From 25bfb1fb9cbc205cdb81445a8b15d1d0b078259d Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 21:44:32 +0300
Subject: [PATCH 01/11] test(compilers/openapi): move end-to-end tests into
 their own package

The root package held its four source files among 53 test files, most of
which compile a whole spec through openapi.New and read the IR, the
conformance corpus, goldens, fuzz targets and benchmarks among them.
They cover nothing under internal/, since coverage counts a package's
own tests, and they buried the unit tests of the root's own code.

They now live in compilers/openapi/e2e, a package of test files only.
The files move whole, so history follows them; the edits are the package
clause, one more ../ in each repository path, the openapi. qualifier on
the seven files that were in-package, and the FuzzCycleDetector seed
corpus moving beside its target.

What the root keeps is the tests of its own files. Three of them
borrowed fixtures from files that moved: sourcetable_test.go now
declares its own document and overlays, and openapi_test.go and
budgets_test.go their own paths. Two exported defaults were covered only
by end-to-end tests and get a unit test each. defs_test.go's copy of
propByWire, which existed only because it could not reach the
conformance one, is gone.

The lowering-spec checks name each package by its repository path, and
the docs and commands that named the old location point at the new one.
---
 CLAUDE.md                                     |  11 +-
 CONTRIBUTING.md                               |  12 +-
 README.md                                     |   6 +-
 compilers/openapi/budgets_test.go             |   2 +
 .../{ => e2e}/allof_visibility_test.go        |   2 +-
 .../openapi/{ => e2e}/amplification_test.go   |   9 +-
 compilers/openapi/{ => e2e}/anchors_test.go   |  19 +--
 .../{ => e2e}/annotations_carrier_test.go     |   2 +-
 .../openapi/{ => e2e}/annotations_test.go     |   2 +-
 .../openapi/{ => e2e}/boolean_ref_test.go     |   2 +-
 .../openapi/{ => e2e}/compile_bench_test.go   |   2 +-
 .../openapi/{ => e2e}/confinement_test.go     |   2 +-
 .../openapi/{ => e2e}/conformance_test.go     |   4 +-
 .../{ => e2e}/conformance_unmodeled_test.go   |   2 +-
 .../openapi/{ => e2e}/constraints_test.go     |   2 +-
 compilers/openapi/{ => e2e}/cycles_test.go    |  37 +++---
 .../openapi/{ => e2e}/danglingcheck_test.go   |   6 +-
 compilers/openapi/{ => e2e}/defs_test.go      |  11 +-
 compilers/openapi/e2e/doc_test.go             |   9 ++
 .../{ => e2e}/external_content_test.go        |   2 +-
 .../openapi/{ => e2e}/external_nested_test.go |   4 +-
 .../openapi/{ => e2e}/external_order_test.go  |   2 +-
 compilers/openapi/{ => e2e}/fuzz_test.go      |   6 +-
 compilers/openapi/{ => e2e}/golden_test.go    |  10 +-
 compilers/openapi/e2e/helpers_test.go         |  43 +++++++
 .../openapi/{ => e2e}/later_version_test.go   |   2 +-
 compilers/openapi/{ => e2e}/load_test.go      |  47 ++++----
 .../{ => e2e}/lowering_spec_checks_test.go    |   4 +-
 .../openapi/{ => e2e}/lowering_spec_test.go   |  31 +++--
 compilers/openapi/{ => e2e}/main_test.go      |   2 +-
 .../openapi/{ => e2e}/mapping_lowered_test.go |   2 +-
 .../{ => e2e}/mapping_spellings_test.go       |   2 +-
 .../openapi/{ => e2e}/namespaces_test.go      |   4 +-
 compilers/openapi/{ => e2e}/nesting_test.go   |   2 +-
 .../openapi/{ => e2e}/null_schema_test.go     |   2 +-
 .../{ => e2e}/nullable_widening_test.go       |   2 +-
 compilers/openapi/{ => e2e}/overlay_test.go   |   2 +-
 compilers/openapi/{ => e2e}/ownership_test.go |   2 +-
 compilers/openapi/{ => e2e}/plus_refs_test.go |  11 +-
 compilers/openapi/e2e/pointer_tokens_test.go  |  69 +++++++++++
 .../{ => e2e}/promotion_carriers_test.go      |   2 +-
 compilers/openapi/{ => e2e}/promotion_test.go |   2 +-
 compilers/openapi/{ => e2e}/purity_test.go    |   2 +-
 .../openapi/{ => e2e}/reference_ends_test.go  |   2 +-
 .../openapi/{ => e2e}/refusal_order_test.go   |   2 +-
 .../openapi/{ => e2e}/reuse_corpus_test.go    |   4 +-
 compilers/openapi/{ => e2e}/streaming_test.go |   2 +-
 .../fuzz/FuzzCycleDetector/7d5c7e6c57176224   |   0
 .../fuzz/FuzzCycleDetector/a897d2fc8d321096   |   0
 .../openapi/{ => e2e}/unknownkeys_test.go     |   4 +-
 compilers/openapi/openapi_test.go             |  13 +-
 compilers/openapi/options_test.go             |  16 +++
 compilers/openapi/resolve_internal_test.go    |  58 ---------
 compilers/openapi/sourcetable_test.go         |  35 ++++--
 docs/compilers/openapi.md                     | 114 +++++++++---------
 55 files changed, 375 insertions(+), 274 deletions(-)
 rename compilers/openapi/{ => e2e}/allof_visibility_test.go (99%)
 rename compilers/openapi/{ => e2e}/amplification_test.go (92%)
 rename compilers/openapi/{ => e2e}/anchors_test.go (94%)
 rename compilers/openapi/{ => e2e}/annotations_carrier_test.go (99%)
 rename compilers/openapi/{ => e2e}/annotations_test.go (99%)
 rename compilers/openapi/{ => e2e}/boolean_ref_test.go (99%)
 rename compilers/openapi/{ => e2e}/compile_bench_test.go (97%)
 rename compilers/openapi/{ => e2e}/confinement_test.go (99%)
 rename compilers/openapi/{ => e2e}/conformance_test.go (99%)
 rename compilers/openapi/{ => e2e}/conformance_unmodeled_test.go (99%)
 rename compilers/openapi/{ => e2e}/constraints_test.go (99%)
 rename compilers/openapi/{ => e2e}/cycles_test.go (96%)
 rename compilers/openapi/{ => e2e}/danglingcheck_test.go (97%)
 rename compilers/openapi/{ => e2e}/defs_test.go (97%)
 create mode 100644 compilers/openapi/e2e/doc_test.go
 rename compilers/openapi/{ => e2e}/external_content_test.go (99%)
 rename compilers/openapi/{ => e2e}/external_nested_test.go (98%)
 rename compilers/openapi/{ => e2e}/external_order_test.go (98%)
 rename compilers/openapi/{ => e2e}/fuzz_test.go (97%)
 rename compilers/openapi/{ => e2e}/golden_test.go (84%)
 create mode 100644 compilers/openapi/e2e/helpers_test.go
 rename compilers/openapi/{ => e2e}/later_version_test.go (99%)
 rename compilers/openapi/{ => e2e}/load_test.go (94%)
 rename compilers/openapi/{ => e2e}/lowering_spec_checks_test.go (98%)
 rename compilers/openapi/{ => e2e}/lowering_spec_test.go (94%)
 rename compilers/openapi/{ => e2e}/main_test.go (96%)
 rename compilers/openapi/{ => e2e}/mapping_lowered_test.go (99%)
 rename compilers/openapi/{ => e2e}/mapping_spellings_test.go (98%)
 rename compilers/openapi/{ => e2e}/namespaces_test.go (96%)
 rename compilers/openapi/{ => e2e}/nesting_test.go (98%)
 rename compilers/openapi/{ => e2e}/null_schema_test.go (99%)
 rename compilers/openapi/{ => e2e}/nullable_widening_test.go (99%)
 rename compilers/openapi/{ => e2e}/overlay_test.go (99%)
 rename compilers/openapi/{ => e2e}/ownership_test.go (99%)
 rename compilers/openapi/{ => e2e}/plus_refs_test.go (97%)
 create mode 100644 compilers/openapi/e2e/pointer_tokens_test.go
 rename compilers/openapi/{ => e2e}/promotion_carriers_test.go (98%)
 rename compilers/openapi/{ => e2e}/promotion_test.go (99%)
 rename compilers/openapi/{ => e2e}/purity_test.go (99%)
 rename compilers/openapi/{ => e2e}/reference_ends_test.go (99%)
 rename compilers/openapi/{ => e2e}/refusal_order_test.go (99%)
 rename compilers/openapi/{ => e2e}/reuse_corpus_test.go (96%)
 rename compilers/openapi/{ => e2e}/streaming_test.go (98%)
 rename compilers/openapi/{ => e2e}/testdata/fuzz/FuzzCycleDetector/7d5c7e6c57176224 (100%)
 rename compilers/openapi/{ => e2e}/testdata/fuzz/FuzzCycleDetector/a897d2fc8d321096 (100%)
 rename compilers/openapi/{ => e2e}/unknownkeys_test.go (99%)

diff --git a/CLAUDE.md b/CLAUDE.md
index 90c39030..c5329ca1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -205,11 +205,12 @@ These all exist already — extend them rather than building a parallel mechanis
   `internal/jsonshape` by `internal/census`; `go test ./cmd/morphic-census` holds the file to a
   census of `testdata/`. A case that sets a fact takes its line out, so its change runs `-update`.
 - **Lowering specification**: `docs/compilers/openapi.md` is machine-read like the matrix. Each rule
-  names its evidence, and the `TestLoweringSpec` tests in `compilers/openapi` hold the names to the
-  code both ways, each listed code to the rule's text, and every `docs/compilers/openapi.md#<key>`
-  citation to a rule. It, `docs/parser-library.md` and each format's conformance `matrix.md` are
-  read through `internal/keydoc`, the one reader of the repository's keyed documents, and a test a
-  Markdown document names must exist (`internal/archtest`).
+  names its evidence, and the `TestLoweringSpec` tests in `compilers/openapi/e2e` hold the names to
+  the code both ways, each listed code to the rule's text, and every
+  `docs/compilers/openapi.md#<key>` citation to a rule. It, `docs/parser-library.md` and each
+  format's conformance `matrix.md` are read through `internal/keydoc`, the one reader of the
+  repository's keyed documents, and a test a Markdown document names must exist
+  (`internal/archtest`).
 - **Oracles**: `internal/harness` drives a spec through no-panic → no error diagnostic →
   `irverify` invariants → JSON round-trip → determinism → order-invariance, stopping at the first
   one that fires. `harness.Check` is the list — read it there rather than trusting this sentence;
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 26fd470f..de3c6e5f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -74,7 +74,7 @@ A lowering rule says how one OpenAPI construct reaches the IR: the field it fill
    `TestDocComments_StayUnderTheCap`, `TestSuppressions_NoDirectiveStandsInTheSource`.
 4. **Add a conformance case and a unit test.** Write a minimal spec at
    `testdata/conformance/openapi/<name>.yaml` that exercises the rule, add an entry to
-   `conformanceCases()` in `compilers/openapi/conformance_test.go` naming its assertion, list it
+   `conformanceCases()` in `compilers/openapi/e2e/conformance_test.go` naming its assertion, list it
    under each [`ir-spec-matrix.md`](docs/ir-spec-matrix.md) row it witnesses in
    `testdata/conformance/openapi/matrix.md` (none, for a case that pins only a diagnostic), write
    the assertion, and name the case in the rule's Cases field. Then write its golden alone, since
@@ -82,12 +82,12 @@ A lowering rule says how one OpenAPI construct reaches the IR: the field it fill
    the golden exists:
 
    ```bash
-   go test ./compilers/openapi -run '^TestConformance$/^<name>$' -update
+   go test ./compilers/openapi/e2e -run '^TestConformance$/^<name>$' -update
    ```
 
-   Coverage is counted per package, and the case runs in `compilers/openapi`, so it covers nothing
-   under `internal/`: the code you wrote there also needs a test in its own package, which the
-   rule's Tests field then names.
+   Coverage is counted per package, and the case runs in `compilers/openapi/e2e`, which holds no
+   code of its own, so it covers nothing: the code you wrote also needs a test in its own package,
+   which the rule's Tests field then names.
    *Fails if missed:* `TestConformance_TableNamesEveryCorpusSpec` for a spec with no entry,
    `TestConformance/<name>` for a golden that does not match, `TestLoweringSpec_CasesAreTheCorpus`
    for a case no rule names, `TestConformance_EveryRegisteredFormatIsHeldToItsColumn` for a name in
@@ -97,7 +97,7 @@ A lowering rule says how one OpenAPI construct reaches the IR: the field it fill
 5. **Regenerate what the change moves, and read the diff.** Other goldens may change too:
 
    ```bash
-   go test ./compilers/openapi -run 'TestGolden|TestConformance' -update
+   go test ./compilers/openapi/e2e -run 'TestGolden|TestConformance' -update
    git status --short testdata/
    ```
 
diff --git a/README.md b/README.md
index b031dc23..89d0574e 100644
--- a/README.md
+++ b/README.md
@@ -316,13 +316,13 @@ Run a single test with `go test ./ir -run TestName`. Beyond that:
   and review the diff:
 
   ```bash
-  go test ./compilers/openapi -run 'TestGolden|TestConformance' -update
+  go test ./compilers/openapi/e2e -run 'TestGolden|TestConformance' -update
   ```
 
 - **Conformance corpus.** Each case in `testdata/conformance/openapi/` is a minimal spec that
   witnesses one or more rows of the [spec capability matrix](docs/ir-spec-matrix.md). To add one,
   write `<name>.yaml`, add an entry to `conformanceCases()` in
-  `compilers/openapi/conformance_test.go` naming its assertion, list it under the matrix rows it
+  `compilers/openapi/e2e/conformance_test.go` naming its assertion, list it under the matrix rows it
   witnesses in `testdata/conformance/openapi/matrix.md`, then run the command above to write
   `<name>.golden.json`, and name the case in the rule of the
   [OpenAPI lowering specification](docs/compilers/openapi.md) it pins. The suite fails on a spec
@@ -342,7 +342,7 @@ Run a single test with `go test ./ir -run TestName`. Beyond that:
   it reads the IR's declarations through the go command.
 - **Fuzzing.** `make fuzz` runs every fuzz target for 10s each (`make fuzz FUZZTIME=5m` for a
   longer search). One target runs on its own with, for example,
-  `go test ./compilers/openapi -run '^$' -fuzz '^FuzzCompile$' -fuzztime 1m`.
+  `go test ./compilers/openapi/e2e -run '^$' -fuzz '^FuzzCompile$' -fuzztime 1m`.
 
 ## Design docs
 
diff --git a/compilers/openapi/budgets_test.go b/compilers/openapi/budgets_test.go
index f8ba0afe..1ecd5e66 100644
--- a/compilers/openapi/budgets_test.go
+++ b/compilers/openapi/budgets_test.go
@@ -25,6 +25,8 @@ import (
 	"github.com/dexpace/morphic/ir"
 )
 
+const amplificationBombFixture = "../../testdata/openapi/amplification_alias_bomb.yaml"
+
 // enumSpec is a minimal document whose one component declares a string enum of
 // n members. The specs these tests need differ only in how large they are, and
 // building them here is what keeps a multi-megabyte fixture out of the corpus.
diff --git a/compilers/openapi/allof_visibility_test.go b/compilers/openapi/e2e/allof_visibility_test.go
similarity index 99%
rename from compilers/openapi/allof_visibility_test.go
rename to compilers/openapi/e2e/allof_visibility_test.go
index 520ffa15..9232fb4a 100644
--- a/compilers/openapi/allof_visibility_test.go
+++ b/compilers/openapi/e2e/allof_visibility_test.go
@@ -2,7 +2,7 @@
 // redeclared property detail (required, docs, default, constraints, ...) but
 // never Visibility, so a readOnly/writeOnly declared on the allOf branch that
 // redeclares a shared field was silently lost.
-package openapi_test
+package e2e_test
 
 import (
 	"testing"
diff --git a/compilers/openapi/amplification_test.go b/compilers/openapi/e2e/amplification_test.go
similarity index 92%
rename from compilers/openapi/amplification_test.go
rename to compilers/openapi/e2e/amplification_test.go
index 3e25fb4c..8d11e6b0 100644
--- a/compilers/openapi/amplification_test.go
+++ b/compilers/openapi/e2e/amplification_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"fmt"
@@ -11,11 +11,12 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/compilers/openapi"
 	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/ir"
 )
 
-const amplificationBombFixture = "../../testdata/openapi/amplification_alias_bomb.yaml"
+const amplificationBombFixture = "../../../testdata/openapi/amplification_alias_bomb.yaml"
 
 func TestCompile_AliasBombDoesNotExhaustMemory(t *testing.T) {
 	t.Parallel()
@@ -29,7 +30,7 @@ func TestCompile_AliasBombDoesNotExhaustMemory(t *testing.T) {
 	}
 	done := make(chan result, 1)
 	go func() {
-		doc, diags, cerr := New().Compile(t.Context(),
+		doc, diags, cerr := openapi.New().Compile(t.Context(),
 			[]compilers.Source{{Path: "amplification_alias_bomb.yaml", Data: data}}, compilers.Options{})
 		done <- result{doc, diags, cerr}
 	}()
@@ -75,7 +76,7 @@ func TestCompile_SharedCompositionAncestorsDoNotAmplify(t *testing.T) {
 	}
 	done := make(chan result, 1)
 	go func() {
-		doc, diags, cerr := New().Compile(t.Context(),
+		doc, diags, cerr := openapi.New().Compile(t.Context(),
 			[]compilers.Source{{Path: "shared_ancestors.yaml", Data: []byte(b.String())}},
 			compilers.Options{})
 		done <- result{doc, diags, cerr}
diff --git a/compilers/openapi/anchors_test.go b/compilers/openapi/e2e/anchors_test.go
similarity index 94%
rename from compilers/openapi/anchors_test.go
rename to compilers/openapi/e2e/anchors_test.go
index 23bdaece..cabc1c26 100644
--- a/compilers/openapi/anchors_test.go
+++ b/compilers/openapi/e2e/anchors_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"encoding/json/jsontext"
@@ -18,6 +18,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/compilers/openapi"
 	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
 	"github.com/dexpace/morphic/engine/reader"
@@ -179,9 +180,9 @@ func compileServed(t *testing.T, first, second string) (*ir.Document, *ir.Docume
 func compileReferring(t *testing.T, path, uri string) *ir.Document {
 	t.Helper()
 	src := anchorFixtureHead + "paths:\n  /x: {$ref: \"" + uri + "#/paths/~1x\"}\n"
-	doc, diags, err := New().Compile(t.Context(),
+	doc, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: path, Data: []byte(src)}},
-		compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 	require.NoError(t, err)
 	require.NotNil(t, doc)
 	openapitest.RequireNoErrorDiags(t, diags)
@@ -200,9 +201,9 @@ func compileBesideExpectingErrors(t *testing.T, ext, root string) []ir.Diagnosti
 	t.Helper()
 	dir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "other.yaml"), []byte(ext), 0o600))
-	_, diags, err := New().Compile(t.Context(),
+	_, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: []byte(root)}},
-		compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 	require.NoError(t, err, "a refused external document is a diagnostic, not a Go error")
 	return diags
 }
@@ -268,8 +269,8 @@ func TestCompile_ARefusedExternalDocumentIsFetchedOnce(t *testing.T) {
 	src := "openapi: 3.1.0\ninfo: {title: T, version: \"1\"}\npaths: {}\ncomponents:\n  schemas:\n" +
 		"    R1: " + ref + "\n    R2: " + ref + "\n    R3: " + ref + "\n"
 
