ata-validator 1.41.0 → 1.43.0

package/lib/js-compiler.js

@@ -101,6 +101,38 @@ function emitUq(ctx) {
   return '_uq'
 }
 
+// The error and combined generators need the duplicate pair, not only the
+// verdict. `_uqp` returns the index of the duplicate (-1 when every item is
+// distinct) and leaves the item it repeats in `_uqpI`: the first item that has
+// a later equal, paired with its first later equal. That is the pair the
+// interpreted engine reports, and the generators used to report a different
+// one (the earliest repeat, paired with what it repeats), so the same document
+// named a different pair depending on the engine that answered. Short arrays
+// compare pairwise and allocate nothing; longer ones key a Map by value, or by
+// canonical string once an object appears. Building a canonical string for
+// every item on every call, as the generators did, made reading a uniqueItems
+// error up to ten times the cost of the verdict.
+const UQP_HELPER = "var _uqpI=0;function _uqp(a){var n=a.length,i,k;if(n<2)return -1;if(n<=12){for(i=0;i<n-1;i++)for(k=i+1;k<n;k++)if(_deq(a[i],a[k])){_uqpI=i;return k}return -1}var prim=true;for(i=0;i<n;i++){var x=a[i];if(x!==null&&typeof x==='object'){prim=false;break}}var m=new Map(),bi=-1,bj=-1;for(i=0;i<n;i++){var c=prim?a[i]:_cn(a[i]);var p=m.get(c);if(p===undefined)m.set(c,i);else if(p>=0){if(bi<0||p<bi){bi=p;bj=i}m.set(c,-1)}}if(bi<0)return -1;_uqpI=bi;return bj}"
+function emitUqp(ctx) {
+  emitUq(ctx)
+  hoistOnce(ctx, '_uqpHoisted', UQP_HELPER)
+  return '_uqp'
+}
+
+// An object or array a const error reports as `allowedValue`, parsed once per
+// compiled function rather than on every error: parsing it per error made
+// reading a const error two to five times what the check costs. A copy of its
+// own, not the compared constant, so an error a caller edits cannot change
+// what the validator compares against. Declared in the function's helper
+// code, so standalone output carries it the same way.
+function emitParamConstant(ctx, value) {
+  const name = `_pc${ctx.varCounter++}`
+  const decl = `const ${name}=JSON.parse(${JSON.stringify(JSON.stringify(value))})`
+  if (ctx.preamble) ctx.preamble.push(decl)
+  else ctx.helperCode.push(decl)
+  return name
+}
+
 // The compared value, parsed once at compile time. `JSON.parse` rather than a
 // JS object literal so a `__proto__` member stays an ordinary property.
 function emitConstant(ctx, value) {
@@ -144,7 +176,24 @@ const { compileSafe, patternIsSafe } = require('./safe-regex')
 let _nativeIsLinear = null
 // The linearity check only parses; it runs first so a pattern bound for the
 // RegExp is never compiled for the engine just to be told it could have been.
+// Unicode property escapes need a real RegExp in unicode mode, as the
+// interpreter compiles them (Interpreter#pattern): the linear engine does not
+// know them, and without the flag `\p{L}` reads as the letters p, {, L, }.
+// The flag only where the pattern is valid with it, again as the interpreter
+// does. These patterns used to send the whole schema to the interpreter.
+const PROP_ESCAPE = /\\[pP]\{/
+function reFlags (src) {
+  if (!PROP_ESCAPE.test(src)) return ''
+  try { new RegExp(src, 'u'); return 'u' } catch { return '' }
+}
+// The flag argument for generated `new RegExp(<json literal>)` source.
+function reFlagArg (jsonLit) {
+  let raw
+  try { raw = JSON.parse(jsonLit) } catch { return '' }
+  return typeof raw === 'string' && reFlags(raw) ? ",'u'" : ''
+}
 const useSafeEngine = (src) => {
+  if (PROP_ESCAPE.test(src)) return false
   if (_nativeIsLinear === null) _nativeIsLinear = require('./regex-linear').nativeIsLinear
   if (_nativeIsLinear(src)) return false
   return patternIsSafe(src)
@@ -155,7 +204,7 @@ const useSafeEngine = (src) => {
 // standalone embeds the engine), else a plain RegExp. Both expose `.test`.
 function safeReClosure (ctx, src) {
   if (useSafeEngine(src)) { ctx.usesSafeRe = true; return compileSafe(src) }
-  return new RegExp(src)
+  return new RegExp(src, reFlags(src))
 }
 
 // Compile a JSON Schema into a pure JS validator function.
@@ -196,7 +245,7 @@ function literalValue (lit) {
 }
 
 function unescapeSp (sp) {
-  return sp.indexOf('\\') === -1 ? sp : sp.replace(/\\(.)/g, '$1')
+  return sp.indexOf('\\') === -1 ? sp : sp.replace(/\\u([0-9a-fA-F]{4})|\\(.)/g, (m, h, c) => (h !== undefined ? String.fromCharCode(parseInt(h, 16)) : c))
 }
 
 const FRAME_INLINE_MAX = 120
@@ -306,6 +355,7 @@ function compileToJS(schema, defs, schemaMap) {
   // A $ref cycle on one value recurses here as it does in generated code; see
   // hasSameInstanceRefCycle.
   if (!defs && hasSameInstanceRefCycle(schema)) return null
+  if (!defs && bothDefsContainers(schema)) return null
 
   // unevaluatedProperties / unevaluatedItems need annotation tracking this
   // path does not do. Decline so the schema reaches an engine that does.
@@ -557,7 +607,7 @@ function compileToJS(schema, defs, schemaMap) {
   }
   if (schema.pattern) {
     try {
-      const re = useSafeEngine(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern)
+      const re = useSafeEngine(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern, reFlags(schema.pattern))
       checks.push((d) => typeof d !== 'string' || re.test(d))
     } catch {
       return null
@@ -1390,6 +1440,25 @@ function unevalPropsModeled(schema, schemaMap) {
   return true
 }
 
+// Every `$ref` string under a node, once per node.
+const _refStrings = new WeakMap()
+function refStringsOf(node) {
+  let set = _refStrings.get(node)
+  if (set !== undefined) return set
+  set = new Set()
+  const seen = new Set()
+  const walk = (n) => {
+    if (n === null || typeof n !== 'object' || seen.has(n)) return
+    seen.add(n)
+    if (Array.isArray(n)) { for (const x of n) walk(x); return }
+    if (typeof n.$ref === 'string') set.add(n.$ref)
+    for (const k of Object.keys(n)) if (k !== 'enum' && k !== 'const' && k !== 'default' && k !== 'examples') walk(n[k])
+  }
+  walk(node)
+  _refStrings.set(node, set)
+  return set
+}
+
 function codegenSafe(schema, schemaMap) {
   if (typeof schema === 'boolean') return true
   if (typeof schema !== 'object' || schema === null) return true
@@ -1430,7 +1499,6 @@ function codegenSafe(schema, schemaMap) {
   }
 
   // Unicode property escapes in pattern need 'u' flag — codegen uses RegExp without it
-  if (schema.pattern && /\\[pP]\{/.test(schema.pattern)) return false
 
   // $ref — allow local refs (#/$defs/Name) and non-local refs if in schemaMap
   if (schema.$ref) {
@@ -1465,17 +1533,11 @@ function codegenSafe(schema, schemaMap) {
         !resolvedTarget.propertyNames
       if (!targetSimple && schema.unevaluatedProperties === undefined && schema.unevaluatedItems === undefined) return false
     }
-    // In Draft 2020-12, $ref with siblings is allowed. Only bail if no unevaluated* keyword
-    // (unevaluated schemas need $ref + siblings to work properly): without one, the
-    // generators emit the $ref and skip the rest of the node, so a sibling that
-    // validates would be dropped. Schema-organization keywords and annotations
-    // validate nothing and do not count. Annotations are listed rather than
-    // inferred from what is not a validation keyword, so a keyword this list
-    // does not know still declines instead of being skipped. Measured on the
-    // 977 SchemaStore schemas: a $ref with a description or title beside it sent
-    // 223 of them to the interpreted engine.
-    const siblings = Object.keys(schema).filter(k => !REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-'))
-    if (siblings.length > 0 && schema.unevaluatedProperties === undefined && schema.unevaluatedItems === undefined) return false
+    // In Draft 2020-12, $ref with siblings applies both. The verdict
+    // generator compiles the siblings after the reference (genCodeNode), the
+    // combined one too (genCodeCNode), and the error generator declines such
+    // a node, so a sibling is never dropped. This used to decline the whole
+    // schema unless an unevaluated keyword was beside the reference.
   }
 
   // additionalProperties as schema — supported when no composition (allOf/oneOf/anyOf)
@@ -1505,8 +1567,9 @@ function codegenSafe(schema, schemaMap) {
     // that only the interpreted engine provides.
     if (schema.unevaluatedProperties === false || (typeof schema.unevaluatedProperties === 'object' && schema.unevaluatedProperties !== null)) {
       const evalResult = collectEvaluated(schema, schemaMap)
-      if (evalResult.dynamic && evalResult.allProps) return false
-      if (evalResult.dynamic && !unevalPropsModeled(schema, schemaMap)) return false
+      // What the static model cannot represent is built at run time
+      // (genUnevalDynamicVerdict); shapes that cannot be (dynamic references,
+      // reference cycles) decline there.
     }
   }
   // unevaluatedItems: allow boolean and schema values
@@ -1527,7 +1590,12 @@ function codegenSafe(schema, schemaMap) {
     // Defs on a $ref cycle compile as named functions (see genCode); nothing
     // to decline here. cyclicDefNames() is the walk that used to bail.
     for (const [name, def] of Object.entries(defs)) {
-      if (/[~/"']/.test(name)) return false // special chars in def name
+      // A name the generators would have to spell inside a path or an
+      // identifier. Only a problem when a reference names it: tsconfig.json
+      // keeps a comment object under the definition `//`, which nothing
+      // references, and declined whole for it. A definition reached through
+      // a deeper pointer was renamed by normalizeDeepRefs.
+      if (/[~/"']/.test(name) && refStringsOf(schema).has('#/' + (schema.$defs === defs ? '$defs' : 'definitions') + '/' + name.replace(/~/g, '~0').replace(/\//g, '~1'))) return false
       if (typeof def === 'boolean') return false
       if (typeof def === 'object' && def !== null) {
         // A non-fragment $id (e.g. 'sub.json', 'http://...') opens a new base URI
@@ -1551,7 +1619,6 @@ function codegenSafe(schema, schemaMap) {
   // compiled to code that ignored it.
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
-      if (/\\[pP]\{/.test(pat)) return false
       if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return false
     }
   }
@@ -1587,37 +1654,6 @@ function codegenSafe(schema, schemaMap) {
   return true
 }
 
-// Returns true if the schema (or any nested sub-schema reachable through the
-// usual keywords) has additionalProperties as a schema value. Used by the
-// combined-codegen bail since that path does not emit the per-key loop yet.
-function hasAdditionalPropertiesSchema(schema) {
-  if (typeof schema !== 'object' || schema === null) return false
-  if (typeof schema.additionalProperties === 'object' && schema.additionalProperties !== null) return true
-  const objSubs = ['properties', 'patternProperties', '$defs', 'definitions', 'dependentSchemas']
-  for (const key of objSubs) {
-    if (schema[key] && typeof schema[key] === 'object') {
-      for (const v of Object.values(schema[key])) {
-        if (hasAdditionalPropertiesSchema(v)) return true
-      }
-    }
-  }
-  const arrSubs = ['allOf', 'anyOf', 'oneOf', 'prefixItems']
-  for (const key of arrSubs) {
-    if (Array.isArray(schema[key])) {
-      for (const s of schema[key]) {
-        if (hasAdditionalPropertiesSchema(s)) return true
-      }
-    }
-  }
-  const singleSubs = ['items', 'contains', 'not', 'if', 'then', 'else', 'propertyNames']
-  for (const key of singleSubs) {
-    if (typeof schema[key] === 'object' && schema[key] !== null) {
-      if (hasAdditionalPropertiesSchema(schema[key])) return true
-    }
-  }
-  return false
-}
-
 // Schema-bearing keywords, so the walk below never mistakes a property named
 // "$ref" for an actual reference.
 const SUBSCHEMA_MAPS = ['properties', 'patternProperties', '$defs', 'definitions', 'dependentSchemas']
@@ -1921,8 +1957,20 @@ function hasSameInstanceRefCycle(root) {
   return found
 }
 
+// The generators look a definition up by name in one table, `$defs` or else
+// `definitions`, whichever container the pointer named. With both at the root,
+// `#/definitions/x` read `$defs/x`: a draft 7 schema carrying both, with
+// different schemas under one name, rejected what it allowed and accepted
+// what it rejected. The interpreter resolves the pointer as written, so a
+// schema with both goes there. None of SchemaStore's 980 has both.
+function bothDefsContainers(schema) {
+  return schema.$defs !== null && typeof schema.$defs === 'object' &&
+    schema.definitions !== null && typeof schema.definitions === 'object'
+}
+
 function sharedCodegenGate(schema, schemaMap) {
   if (typeof schema !== 'object' || schema === null) return true
+  if (bothDefsContainers(schema)) return false
   if (hasSameInstanceRefCycle(schema)) return false
   if (!codegenSafe(schema, schemaMap)) return false
   if (needsBaseTracking(schema, schemaMap, new Set())) return false
@@ -2020,9 +2068,248 @@ function normalizePropertyNamesWalk(root) {
   return walk(root)
 }
 
