diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8bef27..7355360 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.0.1] - 2026-09-29
+
+Fixes from an audit of 3.0.0. Each one has a test that fails on 3.0.0.
+
+### Fixed
+
+- **A `MultiResult` failure leaked exception messages into the response.** The
+  multi-error path wrote `[CODE] message` for every error and ignored
+  `IncludeErrorMessage`, `IncludeErrorCode` and `IncludeExceptionDetails`. It now
+  applies them the same way the single-error path does, and a new
+  `CreateFromMultiResult(result, options)` overload takes options directly. This
+  predates 3.0.0.
+- **A success mapped to 204 or 304 no longer writes a body.** `ToHttpResult` and
+  `ToActionResult` serialised the value anyway, and Kestrel throws when a
+  response with those codes has a body.
+- **The `ValueTask` fast path no longer throws out of the call.** When the source
+  had already completed, an exception from the delegate escaped synchronously,
+  while the pending path put it in the task. Both now fault the task. An
+  already cancelled token gives a canceled task instead of a synchronous throw.
+- **Message neutralising missed C1 controls, NEL, U+2028 and U+2029**, which
+  some log viewers and JavaScript treat as line breaks.
+- **Truncation could split a surrogate pair**, leaving a lone high surrogate that
+  an encoder rejects or turns into U+FFFD.
+- **`ErrorStatusCodeMapper.GetStatusCode(default)` threw** on the null code. It
+  now returns 400, or 500 when an exception is attached.
+- **Reading `Value` on a failed `MultiResult` after `DisposeErrors`** threw
+  `ObjectDisposedException` instead of the documented
+  `InvalidOperationException`.
+- `ResultLogger` awaits with `ConfigureAwait(false)`.
+
+### Changed
+
+- **`MultiResult.Failure` with no errors now throws `ArgumentException`.** It
+  used to build a failure that reported nothing and rendered as an empty 400.
+- **A `MultiResult` that holds an error with an exception now maps to 500**,
+  matching the single-error path, rather than 400.
+
 ## [3.0.0] - 2026-08-31
 
 The release where the zero-allocation claim became something the build enforces
diff --git a/Directory.Build.props b/Directory.Build.props
index f9516be..0ce7b62 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -11,7 +11,7 @@
     <!-- Single source of truth for the release version. The publish workflow
          reads this rather than taking a hand-typed input, so what shipped is
          always recorded in git. -->
-    <VersionPrefix>3.0.0</VersionPrefix>
+    <VersionPrefix>3.0.1</VersionPrefix>
 
     <!-- Dependency advisories fail the build rather than waiting for someone to
          run the check by hand. Mode 'all' because the packages that matter here
diff --git a/src/Verdict.AspNetCore/ErrorStatusCodeMapper.cs b/src/Verdict.AspNetCore/ErrorStatusCodeMapper.cs
index 3077ac3..65fba6d 100644
--- a/src/Verdict.AspNetCore/ErrorStatusCodeMapper.cs
+++ b/src/Verdict.AspNetCore/ErrorStatusCodeMapper.cs
@@ -63,6 +63,13 @@ public static class ErrorStatusCodeMapper
     /// <returns>HTTP status code.</returns>
     public static int GetStatusCode(Error error)
     {
+        // default(Error) never ran its constructor, so its Code is null, and a
+        // null key throws from both dictionaries. It has no mapping to find.
+        if (string.IsNullOrEmpty(error.Code))
+        {
+            return error.Exception is not null ? 500 : 400;
+        }
+
         // Check custom mappings first
         if (_customMappings.TryGetValue(error.Code, out var customCode))
         {
diff --git a/src/Verdict.AspNetCore/ProblemDetailsFactory.cs b/src/Verdict.AspNetCore/ProblemDetailsFactory.cs
index 0aa3ddb..36a8c8d 100644
--- a/src/Verdict.AspNetCore/ProblemDetailsFactory.cs
+++ b/src/Verdict.AspNetCore/ProblemDetailsFactory.cs
@@ -107,13 +107,40 @@ public static ProblemDetails CreateFromError(Error error, int statusCode, Verdic
     }
 
     /// <summary>
-    /// Creates ValidationProblemDetails from MultiResult errors.
+    /// Creates ValidationProblemDetails from MultiResult errors, using the
+    /// default options.
     /// </summary>
     /// <typeparam name="T">The result value type.</typeparam>
     /// <param name="result">The multi-result with errors.</param>
     /// <returns>RFC 7807 compliant ValidationProblemDetails.</returns>
     public static ValidationProblemDetails CreateFromMultiResult<T>(Verdict.Extensions.MultiResult<T> result)
     {
+        var options = Volatile.Read(ref _defaultOptions);
+        return CreateFromMultiResult(result, options);
+    }
+
+    /// <summary>
+    /// Creates ValidationProblemDetails from MultiResult errors, applying the
+    /// same message, code and exception rules as <see cref="CreateFromError(Error, int, VerdictProblemDetailsOptions)"/>
+    /// to every error.
+    /// </summary>
+    /// <remarks>
+    /// This path used to print every error as <c>[CODE] message</c> whatever the
+    /// options said, so an exception message in a multi-error result reached the
+    /// client with every leak-prevention option turned off. When any error
+    /// carries an exception the status is 500, for the same reason
+    /// <see cref="ErrorStatusCodeMapper.GetStatusCode(Error)"/> returns 500 for one.
+    /// </remarks>
+    /// <typeparam name="T">The result value type.</typeparam>
+    /// <param name="result">The multi-result with errors.</param>
+    /// <param name="options">The options to apply. Null uses the defaults.</param>
+    /// <returns>RFC 7807 compliant ValidationProblemDetails.</returns>
+    public static ValidationProblemDetails CreateFromMultiResult<T>(
+        Verdict.Extensions.MultiResult<T> result,
+        VerdictProblemDetailsOptions options)
+    {
+        options ??= Volatile.Read(ref _defaultOptions);
+
         // Reading a disposed collection throws, and this runs while the handler is
         // already building an error response, so throwing here turns a reported
         // validation failure into an unhandled 500 and loses the errors entirely.
@@ -133,11 +160,22 @@ public static ValidationProblemDetails CreateFromMultiResult<T>(Verdict.Extensio
         // Pre-allocate array with exact size to avoid List resizing
         var errorCount = result.ErrorCount;
         var errorMessages = new string[errorCount];
+        var anyException = false;
 
