diff --git a/prospect/big-bang.rkt b/prospect/big-bang.rkt
index 5d8e340..b9e1124 100644
--- a/prospect/big-bang.rkt
+++ b/prospect/big-bang.rkt
@@ -30,7 +30,7 @@
 
 ;;---------------------------------------------------------------------------
 
-(struct window (id x y z image) #:transparent)
+(struct window (id x y z image) #:transparent) ;; image must be sealed
 
 (struct to-server (message) #:transparent)
 (struct from-server (message) #:transparent)
@@ -44,7 +44,7 @@
 
 (define (update-window id x y image #:z [z 0])
   (patch-seq (retract (window id ? ? ? ?) #:meta-level 1)
-             (assert (window id x y z image) #:meta-level 1)))
+             (assert (window id x y z (seal image)) #:meta-level 1)))
 
 ;;---------------------------------------------------------------------------
 
@@ -114,12 +114,12 @@
   (let loop ((ws (bb-windows b)))
     (match ws
       ['() #f]
-      [(cons (window id x y _ image) ws)
+      [(cons (window id x y _ (seal image)) ws)
        (if (inside? mx my x y image) id (loop ws))])))
 
 (define (render b)
   (for/fold [(scene empty-image)] [(w (bb-windows b))]
-    (match-define (window _ x y z image) w)
+    (match-define (window _ x y z (seal image)) w)
     (overlay/xy scene x y image)))
 
 (define (update-active-window active-id)
diff --git a/prospect/core.rkt b/prospect/core.rkt
index 453c6a7..2924c1c 100644
--- a/prospect/core.rkt
+++ b/prospect/core.rkt
@@ -9,6 +9,8 @@
          (struct-out transition)
          (struct-out world)
 
+         (struct-out seal)
+
          (all-from-out "patch.rkt")
 
          ;; imported from route.rkt:
@@ -104,6 +106,12 @@
   [(define (prospect-pretty-print w [p (current-output-port)])
      (pretty-print-world w p))])
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Seals are used by protocols to prevent the routing tries from
+;; examining internal structure of values.
+
+(struct seal (contents)) ;; NB. Neither transparent nor prefab
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 (define (event? x) (or (patch? x) (message? x)))