+// A local `$ref` that is a JSON pointer to anything other than a top-level
+// definition (`#/definitions/item/properties/id`, `#/properties/foo`,
+// `#/$defs/a/items`) became the generators' own definition reference: the
+// pointer is resolved here, at compile time, and its target added as a
+// definition under a name of its own, so every path that already handles
+// `#/$defs/name` handles it, cycles included. The generators knew only the
+// top-level form and declined the rest, which kept 40 of 980 SchemaStore
+// schemas, tsconfig.json among them, on the interpreted engine for every
+// document. Left alone, as before: a pointer that does not resolve to a
+// schema, one that passes through a subschema with its own `$id` (another
+// base, whose pointers mean something else), and every `$ref` inside such a
+// subschema. Copy on write; errors keep their paths, which name the place of
+// the reference, not of its target, and are ordered against the schema as
+// the caller wrote it.
+const DEF_REF = /^#\/(?:\$defs|definitions)\/[^/]+$/
+const _deepRefsNormalized = new WeakMap()
+function normalizeDeepRefs(root) {
+  if (!root || typeof root !== 'object' || Array.isArray(root)) return root
+  const hit = _deepRefsNormalized.get(root)
+  if (hit !== undefined) return hit
+  const out = normalizeDeepRefsWalk(root)
+  _deepRefsNormalized.set(root, out)
+  return out
+}
+function resolveLocalPointer(root, ref) {
+  let node = root
+  const segs = ref.slice(2).split('/')
+  for (let i = 0; i < segs.length; i++) {
+    let seg = segs[i].replace(/~1/g, '/').replace(/~0/g, '~')
+    // Draft 7 schemas reach the generators with `definitions` renamed to
+    // `$defs` (lib/draft7.js) and their references as written, which the
+    // top-level form already reads either way; so does this.
+    if (i === 0 && (seg === 'definitions' || seg === '$defs') && !Object.prototype.hasOwnProperty.call(node, seg)) seg = seg === 'definitions' ? '$defs' : 'definitions'
+    if (node === null || typeof node !== 'object') return undefined
+    if (Array.isArray(node)) {
+      if (!/^(?:0|[1-9]\d*)$/.test(seg) || +seg >= node.length) return undefined
+      node = node[+seg]
+    } else {
+      if (!Object.prototype.hasOwnProperty.call(node, seg)) return undefined
+      node = node[seg]
+    }
+    if (node !== null && typeof node === 'object' && !Array.isArray(node) && typeof node.$id === 'string') return undefined
+  }
+  if (typeof node === 'boolean') return node
+  if (node === null || typeof node !== 'object' || Array.isArray(node)) return undefined
+  return node
+}
+function normalizeDeepRefsWalk(root) {
+  // First pass: the deep pointers used outside any nested `$id`, and their
+  // targets.
+  const targets = new Map()
+  const scan = (node, nested, seen) => {
+    if (node === null || typeof node !== 'object') return
+    if (seen.has(node)) return
+    seen.add(node)
+    if (Array.isArray(node)) { for (const n of node) scan(n, nested, seen); return }
+    const inner = nested || (node !== root && typeof node.$id === 'string')
+    if (!inner && typeof node.$ref === 'string' && node.$ref.startsWith('#/') && !DEF_REF.test(node.$ref) && !targets.has(node.$ref)) {
+      const t = resolveLocalPointer(root, node.$ref)
+      if (t !== undefined) targets.set(node.$ref, t)
+    }
+    for (const k of Object.keys(node)) if (k !== 'enum' && k !== 'const' && k !== 'default' && k !== 'examples') scan(node[k], inner, seen)
+  }
+  scan(root, false, new Set())
+  if (targets.size === 0) return root
+  const defsKey = root.$defs && typeof root.$defs === 'object' ? '$defs' : (root.definitions && typeof root.definitions === 'object' ? 'definitions' : '$defs')
+  const existing = root[defsKey] && typeof root[defsKey] === 'object' ? root[defsKey] : {}
+  const names = new Map()
+  let n = 0
+  for (const ref of targets.keys()) {
+    let name
+    do { name = '__ata_ptr_' + n++ } while (Object.prototype.hasOwnProperty.call(existing, name))
+    names.set(ref, name)
+  }
+  // Second pass: the references rewritten, copy on write, sharing one copy
+  // per node so a target reached twice stays one object.
+  const memo = new Map()
+  const walk = (node, nested) => {
+    if (node === null || typeof node !== 'object') return node
+    const key = nested ? null : node
+    if (key !== null && memo.has(key)) return memo.get(key)
+    if (Array.isArray(node)) {
+      let out = node
+      if (key !== null) memo.set(key, out)
+      for (let i = 0; i < node.length; i++) {
+        const w = walk(node[i], nested)
+        if (w !== node[i]) { if (out === node) { out = node.slice(); if (key !== null) memo.set(key, out) } out[i] = w }
+      }
+      return out
+    }
+    const inner = nested || (node !== root && typeof node.$id === 'string')
+    if (inner) return node
+    let out = node
+    memo.set(node, out)
+    const own = (k, v) => { if (out === node) { out = { ...node }; memo.set(node, out) } out[k] = v }
+    if (typeof node.$ref === 'string' && names.has(node.$ref)) own('$ref', '#/' + defsKey + '/' + names.get(node.$ref))
+    for (const k of Object.keys(node)) {
+      if (k === '$ref' || k === 'enum' || k === 'const' || k === 'default' || k === 'examples') continue
+      const v = node[k]
+      if (v === null || typeof v !== 'object') continue
+      const w = walk(v, false)
+      if (w !== v) own(k, w)
+    }
+    return out
+  }
+  const rewritten = walk(root, false)
+  const out = rewritten === root ? { ...root } : rewritten
+  const defs = { ...(out[defsKey] && typeof out[defsKey] === 'object' ? out[defsKey] : {}) }
+  for (const [ref, name] of names) {
+    const t = targets.get(ref)
+    defs[name] = typeof t === 'boolean' ? t : walk(t, false)
+  }
+  out[defsKey] = defs
+  return out
+}
+
+// Every reference the interpreted engine can resolve becomes a definition
+// reference the generators handle: URNs, `$id`-relative and absolute URIs,
+// anchors, pointers into a resource with its own `$id`, names with characters
+// the generators cannot spell, documents registered through `schemas`. The
+// target of each is found by the interpreter's own resolver (indexSchemas and
+// resolveRef in lib/interpreter.js), so the two engines cannot resolve a
+// reference differently, and is added under a name of its own as with
+// normalizeDeepRefs. Once every reference names a definition, nested `$id`s
+// no longer change what anything means and are dropped from the copy, which
+// is what kept those schemas from compiling. Left to normalizeDeepRefs, as
+// before: a schema with dynamic references (their meaning depends on the
+// resources at run time), one with an embedded resource in another dialect,
+// and one with any reference the resolver cannot resolve.
+const _refsNormalized = new WeakMap()
+function normalizeRefs(root, schemaMap) {
+  if (!root || typeof root !== 'object' || Array.isArray(root)) return root
+  let byMap = _refsNormalized.get(root)
+  const mapKey = schemaMap || _refsNormalized
+  if (byMap !== undefined && byMap.has(mapKey)) return byMap.get(mapKey)
+  let out
+  try { out = normalizeRefsWalk(root, schemaMap) } catch { out = null }
+  if (out === null) out = normalizeDeepRefs(root)
+  if (byMap === undefined) { byMap = new Map(); _refsNormalized.set(root, byMap) }
+  byMap.set(mapKey, out)
+  return out
+}
+const SKIP_VALUE_KEYS = new Set(['enum', 'const', 'default', 'examples'])
+function normalizeRefsWalk(root, schemaMap) {
+  const text = JSON.stringify(root)
+  if (!text.includes('"$ref"')) return root
+  if (/"\$(?:dynamicRef|recursiveRef|dynamicAnchor|recursiveAnchor)"/.test(text)) return null
+  const { indexSchemas, resolveRef } = require('./interpreter')._refInternals
+  const state = indexSchemas(root, schemaMap && schemaMap.size ? schemaMap : null)
+  const rootDialect = typeof root.$schema === 'string' ? root.$schema.replace(/#$/, '') : null
+  // Resolve every reference reachable from the root, following into targets
+  // in other documents.
+  const names = new Map() // target node -> synthetic name
+  const refTarget = new Map() // reference site node -> target node
+  const visited = new Set()
+  let fail = false
+  const visit = (node) => {
+    if (fail || node === null || typeof node !== 'object' || visited.has(node)) return
+    visited.add(node)
+    if (Array.isArray(node)) { for (const n of node) visit(n); return }
+    if (node !== root && typeof node.$schema === 'string' && rootDialect !== null && node.$schema.replace(/#$/, '') !== rootDialect) { fail = true; return }
+    // A dynamic reference reached through another document means the same as
+    // one in the root: its target depends on the resources at run time.
+    if (node.$dynamicRef !== undefined || node.$dynamicAnchor !== undefined || node.$recursiveRef !== undefined || node.$recursiveAnchor !== undefined) { fail = true; return }
+    if (typeof node.$ref === 'string' && state.nodeBase.has(node)) {
+      const base = state.nodeBase.get(node)
+      const ref = node.$ref
+      const local = base === state.rootBase && (ref === '#' || (DEF_REF.test(ref) && !/[~%]/.test(ref)))
+      if (!local) {
+        const { node: t } = resolveRef(ref, base, state)
+        if (t === undefined || (typeof t !== 'boolean' && (t === null || typeof t !== 'object' || Array.isArray(t)))) { fail = true; return }
+        refTarget.set(node, t)
+        // The root, however it is spelled, is `#`: a copy of it under its own
+        // definitions would contain itself.
+        if (t === root) { /* named '#' below */ }
+        else if (typeof t === 'object' && !names.has(t)) { names.set(t, null); visit(t) }
+        if (typeof t === 'boolean' && !names.has(t)) names.set(t, null)
+      }
+    }
+    for (const k of Object.keys(node)) if (!SKIP_VALUE_KEYS.has(k)) visit(node[k])
+  }
+  visit(root)
+  if (fail) return null
+  if (refTarget.size === 0) return root
+  const defsKey = root.$defs && typeof root.$defs === 'object' ? '$defs' : (root.definitions && typeof root.definitions === 'object' ? 'definitions' : '$defs')
+  const existing = root[defsKey] && typeof root[defsKey] === 'object' ? root[defsKey] : {}
+  let n = 0
+  for (const t of names.keys()) {
+    let name
+    do { name = '__ata_ref_' + n++ } while (Object.prototype.hasOwnProperty.call(existing, name))
+    names.set(t, name)
+  }
+  // The copy: references renamed, nested `$id`s dropped.
+  const memo = new Map()
+  const walk = (node) => {
+    if (node === null || typeof node !== 'object') return node
+    if (memo.has(node)) return memo.get(node)
+    if (Array.isArray(node)) {
+      const out = []
+      memo.set(node, out)
+      for (const x of node) out.push(walk(x))
+      return out
+    }
+    const out = {}
+    memo.set(node, out)
+    for (const k of Object.keys(node)) {
+      if (k === '$id' && node !== root) continue
+      if (k === '$ref' && refTarget.has(node)) {
+        const t = refTarget.get(node)
+        out.$ref = t === root ? '#' : '#/' + defsKey + '/' + names.get(t)
+        continue
+      }
+      out[k] = SKIP_VALUE_KEYS.has(k) ? node[k] : walk(node[k])
+    }
+    return out
+  }
+  const out = walk(root)
+  const defs = { ...(out[defsKey] && typeof out[defsKey] === 'object' ? out[defsKey] : {}) }
+  for (const [t, name] of names) defs[name] = typeof t === 'boolean' ? t : walk(t)
+  out[defsKey] = defs
+  return out
+}
+
+// What the three generators compile from: the schema with deep local pointers
+// turned into definition references, then propertyNames normalized. The same
+// for all three, so they decline and agree on the same schemas.
+function prepareForCodegen(schema, schemaMap) {
+  return normalizePropertyNames(normalizeRefs(schema, schemaMap))
+}
+
+const VERDICT_SPLIT = 64 * 1024
+function sourceSize (lines, ctx) {
+  let n = 0
+  for (const l of lines) n += l.length
+  for (const l of ctx.preamble) n += l.length
+  if (ctx.deferredChecks) for (const l of ctx.deferredChecks) n += l.length
+  return n
+}
+
 function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
   const inputSchema = schema
-  schema = normalizePropertyNames(schema)
+  schema = prepareForCodegen(schema, schemaMap)
   if (typeof schema === 'boolean') return schema ? () => true : () => false
   if (typeof schema !== 'object' || schema === null) return null
   // removeAdditional: a verdict function that deletes the keys the remover
@@ -2044,7 +2331,6 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
   // patternProperties: bail only on boolean sub-schemas or unicode property escapes
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
-      if (/\\[pP]\{/.test(pat)) return null
       if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return null
     }
   }
@@ -2093,20 +2379,28 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
   if (hasUnresolvableRef(schema, rootDefs, anchors, schemaMap, new Set())) return null
   if (needsBaseTracking(schema, schemaMap, new Set())) return null
 
-  const ctx = { varCounter: 0, helpers: [], helperCode: [], preamble: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen], rootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors, rootSchema: inputSchema, userFormats: userFormats || null, removeNodes,
-    keywords: (opts && opts.keywords) || null, kwEmitted: null }
-  if (ctx.keywords) {
-    // Macro keywords expand into a schema of their own, which this generator
-    // does not apply; such a schema stays on the interpreted engine.
-    if (usesMacroKeyword(schema, schemaMap, ctx.keywords)) return null
-    ctx.kwEmitted = new Set()
-  }
-  const lines = []
-  try {
-    genCode(schema, 'd', lines, ctx)
-  } catch (e) {
-    if (e === DECLINE) return null
-    throw e
+  // Macro keywords expand into a schema of their own, which this generator
+  // does not apply; such a schema stays on the interpreted engine.
+  if (opts && opts.keywords && usesMacroKeyword(schema, schemaMap, opts.keywords)) return null
+  // Every reference is first expanded where it is used, which is the fastest
+  // form for the checks. Past VERDICT_SPLIT of source the function is
+  // generated again with each definition referenced from several places
+  // written once, as a function in the preamble: expanded, SchemaStore's sarif
+  // (79 KB of schema) came to 2.8 MB of verdict source, and compiling it was
+  // half of the first validate() call.
+  let ctx, lines
+  for (const share of [false, true]) {
+    ctx = { varCounter: 0, helpers: [], helperCode: [], preamble: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen], rootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors, rootSchema: inputSchema, userFormats: userFormats || null, removeNodes,
+      keywords: (opts && opts.keywords) || null, kwEmitted: null, shareDefs: share }
+    if (ctx.keywords) ctx.kwEmitted = new Set()
+    lines = []
+    try {
+      genCode(schema, 'd', lines, ctx)
+    } catch (e) {
+      if (e === DECLINE) return null
+      throw e
+    }
+    if (share || sourceSize(lines, ctx) <= VERDICT_SPLIT) break
   }
   // Every schema node that carries a custom keyword must have had its check
   // written. A path that inlined a node without going through genCodeNode
@@ -2140,10 +2434,10 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
       closureValues.push(compileSafe(JSON.parse(safeMatch[2])))
       continue
     }
-    const match = code.match(/^const (_re\d+)=new RegExp\((.+)\)$/)
+    const match = code.match(/^const (_re\d+)=new RegExp\((.+?)(?:,'(u)')?\)$/)
     if (match) {
       closureNames.push(match[1])
-      closureValues.push(new RegExp(JSON.parse(match[2])))
+      closureValues.push(new RegExp(JSON.parse(match[2]), match[3] || ''))
     }
   }
 
@@ -2154,7 +2448,7 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
   // are built when first asked for, not here: most validators never call
   // validateJSON or get extended, and rewriting and compiling the source twice
   // more on every schema was about a third of what a first call cost.
-  let body, hybridThunk, tailThunk
+  let body, hybridThunk, tailThunk, resultThunk
   if (ctx.usesRecursion) {
     // Self-recursive: a named body reached through the cycle guard, so data
     // that points back at itself settles instead of exhausting the stack.
@@ -2164,6 +2458,7 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
     body = `${decl}function _run(d){\n  ${run}\n  }\n  return _run(d)`
     // Hybrid: keep the boolean answer, wrap only the outer call
     hybridThunk = () => `${decl}function _run(d){\n  ${run}\n  }\n  return _run(d)?R:E(d)`
+    resultThunk = () => `${decl}function _run(d){\n  ${run}\n  }\n  return _run(d)?${RESULT_TRUE}:${RESULT_FALSE}`
     tailThunk = () => `${decl}function _run(d){\n  ${run}\n  }\n  return _run(d)&&__ataTail(d)`
   } else if (defSets.length > 0) {
     // No self-reference at the root, but a def on a cycle can still be
@@ -2171,10 +2466,12 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
     const run = emitGuardedRun(`return _body(d)`, '', defSets)
     body = `function _body(d){\n  ${checkStr}\n  return true\n  }\n  function _run(d){\n  ${run}\n  }\n  return _run(d)`
     hybridThunk = () => `function _body(d){\n  ${checkStr}\n  return true\n  }\n  function _run(d){\n  ${run}\n  }\n  return _run(d)?R:E(d)`
+    resultThunk = () => `function _body(d){\n  ${checkStr}\n  return true\n  }\n  function _run(d){\n  ${run}\n  }\n  return _run(d)?${RESULT_TRUE}:${RESULT_FALSE}`
     tailThunk = () => `function _body(d){\n  ${checkStr}\n  return true\n  }\n  function _run(d){\n  ${run}\n  }\n  return _run(d)&&__ataTail(d)`
   } else {
     body = checkStr + '\n  return true'
     hybridThunk = () => replaceTopLevel(checkStr + '\n  return R')
+    resultThunk = () => replaceTopLevel(checkStr + '\n  return true', `return ${RESULT_TRUE}`, `return ${RESULT_FALSE}`)
     // An early accept inside the checks has to reach the tail too, so every
     // top-level `return true` becomes the tail call, by the same rewrite the
     // hybrid above relies on and test_hybrid_agreement holds to the suite.
@@ -2214,6 +2511,25 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
       return hybridFactory === null ? null : hybridFactory(...closureValues, R, E)
     }
 
+    // validate() itself: the same checks returning the result objects, for a
+    // validator past its first calls (see validator-core). One function per
+    // schema means the result is built at an allocation site of its own and
+    // nothing between the caller and the checks is shared with other schemas.
+    // Shared wrappers are what made reading results slow across many schemas:
+    // every validator's calls went through the same few call sites. The
+    // rejection is the lazy one, built from the arguments.
+    let resultFactory
+    boolFn._resultFactory = (LR, B, W, EE) => {
+      if (resultFactory === undefined) {
+        try {
+          resultFactory = new Function(...closureNames, '__ataLR', '__ataB', '__ataW', '__ataEE', `${preambleStr}return function(d){${resultThunk()}}`)
+        } catch {
+          resultFactory = null
+        }
+      }
+      return resultFactory === null ? null : resultFactory(...closureValues, LR, B, W, EE)
+    }
+
     // The same function with one more check where it would return true, for a
     // wrapper that enforces something the schema does not carry (see
     // Validator#_extendVerdict). Calling the check from here rather than from a
@@ -2291,40 +2607,75 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
 