-	_, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: "root.yaml", Data: []byte(src)}},
-		compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true, Limits: Limits{MaxSourceBytes: budget}}})
+	_, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: "root.yaml", Data: []byte(src)}},
+		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true, Limits: openapi.Limits{MaxSourceBytes: budget}}})
 
 	require.NoError(t, err)
 	var refusedAt []jsontext.Pointer
@@ -312,8 +313,8 @@ func TestCompile_AnExternalDocumentIsParsedAsItWasJudged(t *testing.T) {
 		"  /a: {$ref: \"" + srv.URL + "/doc.yaml#/paths/~1missing\"}\n" +
 		"  /b: {$ref: \"" + respelled + "/doc.yaml#/paths/~1x\"}\n"
 
-	doc, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: "root.yaml", Data: []byte(src)}},
-		compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true, Limits: Limits{MaxSourceNodes: budget}}})
+	doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: "root.yaml", Data: []byte(src)}},
+		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true, Limits: openapi.Limits{MaxSourceNodes: budget}}})
 
 	require.NoError(t, err)
 	require.NotNil(t, doc)
diff --git a/compilers/openapi/annotations_carrier_test.go b/compilers/openapi/e2e/annotations_carrier_test.go
similarity index 99%
rename from compilers/openapi/annotations_carrier_test.go
rename to compilers/openapi/e2e/annotations_carrier_test.go
index af942d84..731e6b61 100644
--- a/compilers/openapi/annotations_carrier_test.go
+++ b/compilers/openapi/e2e/annotations_carrier_test.go
@@ -4,7 +4,7 @@
 // not express a cell there at all — so two dropped-annotation defects at a
 // parameter lived in a position the matrix was structurally silent about, while
 // looking complete (GitHub #142).
-package openapi_test
+package e2e_test
 
 import (
 	"testing"
diff --git a/compilers/openapi/annotations_test.go b/compilers/openapi/e2e/annotations_test.go
similarity index 99%
rename from compilers/openapi/annotations_test.go
rename to compilers/openapi/e2e/annotations_test.go
index 58a45632..625ae9a5 100644
--- a/compilers/openapi/annotations_test.go
+++ b/compilers/openapi/e2e/annotations_test.go
@@ -2,7 +2,7 @@
 // annotation per kind of position, plus an assertion that no combination is
 // silently uncovered. It complements conformance_test.go, which covers
 // capability rows rather than annotation positions.
-package openapi_test
+package e2e_test
 
 import (
 	"encoding/json/v2"
diff --git a/compilers/openapi/boolean_ref_test.go b/compilers/openapi/e2e/boolean_ref_test.go
similarity index 99%
rename from compilers/openapi/boolean_ref_test.go
rename to compilers/openapi/e2e/boolean_ref_test.go
index ac82be79..25272029 100644
--- a/compilers/openapi/boolean_ref_test.go
+++ b/compilers/openapi/e2e/boolean_ref_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"strings"
diff --git a/compilers/openapi/compile_bench_test.go b/compilers/openapi/e2e/compile_bench_test.go
similarity index 97%
rename from compilers/openapi/compile_bench_test.go
rename to compilers/openapi/e2e/compile_bench_test.go
index b7d8f494..09ae591e 100644
--- a/compilers/openapi/compile_bench_test.go
+++ b/compilers/openapi/e2e/compile_bench_test.go
@@ -1,4 +1,4 @@
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"encoding/json/v2"
diff --git a/compilers/openapi/confinement_test.go b/compilers/openapi/e2e/confinement_test.go
similarity index 99%
rename from compilers/openapi/confinement_test.go
rename to compilers/openapi/e2e/confinement_test.go
index 93e28f41..208451d7 100644
--- a/compilers/openapi/confinement_test.go
+++ b/compilers/openapi/e2e/confinement_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it pins the
 // confinement a compile gives the reader it was handed, end to end through the
 // public entry point, where the load phase's own tests hold its parts.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"context"
diff --git a/compilers/openapi/conformance_test.go b/compilers/openapi/e2e/conformance_test.go
similarity index 99%
rename from compilers/openapi/conformance_test.go
rename to compilers/openapi/e2e/conformance_test.go
index 1f710a89..30ee54f1 100644
--- a/compilers/openapi/conformance_test.go
+++ b/compilers/openapi/e2e/conformance_test.go
@@ -2,7 +2,7 @@
 // capability-conformance corpus (one minimal spec per ir-spec-matrix.md row)
 // through the whole compiler to keep "lossless by default" honest, so it has no
 // single source file to pair with.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"encoding/json/jsontext"
@@ -30,7 +30,7 @@ import (
 
 // conformanceDir is the corpus of one minimal spec per capability row of
 // ir-spec-matrix.md, addressed relative to this test file.
-const conformanceDir = "../../testdata/conformance/openapi"
+const conformanceDir = "../../../testdata/conformance/openapi"
 
 // witnessDoc is the file in the corpus directory that names the matrix rows each
 // spec witnesses. It is no spec, and internal/conformance reads it.
diff --git a/compilers/openapi/conformance_unmodeled_test.go b/compilers/openapi/e2e/conformance_unmodeled_test.go
similarity index 99%
rename from compilers/openapi/conformance_unmodeled_test.go
rename to compilers/openapi/e2e/conformance_unmodeled_test.go
index a0676ad5..03c3bb33 100644
--- a/compilers/openapi/conformance_unmodeled_test.go
+++ b/compilers/openapi/e2e/conformance_unmodeled_test.go
@@ -4,7 +4,7 @@
 // and be announced by a diagnostic. It shares TestConformance's table in
 // conformance_test.go; the split is by subject, so the structural cases stay
 // readable beside each other there.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"encoding/json/jsontext"
diff --git a/compilers/openapi/constraints_test.go b/compilers/openapi/e2e/constraints_test.go
similarity index 99%
rename from compilers/openapi/constraints_test.go
rename to compilers/openapi/e2e/constraints_test.go
index 1400338d..e070649a 100644
--- a/compilers/openapi/constraints_test.go
+++ b/compilers/openapi/e2e/constraints_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"testing"
diff --git a/compilers/openapi/cycles_test.go b/compilers/openapi/e2e/cycles_test.go
similarity index 96%
rename from compilers/openapi/cycles_test.go
rename to compilers/openapi/e2e/cycles_test.go
index 63fdf37e..8e2dc28a 100644
--- a/compilers/openapi/cycles_test.go
+++ b/compilers/openapi/e2e/cycles_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"encoding/json/v2"
@@ -14,6 +14,7 @@ import (
 	yaml "gopkg.in/yaml.v3"
 
 	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/compilers/openapi"
 	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/compilers/openapi/internal/ids"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
@@ -158,7 +159,7 @@ func TestCompile_AliasCycleIsRefused(t *testing.T) {
 	for _, tc := range aliasCycleReproducers {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			doc, diags, err := New().Compile(t.Context(),
+			doc, diags, err := openapi.New().Compile(t.Context(),
 				[]compilers.Source{{Path: tc.file + ".yaml", Data: readReproducer(t, tc.file)}}, compilers.Options{})
 			require.NoError(t, err, "a recursive anchor is a spec problem, not a Go error")
 			assert.Nil(t, doc, "the compiler refuses to read a source whose aliases never end")
@@ -177,7 +178,7 @@ func TestCompile_SchemaRefCycleIsReportedAndStillCompiles(t *testing.T) {
 	for _, tc := range schemaRefCycles {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			doc, diags, err := New().Compile(t.Context(),
+			doc, diags, err := openapi.New().Compile(t.Context(),
 				[]compilers.Source{{Path: tc.file + ".yaml", Data: readReproducer(t, tc.file)}}, compilers.Options{})
 			require.NoError(t, err, "a cyclic spec is a spec problem, not a Go error")
 			assert.NotNil(t, doc, "a loop of schema $refs does not refuse the document")
@@ -197,7 +198,7 @@ func TestCompile_SchemaRefNamingNothingIsUnresolvedNotCyclic(t *testing.T) {
 	for _, tc := range unreadSchemaRefs {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			doc, diags, err := New().Compile(t.Context(),
+			doc, diags, err := openapi.New().Compile(t.Context(),
 				[]compilers.Source{{Path: tc.file + ".yaml", Data: readReproducer(t, tc.file)}}, compilers.Options{})
 			require.NoError(t, err)
 			assert.NotNil(t, doc)
@@ -247,7 +248,7 @@ func TestCompile_CycleIsReportedAtItsLeastMemberInEitherOrder(t *testing.T) {
 					slices.Reverse(members)
 				}
 
-				doc, diags, err := New().Compile(t.Context(),
+				doc, diags, err := openapi.New().Compile(t.Context(),
 					[]compilers.Source{{Path: "loop.yaml", Data: []byte(head + strings.Join(members, ""))}},
 					compilers.Options{})
 
@@ -313,9 +314,9 @@ func TestCompile_ALoopThroughAnotherDocumentIsReportedOnce(t *testing.T) {
 				[]byte("components:\n  schemas:\n"+strings.Join(other, "")), 0o600))
 			root := "openapi: 3.1.0\ninfo: {title: t, version: '1'}\npaths: {}\ncomponents:\n  schemas:\n" +
 				strings.Join(source, "")
-			doc, diags, err := New().Compile(t.Context(),
+			doc, diags, err := openapi.New().Compile(t.Context(),
 				[]compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: []byte(root)}},
-				compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+				compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 			require.NoError(t, err, tc.name)
 			require.NotNil(t, doc, "%s: the rest of the document lowers", tc.name)
 			var sites []ir.Provenance
@@ -346,7 +347,7 @@ func TestCompile_ReferenceObjectCycleIsReportedUnresolved(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			data := readReproducer(t, tc.file)
-			_, diags, err := New().Compile(t.Context(),
+			_, diags, err := openapi.New().Compile(t.Context(),
 				[]compilers.Source{{Path: tc.file + ".yaml", Data: data}}, compilers.Options{})
 			require.NoError(t, err, "a failing reference is a spec problem, not a Go error")
 			for _, d := range diags {
@@ -376,7 +377,7 @@ components:
     A:
       $ref: '#x-s'
 `
-	doc, diags, err := New().Compile(t.Context(),
+	doc, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: "anchor.yaml", Data: []byte(src)}}, compilers.Options{})
 	require.NoError(t, err, "an unresolved anchor reference is a spec problem, not a Go error")
 	require.NotNil(t, doc, "the document is no longer refused as a cycle")
@@ -417,7 +418,7 @@ components:
   schemas:
     Form: {type: object}
 `
-	doc, _, err := New().Compile(t.Context(),
+	doc, _, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: "multipart.yaml", Data: []byte(src)}}, compilers.Options{})
 	require.NoError(t, err)
 	require.NotNil(t, doc)
@@ -480,10 +481,10 @@ func TestDetectCycles_ComponentOnlyCyclesLeftToResolver(t *testing.T) {
 	for _, tc := range componentOnlyCycles {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			assert.Empty(t, scan.Aliases(scan.InSource(0), scanIndex(t, tc.data), DefaultMaxAliasSurplus),
+			assert.Empty(t, scan.Aliases(scan.InSource(0), scanIndex(t, tc.data), openapi.DefaultMaxAliasSurplus),
 				"a components-only cycle is the resolver's to report")
 
-			_, diags, err := New().Compile(t.Context(),
+			_, diags, err := openapi.New().Compile(t.Context(),
 				[]compilers.Source{{Path: tc.name + ".yaml", Data: []byte(tc.data)}}, compilers.Options{})
 			require.NoError(t, err)
 			assertHasErrorCode(t, diags, diag.UnresolvedRef)
@@ -586,7 +587,7 @@ func TestCompile_RefShapedDataNotRefused(t *testing.T) {
 	for _, tc := range refShapedDataSpecs {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			doc, diags, err := New().Compile(t.Context(),
+			doc, diags, err := openapi.New().Compile(t.Context(),
 				[]compilers.Source{{Path: tc.name + ".yaml", Data: []byte(tc.data)}}, compilers.Options{})
 			require.NoError(t, err)
 			assert.NotNil(t, doc, "a legal ref-shaped-data spec must still lower")
@@ -619,7 +620,7 @@ components:
   schemas:
     A: {$ref: '#/components/schemas/A/'}
 `
-	doc, diags, err := New().Compile(t.Context(),
+	doc, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: "schema_empty_segment.yaml", Data: []byte(src)}}, compilers.Options{})
 	require.NoError(t, err)
 	assert.NotNil(t, doc)
@@ -633,7 +634,7 @@ components:
 // can end up looking somewhere the others are not — which matters most for the
 // seed loader, since it ignores a read error and a wrong path there would cost
 // the fuzzer its seeds in silence.
-const reproducerDir = "../../testdata/openapi"
+const reproducerDir = "../../../testdata/openapi"
 
 func readReproducer(t *testing.T, file string) []byte {
 	t.Helper()
@@ -649,7 +650,7 @@ func readReproducer(t *testing.T, file string) []byte {
 // source or reports an incomplete scan.
 func TestCompile_MergeChainPastBoundStillCompiles(t *testing.T) {
 	t.Parallel()
-	doc, diags, err := New().Compile(t.Context(),
+	doc, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: "deep-merge.yaml", Data: []byte(ynode.MergeChainSpec(200))}},
 		compilers.Options{})
 	require.NoError(t, err)
@@ -682,7 +683,7 @@ func FuzzCycleDetector(f *testing.F) {
 	f.Add([]byte("\t\x00: [")) // undecodable: reported as a parse error, not a fault
 
 	f.Fuzz(func(t *testing.T, data []byte) {
-		doc, diags, err := New().Compile(t.Context(),
+		doc, diags, err := openapi.New().Compile(t.Context(),
 			[]compilers.Source{{Path: "fuzz.yaml", Data: data}}, compilers.Options{})
 		if err != nil {
 			assert.Nil(t, doc, "a Go error returns no document")
@@ -709,7 +710,7 @@ func TestCompile_ReentrantPrefixReportsAlikeInBothDeclarationOrders(t *testing.T
 	for _, tc := range orders {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			_, diags, err := New().Compile(t.Context(),
+			_, diags, err := openapi.New().Compile(t.Context(),
 				[]compilers.Source{{Path: "order.yaml", Data: []byte(head + tc.body)}},
 				compilers.Options{})
 			require.NoError(t, err, "a failing reference is a spec problem, not a Go error")
diff --git a/compilers/openapi/danglingcheck_test.go b/compilers/openapi/e2e/danglingcheck_test.go
similarity index 97%
rename from compilers/openapi/danglingcheck_test.go
rename to compilers/openapi/e2e/danglingcheck_test.go
index d805cfb7..2e9af72f 100644
--- a/compilers/openapi/danglingcheck_test.go
+++ b/compilers/openapi/e2e/danglingcheck_test.go
@@ -2,7 +2,7 @@
 // issue-#14 dangling-ref reproducer corpus through the whole compiler, so it has
 // no single source file to pair with. This is deliberate, not a leftover from the
 // test-file consolidation — do not fold it into another file.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"fmt"
@@ -25,7 +25,7 @@ import (
 // danglingDir holds the issue-#14 reproducers, copied out of triage so the tests
 // are self-contained. danglingReproducers is the enumeration, and
 // TestDanglingRefs_EveryReproducerIsExercised holds it to the directory.
-const danglingDir = "../../testdata/dangling/openapi"
+const danglingDir = "../../../testdata/dangling/openapi"
 
 // danglingRefs returns a sorted, human-readable list of every dangling reference
 // in doc — a TypeRef, discriminator, or value ref whose TypeID is absent from
@@ -217,7 +217,7 @@ func TestDanglingRefs_Corpus(t *testing.T) {
 	specs, err := filepath.Glob(filepath.Join(conformanceDir, "*.yaml"))
 	require.NoError(t, err)
 	require.NotEmpty(t, specs)
-	specs = append(specs, "../../testdata/golden/openapi/petstore.yaml")
+	specs = append(specs, "../../../testdata/golden/openapi/petstore.yaml")
 	for _, spec := range specs {
 		t.Run(filepath.Base(spec), func(t *testing.T) {
 			t.Parallel()
diff --git a/compilers/openapi/defs_test.go b/compilers/openapi/e2e/defs_test.go
similarity index 97%
rename from compilers/openapi/defs_test.go
rename to compilers/openapi/e2e/defs_test.go
index f35caae7..78fcb436 100644
--- a/compilers/openapi/defs_test.go
+++ b/compilers/openapi/e2e/defs_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"encoding/json/jsontext"
@@ -14,15 +14,6 @@ import (
 	"github.com/dexpace/morphic/ir"
 )
 
-// propByWire looks up m's property by wire name. This file is package openapi,
-// for the helpers it shares with the other internal tests, so it cannot reach
-// conformance_test.go's helper of the same name in package openapi_test; it
-// puts openapitest.PropsByWire's map in the same two-value form.
-func propByWire(m *ir.Model, wire string) (ir.Property, bool) {
-	p, ok := openapitest.PropsByWire(m.Properties)[wire]
-	return p, ok
-}
-
 // twoReversedSpec is testdata/openapi/two.yaml (GitHub #557's repro) with A and
 // B's declaration order swapped. It is not itself committed to the corpus: the
 // harness's own order-invariance oracle already reverses every committed
diff --git a/compilers/openapi/e2e/doc_test.go b/compilers/openapi/e2e/doc_test.go
new file mode 100644
index 00000000..d77c8e5c
--- /dev/null
+++ b/compilers/openapi/e2e/doc_test.go
@@ -0,0 +1,9 @@
+// Package e2e_test holds the OpenAPI compiler's end-to-end tests: the
+// conformance corpus, the goldens, fuzzing, benchmarks, and scenarios several
+// internal packages decide together, each compiling a spec through openapi.New
+// and reading what comes out.
+//
+// It is a package of its own because coverage counts only a package's own
+// tests. Nothing here is covered by them, so the code they reach still needs
+// the unit tests beside it, and a case here never stands in for one.
+package e2e_test
diff --git a/compilers/openapi/external_content_test.go b/compilers/openapi/e2e/external_content_test.go
similarity index 99%
rename from compilers/openapi/external_content_test.go
rename to compilers/openapi/e2e/external_content_test.go
index 146dc244..e2fc872b 100644
--- a/compilers/openapi/external_content_test.go
+++ b/compilers/openapi/e2e/external_content_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it pins how
 // the lowering reads what references bring in from another document, across
 // every kind of object the operation walk follows.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"fmt"
diff --git a/compilers/openapi/external_nested_test.go b/compilers/openapi/e2e/external_nested_test.go
similarity index 98%
rename from compilers/openapi/external_nested_test.go
rename to compilers/openapi/e2e/external_nested_test.go
index 2d8e056f..7a4d17af 100644
--- a/compilers/openapi/external_nested_test.go
+++ b/compilers/openapi/e2e/external_nested_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite: it pins how the compile reads the
 // reference objects another document writes in what a reference brings in
 // from it (GitHub #751).
-package openapi_test
+package e2e_test
 
 import (
 	"os"
@@ -27,7 +27,7 @@ import (
 // passes a.yaml's own parameter reference reads on through it.
 func TestExternalContent_AReferenceItWritesIsResolvedWhereItIsDeclared(t *testing.T) {
 	t.Parallel()
-	path := filepath.Join("..", "..", "testdata", "openapi", "nested_refs", "root.yaml")
+	path := filepath.Join("..", "..", "..", "testdata", "openapi", "nested_refs", "root.yaml")
 	data, err := os.ReadFile(path)
 	require.NoError(t, err)
 
diff --git a/compilers/openapi/external_order_test.go b/compilers/openapi/e2e/external_order_test.go
similarity index 98%
rename from compilers/openapi/external_order_test.go
rename to compilers/openapi/e2e/external_order_test.go
index e520d720..fb6d344f 100644
--- a/compilers/openapi/external_order_test.go
+++ b/compilers/openapi/e2e/external_order_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it sweeps the
 // whole committed corpus through the compiler as another document's content,
 // so it has no single source file to pair with.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"encoding/json/v2"
diff --git a/compilers/openapi/fuzz_test.go b/compilers/openapi/e2e/fuzz_test.go
similarity index 97%
rename from compilers/openapi/fuzz_test.go
rename to compilers/openapi/e2e/fuzz_test.go
index 476937da..60a32a5e 100644
--- a/compilers/openapi/fuzz_test.go
+++ b/compilers/openapi/e2e/fuzz_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it fuzzes the
 // whole compile pipeline (corpus-seeded and mutation-based) rather than any one
 // source file's logic, so it has no single source file to pair with.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"bytes"
@@ -25,11 +25,11 @@ import (
 