         int index = 0;
         foreach (var error in result.Errors)
         {
-            errorMessages[index++] = $"[{error.Code}] {error.Message}";
+            var carriesException = error.Exception is not null;
+            var withheld = carriesException && !options.IncludeExceptionDetails;
+            anyException |= carriesException;
+
+            var message = !options.IncludeErrorMessage || withheld
+                ? options.GenericErrorMessage
+                : error.Message;
+
+            errorMessages[index++] = options.IncludeErrorCode && !withheld
+                ? $"[{error.Code}] {message}"
+                : message;
         }
 
         var errors = new Dictionary<string, string[]>(1)
@@ -145,6 +183,17 @@ public static ValidationProblemDetails CreateFromMultiResult<T>(Verdict.Extensio
             ["errors"] = errorMessages
         };
 
+        if (anyException)
+        {
+            return new ValidationProblemDetails(errors)
+            {
+                Type = GetProblemType(500),
+                Title = GetTitle(500),
+                Status = 500,
+                Detail = $"{errorCount} error(s) occurred."
+            };
+        }
+
         return new ValidationProblemDetails(errors)
         {
             Type = "https://tools.ietf.org/html/rfc7231#section-6.5.1",
diff --git a/src/Verdict.AspNetCore/ResultExtensions.cs b/src/Verdict.AspNetCore/ResultExtensions.cs
index e2b4376..4d23352 100644
--- a/src/Verdict.AspNetCore/ResultExtensions.cs
+++ b/src/Verdict.AspNetCore/ResultExtensions.cs
@@ -38,7 +38,9 @@ public static IResult ToHttpResult<T>(
     {
         if (result.IsSuccess)
         {
-            return Results.Json(result.Value, statusCode: successStatusCode);
+            return ForbidsBody(successStatusCode)
+                ? Results.StatusCode(successStatusCode)
+                : Results.Json(result.Value, statusCode: successStatusCode);
         }
 
         var statusCode = errorStatusCodeMapper?.Invoke(result.Error) 
@@ -78,7 +80,9 @@ public static IResult ToHttpResult<T>(
 
         if (result.IsSuccess)
         {
-            return Results.Json(result.Value, statusCode: successStatusCode);
+            return ForbidsBody(successStatusCode)
+                ? Results.StatusCode(successStatusCode)
+                : Results.Json(result.Value, statusCode: successStatusCode);
         }
 
         var (statusCode, problemDetails) = Describe(context, result.Error);
@@ -127,7 +131,9 @@ public static ActionResult<T> ToActionResult<T>(
 
         if (result.IsSuccess)
         {
-            return new ObjectResult(result.Value) { StatusCode = successStatusCode };
+            return ForbidsBody(successStatusCode)
+                ? new StatusCodeResult(successStatusCode)
+                : new ObjectResult(result.Value) { StatusCode = successStatusCode };
         }
 
         var (statusCode, problemDetails) = Describe(context, result.Error);
@@ -142,6 +148,14 @@ public static ActionResult<T> ToActionResult<T>(
     /// <summary>
     /// Resolves the container's mapper and factory, falling back to the statics.
     /// </summary>
+    /// <summary>
+    /// Whether HTTP forbids a body with this status. Writing the value anyway
+    /// made Kestrel throw after the handler returned, so the client got an
+    /// empty 204 and the server logged an unhandled exception.
+    /// </summary>
+    private static bool ForbidsBody(int statusCode) =>
+        statusCode == 204 || statusCode == 304 || (statusCode >= 100 && statusCode < 200);
+
     private static (int StatusCode, ProblemDetails Details) Describe(HttpContext context, Error error)
     {
         var services = context.RequestServices;
@@ -187,6 +201,13 @@ public static ActionResult<T> ToActionResult<T>(
     {
         if (result.IsSuccess)
         {
+            if (ForbidsBody(successStatusCode))
+            {
+                return successStatusCode == 204
+                    ? new NoContentResult()
+                    : new StatusCodeResult(successStatusCode);
+            }
+
             if (locationUri != null)
             {
                 return successStatusCode switch
@@ -202,7 +223,6 @@ public static ActionResult<T> ToActionResult<T>(
                 200 => new OkObjectResult(result.Value),
                 201 => new ObjectResult(result.Value) { StatusCode = 201 },
                 202 => new ObjectResult(result.Value) { StatusCode = 202 },
-                204 => new NoContentResult(),
                 _ => new ObjectResult(result.Value) { StatusCode = successStatusCode }
             };
         }
diff --git a/src/Verdict.Async/ValueTaskResultExtensions.cs b/src/Verdict.Async/ValueTaskResultExtensions.cs
index 788d80b..9f4c8df 100644
--- a/src/Verdict.Async/ValueTaskResultExtensions.cs
+++ b/src/Verdict.Async/ValueTaskResultExtensions.cs
@@ -43,7 +43,14 @@ public static ValueTask<Result<K>> Map<T, K>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            return new ValueTask<Result<K>>(Apply(resultTask.Result, mapper));
+            try
+            {
+                return new ValueTask<Result<K>>(Apply(resultTask.Result, mapper));
+            }
+            catch (Exception ex)
+            {
+                return Faulted<Result<K>>(ex);
+            }
         }
 
