@@ -155,6 +155,20 @@ func TestRunAsksTheEmbeddedEngine(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(dir, "user_stash.go")); !os.IsNotExist(err) {
 		t.Fatal("a file was written after the engine refused")
 	}
+	// A context of two segments leaves an EQL field no column: refused by
+	// name, before the engine is asked, and nothing written.
+	deep := strings.Replace(userSource, "context=users", "context=app/users", 1)
+	dir = writeModule(t, map[string]string{"model.go": deep})
+	stderr.Reset()
+	if code := run([]string{"-type", "User"}, dir, &stdout, &stderr, stashgen.GuestEngine); code != 1 {
+		t.Fatalf("exit %d, want 1\n%s", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "User.Email") || !strings.Contains(stderr.String(), `"app/users" has 2 segments`) {
+		t.Fatalf("stderr = %q", stderr.String())
+	}
+	if _, err := os.Stat(filepath.Join(dir, "user_stash.go")); !os.IsNotExist(err) {
+		t.Fatal("a file was written after the refusal")
+	}
 	// Separate columns, as before.
 	columns := strings.Replace(userSource, "encrypt_into=TextEq", "encrypt,index=equality;match", 1)
 	dir = writeModule(t, map[string]string{"model.go": columns})
 
@@ -227,6 +227,16 @@ func (p *Plan) Validate() error {
 			if len(f.Outputs) != 0 {
 				return fmt.Errorf("record: field %q names the EQL type %s and outputs; a field has one or the other", f.Name, f.Target)
 			}
+			// An EQL value is stored under a table and a column: the
+			// context is the table, the identity the column. The engine
+			// refuses anything else when the plan is built; saying it here
+			// names the field before the guest is asked.
+			if len(p.Context) != 1 {
+				return fmt.Errorf("record: field %q names the EQL type %s, and an EQL column is a table and a column: the context %q has %d segments, not one", f.Name, f.Target, strings.Join(p.Context, "/"), len(p.Context))
+			}
+			if len(p.Extension) != 0 {
+				return fmt.Errorf("record: field %q names the EQL type %s, and an EQL column is a table and a column: an extended context has no column", f.Name, f.Target)
+			}
 			continue
 		}
 		if len(f.Outputs) == 0 {
 
@@ -105,6 +105,22 @@ func TestTargetFieldWiresItsTypeInsteadOfOutputs(t *testing.T) {
 	if err := both.Validate(); err == nil {
 		t.Fatal("a field with a target and outputs was accepted")
 	}
+	// An EQL column is a table and a column: a two-segment context, or an
+	// extension, leaves the target field no column, and the refusal names
+	// the field — before the guest is asked.
+	deep := &Plan{Context: []string{"app", "users"}, Fields: []Field{{Name: "email", Kind: String, Target: "TextEq"}}}
+	if err := deep.Validate(); err == nil || !strings.Contains(err.Error(), `field "email"`) || !strings.Contains(err.Error(), `"app/users" has 2 segments`) {
+		t.Fatalf("a target under app/users: %v", err)
+	}
+	extended := &Plan{Context: []string{"users"}, Extension: []any{uint64(7)}, Fields: []Field{{Name: "email", Kind: String, Target: "TextEq"}}}
+	if err := extended.Validate(); err == nil || !strings.Contains(err.Error(), "extended context has no column") {
+		t.Fatalf("an extended target: %v", err)
+	}
+	// The same context seals a plain field as before.
+	plain := &Plan{Context: []string{"app", "users"}, Fields: []Field{{Name: "email", Kind: String, Outputs: []Output{Ciphertext}}}}
+	if err := plain.Validate(); err != nil {
+		t.Fatal(err)
+	}
 }
 
 func TestValidateRefusals(t *testing.T) {
 
@@ -158,6 +158,14 @@ func lowerDeclaration(d Declaration, eqlTypes []EQLType) (*record.Plan, error) {
 			if eqlType.Plaintext != KindOther && eqlType.Plaintext != f.GoType.Kind {
 				return nil, &FieldError{Type: d.Type, Field: f.GoName, Reason: fmt.Sprintf("%s seals a %s, and %s is %s", f.EQLType, eqlType.Plaintext, f.GoType, f.GoType.Kind)}
 			}
+			// An EQL value is stored under a table and a column: the struct's
+			// context is the table and the field's name the column, so a
+			// context of two or more segments leaves the field no column.
+			// The engine refuses it too (se_plan_check); naming it here
+			// names the field.
+			if len(segments) != 1 {
+				return nil, &FieldError{Type: d.Type, Field: f.GoName, Reason: fmt.Sprintf("%s is stored under a table and a column, and the context %q has %d segments, not one", f.EQLType, d.Context, len(segments))}
+			}
 			rf.Target = f.EQLType
 		case VerbEncrypt, VerbEncryptIndex:
 			rf.Outputs = append(rf.Outputs, record.Ciphertext)
 