 // goldenPetstore is the larger real-ish spec seeded alongside the conformance
 // corpus, addressed relative to this test file.
-const goldenPetstore = "../../testdata/golden/openapi/petstore.yaml"
+const goldenPetstore = "../../../testdata/golden/openapi/petstore.yaml"
 
 // cycleFixtureDir holds the cycle-detector reproducer and pointer-resolution
 // fixtures, addressed relative to this test file.
-const cycleFixtureDir = "../../testdata/openapi"
+const cycleFixtureDir = "../../../testdata/openapi"
 
 // FuzzCompile hammers the OpenAPI compiler with mutated spec bytes and asserts the
 // structural oracles (irverify passes, JSON round-trips byte-identical, recompile
diff --git a/compilers/openapi/golden_test.go b/compilers/openapi/e2e/golden_test.go
similarity index 84%
rename from compilers/openapi/golden_test.go
rename to compilers/openapi/e2e/golden_test.go
index 3f8f3f00..03a80040 100644
--- a/compilers/openapi/golden_test.go
+++ b/compilers/openapi/e2e/golden_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it snapshot-
 // compares the whole compiler's IR output against a byte-exact golden file, so
 // it has no single source file to pair with.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"os"
@@ -22,7 +22,7 @@ import (
 // `go test ./compilers/openapi -run TestGolden -update`.
 func TestGolden(t *testing.T) {
 	t.Parallel()
-	data, err := os.ReadFile("../../testdata/golden/openapi/petstore.yaml")
+	data, err := os.ReadFile("../../../testdata/golden/openapi/petstore.yaml")
 	require.NoError(t, err)
 	doc, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: "petstore.yaml", Data: data}}, compilers.Options{})
@@ -31,7 +31,7 @@ func TestGolden(t *testing.T) {
 	for _, d := range diags {
 		assert.NotEqual(t, ir.SeverityError, d.Severity, "unexpected error diagnostic: %+v", d)
 	}
-	irtest.CompareGolden(t, "../../testdata/golden/openapi/petstore.golden.json", doc)
+	irtest.CompareGolden(t, "../../../testdata/golden/openapi/petstore.golden.json", doc)
 }
 
 // TestGolden_SplitSpec pins the IR of a spec split across four files, read
@@ -45,7 +45,7 @@ func TestGolden_SplitSpec(t *testing.T) {
 	t.Parallel()
 	sources := make([]compilers.Source, 0, 4)
 	for _, name := range []string{"root.yaml", "common.yaml", "paths.yaml", "schemas/pet.yaml"} {
-		data, err := os.ReadFile("../../testdata/golden/openapi/split/" + name)
+		data, err := os.ReadFile("../../../testdata/golden/openapi/split/" + name)
 		require.NoError(t, err)
 		sources = append(sources, compilers.Source{Path: "split/" + name, Data: data})
 	}
@@ -57,5 +57,5 @@ func TestGolden_SplitSpec(t *testing.T) {
 	for _, d := range diags {
 		assert.NotEqual(t, ir.SeverityError, d.Severity, "unexpected error diagnostic: %+v", d)
 	}
-	irtest.CompareGolden(t, "../../testdata/golden/openapi/split/split.golden.json", doc)
+	irtest.CompareGolden(t, "../../../testdata/golden/openapi/split/split.golden.json", doc)
 }
diff --git a/compilers/openapi/e2e/helpers_test.go b/compilers/openapi/e2e/helpers_test.go
new file mode 100644
index 00000000..59e25fdd
--- /dev/null
+++ b/compilers/openapi/e2e/helpers_test.go
@@ -0,0 +1,43 @@
+package e2e_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/compilers/openapi"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+// parseFull runs the whole public compiler pipeline over src. That reach back
+// through openapi is also why openapitest cannot hold it — see that package's
+// doc comment.
+func parseFull(t *testing.T, src string) (*ir.Document, []ir.Diagnostic) {
+	t.Helper()
+	doc, diags, err := openapi.New().Compile(t.Context(),
+		[]compilers.Source{openapitest.SourceOf(src)}, compilers.Options{})
+	require.NoError(t, err)
+	require.NotNil(t, doc)
+	return doc, diags
+}
+
+// componentID is the stable TypeID of a components-named schema, or of a
+// sub-schema beneath one ("Holder/properties/inner"). It stays a test-file
+// copy for the reason openapitest's doc comment gives.
+func componentID(name string) ir.TypeID {
+	return ir.TypeID("t/openapi/components/schemas/" + name)
+}
+
+// typeByName returns the named component schema's lowered TypeDef.
+func typeByName(doc *ir.Document, name string) ir.TypeDef {
+	return doc.Types[componentID(name)]
+}
+
+// assertHasErrorCode requires diags to carry an error-severity diagnostic with
+// the given code.
+func assertHasErrorCode(t *testing.T, diags []ir.Diagnostic, code string) {
+	t.Helper()
+	openapitest.AssertHasCode(t, diags, code, ir.SeverityError)
+}
diff --git a/compilers/openapi/later_version_test.go b/compilers/openapi/e2e/later_version_test.go
similarity index 99%
rename from compilers/openapi/later_version_test.go
rename to compilers/openapi/e2e/later_version_test.go
index 107accff..e37058e8 100644
--- a/compilers/openapi/later_version_test.go
+++ b/compilers/openapi/e2e/later_version_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"encoding/json/v2"
diff --git a/compilers/openapi/load_test.go b/compilers/openapi/e2e/load_test.go
similarity index 94%
rename from compilers/openapi/load_test.go
rename to compilers/openapi/e2e/load_test.go
index b01055ab..96121dbb 100644
--- a/compilers/openapi/load_test.go
+++ b/compilers/openapi/e2e/load_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"encoding/json/jsontext"
@@ -16,6 +16,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/compilers/openapi"
 	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/compilers/openapi/internal/ids"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
@@ -34,7 +35,7 @@ const resolverPanicSpec = "openapi: 3.0\ncomponents:\n responses:\n  000: {$ref:
 // as a spec problem rather than reported as a Go error or crashing the process.
 func TestCompile_ResolverPanicIsADiagnostic(t *testing.T) {
 	t.Parallel()
-	doc, diags, err := New().Compile(t.Context(),
+	doc, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: "resolver-panic.yaml", Data: []byte(resolverPanicSpec)}},
 		compilers.Options{})
 	require.NoError(t, err, "a malformed spec is a spec problem, not a Go error")
@@ -89,9 +90,9 @@ func TestCompile_AResolutionFailureIsReportedOnceAtItsRef(t *testing.T) {
 		root := "openapi: 3.1.0\ninfo: {title: T, version: \"1\"}\npaths: {}\n" +
 			"components:\n  schemas:\n    S: {$ref: 'other.yaml#/components/schemas/X'}\n"
 
-		doc, diags, err := New().Compile(t.Context(),
+		doc, diags, err := openapi.New().Compile(t.Context(),
 			[]compilers.Source{{Path: rootPath, Data: []byte(root)}},
-			compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+			compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 		require.NoError(t, err)
 		require.NotNil(t, doc)
 
@@ -107,9 +108,9 @@ func TestCompile_AResolutionFailureIsReportedOnceAtItsRef(t *testing.T) {
 		root := "openapi: 3.1.0\ninfo: {title: T, version: \"1\"}\npaths: {}\n" +
 			"components:\n  schemas:\n    A: {$ref: 'root.yaml#/x-a'}\nx-a: {$ref: '#/components/schemas/A'}\n"
 
-		_, diags, err := New().Compile(t.Context(),
+		_, diags, err := openapi.New().Compile(t.Context(),
 			[]compilers.Source{{Path: filepath.Join(t.TempDir(), "root.yaml"), Data: []byte(root)}},
-			compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+			compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 		require.NoError(t, err)
 
 		var at []string
@@ -259,9 +260,9 @@ func TestCompile_AReferenceObjectToANonObjectIsReportedOnce(t *testing.T) {
 		root := openapitest.PathsSpec("  /x:\n    get:\n      parameters: [{$ref: 'mid.yaml#/P'}]\n" +
 			"      responses: {\"200\": {description: ok}}\n")
 
-		_, diags, err := New().Compile(t.Context(),
+		_, diags, err := openapi.New().Compile(t.Context(),
 			[]compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: []byte(root)}},
-			compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+			compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 		require.NoError(t, err)
 
 		want := []ir.Diagnostic{{Severity: ir.SeverityError, Code: diag.UnresolvedRef,
@@ -311,7 +312,7 @@ func TestCompile_AFindingInASchemaOnlyAnotherDocumentReachesIsPlacedThere(t *tes
 		"      parameters: [{$ref: './other.yaml#/components/parameters/P'}]\n" +
 		"      responses: {\"200\": {description: ok}}\n"
 
-	_, diags, err := New().Compile(t.Context(),
+	_, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: []byte(root)}},
 		compilers.Options{Reader: reader.Disk{}})
 	require.NoError(t, err)
@@ -340,9 +341,9 @@ func TestCompile_AFindingInAnExternalDocumentKeepsItsRule(t *testing.T) {
 	root := "openapi: 3.1.0\ninfo: {title: T, version: \"1\"}\n" +
 		"paths:\n  /x: {$ref: 'other.yaml#/paths/~1y'}\n"
 
-	doc, diags, err := New().Compile(t.Context(),
+	doc, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: rootPath, Data: []byte(root)}},
-		compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 	require.NoError(t, err)
 	require.NotNil(t, doc)
 
@@ -390,8 +391,8 @@ func TestCompile_OneFileUnderTwoNamesIsOneDocument(t *testing.T) {
 	t.Chdir(dir)
 	compileAt := func(path string) (*ir.Document, []ir.Diagnostic) {
 		t.Helper()
-		doc, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: path, Data: root}},
-			compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+		doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: path, Data: root}},
+			compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 		require.NoError(t, err)
 		require.NotNil(t, doc)
 		return doc, diags
@@ -440,7 +441,7 @@ func TestCompile_ByDefaultOnlyARelativeReferenceIsFollowed(t *testing.T) {
 	compileFrom := func(cwd, path string) (ir.TypeRegistry, []string) {
 		t.Helper()
 		t.Chdir(cwd)
-		doc, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: path, Data: root}},
+		doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: path, Data: root}},
 			compilers.Options{Reader: reader.Disk{}})
 		require.NoError(t, err)
 		require.NotNil(t, doc)
@@ -490,8 +491,8 @@ func TestCompile_AnUnusableDocumentIsReportedAlikeOnEitherRoute(t *testing.T) {
 				"components:\n  schemas:\n    S: {$ref: 'u.yaml#/B'}\n    T: {$ref: 'u.yaml'}\n")
 
 			for _, allow := range []bool{false, true} {
-				doc, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: root}},
-					compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: allow}})
+				doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: root}},
+					compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: allow}})
 				require.NoError(t, err)
 				require.NotNil(t, doc)
 
@@ -540,8 +541,8 @@ func TestCompile_AURLNoReaderReadsIsRefusedUnread(t *testing.T) {
 	} {
 		t.Chdir(run.cwd)
 		for _, allow := range []bool{false, true} {
-			doc, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: run.spec, Data: root}},
-				compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: allow}})
+			doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: run.spec, Data: root}},
+				compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: allow}})
 			require.NoError(t, err)
 			require.NotNil(t, doc)
 
@@ -573,8 +574,8 @@ func TestCompile_ARefAnIDAnswersIsNeverRefusedUnread(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "root.yaml")
 	component := func(name string) ir.TypeID { return ids.Document{}.ForPointer(ids.Ptr("components", "schemas", name)) }
 	for _, allow := range []bool{false, true} {
-		doc, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: path, Data: root}},
-			compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: allow}})
+		doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: path, Data: root}},
+			compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: allow}})
 		require.NoError(t, err)
 		require.NotNil(t, doc)
 
@@ -614,8 +615,8 @@ func TestCompile_ARelativeRefUnderAnIDReadsWhereTheIDPlacesIt(t *testing.T) {
 		"    Pet: {$id: 'schemas/pet.json', type: object, properties: {tag: {$ref: 'tag.json#/T'}}}\n" +
 		"    S: {$id: '" + srv.URL + "/x/s.json', type: object, properties: {b: {$ref: 'b.yaml#/B'}}}\n")
 	for _, allow := range []bool{false, true} {
-		doc, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: root}},
-			compilers.Options{Reader: reader.Disk{Client: srv.Client()}, FormatOptions: Options{AllowExternalRefs: allow}})
+		doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: root}},
+			compilers.Options{Reader: reader.Disk{Client: srv.Client()}, FormatOptions: openapi.Options{AllowExternalRefs: allow}})
 		require.NoError(t, err)
 		require.NotNil(t, doc)
 
@@ -671,7 +672,7 @@ func TestCompile_ByDefaultEachReferenceIsJudgedByItsOwnSpelling(t *testing.T) {
 	for _, order := range [][2]string{{"C", "D"}, {"D", "C"}} {
 		types := make([]ir.TypeRegistry, 0, 2)
 		for _, path := range []string{"root.yaml", self} {
-			doc, diags, err := New().Compile(t.Context(), []compilers.Source{{Path: path, Data: spec(order[0], order[1])}},
+			doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: path, Data: spec(order[0], order[1])}},
 				compilers.Options{Reader: reader.Disk{}})
 			require.NoError(t, err)
 			require.NotNil(t, doc)
diff --git a/compilers/openapi/lowering_spec_checks_test.go b/compilers/openapi/e2e/lowering_spec_checks_test.go
similarity index 98%
rename from compilers/openapi/lowering_spec_checks_test.go
rename to compilers/openapi/e2e/lowering_spec_checks_test.go
index c7c1e688..95637e3e 100644
--- a/compilers/openapi/lowering_spec_checks_test.go
+++ b/compilers/openapi/e2e/lowering_spec_checks_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"errors"
@@ -120,7 +120,7 @@ func TestSpecChecks_ReportEachPlantedDefect(t *testing.T) {
 		{"a test named without its package", replace("`load.TestB`", "`TestB`"), "is not package.TestName"},
 		{"a test named with a subtest", replace("`load.TestB`", "`load.TestB/sub`"), "is not package.TestName"},
 		{"a test the package lacks", func(_ *testing.T, _ *string, env *specEnv) { delete(env.funcs["load"], "TestB") },
-			`names "load.TestB", which internal/load does not declare`},
+			`names "load.TestB", which compilers/openapi/internal/load does not declare`},
 		{"a package with no tests", func(_ *testing.T, _ *string, env *specEnv) { delete(env.funcs, "load") },
 			`names "load.TestB": holds no test file`},
 		{"a citation naming no rule", func(_ *testing.T, _ *string, env *specEnv) {
diff --git a/compilers/openapi/lowering_spec_test.go b/compilers/openapi/e2e/lowering_spec_test.go
similarity index 94%
rename from compilers/openapi/lowering_spec_test.go
rename to compilers/openapi/e2e/lowering_spec_test.go
index 692d44ad..3b36a2be 100644
--- a/compilers/openapi/lowering_spec_test.go
+++ b/compilers/openapi/e2e/lowering_spec_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it reads
 // docs/compilers/openapi.md, the compiler's specification, and holds each rule
 // to the evidence it names and each citation of a rule to a rule.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"fmt"
@@ -25,7 +25,7 @@ import (
 )
 
 // specRoot is the repository root, from this package's directory.
-const specRoot = "../.."
+const specRoot = "../../.."
 
 // specDoc is the specification, relative to specRoot.
 const specDoc = "docs/compilers/openapi.md"
@@ -285,8 +285,8 @@ func declaredDiagCodes(t *testing.T) map[string]bool {
 
 // TestLoweringSpec_TestsAreDeclared requires each test a rule names, as
 // package.TestName, to be a test function the test files of that package
-// declare: openapi for the compiler itself, or a package under its internal
-// directory.
+// declare: openapi for the compiler itself, e2e for this package, or a package
+// under the compiler's internal directory.
 func TestLoweringSpec_TestsAreDeclared(t *testing.T) {
 	t.Parallel()
 	report(t, testProblems(readSpec(t), testFuncs))
@@ -315,20 +315,25 @@ func testProblems(rules []rule, funcsOf func(pkg string) (map[string]bool, error
 			}
 			if declared[pkg] != nil && !declared[pkg][fn] {
 				problems = append(problems, fmt.Sprintf("line %d: %s names %q, which %s does not declare",
-					r.line, r.key, name, testDir(pkg)))
+					r.line, r.key, name, packageDir(pkg)))
 			}
 		}
 	}
 	return problems
 }
 
-// testDir returns the directory of the package a test name's prefix stands
-// for, relative to this package.
-func testDir(pkg string) string {
-	if pkg == "openapi" {
-		return "."
+// packageDir returns the directory, from the repository root, of the package
+// a test name's prefix stands for: the compiler itself, this package, or one
+// under the compiler's internal directory.
+func packageDir(pkg string) string {
+	switch pkg {
+	case "openapi":
+		return "compilers/openapi"
+	case "e2e":
+		return "compilers/openapi/e2e"
+	default:
+		return "compilers/openapi/internal/" + pkg
 	}
-	return filepath.Join("internal", pkg)
 }
 
