@@ -19,7 +19,7 @@ pub(crate) struct ContainerAttrs {
     /// field says otherwise. Exclusive with `plaintext`; requires `context`.
     pub(crate) by_field: Option<Type>,
     /// `#[stash(context = "...")]` on the container: the first half of every
-    /// field's inferred context — `"<context>/<field>"`. Names the stored
+    /// field's inferred context, the pair `("<context>", "<field>")`. Names the stored
     /// data, not the Rust type: it is part of the stored data's identity, so
     /// it is given explicitly rather than inferred from a name a refactor
     /// can change. Only meaningful with `struct`.
@@ -149,7 +149,7 @@ impl ContainerAttrs {
                     by_field,
                     "`struct = ..` needs a `context = \"..\"` beside it naming the stored data \
                      (e.g. `#[stash(struct = User, context = \"users\")]`): each field is derived \
-                     under `\"<context>/<field>\"`, and the prefix is part of the stored data's \
+                     under the pair `(\"<context>\", \"<field>\")`, and the prefix is part of the stored data's \
                      identity, so it is given explicitly rather than inferred from the Rust \
                      type's name",
                 ));
 
@@ -35,7 +35,9 @@
 //! `context_type = AeadContext` and accept a context type that implements
 //! `IntoAad` alone, as the ciphertext leaf itself does.
 //! `struct = User, context = "users"` selects plaintext fields
-//! and binds them under `"users/<field>"`. The storage envelope itself adds no
+//! and binds each under the pair `("users", "<field>")`, which renders
+//! `users/<field>` as its ZeroKMS descriptor. A `context = ".."` literal on a
+//! field is one text part, exactly as written. The storage envelope itself adds no
 //! cryptographic map-entry context. Vitamin C still binds keys inside plaintext
 //! maps and preserves authenticated absence and empty-container markers.
 //!
 
@@ -64,9 +64,9 @@ pub(crate) enum Kind {
     /// Derived from the source through the field type's own `EncryptFrom`.
     Derived {
         /// This field's own context, if it has one: a `#[stash(context =
-        /// "...")]` literal, or the `"<prefix>/<field>"` a `struct` derive
+        /// "...")]` literal, or the `(prefix, field)` pair a `struct` derive
         /// infers. A context the caller passes extends it either way.
-        context: Option<LitStr>,
+        context: Option<OwnContext>,
         /// With `struct = ..`: the plaintext field this one is derived
         /// from — its own name, or the `#[stash(from = field)]` override.
         /// `None` for a `plaintext` record, whose fields are all derived
@@ -96,7 +96,7 @@ impl Field {
     ///
     /// A field with a context of its own — a literal, or the one a `struct`
     /// derive infers — is derived under it as it is when the caller passes
-    /// `()`, and under it *extended* with the caller's (`("users/age", id)`)
+    /// `()`, and under it *extended* with the caller's (`(("users", "age"), id)`)
     /// when the caller passes a `NonEmpty<_>`. A field with none is handed
     /// the caller's context as it is, and its type decides what that means:
     /// a nested `struct` derive composes it with its own contexts; a leaf
@@ -118,13 +118,35 @@ impl Field {
     }
 }
 
+/// A derived field's own context.
+#[cfg_attr(test, derive(Debug))]
+pub(crate) enum OwnContext {
+    /// `#[stash(context = "...")]`: one text part, exactly as written.
+    Literal(LitStr),
+    /// What a `struct` derive infers: the pair (container prefix, column),
+    /// two parts, so it renders `prefix/column` without the column name
+    /// having to be joined into, or kept out of, a string.
+    Column { table: LitStr, column: LitStr },
+}
+impl OwnContext {
+    /// The `NonEmpty` the derive hands `under` / `extend`.
+    fn expr(&self, krate: &Path) -> TokenStream {
+        match self {
+            Self::Literal(lit) => quote!(#krate::nonempty!(#lit)),
+            Self::Column { table, column } => {
+                quote!(#krate::nonempty!(#table).with(#column))
+            }
+        }
+    }
+}
+
 /// Where a derived field's context comes from. See [`Field::field_context`].
 #[cfg_attr(test, derive(Debug))]
 pub(crate) enum FieldContext<'a> {
     /// A context of the field's own — `#[stash(context = "...")]`, or the
-    /// `"<prefix>/<field>"` a `struct` derive infers: as it is under `()`,
+    /// `(prefix, field)` pair a `struct` derive infers: as it is under `()`,
     /// extended with the caller's context under `NonEmpty<_>`.
-    Own(&'a LitStr),
+    Own(&'a OwnContext),
     /// No context of its own: handed the caller's as it is — `()`, or the
     /// record's associated context.
     Caller,
@@ -270,7 +292,7 @@ pub(crate) fn trait_impl(
 
