you're right - in order for something to appear in the report, it must be returned by the schema, AND it must exist in this list.

I can add imaginary, made-up stuff to the list, and the whole system still works as intended. We just mustn't have an expectation that every field in the list will *necessarily* appear in a report. 

I'm not offended by how that works. I'm also happy with using this "explicit" strategy instead of using white- and black- lists.