         return Awaited(resultTask, mapper);
@@ -66,19 +73,26 @@ public static ValueTask<Result<K>> MapAsync<T, K>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            var result = resultTask.Result;
-            if (result.IsFailure)
+            try
             {
-                return new ValueTask<Result<K>>(Result<K>.Failure(result.Error));
+                var result = resultTask.Result;
+                if (result.IsFailure)
+                {
+                    return new ValueTask<Result<K>>(Result<K>.Failure(result.Error));
+                }
+
+                var mapped = mapper(result.Value);
+                if (mapped.IsCompletedSuccessfully)
+                {
+                    return new ValueTask<Result<K>>(Result<K>.Success(mapped.Result));
+                }
+
+                return AwaitedMapper(mapped);
             }
-
-            var mapped = mapper(result.Value);
-            if (mapped.IsCompletedSuccessfully)
+            catch (Exception ex)
             {
-                return new ValueTask<Result<K>>(Result<K>.Success(mapped.Result));
+                return Faulted<Result<K>>(ex);
             }
-
-            return AwaitedMapper(mapped);
         }
 
         return Awaited(resultTask, mapper);
@@ -105,7 +119,10 @@ public static ValueTask<Result<K>> MapAsync<T, K>(
     {
         if (mapper == null) throw new ArgumentNullException(nameof(mapper));
 
-        cancellationToken.ThrowIfCancellationRequested();
+        if (cancellationToken.IsCancellationRequested)
+        {
+            return Faulted<Result<K>>(new OperationCanceledException(cancellationToken));
+        }
 
         // Checked again inside, after the antecedent completes. A token cancelled
         // while the antecedent was still pending would otherwise still run the
@@ -130,7 +147,14 @@ public static ValueTask<Result<K>> Bind<T, K>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            return new ValueTask<Result<K>>(Apply(resultTask.Result, binder));
+            try
+            {
+                return new ValueTask<Result<K>>(Apply(resultTask.Result, binder));
+            }
+            catch (Exception ex)
+            {
+                return Faulted<Result<K>>(ex);
+            }
         }
 
         return Awaited(resultTask, binder);
@@ -153,19 +177,26 @@ public static ValueTask<Result<K>> BindAsync<T, K>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            var result = resultTask.Result;
-            if (result.IsFailure)
+            try
             {
-                return new ValueTask<Result<K>>(Result<K>.Failure(result.Error));
+                var result = resultTask.Result;
+                if (result.IsFailure)
+                {
+                    return new ValueTask<Result<K>>(Result<K>.Failure(result.Error));
+                }
+
+                var bound = binder(result.Value);
+                if (bound.IsCompletedSuccessfully)
+                {
+                    return new ValueTask<Result<K>>(bound.Result);
+                }
+
+                return bound;
             }
-
-            var bound = binder(result.Value);
-            if (bound.IsCompletedSuccessfully)
+            catch (Exception ex)
             {
-                return new ValueTask<Result<K>>(bound.Result);
+                return Faulted<Result<K>>(ex);
             }
-
-            return bound;
         }
 
         return Awaited(resultTask, binder);
@@ -192,7 +223,14 @@ public static ValueTask<Result<T>> Tap<T>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            return new ValueTask<Result<T>>(Apply(resultTask.Result, action));
+            try
+            {
+                return new ValueTask<Result<T>>(Apply(resultTask.Result, action));
+            }
+            catch (Exception ex)
+            {
+                return Faulted<Result<T>>(ex);
+            }
         }
 
         return Awaited(resultTask, action);
@@ -222,19 +260,26 @@ public static ValueTask<Result<T>> TapAsync<T>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            var result = resultTask.Result;
-            if (result.IsFailure)
+            try
             {
-                return new ValueTask<Result<T>>(result);
+                var result = resultTask.Result;
+                if (result.IsFailure)
+                {
+                    return new ValueTask<Result<T>>(result);
+                }
+
+                var running = action(result.Value);
+                if (running.IsCompletedSuccessfully)
+                {
+                    return new ValueTask<Result<T>>(result);
+                }
+
+                return AwaitedAction(running, result);
             }
-
-            var running = action(result.Value);
-            if (running.IsCompletedSuccessfully)
+            catch (Exception ex)
             {
-                return new ValueTask<Result<T>>(result);
+                return Faulted<Result<T>>(ex);
             }
-
-            return AwaitedAction(running, result);
         }
 
         return Awaited(resultTask, action);
@@ -268,19 +313,26 @@ public static ValueTask<Result<T>> TapErrorAsync<T>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            var result = resultTask.Result;
-            if (result.IsSuccess)
+            try
             {
-                return new ValueTask<Result<T>>(result);
+                var result = resultTask.Result;
+                if (result.IsSuccess)
+                {
+                    return new ValueTask<Result<T>>(result);
+                }
+
+                var running = action(result.Error);
+                if (running.IsCompletedSuccessfully)
+                {
+                    return new ValueTask<Result<T>>(result);
+                }
+
+                return AwaitedAction(running, result);
             }
-
-            var running = action(result.Error);
-            if (running.IsCompletedSuccessfully)
+            catch (Exception ex)
             {
-                return new ValueTask<Result<T>>(result);
+                return Faulted<Result<T>>(ex);
             }
-
-            return AwaitedAction(running, result);
         }
 