 // testFuncs returns the name of every test function the test files of pkg
@@ -337,9 +342,9 @@ func testDir(pkg string) string {
 // test files: a test function is a top-level declaration, so a parse sees it
 // exactly as the compiler does.
 func testFuncs(pkg string) (map[string]bool, error) {
-	paths, err := filepath.Glob(filepath.Join(testDir(pkg), "*_test.go"))
+	paths, err := filepath.Glob(filepath.Join(specRoot, packageDir(pkg), "*_test.go"))
 	if err != nil || len(paths) == 0 {
-		return nil, fmt.Errorf("%s holds no test file", testDir(pkg))
+		return nil, fmt.Errorf("%s holds no test file", packageDir(pkg))
 	}
 	out := map[string]bool{}
 	fset := token.NewFileSet()
diff --git a/compilers/openapi/main_test.go b/compilers/openapi/e2e/main_test.go
similarity index 96%
rename from compilers/openapi/main_test.go
rename to compilers/openapi/e2e/main_test.go
index 4f373fd2..025db244 100644
--- a/compilers/openapi/main_test.go
+++ b/compilers/openapi/e2e/main_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"testing"
diff --git a/compilers/openapi/mapping_lowered_test.go b/compilers/openapi/e2e/mapping_lowered_test.go
similarity index 99%
rename from compilers/openapi/mapping_lowered_test.go
rename to compilers/openapi/e2e/mapping_lowered_test.go
index d4afe28c..5cfdd438 100644
--- a/compilers/openapi/mapping_lowered_test.go
+++ b/compilers/openapi/e2e/mapping_lowered_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it holds the
 // load phase's resolution of mapping targets to what the lowering reads, so it
 // has no single source file to pair with.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"os"
diff --git a/compilers/openapi/mapping_spellings_test.go b/compilers/openapi/e2e/mapping_spellings_test.go
similarity index 98%
rename from compilers/openapi/mapping_spellings_test.go
rename to compilers/openapi/e2e/mapping_spellings_test.go
index b6f6cc69..adb104c8 100644
--- a/compilers/openapi/mapping_spellings_test.go
+++ b/compilers/openapi/e2e/mapping_spellings_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it crosses
 // every spelling of a discriminator mapping target with every kind of position
 // it can name, so it has no single source file to pair with.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"fmt"
diff --git a/compilers/openapi/namespaces_test.go b/compilers/openapi/e2e/namespaces_test.go
similarity index 96%
rename from compilers/openapi/namespaces_test.go
rename to compilers/openapi/e2e/namespaces_test.go
index 9749e5c2..0e4a366f 100644
--- a/compilers/openapi/namespaces_test.go
+++ b/compilers/openapi/e2e/namespaces_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"os"
@@ -26,7 +26,7 @@ import (
 // listing them would otherwise look unused.
 func TestNamespaces_DeclaredAreExactlyWhatTheCorpusUses(t *testing.T) {
 	t.Parallel()
-	specs, err := filepath.Glob("../../testdata/*/openapi/*.yaml")
+	specs, err := filepath.Glob("../../../testdata/*/openapi/*.yaml")
 	require.NoError(t, err)
 	require.NotEmpty(t, specs, "the corpus must exist, or this test holds nothing to anything")
 
diff --git a/compilers/openapi/nesting_test.go b/compilers/openapi/e2e/nesting_test.go
similarity index 98%
rename from compilers/openapi/nesting_test.go
rename to compilers/openapi/e2e/nesting_test.go
index ab447db7..9b25958b 100644
--- a/compilers/openapi/nesting_test.go
+++ b/compilers/openapi/e2e/nesting_test.go
@@ -1,4 +1,4 @@
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"fmt"
diff --git a/compilers/openapi/null_schema_test.go b/compilers/openapi/e2e/null_schema_test.go
similarity index 99%
rename from compilers/openapi/null_schema_test.go
rename to compilers/openapi/e2e/null_schema_test.go
index a93cc1ea..53ab5317 100644
--- a/compilers/openapi/null_schema_test.go
+++ b/compilers/openapi/e2e/null_schema_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"encoding/json/jsontext"
diff --git a/compilers/openapi/nullable_widening_test.go b/compilers/openapi/e2e/nullable_widening_test.go
similarity index 99%
rename from compilers/openapi/nullable_widening_test.go
rename to compilers/openapi/e2e/nullable_widening_test.go
index bbbf9680..cbb218b4 100644
--- a/compilers/openapi/nullable_widening_test.go
+++ b/compilers/openapi/e2e/nullable_widening_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"encoding/json/jsontext"
diff --git a/compilers/openapi/overlay_test.go b/compilers/openapi/e2e/overlay_test.go
similarity index 99%
rename from compilers/openapi/overlay_test.go
rename to compilers/openapi/e2e/overlay_test.go
index 44c8ebfd..9eb5f956 100644
--- a/compilers/openapi/overlay_test.go
+++ b/compilers/openapi/e2e/overlay_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"encoding/json/jsontext"
diff --git a/compilers/openapi/ownership_test.go b/compilers/openapi/e2e/ownership_test.go
similarity index 99%
rename from compilers/openapi/ownership_test.go
rename to compilers/openapi/e2e/ownership_test.go
index 96f5a14e..eb15dd30 100644
--- a/compilers/openapi/ownership_test.go
+++ b/compilers/openapi/e2e/ownership_test.go
@@ -2,7 +2,7 @@
 // rule that a coordinate is built by the lowering that owns it whichever path
 // reaches it first (docs/micro-compiler-design.md §6.2) to every shape that
 // broke it, so it has no single source file to pair with.
-package openapi_test
+package e2e_test
 
 import (
 	"fmt"
diff --git a/compilers/openapi/plus_refs_test.go b/compilers/openapi/e2e/plus_refs_test.go
similarity index 97%
rename from compilers/openapi/plus_refs_test.go
rename to compilers/openapi/e2e/plus_refs_test.go
index 2374dd45..4a1adc59 100644
--- a/compilers/openapi/plus_refs_test.go
+++ b/compilers/openapi/e2e/plus_refs_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"cmp"
@@ -13,6 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/compilers/openapi"
 	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/compilers/openapi/internal/ids"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
@@ -337,9 +338,9 @@ components:
 		require.NoError(t, os.WriteFile(filepath.Join(dir, "ext.yaml"), []byte(ext), 0o600))
 		root := "openapi: 3.1.0\ninfo: {title: T, version: \"1\"}\npaths:\n" + paths + tail
 
-		doc, diags, err := New().Compile(t.Context(),
+		doc, diags, err := openapi.New().Compile(t.Context(),
 			[]compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: []byte(root)}},
-			compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+			compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 
 		require.NoError(t, err)
 		require.NotNil(t, doc)
@@ -388,9 +389,9 @@ paths:
   /m: {$ref: '#/paths/~1a+b/x-n'}
 `
 
-	doc, diags, err := New().Compile(t.Context(),
+	doc, diags, err := openapi.New().Compile(t.Context(),
 		[]compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: []byte(root)}},
-		compilers.Options{Reader: reader.Disk{}, FormatOptions: Options{AllowExternalRefs: true}})
+		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
 
 	require.NoError(t, err)
 	require.NotNil(t, doc)
diff --git a/compilers/openapi/e2e/pointer_tokens_test.go b/compilers/openapi/e2e/pointer_tokens_test.go
new file mode 100644
index 00000000..57e36021
--- /dev/null
+++ b/compilers/openapi/e2e/pointer_tokens_test.go
@@ -0,0 +1,69 @@
+package e2e_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+// TestCompile_APointerTokenPastUFFFFIsRefusedUpstream pins GitHub #516. The
+// library caps its reference-token character class at U+FFFF
+// (jsonpointer/navigation.go, tokenRegex), though RFC 6901 admits up to
+// U+10FFFF, so a reference object through an emoji key is refused and one
+// through a Basic Multilingual Plane key resolves. A schema $ref, which the
+// compiler binds itself, resolves through either, in either declaration order.
+//
+// The twins differ only in that key. A refused path item mount is lost. When
+// the astral twin mounts like the other, the library is fixed: assert that and
+// close #516.
+func TestCompile_APointerTokenPastUFFFFIsRefusedUpstream(t *testing.T) {
+	t.Parallel()
+	twin := func(key string) string {
+		return `openapi: 3.1.0
+info: {title: t, version: "1"}
+paths:
+  "/` + key + `":
+    get: {operationId: getKey, responses: {"200": {description: ok}}}
+  /mount: {$ref: '#/paths/~1` + key + `'}
+components:
+  schemas:
+    Early: {$ref: '#/components/schemas/Later/properties/` + key + `'}
+    Later: {type: object, properties: {"` + key + `": {type: object}}}
+    Holder: {type: object, properties: {"` + key + `": {type: object}}}
+    Uses: {$ref: '#/components/schemas/Holder/properties/` + key + `'}
+`
+	}
+	property := func(owner, key string) ir.TypeID {
+		return ir.TypeID("t/anon/components/schemas/" + owner + "/properties/" + key)
+	}
+
+	basic, basicDiags := parseFull(t, twin("é"))
+	openapitest.RequireNoErrorDiags(t, basicDiags)
+	assert.Len(t, operationsNamed(basic, "getKey"), 2,
+		"a key inside the Basic Multilingual Plane resolves: the item is mounted at both paths")
+	assertAliases(t, basic, "Uses", property("Holder", "é"), "a resolved reference aliases its target")
+	assertAliases(t, basic, "Early", property("Later", "é"), "in either declaration order")
+
+	astral, astralDiags := parseFull(t, twin("😀"))
+	assert.True(t, openapitest.HasDiagCodeAt(astralDiags, diag.UnresolvedRef, "/paths/~1mount"),
+		"the resolver still refuses a token past U+FFFF; if it no longer does, see this test's comment")
+	assert.Len(t, operationsNamed(astral, "getKey"), 1,
+		"the refused reference mounts nothing, which is what the fix will change")
+	assertAliases(t, astral, "Uses", property("Holder", "😀"), "a schema $ref resolves past U+FFFF")
+	assertAliases(t, astral, "Early", property("Later", "😀"), "in either declaration order")
+}
+
+// assertAliases asserts the component schema name lowered to an alias over
+// target: what the position's $ref came to stand for.
+func assertAliases(t *testing.T, doc *ir.Document, name string, target ir.TypeID, msg string) {
+	t.Helper()
+	alias, ok := doc.Types[componentID(name)].(*ir.Scalar)
+	require.True(t, ok, "%s lowers to an alias over what its $ref names", name)
+	require.NotNil(t, alias.Base, "the alias names what it stands for")
+	assert.Equal(t, target, alias.Base.Target, msg)
+}
diff --git a/compilers/openapi/promotion_carriers_test.go b/compilers/openapi/e2e/promotion_carriers_test.go
similarity index 98%
rename from compilers/openapi/promotion_carriers_test.go
rename to compilers/openapi/e2e/promotion_carriers_test.go
index 778e358f..2ac12d48 100644
--- a/compilers/openapi/promotion_carriers_test.go
+++ b/compilers/openapi/e2e/promotion_carriers_test.go
@@ -3,7 +3,7 @@
 // hand-written: a carrier the IR gains, and the compiler starts building without
 // a PromoteDeprecation call, would be covered by no row and reddens nothing —
 // the exact shape of the defect Parameter had before GitHub #423.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"go/types"
diff --git a/compilers/openapi/promotion_test.go b/compilers/openapi/e2e/promotion_test.go
similarity index 99%
rename from compilers/openapi/promotion_test.go
rename to compilers/openapi/e2e/promotion_test.go
index 50f93184..e60f1685 100644
--- a/compilers/openapi/promotion_test.go
+++ b/compilers/openapi/e2e/promotion_test.go
@@ -2,7 +2,7 @@
 // field it is the only OpenAPI spelling for. It belongs to no single source
 // file — the policy is on the compiler's options, the reading is one function
 // beneath both walks, and it is applied at every carrier that can record it.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"testing"
diff --git a/compilers/openapi/purity_test.go b/compilers/openapi/e2e/purity_test.go
similarity index 99%
rename from compilers/openapi/purity_test.go
rename to compilers/openapi/e2e/purity_test.go
index 3c67bc8f..3adc911f 100644
--- a/compilers/openapi/purity_test.go
+++ b/compilers/openapi/e2e/purity_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"net/http"
diff --git a/compilers/openapi/reference_ends_test.go b/compilers/openapi/e2e/reference_ends_test.go
similarity index 99%
rename from compilers/openapi/reference_ends_test.go
rename to compilers/openapi/e2e/reference_ends_test.go
index bfd124ca..9f72790a 100644
--- a/compilers/openapi/reference_ends_test.go
+++ b/compilers/openapi/e2e/reference_ends_test.go
@@ -1,6 +1,6 @@
 // This file pins how the binder reads what a reference object resolved to:
 // at the node the parser's chain reached, in the source or another document.
-package openapi_test
+package e2e_test
 
 import (
 	"encoding/json/jsontext"
diff --git a/compilers/openapi/refusal_order_test.go b/compilers/openapi/e2e/refusal_order_test.go
similarity index 99%
rename from compilers/openapi/refusal_order_test.go
rename to compilers/openapi/e2e/refusal_order_test.go
index 8bec5427..92172b04 100644
--- a/compilers/openapi/refusal_order_test.go
+++ b/compilers/openapi/e2e/refusal_order_test.go
@@ -1,4 +1,4 @@
-package openapi_test
+package e2e_test
 
 import (
 	"fmt"
diff --git a/compilers/openapi/reuse_corpus_test.go b/compilers/openapi/e2e/reuse_corpus_test.go
similarity index 96%
rename from compilers/openapi/reuse_corpus_test.go
rename to compilers/openapi/e2e/reuse_corpus_test.go
index 0c3fb3c6..540769f7 100644
--- a/compilers/openapi/reuse_corpus_test.go
+++ b/compilers/openapi/e2e/reuse_corpus_test.go
@@ -1,7 +1,7 @@
 // This file is a package-level suite, not a per-source-file test: it sweeps the
 // whole committed corpus through the compiler twice and compares the results,
 // so it has no single source file to pair with.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"encoding/json/v2"
@@ -77,7 +77,7 @@ func encodeDoc(t *testing.T, doc any) string {
 }
 
 // corpusRoot is every committed spec directory, addressed relative to this file.
-const corpusRoot = "../../testdata"
+const corpusRoot = "../../../testdata"
 
 // corpusSpecs lists every committed spec under testdata, as harness.SpecFiles
 // lists a directory.
diff --git a/compilers/openapi/streaming_test.go b/compilers/openapi/e2e/streaming_test.go
similarity index 98%
rename from compilers/openapi/streaming_test.go
rename to compilers/openapi/e2e/streaming_test.go
index cf630736..10c88247 100644
--- a/compilers/openapi/streaming_test.go
+++ b/compilers/openapi/e2e/streaming_test.go
@@ -2,7 +2,7 @@
 // option surface that switches it, which no single source file owns: the policy
 // lives on the compiler's options, the media types are read where content is
 // lowered, and the result is written onto the operation core.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"testing"
diff --git a/compilers/openapi/testdata/fuzz/FuzzCycleDetector/7d5c7e6c57176224 b/compilers/openapi/e2e/testdata/fuzz/FuzzCycleDetector/7d5c7e6c57176224
similarity index 100%
rename from compilers/openapi/testdata/fuzz/FuzzCycleDetector/7d5c7e6c57176224
rename to compilers/openapi/e2e/testdata/fuzz/FuzzCycleDetector/7d5c7e6c57176224
diff --git a/compilers/openapi/testdata/fuzz/FuzzCycleDetector/a897d2fc8d321096 b/compilers/openapi/e2e/testdata/fuzz/FuzzCycleDetector/a897d2fc8d321096
similarity index 100%
rename from compilers/openapi/testdata/fuzz/FuzzCycleDetector/a897d2fc8d321096
rename to compilers/openapi/e2e/testdata/fuzz/FuzzCycleDetector/a897d2fc8d321096
diff --git a/compilers/openapi/unknownkeys_test.go b/compilers/openapi/e2e/unknownkeys_test.go
similarity index 99%
rename from compilers/openapi/unknownkeys_test.go
rename to compilers/openapi/e2e/unknownkeys_test.go
index 40e71eb1..6f0bac62 100644
--- a/compilers/openapi/unknownkeys_test.go
+++ b/compilers/openapi/e2e/unknownkeys_test.go
@@ -2,7 +2,7 @@
 // reaches the IR rather than vanishing between the parser and the lowering. It
 // is separate from annotations_test.go because the subject is the complement of
 // what the model names, not any one annotation.
-package openapi_test // external test package — exercises only the public API
+package e2e_test // external test package — exercises only the public API
 
 import (
 	"encoding/json/jsontext"
@@ -23,7 +23,7 @@ import (
 // round-tripped and verified, none of which a spec written inline reaches.
 func specFile(t *testing.T, name string) string {
 	t.Helper()
-	data, err := os.ReadFile(filepath.Join("..", "..", "testdata", "openapi", name))
+	data, err := os.ReadFile(filepath.Join("..", "..", "..", "testdata", "openapi", name))
 	require.NoError(t, err)
 	return string(data)
 }
diff --git a/compilers/openapi/openapi_test.go b/compilers/openapi/openapi_test.go
index 8ff78a92..051d098d 100644
--- a/compilers/openapi/openapi_test.go
+++ b/compilers/openapi/openapi_test.go
@@ -18,11 +18,14 @@ import (
 	"github.com/dexpace/morphic/ir"
 )
 
-// parsePetstore compiles the shared golden petstore spec (goldenPetstore, in
-// fuzz_test.go) through the public pipeline. Reading the on-disk spec rather
-// than a hand-copied literal keeps this test coupled to the same document the
-// golden snapshot is compared against, so an edit to the fixture cannot leave
-// this test asserting against a stale copy.
+// goldenPetstore is the golden petstore spec, addressed relative to this
+// package.
+const goldenPetstore = "../../testdata/golden/openapi/petstore.yaml"
+
+// parsePetstore compiles the golden petstore spec through the public pipeline.
+// Reading the on-disk spec rather than a hand-copied literal keeps this test
+// coupled to the same document the golden snapshot is compared against, so an
+// edit to the fixture cannot leave this test asserting against a stale copy.
 func parsePetstore(t *testing.T) (*ir.Document, []ir.Diagnostic) {
 	t.Helper()
 	data, err := os.ReadFile(goldenPetstore)
diff --git a/compilers/openapi/options_test.go b/compilers/openapi/options_test.go
index 76fe1a19..803e9ecb 100644
--- a/compilers/openapi/options_test.go
+++ b/compilers/openapi/options_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/compilers/openapi/internal/lowering"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
 )
 
@@ -201,3 +202,18 @@ func TestDecodeOptions_FeedsCompile(t *testing.T) {
 	assert.Equal(t, "a", doc.Services[0].Groups[0].Name.Source,
 		"the decoded option must reach the lowering, not merely parse")
 }
+
+// TestDefaultStreamingMediaTypes_IsWhatTheLoweringApplies pins the exported
+// list to the one a compile classifies by when Options names none, so a caller
+// extending it starts from what a compile really uses.
+func TestDefaultStreamingMediaTypes_IsWhatTheLoweringApplies(t *testing.T) {
+	t.Parallel()
+	assert.Equal(t, lowering.DefaultStreamingMediaTypes(), DefaultStreamingMediaTypes())
+}
+
+// TestDefaultExtensionPromotions_IsWhatTheLoweringApplies pins the exported
+// mapping to the one a compile promotes by when Options names none.
+func TestDefaultExtensionPromotions_IsWhatTheLoweringApplies(t *testing.T) {
+	t.Parallel()
+	assert.Equal(t, lowering.DefaultExtensionPromotions(), DefaultExtensionPromotions())
+}
diff --git a/compilers/openapi/resolve_internal_test.go b/compilers/openapi/resolve_internal_test.go
index 76c84e06..c3f5cf3e 100644
--- a/compilers/openapi/resolve_internal_test.go
+++ b/compilers/openapi/resolve_internal_test.go
@@ -9,7 +9,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexpace/morphic/compilers/openapi/internal/annotation"
-	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
 	"github.com/dexpace/morphic/compilers/openapi/internal/schema"
 	"github.com/dexpace/morphic/ir"
@@ -264,60 +263,3 @@ func TestLowerComponentSchemas_PercentEncodedDiscriminatorMapping(t *testing.T)
 	assert.Equal(t, map[string]ir.TypeID{"cat": componentID("Cat-A")}, pet.Discriminator.Mapping,
 		"the encoded mapping target names the declared component, and the entry is kept")
 }
-
-// TestCompile_APointerTokenPastUFFFFIsRefusedUpstream pins GitHub #516. The
-// library caps its reference-token character class at U+FFFF
-// (jsonpointer/navigation.go, tokenRegex), though RFC 6901 admits up to
-// U+10FFFF, so a reference object through an emoji key is refused and one
-// through a Basic Multilingual Plane key resolves. A schema $ref, which the
-// compiler binds itself, resolves through either, in either declaration order.
-//
-// The twins differ only in that key. A refused path item mount is lost. When
-// the astral twin mounts like the other, the library is fixed: assert that and
-// close #516.
-func TestCompile_APointerTokenPastUFFFFIsRefusedUpstream(t *testing.T) {
-	t.Parallel()
-	twin := func(key string) string {
-		return `openapi: 3.1.0
-info: {title: t, version: "1"}
-paths:
-  "/` + key + `":
-    get: {operationId: getKey, responses: {"200": {description: ok}}}
-  /mount: {$ref: '#/paths/~1` + key + `'}
-components:
-  schemas:
-    Early: {$ref: '#/components/schemas/Later/properties/` + key + `'}
-    Later: {type: object, properties: {"` + key + `": {type: object}}}
-    Holder: {type: object, properties: {"` + key + `": {type: object}}}
-    Uses: {$ref: '#/components/schemas/Holder/properties/` + key + `'}
-`
-	}
-	property := func(owner, key string) ir.TypeID {
-		return ir.TypeID("t/anon/components/schemas/" + owner + "/properties/" + key)
-	}
-
-	basic, basicDiags := parseFull(t, twin("é"))
-	openapitest.RequireNoErrorDiags(t, basicDiags)
-	assert.Len(t, operationsNamed(basic, "getKey"), 2,
-		"a key inside the Basic Multilingual Plane resolves: the item is mounted at both paths")
-	assertAliases(t, basic, "Uses", property("Holder", "é"), "a resolved reference aliases its target")
-	assertAliases(t, basic, "Early", property("Later", "é"), "in either declaration order")
-
-	astral, astralDiags := parseFull(t, twin("😀"))
-	assert.True(t, openapitest.HasDiagCodeAt(astralDiags, diag.UnresolvedRef, "/paths/~1mount"),
-		"the resolver still refuses a token past U+FFFF; if it no longer does, see this test's comment")
-	assert.Len(t, operationsNamed(astral, "getKey"), 1,
-		"the refused reference mounts nothing, which is what the fix will change")
-	assertAliases(t, astral, "Uses", property("Holder", "😀"), "a schema $ref resolves past U+FFFF")
-	assertAliases(t, astral, "Early", property("Later", "😀"), "in either declaration order")
-}
-
-// assertAliases asserts the component schema name lowered to an alias over
-// target: what the position's $ref came to stand for.
-func assertAliases(t *testing.T, doc *ir.Document, name string, target ir.TypeID, msg string) {
-	t.Helper()
-	alias, ok := doc.Types[componentID(name)].(*ir.Scalar)
-	require.True(t, ok, "%s lowers to an alias over what its $ref names", name)
-	require.NotNil(t, alias.Base, "the alias names what it stands for")
-	assert.Equal(t, target, alias.Base.Target, msg)
-}
diff --git a/compilers/openapi/sourcetable_test.go b/compilers/openapi/sourcetable_test.go
index 806f8755..e252d653 100644
--- a/compilers/openapi/sourcetable_test.go
+++ b/compilers/openapi/sourcetable_test.go
@@ -10,13 +10,28 @@ import (
 	"github.com/dexpace/morphic/compilers"
 	"github.com/dexpace/morphic/compilers/openapi"
 	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
 	"github.com/dexpace/morphic/engine/reader"
 	"github.com/dexpace/morphic/ir"
 )
 