 /// The fields, with what a `struct` derive (`prefix` is the container's
 /// `context`) fills in: `from` is the field's own name and `context` is
-/// `"<prefix>/<from>"`, each unless the field gives its own.
+/// the pair `("<prefix>", "<from>")`, each unless the field gives its own.
 /// `#[stash(nested)]` opts a field out of the inferred context — it is handed
 /// the caller's as it is, which a nested `struct` derive (a type carrying its
 /// own contexts) composes with them and a leaf accepts only as a
@@ -311,8 +333,8 @@ fn collect(fields: &Fields, prefix: Option<&LitStr>) -> Result<Vec<Field>> {
                 if context.value().is_empty() {
                     let message = if prefix.is_some() {
                         "an empty `context` is rejected when a value is encrypted: name the \
-                         field (e.g. \"users/email\"), or drop the attribute to use the inferred \
-                         `\"<context>/<field>\"`"
+                         field (e.g. \"email\"), or drop the attribute to use the inferred \
+                         pair `(\"<context>\", \"<field>\")`"
                     } else {
                         "an empty `context` is rejected when a value is encrypted: name the \
                          field (e.g. \"users/email\"), or drop the attribute to hand the field \
@@ -359,22 +381,24 @@ fn collect(fields: &Fields, prefix: Option<&LitStr>) -> Result<Vec<Field>> {
                                 // is handed the caller's (`FieldContext::Caller`).
                                 None
                             } else if let Some(lit) = attrs.context {
-                                Some(lit)
+                                Some(OwnContext::Literal(lit))
                             } else {
                                 let column = match &from {
                                     Member::Named(ident) => ident.to_string(),
                                     Member::Unnamed(index) => index.index.to_string(),
                                 };
-                                let prefix = prefix.value();
-                                Some(LitStr::new(&format!("{prefix}/{column}"), member.span()))
+                                Some(OwnContext::Column {
+                                    table: prefix.clone(),
+                                    column: LitStr::new(&column, member.span()),
+                                })
                             };
                             Kind::Derived {
                                 context,
                                 from: Some(from),
                             }
                         }
                         None => Kind::Derived {
-                            context: attrs.context,
+                            context: attrs.context.map(OwnContext::Literal),
                             from: None,
                         },
                     },
@@ -482,12 +506,13 @@ impl Record {
         let krate = &self.krate;
         let span = field.ty.span();
         match field.field_context() {
-            FieldContext::Own(lit) => {
+            FieldContext::Own(own) => {
+                let own = respan(own.expr(krate), span);
                 if self.declared_contexts() {
-                    quote_spanned!(span=> .under(#krate::nonempty!(#lit)))
+                    quote_spanned!(span=> .under(#own))
                 } else {
                     let threaded = respan(self.threaded_context().into_token_stream(), span);
-                    quote_spanned!(span=> .extend::<#threaded>(#krate::nonempty!(#lit)))
+                    quote_spanned!(span=> .extend::<#threaded>(#own))
                 }
             }
             FieldContext::Caller => {
@@ -530,13 +555,14 @@ impl Record {
         let krate = &self.krate;
         match field.field_context() {
             FieldContext::Caller => quote!(::core::clone::Clone::clone(&__context)),
-            FieldContext::Own(lit) => {
+            FieldContext::Own(own) => {
                 let method = if self.declared_contexts() {
                     quote!(under)
                 } else {
                     quote!(extend)
                 };
-                quote!(::core::clone::Clone::clone(&__context).#method(#krate::nonempty!(#lit)))
+                let own = own.expr(krate);
+                quote!(::core::clone::Clone::clone(&__context).#method(#own))
             }
         }
     }
@@ -584,7 +610,10 @@ mod tests {
     /// The field's own context, for assertions.
     fn own(field: &Field) -> String {
         match field.field_context() {
-            FieldContext::Own(lit) => lit.value(),
+            FieldContext::Own(OwnContext::Literal(lit)) => lit.value(),
+            FieldContext::Own(OwnContext::Column { table, column }) => {
+                format!("({}, {})", table.value(), column.value())
+            }
             other => panic!("expected a context of the field's own, got {other:?}"),
         }
     }
@@ -824,10 +853,10 @@ mod tests {
         );
         // Own name under the container's prefix.
         assert!(matches!(age.from(), Some(Member::Named(m)) if m == "age"));
-        assert_eq!(own(age), "user_profiles/age");
+        assert_eq!(own(age), "(user_profiles, age)");
         // `from` overrides the field; the context follows the plaintext field.
         assert!(matches!(email.from(), Some(Member::Named(m)) if m == "email_address"));
-        assert_eq!(own(email), "user_profiles/email_address");
+        assert_eq!(own(email), "(user_profiles, email_address)");
         // `context` is taken verbatim; like the inferred ones, the caller's
         // context extends it.
         assert!(matches!(name.from(), Some(Member::Named(m)) if m == "name"));
@@ -846,8 +875,8 @@ mod tests {
         })
         .unwrap();
         assert!(matches!(record.fields[1].from(), Some(Member::Unnamed(i)) if i.index == 1));
-        assert_eq!(own(&record.fields[0]), "readings/0");
-        assert_eq!(own(&record.fields[1]), "readings/1");
+        assert_eq!(own(&record.fields[0]), "(readings, 0)");
+        assert_eq!(own(&record.fields[1]), "(readings, 1)");
     }
 