 // Replace top-level `return false` → `return E(d)` and `return true` → `return R`.
 // Tracks function nesting depth to preserve nested function internals.
+const RESULT_TRUE = '{valid:true,data:d,errors:__ataEE}'
+const RESULT_FALSE = 'new __ataLR(__ataB,d,__ataW)'
+// The end of the string literal that starts at `i` (a quote character), or
+// the end of the code when it does not close.
+function skipString(code, i) {
+  const q = code[i]
+  let j = i + 1
+  while (j < code.length) {
+    const c = code[j]
+    if (c === '\\') { j += 2; continue }
+    if (c === q) return j + 1
+    j++
+  }
+  return code.length
+}
+
 function replaceTopLevel(code, onTrue = 'return R', onFalse = 'return E(d)') {
   let fnDepth = 0, result = '', i = 0
   while (i < code.length) {
+    // String literals are copied as they are. A property called `function`
+    // reads `d["function"]`, and the scan took the word for a nested function
+    // and left every return after it alone, so the hybrid returned a bare
+    // `false` where a result was due: validateJSON answered `false` instead
+    // of a rejection for such schemas. Text such as `return false` or a brace
+    // inside a string is not code either.
+    const ch = code[i]
+    if (ch === '"' || ch === "'" || ch === '`') {
+      const j = skipString(code, i)
+      result += code.slice(i, j)
+      i = j
+      continue
+    }
     // A nested closure keeps its own returns. Both spellings count: a
     // `function` keyword and an arrow with a block body. The inline pattern
     // compiler emits `(()=>{...return false...return true})()` and rewriting
     // those returns turned the arrow's boolean into an object, which made
     // `!(cond && obj)` false and let the hybrid accept what the boolean
     // program rejected.
-    const isFunctionKw = code.startsWith('function', i) && (i === 0 || /[^a-zA-Z_$]/.test(code[i - 1]))
+    const isFunctionKw = code.startsWith('function', i) && (i === 0 || /[^a-zA-Z_$]/.test(code[i - 1])) && !/[a-zA-Z0-9_$]/.test(code[i + 8] || '')
     const isArrowBlock = code.startsWith('=>{', i)
     if (isFunctionKw || isArrowBlock) {
-      // Skip to the opening brace, then track all braces inside the body.
+      // Skip to the opening brace, then track all braces inside the body,
+      // strings skipped as above.
       let j = isArrowBlock ? i + 2 : i + 8
       while (j < code.length && code[j] !== '{') j++
       result += code.slice(i, j + 1)
       i = j + 1
-      // Track braces inside this function body
       let braceDepth = 1
       while (i < code.length && braceDepth > 0) {
-        if (code[i] === '{') braceDepth++
-        else if (code[i] === '}') braceDepth--
-        if (braceDepth > 0) result += code[i]
-        else result += '}'  // closing brace of function
+        const c = code[i]
+        if (c === '"' || c === "'" || c === '`') {
+          const k = skipString(code, i)
+          result += code.slice(i, k)
+          i = k
+          continue
+        }
+        if (c === '{') braceDepth++
+        else if (c === '}') braceDepth--
+        result += c
         i++
       }
-    } else if (code.startsWith('return false', i)) {
+    } else if (code.startsWith('return false', i) && (i + 12 >= code.length || !/[a-zA-Z0-9_$]/.test(code[i + 12]))) {
       result += onFalse
       i += 12
-    } else if (code.startsWith('return true', i) && (i + 11 >= code.length || !/[a-zA-Z_$]/.test(code[i + 11]))) {
+    } else if (code.startsWith('return true', i) && (i + 11 >= code.length || !/[a-zA-Z0-9_$]/.test(code[i + 11]))) {
       result += onTrue
       i += 11
     } else {
-      result += code[i]
+      result += ch
       i++
     }
   }
@@ -2600,7 +2951,9 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   // $ref — guard against circular references
   // In 2020-12 with unevaluated*, $ref can coexist with siblings — don't early return
   // Only when THIS schema has unevaluated keywords directly (not via $ref target)
-  const hasSiblings = schema.$ref && (schema.unevaluatedProperties !== undefined || schema.unevaluatedItems !== undefined)
+  // Any keyword beside $ref that validates is compiled after the reference
+  // (2020-12 applies both; draft 7 drops such siblings when it is read).
+  const hasSiblings = !!schema.$ref && Object.keys(schema).some((k) => !REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-'))
   if (schema.$ref) {
     if (genRefNode(schema, v, lines, ctx, knownType, hasSiblings)) return
   }
@@ -2808,7 +3161,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
           ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`);
           ctx.usesSafeRe = true
         } else {
-          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`);
+          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`);
         }
       }
       const ri = ctx.regExpMap.get(pattern);
@@ -3330,6 +3683,31 @@ function genRefNode(schema, v, lines, ctx, knownType, hasSiblings) {
       }
       lines.push(`if(!${fnName}(${v}))return false`)
       if (!hasSiblings) return true
+    } else if (ctx.shareDefs && !ctx.refStack.has(schema.$ref) && (ctx.sharedDefs || (ctx.sharedDefs = sharedDefNames(ctx.rootSchema, ctx.rootDefs))).has(defName)) {
+      // A shared definition off any cycle, as a plain function in the
+      // preamble (see compileToJSCodegen): no guard, since it cannot re-enter
+      // itself. Generated over its own `d` like the cyclic ones above.
+      if (!ctx.sharedDefFns) ctx.sharedDefFns = new Map()
+      let fnName = ctx.sharedDefFns.get(defName)
+      if (!fnName) {
+        fnName = '_dv' + ctx.sharedDefFns.size + '_' + defName.replace(/[^A-Za-z0-9_]/g, '_')
+        ctx.sharedDefFns.set(defName, fnName)
+        const bodyLines = []
+        const outerDeferred = ctx.deferredChecks
+        ctx.deferredChecks = null
+        ctx.refStack.add(schema.$ref)
+        try {
+          genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx)
+        } finally {
+          ctx.refStack.delete(schema.$ref)
+        }
+        if (ctx.deferredChecks) for (const dc of ctx.deferredChecks) bodyLines.push(dc)
+        ctx.deferredChecks = outerDeferred
+        if (bodyLines.some((l) => /\b_validate\b/.test(l))) throw DECLINE
+        hoist(ctx, `function ${fnName}(d){${bodyLines.join('\n  ')}\n  return true}`)
+      }
+      lines.push(`if(!${fnName}(${v}))return false`)
+      if (!hasSiblings) return true
     } else if (ctx.refStack.has(schema.$ref)) { if (ctx.nestedBoolean) throw DECLINE; if (!hasSiblings) return true }
     else {
       ctx.refStack.add(schema.$ref)
@@ -3508,14 +3886,32 @@ function genPatternPropertiesNode(schema, v, lines, ctx, knownType, isObj) {
   return handledPropertyNames
 }
 
+// Whether the static unevaluatedProperties model checks the anyOf itself, so
+// genCodeNode leaves it out. Not when the set is built at run time
+// (unevalBuiltAtRuntime): that form only collects, and dropping the anyOf
+// there accepted a document no branch matched.
 function unevalChecksAnyOf(schema, ctx) {
   if (schema.unevaluatedProperties !== false) return false
   const r = collectEvaluated(schema, ctx.schemaMap, ctx.rootDefs)
-  return r.dynamic && !r.allProps
+  return r.dynamic && !r.allProps && !unevalBuiltAtRuntime(schema, ctx, r)
+}
+
+// The unevaluatedProperties forms the static model cannot represent; those
+// build the evaluated set at run time (genUnevalDynamicVerdict). Decided in
+// one place so genCodeNode and genUnevaluatedPropertiesNode cannot disagree
+// about which of them checks the node's anyOf.
+function unevalBuiltAtRuntime(schema, ctx, r) {
+  if (schema.unevaluatedProperties === true || schema.unevaluatedProperties === undefined) return false
+  if (r === undefined) r = collectEvaluated(schema, ctx.schemaMap, ctx.rootDefs)
+  return r.dynamic && (r.allProps || !unevalPropsModeled(schema, ctx.schemaMap))
 }
 
 function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, hoisted, earlyKeyCount) {
   const evalResult = collectEvaluated(schema, ctx.schemaMap, ctx.rootDefs)
+  if (unevalBuiltAtRuntime(schema, ctx, evalResult)) {
+    genUnevalDynamicVerdict(schema, v, lines, ctx, isObj)
+    return
+  }
 
   if (evalResult.allProps || schema.unevaluatedProperties === true) {
     // All props evaluated or unevaluatedProperties:true — no-op
@@ -4086,7 +4482,11 @@ const FORMAT_CODEGEN = {
 function esc(s) { return JSON.stringify(s).slice(1, -1).replace(/'/g, "\\'") }
 // A schema pointer segment for a pattern: JSON Pointer escaping, then made
 // safe for the single-quoted literal the error emitters use.
-function ptrSeg(s) { return s.replace(/~/g, '~0').replace(/\//g, '~1').replace(/\\/g, '\\\\').replace(/'/g, "\\'") }
+// A pointer segment as text for a single-quoted literal. Control characters
+// and the two line separators go in as \u escapes: written raw, a property
+// named "foo\nbar" broke the literal, the combined function failed to compile
+// and every schema with such a name lost it.
+function ptrSeg(s) { return s.replace(/~/g, '~0').replace(/\//g, '~1').replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/[\u0000-\u001f\u2028\u2029]/g, (c) => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0')) }
 