         return Awaited(resultTask, action);
@@ -317,7 +369,14 @@ public static ValueTask<Result<T>> Ensure<T>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            return new ValueTask<Result<T>>(Apply(resultTask.Result, predicate, error));
+            try
+            {
+                return new ValueTask<Result<T>>(Apply(resultTask.Result, predicate, error));
+            }
+            catch (Exception ex)
+            {
+                return Faulted<Result<T>>(ex);
+            }
         }
 
         return Awaited(resultTask, predicate, error);
@@ -349,7 +408,14 @@ public static ValueTask<TOut> Match<T, TOut>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            return new ValueTask<TOut>(Apply(resultTask.Result, onSuccess, onFailure));
+            try
+            {
+                return new ValueTask<TOut>(Apply(resultTask.Result, onSuccess, onFailure));
+            }
+            catch (Exception ex)
+            {
+                return Faulted<TOut>(ex);
+            }
         }
 
         return Awaited(resultTask, onSuccess, onFailure);
@@ -375,10 +441,17 @@ public static ValueTask<TOut> MatchAsync<T, TOut>(
 
         if (resultTask.IsCompletedSuccessfully)
         {
-            var result = resultTask.Result;
-            var chosen = result.IsSuccess ? onSuccess(result.Value) : onFailure(result.Error);
+            try
+            {
+                var result = resultTask.Result;
+                var chosen = result.IsSuccess ? onSuccess(result.Value) : onFailure(result.Error);
 
-            return chosen.IsCompletedSuccessfully ? new ValueTask<TOut>(chosen.Result) : chosen;
+                return chosen.IsCompletedSuccessfully ? new ValueTask<TOut>(chosen.Result) : chosen;
+            }
+            catch (Exception ex)
+            {
+                return Faulted<TOut>(ex);
+            }
         }
 
         return Awaited(resultTask, onSuccess, onFailure);
@@ -416,4 +489,28 @@ public static ValueTask<Result<T>> AsValueTask<T>(this Task<Result<T>> resultTas
 
         return new ValueTask<Result<T>>(resultTask);
     }
+
+    /// <summary>
+    /// A completed task carrying the exception a delegate threw on the fast path.
+    /// </summary>
+    /// <remarks>
+    /// The fast path runs the delegate before returning, so without this an
+    /// exception escaped the call itself instead of the task it returns. The
+    /// <see cref="Task"/> overloads are async methods and always put it in the
+    /// task, so switching overloads moved where a caller had to catch it.
+    /// <para>
+    /// Rethrown from an async method rather than built with
+    /// <c>Task.FromException</c> or a <c>TaskCompletionSource</c>, because only
+    /// the async builder turns an <see cref="OperationCanceledException"/> into a
+    /// cancelled task while keeping the original exception object for the await
+    /// to rethrow. Allocates only when something threw.
+    /// </para>
+    /// </remarks>
+#pragma warning disable CS1998 // Nothing to await: the method exists to rethrow.
+    private static async ValueTask<T> Faulted<T>(Exception exception)
+    {
+        System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(exception).Throw();
+        return default!;
+    }
+#pragma warning restore CS1998
 }
diff --git a/src/Verdict.Extensions/ErrorCollection.cs b/src/Verdict.Extensions/ErrorCollection.cs
index 27eff4d..531bd52 100644
--- a/src/Verdict.Extensions/ErrorCollection.cs
+++ b/src/Verdict.Extensions/ErrorCollection.cs
@@ -311,6 +311,28 @@ private static int Fill(ICollection<Error> source, Error[] destination, int limi
         return filled;
     }
 
+    /// <summary>
+    /// Returns the collection unchanged, or throws if it holds no errors.
+    /// </summary>
+    /// <remarks>
+    /// A failure with no errors has nothing to report: <c>ToSingleResult</c>
+    /// threw on it and a response built from it said "0 validation error(s)".
+    /// It was usually an empty validation list passed straight through, so the
+    /// mistake is reported where it was made. A released collection is passed
+    /// through, because its count is no longer known to be zero.
+    /// </remarks>
+    internal static ErrorCollection RequireErrors(ErrorCollection errors)
+    {
+        if (errors._count == 0 && !errors.IsDisposed)
+        {
+            throw new ArgumentException(
+                "A failed result needs at least one error. Return a success when there are none.",
+                nameof(errors));
+        }
+
+        return errors;
+    }
+
     /// <summary>
     /// Gets the error at the specified index.
     /// </summary>
diff --git a/src/Verdict.Extensions/MultiResult.cs b/src/Verdict.Extensions/MultiResult.cs
index e0d94cc..3194031 100644
--- a/src/Verdict.Extensions/MultiResult.cs
+++ b/src/Verdict.Extensions/MultiResult.cs
@@ -35,8 +35,11 @@ public T Value
         {
             if (!_isSuccess)
             {
-                throw new InvalidOperationException(
-                    $"Cannot access Value on a failed result. {_errors.Count} error(s) occurred.");
+                // RawCount, because Count throws once the errors are released and
+                // the caller asked about the value, not the errors.
+                throw new InvalidOperationException(_errors.IsDisposed
+                    ? "Cannot access Value on a failed result. Its errors were already released."
+                    : $"Cannot access Value on a failed result. {_errors.RawCount} error(s) occurred.");
             }
             return _value;
         }
@@ -103,13 +106,20 @@ public static MultiResult<T> Failure(Error error) =>
     /// Creates a failed result with multiple errors.
     /// </summary>
     public static MultiResult<T> Failure(params Error[] errors) =>
-        new(ErrorCollection.Create(errors));
+        new(ErrorCollection.RequireErrors(ErrorCollection.Create(errors)));
 