-// sourceTableSources is the source compileWith compiles, so a case handing it
-// to SourceTable asks about the compile compileWith actually ran.
-var sourceTableSources = []compilers.Source{{Path: "spec.yaml", Data: []byte(overlaySpec)}}
+// sourceTableSpec is the document the cases compile: one component schema,
+// Pet, whose properties the overlays target, written last so a case can append
+// a schema of its own.
+var sourceTableSpec = openapitest.ComponentSpec("    Pet:\n      type: object\n      properties:\n        name: {type: string}\n")
+
+// tagOverlay adds a property to Pet, so a compile under it applies an action.
+const tagOverlay = "overlay: 1.0.0\ninfo: {title: Patch, version: \"1\"}\n" +
+	"actions:\n  - target: $.components.schemas.Pet.properties\n    update:\n      tag: {type: string}\n"
+
+// missOverlay targets a path the document does not declare, which only a lax
+// overlay lets pass.
+const missOverlay = "overlay: 1.0.0\ninfo: {title: Patch, version: \"1\"}\n" +
+	"actions:\n  - target: $.paths['/nope']\n    update: {description: x}\n"
+
+// sourceTableSources is sourceTableSpec as the one source a case hands to both
+// Compile and SourceTable.
+var sourceTableSources = []compilers.Source{{Path: "spec.yaml", Data: []byte(sourceTableSpec)}}
 
 // TestCompiler_SourceTableBeginsDocumentSourcesOnSuccess pins the contract
 // half that matters most for a caller reading a successful compile:
@@ -26,7 +41,7 @@ var sourceTableSources = []compilers.Source{{Path: "spec.yaml", Data: []byte(ove
 // come only the documents the compile read, here one a reference names.
 func TestCompiler_SourceTableBeginsDocumentSourcesOnSuccess(t *testing.T) {
 	t.Parallel()
-	const split = overlaySpec + "    Thing: {$ref: 'other.yaml#/Thing'}\n"
+	split := sourceTableSpec + "    Thing: {$ref: 'other.yaml#/Thing'}\n"
 	other := compilers.Source{Path: "other.yaml", Data: []byte("Thing: {type: string}\n")}
 	tests := []struct {
 		name string
@@ -34,16 +49,16 @@ func TestCompiler_SourceTableBeginsDocumentSourcesOnSuccess(t *testing.T) {
 		opts openapi.Options
 		read []string
 	}{
-		{"no overlay", overlaySpec, openapi.Options{}, nil},
-		{"an overlay that applies", overlaySpec, openapi.Options{
-			Overlay: &openapi.Overlay{Path: "patch.yaml", Data: []byte(addTagProperty)},
+		{"no overlay", sourceTableSpec, openapi.Options{}, nil},
+		{"an overlay that applies", sourceTableSpec, openapi.Options{
+			Overlay: &openapi.Overlay{Path: "patch.yaml", Data: []byte(tagOverlay)},
 		}, nil},
-		{"a lax overlay that matches nothing", overlaySpec, openapi.Options{
-			Overlay: &openapi.Overlay{Path: "patch.yaml", Data: []byte(noMatch), Lax: true},
+		{"a lax overlay that matches nothing", sourceTableSpec, openapi.Options{
+			Overlay: &openapi.Overlay{Path: "patch.yaml", Data: []byte(missOverlay), Lax: true},
 		}, nil},
 		{"a reference into another document", split, openapi.Options{}, []string{"other.yaml"}},
 		{"an overlay and a reference", split, openapi.Options{
-			Overlay: &openapi.Overlay{Path: "patch.yaml", Data: []byte(addTagProperty)},
+			Overlay: &openapi.Overlay{Path: "patch.yaml", Data: []byte(tagOverlay)},
 		}, []string{"other.yaml"}},
 	}
 	for _, tt := range tests {
diff --git a/docs/compilers/openapi.md b/docs/compilers/openapi.md
index 384bb834..03d06ef4 100644
--- a/docs/compilers/openapi.md
+++ b/docs/compilers/openapi.md
@@ -17,7 +17,7 @@ evidence that pins it, one bullet per field:
 - **Codes** — every diagnostic code it reports. Each is written in the text, where the text says
   when it fires.
 - **Tests** — Go tests that pin what no case reaches, as `package.TestName`: `openapi` for the
-  compiler's own package, an internal package's name otherwise.
+  compiler's own package, `e2e` for its end-to-end tests, an internal package's name otherwise.
 - **Status** — what the rule leaves open: where the compiler does not yet do all the rule says, or a
   question the rule does not settle, each naming the issue that tracks it, or the milestone that
   schedules work not yet begun. An issue is named here and nowhere in a rule's text.
@@ -26,9 +26,9 @@ The fields are the only bullets a rule writes at the margin, since each is read
 rule's text is numbered.
 
 A rule names a case or a test, or says in its Status what it leaves open. The `TestLoweringSpec`
-tests in `compilers/openapi` hold every field to the code and read it both ways: each conformance
-case is named by a rule, and each code by a rule or by `codesOutsideTheRules`, which gives the
-reason a code has no rule. [`CONTRIBUTING.md`](../../CONTRIBUTING.md) walks adding a rule.
+tests in `compilers/openapi/e2e` hold every field to the code and read it both ways: each
+conformance case is named by a rule, and each code by a rule or by `codesOutsideTheRules`, which
+gives the reason a code has no rule. [`CONTRIBUTING.md`](../../CONTRIBUTING.md) walks adding a rule.
 
 ## 1. Reading a document
 
@@ -137,10 +137,10 @@ the overlay is applied and every position names the source, as with no overlay,
 - Codes: `openapi/invalid-overlay`, `openapi/overlay-failed`, `openapi/overlay-action`,
   `openapi/overlay-origin-incomplete`
 - Tests: `overlay.TestApply_RejectsAnOverlayItCannotRead`,
-  `openapi.TestCompile_StrictRefusesAnActionThatMatchesNothing`,
+  `e2e.TestCompile_StrictRefusesAnActionThatMatchesNothing`,
   `overlay.TestApply_StrictReportsAnActionThatChangesNothingWithoutRefusing`,
   `overlay.TestApplyWithin_DegradesToTheSourceAtTheNodeBudget`,
-  `openapi.TestCompile_OverlayIsRecordedAsASource`
+  `e2e.TestCompile_OverlayIsRecordedAsASource`
 - Status: partly built: an Overlay 1.0.0 document's RFC 9535 filter selector fails to apply (#651).
   Open: whether lax application should report an action that matches nothing (#652), how an update
   merges a nested array (#653), and whether an overlay that replaces a value the source declares is
@@ -218,7 +218,7 @@ gives it no effect is [`allow-reserved-locations`](#allow-reserved-locations)' a
   `load.TestResolve_AnObjectReachedTwiceIsReportedOnce`,
   `load.TestResolve_AFileSpelledTwoWaysPlacesAFindingOnce`,
   `load.TestResolve_AReachedFindingNamesThePositionThatReadIt`,
-  `openapi.TestCompile_AFindingInAnExternalDocumentKeepsItsRule`,
+  `e2e.TestCompile_AFindingInAnExternalDocumentKeepsItsRule`,
   `canary.TestValidationOracle_AgreesWithTheLibrary`
 - Status: partly built: a document a reference reaches is held to the source's minor until which
   minor governs it is settled (#839), and a `null` for a Schema Object's keyword whose value is no
@@ -292,8 +292,8 @@ judges a Parameter Object's `allowReserved` against where the declared minor app
 
 - Cases: `later-version-constructs`, `reached-outside-model`, `schema-ref-siblings-30`
 - Codes: `openapi/later-version-construct`
-- Tests: `openapi.TestLaterVersionConstructs_LowerAsInTheVersionThatAddedThem`,
-  `openapi.TestSchemaRefSiblings_LowerAsIn31`,
+- Tests: `e2e.TestLaterVersionConstructs_LowerAsInTheVersionThatAddedThem`,
+  `e2e.TestSchemaRefSiblings_LowerAsIn31`,
   `oas.TestCheck_LaterConstructsAreWarnedOfInTheCompilersWords`,
   `oas.TestCheck_EveryKeyBesideA30SchemaRefIsALaterConstruct`,
   `oas.TestCheck_ValuesAddedLaterAreWarnedOf`,
@@ -410,49 +410,49 @@ references that closes on itself is [`reference-cycles`](#reference-cycles)'.
 
 - Cases: `schema-identifiers`
 - Codes: `openapi/unresolved-ref`, `openapi/budget-exceeded`, `openapi/degraded-construct`
-- Tests: `openapi.TestCompile_ExternalFileRefIsNotReadByDefault`,
-  `openapi.TestGolden_SplitSpec`, `openapi.TestExternalContent_ARefInItNamesItsOwnDocument`,
-  `openapi.TestCompile_AResolutionFailureIsReportedOnceAtItsRef`,
+- Tests: `e2e.TestCompile_ExternalFileRefIsNotReadByDefault`,
+  `e2e.TestGolden_SplitSpec`, `e2e.TestExternalContent_ARefInItNamesItsOwnDocument`,
+  `e2e.TestCompile_AResolutionFailureIsReportedOnceAtItsRef`,
   `schema.TestMapping_InAnotherDocumentIsReportedWhereItIsWritten`,
   `lowering.TestInDocument_PlacesWhatAnotherDocumentDeclares`,
   `lowering.TestDeclared_LowersAReferencedObjectWhereItIsDeclared`,
   `lowering.TestDeclared_ReadsTheEndOfTheDocumentWritingTheReference`,
   `bind.TestBind_PassesAReferenceObjectOfAnotherDocument`,
-  `openapi.TestCompile_ASiblingRefResolvesWithinTheSourcesDirectory`,
-  `openapi.TestCompile_ARefOutsideTheSourcesDirectoryIsRefused`,
-  `openapi.TestCompile_ASymlinkOutOfTheSourcesDirectoryIsRefused`,
-  `openapi.TestCompile_ARefOutsideTheSourcesDirectoryResolvesWhenAllowed`,
-  `openapi.TestCompile_ByDefaultOnlyARelativeReferenceIsFollowed`,
-  `openapi.TestCompile_ByDefaultEachReferenceIsJudgedByItsOwnSpelling`,
-  `openapi.TestCompile_AURLNoReaderReadsIsRefusedUnread`,
-  `openapi.TestCompile_ARefAnIDAnswersIsNeverRefusedUnread`,
-  `openapi.TestCompile_ARelativeRefUnderAnIDReadsWhereTheIDPlacesIt`,
+  `e2e.TestCompile_ASiblingRefResolvesWithinTheSourcesDirectory`,
+  `e2e.TestCompile_ARefOutsideTheSourcesDirectoryIsRefused`,
+  `e2e.TestCompile_ASymlinkOutOfTheSourcesDirectoryIsRefused`,
+  `e2e.TestCompile_ARefOutsideTheSourcesDirectoryResolvesWhenAllowed`,
+  `e2e.TestCompile_ByDefaultOnlyARelativeReferenceIsFollowed`,
+  `e2e.TestCompile_ByDefaultEachReferenceIsJudgedByItsOwnSpelling`,
+  `e2e.TestCompile_AURLNoReaderReadsIsRefusedUnread`,
+  `e2e.TestCompile_ARefAnIDAnswersIsNeverRefusedUnread`,
+  `e2e.TestCompile_ARelativeRefUnderAnIDReadsWhereTheIDPlacesIt`,
   `bind.TestBind_ReadsARelativeURIUnderAnIDWhereTheIDPlacesIt`,
   `bind.TestBind_RefusesAReadUnderAnIDAsItsSpellingsWould`,
-  `openapi.TestCompile_OneFileUnderTwoNamesIsOneDocument`,
-  `openapi.TestExternalContent_ASchemaRefPastARefNamesItsContent`,
-  `openapi.TestExternalContent_ASourcePositionItNamesByFileResolvesInEitherOrder`,
-  `openapi.TestCompile_SchemaEmptyPointerSegmentIsUnresolved`,
+  `e2e.TestCompile_OneFileUnderTwoNamesIsOneDocument`,
+  `e2e.TestExternalContent_ASchemaRefPastARefNamesItsContent`,
+  `e2e.TestExternalContent_ASourcePositionItNamesByFileResolvesInEitherOrder`,
+  `e2e.TestCompile_SchemaEmptyPointerSegmentIsUnresolved`,
   `load.TestLoad_ARootDefinitionResolvesAsTheResolverReadsIt`,
   `load.TestLoad_ARootDefinitionAnswersBeforeASchemasOwn`,
   `bind.TestBind_ReadsEachHop`, `bind.TestBind_ReadsADefinitionByTheDefsRule`,
-  `openapi.TestCompile_DefsPointerUnderANestedIDReadsTheBaseItNames`,
-  `openapi.TestExternalContent_ARefLendsItsUseSiteWhatItsTypeReaches`,
+  `e2e.TestCompile_DefsPointerUnderANestedIDReadsTheBaseItNames`,
+  `e2e.TestExternalContent_ARefLendsItsUseSiteWhatItsTypeReaches`,
   `schema.TestSchema_ARefThroughAnEmptyRefLendsNothing`,
   `bind.TestBind_ReadsEachPositionAsTheJSONItSpells`, `bind.TestBind_ReadsARepeatedKeyAsItsLast`,
   `bind.TestBind_StopsAtItsBudget`, `bind.TestBind_CountsWorkLinearInTheDocument`,
   `bind.TestBind_ReadsEveryWebhookAsAPathItem`, `bind.TestBind_PlacesAnEndAtTheNodeItsChainReached`,
-  `openapi.TestReferenceEnds_AnEndingSlashIsReadWhereTheParserResolvedIt`,
-  `openapi.TestReferenceEnds_AnEndInTheSourceIsReadThereUnderSelf`,
+  `e2e.TestReferenceEnds_AnEndingSlashIsReadWhereTheParserResolvedIt`,
+  `e2e.TestReferenceEnds_AnEndInTheSourceIsReadThereUnderSelf`,
   `load.TestBindSchemas_PlacesEveryEndAndBindsEveryRefInTheCorpus`,
-  `openapi.TestReferenceEnds_AnEndTheBinderCannotPlaceSaysWhy`,
+  `e2e.TestReferenceEnds_AnEndTheBinderCannotPlaceSaysWhy`,
   `bind.TestTable_SaysWhyARefWentUnread`,
   `bind.TestBind_SaysAKeyMayLiePastTheMergeBound`,
   `bind.TestBind_TakesNoDefinitionPastAReadTheMergeBoundStopped`,
   `canary.TestBindingOracle_AgreesWithTheLibrary`,
   `load.TestResolve_AFindingNamesTheDocumentItIsIn`,
   `load.TestResolve_ReachedFindingsDoNotDependOnDeclarationOrder`,
-  `openapi.TestCompile_AReferenceObjectToANonObjectIsReportedOnce`
+  `e2e.TestCompile_AReferenceObjectToANonObjectIsReportedOnce`
 - Status: partly built: an `encoding` entry naming no part of its body is dropped with no record
   (#604). Another document's identifiers are not read, so a plain name naming one of its resources
   is reported unresolved (#1049). An absolute-path `$ref` in a remote document is read as a local
@@ -481,15 +481,15 @@ declares is recursion, not a cycle ([`recursion`](#recursion)). An alias scan th
 of its own is reported as an `openapi/cycle-scan-failed` warning, and the compile proceeds.
 
 - Codes: `openapi/cyclic-ref`, `openapi/cycle-scan-failed`
-- Tests: `openapi.TestCompile_SchemaRefCycleIsReportedAndStillCompiles`,
-  `openapi.TestCompile_CycleIsReportedAtItsLeastMemberInEitherOrder`,
-  `openapi.TestCompile_ReentrantPrefixReportsAlikeInBothDeclarationOrders`,
-  `openapi.TestCompile_AliasCycleIsRefused`, `load.TestLoad_ADegenerateCycleLoadsAndIsReportedOnce`,
-  `openapi.TestCompile_ALoopThroughAnotherDocumentIsReportedOnce`,
+- Tests: `e2e.TestCompile_SchemaRefCycleIsReportedAndStillCompiles`,
+  `e2e.TestCompile_CycleIsReportedAtItsLeastMemberInEitherOrder`,
+  `e2e.TestCompile_ReentrantPrefixReportsAlikeInBothDeclarationOrders`,
+  `e2e.TestCompile_AliasCycleIsRefused`, `load.TestLoad_ADegenerateCycleLoadsAndIsReportedOnce`,
+  `e2e.TestCompile_ALoopThroughAnotherDocumentIsReportedOnce`,
   `load.TestBindingDiags_NamesALoopsMembersByTheirDocument`,
   `bind.TestBind_ReportsALoopOutsideTheSourceAtItsLeastMember`,
   `bind.TestBind_ReportsALoopOfDefinitionsAtItsLeastMember`,
-  `openapi.TestCompile_MergeChainPastBoundStillCompiles`, `bind.TestBind_AnswersAlikeInEitherOrder`
+  `e2e.TestCompile_MergeChainPastBoundStillCompiles`, `bind.TestBind_AnswersAlikeInEitherOrder`
 - Status: partly built: a cycle of component Reference Objects is reported as an unresolved
   reference rather than as `openapi/cyclic-ref` (#580), and a reference object on a failing chain is
   reported only where the walk reaches it first (#767).
@@ -735,7 +735,7 @@ a cycle with no schema in it, which [`reference-cycles`](#reference-cycles) repo
 
 - Cases: `recursive`
 - Tests: `schema.TestLower_RecursiveSchemaTerminates`, `scan.TestAliases_LegalRecursionClean`,
-  `openapi.TestCompile_SchemaRefCycleIsReportedAndStillCompiles`
+  `e2e.TestCompile_SchemaRefCycleIsReportedAndStillCompiles`
 - Status: partly built: an `allOf` that names its own schema, or two schemas that are each other's
   `Base`, lowers to a base chain that returns to where it started with no diagnostic, and a cycle of
   required properties that admits no finite value is reported by nothing (#642).
@@ -754,7 +754,7 @@ is copied to a use site (§12.2).
 