 // Resolve child path at codegen time when parent is a static string literal.
 // This enables frozen pre-allocation for ALL nested error objects.
@@ -4331,7 +4731,7 @@ function unevalLocalOk (node, key) {
 // generic and may visit data positions (an enum value, say); judging those is
 // harmless, since a data node that fails the test only makes the answer more
 // conservative and the generators never read data positions as schemas.
-function unevalAllProvablyLocal (root) {
+function unevalAllProvablyLocal (root, only) {
   const seen = new Set()
   const stack = [root]
   while (stack.length) {
@@ -4339,7 +4739,7 @@ function unevalAllProvablyLocal (root) {
     if (n === null || typeof n !== 'object' || seen.has(n)) continue
     seen.add(n)
     if (!Array.isArray(n)) {
-      if (n.unevaluatedProperties !== undefined && !unevalLocalOk(n, 'unevaluatedProperties')) return false
+      if (only !== 'items' && n.unevaluatedProperties !== undefined && !unevalLocalOk(n, 'unevaluatedProperties')) return false
       if (n.unevaluatedItems !== undefined && !unevalLocalOk(n, 'unevaluatedItems')) return false
     }
     for (const k of Array.isArray(n) ? n : Object.values(n)) stack.push(k)
@@ -4396,7 +4796,7 @@ function genCharCodeSwitch(keys, v) {
 // Valid path is still fast — only error path does extra work.
 function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts) {
   const inputSchema = schema
-  schema = normalizePropertyNames(schema)
+  schema = prepareForCodegen(schema, schemaMap)
   // unevaluated* is generated only where it is provably its plain counterpart
   // (see unevalLocalOk); any occurrence that is not keeps the whole schema on
   // the interpreted engine's error path, exactly as before.
@@ -4413,7 +4813,6 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
   if (!sharedCodegenGate(schema, schemaMap)) return null
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
-      if (/\\[pP]\{/.test(pat)) return null
       if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return null
     }
   }
@@ -4610,6 +5009,50 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
 // Emit codegen for oneOf/anyOf that runs each branch with error collection,
 // aggregates results, and uses __ataCollapse to surface a single best-branch
 // error. Wraps the existing per-branch evaluation; does not replace it.
+const BRANCH_VERDICT_MAX = 4096
+
+// What undoing a trial emission needs: during one, the context's arrays only
+// grow and its maps and sets only gain keys (a reference pushed onto refStack
+// by a declined branch is such a key), so their lengths and sizes are enough,
+// and what was added is cut off the end, in insertion order. Copying them
+// instead made the trial quadratic: 297 oneOf and anyOf on apollo-router,
+// each copying a helper list thousands long.
+function snapshotCtx (ctx) {
+  const out = new Map()
+  for (const k of Object.keys(ctx)) {
+    const x = ctx[k]
+    if (Array.isArray(x)) out.set(k, { kind: 'a', ref: x, n: x.length })
+    else if (x instanceof Map || x instanceof Set) out.set(k, { kind: 'c', ref: x, n: x.size })
+    else out.set(k, { kind: 'v', ref: x })
+  }
+  return out
+}
+function restoreCtx (ctx, saved) {
+  for (const k of Object.keys(ctx)) if (!saved.has(k)) delete ctx[k]
+  for (const [k, e] of saved) {
+    if (e.kind === 'a') { e.ref.length = Math.min(e.ref.length, e.n); ctx[k] = e.ref }
+    else if (e.kind === 'c') {
+      const extra = e.ref.size - e.n
+      if (extra > 0) {
+        const added = []
+        let i = 0
+        for (const key of e.ref.keys()) if (i++ >= e.n) added.push(key)
+        for (const key of added) e.ref.delete(key)
+      }
+      ctx[k] = e.ref
+    } else ctx[k] = e.ref
+  }
+}
+
+// Whether a node holds a reference anywhere below it.
+function holdsRef (node, seen = new Set()) {
+  if (node === null || typeof node !== 'object' || seen.has(node)) return false
+  seen.add(node)
+  if (typeof node.$ref === 'string' || typeof node.$dynamicRef === 'string') return true
+  for (const k of Object.keys(node)) if (holdsRef(node[k], seen)) return true
+  return false
+}
+
 function emitBranchCollapse (branches, keyword, v, pathExpr, lines, ctx, schemaPrefix) {
   ctx.usesBranchCollapse = true
   const fi = ctx.varCounter++
@@ -4629,7 +5072,14 @@ function emitBranchCollapse (branches, keyword, v, pathExpr, lines, ctx, schemaP
     const subLines = []
     const subSp = branchSp + '/' + i
     if (typeof sub === 'object' && sub !== null) {
-      genCodeE(sub, '_bv', '_bpth', subLines, ctx, subSp)
+      // A branch is a function of its own with a local `_e`; a collapse
+      // inside it reports there, not into the combined function's lists.
+      ctx.inBranchFn = (ctx.inBranchFn || 0) + 1
+      try {
+        genCodeE(sub, '_bv', '_bpth', subLines, ctx, subSp)
+      } finally {
+        ctx.inBranchFn--
+      }
     } else if (sub === false) {
       // A false branch never matches; it reports the same error the
       // interpreter attaches to a false schema.
@@ -4653,8 +5103,101 @@ function emitBranchCollapse (branches, keyword, v, pathExpr, lines, ctx, schemaP
   const pp = pathExpr || '""'
   ctx.helperCode.push(`const ${fnArr}=[${fns.map((b) => b === '' ? `function(){return{valid:true,errors:[]}}` : `function(${params}){${b}}`).join(',')}];const _bt${fi}=${titleArr}`)
   const call = `${fnArr}[_bi](${v},_pp${fi},_all${usesSp ? ',_sp' : ''})`
-  const ord = (() => { const o = ordinalFor(ctx.rootSchema, branchSp); return o === null ? 'null' : o })()
-  const report = `const ${collapsed}=__ataCollapse('${branchKw}',${resArr},_pp${fi},'${branchSp}',${ord});if(${collapsed}){_e.push(${collapsed});if(!_all)return{valid:false,errors:_e}}`
+  // branchSp is source text for a quoted literal, with backslashes and quotes
+  // escaped; the ordinal is looked up by the path itself. Looked up by the
+  // text, a path through a pattern such as `^\\d+$` found no node, or the
+  // wrong one, and the collapsed error sorted out of place against the other
+  // engines.
+  // In the runtime shape there is no ordering key (the reader looks the path
+  // up), so the collapsed error is in its final shape as it is built.
+  const ord = ctx.noOrdinal ? 'null' : (() => { const o = ordinalFor(ctx.rootSchema, unescapeSp(branchSp)); return o === null ? 'null' : o })()
+  // In the combined function `_e` is created on the first error and every
+  // error is collected (`_all` is true there), so the report only pushes.
+  const report = ctx.inCombined && !ctx.inBranchFn
+    ? `const ${collapsed}=__ataCollapse('${branchKw}',${resArr},_pp${fi},'${branchSp}',${ord},_bt${fi});if(${collapsed})(_e||(_e=[])).push(${collapsed})`
+    : `const ${collapsed}=__ataCollapse('${branchKw}',${resArr},_pp${fi},'${branchSp}',${ord},_bt${fi});if(${collapsed}){_e.push(${collapsed});if(!_all)return{valid:false,errors:_e}}`
+  // The node's runtime unevaluatedProperties already counted how many of
+  // these branches pass, through the annotation functions, which answer the
+  // same validity. A oneOf with exactly one, an anyOf with any, holds and
+  // reports nothing, so its branches are not run a second time to say so.
+  // Only in the combined function proper, where that count is in scope.
+  const counted = ctx.inCombined && !ctx.inBranchFn && ctx.branchCounts ? ctx.branchCounts.get(branches) : undefined
+  const same = counted !== undefined ? `${v}!==null&&typeof ${v}==='object'&&${counted.of}===${v}` : ''
+  let guard = counted !== undefined
+    ? (keyword === 'anyOf' ? `if(!(${same}&&${counted.count}>=1))` : `if(!(${same}&&${counted.count}===1))`)
+    : ''
+  // More than one oneOf branch passed: the error names them and carries no
+  // branch errors, so it is built from the bits the count left.
+  if (guard !== '' && keyword === 'oneOf' && counted.mask && ctx.inCombined && !ctx.inBranchFn) {
+    const ord0 = ctx.noOrdinal ? 'null' : (() => { const o = ordinalFor(ctx.rootSchema, unescapeSp(branchSp)); return o === null ? 'null' : o })()
+    guard = `if(${same}&&${counted.count}>1){const _pi${fi}=[];for(let _k=0;_k<${branches.length};_k++)if((${counted.mask}>>_k)&1)_pi${fi}.push(_k);(_e||(_e=[])).push(__ataMulti(_pi${fi},${branches.length},${pp},'${branchSp}',${ord0}))}else if(!(${same}&&${counted.count}===1))`
+  }
+  // Without such a count, each branch also gets a verdict function, and the
+  // passing branches are counted with those: a oneOf with exactly one and an
+  // anyOf with any hold, and a oneOf with more than one is reported from the
+  // bits, so the error-collecting branches run only when no branch passes
+  // and the collapse needs their errors to pick the closest. Running them to
+  // learn the count built a result object and an error list per branch,
+  // which made a oneOf matched twice cost 69 ns where counting costs about
+  // 12. A branch the verdict generator declines keeps the old path.
+  let vfArr = null
+  // Branches that hold a reference are left to the error branches: their
+  // verdicts would expand every definition again, as a second copy, where the
+  // error branches call the shared one.
+  if (guard === '' && !branches.some((b) => holdsRef(b))) {
+    // A trial: the generators are not exception-safe on the context (a
+    // reference left on refStack by a declined branch made the next error
+    // function write that branch as nothing, which read as valid), so the
+    // context is put back as it was when the verdicts decline.
+    const saved = snapshotCtx(ctx)
+    try {
+      const vfs = branches.map((sub) => {
+        if (sub === true) return 'function(){return true}'
+        if (sub === false) return 'function(){return false}'
+        const bl = []
+        nestedGenCode(sub, '_bv', bl, ctx)
+        return bl.length === 0 ? 'function(){return true}' : `function(_bv){${bl.join(';')};return true}`
+      })
+      // Only while the verdicts are small: they are a second copy of the
+      // branches, with every reference expanded, and on large branches that
+      // copy cost more to compile than counting saves (apollo-router's error
+      // function grew from 1.5 to 2.5 MB of source).
+      if (!vfs.some((b) => b.includes(SP_PLACEHOLDER)) && vfs.reduce((n, b) => n + b.length, 0) <= BRANCH_VERDICT_MAX) {
+        // One constant per branch, called directly: through an array the one
+        // call site sees every branch and none of them is inlined.
+        vfArr = `_bvf${fi}`
+        ctx.helperCode.push(vfs.map((b, i) => `const ${vfArr}_${i}=${b}`).join(';'))
+      } else {
+        restoreCtx(ctx, saved)
+      }
+    } catch (e) {
+      if (e !== DECLINE) throw e
+      restoreCtx(ctx, saved)
+    }
+  }
+  if (vfArr !== null) {
+    const L = branches.length
+    const top = ctx.inCombined && !ctx.inBranchFn
+    // An accepted document is still answered by the verdict first (see the
+    // result shape in compileToJSCombined): that is the fastest path to it,
+    // and dropping it measured 20 ns slower per accepted oneOf.
+    if (top) ctx.unguardedCollapse = true
+    const tests = branches.map((_, i) => `${vfArr}_${i}(${v})`)
+    if (keyword === 'anyOf') {
+      lines.push(`{const _pp${fi}=${pp};if(!(${tests.join('||')})){if(_all===0){_e.push(null);return{valid:false,errors:_e}}const ${resArr}=[];for(let _bi=0;_bi<${L};_bi++){const _br=${call};${resArr}.push(_br.valid?{valid:false,errors:_br.errors}:_br)}${report}}}`)
+    } else {
+      const mk = L <= 30
+      const collect = mk
+        ? `const _pi${fi}=[];for(let _k=0;_k<${L};_k++)if((_m${fi}>>_k)&1)_pi${fi}.push(_k);`
+        : ''
+      const multi = `__ataMulti(_pi${fi},${L},_pp${fi},'${branchSp}',${ord})`
+      const pushMulti = top ? `(_e||(_e=[])).push(${multi})` : `_e.push(${multi});if(!_all)return{valid:false,errors:_e}`
+      const count = tests.map((t, i) => `if(${t}){_n${fi}++;${mk ? `_m${fi}|=${1 << i}` : `_pi${fi}.push(${i})`}}`).join('')
+      lines.push(`{const _pp${fi}=${pp};let _n${fi}=0${mk ? `,_m${fi}=0` : `,_pi${fi}=[]`};${count}if(_n${fi}!==1){if(_all===0){_e.push(null);return{valid:false,errors:_e}}if(_n${fi}>1){${collect}${pushMulti}}else{const ${resArr}=[];for(let _bi=0;_bi<${L};_bi++)${resArr}.push(${call});${report}}}}`)
+    }
+    return
+  }
+  if (guard === '' && ctx.inCombined && !ctx.inBranchFn) ctx.unguardedCollapse = true
   if (keyword === 'anyOf') {
     // anyOf reports nothing once a branch passes, so the branches are first
     // only asked whether they pass. They are called with `_all` set to 0, a
@@ -4668,12 +5211,12 @@ function emitBranchCollapse (branches, keyword, v, pathExpr, lines, ctx, schemaP
     // no one read. Only when no branch passes do they run again with the
     // caller's `_all`, and the collapse sees them all, as before.
     const probe = `${fnArr}[_bi](${v},_pp${fi},0${usesSp ? ',_sp' : ''})`
-    lines.push(`{const _pp${fi}=${pp};let _bp${fi}=false;for(let _bi=0;_bi<${fnArr}.length;_bi++){if(${probe}.valid){_bp${fi}=true;break}}if(!_bp${fi}){if(_all===0){_e.push(null);return{valid:false,errors:_e}}const ${resArr}=[];for(let _bi=0;_bi<${fnArr}.length;_bi++){const _br=${call};${resArr}.push({valid:false,errors:_br.errors,title:_bt${fi}[_bi]})}${report}}}`)
+    lines.push(`${guard}{const _pp${fi}=${pp};let _bp${fi}=false;for(let _bi=0;_bi<${fnArr}.length;_bi++){if(${probe}.valid){_bp${fi}=true;break}}if(!_bp${fi}){if(_all===0){_e.push(null);return{valid:false,errors:_e}}const ${resArr}=[];for(let _bi=0;_bi<${fnArr}.length;_bi++){const _br=${call};${resArr}.push(_br.valid?{valid:false,errors:_br.errors}:_br)}${report}}}`)
   } else {
     // Asked only whether it passes (`_all` 0, see anyOf above), oneOf counts
     // the passing branches and answers; the branch errors of a probe are not
     // errors anyone reads and are not collapsed.
-    lines.push(`{const _pp${fi}=${pp};const ${resArr}=[];for(let _bi=0;_bi<${fnArr}.length;_bi++){const _br=${call};${resArr}.push({valid:_br.valid,errors:_br.errors,title:_bt${fi}[_bi]})}if(_all===0){let _n=0;for(const _r of ${resArr})if(_r.valid)_n++;if(_n!==1){_e.push(null);return{valid:false,errors:_e}}}else{${report}}}`)
+    lines.push(`${guard}{const _pp${fi}=${pp};const ${resArr}=[];for(let _bi=0;_bi<${fnArr}.length;_bi++)${resArr}.push(${call});if(_all===0){let _n=0;for(const _r of ${resArr})if(_r.valid)_n++;if(_n!==1){_e.push(null);return{valid:false,errors:_e}}}else{${report}}}`)
   }
 }
 
@@ -4701,6 +5244,13 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   }
   // $ref — resolve local and cross-schema refs
   if (schema.$ref) {
+    // The reference is followed and the rest of the node is not compiled; a
+    // keyword beside it that validates would be dropped, so the node
+    // declines (as in genCodeCNode). Reached since unevaluatedProperties
+    // next to a $ref stopped declining the combined function, whose oneOf
+    // and anyOf branches come from this generator: a branch was taken as
+    // passing with its siblings unchecked.
+    for (const k of Object.keys(schema)) if (!REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-')) throw DECLINE
     // A self-reference cannot be expressed here yet: the root helper takes no
     // path argument, so errors raised through it would carry the path of the
     // root rather than of the value that failed. This used to fall through as
@@ -4801,7 +5351,9 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       }
     })
     const expected = types.join(', ')
-    const expectedParam = types.length === 1 ? `'${types[0]}'` : JSON.stringify(types)
+    // As written: a one-element array stays an array, as the interpreted engine
+    // reports it.
+    const expectedParam = !Array.isArray(schema.type) ? `'${types[0]}'` : JSON.stringify(types)
     {
       const typeSp = `${schemaPrefix}/type`
       const lit = buildErrorLiteral({ keyword: 'type', schemaPath: typeSp, sourceMap: ctx.sourceMap })
@@ -4832,7 +5384,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     if (cv === null || typeof cv !== 'object') {
       lines.push(`if(${v}!==${JSON.stringify(cv)}){${fail('const', 'const', `{allowedValue:${JSON.stringify(schema.const)}}`, "'must be equal to constant'")}}`)
     } else {
-      lines.push(`if(!${emitDeq(ctx)}(${v},${emitConstant(ctx, cv)})){${fail('const', 'const', `{allowedValue:JSON.parse(${JSON.stringify(JSON.stringify(schema.const))})}`, "'must be equal to constant'")}}`)
+      lines.push(`if(!${emitDeq(ctx)}(${v},${emitConstant(ctx, cv)})){${fail('const', 'const', `{allowedValue:${emitParamConstant(ctx, schema.const)}}`, "'must be equal to constant'")}}`)
     }
   }
 
@@ -4901,7 +5453,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
           ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
           ctx.usesSafeRe = true
         } else {
-          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`)
         }
       }
       const ri = ctx.regExpMap.get(pattern);
@@ -4976,7 +5528,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
           ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
           ctx.usesSafeRe = true
         } else {
-          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`)
         }
       }
       patChecks.push(`_re${ctx.regExpMap.get(pattern)}.test(_k${ci}[_i])`)
@@ -5002,6 +5554,12 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   // to emit. The error keeps the keyword's own identity: the interpreted
   // engine reports these as unevaluatedProperties with the key named, and the
   // two engines are pinned to identical output.
+  // Inside the combined function (a oneOf or anyOf branch, see
+  // emitBranchCollapse) this generator only has the static form. A branch
+  // whose evaluated set depends on its own branches would report the wrong
+  // errors, and the collapse would pick the wrong closest branch; declined.
+  if (ctx.inCombined && schema.unevaluatedProperties !== undefined && schema.unevaluatedProperties !== true && !unevalLocalOk(schema, 'unevaluatedProperties')) throw DECLINE
+  if (ctx.inCombined && schema.unevaluatedItems !== undefined && schema.unevaluatedItems !== true && !unevalLocalOk(schema, 'unevaluatedItems')) throw DECLINE
   if (schema.unevaluatedProperties === false && schema.additionalProperties === undefined) genUnevaluatedFalseE(schema, v, pathExpr, lines, ctx, schemaPrefix, isObj)
 
   // unevaluatedItems: false under the same rule. The interpreted engine
@@ -5112,18 +5670,10 @@ function genDynamicRefE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 
 function genUniqueItemsE(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isArr) {
   const si = ctx.varCounter++
-  const itemType = schema.items && typeof schema.items === 'object' && schema.items.type
-  const isPrim = itemType === 'string' || itemType === 'number' || itemType === 'integer'
-  const maxItems = schema.maxItems
   const failExpr = (iVar, jVar) => fail('uniqueItems', 'uniqueItems', `{i:${iVar},j:${jVar}}`, `'must NOT have duplicate items (items ## '+${jVar}+' and '+${iVar}+' are identical)'`)
-  let inner
-  if (isPrim && maxItems && maxItems <= 16) {
-    inner = `for(let _i=1;_i<${v}.length;_i++){for(let _k=0;_k<_i;_k++){if(${v}[_i]===${v}[_k]){${failExpr('_k', '_i')};break}}}`
-  } else if (isPrim) {
-    inner = `const _s${si}=new Map();for(let _i=0;_i<${v}.length;_i++){const _prev=_s${si}.get(${v}[_i]);if(_prev!==undefined){${failExpr('_prev', '_i')};break};_s${si}.set(${v}[_i],_i)}`
-  } else {
-    inner = `const _cn${si}=function(x){if(x===null||typeof x!=='object')return typeof x+':'+x;if(Array.isArray(x))return'['+x.map(_cn${si}).join(',')+']';return'{'+Object.keys(x).sort().map(function(k){return JSON.stringify(k)+':'+_cn${si}(x[k])}).join(',')+'}'};const _s${si}=new Map();for(let _i=0;_i<${v}.length;_i++){const _k=_cn${si}(${v}[_i]);const _prev=_s${si}.get(_k);if(_prev!==undefined){${failExpr('_prev', '_i')};break};_s${si}.set(_k,_i)}`
-  }
+  // Only reached once the verdict has rejected, or when errors are wanted, so
+  // one strategy for every item type: the hoisted pair finder. See UQP_HELPER.
+  const inner = `const _j${si}=${emitUqp(ctx)}(${v});if(_j${si}>=0){const _i${si}=_uqpI;${failExpr('_i' + si, '_j' + si)}}`
   lines.push(isArr ? `{${inner}}` : `if(Array.isArray(${v})){${inner}}`)
 }
 