     /// <summary>
     /// Creates a failed result with an error collection.
     /// </summary>
     public static MultiResult<T> Failure(ErrorCollection errors) =>
-        new(errors);
+        new(ErrorCollection.RequireErrors(errors));
+
+    /// <summary>
+    /// Carries an existing failure's errors into a new result without checking
+    /// them, so a combinator on <c>default(MultiResult)</c> propagates it as it
+    /// always has rather than reporting the caller's empty error list.
+    /// </summary>
+    internal static MultiResult<T> Forward(ErrorCollection errors) => new(errors);
 
     /// <summary>
     /// Creates a failed result with the specified error code and message.
@@ -264,13 +274,13 @@ public static MultiResult Failure(Error error) =>
     /// Creates a failed result with multiple errors.
     /// </summary>
     public static MultiResult Failure(params Error[] errors) =>
-        new(ErrorCollection.Create(errors));
+        new(ErrorCollection.RequireErrors(ErrorCollection.Create(errors)));
 
     /// <summary>
     /// Creates a failed result with an error collection.
     /// </summary>
     public static MultiResult Failure(ErrorCollection errors) =>
-        new(errors);
+        new(ErrorCollection.RequireErrors(errors));
 
     /// <summary>
     /// Creates a failed result with the specified error code and message.
diff --git a/src/Verdict.Extensions/MultiResultCombinators.cs b/src/Verdict.Extensions/MultiResultCombinators.cs
index a1ed876..49dd672 100644
--- a/src/Verdict.Extensions/MultiResultCombinators.cs
+++ b/src/Verdict.Extensions/MultiResultCombinators.cs
@@ -43,7 +43,7 @@ public static MultiResult<TOut> Map<T, TOut>(
 
         return result.IsSuccess
             ? MultiResult<TOut>.Success(mapper(result.Value))
-            : MultiResult<TOut>.Failure(result.ErrorCollection.Detach());
+            : MultiResult<TOut>.Forward(result.ErrorCollection.Detach());
     }
 
     // --------------------------------------------------------------- Bind --
@@ -60,7 +60,7 @@ public static MultiResult<TOut> Bind<T, TOut>(
 
         return result.IsSuccess
             ? binder(result.Value)
-            : MultiResult<TOut>.Failure(result.ErrorCollection.Detach());
+            : MultiResult<TOut>.Forward(result.ErrorCollection.Detach());
     }
 
     // -------------------------------------------------------------- Match --
@@ -155,7 +155,7 @@ public static async Task<MultiResult<TOut>> MapAsync<T, TOut>(
         if (mapper is null) throw new ArgumentNullException(nameof(mapper));
 
         var result = await resultTask.ConfigureAwait(false);
-        if (result.IsFailure) return MultiResult<TOut>.Failure(result.ErrorCollection.Detach());
+        if (result.IsFailure) return MultiResult<TOut>.Forward(result.ErrorCollection.Detach());
 
         return MultiResult<TOut>.Success(await mapper(result.Value).ConfigureAwait(false));
     }
@@ -172,7 +172,7 @@ public static async Task<MultiResult<TOut>> BindAsync<T, TOut>(
 
         var result = await resultTask.ConfigureAwait(false);
         return result.IsFailure
-            ? MultiResult<TOut>.Failure(result.ErrorCollection.Detach())
+            ? MultiResult<TOut>.Forward(result.ErrorCollection.Detach())
             : await binder(result.Value).ConfigureAwait(false);
     }
 
diff --git a/src/Verdict.Logging/ResultLogger.cs b/src/Verdict.Logging/ResultLogger.cs
index e73bd98..8ca5c95 100644
--- a/src/Verdict.Logging/ResultLogger.cs
+++ b/src/Verdict.Logging/ResultLogger.cs
@@ -118,7 +118,7 @@ public static async Task<Result<T>> CreateAsync<T>(
 
         try
         {
-            var result = await operation();
+            var result = await operation().ConfigureAwait(false);
 
             if (result.IsSuccess)
             {
@@ -196,7 +196,7 @@ public static async Task<Result> CreateAsync(
 
         try
         {
-            var result = await operation();
+            var result = await operation().ConfigureAwait(false);
 
             if (result.IsSuccess)
             {
diff --git a/src/Verdict/Error.cs b/src/Verdict/Error.cs
index 74b30bf..7eee96b 100644
--- a/src/Verdict/Error.cs
+++ b/src/Verdict/Error.cs
@@ -52,21 +52,6 @@ public Error(string code, string message, Exception? exception = null)
     /// </summary>
     public const string TruncationMarker = "... [truncated]";
 
-    /// <summary>
-    /// Removes control characters and bounds the length.
-    /// </summary>
-    /// <remarks>
-    /// This runs on every error, including the hot failure path, so it allocates
-    /// nothing unless it actually has to change something: a clean message is
-    /// scanned and returned as it arrived.
-    /// <para>
-    /// Control characters are removed rather than rejected. A carriage return in
-    /// a message forges a line in any plain-text log sink, and throwing instead
-    /// would turn a logging concern into a crash at the worst possible moment.
-    /// The error code still throws on bad input, because a code is chosen by the
-    /// programmer and a message usually is not.
-    /// </para>
-    /// </remarks>
     /// <summary>
     /// Whether the message holds anything that has to be removed.
     /// </summary>
@@ -83,7 +68,9 @@ public Error(string code, string message, Exception? exception = null)
     /// what this uses where it exists.
     /// <para>
     /// Tab is excluded from the set because it is ordinary in a message and does
-    /// not start a new line in a log.
+    /// not start a new line in a log. The C1 controls, NEL among them, and the
+    /// Unicode line and paragraph separators are included, because some log
+    /// viewers and JSON-lines readers break a line on them too.
     /// </para>
     /// </remarks>
 #if NET8_0_OR_GREATER
@@ -92,18 +79,17 @@ public Error(string code, string message, Exception? exception = null)
 
     private static string BuildControlCharacters()
     {
-        var characters = new char[32];
+        var characters = new char[128];
         var count = 0;
 
