynamicwhere.com/docs/classes/segment)** | set1 ∪/∩/∖ set2 ∪/∩/∖ set3 → order → page | UNION / INTERSECT / EXCEPT across multiple condition sets |
 | **[`Summary`](https://doc.dynamicwhere.com/docs/classes/summary)** | where → group → having → order → page | Aggregate reporting (`GROUP BY` + `SUM` / `AVG` / `COUNT` …) |
 
-### Twenty-one extension methods
+### Twenty-eight extension methods
 
 Projection, filtering, composition, and materialization on `IQueryable<T>` and `IEnumerable<T>`:
 
@@ -151,6 +151,8 @@ Projection, filtering, composition, and materialization on `IQueryable<T>` and `
 | **Composition** | `.Order<T>` · `.Page<T>` · `.Group<T>` · `.Filter<T>` · `.FilterDynamic<T>` · `.Summary<T>` |
 | **Materialization** | `.ToList<T>(Filter)` · `.ToListAsync<T>(Filter)` · `.ToListDynamic<T>(Filter)` · `.ToListAsyncDynamic<T>(Filter)` · `.ToList<T>(Summary)` · `.ToListAsync<T>(Summary)` · `.ToListAsync<T>(Segment)` |
 
+Every async terminal also has overloads that take a `CancellationToken`, which reaches the count and the read. `ToList(Filter)`, `ToListDynamic(Filter)` and `ToList(Summary)` also run on an `IEnumerable<T>`.
+
 Full signatures, validations, and return types → **[Extension Methods Reference](https://doc.dynamicwhere.com/docs/extensions)**.
 
 ### Operators & data types
@@ -363,7 +365,7 @@ The complete reference — every enum, class, extension method, validation rule,
 | [Getting Started](https://doc.dynamicwhere.com/docs)              | Introduction, installation, quick start |
 | [Enums](https://doc.dynamicwhere.com/docs/enums)                  | Every DataType, Operator, Connector, Direction, Intersection, Aggregator, Cache enum |
 | [Classes](https://doc.dynamicwhere.com/docs/classes)              | Condition, ConditionGroup, ConditionSet, OrderBy, GroupBy, AggregateBy, PageBy, Filter, Segment, Summary, Result types |
-| [Extension Methods](https://doc.dynamicwhere.com/docs/extensions) | All 17 methods with signatures, validations, examples |
+| [Extension Methods](https://doc.dynamicwhere.com/docs/extensions) | All 28 methods with signatures, validations, examples |
 | [Validation Rules](https://doc.dynamicwhere.com/docs/validation)  | What's checked and what throws |
 | [JSON Cookbook](https://doc.dynamicwhere.com/docs/examples)       | 13 copy-pasteable end-to-end examples |
 | [Field-Level Policies](https://doc.dynamicwhere.com/docs/policies) | Attributes, precedence, masking, dynamic rules, admin API, k-anonymity |
@@ -373,6 +375,22 @@ The complete reference — every enum, class, extension method, validation rule,
 