@@ -5142,7 +5692,7 @@ function genUnevaluatedFalseE(schema, v, pathExpr, lines, ctx, schemaPrefix, isO
         ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
         ctx.usesSafeRe = true
       } else {
-        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`)
       }
     }
     patChecksU.push(`_re${ctx.regExpMap.get(pattern)}.test(_k${ui}[_i])`)
@@ -5174,7 +5724,7 @@ function genPatternPropertiesE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`);
         ctx.usesSafeRe = true
       } else {
-        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`);
+        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`);
       }
     }
     const ri = ctx.regExpMap.get(pattern);
@@ -5204,7 +5754,7 @@ function genAdditionalSchemaE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
         ctx.usesSafeRe = true
       } else {
-        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`)
       }
     }
     patTests.push(`_re${ctx.regExpMap.get(pattern)}.test(_k${ki})`)
@@ -5256,7 +5806,7 @@ function genPropertyNamesE(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
         ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`);
         ctx.usesSafeRe = true
       } else {
-        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`);
+        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`);
       }
     }
     const ri = ctx.regExpMap.get(pattern);
@@ -5338,29 +5888,80 @@ function genIfE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 // Returns VALID_RESULT for valid data, {valid:false, errors} for invalid.
 // Avoids double-pass (jsFn → false → errFn runs same checks again).
 // Uses type-aware optimizations: after type check passes, skip guards.
+// An error literal the combined function shares between calls, frozen. Two
+// non-enumerable fields ride along, invisible to Object.keys, spread and
+// JSON: `_s` says the object is shared, so the reader copies it before handing
+// it out (Object.isFrozen, the check it replaces, cost more than the copy),
+// and `_o` is its schema ordinal, known here and otherwise looked up by path
+// on every read. An `_o` the literal already carries, for standalone output,
+// is kept. `_t` is an empty slot lib/enrich-error.js fills once.
+function sharedErr (lit, rootSchema) {
+  Object.defineProperty(lit, '_s', { value: true })
+  // A slot the enrichment fills on the first read with the fields that depend
+  // only on this literal (code, expected, rank), so later reads skip them.
+  Object.defineProperty(lit, '_t', { value: {} })
+  if (lit._o === undefined) {
+    const o = ordinalFor(rootSchema, lit.schemaPath)
+    if (typeof o === 'number') Object.defineProperty(lit, '_o', { value: o })
+  }
+  return Object.freeze(lit)
+}
+
+// The push for one error in the combined generator. With `ctx.rich` (the
+// validator's errors are being read and enriched, see validator-core) the
+// error is built in its final enriched shape where it happens, by makeRich in
+// lib/enrich-site.js with a site record made here at compile time; otherwise
+// it is the plain literal `lean` the generator always emitted. `valueExpr` is
+// the value at `pathExpr`, which enrichment otherwise finds again by walking
+// the document. `paramsShared` names a frozen params object hoisted for a
+// static site, so a static error's params stay one shared object as before.
+function errPushC(ctx, keyword, sp, pathExpr, paramsCode, msgCode, valueExpr, lean, paramsShared) {
+  if (!ctx.rich) return `(_e||(_e=[])).push(${lean})`
+  if (!ctx.richMk) {
+    ctx.richMk = true
+    const { makeRich } = require('./enrich-site')
+    ctx.closureVars.push('_mk'); ctx.closureVals.push(makeRich)
+  }
+  let paramsVal
+  try { paramsVal = Function('return ' + paramsCode)() } catch { paramsVal = undefined }
+  const fmt = keyword === 'format' && paramsVal ? paramsVal.format : undefined
+  const { errorSite } = require('./enrich-site')
+  const siteVar = `_S${ctx.varCounter++}`
+  ctx.closureVars.push(siteVar)
+  // Inside a shared definition (emitSharedDefC) the site holds the path past
+  // the definition and the reference's own comes in as `_sp`.
+  const rel = sp.startsWith(SP_PLACEHOLDER)
+  ctx.closureVals.push(errorSite(keyword, unescapeSp(rel ? sp.slice(SP_PLACEHOLDER.length) : sp), paramsVal, fmt))
+  return `(_e||(_e=[])).push(_mk(${siteVar},${pathExpr || '""'},${paramsShared || paramsCode},${msgCode},${valueExpr},d${rel ? ',_sp' : ''}))`
+}
+
 function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts) {
   const inputSchema = schema
-  schema = normalizePropertyNames(schema)
+  schema = prepareForCodegen(schema, schemaMap)
   // Same provably-local rule as the error generator above.
   if (typeof schema === 'object' && schema !== null) {
     const s = JSON.stringify(schema)
-    if ((s.includes('unevaluatedProperties') || s.includes('unevaluatedItems')) && !unevalAllProvablyLocal(schema)) return null
-    // Bail on self-referencing schemas — combined codegen doesn't support recursion
-    if (s.includes('"$ref":"#"')) return null
-    // Defs on a $ref cycle compile as named functions in the boolean and
-    // errors generators; this generator has no preamble for them, so it
-    // declines and the router uses the errors generator.
-    if (cyclicDefNames(schema.$defs || schema.definitions).size) return null
-    // Bail on additionalProperties as a schema — combined path doesn't emit the
-    // per-key sub-schema loop yet. The jsFn + errFn fallback handles it correctly.
-    if (hasAdditionalPropertiesSchema(schema)) return null
+    // unevaluatedProperties and unevaluatedItems that are not provably local
+    // are worked out at run time (genUnevaluatedDynamicC,
+    // genUnevaluatedItemsDynamicC).
+    // A schema that references itself, through `$ref: "#"` or a definition on
+    // a cycle, has those references written as calls under the cycle guard
+    // (emitDefFnC).
     // Bail on oneOf/anyOf — branch-collapse aggregation lives in genCodeE only.
     // Letting genCodeC emit the legacy "must match exactly one" placeholder
     // would short-circuit the ATA4001/ATA4002/ATA4003 contract. The boolean
     // fast path plus errFn fallback handles these schemas with collapse.
-    if (s.includes('"oneOf"') || s.includes('"anyOf"')) return null
+    // Branches are collapsed into one error by the error generator's emitter
+    // (emitBranchCollapse). Its errors are plain, so the rich form, which
+    // builds every error enriched where it fails, declines them.
+    // In the rich form the collapsed error and its branch errors come out
+    // plain (the branches are the error generator's) and are enriched when
+    // presented; every other error is built enriched. See richBuilder.
   }
   if (typeof schema === 'boolean') {
+    // A `false` root has one fixed error; the rich form leaves it to enrich.
+    if (!schema && opts && (opts.rich || opts.resultShape)) return null
+    if (opts && opts.resultShape) return null
     return schema
       ? () => VALID_RESULT
       : () => ({ valid: false, errors: [{ keyword: 'not', instancePath: '', schemaPath: '#', params: {}, message: 'boolean schema is false' }] })
@@ -5369,7 +5970,6 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
   if (!sharedCodegenGate(schema, schemaMap)) return null
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
-      if (/\\[pP]\{/.test(pat)) return null
       if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return null
     }
   }
@@ -5419,7 +6019,7 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
   if (needsBaseTracking(schema, schemaMap, new Set())) return null
 
   // runtimeShape: errors without the ordinal, see compileToJSCodegenWithErrors.
-  const ctx = { noOrdinal: !!(opts && opts.runtimeShape), varCounter: 0, helperCode: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen],
+  const ctx = { noOrdinal: !!(opts && opts.runtimeShape), rich: !!(opts && opts.rich), inCombined: true, hoisted: [], rootC: schema, varCounter: 0, helperCode: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen],
                 rootDefs: cRootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors: cAnchors, rootSchema: inputSchema, userFormats: userFormats || null }
   const lines = []
   try {
@@ -5436,14 +6036,69 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
   // helper compiles a pattern through it, which the boolean generator does for
   // subschemas under not/if/contains; without the binding those threw a
   // ReferenceError on the first document that reached them.
+  if (opts && opts.resultShape) {
+    ctx.closureVars.push('_ER', '_EE', '_SRT', '_FB', '_VF')
+    ctx.closureVals.push(opts.resultShape.Rejection, opts.resultShape.empty, opts.resultShape.sort, opts.resultShape.fallback, opts.resultShape.verdict || null)
+  }
   const closureNames = ctx.usesSafeRe ? [...ctx.closureVars, '__ataSafeRe'] : ctx.closureVars
   const closureArgs = ctx.usesSafeRe ? [...ctx.closureVals, compileSafe] : ctx.closureVals
   const closureParams = closureNames.join(',')
-  const helpers = ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : ''
+  // A definition the error generator wrote as a named function inside a
+  // branch (one on a cycle, or referenced from several places) reads the
+  // cycle-guard state the error function declares. Here that state is
+  // declared too, and the checks run as the error function runs them: in a
+  // body of their own, again in the guarded mode when data turns out to
+  // point back at itself. This used to decline, which left every schema
+  // whose oneOf or anyOf branches reach a shared definition without one
+  // pass.
+  const guardList = [...(ctx.defFns ? ctx.defFns.values() : []), ...(ctx.cycFnsC || [])]
+  const guardDefs = guardList.length ? guardList : null
+  if (guardDefs) ctx.helperCode.unshift(emitGuardState())
+  // Collapsed oneOf/anyOf: the helper the error generator embeds, `_all` for
+  // the branch functions (this function collects everything), and the
+  // runtime shape the error generator gives its literals, without code and
+  // docUrl. The collapsed error itself keeps its code, as everywhere.
+  if (ctx.usesBranchCollapse) ctx.helperCode.push(require('./branch-collapse').embedSource())
+  if (ctx.usesBranchCollapse && opts && opts.runtimeShape) {
+    const shape = (src) => src.replace(/code:'ATA\d{4}',/g, '').replace(/,docUrl:'https:\/\/ata-validator\.com\/e\/ATA\d{4}'/g, '')
+    for (let i = 0; i < ctx.helperCode.length; i++) ctx.helperCode[i] = shape(ctx.helperCode[i])
+    for (let i = 0; i < lines.length; i++) lines[i] = shape(lines[i])
+  }
   // Lazy error array: no allocation for valid data (the common case)
-  const inner = `let _e;\n  ` +
-    lines.join('\n  ') +
-    `\n  return _e?{valid:false,errors:_e}:R`
+  // resultShape: validate() itself for a validator whose errors are being read
+  // (see validator-core): the result objects built here, so one pass decides,
+  // collects and answers, with nothing between the caller and the checks.
+  const rs = opts && opts.resultShape
+  // Counts shared between a node's unevaluatedProperties and its anyOf and
+  // oneOf (genUnevaluatedDynamicC), visible to every line of the function.
+  let hoistDecl = ctx.hoisted.length ? `let ${ctx.hoisted.map((n) => n + '=null').join(',')};` : ''
+  let checks = lines.join('\n  ')
+  let allDecl = ctx.usesBranchCollapse ? 'const _all=true;' : ''
+  if (guardDefs) {
+    const clears = ['_stk.clear()'].concat(guardDefs.map((n) => `${n}_s.clear()`)).join(';')
+    ctx.helperCode.push(`function _bodyC(d){${hoistDecl}${allDecl}let _e;\n  ${checks}\n  return _e}`)
+    hoistDecl = ''
+    allDecl = ''
+    checks = `_sd=0;try{_e=_bodyC(d)}catch(_err){if(_err!==_CYC)throw _err;_sg=true;${clears};try{_e=_bodyC(d)}finally{_sg=false}}`
+  }
+  // In the result shape this function is validate() itself, so a document
+  // that makes it throw is answered by the caller's previous path instead
+  // (`_FB`). A thrown error reaching the caller is the one thing this form
+  // must not add; a try that does not throw costs nothing measurable.
+  const inner = rs
+    // With collapsed branches, collecting runs every branch of every oneOf
+    // and anyOf in full, which an accepted document does not need: the
+    // verdict answers it first.
+    // Not when every collapse is guarded by a count (emitBranchCollapse): an
+    // accepted document then runs no branch twice, and a rejected one would
+    // pay for the verdict for nothing.
+    ? `try{${hoistDecl}${ctx.usesBranchCollapse && ctx.unguardedCollapse ? 'if(_VF!==null&&_VF(d))return{valid:true,data:d,errors:_EE};' : ''}${allDecl}let _e;\n  ` + checks +
+      // A collapsed branch error is presented even alone (its ordinal and
+      // raw branch errors stay inside); otherwise only a list of two or more
+      // needs ordering.
+      `\n  return _e?new _ER(${ctx.usesBranchCollapse ? '_SRT(_e)' : '_e.length>1?_SRT(_e):_e'}):{valid:true,data:d,errors:_EE}}catch(_x){return _FB(d)}`
+    : hoistDecl + allDecl + `let _e;\n  ` + checks + `\n  return _e?{valid:false,errors:_e}:R`
+  const helpers = ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : ''
 
   try {
     if (typeof process !== 'undefined' && process.env && process.env.ATA_DUMP_CODEGEN) console.log('=== COMBINED CODEGEN ===\n' + helpers + inner + '\n=== CLOSURE VARS: ' + ctx.closureVars.length + ' ===')
@@ -5459,9 +6114,102 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
 // Combined code generator: type-aware like genCode, error-collecting like genCodeE.
 // After type check passes → use optimizations (destructuring, no guards).
 // If type check fails → push error, skip property checks (they'd crash).
+// What of a node still applies to a value that failed its `type`, for the
+// combined generator: the node without `type`, without what it emits outside
+// the type block anyway (enum, const, anyOf, oneOf), and without the keywords
+// of the declared types, which no value of another type meets. Null when
+// nothing that validates is left.
+const TYPE_KEYWORDS = {
+  object: ['properties', 'patternProperties', 'additionalProperties', 'required', 'propertyNames', 'minProperties', 'maxProperties', 'dependentRequired', 'dependentSchemas', 'dependencies', 'unevaluatedProperties'],
+  array: ['items', 'prefixItems', 'additionalItems', 'contains', 'minContains', 'maxContains', 'minItems', 'maxItems', 'uniqueItems', 'unevaluatedItems'],
+  string: ['minLength', 'maxLength', 'pattern'],
+  number: ['minimum', 'maximum', 'exclusiveMinimum', 'exclusiveMaximum', 'multipleOf'],
+}
+TYPE_KEYWORDS.integer = TYPE_KEYWORDS.number
+const NOT_VALIDATING = new Set(['$schema', '$id', '$anchor', '$comment', '$defs', 'definitions', 'title', 'description', 'default', 'examples', 'deprecated', 'readOnly', 'writeOnly', '$vocabulary'])
+function typeMismatchRest(schema, types) {
+  const drop = new Set(['type', 'enum', 'const', 'anyOf', 'oneOf'])
+  for (const t of types) for (const k of (TYPE_KEYWORDS[t] || [])) drop.add(k)
+  // A non-integer number reaches the type block already (numberToo).
+  let rest = null
+  for (const k of Object.keys(schema)) {
+    if (drop.has(k)) continue
+    if (rest === null) rest = {}
+    rest[k] = schema[k]
+  }
+  if (rest === null) return null
+  // A node whose reference was already written (genCodeCNode) keeps that
+  // mark, or the reference is written again here and its errors twice.
+  if (schema[REF_DONE]) Object.defineProperty(rest, REF_DONE, { value: true })
+  for (const k of Object.keys(rest)) if (!NOT_VALIDATING.has(k) && !k.startsWith('x-')) return rest
+  return null
+}
+
 function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   return withPlain(schema, v, lines, ctx, () => genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix))
 }
+// A definition referenced from several places, written once as a function
+// and called at each reference, instead of its whole code at every one: the
+// combined function of SchemaStore's cloud-run (48 KB of schema) came to
+// 1.1 MB of source and sarif's (79 KB) to 2.8 MB, and compiling those was most
+// of the 50 to 300 ms a first rejection with its errors read took. The body is
+// generated against a placeholder schema path that becomes the `_sp` argument,
+// as the error generator does (genCodeENode), so an error names the path it
+// was reached by. It collects into its own list, returned to the caller, and
+// declares its own branch counts (genUnevaluatedDynamicC). The document root
+// comes in as `d` for the rich errors that read it. Not for a definition on a
+// reference cycle, which keeps its existing path. False when not shared.
+function emitSharedDefC(defName, v, pathExpr, lines, ctx, schemaPrefix) {
+  if (!ctx.cyclicDefs) ctx.cyclicDefs = cyclicDefNames(ctx.rootDefs)
+  if (!ctx.sharedDefs) ctx.sharedDefs = sharedDefNames(ctx.rootSchema, ctx.rootDefs)
+  const cyclic = ctx.cyclicDefs.has(defName)
+  if (!cyclic && !ctx.sharedDefs.has(defName)) return false
+  emitDefFnC(defName, ctx.rootDefs[defName], cyclic, v, pathExpr, lines, ctx, schemaPrefix)
+  return true
+}
+
+// One schema as a function of its own in the combined function (see
+// emitSharedDefC). The name is registered before the body is written, so a
+// reference back to it inside becomes a call. One that can re-enter itself,
+// a definition on a cycle or the root through `$ref: "#"`, goes through the
+// cycle guard the error generator's definitions use: depth counted, and in
+// the guarded pass a value already being checked is not checked again.
+function emitDefFnC(key, target, cyclic, v, pathExpr, lines, ctx, schemaPrefix) {
+  if (!ctx.defFnsC) ctx.defFnsC = new Map()
+  let fnName = ctx.defFnsC.get(key)
+  if (!fnName) {
+    fnName = '_defC' + ctx.defFnsC.size + '_' + (key === '#' ? 'root' : key.replace(/[^A-Za-z0-9_]/g, '_'))
+    ctx.defFnsC.set(key, fnName)
+    const outerHoisted = ctx.hoisted
+    ctx.hoisted = []
+    const bodyLines = []
+    let hoisted
+    try {
+      genCodeC(target, '_dv', '_p', bodyLines, ctx, SP_PLACEHOLDER)
+    } finally {
+      hoisted = ctx.hoisted
+      ctx.hoisted = outerHoisted
+    }
+    let body = bodyLines.join('\n  ')
+    body = body.split(`'${SP_PLACEHOLDER}`).join(`_sp+'`).split(`"${SP_PLACEHOLDER}`).join(`_sp+"`)
+    if (body.includes(SP_PLACEHOLDER)) throw DECLINE
+    const decl = hoisted.length ? `let ${hoisted.map((n) => n + '=null').join(',')};` : ''
+    const fn = `function ${cyclic ? fnName + '_b' : fnName}(_dv,_p,_sp,d){const _all=true;${decl}let _e;\n  ${body}\n  return _e}`
+    if (cyclic) {
+      if (!ctx.cycFnsC) ctx.cycFnsC = []
+      ctx.cycFnsC.push(fnName)
+      ctx.helperCode.push(
+        `const ${fnName}_s=new Set()\n  function ${fnName}(_dv,_p,_sp,d){\n  ` +
+          `if(_sg){if(typeof _dv!=='object'||_dv===null)return ${fnName}_b(_dv,_p,_sp,d);if(${fnName}_s.has(_dv))return;${fnName}_s.add(_dv);try{return ${fnName}_b(_dv,_p,_sp,d)}finally{${fnName}_s.delete(_dv)}}\n  ` +
+          `if(++_sd>${CYCLE_DEPTH})throw _CYC\n  const _r=${fnName}_b(_dv,_p,_sp,d)\n  _sd--\n  return _r\n  }\n  ` + fn)
+    } else {
+      ctx.helperCode.push(fn)
+    }
+  }
+  lines.push(`{const _r=${fnName}(${v},${pathExpr || '""'},'${schemaPrefix}',d);if(_r!==undefined){if(_e===undefined)_e=_r;else for(let _i=0;_i<_r.length;_i++)_e.push(_r[_i])}}`)
+}
+
+const REF_DONE = Symbol('ata.refDone')
 function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   if (!schemaPrefix) schemaPrefix = '#'
   // Per-node, for the reason spelled out in genCode.
@@ -5469,19 +6217,41 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   if (schema === false) {
     // Leading semicolon: the previous generated line may end in an
     // expression, and a line starting with `(` would be parsed as a call.
-    lines.push(`;(_e||(_e=[])).push({keyword:'not',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}'${ordinalField(ctx, `${schemaPrefix}`)},params:{},message:'boolean schema is false'})`)
+    lines.push(';' + errPushC(ctx, 'not', schemaPrefix, pathExpr, '{}', "'boolean schema is false'", v, `{keyword:'not',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}'${ordinalField(ctx, `${schemaPrefix}`)},params:{},message:'boolean schema is false'}`))
     return
   }
   if (schema === true) return
   if (typeof schema !== 'object' || schema === null) return
 