-        for (var c = '\u0000'; c < ' '; c++)
+        for (var c = '\u0000'; c <= '\u2029'; c++)
         {
-            if (c != '\t')
+            if (IsControlCharacter(c))
             {
                 characters[count++] = c;
             }
         }
 
-        characters[count++] = '\u007f';
         return new string(characters, 0, count);
     }
 
@@ -114,8 +100,7 @@ private static bool ContainsControlCharacter(string message)
     {
         for (var i = 0; i < message.Length; i++)
         {
-            var c = message[i];
-            if (c != '\t' && (c < ' ' || c == '\u007f'))
+            if (IsControlCharacter(message[i]))
             {
                 return true;
             }
@@ -125,6 +110,27 @@ private static bool ContainsControlCharacter(string message)
     }
 #endif
 
+    private static bool IsControlCharacter(char c) =>
+        (c < ' ' && c != '\t')
+        || (c >= '\u007f' && c <= '\u009f')
+        || c == '\u2028'
+        || c == '\u2029';
+
+    /// <summary>
+    /// Removes control characters and bounds the length.
+    /// </summary>
+    /// <remarks>
+    /// This runs on every error, including the hot failure path, so it allocates
+    /// nothing unless it actually has to change something: a clean message is
+    /// scanned and returned as it arrived.
+    /// <para>
+    /// Control characters are removed rather than rejected. A carriage return in
+    /// a message forges a line in any plain-text log sink, and throwing instead
+    /// would turn a logging concern into a crash at the worst possible moment.
+    /// The error code still throws on bad input, because a code is chosen by the
+    /// programmer and a message usually is not.
+    /// </para>
+    /// </remarks>
     private static string Normalize(string? message)
     {
         if (string.IsNullOrEmpty(message))
@@ -144,12 +150,20 @@ private static string Normalize(string? message)
         var limit = text.Length <= MaxMessageLength
             ? text.Length
             : MaxMessageLength - TruncationMarker.Length;
+
+        // Never cut between the two halves of a surrogate pair. A lone high
+        // surrogate is not valid UTF-16 and serialises as a replacement character.
+        if (limit < text.Length && char.IsHighSurrogate(text[limit - 1]))
+        {
+            limit--;
+        }
+
         var builder = new System.Text.StringBuilder(limit + TruncationMarker.Length);
 
         for (var i = 0; i < limit; i++)
         {
             var c = text[i];
-            builder.Append(c != '\t' && (c < ' ' || c == '\u007f') ? ' ' : c);
+            builder.Append(IsControlCharacter(c) ? ' ' : c);
         }
 