 - Cases: `param-ref-inheritance`, `allof-ref-branch-siblings`, `readonly-writeonly`,
   `schema-ref-siblings-30`
-- Tests: `openapi.TestAnnotationRetention`, `schema.TestModel_RefSiblingDescriptionWins`,
+- Tests: `e2e.TestAnnotationRetention`, `schema.TestModel_RefSiblingDescriptionWins`,
   `schema.TestSchemaExamples_ComponentRefSiblingKeepsThem`
 
 ### `reference-object-siblings`
@@ -795,9 +795,9 @@ the position: a `$ref` leaves lowering a position to the declaration that owns i
 
 - Cases: `defaults`, `readonly-writeonly`, `inline-residue`
 - Codes: `openapi/degraded-construct`
-- Tests: `openapi.TestAnnotationRetention_OtherDeclarationShapes`,
+- Tests: `e2e.TestAnnotationRetention_OtherDeclarationShapes`,
   `schema.TestPropertyPosition_ResidueStaysOutOfTheTypeNode`,
-  `openapi.TestCompile_AReferenceLeavesItsTargetToItsOwnerInEitherOrder`
+  `e2e.TestCompile_AReferenceLeavesItsTargetToItsOwnerInEitherOrder`
 
 ### `docs-and-deprecation`
 
@@ -842,7 +842,7 @@ each property that references it.
 - Cases: `readonly-writeonly`
 - Codes: `openapi/disjoint-visibility`
 - Tests: `schema.TestModel_ReadOnlyAndWriteOnlyTogetherAreVisibleNowhere`,
-  `openapi.TestAllOfVisibilityMerge_DisjointRestrictionsAreInvisibleNotAConflict`,
+  `e2e.TestAllOfVisibilityMerge_DisjointRestrictionsAreInvisibleNotAConflict`,
   `merge.TestFold_AlreadyInvisibleVisibilityIsNotReAnnounced`
 
 ### `nullable`
@@ -887,9 +887,9 @@ model does not name.
 - Codes: `openapi/inferred-nullable`, `openapi/unknown-schema-keyword`
 - Tests: `schema.TestSchemaRef_NullableNormalization`,
   `schema.TestNullableWidening_EachShapeReadsByItsVersion`,
-  `openapi.TestNullableWidening_AKeywordIsReportedOnceAtItself`,
-  `openapi.TestNullableWidening_DisabledKeepsWhatTheDialectDoesNotDefine`,
-  `openapi.TestNullableWidening_ACompositionKeepsTheMarker`,
+  `e2e.TestNullableWidening_AKeywordIsReportedOnceAtItself`,
+  `e2e.TestNullableWidening_DisabledKeepsWhatTheDialectDoesNotDefine`,
+  `e2e.TestNullableWidening_ACompositionKeepsTheMarker`,
   `merge.TestIntersectNull_TheMarkerFollowsTheBit`
 - Status: partly built: a `nullable` its dialect does not define, read with the policy off, is kept
   nowhere at a position that lowers to a shared node and carries no property or parameter, as no
@@ -1205,10 +1205,10 @@ field's first 64 at most; each later one is kept verbatim, unjudged, under an
   `schema.TestAllOf_ACopyANarrowingKeptIsStillACopy`,
   `schema.TestAllOf_AListOfAComponentWinsOverAListOfItsCopy`,
   `schema.TestAllOf_ARefToASiblingFieldIsDeclaredApart`,
-  `openapi.TestExternalContent_ANodeAnotherDocumentHoistsIsNoCopyOfAnInlineOne`,
-  `openapi.TestExternalContent_ACopyInAnotherDocumentIsJudgedThere`,
+  `e2e.TestExternalContent_ANodeAnotherDocumentHoistsIsNoCopyOfAnInlineOne`,
+  `e2e.TestExternalContent_ACopyInAnotherDocumentIsJudgedThere`,
   `schema.TestAllOf_ARedeclarationIsJudgedOnceTheComponentsHaveLowered`,
-  `openapi.TestCompile_AReferenceLeavesItsTargetToItsOwnerInEitherOrder`
+  `e2e.TestCompile_AReferenceLeavesItsTargetToItsOwnerInEitherOrder`
 - Status: partly built: two distinct nodes of related kinds (`format: hex` against `format: byte`,
   two enums whose members fit each other's kind, two different literals), and a list or map whose
   broader side carries detail the narrower lacks, are reported as an overlap and never narrowed
@@ -1460,7 +1460,7 @@ written with structure is [`union-beside-structure`](#union-beside-structure)'s.
 - Codes: `openapi/degraded-construct`, `openapi/unresolved-ref`
 - Tests: `schema.TestHomelessDiscriminator_IsKeptBesideEveryOtherNode`,
   `schema.TestUnplacedDiscriminator_IsKeptAtEveryUnionSite`,
-  `openapi.TestMappingTargets_ADiscriminatorAReferenceReachesIsBoundWhereItSits`
+  `e2e.TestMappingTargets_ADiscriminatorAReferenceReachesIsBoundWhereItSits`
 - Status: partly built: an empty `propertyName` lowers to IR that `irverify` refuses (#882); a
   mapping to a component that is a `$ref` to a subtype fails validation (#844), a keyword beside a
   union branch's `$ref` breaks a mapping to its component (#847), and a mapping to a property whose
@@ -1521,7 +1521,7 @@ at that position, whichever is lowered first.
 - Tests: `schema.TestEnum_HeterogeneousBecomesUnionWithBadValue`,
   `schema.TestEnum_NonScalarAndMidListMismatch`,
   `schema.TestEnumAsUnion_UnconvertibleMemberBecomesAny`,
-  `openapi.TestCompile_AReferenceLeavesItsTargetToItsOwnerInEitherOrder`
+  `e2e.TestCompile_AReferenceLeavesItsTargetToItsOwnerInEitherOrder`
 - Status: partly built: an `enum` ignores its `format`, though `Enum.ValueType` can carry it (#607);
   an enum whose members do not match its declared type lowers to a union with only an info
   diagnostic (#619); and a `Literal` carries no value type or format (#668). Open: whether a
@@ -1757,9 +1757,9 @@ needs to produce it.
 - Cases: `allof-boolean-branch`
 - Codes: `openapi/degraded-construct`, `openapi/false-schema`
 - Tests: `schema.TestLower_DepthCapExceeded`,
-  `openapi.TestMaxNesting_AdmitsWhatTheLoweringLowersInFull`,
-  `openapi.TestCompile_ARefToABooleanSchemaResolvesInEitherOrder`,
-  `openapi.TestCompile_AReferenceLeavesItsTargetToItsOwnerInEitherOrder`
+  `e2e.TestMaxNesting_AdmitsWhatTheLoweringLowersInFull`,
+  `e2e.TestCompile_ARefToABooleanSchemaResolvesInEitherOrder`,
+  `e2e.TestCompile_AReferenceLeavesItsTargetToItsOwnerInEitherOrder`
 
 ### `null-schema`
 
@@ -1782,7 +1782,7 @@ out draws, but for `items` beside a 3.0 `type: array`, whose absence
 [`missing-array-items`](#missing-array-items) reports instead. One inside a value the IR keeps
 verbatim whole, a `dependentSchemas` entry, stays in that value, since nothing reads it as a schema.
 
-- Tests: `openapi.TestCompile_ANullWhereASchemaBelongsIsNoSchema`,
+- Tests: `e2e.TestCompile_ANullWhereASchemaBelongsIsNoSchema`,
   `schema.TestNullSchema_AnEntryIsTheEmptySchemaAndAKeywordIsLeftOut`,
   `annotation.TestIsNullLiteral_TellsANullFromFalse`
 
@@ -2654,8 +2654,8 @@ kept and reported as a written one is.
 - Cases: `path-item-anchored-key`
 - Codes: `openapi/unknown-object-key`, `openapi/unknown-schema-keyword`,
   `openapi/unknown-key-budget`, `openapi/unknown-key-entry-taken`, `openapi/unknown-key-unreachable`
-- Tests: `openapi.TestUnknownKeys_KeptAtEveryObject`,
-  `openapi.TestUnknownKeys_SchemaAndObjectAreGradedApart`,
+- Tests: `e2e.TestUnknownKeys_KeptAtEveryObject`,
+  `e2e.TestUnknownKeys_SchemaAndObjectAreGradedApart`,
   `annotation.TestUnknownKeysIn_BudgetBoundsWhatOneObjectContributes`,
   `annotation.TestUndefinedKeywordsIn_KeepsWhatTheCallerNames`
 - Status: partly built: a parameter's key and its schema's keyword of one spelling share an entry
@@ -2697,7 +2697,7 @@ list out of an extension, not a promotion, so the entry is left for a consumer t
 - Codes: `openapi/degraded-construct`
 - Tests: `lowering.TestPromoteDeprecation_ValueThatIsNotTextIsReported`,
   `lowering.TestPromoteEnumOpenness_WritesNothing`,
-  `openapi.TestPromotion_RemovalDateAndVersionAreSeparateFacts`
+  `e2e.TestPromotion_RemovalDateAndVersionAreSeparateFacts`
 - Status: partly built: the default mapping covers only deprecation and extensible enums (#656); two
   keys mapped to one field resolve by sort order in silence (#655); a mapping cannot say which
   extension values state the fact (#654); and an unknown key under a prefix the policy owns is kept

From e73d37557395d79456fd7ac280260c00fc08a166 Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 21:46:38 +0300
Subject: [PATCH 02/11] test(compilers/openapi): gather the end-to-end helpers
 in one file

The helpers several end-to-end files share were declared in whichever
file needed them first: the petstore path in fuzz_test.go, the IR
readers in conformance_test.go, the on-disk compile in
confinement_test.go. They now sit in helpers_test.go in reading order,
fixture paths first, then compiling, then reading the IR, then reading
diagnostics.

What stays where it was is not a helper: a conformance case's assertion
stays with its family, the corpus's own reader with conformance_test.go,
the lowering-spec checker with its tests, and a fixture one construct's
files share with that construct. The declarations are byte-identical.
---
 compilers/openapi/e2e/amplification_test.go   |   2 -
 compilers/openapi/e2e/anchors_test.go         |  35 --
 compilers/openapi/e2e/annotations_test.go     |  23 --
 compilers/openapi/e2e/confinement_test.go     |  69 ----
 compilers/openapi/e2e/conformance_test.go     | 138 -------
 .../openapi/e2e/conformance_unmodeled_test.go |  19 -
 compilers/openapi/e2e/cycles_test.go          |   7 -
 compilers/openapi/e2e/danglingcheck_test.go   |   8 -
 compilers/openapi/e2e/fuzz_test.go            |   4 -
 compilers/openapi/e2e/helpers_test.go         | 355 ++++++++++++++++++
 compilers/openapi/e2e/later_version_test.go   |  14 -
 compilers/openapi/e2e/refusal_order_test.go   |  22 --
 compilers/openapi/e2e/reuse_corpus_test.go    |  11 -
 13 files changed, 355 insertions(+), 352 deletions(-)

diff --git a/compilers/openapi/e2e/amplification_test.go b/compilers/openapi/e2e/amplification_test.go
index 8d11e6b0..f4b19b48 100644
--- a/compilers/openapi/e2e/amplification_test.go
+++ b/compilers/openapi/e2e/amplification_test.go
@@ -16,8 +16,6 @@ import (
 	"github.com/dexpace/morphic/ir"
 )
 
-const amplificationBombFixture = "../../../testdata/openapi/amplification_alias_bomb.yaml"
-
 func TestCompile_AliasBombDoesNotExhaustMemory(t *testing.T) {
 	t.Parallel()
 	data, err := os.ReadFile(amplificationBombFixture)
diff --git a/compilers/openapi/e2e/anchors_test.go b/compilers/openapi/e2e/anchors_test.go
index cabc1c26..3f7d363e 100644
--- a/compilers/openapi/e2e/anchors_test.go
+++ b/compilers/openapi/e2e/anchors_test.go
@@ -193,21 +193,6 @@ func compileReferring(t *testing.T, path, uri string) *ir.Document {
 	return out
 }
 
-// compileBesideExpectingErrors compiles root, written beside ext, with
-// external references allowed, and returns the diagnostics instead of
-// requiring none: the twin comparisons above need a clean compile, and a
-// refused external document needs the diagnostic itself.
-func compileBesideExpectingErrors(t *testing.T, ext, root string) []ir.Diagnostic {
-	t.Helper()
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "other.yaml"), []byte(ext), 0o600))
-	_, diags, err := openapi.New().Compile(t.Context(),
-		[]compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: []byte(root)}},
-		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
-	require.NoError(t, err, "a refused external document is a diagnostic, not a Go error")
-	return diags
-}
-
 // TestCompile_ARecursiveAnchorInAnExternalDocumentIsRefused pins GitHub #536.
 // A recursive anchor in an external document, on a folded entry or in a
 // self-referencing schema, would build its model without end. Both are refused
@@ -406,23 +391,3 @@ func operationNamed(doc *ir.Document, name string) (ir.Operation, bool) {
 	}
 	return ops[0], true
 }
-
-// operationsNamed returns every operation whose source operationId is name, in
-// any group of any service, in the order the groups are walked.
-func operationsNamed(doc *ir.Document, name string) []ir.Operation {
-	groups := make([]ir.OperationGroup, 0, len(doc.Services))
-	for _, svc := range doc.Services {
-		groups = append(groups, svc.Groups...)
-	}
-	var ops []ir.Operation
-	for len(groups) > 0 {
-		g := groups[0]
-		groups = append(groups[1:], g.Groups...)
-		for _, op := range g.Operations {
-			if op.Name.Source == name {
-				ops = append(ops, op)
-			}
-		}
-	}
-	return ops
-}
diff --git a/compilers/openapi/e2e/annotations_test.go b/compilers/openapi/e2e/annotations_test.go
index 625ae9a5..2e752518 100644
--- a/compilers/openapi/e2e/annotations_test.go
+++ b/compilers/openapi/e2e/annotations_test.go
@@ -14,8 +14,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/dexpace/morphic/compilers"
-	"github.com/dexpace/morphic/compilers/openapi"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
 	"github.com/dexpace/morphic/internal/harness"
 	"github.com/dexpace/morphic/ir"
@@ -52,19 +50,6 @@ type retentionCase struct {
 	assertDiags func(*testing.T, []ir.Diagnostic)
 }
 
-// compileAnnotationSpec compiles one in-memory annotation-retention spec.
-// Every spec in this suite is well-formed by construction, so compilation is
-// required to succeed with no Go error; the caller checks diagnostics
-// separately, against what its own cell expects.
-func compileAnnotationSpec(t *testing.T, name, spec string) (*ir.Document, []ir.Diagnostic) {
-	t.Helper()
-	doc, diags, err := openapi.New().Compile(t.Context(),
-		[]compilers.Source{{Path: name + ".yaml", Data: []byte(spec)}}, compilers.Options{})
-	require.NoError(t, err)
-	require.NotNil(t, doc)
-	return doc, diags
-}
-
 func TestAnnotationRetention(t *testing.T) {
 	t.Parallel()
 	for _, tc := range retentionCases() {
@@ -1022,14 +1007,6 @@ func paramUnmodeled(t *testing.T, op ir.Operation) ir.Unmodeled {
 	return op.Params[0].Unmodeled
 }
 
-// requestContent returns an operation's single request-body content.
-func requestContent(t *testing.T, op ir.Operation) ir.Content {
-	t.Helper()
-	require.NotNil(t, op.Request)
-	require.Len(t, op.Request.Contents, 1)
-	return op.Request.Contents[0]
-}
-
 // refSiteAlias returns the node a body position hoisted to hold what was
 // written beside its $ref, requiring it to be an alias of the referent rather
 // than the referent itself — which is the difference between keeping the
diff --git a/compilers/openapi/e2e/confinement_test.go b/compilers/openapi/e2e/confinement_test.go
index 208451d7..8bb8c0b8 100644
--- a/compilers/openapi/e2e/confinement_test.go
+++ b/compilers/openapi/e2e/confinement_test.go
@@ -4,14 +4,12 @@
 package e2e_test // external test package — exercises only the public API
 
 import (
-	"context"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"runtime"
-	"sync"
 	"sync/atomic"
 	"testing"
 
@@ -21,44 +19,10 @@ import (
 
 	"github.com/dexpace/morphic/compilers"
 	"github.com/dexpace/morphic/compilers/openapi"
-	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/engine/reader"
 	"github.com/dexpace/morphic/ir"
 )
 
-// recordingReader reads through inner and records each request it was handed.
-type recordingReader struct {
-	inner compilers.DocumentReader
-
-	mu   sync.Mutex
-	reqs []compilers.DocumentRequest
-}
-
-// ReadDocument records req, then answers it as inner does.
-func (r *recordingReader) ReadDocument(ctx context.Context, req compilers.DocumentRequest) ([]byte, error) {
-	r.mu.Lock()
-	r.reqs = append(r.reqs, req)
-	r.mu.Unlock()
-	return r.inner.ReadDocument(ctx, req)
-}
-
-// requests returns the requests recorded so far, in order.
-func (r *recordingReader) requests() []compilers.DocumentRequest {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return append([]compilers.DocumentRequest(nil), r.reqs...)
-}
-
-// locations returns the document each recorded request named, in order.
-func (r *recordingReader) locations() []string {
-	reqs := r.requests()
-	out := make([]string, 0, len(reqs))
-	for _, req := range reqs {
-		out = append(out, req.Location)
-	}
-	return out
-}
-
 // otherDoc holds the one response and parameter a confinement test's $refs
 // name, each told apart from anything the source declares by its description.
 const otherDoc = `components:
@@ -83,39 +47,6 @@ paths:
 `
 }
 
-// layout writes files, named by their slash-separated path under root, creating
-// the directories they sit in.
-func layout(t *testing.T, root string, files map[string]string) {
-	t.Helper()
-	for name, content := range files {
-		path := filepath.Join(root, filepath.FromSlash(name))
-		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o750))
-		require.NoError(t, os.WriteFile(path, []byte(content), 0o600))
-	}
-}
-
-// compileOnDisk compiles source, read from path, through reader.Disk with
-// external references allowed or not.
-func compileOnDisk(t *testing.T, path, source string, allow bool) (*ir.Document, []ir.Diagnostic) {
-	t.Helper()
-	doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: path, Data: []byte(source)}},
-		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: allow}})
-	require.NoError(t, err)
-	require.NotNil(t, doc)
-	return doc, diags
-}
-
-// unresolvedRefs returns the unresolved-ref findings among diags.
-func unresolvedRefs(diags []ir.Diagnostic) []ir.Diagnostic {
-	var out []ir.Diagnostic
-	for _, d := range diags {
-		if d.Code == diag.UnresolvedRef {
-			out = append(out, d)
-		}
-	}
-	return out
-}
-
 // requireReadFrom requires that GET /a took its parameter and its response
 // from the other document, and reported no unresolved reference.
 func requireReadFrom(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
diff --git a/compilers/openapi/e2e/conformance_test.go b/compilers/openapi/e2e/conformance_test.go
index 30ee54f1..92eb9014 100644
--- a/compilers/openapi/e2e/conformance_test.go
+++ b/compilers/openapi/e2e/conformance_test.go
@@ -10,7 +10,6 @@ import (
 	"maps"
 	"os"
 	"path/filepath"
-	"reflect"
 	"slices"
 	"strings"
 	"testing"
@@ -311,12 +310,6 @@ func invalidCases() map[string][]string {
 	}
 }
 
-// assertNoErrorDiags fails when any diagnostic has error severity.
-func assertNoErrorDiags(t *testing.T, diags []ir.Diagnostic) {
-	t.Helper()
-	assertOnlyErrorDiags(t, diags, nil)
-}
-
 // assertOnlyErrorDiags fails when a diagnostic has error severity and a code
 // outside want, or when a code of want draws no error.
 func assertOnlyErrorDiags(t *testing.T, diags []ir.Diagnostic, want []string) {
@@ -334,58 +327,6 @@ func assertOnlyErrorDiags(t *testing.T, diags []ir.Diagnostic, want []string) {
 	}
 }
 