     #[test]
 
@@ -46,15 +46,17 @@ leaf requires a nonempty context, validated by Vitamin C and owned in a
 record deriving terms threads to every field) or an `AeadContext` (the AAD
 encoding alone — what a ciphertext is sealed and opened under; a record
 deriving terms hands its ciphertext fields that half of its `CallerContext`);
-a `nonempty!("users/email")` literal, a `NonEmpty::new(value)?` at runtime,
-or a bare integer. It becomes the ciphertext's associated data,
+a `nonempty!("users").with("email")` pair (a table and a column are two
+parts, rendered `users/email`), a `NonEmpty::new(value)?` at runtime, or a
+bare integer. It becomes the ciphertext's associated data,
 the term's PRF context, and the ZeroKMS descriptor of the data key.
 _Avoid_: AAD (that is one of its encodings, not the concept), lock context
 
 **Own context**:
-The context a field carries itself: a `context = ".."` literal, or the one a
-`struct = ..` derive infers as `<struct context>/<field>`. A caller's context
-*extends* it (`("users/age", id)`); it is never discarded. A subtree of a
+The context a field carries itself: a `context = ".."` literal (one text
+part, exactly as written), or the pair a `struct = ..` derive infers,
+`(<struct context>, <field>)`. A caller's context *extends* it
+(`(("users", "age"), id)`); it is never discarded. A subtree of a
 declaration is given one with `under` (the caller's is then optional) or
 `extend` (the caller's stays required).
 _Avoid_: default context, field prefix
 
@@ -55,7 +55,7 @@ struct User {
 }
 
 /// `User`, encrypted field by field: `age` from `user.age` under
-/// `"users/age"`, `email` from `user.email` under `"users/email"`. The prefix
+/// `("users", "age")`, `email` from `user.email` under `("users", "email")`. The prefix
 /// is named once, explicitly — it is part of the stored data's identity, so
 /// it is never inferred from a Rust type name — and the field half follows
 /// the plaintext field.
@@ -108,7 +108,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // WHERE age = 34: compare equality terms.
     let probe: EqualityTerm = 34u32
-        .encrypt_into_with_context(&keyset, nonempty!("users/age"))
+        .encrypt_into_with_context(&keyset, nonempty!("users").with("age"))
         .await?;
     let equal: Vec<usize> = (0..table.len())
         .filter(|&i| table[i].age.eq == probe)
@@ -117,7 +117,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // WHERE age > 40: compare ORE terms.
     let bound: OreTerm<u32> = 40u32
-        .encrypt_into_with_context(&keyset, nonempty!("users/age"))
+        .encrypt_into_with_context(&keyset, nonempty!("users").with("age"))
         .await?;
     let over_40: Vec<usize> = (0..table.len())
         .filter(|&i| table[i].age.ord > bound)
@@ -153,10 +153,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     // --- Binding a value to its record ----------------------------------------
 
     // A context the caller passes *extends* every field's own: under the
-    // record's id, `age` is sealed under `("users/age", id)` and opens only
+    // record's id, `age` is sealed under `(("users", "age"), id)` and opens only
     // there — a ciphertext can no longer be moved between records of the
     // same table. The price is that its terms are scoped to that record too:
-    // a probe built under `"users/age"` alone never matches them, so extend
+    // a probe built under `("users", "age")` alone never matches them, so extend
     // where a value is read by id, not where it is searched across rows.
     let id = 42u64;
     let alice = User {
@@ -174,7 +174,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         !unscoped.is_empty()
     );
     let scoped: EqualityTerm = 34u32
-        .encrypt_into_with_context(&keyset, nonempty!("users/age").with(id))
+        .encrypt_into_with_context(&keyset, nonempty!("users").with("age").with(id))
         .await?;
     println!(
         "  ...and a probe built under the same id: {}",
 