         if (text.Length > MaxMessageLength)
diff --git a/tests/Verdict.ApiApproval.Tests/ApprovedApi/Verdict.AspNetCore.approved.txt b/tests/Verdict.ApiApproval.Tests/ApprovedApi/Verdict.AspNetCore.approved.txt
index f0ece41..338f75f 100644
--- a/tests/Verdict.ApiApproval.Tests/ApprovedApi/Verdict.AspNetCore.approved.txt
+++ b/tests/Verdict.ApiApproval.Tests/ApprovedApi/Verdict.AspNetCore.approved.txt
@@ -21,6 +21,7 @@ namespace Verdict.AspNetCore
         public static Microsoft.AspNetCore.Mvc.ProblemDetails CreateFromError(Verdict.Error error, int statusCode = 400) { }
         public static Microsoft.AspNetCore.Mvc.ProblemDetails CreateFromError(Verdict.Error error, int statusCode, Verdict.AspNetCore.VerdictProblemDetailsOptions options) { }
         public static Microsoft.AspNetCore.Mvc.ValidationProblemDetails CreateFromMultiResult<T>(Verdict.Extensions.MultiResult<T> result) { }
+        public static Microsoft.AspNetCore.Mvc.ValidationProblemDetails CreateFromMultiResult<T>(Verdict.Extensions.MultiResult<T> result, Verdict.AspNetCore.VerdictProblemDetailsOptions options) { }
         public static void ResetDefaultOptions() { }
         public static void SetDefaultOptions(Verdict.AspNetCore.VerdictProblemDetailsOptions options) { }
     }
diff --git a/tests/Verdict.AspNetCore.Tests/BodylessStatusTests.cs b/tests/Verdict.AspNetCore.Tests/BodylessStatusTests.cs
new file mode 100644
index 0000000..c6424be
--- /dev/null
+++ b/tests/Verdict.AspNetCore.Tests/BodylessStatusTests.cs
@@ -0,0 +1,70 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http.HttpResults;
+using Microsoft.AspNetCore.Mvc;
+using Xunit;
+
+namespace Verdict.AspNetCore.Tests;
+
+/// <summary>
+/// A success mapped to 204 or 304 used to write the value as JSON, and Kestrel
+/// throws when a response with one of those codes gets a body.
+/// </summary>
+public class BodylessStatusTests
+{
+    [Theory]
+    [InlineData(204)]
+    [InlineData(304)]
+    public void ToHttpResultSendsNoBody(int status)
+    {
+        var result = Result<int>.Success(42).ToHttpResult(successStatusCode: status);
+
+        var code = Assert.IsType<StatusCodeHttpResult>(result);
+        Assert.Equal(status, code.StatusCode);
+    }
+
+    [Theory]
+    [InlineData(204)]
+    [InlineData(304)]
+    public void ToHttpResultWithAContextSendsNoBody(int status)
+    {
+        var result = Result<int>.Success(42).ToHttpResult(new DefaultHttpContext(), status);
+
+        var code = Assert.IsType<StatusCodeHttpResult>(result);
+        Assert.Equal(status, code.StatusCode);
+    }
+
+    [Fact]
+    public void ToActionResultWithAContextSendsNoBody()
+    {
+        var result = Result<int>.Success(42).ToActionResult(new DefaultHttpContext(), 204);
+
+        var code = Assert.IsType<StatusCodeResult>(result.Result);
+        Assert.Equal(204, code.StatusCode);
+    }
+
+    [Fact]
+    public void ALocationDoesNotBringTheBodyBack()
+    {
+        var result = Result<int>.Success(42).ToActionResult(successStatusCode: 204, locationUri: "/items/1");
+
+        Assert.IsType<NoContentResult>(result.Result);
+    }
+
+    [Fact]
+    public void A304IsNotWrittenAsAnObject()
+    {
+        var result = Result<int>.Success(42).ToActionResult(successStatusCode: 304);
+
+        var code = Assert.IsType<StatusCodeResult>(result.Result);
+        Assert.Equal(304, code.StatusCode);
+    }
+
+    [Fact]
+    public void A200StillCarriesTheValue()
+    {
+        var result = Result<int>.Success(42).ToHttpResult();
+
+        var json = Assert.IsType<JsonHttpResult<int>>(result);
+        Assert.Equal(42, json.Value);
+    }
+}
diff --git a/tests/Verdict.AspNetCore.Tests/SecureDefaultsTests.cs b/tests/Verdict.AspNetCore.Tests/SecureDefaultsTests.cs
index 5c60a19..6930b34 100644
--- a/tests/Verdict.AspNetCore.Tests/SecureDefaultsTests.cs
+++ b/tests/Verdict.AspNetCore.Tests/SecureDefaultsTests.cs
@@ -159,4 +159,69 @@ public void ALiveMultiResultStillReportsItsErrors()
         Assert.Contains("age cannot be negative", body, StringComparison.Ordinal);
         Assert.Contains("name is required", body, StringComparison.Ordinal);
     }
+
+    [Fact]
+    public void AMultiResultDoesNotLeakAnExceptionMessage()
+    {
+        // The single-error path withheld this and the multi-error path wrote
+        // "[CODE] message" for every entry regardless of the options.
+        var result = MultiResult<int>.Failure(
+            new Error("INVALID_AGE", "age cannot be negative"),
+            Error.FromException(DatabaseFailure, sanitize: false));
+
+        var details = ProblemDetailsFactory.CreateFromMultiResult(result);
+        var body = Body(details);
+
+        Assert.DoesNotContain("hunter2", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("svc_billing", body, StringComparison.Ordinal);
+        Assert.DoesNotContain(nameof(InvalidOperationException), body, StringComparison.Ordinal);
+        Assert.Contains("age cannot be negative", body, StringComparison.Ordinal);
+        Assert.Equal(500, details.Status);
+    }
+
+    [Fact]
+    public void AMultiResultHonoursIncludeErrorMessage()
+    {
+        ProblemDetailsFactory.SetDefaultOptions(new VerdictProblemDetailsOptions { IncludeErrorMessage = false });
+        var result = MultiResult<int>.Failure(
+            new Error("INVALID_AGE", "age cannot be negative"),
+            new Error("INVALID_NAME", "name is required"));
+
+        var body = Body(ProblemDetailsFactory.CreateFromMultiResult(result));
+
+        Assert.DoesNotContain("age cannot be negative", body, StringComparison.Ordinal);
+        Assert.Contains("An unexpected error occurred.", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AMultiResultHonoursIncludeErrorCode()
+    {
+        var result = MultiResult<int>.Failure(
+            new Error("INVALID_AGE", "age cannot be negative"),
+            new Error("INVALID_NAME", "name is required"));
+
+        var body = Body(ProblemDetailsFactory.CreateFromMultiResult(
+            result, new VerdictProblemDetailsOptions { IncludeErrorCode = false }));
+
+        Assert.DoesNotContain("INVALID_AGE", body, StringComparison.Ordinal);
+        Assert.Contains("age cannot be negative", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AMultiResultShowsExceptionsWhenAskedTo()
+    {
+        var result = MultiResult<int>.Failure(Error.FromException(DatabaseFailure, sanitize: false));
+
+        var body = Body(ProblemDetailsFactory.CreateFromMultiResult(
+            result, new VerdictProblemDetailsOptions { IncludeExceptionDetails = true }));
+
+        Assert.Contains("svc_billing", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ADefaultErrorMapsToABadRequest()
+    {
+        // default(Error) has a null code and used to throw from the dictionary lookup.
+        Assert.Equal(400, ErrorStatusCodeMapper.GetStatusCode(default));
+    }
 }
diff --git a/tests/Verdict.Async.Tests/ValueTaskResultExtensionsTests.cs b/tests/Verdict.Async.Tests/ValueTaskResultExtensionsTests.cs
index 2268641..eebf0fb 100644
--- a/tests/Verdict.Async.Tests/ValueTaskResultExtensionsTests.cs
+++ b/tests/Verdict.Async.Tests/ValueTaskResultExtensionsTests.cs
@@ -273,4 +273,42 @@ public async Task MatchAsyncExistsOnTheTaskApiToo()
 
