@@ -264,11 +264,15 @@ Run all checks:
 Or individually:
 
 ```bash
-python3 -m ruff format .
-python3 -m ruff check . --fix
-python3 -m mypy src
-python3 -m pytest -vv
-python3 -m build
+python -m ruff format .
+python -m ruff check . --fix
+python -m ruff format .
+python -m ruff format --check .
+python -m ruff check .
+python -m mypy src
+python -m pytest -vv
+python -m compileall -q src tests
+python -m build
 ```
 
 ## Design goals
 
@@ -2,9 +2,12 @@
 
 from __future__ import annotations
 
+from typing import Literal, TypeAlias
+
 from logprivacy.field_rules.rules import normalize_field_name
 
-_TraversalPath = tuple[str | int, ...]
+_TraversalPath: TypeAlias = tuple[str | int, ...]
+_AllowlistPathMatch: TypeAlias = Literal["none", "prefix", "exact"]
 
 
 class _AllowlistMatcher:
@@ -13,80 +16,114 @@ class _AllowlistMatcher:
     Allowlist paths are dot-separated patterns that may use ``*`` as a
     single-segment wildcard: ``"orders.*.status"``.
 
-    A field at path ``P`` is retained when:
-    - ``P`` exactly matches an allowlist pattern, OR
-    - ``P`` is a proper prefix of an allowlist pattern (meaning there is
-      allowed content nested under ``P``).
+    ``match_path()`` distinguishes three states:
+
+    - ``"exact"``: the current path is explicitly allowed;
+    - ``"prefix"``: the current path is a parent of allowed descendants;
+    - ``"none"``: the current path is not covered by the allowlist.
 
-    This ensures parent objects are preserved when any of their descendants
-    are allowed.
+    Distinguishing exact matches from parent prefixes is important for safe
+    traversal. A scalar value at a prefix-only path cannot contain the allowed
+    descendant and must not be emitted merely because its path is a prefix.
     """
 
     __slots__ = ("_patterns",)
 
     def __init__(self, patterns: tuple[str, ...]) -> None:
-        parsed: list[tuple[str, ...]] = []
-        for pat in patterns:
-            parsed.append(_parse_allowlist_path(pat))
-        self._patterns: tuple[tuple[str, ...], ...] = tuple(parsed)
+        self._patterns: tuple[tuple[str, ...], ...] = tuple(
+            _parse_allowlist_path(pattern) for pattern in patterns
+        )
+
+    def match_path(self, path: _TraversalPath) -> _AllowlistPathMatch:
+        """Return whether ``path`` is exact, a parent prefix, or not covered."""
+        if not self._patterns:
+            return "none"
+
+        normalized_path = _normalize_traversal_path(path)
+        has_prefix_match = False
+
+        for pattern in self._patterns:
+            match = _match_normalized_path(normalized_path, pattern)
+            if match == "exact":
+                return "exact"
+            if match == "prefix":
+                has_prefix_match = True
+
+        return "prefix" if has_prefix_match else "none"
 
     def is_path_allowed(self, path: _TraversalPath) -> bool:
-        """Return True if ``path`` is allowed or leads to allowed content.
+        """Return whether ``path`` is explicitly allowed or leads to allowed content.
 
-        Returns False when no patterns are configured (empty allowlist rejects everything).
-        The caller is responsible for checking whether an allowlist is active at all.
+        This compatibility helper preserves the previous boolean API. Traversal
+        code that needs to decide whether a scalar may be emitted should use
+        ``match_path()`` so it can distinguish an exact match from a parent
+        prefix.
         """
-        if not self._patterns:
-            return False
-        norm = _normalize_traversal_path(path)
-        return any(_path_matches_or_prefixes_pattern(norm, pattern) for pattern in self._patterns)
+        return self.match_path(path) != "none"
 
 
 def _normalize_traversal_path(path: _TraversalPath) -> tuple[str, ...]:
-    result: list[str] = []
-    for seg in path:
-        if isinstance(seg, int):
-            result.append(str(seg))
+    normalized_segments: list[str] = []
+    for segment in path:
+        if isinstance(segment, int):
+            normalized_segments.append(str(segment))
         else:
-            result.append(normalize_field_name(seg))
-    return tuple(result)
-
-
-def _path_matches_or_prefixes_pattern(norm_path: tuple[str, ...], pattern: tuple[str, ...]) -> bool:
-    """Return True if norm_path matches pattern exactly or is a proper prefix of it."""
-    plen = len(pattern)
-    nlen = len(norm_path)
-    if nlen > plen:
-        return False
-    for p_seg, n_seg in zip(pattern[:nlen], norm_path, strict=False):
-        if p_seg == "*":
-            continue
-        if p_seg != n_seg:
-            return False
-    return True
+            normalized_segments.append(normalize_field_name(segment))
+    return tuple(normalized_segments)
+
+
+def _match_normalized_path(
+    normalized_path: tuple[str, ...],
+    pattern: tuple[str, ...],
+) -> _AllowlistPathMatch:
+    """Match an already-normalized traversal path against one pattern."""
+    path_length = len(normalized_path)
+    pattern_length = len(pattern)
+
+    if path_length > pattern_length:
+        return "none"
+
+    for pattern_segment, path_segment in zip(pattern[:path_length], normalized_path, strict=False):
+        if pattern_segment != "*" and pattern_segment != path_segment:
+            return "none"
+
+    if path_length == pattern_length:
+        return "exact"
+    return "prefix"
+
+
+def _path_matches_or_prefixes_pattern(
+    norm_path: tuple[str, ...],
+    pattern: tuple[str, ...],
+) -> bool:
+    """Compatibility wrapper for the previous private helper."""
+    return _match_normalized_path(norm_path, pattern) != "none"
 
 
 def _parse_allowlist_path(path_str: str) -> tuple[str, ...]:
-    """Parse 'error.type' -> ('error', 'type'), 'orders.*.status' -> ('orders', '*', 'status')."""
+    """Parse an allowlist path into normalized segments."""
     if not path_str:
         raise ValueError("allowlist path must not be empty")
     if path_str.startswith(".") or path_str.endswith("."):
         raise ValueError(f"allowlist path {path_str!r} must not start or end with '.'")
     if ".." in path_str:
         raise ValueError(f"allowlist path {path_str!r} must not contain '..'")
+
     segments: list[str] = []
-    for seg in path_str.split("."):
-        if not seg:
+    for segment in path_str.split("."):
+        if not segment:
             raise ValueError(f"empty segment in allowlist path {path_str!r}")
-        if seg == "**":
+        if segment == "**":
             raise ValueError("'**' is not supported in allowlist paths; use '*'")
-        if "*" in seg and seg != "*":
-            raise ValueError(f"partial wildcard {seg!r} in allowlist path {path_str!r}")
-        if seg == "*":
+        if "*" in segment and segment != "*":
+            raise ValueError(f"partial wildcard {segment!r} in allowlist path {path_str!r}")
+        if segment == "*":
             segments.append("*")
-        else:
-            norm = normalize_field_name(seg)
-            if not norm:
-                raise ValueError(f"allowlist segment {seg!r} normalizes to empty string")
-            segments.append(norm)
+            continue
+
+        normalized_segment = normalize_field_name(segment)
+        if not normalized_segment:
+            raise ValueError(f"allowlist segment {segment!r} normalizes to empty string")
+        segments.append(normalized_segment)
+
     return tuple(segments)