@@ -177,14 +177,17 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // One call, one batched generate_keys round-trip for every encrypted leaf
     // in the whole Vec (here: 3 rows x 2 encrypted fields = 6 data keys).
-    let ciphertext = cipher.default_keyset().encrypt(users, "users/v1").await?;
+    let ciphertext = cipher
+        .default_keyset()
+        .encrypt(users, ("users", "v1"))
+        .await?;
 
     println!("what the stored ciphertext reveals:");
     describe(&ciphertext, 1);
 
     // One batched retrieve_keys round-trip, then a crypto-free structural
     // decode back into the typed rows. The AAD must match the encrypt call.
-    let users: Vec<User> = cipher.decrypt(ciphertext, "users/v1").await?;
+    let users: Vec<User> = cipher.decrypt(ciphertext, ("users", "v1")).await?;
 
     println!("\ndecrypted rows:");
     for user in &users {
 
@@ -39,21 +39,22 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // --- Equality: exact-match lookups --------------------------------------
     //
-    // The context ("users/email") domain-separates terms per field: the same
+    // The context, the pair ("users", "email"), domain-separates terms per
+    // field: the same
     // value indexed under another field can never produce a colliding term.
 
     let stored: EqualityTerm = "alice@example.com"
-        .encrypt_into_with_context(&terms, nonempty!("users/email"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("email"))
         .await?;
 
     let hit: EqualityTerm = "alice@example.com"
-        .encrypt_into_with_context(&terms, nonempty!("users/email"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("email"))
         .await?;
     let miss: EqualityTerm = "bob@example.com"
-        .encrypt_into_with_context(&terms, nonempty!("users/email"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("email"))
         .await?;
     let wrong_field: EqualityTerm = "alice@example.com"
-        .encrypt_into_with_context(&terms, nonempty!("users/name"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("name"))
         .await?;
 
     println!("\nequality:");
@@ -73,13 +74,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     let bio: MatchTerm = "alice, senior cryptography engineer"
         .to_string()
-        .encrypt_into_with_context(&terms, nonempty!("users/bio"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("bio"))
         .await?;
 
     for query in ["crypto", "engineer", "plumber"] {
         let probe: MatchTerm = query
             .to_string()
-            .encrypt_into_with_context(&terms, nonempty!("users/bio"))
+            .encrypt_into_with_context(&terms, nonempty!("users").with("bio"))
             .await?;
         println!("match: bio contains {query:?} => {}", bio.contains(&probe));
     }
@@ -97,13 +98,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     // local.
 
     let age_30: OreTerm<u32> = 30u32
-        .encrypt_into_with_context(&terms, nonempty!("users/age"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("age"))
         .await?;
     let age_45: OreTerm<u32> = 45u32
-        .encrypt_into_with_context(&terms, nonempty!("users/age"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("age"))
         .await?;
     let query_40: OreTerm<u32> = 40u32
-        .encrypt_into_with_context(&terms, nonempty!("users/age"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("age"))
         .await?;
 
     println!("\nore (WHERE age > 40):");
@@ -112,10 +113,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // Strings order lexicographically.
     let apple: OreTerm<&str> = "apple"
-        .encrypt_into_with_context(&terms, nonempty!("users/name"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("name"))
         .await?;
     let banana: OreTerm<&str> = "banana"
-        .encrypt_into_with_context(&terms, nonempty!("users/name"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("name"))
         .await?;
     println!("  \"apple\" < \"banana\" => {}", apple < banana);
 
@@ -137,11 +138,11 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     let record: SearchableEmail = "alice@example.com"
         .to_string()
-        .encrypt_into_with_context(&terms, nonempty!("users/email"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("email"))
         .await?;
     let probe: MatchTerm = "example"
         .to_string()
-        .encrypt_into_with_context(&terms, nonempty!("users/email"))
+        .encrypt_into_with_context(&terms, nonempty!("users").with("email"))
         .await?;
     println!("\nrecord:");
     println!(
@@ -157,7 +158,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         record.ord
             > "alice"
                 .to_string()
-                .encrypt_into_with_context(&terms, nonempty!("users/email"))
+                .encrypt_into_with_context(&terms, nonempty!("users").with("email"))
                 .await?
     );
     let _ = record.c; // the ciphertext, opened with `decrypt_into` under the same context