         Assert.Equal(42, response);
     }
+
+    [Theory]
+    [InlineData("map")]
+    [InlineData("bind")]
+    [InlineData("tap")]
+    [InlineData("ensure")]
+    [InlineData("match")]
+    public void AThrowingDelegateFaultsTheTaskOnTheFastPath(string operation)
+    {
+        // The completed path ran the delegate synchronously and let it throw out
+        // of the call, so a caller holding the ValueTask saw a different failure
+        // shape depending on whether the source had finished yet.
+        var boom = new InvalidOperationException("boom");
+        var task = Completed(21);
+
+        var returned = operation switch
+        {
+            "map" => task.Map<int, int>(_ => throw boom).AsTask(),
+            "bind" => task.Bind<int, int>(_ => throw boom).AsTask(),
+            "tap" => task.Tap(_ => throw boom).AsTask(),
+            "ensure" => task.Ensure(_ => throw boom, Missing).AsTask(),
+            _ => (Task)task.Match<int, int>(_ => throw boom, _ => 0).AsTask(),
+        };
+
+        Assert.True(returned.IsFaulted);
+        Assert.Same(boom, returned.Exception!.InnerException);
+    }
+
+    [Fact]
+    public void AnAlreadyCancelledTokenCancelsTheTask()
+    {
+        using var source = new CancellationTokenSource();
+        source.Cancel();
+
+        var returned = Completed(21).MapAsync((x, _) => new ValueTask<int>(x), source.Token).AsTask();
+
+        Assert.True(returned.IsCanceled);
+    }
 }
diff --git a/tests/Verdict.Extensions.Tests/ProductionReadinessTests.cs b/tests/Verdict.Extensions.Tests/ProductionReadinessTests.cs
index 9c05d19..26927dc 100644
--- a/tests/Verdict.Extensions.Tests/ProductionReadinessTests.cs
+++ b/tests/Verdict.Extensions.Tests/ProductionReadinessTests.cs
@@ -289,14 +289,42 @@ public void ErrorCollection_Create_WithSingleError_ShouldWork()
     }
 
     [Fact]
-    public void MultiResult_Failure_WithEmptyErrors_ShouldStillBeFailure()
+    public void MultiResult_Map_OnDefault_StillPropagatesTheFailure()
     {
-        // Arrange & Act
-        var result = MultiResult<int>.Failure(Array.Empty<Error>());
+        // The empty-errors check belongs where a caller builds a failure, not
+        // where a combinator forwards one it was handed.
+        var mapped = default(MultiResult<int>).Map(x => x + 1);
 
-        // Assert - empty errors array still creates failure
-        result.IsFailure.Should().BeTrue();
-        result.ErrorCount.Should().Be(0);
+        mapped.IsFailure.Should().BeTrue();
+    }
+
+    [Fact]
+    public void MultiResult_Value_AfterDisposeErrors_ThrowsInvalidOperation()
+    {
+        // Reading Value on a failure is documented to throw InvalidOperationException.
+        // After DisposeErrors it threw ObjectDisposedException from the message instead.
+        // Enough errors to be pooled; a small collection has nothing to release.
+        var errors = Enumerable.Range(0, 64).Select(i => new Error("E" + i, "m")).ToList();
+        var result = MultiResult<int>.Failure(ErrorCollection.Create((IEnumerable<Error>)errors));
+        result.DisposeErrors();
+
+        Action read = () => _ = result.Value;
+
+        read.Should().Throw<InvalidOperationException>().WithMessage("*released*");
+    }
+
+    [Fact]
+    public void MultiResult_Failure_WithEmptyErrors_Throws()
+    {
+        // A failure with no errors has nothing to report and rendered as an
+        // empty 400, so it is refused at construction.
+        Action generic = () => MultiResult<int>.Failure(Array.Empty<Error>());
+        Action nonGeneric = () => MultiResult.Failure(Array.Empty<Error>());
+        Action collection = () => MultiResult<int>.Failure(ErrorCollection.Create(Array.Empty<Error>()));
+
+        generic.Should().Throw<ArgumentException>();
+        nonGeneric.Should().Throw<ArgumentException>();
+        collection.Should().Throw<ArgumentException>();
     }
 
     [Fact]
diff --git a/tests/Verdict.Tests/ErrorMessageBoundsTests.cs b/tests/Verdict.Tests/ErrorMessageBoundsTests.cs
index 34104ab..209354e 100644
--- a/tests/Verdict.Tests/ErrorMessageBoundsTests.cs
+++ b/tests/Verdict.Tests/ErrorMessageBoundsTests.cs
@@ -31,6 +31,10 @@ public void AControlCharacterCannotForgeALogLine()
     [InlineData('\u0007')]
     [InlineData('\u001b')]
     [InlineData('\u007f')]
+    [InlineData('\u0085')]
+    [InlineData('\u009b')]
+    [InlineData('\u2028')]
+    [InlineData('\u2029')]
     public void OtherControlCharactersAreRemovedToo(char control)
     {
         var error = new Error("E", $"before{control}after");
@@ -93,4 +97,19 @@ public void ANullMessageIsStillEmptyRatherThanNull()
 
         Assert.Equal(string.Empty, error.Message);
     }
+
+    [Fact]
+    public void TruncationDoesNotSplitASurrogatePair()
+    {
+        // The cut used to land between the two halves of an emoji, leaving a lone
+        // high surrogate that an encoder turns into U+FFFD or rejects.
+        var cut = Error.MaxMessageLength - Error.TruncationMarker.Length;
+        var text = new string('A', cut - 1) + "\U0001F600" + new string('B', 100);
+
+        var error = new Error("E", text);
+
+        var kept = error.Message.Substring(0, error.Message.Length - Error.TruncationMarker.Length);
+        Assert.False(char.IsHighSurrogate(kept[kept.Length - 1]));
+        Assert.EndsWith(Error.TruncationMarker, error.Message, StringComparison.Ordinal);
+    }
 }