   // $ref — resolve local, anchor, and cross-schema refs
-  if (schema.$ref) {
-    // Self-reference "#" — no-op (permissive) to avoid infinite recursion
-    if (schema.$ref === '#') return
+  if (schema.$ref && !schema[REF_DONE]) {
+    // A keyword beside $ref that validates applies too (2020-12; draft 7
+    // drops such siblings when the schema is read). The reference is written
+    // on its own, then the node again with the reference marked done, on a
+    // fresh copy so the mark cannot reach the same schema object met through
+    // another path; the copy keeps `$ref` for unevaluatedProperties and
+    // unevaluatedItems, which read its annotations. Dropping the siblings
+    // once accepted what they reject, which is why this declined. Not in a
+    // branch function, which the error generator writes.
+    if (Object.keys(schema).some((k) => !REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-'))) {
+      if (!ctx.inCombined || ctx.inBranchFn) throw DECLINE
+      genCodeCNode({ $ref: schema.$ref }, v, pathExpr, lines, ctx, schemaPrefix)
+      const rest = Object.assign({}, schema)
+      Object.defineProperty(rest, REF_DONE, { value: true })
+      genCodeCNode(rest, v, pathExpr, lines, ctx, schemaPrefix)
+      return
+    }
+    // A reference back into what is being expanded is a call to that
+    // schema's function (emitDefFnC), never nothing: an expansion that stops
+    // and emits no lines reads as valid.
+    if (schema.$ref === '#') {
+      if (ctx.inCombined && !ctx.inBranchFn && ctx.rootC) { emitDefFnC('#', ctx.rootC, true, v, pathExpr, lines, ctx, schemaPrefix); return }
+      throw DECLINE
+    }
     const m = schema.$ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/)
     if (m && ctx.rootDefs && ctx.rootDefs[m[1]]) {
-      if (ctx.refStack.has(schema.$ref)) return
+      if (ctx.inCombined && !ctx.inBranchFn && emitSharedDefC(m[1], v, pathExpr, lines, ctx, schemaPrefix)) return
+      if (ctx.refStack.has(schema.$ref)) throw DECLINE
       ctx.refStack.add(schema.$ref)
       genCodeC(ctx.rootDefs[m[1]], v, pathExpr, lines, ctx, schemaPrefix)
       ctx.refStack.delete(schema.$ref)
@@ -5492,7 +6262,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       const entry = ctx.rootDefs && ctx.rootDefs[schema.$ref]
       const anchorTarget = entry && entry.raw ? entry.raw : (ctx.anchors && ctx.anchors[schema.$ref])
       if (anchorTarget) {
-        if (ctx.refStack.has(schema.$ref)) return
+        if (ctx.refStack.has(schema.$ref)) throw DECLINE
         ctx.refStack.add(schema.$ref)
         genCodeC(anchorTarget, v, pathExpr, lines, ctx, schemaPrefix)
         ctx.refStack.delete(schema.$ref)
@@ -5500,7 +6270,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       }
     }
     if (ctx.schemaMap && ctx.schemaMap.has(schema.$ref)) {
-      if (ctx.refStack.has(schema.$ref)) return
+      if (ctx.refStack.has(schema.$ref)) throw DECLINE
       ctx.refStack.add(schema.$ref)
       genCodeC(ctx.schemaMap.get(schema.$ref), v, pathExpr, lines, ctx, schemaPrefix)
       ctx.refStack.delete(schema.$ref)
@@ -5510,7 +6280,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     if (ctx.schemaMap && schema.$ref.includes('#') && !schema.$ref.startsWith('#')) {
       const r = resolveCrossSchemaRef(schema.$ref, ctx.schemaMap)
       if (r) {
-        if (ctx.refStack.has(schema.$ref)) return
+        if (ctx.refStack.has(schema.$ref)) throw DECLINE
         ctx.refStack.add(schema.$ref)
         genCodeC(r.schema, v, pathExpr, lines, ctx, schemaPrefix)
         ctx.refStack.delete(schema.$ref)
@@ -5530,7 +6300,26 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   const isStaticPath = !pathExpr || (pathExpr.startsWith("'") && !pathExpr.includes('+'))
   const fail = (keyword, schemaSuffix, paramsCode, msgCode) => {
     const sp = schemaPrefix + '/' + schemaSuffix
-    if (isStaticPath && msgCode.startsWith("'") && !msgCode.includes('+')) {
+    if (ctx.rich) {
+      // A static site shares one frozen params object between calls, as its
+      // hoisted literal does below; a dynamic one builds its params per call.
+      let shared = null
+      if (isStaticPath && msgCode.startsWith("'") && !msgCode.includes('+')) {
+        let pv
+        try { pv = Function('return ' + paramsCode)() } catch { pv = undefined }
+        if (pv !== undefined) {
+          shared = `_P${ctx.varCounter++}`
+          ctx.closureVars.push(shared); ctx.closureVals.push(Object.freeze(pv))
+        }
+      }
+      return errPushC(ctx, keyword, sp, pathExpr, paramsCode, msgCode, v, null, shared)
+    }
+    // Hoisting a static error as one shared literal keeps a function that
+    // also answers accepted documents small. In the runtime shape this
+    // function only runs for documents being rejected (the verdict is its own
+    // function), and a shared literal has to be copied for the caller on
+    // every read, so there it is written fresh.
+    if (isStaticPath && !ctx.noOrdinal && msgCode.startsWith("'") && !msgCode.includes('+')) {
       // Try to evaluate paramsCode as a static constant
       let paramsVal
       try { paramsVal = Function('return ' + paramsCode)() } catch { /* dynamic params — fall through */ }
@@ -5557,7 +6346,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         const o = ctx.noOrdinal ? null : ordinalFor(ctx.rootSchema, spVal)
         const lit = {keyword, instancePath: pathVal, schemaPath: spVal, params: Object.freeze(paramsVal), message: msgVal}
         if (o !== null) lit._o = o
-        ctx.closureVals.push(Object.freeze(lit))
+        ctx.closureVals.push(sharedErr(lit, ctx.rootSchema))
         return `(_e||(_e=[])).push(${errVar})`
         }
       }
@@ -5582,7 +6371,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       if (cv === null || typeof cv !== 'object') {
         lines.push(`if(${v}!==${JSON.stringify(cv)}){${fail('const', 'const', `{allowedValue:${JSON.stringify(schema.const)}}`, "'must be equal to constant'")}}`)
       } else {
-        lines.push(`if(!${emitDeq(ctx)}(${v},${emitConstant(ctx, cv)})){${fail('const', 'const', `{allowedValue:JSON.parse(${JSON.stringify(JSON.stringify(schema.const))})}`, "'must be equal to constant'")}}`)
+        lines.push(`if(!${emitDeq(ctx)}(${v},${emitConstant(ctx, cv)})){${fail('const', 'const', `{allowedValue:${emitParamConstant(ctx, schema.const)}}`, "'must be equal to constant'")}}`)
       }
     }
   }
@@ -5601,7 +6390,9 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       }
     })
     const expected = types.join(', ')
-    const expectedParam = types.length === 1 ? `'${types[0]}'` : JSON.stringify(types)
+    // As written: a one-element array stays an array, as the interpreted engine
+    // reports it.
+    const expectedParam = !Array.isArray(schema.type) ? `'${types[0]}'` : JSON.stringify(types)
     // Type check: push error but continue — wrap remaining in type-success block
     const typeOk = `_tok${ctx.varCounter++}`
     lines.push(`const ${typeOk}=${conds.join('||')}`)
@@ -5614,7 +6405,11 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       isNum = types[0] === 'number' || types[0] === 'integer'
     }
     emitEnumConst()
-    lines.push(`if(${typeOk}){`)
+    // A number that is not an integer fails `integer` and is still a number:
+    // minimum, multipleOf and the rest apply to it, and the other engines
+    // report them next to the type error. The block opens for any number.
+    const numberToo = types.includes('integer') && !types.includes('number')
+    lines.push(numberToo ? `if(${typeOk}||typeof ${v}==='number'){` : `if(${typeOk}){`)
   } else {
     emitEnumConst()
   }
@@ -5641,29 +6436,29 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     }
     for (const key of schema.required) {
       const check = hoisted[key] ? `${hoisted[key]}===undefined` : `!${ownKeyExpr(ctx, v, key)}`
-      if (isStaticPath) {
+      if (isStaticPath && !ctx.rich && !ctx.noOrdinal) {
         const ei = ctx.varCounter++
         const errVar = `_E${ei}`
         const pathVal = pathExpr ? literalValue(pathExpr) : ''
         ctx.closureVars.push(errVar)
-        ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/required`), params: Object.freeze({missingProperty: key}), message: `must have required property '${key}'`}))
+        ctx.closureVals.push(sharedErr({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/required`), params: Object.freeze({missingProperty: key}), message: `must have required property '${key}'`}, ctx.rootSchema))
         lines.push(`if(${check}){(_e||(_e=[])).push(${errVar})}`)
       } else {
-        lines.push(`if(${check}){(_e||(_e=[])).push({keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/required'${ordinalField(ctx, `${schemaPrefix}/required`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'"})}`)
+        lines.push(`if(${check}){${errPushC(ctx, 'required', `${schemaPrefix}/required`, pathExpr, `{missingProperty:'${esc(key)}'}`, `"must have required property '${esc(key)}'"`, v, `{keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/required'${ordinalField(ctx, `${schemaPrefix}/required`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'"}`)}}`)
       }
     }
   } else if (schema.required) {
     for (const key of schema.required) {
       const isStatic = !pathExpr || (pathExpr.startsWith("'") && !pathExpr.includes('+'))
-      if (isStatic) {
+      if (isStatic && !ctx.rich && !ctx.noOrdinal) {
         const ei = ctx.varCounter++
         const errVar = `_E${ei}`
         const pathVal = pathExpr ? literalValue(pathExpr) : ''
         ctx.closureVars.push(errVar)
-        ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/required`), params: Object.freeze({missingProperty: key}), message: `must have required property '${key}'`}))
+        ctx.closureVals.push(sharedErr({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/required`), params: Object.freeze({missingProperty: key}), message: `must have required property '${key}'`}, ctx.rootSchema))
         lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!${ownKeyExpr(ctx, v, key)}){(_e||(_e=[])).push(${errVar})}`)
       } else {
-        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!${ownKeyExpr(ctx, v, key)}){(_e||(_e=[])).push({keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/required'${ordinalField(ctx, `${schemaPrefix}/required`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'"})}`)
+        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!${ownKeyExpr(ctx, v, key)}){${errPushC(ctx, 'required', `${schemaPrefix}/required`, pathExpr, `{missingProperty:'${esc(key)}'}`, `"must have required property '${esc(key)}'"`, v, `{keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/required'${ordinalField(ctx, `${schemaPrefix}/required`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'"}`)}}`)
       }
     }
   }
@@ -5701,7 +6496,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       const ri = ctx.varCounter++
       const reVar = `_re${ri}`
       ctx.closureVars.push(reVar)
-      ctx.closureVals.push(useSafeEngine(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern))
+      ctx.closureVals.push(useSafeEngine(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern, reFlags(schema.pattern)))
       const c = isStr ? `!${reVar}.test(${v})` : `typeof ${v}==='string'&&!${reVar}.test(${v})`
       lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, JSON.stringify(`must match pattern "${schema.pattern}"`))}}`)
     }
@@ -5786,27 +6581,36 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   // unevaluatedProperties: false where it is provably additionalProperties
   // (the entry bail guaranteed that), keeping the keyword's own identity so
   // the two engines report the same error.
-  if (schema.unevaluatedProperties === false && schema.additionalProperties === undefined && !schema.patternProperties) genUnevaluatedFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj)
+  if (schema.unevaluatedProperties !== undefined && schema.unevaluatedProperties !== true) {
+    if (unevalLocalOk(schema, 'unevaluatedProperties')) {
+      if (schema.additionalProperties === undefined && !schema.patternProperties) genUnevaluatedFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj)
+    } else {
+      genUnevaluatedDynamicC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj)
+    }
+  }
 
   // unevaluatedItems: false under the same rule: one error for the array,
   // the first uncovered position as the limit. Adjacent schema-form `items`
   // evaluates everything; the draft-07 array form acts as the prefix.
-  if (schema.unevaluatedItems === false) genUnevaluatedItemsFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+  if (schema.unevaluatedItems !== undefined && schema.unevaluatedItems !== true) {
+    if (unevalLocalOk(schema, 'unevaluatedItems')) genUnevaluatedItemsFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+    else genUnevaluatedItemsDynamicC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+  }
 
   // dependentRequired
   if (schema.dependentRequired) {
     for (const [key, deps] of Object.entries(schema.dependentRequired)) {
       for (const dep of deps) {
         const isStatic = !pathExpr || (pathExpr.startsWith("'") && !pathExpr.includes('+'))
-        if (isStatic) {
+        if (isStatic && !ctx.rich && !ctx.noOrdinal) {
           const ei = ctx.varCounter++
           const errVar = `_E${ei}`
           const pathVal = pathExpr ? literalValue(pathExpr) : ''
           ctx.closureVars.push(errVar)
-          ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/dependentRequired`), params: Object.freeze({missingProperty: dep}), message: `must have required property '${dep}'`}))
+          ctx.closureVals.push(sharedErr({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/dependentRequired`), params: Object.freeze({missingProperty: dep}), message: `must have required property '${dep}'`}, ctx.rootSchema))
           lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${ownKeyExpr(ctx, v, key)}&&!${ownKeyExpr(ctx, v, dep)}){(_e||(_e=[])).push(${errVar})}`)
         } else {
-          lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${ownKeyExpr(ctx, v, key)}&&!${ownKeyExpr(ctx, v, dep)}){(_e||(_e=[])).push({keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/dependentRequired'${ordinalField(ctx, `${schemaPrefix}/dependentRequired`)},params:{missingProperty:'${esc(dep)}'},message:"must have required property '${esc(dep)}'"})}`)
+          lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${ownKeyExpr(ctx, v, key)}&&!${ownKeyExpr(ctx, v, dep)}){${errPushC(ctx, 'required', `${schemaPrefix}/dependentRequired`, pathExpr, `{missingProperty:'${esc(dep)}'}`, `"must have required property '${esc(dep)}'"`, v, `{keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/dependentRequired'${ordinalField(ctx, `${schemaPrefix}/dependentRequired`)},params:{missingProperty:'${esc(dep)}'},message:"must have required property '${esc(dep)}'"}`)}}`)
         }
       }
     }
@@ -5839,6 +6643,10 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   if (schema.patternProperties) {
     if (genPatternPropertiesC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj)) ppHandledPropertyNames = true
   }
+  // additionalProperties as a schema: each key that is neither declared nor
+  // matched by a pattern, validated where it is (see genAdditionalSchemaC).
+  if (typeof schema.additionalProperties === 'object' && schema.additionalProperties !== null) genAdditionalSchemaC(schema, v, pathExpr, lines, ctx, schemaPrefix, isObj)
+
 
   // dependentSchemas
   if (schema.dependentSchemas) genDependentSchemasC(schema, v, pathExpr, lines, ctx, schemaPrefix)
@@ -5868,11 +6676,11 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   // allOf
   if (schema.allOf) { for (let _ai = 0; _ai < schema.allOf.length; _ai++) genCodeC(schema.allOf[_ai], v, pathExpr, lines, ctx, schemaPrefix+'/allOf/'+_ai) }
 