 ---
 
+## Version 3.2.0 highlights
+
+**Upgrade note — the security fixes and the three changes alter what code written for 3.1.0 does, and the new overloads can stop a call from compiling. Read these before bumping.**
+
+- **Fixed (security): a field denied beneath a member reached a caller who sent no `Selects`.** A guarded query synthesizes a projection for a denied field, and it did so only when a simple field at the top of the type was denied. With every denial beneath a member, the whole row came back with the denied value in it: in a list or nested object of a row projected before `ApplyPolicy`, in a row held in memory, and in an entity's included, automatically included, lazily loaded or owned member — typed and dynamic, in both tiers, for a `Filter` and a `Segment`. Such a denial now synthesizes the projection whenever its value can reach the result. On an entity that means beneath a column, an owned or complex member, or a navigation the query loads through `Include`, an automatic include or a lazy loader. A denial beneath a navigation nothing loads never leaves the database, and the entity is read exactly as before.
+- **Fixed (security): what a query loads, and what a member holds, was read too narrowly.** An include named from the root and reached through `Select(o => o.Customer)`, `SelectMany` or `Join`, a projection behind another `Select`, an initializer after a constructor with arguments, and a lazy loader the constructor takes and keeps in a field or any property each loaded a denied value the gate read as unloaded. An injected `DbContext` and EF Core 7's asynchronous loader delegate loaded one too, and so did a reshaping lambda that got its row from an application's method or from a captured query or object. An application's own collection class hid its own denied members, and a guarded query through a provider wrapping EF Core's, such as LinqKit's `AsExpandable`, ran tracking, so the context filled in navigations it already held and a masked value became a pending change. A field a subtype declares — a derived entity's, a subclass's held by a base-typed member, an open generic one's — was not read at all, nor was a `[DwDenied]` on an override, on a member hidden with `new` or on an interface member's implementation, and under a `"*"` deny with exact allows a path the walk never asked about (past four segments, around a cycle, with no setter) resolved as allowed. `Selects` naming an entity navigation returned a denial in its owned chain past four segments or in a converted `Dictionary<string, T>` column. All of these are read now: from the EF Core model for an entity, so only what loads counts, and from every loaded subtype for a projected or in-memory row. A denial on an override, a public member hidden with `new` or an implementation, through a variant instantiation too, applies to the base type's or the interface's path, on every row and in every clause.
+- **Fixed (security): a denied member that holds no simple value came back.** A field denied at the top of the type whose own type is not a simple value — a byte array, a list, an owned object, a JSON column — synthesized no projection either, so with nothing else denied it came back.
+- **Fixed (security): an application namespace starting with `System` got no policy.** The attribute walker read any namespace starting with "System" as the framework's, so an application namespace such as `SystemsCorp.Payroll` got no policy beneath its types, and a `[DwDenied]` field there was returned, filterable and sortable. Only `System` and the namespaces beneath it are the framework's now.
+- **Fixed (security): a navigation narrowed around its own denied key got the key back.** Under the convenience tier, `Selects` naming a navigation whose key (`Id`) is denied was narrowed to the allowed fields beneath it, and the core's typed projection added the key back. Such a narrowing is refused with `FieldDeniedForSelect` in both tiers, as naming a sibling of the key already was. A navigation named through another, such as `Main.Lead`, now gates the key of `Main`, which the projection adds; it did not.
+- **Fixed (security): `Selects` could name a member whose denials the gate did not see.** A member typed as a collection the core does not unwrap — `IReadOnlyList<T>`, `IReadOnlyCollection<T>`, `Collection<T>` or an application's own — returned every field beneath it, denied ones included, in both tiers, because the projection gate read collections through a narrower list than the attribute walker. It reads them the same way now, and a narrowing the core cannot project is refused with `FieldDeniedForSelect`. Denials beneath a named member are also read from the policy's own rules, so a denied property with no setter and a rule on a path reached through a cycle are found. A member carrying a field denied where no path reaches it — deeper than the walker, inside a framework collection such as `Dictionary<string, T>`, or on a subtype — is refused under the strict tier, and under the convenience tier narrowed where the core can narrow it and refused where it cannot.