@@ -47,8 +47,12 @@
 //! that parses there has no target field.
 //!
 //! A target field's label must be a column, `<table>/<column>`, because
-//! that is what an EQL value stores in its `i`; an extended plan (a tenant
-//! part on every label) has no column for it and is refused with
+//! that is what an EQL value stores in its `i`: [`Plan::new_with`] refuses
+//! a target field whose label has any other number of segments
+//! ([`TargetError::Column`]) — [`FieldPlan::with_target`] itself takes any
+//! label of two or more segments, as every field constructor does; the
+//! column rule is the plan's — and an extended plan (a tenant part on every
+//! label) has no column for it and is refused with
 //! [`TargetError::Extended`] rather than silently dropping the extension.
 //! The field's `"type"`, when declared, must be the kind the EQL type is
 //! produced from ([`TargetError::Kind`]); undeclared, it is that kind, so
@@ -550,6 +554,19 @@ impl Plan {
                 }
                 .into());
             }
+            // An EQL value is stored under a table and a column, so the
+            // label is exactly two segments. Decided here, where the plan is
+            // built and se_plan_check reports it, not at the first value: a
+            // generator that asks the engine must be told before it writes
+            // the code. The resolver re-checks, since it is public API.
+            if field.label.segments().len() != 2 {
+                return Err(TargetError::Column {
+                    name: field.name.clone(),
+                    label: field.label.to_string(),
+                    reason: "an EQL column is a two-segment label: table and column".to_owned(),
+                }
+                .into());
+            }
             match (field.field_type, descriptor.plaintext) {
                 (Some(declared), expected) if expected != Some(declared) => {
                     return Err(TargetError::Kind {
@@ -4341,12 +4358,12 @@ mod tests {
         }
 
         /// The constructor's one bound on the label is "at least two
-        /// segments": a column is table and column, and a longer label is
-        /// still a label — whether a resolver can store under it is the
-        /// resolver's to say, and the extension rule is `Plan::new_with`'s.
-        /// Pinned from both sides so the bound cannot drift to "exactly two"
-        /// or flip: one segment refused (it is no label), two accepted, and
-        /// three — the first length above the bound — accepted intact.
+        /// segments", the same as every field constructor's: a longer label
+        /// is still a label. The column rule — exactly two — is
+        /// `Plan::new_with`'s, where the plan is built (the test after this
+        /// one). Pinned from both sides so the constructor's bound cannot
+        /// drift to "exactly two" or flip: one segment refused (it is no
+        /// label), two accepted, and three accepted intact.
         #[test]
         fn with_target_takes_any_label_of_two_or_more_segments() {
             let ctx = |segments: &[&str]| context(strings(segments)).expect("a context value");
@@ -4368,6 +4385,37 @@ mod tests {
             assert_eq!(three.target(), Some(TEXT_EQ));
         }
 
+        /// `context=app/users` with `email,encrypt_into=TextEq` in Go gives
+        /// the label `app/users/email`: no column for it. Refused when the
+        /// plan is built, so `se_plan_check` tells the generator before it
+        /// writes the code, and no value ever reaches the resolver.
+        #[tokio::test]
+        async fn a_target_label_that_is_not_table_and_column_is_refused_when_the_plan_is_built() {
+            let cipher = cipher().await;
+            let value = obj(vec![(
+                "email",
+                target_spec(strings(&["app", "users", "email"]), TEXT_EQ),
+            )]);
+            let error = target_error(plan_with(value, &FakeEql).unwrap_err());
+            assert!(
+                matches!(&error, TargetError::Column { name, label, .. } if name == "email" && label == "app/users/email"),
+                "{error}"
+            );
+            assert_eq!(
+                error.to_string(),
+                "email: the label app/users/email is not an EQL column: an EQL column is a \
+                 two-segment label: table and column"
+            );
+            // A sealed field under the same three-segment label is fine: the
+            // rule is the EQL column's, not the plan's.
+            let value = obj(vec![(
+                "email",
+                spec(strings(&["app", "users", "email"]), &["c"]),
+            )]);
+            assert!(plan_with(value, &FakeEql).is_ok());
+            assert_eq!(generates(&cipher), 0, "nothing minted");
+        }
+
         #[test]
         fn the_target_and_output_forms_are_exclusive() {
             let both = obj(vec![