-// namedID is the stable TypeID of a components-named schema.
-func namedID(name string) ir.TypeID {
-	return ir.TypeID("t/openapi/components/schemas/" + name)
-}
-
-// allOperations flattens every operation across a document's service groups.
-func allOperations(doc *ir.Document) []ir.Operation {
-	var out []ir.Operation
-	var walk func(gs []ir.OperationGroup)
-	walk = func(gs []ir.OperationGroup) {
-		for _, g := range gs {
-			out = append(out, g.Operations...)
-			walk(g.Groups)
-		}
-	}
-	for _, svc := range doc.Services {
-		walk(svc.Groups)
-	}
-	return out
-}
-
-// opByName finds an operation by its source operationId.
-func opByName(doc *ir.Document, source string) (ir.Operation, bool) {
-	for _, op := range allOperations(doc) {
-		if op.Name.Source == source {
-			return op, true
-		}
-	}
-	return ir.Operation{}, false
-}
-
-// propByWire returns the property of m with the given wire name.
-func propByWire(m *ir.Model, wire string) (ir.Property, bool) {
-	for _, p := range m.Properties {
-		if p.WireName == wire {
-			return p, true
-		}
-	}
-	return ir.Property{}, false
-}
-
-// paramByName returns the operation's logical parameter with the given source
-// name.
-func paramByName(op ir.Operation, name string) (ir.Parameter, bool) {
-	for _, p := range op.Params {
-		if p.Name.Source == name {
-			return p, true
-		}
-	}
-	return ir.Parameter{}, false
-}
-
 func assertNamedTypes(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
 	user, ok := doc.Types[namedID("User")].(*ir.Model)
 	require.True(t, ok, "named schema User present under its pointer-derived ID")
@@ -761,23 +702,6 @@ func assertComponentReuse(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
 	assert.True(t, ok, "the shared callback's operation is registered alongside its parent")
 }
 
-// operationAt finds the operation bound to one HTTP method and URI template.
-// Operations reached through a shared path item have no distinguishing name of
-// their own, so their binding is what tells them apart. A webhook binding has
-// no URI template, so no webhook is found.
-func operationAt(t *testing.T, doc *ir.Document, method, uri string) ir.Operation {
-	t.Helper()
-	for _, op := range allOperations(doc) {
-		for _, hb := range op.Bindings.HTTP {
-			if hb.Method == method && hb.URITemplate == uri {
-				return op
-			}
-		}
-	}
-	t.Fatalf("no operation bound to %s %s", method, uri)
-	return ir.Operation{}
-}
-
 func assertAllOfInheritance(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
 	d, ok := doc.Types[namedID("Derived")].(*ir.Model)
 	require.True(t, ok)
@@ -3019,16 +2943,6 @@ func assertHeaderStyleAndExplodeKept(t *testing.T, headers []ir.Property) {
 		"a header that declares neither keyword records neither")
 }
 
-// headerByWire returns the response header with the given wire name.
-func headerByWire(headers []ir.Property, wire string) (ir.Property, bool) {
-	for _, h := range headers {
-		if h.WireName == wire {
-			return h, true
-		}
-	}
-	return ir.Property{}, false
-}
-
 func assertMultiContent(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
 	op, ok := opByName(doc, "getData")
 	require.True(t, ok)
@@ -3261,15 +3175,6 @@ func assertSequentialMedia(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
 	}
 }
 
-// firstContent returns an operation's single success-response content.
-func firstContent(t *testing.T, op ir.Operation) ir.Content {
-	t.Helper()
-	require.Len(t, op.Responses, 1)
-	require.NotNil(t, op.Responses[0].Payload)
-	require.Len(t, op.Responses[0].Payload.Contents, 1)
-	return op.Responses[0].Payload.Contents[0]
-}
-
 func assertPerStatusErrors(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
 	op, ok := opByName(doc, "getWidgets")
 	require.True(t, ok)
@@ -4232,36 +4137,6 @@ func assertEveryObjectKeepsItsExtensions(t *testing.T, doc *ir.Document) {
 	}
 }
 
-// unmodeledSite is one Unmodeled entry paired with the walk path of the map
-// holding it.
-type unmodeledSite struct {
-	key   string
-	path  string
-	entry ir.UnmodeledEntry
-}
-
-// unmodeledSites returns every Unmodeled entry the document holds. It walks the
-// value graph rather than naming carriers so that a test asserting "this is kept
-// somewhere sensible" cannot pass by looking only where it expected to.
-func unmodeledSites(doc *ir.Document) []unmodeledSite {
-	unmodeledType := reflect.TypeFor[ir.Unmodeled]()
-	var out []unmodeledSite
-	ir.WalkValues(doc, ir.DocumentPath, func(v reflect.Value, path string) bool {
-		if v.Type() != unmodeledType || !v.CanInterface() {
-			return true
-		}
-		u, ok := reflect.TypeAssert[ir.Unmodeled](v)
-		if !ok {
-			return true
-		}
-		for key, entry := range u {
-			out = append(out, unmodeledSite{key: key, path: path, entry: entry})
-		}
-		return true
-	})
-	return out
-}
-
 // carrierNarrows reports whether carrier picks out fewer than all of the
 // document's Unmodeled maps. A carrier that matches every one of them makes the
 // assertion beside it unconditionally true, which is how a row can name the
@@ -4281,19 +4156,6 @@ func carrierNarrows(sites []unmodeledSite, carrier string) bool {
 	return len(matched) < len(all)
 }
 
-// findUnmodeled returns the site holding key with the given JSON value. The
-// value is part of the match because one key spelling occurs at many carriers —
-// "openapi:x-mark" is written on a dozen objects in this fixture — so matching
-// on the key alone would find a different object's entry and call it a pass.
-func findUnmodeled(sites []unmodeledSite, key, wantJSON string) (unmodeledSite, bool) {
-	for _, site := range sites {
-		if site.key == key && string(site.entry.Value) == wantJSON {
-			return site, true
-		}
-	}
-	return unmodeledSite{}, false
-}
-
 // assertRawPreservedBinary pins what a !!binary extension keeps: the base64 the
 // source wrote. Decoding it and storing the bytes in a JSON string lost the
 // spelling on every value and lost the data itself on any byte that is not
diff --git a/compilers/openapi/e2e/conformance_unmodeled_test.go b/compilers/openapi/e2e/conformance_unmodeled_test.go
index 03c3bb33..3605b331 100644
--- a/compilers/openapi/e2e/conformance_unmodeled_test.go
+++ b/compilers/openapi/e2e/conformance_unmodeled_test.go
@@ -21,25 +21,6 @@ import (
 	"github.com/dexpace/morphic/ir"
 )
 
-// unmodeledEntry returns the Unmodeled entry at key, failing when absent.
-func unmodeledEntry(t *testing.T, p ir.Unmodeled, key string) ir.UnmodeledEntry {
-	t.Helper()
-	entry, ok := p[key]
-	require.True(t, ok, "%s kept verbatim; got %v", key, p)
-	return entry
-}
-
-// diagsAt returns the severities of the diagnostics coded code at pointer.
-func diagsAt(diags []ir.Diagnostic, code, pointer string) []ir.Severity {
-	var out []ir.Severity
-	for _, d := range diags {
-		if d.Code == code && d.Provenance.Pointer == jsontext.Pointer(pointer) {
-			out = append(out, d.Severity)
-		}
-	}
-	return out
-}
-
 // assertUnhomedKeywords pins the keywords a position writes that the node its
 // lowering produced has nowhere to carry (GitHub #148, #151).
 //
diff --git a/compilers/openapi/e2e/cycles_test.go b/compilers/openapi/e2e/cycles_test.go
index 8e2dc28a..07ca63e3 100644
--- a/compilers/openapi/e2e/cycles_test.go
+++ b/compilers/openapi/e2e/cycles_test.go
@@ -636,13 +636,6 @@ components:
 // the fuzzer its seeds in silence.
 const reproducerDir = "../../../testdata/openapi"
 
-func readReproducer(t *testing.T, file string) []byte {
-	t.Helper()
-	data, err := os.ReadFile(filepath.Join(reproducerDir, file+".yaml"))
-	require.NoError(t, err)
-	return data
-}
-
 // TestCompile_MergeChainPastBoundStillCompiles pins that a legal document whose
 // `<<` merge chain runs past the mapping view's depth bound is compiled. The
 // alias scan weighs aliases rather than expanding merges through that view, so
diff --git a/compilers/openapi/e2e/danglingcheck_test.go b/compilers/openapi/e2e/danglingcheck_test.go
index 2e9af72f..950649a4 100644
--- a/compilers/openapi/e2e/danglingcheck_test.go
+++ b/compilers/openapi/e2e/danglingcheck_test.go
@@ -59,14 +59,6 @@ func compileFile(t *testing.T, dir, file, srcPath string) (*ir.Document, []ir.Di
 	return doc, diags
 }
 
-// hasErrorRef reports whether the diagnostics carry an error-severity
-// unresolved-ref finding — the signal that an offending entry was dropped.
-func hasErrorRef(diags []ir.Diagnostic) bool {
-	return slices.ContainsFunc(diags, func(d ir.Diagnostic) bool {
-		return d.Severity == ir.SeverityError && d.Code == "openapi/unresolved-ref"
-	})
-}
-
 // outcome classifies how a reproducer must be made referentially sound.
 type outcome int
 
diff --git a/compilers/openapi/e2e/fuzz_test.go b/compilers/openapi/e2e/fuzz_test.go
index 60a32a5e..9b901bd2 100644
--- a/compilers/openapi/e2e/fuzz_test.go
+++ b/compilers/openapi/e2e/fuzz_test.go
@@ -23,10 +23,6 @@ import (
 	"github.com/dexpace/morphic/ir/irverify"
 )
 
-// goldenPetstore is the larger real-ish spec seeded alongside the conformance
-// corpus, addressed relative to this test file.
-const goldenPetstore = "../../../testdata/golden/openapi/petstore.yaml"
-
 // cycleFixtureDir holds the cycle-detector reproducer and pointer-resolution
 // fixtures, addressed relative to this test file.
 const cycleFixtureDir = "../../../testdata/openapi"
diff --git a/compilers/openapi/e2e/helpers_test.go b/compilers/openapi/e2e/helpers_test.go
index 59e25fdd..4688eca6 100644
--- a/compilers/openapi/e2e/helpers_test.go
+++ b/compilers/openapi/e2e/helpers_test.go
@@ -1,16 +1,34 @@
 package e2e_test
 
 import (
+	"context"
+	"encoding/json/jsontext"
+	"encoding/json/v2"
+	"os"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"sync"
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	yaml "gopkg.in/yaml.v3"
 
 	"github.com/dexpace/morphic/compilers"
 	"github.com/dexpace/morphic/compilers/openapi"
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/engine/reader"
+	"github.com/dexpace/morphic/internal/harness"
 	"github.com/dexpace/morphic/ir"
 )
 
+// goldenPetstore is the larger real-ish spec seeded alongside the conformance
+// corpus, addressed relative to this test file.
+const goldenPetstore = "../../../testdata/golden/openapi/petstore.yaml"
+
+const amplificationBombFixture = "../../../testdata/openapi/amplification_alias_bomb.yaml"
+
 // parseFull runs the whole public compiler pipeline over src. That reach back
 // through openapi is also why openapitest cannot hold it — see that package's
 // doc comment.
@@ -23,6 +41,127 @@ func parseFull(t *testing.T, src string) (*ir.Document, []ir.Diagnostic) {
 	return doc, diags
 }
 
+// compileAnnotationSpec compiles one in-memory annotation-retention spec.
+// Every spec in this suite is well-formed by construction, so compilation is
+// required to succeed with no Go error; the caller checks diagnostics
+// separately, against what its own cell expects.
+func compileAnnotationSpec(t *testing.T, name, spec string) (*ir.Document, []ir.Diagnostic) {
+	t.Helper()
+	doc, diags, err := openapi.New().Compile(t.Context(),
+		[]compilers.Source{{Path: name + ".yaml", Data: []byte(spec)}}, compilers.Options{})
+	require.NoError(t, err)
+	require.NotNil(t, doc)
+	return doc, diags
+}
+
+// compileBesideExpectingErrors compiles root, written beside ext, with
+// external references allowed, and returns the diagnostics instead of
+// requiring none: the twin comparisons above need a clean compile, and a
+// refused external document needs the diagnostic itself.
+func compileBesideExpectingErrors(t *testing.T, ext, root string) []ir.Diagnostic {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "other.yaml"), []byte(ext), 0o600))
+	_, diags, err := openapi.New().Compile(t.Context(),
+		[]compilers.Source{{Path: filepath.Join(dir, "root.yaml"), Data: []byte(root)}},
+		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: true}})
+	require.NoError(t, err, "a refused external document is a diagnostic, not a Go error")
+	return diags
+}
+
+// compileOnDisk compiles source, read from path, through reader.Disk with
+// external references allowed or not.
+func compileOnDisk(t *testing.T, path, source string, allow bool) (*ir.Document, []ir.Diagnostic) {
+	t.Helper()
+	doc, diags, err := openapi.New().Compile(t.Context(), []compilers.Source{{Path: path, Data: []byte(source)}},
+		compilers.Options{Reader: reader.Disk{}, FormatOptions: openapi.Options{AllowExternalRefs: allow}})
+	require.NoError(t, err)
+	require.NotNil(t, doc)
+	return doc, diags
+}
+
+// layout writes files, named by their slash-separated path under root, creating
+// the directories they sit in.
+func layout(t *testing.T, root string, files map[string]string) {
+	t.Helper()
+	for name, content := range files {
+		path := filepath.Join(root, filepath.FromSlash(name))
+		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o750))
+		require.NoError(t, os.WriteFile(path, []byte(content), 0o600))
+	}
+}
+
+// recordingReader reads through inner and records each request it was handed.
+type recordingReader struct {
+	inner compilers.DocumentReader
+
+	mu   sync.Mutex
+	reqs []compilers.DocumentRequest
+}
+
+// ReadDocument records req, then answers it as inner does.
+func (r *recordingReader) ReadDocument(ctx context.Context, req compilers.DocumentRequest) ([]byte, error) {
+	r.mu.Lock()
+	r.reqs = append(r.reqs, req)
+	r.mu.Unlock()
+	return r.inner.ReadDocument(ctx, req)
+}
+
+// requests returns the requests recorded so far, in order.
+func (r *recordingReader) requests() []compilers.DocumentRequest {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return append([]compilers.DocumentRequest(nil), r.reqs...)
+}
+
+// locations returns the document each recorded request named, in order.
+func (r *recordingReader) locations() []string {
+	reqs := r.requests()
+	out := make([]string, 0, len(reqs))
+	for _, req := range reqs {
+		out = append(out, req.Location)
+	}
+	return out
+}
+
+func readReproducer(t *testing.T, file string) []byte {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join(reproducerDir, file+".yaml"))
+	require.NoError(t, err)
+	return data
+}
+
+// reversed is src with every mapping's entries in reverse order.
+func reversed(t *testing.T, src string) []byte {
+	t.Helper()
+	var root yaml.Node
+	require.NoError(t, yaml.Unmarshal([]byte(src), &root))
+	stack := []*yaml.Node{&root}
+	for len(stack) > 0 {
+		n := stack[len(stack)-1]
+		stack = stack[:len(stack)-1]
+		if n.Kind == yaml.MappingNode {
+			pairs := slices.Collect(slices.Chunk(n.Content, 2))
+			slices.Reverse(pairs)
+			n.Content = slices.Concat(pairs...)
+		}
+		stack = append(stack, n.Content...)
+	}
+	out, err := yaml.Marshal(&root)
+	require.NoError(t, err)
+	return out
+}
+
+// corpusSpecs lists every committed spec under testdata, as harness.SpecFiles
+// lists a directory.
+func corpusSpecs(t *testing.T) []string {
+	t.Helper()
+	out, err := harness.SpecFiles(t.Context(), corpusRoot)
+	require.NoError(t, err)
+	require.NotEmpty(t, out, "corpus sweep found no specs")
+	return out
+}
+
 // componentID is the stable TypeID of a components-named schema, or of a
 // sub-schema beneath one ("Holder/properties/inner"). It stays a test-file
 // copy for the reason openapitest's doc comment gives.
@@ -35,9 +174,225 @@ func typeByName(doc *ir.Document, name string) ir.TypeDef {
 	return doc.Types[componentID(name)]
 }
 
