@@ -182,7 +182,9 @@
         ],
         "owned-records": [
           "the_owned_record_wipes_sealed_fields_and_moves_passthrough_fields",
-          "the_owned_record_wipes_sealed_fields_when_the_context_is_refused"
+          "the_owned_record_wipes_sealed_fields_when_the_context_is_refused",
+          "a_panicking_field_declaration_wipes_the_sealed_fields_after_it",
+          "a_declaration_that_panics_while_constructed_wipes_the_plaintext"
         ],
         "guest-abi": [
           "buffers::tests::wipe_all_leaves_no_live_buffer",
 
@@ -102,9 +102,11 @@ carrying it through: the owned conversion destructures the struct, and a
 field it does neither would be dropped unwiped, so it is refused at the
 `struct = ..` path ("pattern does not mention field"). For the same reason
 the plaintext struct cannot implement `Drop` (so not `ZeroizeOnDrop`
-either): a type with a destructor cannot be destructured. On decryption a
-field opened before a later field is refused is wiped, not dropped as it
-is.
+either): a type with a destructor cannot be destructured. A field's
+declaration that panics wipes the sealed fields not yet handed to their
+own declarations, and a record's declaration that panics while it is
+constructed wipes the whole plaintext. On decryption a field opened before
+a later field is refused is wiped, not dropped as it is.
 
 A `plaintext` record's fields are all handed the one context the record
 requires, so a term beside an `AeadContext`-only record is refused at the
 
@@ -204,15 +204,20 @@ fn struct_derive(input: &DeriveInput, record: &Record) -> TokenStream {
         [first, rest @ ..] => {
             // `rest` as one description over the nested tuple of its parts,
             // divided by identity; then the struct divided into `first` and
-            // that tuple.
+            // that tuple. Each `split` is told how to wipe the parts still
+            // waiting for their descriptions, should an earlier field's
+            // description panic.
             let mut tail = {
                 let last = rest[rest.len() - 1];
                 quote!(#last)
             };
-            for local in rest[..rest.len() - 1].iter().rev() {
-                tail = quote!(#local.split(#tail, |__parts| __parts));
+            for index in (1..locals.len() - 1).rev() {
+                let local = locals[index];
+                let wipe = wipe_waiting(krate, &fields[index + 1..]);
+                tail = quote!(#local.split(#tail, |__parts| __parts, #wipe));
             }
-            quote!(#first.split(#tail, #divide))
+            let wipe = wipe_waiting(krate, &fields[1..]);
+            quote!(#first.split(#tail, #divide, #wipe))
         }
         [] => unreachable!("a record has a derived field"),
     };
@@ -251,6 +256,37 @@ fn struct_derive(input: &DeriveInput, record: &Record) -> TokenStream {
     quote!(#encrypt_target #bridge)
 }
 
+/// The `wipe` a `split` is handed for the parts still waiting, the nested
+/// tuple of `waiting`: every sealed field in it wiped, every passthrough
+/// field left as it is. A sealed field's plaintext is `Zeroize` already, as
+/// every `EncryptTarget` source is, so this adds no bound; a passthrough
+/// field is stored in the clear and takes none.
+fn wipe_waiting(krate: &syn::Path, waiting: &[&Field]) -> TokenStream {
+    let mut wipes = Vec::new();
+    let mut base = quote!((*__parts));
+    for (index, field) in waiting.iter().enumerate() {
+        let last = index == waiting.len() - 1;
+        let place = if last {
+            base.clone()
+        } else {
+            let first = syn::Index::from(0);
+            quote!(#base.#first)
+        };
+        if field.is_derived() {
+            wipes.push(quote!(#krate::target::Zeroize::zeroize(&mut #place);));
+        }
+        if !last {
+            let rest = syn::Index::from(1);
+            base = quote!(#base.#rest);
+        }
+    }
+    if wipes.is_empty() {
+        quote!(|_| {})
+    } else {
+        quote!(|__parts| { #(#wipes)* })
+    }
+}
+
 /// The nested tuple `(a, (b, (c, d)))` of the locals: how `split` divides
 /// a struct, one part per step.
 fn nested_tuple(locals: &[&Ident]) -> TokenStream {
 
@@ -66,7 +66,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   the pending is returned; `EncryptInto` and the owned column run it. A
   record overrides it to divide the struct between its fields with the new
   `Encryption::split` (two descriptions over two parts of one value, one
-  context) and `Encryption::project_owned`. `indexes` is what a plan field
+  context, and a `wipe` for the part that waits while the first part's
+  description runs, called if that description panics) and
+  `Encryption::project_owned`. `EncryptInto` guards the plaintext until the
+  declaration and its context have been constructed, so a declaration that
+  panics while it is constructed wipes it. `indexes` is what a plan field
   typed with the target answers queries by; the terms, `Encrypted<Terms>`
   and `plaintext` records report theirs.
 - **The core leaves implement the owned declarations**: `StackCipherText`
 
@@ -54,6 +54,20 @@ function pointer that destructures the struct: it captures nothing, so like
 the accepted plaintext-ownership rule made mechanical: the conversion wipes
 what it seals and transfers what the caller chose to keep in the clear.
 