+- **Changed: the synthesized projection keeps what the source carries.** It kept simple fields only, so every nested object and list of a row projected before `ApplyPolicy` came back null or empty as soon as any field was denied. A row a projection builds — the outermost `Select` constructs it, in an object initializer or with a constructor, as in `db.Roles.Select(r => new RoleRow { … })` — keeps the members its initializer assigns. An entity, or a `Select` that hands back an entity such as `db.Orders.Select(o => o.Customer)`, keeps its mapped columns, converted and JSON ones included except a converted one that can hold an object of any type, its owned and complex members, and every collection of simple values such as `byte[]` or `List<string>`. A member holding an object is kept whole when nothing it can hold is denied, narrowed to the allowed fields where the core's narrowing translates, and otherwise left out whole, recorded as `Dropped` with a reason starting `left out whole`. An entity's navigations, the objects of a row in memory, and a value EF Core does not map are left out, and the type needs a public parameterless constructor for the typed projection, as it already did. When a derived type in the model, or a loaded subclass of a row in memory, declares a denied field, the rows come back as the queried type, so a derived type's allowed fields are dropped too; query the derived type with `OfType<T>()` to keep them. A member that can hold an object of any type, a geometry or a JSON bag say, asks for no projection on its own, and a chain that reaches its rows through a navigation, `SelectMany`, `Join` or `GroupBy` counts every navigation as loaded only when it has an include, or a lambda that builds an object, gets one from an application's method, or captures a query with its own include or projection.
+- **Changed: `[DwEntity(DefaultOrder)]` reaches a projection that builds the row.** A guarded query over a projected source takes the default when the outermost `Select` builds the type in an object initializer and assigns every field the default names a column, at every level of a nested path — a mapped member read directly, through reference navigations or through `EF.Property`: `Select(t => new TicketRow { Id = t.Id, CreatedAt = t.CreatedAt })` for `"CreatedAt desc, Id"`. A computed value or any other projection still leaves the query in its own order. A `Select`, or a `Filter` with `Selects`, composed on the guarded handle keeps the rest of the chain unordered, and a composed `Filter` that sent orders gets no default later in the chain, as a composed `Order` already did not.
+- **Changed: the async dynamic `Filter` and the async `Summary` read through EF Core.** `ToListAsyncDynamic` and `ToListAsync(Summary)` read with EF Core's `ToListAsync` instead of Dynamic LINQ's `ToDynamicListAsync`, which had no token to pass on, and the summary counts with `CountAsync` where it counted synchronously. So on an EF Core query a canceled token now reaches the database. A provider that is not EF Core's keeps Dynamic LINQ's read, on the calling thread.
+- **New: a `CancellationToken` on every async terminal**, guarded and unguarded: `ToListAsync` and `ToListAsyncDynamic` with a `Filter`, `ToListAsync` with a `Summary`, and `ToListAsync` with a `Segment`. The token reaches the count and the read. The overloads sit beside the 3.1 signatures, which are unchanged, so code compiled against 3.1 still binds. `ToListAsync(filter, default)`, `ToListAsyncDynamic(filter, default)` and `ToListAsync(summary, default)` no longer compile, because `default` fits both `getQueryString` and the token: write `false`, a token, or a named argument. A reflection lookup of `ToListAsyncDynamic` by name alone now finds three methods where it found one, and one of `ToListAsync` finds more than it did.
+- **Known limits.** Once a projection is needed, an entity's navigations are left out, included ones too; under the convenience tier name one in `Selects` to get it narrowed, and under the strict tier name its allowed fields. A forced scope declared on a list's element type filters the rows that hold the list, never its elements, so `Selects` naming the list returns every element and a synthesized projection leaves the list out; scope the elements where the row is built. A member typed `object`, a framework interface or a collection that is not generic (`IEnumerable`, `ArrayList`) is opaque to the policy, and a framework generic holding a policed type, such as `Dictionary<string, LineDto>`, has no paths beneath it: hold such values in a list of the policed type. A member EF Core does not map is read as its type, since its getter can hand out what EF Core loaded. Rows in memory can be any loaded subtype, so they are projected whenever one declares a denied field. A denial on an override or a `new` member counts for every loaded subtype, a class EF Core does not map included. A repository or specification method in a reshaping lambda runs once more per guarded read, and on EF Core 6 a reshaped query whose projection EF Core 6 cannot translate fails guarded where it ran unguarded. `/simulate` has no source, so it reads the type as one it cannot see into: every denial beneath a member counts, and the projection it shows keeps only members holding a value.
+
 ## Version 3.1.0 highlights
 
 **Upgrade note — eleven behaviour changes, listed first. Read these before bumping.**
diff --git a/build/check-version.ps1 b/build/check-version.ps1
index 311f68f..7d5e900 100644
--- a/build/check-version.ps1
+++ b/build/check-version.ps1
@@ -103,10 +103,10 @@ $targets = [ordered]@{
         "Version ($semver) . targets net6\.0",
         "DynamicWhere\.ex --version ($semver)"
     )
-    # The page that serves that reference says which version it was generated against, in prose
+    # The page that serves that reference says which version it was written against, in prose
     # none of the patterns above reach.
     'OfficialWebsite/app/docs/ai/page.tsx' = @(
-        "generated against version ($semver)"
+        "written against version ($semver)"
     )
 }