-  // anyOf
-  if (schema.anyOf) genAnyOfC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
-
-  // oneOf
-  if (schema.oneOf) genOneOfC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+  // anyOf, oneOf. A collapsed branch applies to a value of any type, as enum
+  // and const do: the other engines report it next to a failed `type`, so
+  // in the combined function it goes after the type-success block below.
+  if (schema.anyOf && !ctx.inCombined) genAnyOfC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+  if (schema.oneOf && !ctx.inCombined) genOneOfC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
 
   // not
   if (schema.not !== undefined) genNotC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
@@ -5883,7 +6691,22 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   // Close type-success block if opened
   if (types) {
     lines.push(`}`)
+    // A value of another type still meets every keyword that applies to its
+    // own type, and the applicators (allOf, not, if/then/else, $ref): the
+    // other engines report those next to the type error, and the block above
+    // skipped them all. The keywords of the declared types cannot apply to
+    // it and are left out, so the else is small and does not repeat the
+    // declared type's subtree.
+    const rest = typeMismatchRest(schema, types)
+    if (rest !== null) {
+      lines.push(`else{`)
+      genCodeC(rest, v, pathExpr, lines, ctx, schemaPrefix)
+      lines.push(`}`)
+    }
   }
+  if (schema.anyOf && ctx.inCombined) genAnyOfC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+  if (schema.oneOf && ctx.inCombined) genOneOfC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+
 }
 
 // Rarely used keyword families of genCodeCNode, kept out of it so their compile is
@@ -5909,20 +6732,376 @@ function genDynamicRefC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 
 function genUniqueItemsC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isArr) {
   const si = ctx.varCounter++
-  const itemType = schema.items && typeof schema.items === 'object' && schema.items.type
-  const isPrim = itemType === 'string' || itemType === 'number' || itemType === 'integer'
-  const maxItems = schema.maxItems
   const failExpr = (iVar, jVar) => fail('uniqueItems', 'uniqueItems', `{i:${iVar},j:${jVar}}`, `'must NOT have duplicate items (items ## '+${jVar}+' and '+${iVar}+' are identical)'`)
-  let inner
-  if (isPrim && maxItems && maxItems <= 16) {
-    // Small primitive arrays: O(n²) nested loop, zero allocation
-    inner = `for(let _i=1;_i<${v}.length;_i++){for(let _k=0;_k<_i;_k++){if(${v}[_i]===${v}[_k]){${failExpr('_k', '_i')};break}}}`
-  } else if (isPrim) {
-    inner = `const _s${si}=new Map();for(let _i=0;_i<${v}.length;_i++){const _prev=_s${si}.get(${v}[_i]);if(_prev!==undefined){${failExpr('_prev', '_i')};break};_s${si}.set(${v}[_i],_i)}`
+  // Only reached once the verdict has rejected, or when errors are wanted, so
+  // one strategy for every item type: the hoisted pair finder. See UQP_HELPER.
+  const inner = `const _j${si}=${emitUqp(ctx)}(${v});if(_j${si}>=0){const _i${si}=_uqpI;${failExpr('_i' + si, '_j' + si)}}`
+  lines.push(isArr ? `{${inner}}` : `if(Array.isArray(${v})){${inner}}`)
+}
+
+// The verdict form of genUnevaluatedDynamicC: the same set, built the same
+// way, and the answer false at the first key outside it.
+function genUnevalDynamicVerdict(schema, v, lines, ctx, isObj) {
+  if (schema.additionalProperties !== undefined) return
+  const ui = ctx.varCounter++
+  const S = `_ev${ui}`
+  const body = [`const ${S}=[]`]
+  addLocalAnnotations(schema, v, S, body, ctx)
+  addTopApplicatorAnnotations(schema, v, S, body, ctx)
+  const kVar = `_uk${ui}`
+  const up = schema.unevaluatedProperties
+  if (up === false) {
+    body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.includes(${kVar}))return false`)
+  } else if (typeof up === 'object' && up !== null) {
+    const sub = []
+    genCode(up, `${v}[${kVar}]`, sub, ctx)
+    if (sub.length) body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.includes(${kVar})){${sub.join('\n  ')}\n  }`)
   } else {
-    inner = `const _cn${si}=function(x){if(x===null||typeof x!=='object')return typeof x+':'+x;if(Array.isArray(x))return'['+x.map(_cn${si}).join(',')+']';return'{'+Object.keys(x).sort().map(function(k){return JSON.stringify(k)+':'+_cn${si}(x[k])}).join(',')+'}'};const _s${si}=new Map();for(let _i=0;_i<${v}.length;_i++){const _k=_cn${si}(${v}[_i]);const _prev=_s${si}.get(_k);if(_prev!==undefined){${failExpr('_prev', '_i')};break};_s${si}.set(_k,_i)}`
+    throw DECLINE
   }
-  lines.push(isArr ? `{${inner}}` : `if(Array.isArray(${v})){${inner}}`)
+  lines.push(isObj ? `{${body.join(';')}}` : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${body.join(';')}}`)
+}
+
+// unevaluatedProperties where what is evaluated depends on which branches
+// pass: the set is built at run time with the interpreted engine's rules.
+// The node's own properties, patternProperties and additionalProperties
+// count whether or not their values pass; an allOf, anyOf or dependentSchemas
+// branch, an if, then or else, or a $ref target counts only when it passes,
+// a oneOf only when exactly one branch passes, and `not` never. Each branch is
+// asked through an annotation function (emitAnnot).
+function genUnevaluatedDynamicC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj) {
+  // additionalProperties evaluates every key the others do not, pass or fail.
+  if (schema.additionalProperties !== undefined) return
+  const ui = ctx.varCounter++
+  const S = `_ev${ui}`
+  const body = [`const ${S}=[]`]
+  addLocalAnnotations(schema, v, S, body, ctx)
+  // The anyOf and oneOf counts are handed to the keywords' own error code
+  // (emitBranchCollapse), with the object they were counted for: they are
+  // declared once at the top of the combined function, where every later
+  // line sees them, and read only when that object is the value at hand, so
+  // a count left from another value, another loop iteration or another place
+  // is never taken for this one. Only in the combined function proper.
+  const share = ctx.inCombined && !ctx.inBranchFn && ctx.hoisted !== undefined &&
+    (Array.isArray(schema.anyOf) || Array.isArray(schema.oneOf))
+  const counts = share ? { anyOf: `_ac${ui}`, oneOf: `_oc${ui}`, oneOfMask: `_om${ui}`, of: `_ao${ui}` } : null
+  if (share) {
+    ctx.hoisted.push(counts.anyOf, counts.oneOf, counts.oneOfMask, counts.of)
+    body.push(`${counts.of}=${v};${counts.oneOfMask}=0`)
+    if (!ctx.branchCounts) ctx.branchCounts = new Map()
+    if (Array.isArray(schema.anyOf)) ctx.branchCounts.set(schema.anyOf, { of: counts.of, count: counts.anyOf, mask: null })
+    if (Array.isArray(schema.oneOf)) ctx.branchCounts.set(schema.oneOf, { of: counts.of, count: counts.oneOf, mask: schema.oneOf.length <= 30 ? counts.oneOfMask : null })
+  }
+  addTopApplicatorAnnotations(schema, v, S, body, ctx, counts)
+  const kVar = `_uk${ui}`
+  const up = schema.unevaluatedProperties
+  if (up === false) {
+    body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.includes(${kVar})){${fail('unevaluatedProperties', 'unevaluatedProperties', `{unevaluatedProperty:${kVar}}`, "'must NOT have unevaluated properties'")}}`)
+  } else if (typeof up === 'object' && up !== null) {
+    const pe = emitPtrEsc(ctx)
+    const p = pathExpr ? `${pathExpr}+'/'+${pe}(${kVar})` : `'/'+${pe}(${kVar})`
+    const sub = []
+    genCodeC(up, `${v}[${kVar}]`, p, sub, ctx, schemaPrefix + '/unevaluatedProperties')
+    if (sub.length) body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.includes(${kVar})){${sub.join('\n  ')}\n  }`)
+  } else {
+    throw DECLINE
+  }
+  lines.push(isObj ? `{${body.join(';')}}` : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${body.join(';')}}`)
+}
+
+// The names a node's own keywords evaluate, pushed onto the array `S`:
+// present declared properties, keys matching a pattern, and every key when
+// additionalProperties is there.
+function addLocalAnnotations(node, v, S, out, ctx) {
+  if (node.additionalProperties !== undefined) {
+    out.push(`for(const _ka in ${v})${S}.push(_ka)`)
+    return
+  }
+  for (const k of Object.keys(node.properties || {})) out.push(`if(Object.prototype.hasOwnProperty.call(${v},${JSON.stringify(k)}))${S}.push(${JSON.stringify(k)})`)
+  const pats = Object.keys(node.patternProperties || {})
+  if (pats.length) {
+    const tests = []
+    const kv = `_pk${ctx.varCounter++}`
+    for (const pat of pats) {
+      const fast = fastPrefixCheck(pat, kv)
+      if (fast) { tests.push(fast); continue }
+      const ri = ctx.varCounter++
+      ctx.closureVars.push(`_re${ri}`)
+      ctx.closureVals.push(safeReClosure(ctx, pat))
+      tests.push(`_re${ri}.test(${kv})`)
+    }
+    out.push(`for(const ${kv} in ${v})if(${tests.join('||')})${S}.push(${kv})`)
+  }
+}
+
+// What the applicators of the node that owns the unevaluatedProperties add.
+// Their validity is checked by the code around this; here a branch only
+// contributes, through its annotation function, when it passes, and a oneOf
+// only with exactly one passing branch. An annotation function that fails
+// leaves `S` as it found it.
+function addTopApplicatorAnnotations(node, v, S, out, ctx, counts) {
+  if (node.$dynamicRef !== undefined || node.$recursiveRef !== undefined || node.dependencies !== undefined) throw DECLINE
+  for (const b of node.allOf || []) out.push(`${emitAnnot(b, ctx)}(${v},${S})`)
+  // With `counts`, the passing branches of anyOf and oneOf are counted into
+  // variables the caller declared, so the keyword's own error code further
+  // down can skip its branches when the count already says it holds (see
+  // emitBranchCollapse).
+  if (Array.isArray(node.anyOf)) {
+    if (counts) out.push(`${counts.anyOf}=0;${node.anyOf.map((b) => `if(${emitAnnot(b, ctx)}(${v},${S}))${counts.anyOf}++;`).join('')}`)
+    else for (const b of node.anyOf) out.push(`${emitAnnot(b, ctx)}(${v},${S})`)
+  }
+  if (Array.isArray(node.oneOf)) {
+    const t = counts ? counts.oneOf : `_oc${ctx.varCounter++}`
+    // Which branches passed, as bits, for a collapse that has to name them.
+    const mask = counts && node.oneOf.length <= 30 ? counts.oneOfMask : null
+    out.push(`{const ${t}m=${S}.length;${counts ? '' : 'let '}${t}=0;${node.oneOf.map((b, i) => `if(${emitAnnot(b, ctx)}(${v},${S})){${t}++;${mask ? `${mask}|=${1 << i};` : ''}}`).join('')}if(${t}!==1)_rb(${S},${t}m)}`)
+  }
+  if (node.if !== undefined) {
+    const thenCall = node.then !== undefined ? `${emitAnnot(node.then, ctx)}(${v},${S})` : ''
+    const elseCall = node.else !== undefined ? `${emitAnnot(node.else, ctx)}(${v},${S})` : ''
+    out.push(`if(${emitAnnot(node.if, ctx)}(${v},${S})){${thenCall}}else{${elseCall}}`)
+  }
+  if (node.dependentSchemas && typeof node.dependentSchemas === 'object') {
+    for (const [k, ds] of Object.entries(node.dependentSchemas)) out.push(`if(Object.prototype.hasOwnProperty.call(${v},${JSON.stringify(k)}))${emitAnnot(ds, ctx)}(${v},${S})`)
+  }
+  if (typeof node.$ref === 'string') out.push(`${emitAnnot(refTargetFor(node.$ref, ctx), ctx)}(${v},${S})`)
+}
+
+function refTargetFor(ref, ctx) {
+  const m = ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/)
+  const t = m && ctx.rootDefs ? ctx.rootDefs[m[1]] : undefined
+  if (t === undefined) throw DECLINE
+  return t
+}
+
+// The keywords an annotation function evaluates itself, through its children;
+// the rest of a subschema is checked by a plain verdict.
+const ANNOT_APPLICATORS = new Set(['allOf', 'anyOf', 'oneOf', 'if', 'then', 'else', 'dependentSchemas', '$ref', 'not', 'unevaluatedProperties'])
+
+// A function `(value, S) => valid` for one subschema: whether it passes, and
+// when it does, what it evaluated pushed onto S; when it does not, S is left
+// as it was. Validity is worked out bottom up: the subschema's own keywords
+// by a verdict of the subschema without its applicators, each applicator from
+// its branches' annotation functions. Asking each branch for a full verdict
+// and then again for its annotations repeated every nested branch once per
+// level, which made nested references the slowest shape there was.
+function emitAnnot(sub, ctx) {
+  if (sub === true) return '_anT'
+  if (sub === false) return '_anF'
+  if (sub === null || typeof sub !== 'object') throw DECLINE
+  if (!ctx.annFns) {
+    ctx.annFns = new Map()
+    ;(ctx.preamble || ctx.helperCode).push('function _anT(){return true}function _anF(){return false}function _rb(S,m){if(S.length!==m)S.length=m}')
+  }
+  const hit = ctx.annFns.get(sub)
+  if (hit !== undefined) {
+    if (hit === null) throw DECLINE // a reference cycle: not modelled here
+    return hit
+  }
+  if (sub.$dynamicRef !== undefined || sub.$recursiveRef !== undefined || sub.dependencies !== undefined) throw DECLINE
+  // unevaluatedItems reads what the applicators evaluate too; the local
+  // verdict would see it without them.
+  if (sub.unevaluatedItems !== undefined) throw DECLINE
+  ctx.annFns.set(sub, null)
+  const name = `_an${ctx.varCounter++}`
+  const local = {}
+  for (const k of Object.keys(sub)) if (!ANNOT_APPLICATORS.has(k)) local[k] = sub[k]
+  const vl = []
+  nestedGenCode(local, '_av', vl, ctx)
+  const decls = [`function ${name}_v(_av){${vl.join('\n  ')}\n  return true}`]
+  const body = [`if(!${name}_v(d))return false`]
+  if (sub.not !== undefined) {
+    const nl = []
+    nestedGenCode(sub.not, '_nv', nl, ctx)
+    decls.push(`function ${name}_n(_nv){${nl.join('\n  ')}\n  return true}`)
+    body.push(`if(${name}_n(d))return false`)
+  }
+  body.push(`const _m=S.length;const _o=typeof d==='object'&&d!==null&&!Array.isArray(d)`)
+  const locals = []
+  addLocalAnnotations(sub, 'd', 'S', locals, ctx)
+  if (locals.length) body.push(`if(_o){${locals.join(';')}}`)
+  const failOut = '{_rb(S,_m);return false}'
+  for (const b of sub.allOf || []) body.push(`if(!${emitAnnot(b, ctx)}(d,S))${failOut}`)
+  if (Array.isArray(sub.anyOf)) body.push(`{let _a=false;${sub.anyOf.map((b) => `if(${emitAnnot(b, ctx)}(d,S))_a=true;`).join('')}if(!_a)${failOut}}`)
+  if (Array.isArray(sub.oneOf)) body.push(`{let _c=0;${sub.oneOf.map((b) => `if(${emitAnnot(b, ctx)}(d,S))_c++;`).join('')}if(_c!==1)${failOut}}`)
+  if (sub.if !== undefined) {
+    const thenCheck = sub.then !== undefined ? `if(!${emitAnnot(sub.then, ctx)}(d,S))${failOut}` : ''
+    const elseCheck = sub.else !== undefined ? `if(!${emitAnnot(sub.else, ctx)}(d,S))${failOut}` : ''
+    body.push(`if(${emitAnnot(sub.if, ctx)}(d,S)){${thenCheck}}else{${elseCheck}}`)
+  }
+  if (sub.dependentSchemas && typeof sub.dependentSchemas === 'object') {
+    for (const [k, ds] of Object.entries(sub.dependentSchemas)) body.push(`if(_o&&Object.prototype.hasOwnProperty.call(d,${JSON.stringify(k)})&&!${emitAnnot(ds, ctx)}(d,S))${failOut}`)
+  }
+  if (typeof sub.$ref === 'string') body.push(`if(!${emitAnnot(refTargetFor(sub.$ref, ctx), ctx)}(d,S))${failOut}`)
+  // An unevaluatedProperties of its own: the keys this subschema evaluated
+  // are the ones pushed since _m; what is left must pass it, and then every
+  // key is evaluated.
+  const up = sub.unevaluatedProperties
+  if (up !== undefined && up !== true && sub.additionalProperties === undefined) {
+    if (up === false) {
+      body.push(`if(_o){for(const _k of Object.keys(d))if(S.indexOf(_k,_m)<0)${failOut}}`)
+    } else if (typeof up === 'object' && up !== null) {
+      const ul = []
+      nestedGenCode(up, '_uv', ul, ctx)
+      decls.push(`function ${name}_u(_uv){${ul.join('\n  ')}\n  return true}`)
+      body.push(`if(_o){for(const _k of Object.keys(d))if(S.indexOf(_k,_m)<0&&!${name}_u(d[_k]))${failOut}}`)
+    } else {
+      throw DECLINE
+    }
+  }
+  if (up !== undefined && sub.additionalProperties === undefined) body.push(`if(_o)for(const _ka in d)S.push(_ka)`)
+  decls.push(`function ${name}(d,S){${body.join(';')};return true}`)
+  ;(ctx.preamble || ctx.helperCode).push(decls.join(''))
+  ctx.annFns.set(sub, name)
+  return name
+}
+
+// unevaluatedItems worked out at run time, for the combined function. The
+// evaluated positions of an array are kept as the interpreter keeps them
+// (lib/plan-compiler.js): `n`, every index below it evaluated, and `x`, the
+// indexes past it that `contains` matched. This node's own prefixItems,
+// items and contains mark them whatever their own verdict, and each in-place
+// subschema marks them only when it passes (emitAnnotI); what is left must
+// pass unevaluatedItems. `false` reports once, at the first position left,
+// as the interpreter does.
+function genUnevaluatedItemsDynamicC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail) {
+  if (schema.$dynamicRef !== undefined || schema.$recursiveRef !== undefined) throw DECLINE
+  if (Array.isArray(schema.items) || schema.additionalItems !== undefined) throw DECLINE
+  annItemHelpers(ctx)
+  const ui = ctx.varCounter++
+  const S = `_es${ui}`
+  const body = [`const ${S}={n:0,x:null}`]
+  addLocalItemAnnotations(schema, v, S, body, ctx)
+  for (const b of schema.allOf || []) body.push(`${emitAnnotI(b, ctx)}(${v},${S})`)
+  if (Array.isArray(schema.anyOf)) for (const b of schema.anyOf) body.push(`${emitAnnotI(b, ctx)}(${v},${S})`)
+  if (Array.isArray(schema.oneOf)) {
+    body.push(`{const _n0=${S}.n,_x0=${S}.x===null?0:${S}.x.length;let _c=0;${schema.oneOf.map((b) => `if(${emitAnnotI(b, ctx)}(${v},${S}))_c++;`).join('')}if(_c!==1)_rbI(${S},_n0,_x0)}`)
+  }
+  if (schema.if !== undefined) {
+    const thenCall = schema.then !== undefined ? `${emitAnnotI(schema.then, ctx)}(${v},${S})` : ''
+    const elseCall = schema.else !== undefined ? `${emitAnnotI(schema.else, ctx)}(${v},${S})` : ''
+    body.push(`if(${emitAnnotI(schema.if, ctx)}(${v},${S})){${thenCall}}else{${elseCall}}`)
+  }
+  if (typeof schema.$ref === 'string') body.push(`${emitAnnotI(refTargetFor(schema.$ref, ctx), ctx)}(${v},${S})`)
+  const iv = `_ix${ui}`
+  const ui2 = schema.unevaluatedItems
+  if (ui2 === false) {
+    const failI = fail('unevaluatedItems', 'unevaluatedItems', `{limit:${iv}}`, `'must NOT have more than '+${iv}+' items'`)
+    body.push(`for(let ${iv}=0;${iv}<${v}.length;${iv}++){if(_hI(${S},${iv}))continue;${failI};break}`)
+  } else if (typeof ui2 === 'object' && ui2 !== null) {
+    const pe = pathExpr ? `${pathExpr}+'/'+${iv}` : `'/'+${iv}`
+    const sub = []
+    genCodeC(ui2, `${v}[${iv}]`, pe, sub, ctx, schemaPrefix + '/unevaluatedItems')
+    if (sub.length) body.push(`for(let ${iv}=0;${iv}<${v}.length;${iv}++){if(_hI(${S},${iv}))continue;${sub.join('\n  ')}\n  }`)
+  } else {
+    throw DECLINE
+  }
+  lines.push(`if(Array.isArray(${v})){${body.join(';')}}`)
+}
+
+function annItemHelpers(ctx) {
+  if (ctx.annItemHelpers) return
+  ctx.annItemHelpers = true
+  ;(ctx.preamble || ctx.helperCode).push(
+    'function _aI(S,i){if(i<S.n)return;if(i===S.n){S.n=i+1;return}(S.x||(S.x=[])).push(i)}' +
+    'function _mrI(S,f,t){if(f>=t)return;if(f<=S.n){if(t>S.n)S.n=t;return}const x=S.x||(S.x=[]);for(let i=f;i<t;i++)x.push(i)}' +
+    'function _hI(S,i){if(i<S.n)return true;const x=S.x;if(x===null)return false;for(let j=0;j<x.length;j++)if(x[j]===i)return true;return false}' +
+    'function _rbI(S,n,l){S.n=n;if(S.x!==null)S.x.length=l}' +
+    'function _anIT(){return true}function _anIF(){return false}')
+}
+
+// The positions a node's own keywords evaluate, marked on `S`, for an array.
+function addLocalItemAnnotations(node, v, S, out, ctx) {
+  if (Array.isArray(node.items) || node.additionalItems !== undefined) throw DECLINE
+  const prefix = Array.isArray(node.prefixItems) ? node.prefixItems.length : 0
+  if (prefix) out.push(`_mrI(${S},0,Math.min(${v}.length,${prefix}))`)
+  if (node.items !== undefined) out.push(`_mrI(${S},${prefix},${v}.length)`)
+  if (node.contains !== undefined) {
+    const cl = []
+    nestedGenCode(node.contains, '_cv', cl, ctx)
+    const ci = ctx.varCounter++
+    ;(ctx.preamble || ctx.helperCode).push(`function _cI${ci}(_cv){${cl.join('\n  ')}\n  return true}`)
+    out.push(`for(let _i=0;_i<${v}.length;_i++)if(_cI${ci}(${v}[_i]))_aI(${S},_i)`)
+  }
+}
+
+// The keywords an item annotation function evaluates through its children;
+// the rest of a subschema is checked by a plain verdict.
+const ANNOT_ITEM_APPLICATORS = new Set(['allOf', 'anyOf', 'oneOf', 'if', 'then', 'else', '$ref', 'not', 'unevaluatedItems'])
+
+// A function `(value, S) => valid` for one subschema, marking on S the array
+// positions it evaluated when it passes, and leaving S as it was when it does
+// not. A subschema with an unevaluatedItems of its own evaluates every
+// position once that passes, so it works on a record of its own and then
+// marks them all.
+function emitAnnotI(sub, ctx) {
+  if (sub === true) return '_anIT'
+  if (sub === false) return '_anIF'
+  if (sub === null || typeof sub !== 'object') throw DECLINE
+  if (!ctx.annFnsI) ctx.annFnsI = new Map()
+  const hit = ctx.annFnsI.get(sub)
+  if (hit !== undefined) {
+    if (hit === null) throw DECLINE
+    return hit
+  }
+  if (sub.$dynamicRef !== undefined || sub.$recursiveRef !== undefined) throw DECLINE
+  if (Array.isArray(sub.items) || sub.additionalItems !== undefined) throw DECLINE
+  // unevaluatedProperties reads the applicators too, which the local verdict
+  // below leaves out.
+  if (sub.unevaluatedProperties !== undefined && sub.unevaluatedProperties !== true) throw DECLINE
+  ctx.annFnsI.set(sub, null)
+  annItemHelpers(ctx)
+  const name = `_ai${ctx.varCounter++}`
+  const local = {}
+  for (const k of Object.keys(sub)) if (!ANNOT_ITEM_APPLICATORS.has(k)) local[k] = sub[k]
+  const vl = []
+  nestedGenCode(local, '_av', vl, ctx)
+  const decls = [`function ${name}_v(_av){${vl.join('\n  ')}\n  return true}`]
+  const body = [`if(!${name}_v(d))return false`]
+  if (sub.not !== undefined) {
+    const nl = []
+    nestedGenCode(sub.not, '_nv', nl, ctx)
+    decls.push(`function ${name}_n(_nv){${nl.join('\n  ')}\n  return true}`)
+    body.push(`if(${name}_n(d))return false`)
+  }
+  const own = sub.unevaluatedItems !== undefined && sub.unevaluatedItems !== true
+  const R = own ? '_R' : 'S'
+  body.push(own ? `const _R={n:0,x:null}` : `const _n0=S.n,_x0=S.x===null?0:S.x.length`)
+  const failOut = own ? 'return false' : '{_rbI(S,_n0,_x0);return false}'
+  const locals = []
+  addLocalItemAnnotations(sub, 'd', R, locals, ctx)
+  if (locals.length) body.push(`if(Array.isArray(d)){${locals.join(';')}}`)
+  for (const b of sub.allOf || []) body.push(`if(!${emitAnnotI(b, ctx)}(d,${R}))${failOut}`)
+  if (Array.isArray(sub.anyOf)) body.push(`{let _a=false;${sub.anyOf.map((b) => `if(${emitAnnotI(b, ctx)}(d,${R}))_a=true;`).join('')}if(!_a)${failOut}}`)
+  if (Array.isArray(sub.oneOf)) body.push(`{let _c=0;${sub.oneOf.map((b) => `if(${emitAnnotI(b, ctx)}(d,${R}))_c++;`).join('')}if(_c!==1)${failOut}}`)
+  if (sub.if !== undefined) {
+    const thenCheck = sub.then !== undefined ? `if(!${emitAnnotI(sub.then, ctx)}(d,${R}))${failOut}` : ''
+    const elseCheck = sub.else !== undefined ? `if(!${emitAnnotI(sub.else, ctx)}(d,${R}))${failOut}` : ''
+    body.push(`if(${emitAnnotI(sub.if, ctx)}(d,${R})){${thenCheck}}else{${elseCheck}}`)
+  }
+  if (typeof sub.$ref === 'string') body.push(`if(!${emitAnnotI(refTargetFor(sub.$ref, ctx), ctx)}(d,${R}))${failOut}`)
+  if (own) {
+    const u = sub.unevaluatedItems
+    if (u === false) {
+      body.push(`if(Array.isArray(d)){for(let _i=0;_i<d.length;_i++)if(!_hI(_R,_i))return false}`)
+    } else if (typeof u === 'object' && u !== null) {
+      const ul = []
+      nestedGenCode(u, '_uv', ul, ctx)
+      decls.push(`function ${name}_u(_uv){${ul.join('\n  ')}\n  return true}`)
+      body.push(`if(Array.isArray(d)){for(let _i=0;_i<d.length;_i++)if(!_hI(_R,_i)&&!${name}_u(d[_i]))return false}`)
+    } else {
+      throw DECLINE
+    }
+    body.push(`if(Array.isArray(d))_mrI(S,0,d.length)`)
+  }
+  // `unevaluatedItems: true` evaluates every position once the subschema
+  // has passed, with nothing to check; marked last, so a failure above has
+  // nothing of it to undo.
+  if (sub.unevaluatedItems === true) body.push(`if(Array.isArray(d))_mrI(S,0,d.length)`)
+  decls.push(`function ${name}(d,S){${body.join(';')};return true}`)
+  ;(ctx.preamble || ctx.helperCode).push(decls.join(''))
+  ctx.annFnsI.set(sub, name)
+  return name
 }
 