+Each `split` runs its first part's description while the other part waits,
+and it is handed a `wipe` for that waiting part. If the first description
+panics (a declaration's selector, say), the waiting part goes to `wipe`
+during the unwind rather than being dropped as it is, as an owned column's
+unvisited elements are. The derive writes each `wipe` to zeroize the sealed
+fields still waiting and to leave the passthrough ones. A sealed field's
+plaintext is `Zeroize` already, as every `EncryptTarget` source is, so this
+adds no bound, and a passthrough field, stored in the clear, takes none. A
+`Zeroize` bound on `split`'s waiting part would have done the same work,
+but it would have fallen on passthrough field types too. `EncryptInto`
+holds the whole plaintext in a `Protected` guard until the declaration and
+its context exist, so a declaration that panics while it is constructed
+wipes the plaintext too.
+
 The destructure is exhaustive. The owned form replaces the guard over the
 whole value, so a plaintext field the record neither seals nor carries
 would be dropped unwiped; it is a compile error at the `struct = ..` path
 
@@ -416,23 +416,65 @@ impl<'s, S: 's, T: 'static, K: 'static, Ctx: 's> Encryption<'s, S, T, K, Ctx, Ow
     /// nesting a `split` per field, so a passthrough field is moved into
     /// the output and never copied, and a sealed field is guarded by its own
     /// target's description. Nothing is cloned, so `P` need not be `Clone`.
+    ///
+    /// `self` runs first while `other`'s part waits, and `wipe` is what
+    /// keeps that part safe meanwhile: if `self`'s description panics
+    /// before `other` has received its part, the part is handed to `wipe`
+    /// during the unwind instead of being dropped as it is. `wipe` wipes
+    /// what `other` seals and leaves what it stores in the clear, so a part
+    /// that is all passthrough takes `|_| {}`, and no `Zeroize` bound falls
+    /// on a part that is not sealed. Once `other` has its part, wiping it is
+    /// `other`'s responsibility, as it is for any owned source.
     pub fn split<P: 's, U: 's, V: 'static>(
         self,
         other: Encryption<'s, U, V, K, Ctx, Owned>,
         divide: fn(P) -> (S, U),
+        wipe: fn(&mut U),
     ) -> Encryption<'s, P, (T, V), K, Ctx, Owned>
     where
         Ctx: Clone,
     {
         Encryption {
-            build: Box::new(move |source, cipher, cx| {
+            build: Box::new(move |source, cipher, cx: Ctx| {
+                let first_cx = cx.clone();
                 let (mine, theirs) = divide(source);
-                (self.build)(mine, cipher, cx.clone()).zip((other.build)(theirs, cipher, cx))
+                let waiting = Waiting {
+                    part: Some(theirs),
+                    wipe,
+                };
+                let first = (self.build)(mine, cipher, first_cx);
+                first.zip((other.build)(waiting.hand_over(), cipher, cx))
             }),
         }
     }
 }
 
+/// The part of a [`split`](Encryption::split) value that waits while the
+/// other part's description runs. Dropped before
+/// [`hand_over`](Self::hand_over), by an unwind out of that description, it
+/// hands the part to `wipe`.
+struct Waiting<U> {
+    part: Option<U>,
+    wipe: fn(&mut U),
+}
+
+impl<U> Waiting<U> {
+    /// The description before it returned: the part goes to its own.
+    fn hand_over(mut self) -> U {
+        self.part
+            .take()
+            .unwrap_or_else(|| unreachable!("a waiting part is handed over once"))
+    }
+}
+
+impl<U> Drop for Waiting<U> {
+    fn drop(&mut self) {
+        if let Some(part) = self.part.as_mut() {
+            (self.wipe)(part);
+        }
+    }
+}
+
 /// A description whose operation is chosen by the value it is handed, at
 /// the moment it runs: `choose` sees the source, the keyset cipher and the
 /// context, and returns the pending of whichever typed operation applies.
 
@@ -371,6 +371,61 @@ impl Decryptable for FlaggedCiphertext {
     const DECRYPTABLE: bool = false;
 }
 
+#[derive(Zeroize)]
+struct Trio {
+    first: Flagged,
+    #[zeroize(skip)]
+    handle: u64,
+    third: Flagged,
+    fourth: Flagged,
+}
+// Only encrypted, and never completed: its fields are never read.
+#[allow(dead_code)]
+#[derive(EncryptTarget)]
+#[stash(struct = Trio, context = "trios")]
+struct EncryptedTrio {
+    first: FlaggedCiphertext,
+    #[stash(passthrough)]
+    handle: u64,
+    third: FlaggedCiphertext,
+    fourth: FlaggedCiphertext,
+}
+
+#[tokio::test]
+async fn a_panicking_field_declaration_wipes_the_sealed_fields_after_it() {
+    let cipher = common::stack_cipher().await;
+    let keyset = cipher.default_keyset();
+    // The outer `split` (the first field panics, the rest wait as one part)
+    // and a nested one (the third panics, the fourth waits on its own).
+    for panicking in ["first", "third"] {
+        let value = |field: &'static str| if field == panicking { "panics" } else { field };
+        let (first, first_wiped) = flagged(value("first"));
+        let (third, third_wiped) = flagged(value("third"));
+        let (fourth, fourth_wiped) = flagged(value("fourth"));
+        let trio = Trio {
+            first,
+            handle: 7,
+            third,
+            fourth,
+        };
+        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            drop(trio.encrypt_into::<EncryptedTrio, _>(&keyset));
+        }));
+        assert!(
+            result.is_err(),
+            "the {panicking} field's declaration panicked"
+        );
+        assert!(
+            first_wiped.load(Ordering::SeqCst) && third_wiped.load(Ordering::SeqCst),
+            "the fields handed over are wiped by their own guards ({panicking} panicked)"
+        );
+        assert!(
+            fourth_wiped.load(Ordering::SeqCst),
+            "the sealed fields not yet handed over are wiped during the unwind ({panicking} panicked)"
+        );
+    }
+}
+
 /// Seals a `Flagged` through a declaration whose construction panics: what
 /// `encrypt_into` is holding then is the plaintext alone.
 struct UnconstructedCiphertext(#[allow(dead_code)] Ciphertext);