 function genUnevaluatedFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj) {
@@ -5952,6 +7131,41 @@ function genUnevaluatedItemsFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix
   }
 }
 
+// The error generator's per-key loop (genAdditionalSchemaE), in the combined
+// generator: the subschema compiled by genCodeC at each additional key, with
+// that key's path. Patterns go through the same matchers patternProperties
+// uses here.
+function genAdditionalSchemaC(schema, v, pathExpr, lines, ctx, schemaPrefix, isObj) {
+  const ki = ctx.varCounter++
+  const kVar = `_ak${ki}`
+  const known = Object.keys(schema.properties || {})
+  const conds = []
+  if (known.length) {
+    const set = `_akn${ki}`
+    ctx.closureVars.push(set)
+    ctx.closureVals.push(new Set(known))
+    conds.push(`!${set}.has(${kVar})`)
+  }
+  const pats = []
+  for (const pat of Object.keys(schema.patternProperties || {})) {
+    const fast = fastPrefixCheck(pat, kVar)
+    if (fast) { pats.push(fast); continue }
+    const ri = ctx.varCounter++
+    ctx.closureVars.push(`_re${ri}`)
+    ctx.closureVals.push(safeReClosure(ctx, pat))
+    pats.push(`_re${ri}.test(${kVar})`)
+  }
+  if (pats.length) conds.push(`!(${pats.join('||')})`)
+  const guard = isObj ? '' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v}))`
+  const keep = conds.length ? `if(${conds.join('&&')})` : ''
+  const pe = emitPtrEsc(ctx)
+  const p = pathExpr ? `${pathExpr}+'/'+${pe}(${kVar})` : `'/'+${pe}(${kVar})`
+  const sub = []
+  genCodeC(schema.additionalProperties, `${v}[${kVar}]`, p, sub, ctx, schemaPrefix + '/additionalProperties')
+  if (sub.length === 0) return
+  lines.push(`${guard}{for(const ${kVar} in ${v}){${keep}{${sub.join('\n  ')}\n  }}}`)
+}
+
 function genPatternPropertiesC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj) {
   let handledPropertyNames = false
   const ppEntries = Object.entries(schema.patternProperties)
@@ -6070,7 +7284,7 @@ function genDependentSchemasC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 function genPropertyNamesFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   const ki = ctx.varCounter++
   const p = pathExpr || '""'
-  lines.push(`;if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){for(const _k${ki} in ${v}){(_e||(_e=[])).push({keyword:'not',instancePath:${p},schemaPath:'${schemaPrefix}/propertyNames'${ordinalField(ctx, `${schemaPrefix}/propertyNames`)},params:{},message:'boolean schema is false'})}}`)
+  lines.push(`;if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){for(const _k${ki} in ${v}){${errPushC(ctx, 'not', `${schemaPrefix}/propertyNames`, pathExpr, '{}', "'boolean schema is false'", v, `{keyword:'not',instancePath:${p},schemaPath:'${schemaPrefix}/propertyNames'${ordinalField(ctx, `${schemaPrefix}/propertyNames`)},params:{},message:'boolean schema is false'}`)}}}`)
 }
 
 function genPropertyNamesC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail) {
@@ -6124,12 +7338,18 @@ function genContainsC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail) {
 }
 
 function genAnyOfC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail) {
+  // The collapsed branch error the other engines report (ATA4001-4003),
+  // built by the error generator's emitter; see compileToJSCombined.
+  if (ctx.inCombined) return emitBranchCollapse(schema.anyOf, 'anyOf', v, pathExpr, lines, ctx, schemaPrefix)
   const fi = ctx.varCounter++
   const fns = schema.anyOf.map(sub => { const sl = []; nestedGenCode(sub, '_av', sl, ctx); return sl.length === 0 ? `function(_av){return true}` : `function(_av){${sl.join(';')};return true}` })
   lines.push(`{const _af${fi}=[${fns.join(',')}];let _am=false;for(let _ai=0;_ai<_af${fi}.length;_ai++){if(_af${fi}[_ai](${v})){_am=true;break}}if(!_am){${fail('anyOf', 'anyOf', '{}', "'must match a schema in anyOf'")}}}`)
 }
 
 function genOneOfC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail) {
+  // The collapsed branch error the other engines report (ATA4001-4003),
+  // built by the error generator's emitter; see compileToJSCombined.
+  if (ctx.inCombined) return emitBranchCollapse(schema.oneOf, 'oneOf', v, pathExpr, lines, ctx, schemaPrefix)
   const fi = ctx.varCounter++
   const fns = schema.oneOf.map(sub => { const sl = []; nestedGenCode(sub, '_ov', sl, ctx); return sl.length === 0 ? `function(_ov){return true}` : `function(_ov){${sl.join(';')};return true}` })
   lines.push(`{const _of${fi}=[${fns.join(',')}];let _oc=0;for(let _oi=0;_oi<_of${fi}.length;_oi++){if(_of${fi}[_oi](${v}))_oc++;if(_oc>1)break}if(_oc!==1){${fail('oneOf', 'oneOf', '{}', "'must match exactly one schema in oneOf'")}}}`)