+// namedID is the stable TypeID of a components-named schema.
+func namedID(name string) ir.TypeID {
+	return ir.TypeID("t/openapi/components/schemas/" + name)
+}
+
+// allOperations flattens every operation across a document's service groups.
+func allOperations(doc *ir.Document) []ir.Operation {
+	var out []ir.Operation
+	var walk func(gs []ir.OperationGroup)
+	walk = func(gs []ir.OperationGroup) {
+		for _, g := range gs {
+			out = append(out, g.Operations...)
+			walk(g.Groups)
+		}
+	}
+	for _, svc := range doc.Services {
+		walk(svc.Groups)
+	}
+	return out
+}
+
+// opByName finds an operation by its source operationId.
+func opByName(doc *ir.Document, source string) (ir.Operation, bool) {
+	for _, op := range allOperations(doc) {
+		if op.Name.Source == source {
+			return op, true
+		}
+	}
+	return ir.Operation{}, false
+}
+
+// operationAt finds the operation bound to one HTTP method and URI template.
+// Operations reached through a shared path item have no distinguishing name of
+// their own, so their binding is what tells them apart. A webhook binding has
+// no URI template, so no webhook is found.
+func operationAt(t *testing.T, doc *ir.Document, method, uri string) ir.Operation {
+	t.Helper()
+	for _, op := range allOperations(doc) {
+		for _, hb := range op.Bindings.HTTP {
+			if hb.Method == method && hb.URITemplate == uri {
+				return op
+			}
+		}
+	}
+	t.Fatalf("no operation bound to %s %s", method, uri)
+	return ir.Operation{}
+}
+
+// operationsNamed returns every operation whose source operationId is name, in
+// any group of any service, in the order the groups are walked.
+func operationsNamed(doc *ir.Document, name string) []ir.Operation {
+	groups := make([]ir.OperationGroup, 0, len(doc.Services))
+	for _, svc := range doc.Services {
+		groups = append(groups, svc.Groups...)
+	}
+	var ops []ir.Operation
+	for len(groups) > 0 {
+		g := groups[0]
+		groups = append(groups[1:], g.Groups...)
+		for _, op := range g.Operations {
+			if op.Name.Source == name {
+				ops = append(ops, op)
+			}
+		}
+	}
+	return ops
+}
+
+// paramByName returns the operation's logical parameter with the given source
+// name.
+func paramByName(op ir.Operation, name string) (ir.Parameter, bool) {
+	for _, p := range op.Params {
+		if p.Name.Source == name {
+			return p, true
+		}
+	}
+	return ir.Parameter{}, false
+}
+
+// propByWire returns the property of m with the given wire name.
+func propByWire(m *ir.Model, wire string) (ir.Property, bool) {
+	for _, p := range m.Properties {
+		if p.WireName == wire {
+			return p, true
+		}
+	}
+	return ir.Property{}, false
+}
+
+// headerByWire returns the response header with the given wire name.
+func headerByWire(headers []ir.Property, wire string) (ir.Property, bool) {
+	for _, h := range headers {
+		if h.WireName == wire {
+			return h, true
+		}
+	}
+	return ir.Property{}, false
+}
+
+// firstContent returns an operation's single success-response content.
+func firstContent(t *testing.T, op ir.Operation) ir.Content {
+	t.Helper()
+	require.Len(t, op.Responses, 1)
+	require.NotNil(t, op.Responses[0].Payload)
+	require.Len(t, op.Responses[0].Payload.Contents, 1)
+	return op.Responses[0].Payload.Contents[0]
+}
+
+// requestContent returns an operation's single request-body content.
+func requestContent(t *testing.T, op ir.Operation) ir.Content {
+	t.Helper()
+	require.NotNil(t, op.Request)
+	require.Len(t, op.Request.Contents, 1)
+	return op.Request.Contents[0]
+}
+
+// withoutVersion encodes doc with what records the declared version set aside:
+// its source entries, which name the format and hash the bytes, and its
+// diagnostics, which the test compares apart.
+func withoutVersion(t *testing.T, doc *ir.Document) string {
+	t.Helper()
+	stripped := *doc
+	stripped.Sources = nil
+	stripped.Diagnostics = nil
+	out, err := json.Marshal(&stripped, json.Deterministic(true))
+	require.NoError(t, err)
+	return string(out)
+}
+
+// unmodeledSite is one Unmodeled entry paired with the walk path of the map
+// holding it.
+type unmodeledSite struct {
+	key   string
+	path  string
+	entry ir.UnmodeledEntry
+}
+
+// unmodeledSites returns every Unmodeled entry the document holds. It walks the
+// value graph rather than naming carriers so that a test asserting "this is kept
+// somewhere sensible" cannot pass by looking only where it expected to.
+func unmodeledSites(doc *ir.Document) []unmodeledSite {
+	unmodeledType := reflect.TypeFor[ir.Unmodeled]()
+	var out []unmodeledSite
+	ir.WalkValues(doc, ir.DocumentPath, func(v reflect.Value, path string) bool {
+		if v.Type() != unmodeledType || !v.CanInterface() {
+			return true
+		}
+		u, ok := reflect.TypeAssert[ir.Unmodeled](v)
+		if !ok {
+			return true
+		}
+		for key, entry := range u {
+			out = append(out, unmodeledSite{key: key, path: path, entry: entry})
+		}
+		return true
+	})
+	return out
+}
+
+// findUnmodeled returns the site holding key with the given JSON value. The
+// value is part of the match because one key spelling occurs at many carriers —
+// "openapi:x-mark" is written on a dozen objects in this fixture — so matching
+// on the key alone would find a different object's entry and call it a pass.
+func findUnmodeled(sites []unmodeledSite, key, wantJSON string) (unmodeledSite, bool) {
+	for _, site := range sites {
+		if site.key == key && string(site.entry.Value) == wantJSON {
+			return site, true
+		}
+	}
+	return unmodeledSite{}, false
+}
+
+// unmodeledEntry returns the Unmodeled entry at key, failing when absent.
+func unmodeledEntry(t *testing.T, p ir.Unmodeled, key string) ir.UnmodeledEntry {
+	t.Helper()
+	entry, ok := p[key]
+	require.True(t, ok, "%s kept verbatim; got %v", key, p)
+	return entry
+}
+
 // assertHasErrorCode requires diags to carry an error-severity diagnostic with
 // the given code.
 func assertHasErrorCode(t *testing.T, diags []ir.Diagnostic, code string) {
 	t.Helper()
 	openapitest.AssertHasCode(t, diags, code, ir.SeverityError)
 }
+
+// assertNoErrorDiags fails when any diagnostic has error severity.
+func assertNoErrorDiags(t *testing.T, diags []ir.Diagnostic) {
+	t.Helper()
+	assertOnlyErrorDiags(t, diags, nil)
+}
+
+// diagsAt returns the severities of the diagnostics coded code at pointer.
+func diagsAt(diags []ir.Diagnostic, code, pointer string) []ir.Severity {
+	var out []ir.Severity
+	for _, d := range diags {
+		if d.Code == code && d.Provenance.Pointer == jsontext.Pointer(pointer) {
+			out = append(out, d.Severity)
+		}
+	}
+	return out
+}
+
+// hasErrorRef reports whether the diagnostics carry an error-severity
+// unresolved-ref finding — the signal that an offending entry was dropped.
+func hasErrorRef(diags []ir.Diagnostic) bool {
+	return slices.ContainsFunc(diags, func(d ir.Diagnostic) bool {
+		return d.Severity == ir.SeverityError && d.Code == "openapi/unresolved-ref"
+	})
+}
+
+// unresolvedRefs returns the unresolved-ref findings among diags.
+func unresolvedRefs(diags []ir.Diagnostic) []ir.Diagnostic {
+	var out []ir.Diagnostic
+	for _, d := range diags {
+		if d.Code == diag.UnresolvedRef {
+			out = append(out, d)
+		}
+	}
+	return out
+}
diff --git a/compilers/openapi/e2e/later_version_test.go b/compilers/openapi/e2e/later_version_test.go
index e37058e8..f60eec75 100644
--- a/compilers/openapi/e2e/later_version_test.go
+++ b/compilers/openapi/e2e/later_version_test.go
@@ -1,7 +1,6 @@
 package e2e_test
 
 import (
-	"encoding/json/v2"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -108,16 +107,3 @@ func TestLaterVersionConstructs_LowerAsInTheVersionThatAddedThem(t *testing.T) {
 	assert.Subset(t, later30, later31, "what 3.2 added is owed to 3.0 as to 3.1")
 	assert.Greater(t, len(later30), len(later31), "and what 3.1 added to 3.0 alone")
 }
-
-// withoutVersion encodes doc with what records the declared version set aside:
-// its source entries, which name the format and hash the bytes, and its
-// diagnostics, which the test compares apart.
-func withoutVersion(t *testing.T, doc *ir.Document) string {
-	t.Helper()
-	stripped := *doc
-	stripped.Sources = nil
-	stripped.Diagnostics = nil
-	out, err := json.Marshal(&stripped, json.Deterministic(true))
-	require.NoError(t, err)
-	return string(out)
-}
diff --git a/compilers/openapi/e2e/refusal_order_test.go b/compilers/openapi/e2e/refusal_order_test.go
index 92172b04..019f17e2 100644
--- a/compilers/openapi/e2e/refusal_order_test.go
+++ b/compilers/openapi/e2e/refusal_order_test.go
@@ -9,7 +9,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	yaml "gopkg.in/yaml.v3"
 
 	"github.com/dexpace/morphic/compilers"
 	"github.com/dexpace/morphic/compilers/openapi"
@@ -71,27 +70,6 @@ func refGraphDoc(r *rand.Rand) string {
 	return b.String()
 }
 
-// reversed is src with every mapping's entries in reverse order.
-func reversed(t *testing.T, src string) []byte {
-	t.Helper()
-	var root yaml.Node
-	require.NoError(t, yaml.Unmarshal([]byte(src), &root))
-	stack := []*yaml.Node{&root}
-	for len(stack) > 0 {
-		n := stack[len(stack)-1]
-		stack = stack[:len(stack)-1]
-		if n.Kind == yaml.MappingNode {
-			pairs := slices.Collect(slices.Chunk(n.Content, 2))
-			slices.Reverse(pairs)
-			n.Content = slices.Concat(pairs...)
-		}
-		stack = append(stack, n.Content...)
-	}
-	out, err := yaml.Marshal(&root)
-	require.NoError(t, err)
-	return out
-}
-
 // cycleRefusals compiles data and returns its cycle refusals and cycle-scan
 // warnings, each as its code, pointer and message, sorted.
 func cycleRefusals(t *testing.T, data []byte) []string {
diff --git a/compilers/openapi/e2e/reuse_corpus_test.go b/compilers/openapi/e2e/reuse_corpus_test.go
index 540769f7..3ed594e5 100644
--- a/compilers/openapi/e2e/reuse_corpus_test.go
+++ b/compilers/openapi/e2e/reuse_corpus_test.go
@@ -15,7 +15,6 @@ import (
 
 	"github.com/dexpace/morphic/compilers"
 	"github.com/dexpace/morphic/compilers/openapi"
-	"github.com/dexpace/morphic/internal/harness"
 )
 
 // TestReuse_MatchesAFreshParseAcrossTheCorpus sweeps every committed spec
@@ -78,13 +77,3 @@ func encodeDoc(t *testing.T, doc any) string {
 
 // corpusRoot is every committed spec directory, addressed relative to this file.
 const corpusRoot = "../../../testdata"
-
-// corpusSpecs lists every committed spec under testdata, as harness.SpecFiles
-// lists a directory.
-func corpusSpecs(t *testing.T) []string {
-	t.Helper()
-	out, err := harness.SpecFiles(t.Context(), corpusRoot)
-	require.NoError(t, err)
-	require.NotEmpty(t, out, "corpus sweep found no specs")
-	return out
-}

From 085f4edf0c2096aa68a644f61c7c4593a3d298e8 Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 21:49:10 +0300
Subject: [PATCH 03/11] test(compilers/openapi): split the conformance
 assertions by family

conformance_test.go was 4,659 lines: the corpus runner, its table and
138 assertions. Adding or finding a case meant scrolling past every
other construct's.

The runner, the table and the corpus's own reader stay in
conformance_test.go. Each case's assertion moves to the family file of
its construct (conformance_types_test.go,
conformance_composition_test.go, conformance_params_test.go and so on),
with every helper only that family uses, beside the
conformance_unmodeled_test.go that already grouped the Unmodeled
assertions. The table keeps its order and the declarations are
byte-identical.
---
 .../e2e/conformance_composition_test.go       |  551 +++
 .../openapi/e2e/conformance_content_test.go   |  282 ++
 .../openapi/e2e/conformance_docs_test.go      |  306 ++
 .../e2e/conformance_extensions_test.go        |  179 +
 .../e2e/conformance_nullability_test.go       |  197 +
 .../e2e/conformance_operations_test.go        |  173 +
 .../openapi/e2e/conformance_params_test.go    |  555 +++
 .../openapi/e2e/conformance_pathitems_test.go |  310 ++
 .../openapi/e2e/conformance_responses_test.go |  145 +
 .../openapi/e2e/conformance_scalars_test.go   |  408 ++
 .../openapi/e2e/conformance_security_test.go  |  184 +
 compilers/openapi/e2e/conformance_test.go     | 4198 -----------------
 .../openapi/e2e/conformance_types_test.go     |  567 +++
 .../e2e/conformance_validation_test.go        |  131 +
 .../openapi/e2e/conformance_values_test.go    |  380 ++
 15 files changed, 4368 insertions(+), 4198 deletions(-)
 create mode 100644 compilers/openapi/e2e/conformance_composition_test.go
 create mode 100644 compilers/openapi/e2e/conformance_content_test.go
 create mode 100644 compilers/openapi/e2e/conformance_docs_test.go
 create mode 100644 compilers/openapi/e2e/conformance_extensions_test.go
 create mode 100644 compilers/openapi/e2e/conformance_nullability_test.go
 create mode 100644 compilers/openapi/e2e/conformance_operations_test.go
 create mode 100644 compilers/openapi/e2e/conformance_params_test.go
 create mode 100644 compilers/openapi/e2e/conformance_pathitems_test.go
 create mode 100644 compilers/openapi/e2e/conformance_responses_test.go
 create mode 100644 compilers/openapi/e2e/conformance_scalars_test.go
 create mode 100644 compilers/openapi/e2e/conformance_security_test.go
 create mode 100644 compilers/openapi/e2e/conformance_types_test.go
 create mode 100644 compilers/openapi/e2e/conformance_validation_test.go
 create mode 100644 compilers/openapi/e2e/conformance_values_test.go

diff --git a/compilers/openapi/e2e/conformance_composition_test.go b/compilers/openapi/e2e/conformance_composition_test.go
new file mode 100644
index 00000000..a319a18d
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_composition_test.go
@@ -0,0 +1,551 @@
+package e2e_test
+
+import (
+	"encoding/json/jsontext"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+	"github.com/dexpace/morphic/pass"
+)
+
+func assertAllOfInheritance(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	d, ok := doc.Types[namedID("Derived")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, d.Base, "sole allOf $ref becomes Base")
+	assert.Equal(t, namedID("Base"), d.Base.Target)
+	assert.Empty(t, d.Mixins)
+	_, ok = propByWire(d, "extra")
+	assert.True(t, ok, "property declared alongside allOf survives")
+	// Model-level detail declared alongside allOf must be captured, not dropped.
+	assert.Equal(t, "A Base specialized with one extra field.", d.Docs.Description,
+		"composed schema keeps its description")
+	assert.NotNil(t, d.Deprecation, "composed schema keeps deprecated")
+	assert.Equal(t, ir.AdditionalClosed, d.Additional,
+		"composed schema keeps additionalProperties: false")
+	assert.Contains(t, d.Unmodeled, "openapi:x-team", "composed schema keeps x-* extensions")
+}
+
+func assertAllOfMixins(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	c, ok := doc.Types[namedID("C")].(*ir.Model)
+	require.True(t, ok)
+	assert.Nil(t, c.Base, "multiple non-hierarchy refs stay Mixins, none is Base")
+	require.Len(t, c.Mixins, 2)
+	assert.Equal(t, namedID("A"), c.Mixins[0].Target)
+	assert.Equal(t, namedID("B"), c.Mixins[1].Target)
+}
+
+func assertAllOfInlineMerge(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("Merged")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, m.Base)
+	assert.Equal(t, namedID("Base"), m.Base.Target)
+	_, ok = propByWire(m, "name")
+	assert.True(t, ok, "inline allOf branch contributes its properties")
+}
+
+// assertAllOfNestedInline pins the flattening of
+// docs/compilers/openapi.md#allof-classification: a nested spelling classifies
+// as the flat one does and keeps each property's own pointer. A wrapper writing
+// nothing else is kept nowhere; one that also writes a keyword is kept whole,
+// with one diagnostic.
+func assertAllOfNestedInline(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("M")].(*ir.Model)
+	require.True(t, ok)
+	assert.Nil(t, m.Base, "two refs and no hierarchy: none is Base")
+	require.Len(t, m.Mixins, 2)
+	assert.Equal(t, namedID("A"), m.Mixins[0].Target)
+	assert.Equal(t, namedID("B"), m.Mixins[1].Target)
+	assert.Empty(t, m.Unmodeled, "the wrapper is flattened, not kept verbatim")
+
+	n, ok := doc.Types[namedID("Nested2")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, n.Base, "the sole ref two wrappers down is the Base")
+	assert.Equal(t, namedID("A"), n.Base.Target)
+	c, ok := propByWire(n, "c")
+	require.True(t, ok)
+	assert.Equal(t, jsontext.Pointer("/components/schemas/Nested2/allOf/0/allOf/1/properties/c"),
+		c.Provenance.Pointer)
+
+	mixed, ok := doc.Types[namedID("Mixed")].(*ir.Model)
+	require.True(t, ok)
+	mc, ok := propByWire(mixed, "c")
+	require.True(t, ok)
+	assert.True(t, mc.Required, "the wrapper's required list reaches the property inside it")
+	wires := make([]string, 0, len(mixed.Properties))
+	for _, p := range mixed.Properties {
+		wires = append(wires, p.WireName)
+	}
+	assert.Equal(t, []string{"c", "w"}, wires, "the wrapper's own property merges after its branches'")
+
+	closed, ok := doc.Types[namedID("Closed")].(*ir.Model)
+	require.True(t, ok)
+	assert.Equal(t, ir.AdditionalClosed, closed.Additional, "a false inside a wrapper still closes")
+	assert.Contains(t, closed.Unmodeled, "openapi:allOf/0/allOf/0")
+	assert.NotContains(t, closed.Unmodeled, "openapi:allOf/0")
+
+	described, ok := doc.Types[namedID("Described")].(*ir.Model)
+	require.True(t, ok)
+	assert.Nil(t, described.Base)
+	require.Len(t, described.Mixins, 2, "the wrapper's refs compose despite its description")
+	assert.Equal(t, namedID("A"), described.Mixins[0].Target)
+	assert.Equal(t, namedID("B"), described.Mixins[1].Target)
+	assert.Contains(t, described.Unmodeled, "openapi:allOf/0", "the wrapper is kept whole")
+
+	for _, id := range []ir.TypeID{"t/composed/components/schemas/U/oneOf/0", "t/composed/components/schemas/U/oneOf/1"} {
+		variant, ok := doc.Types[id].(*ir.Model)
+		require.True(t, ok, "%s should be a composed variant", id)
+		assert.Equal(t, ir.AdditionalClosed, variant.Additional, "%s: a false nested beside a oneOf closes every variant", id)
+		assert.Contains(t, variant.Unmodeled, "openapi:allOf/0/allOf/2/allOf/0", "%s keeps the false at its path", id)
+		a, ok := propByWire(variant, "a")
+		require.True(t, ok, id)
+		assert.True(t, a.Required, "%s: the wrapper's required list reaches the variant's property", id)
+	}
+
+	for _, d := range diags {
+		if d.Code == diag.DegradedConstruct && d.Provenance.Pointer == "/components/schemas/Described/allOf/0" {
+			continue // the one kept wrapper
+		}
+		assert.NotEqual(t, diag.DegradedConstruct, d.Code, "flattening is exact: %+v", d)
+	}
+}
+
+func assertAllOfRequiredOnly(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	d, ok := doc.Types[namedID("Derived")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, d.Base, "the $ref branch still becomes Base")
+	name, ok := propByWire(d, "name")
+	require.True(t, ok, "the inline branch's own property survives")
+	assert.True(t, name.Required,
+		"a required-only allOf branch attaches across the whole composition, not just its own properties map (issue #29)")
+}
+
+// assertRequiredMembers pins where a `required` name lands when no property of
+// the object it is written for declares it (ir-design §4.3): in Model.Requires,
+// once, beside the Required on the properties it does name. The four shapes are
+// four ways an object lowers: a plain object, an allOf making a property its
+// base declares required, an object whose catch-all governs the name, which
+// stays a Model rather than becoming a map since a map requires no key, and the
+// object variant of a multi-typed schema.
+func assertRequiredMembers(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	plain, ok := doc.Types[namedID("Plain")].(*ir.Model)
+	require.True(t, ok)
+	id, ok := propByWire(plain, "id")
+	require.True(t, ok)
+	assert.True(t, id.Required, "a declared name is Required on its property")
+	assert.Equal(t, []string{"ghost"}, plain.Requires, "an undeclared one is listed, and the declared one is not")
+
+	created, ok := doc.Types[namedID("CreatedUser")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, created.Base)
+	assert.Equal(t, namedID("User"), created.Base.Target)
+	assert.Empty(t, created.Properties, "the base declares id, so the composed model has no property for it")
+	assert.Equal(t, []string{"id"}, created.Requires, "the inherited property it makes required")
+	user, ok := doc.Types[namedID("User")].(*ir.Model)
+	require.True(t, ok)
+	assert.Empty(t, user.Requires, "the base is not made to require what only its subtype does")
+	userID, ok := propByWire(user, "id")
+	require.True(t, ok)
+	assert.False(t, userID.Required, "and its own property stays optional")
+
+	tagged, ok := doc.Types[namedID("Tagged")].(*ir.Model)
+	require.True(t, ok, "a required name beside a catch-all keeps the object a Model, not a map")
+	assert.NotNil(t, tagged.AdditionalProps)
+	assert.Empty(t, tagged.Properties)
+	assert.Equal(t, []string{"a"}, tagged.Requires, "required only because the catch-all governs it")
+	_, isMap := ir.AsMap(tagged)
+	assert.False(t, isMap, "AsMap keeps a model that requires a member a Model")
+
+	either, ok := doc.Types[namedID("Either")].(*ir.Union)
+	require.True(t, ok)
+	var object *ir.Model
+	for _, v := range either.Variants {
+		if m, isModel := doc.Types[v.Type.Target].(*ir.Model); isModel {
+			object = m
+		}
+	}
+	require.NotNil(t, object, "the object variant is a Model")
+	variantID, ok := propByWire(object, "id")
+	require.True(t, ok)
+	assert.True(t, variantID.Required)
+	assert.Equal(t, []string{"extra"}, object.Requires, "the variant lists what it declares nowhere")
+}
+
+// assertAllOfOneOfCooccurrence pins both halves of the co-declared composition
+// rule: §4.3 distributes a union whose branches all name referents, and the
+// rule docs/compilers/openapi.md#union-beside-structure keeps one with an
+// inline branch verbatim rather than distributing it halfway. The verbatim half
+// is covered over a model body, which owns a node already, and over a scalar
+// one, which does not — there the alias hoisted for the union carries what the
+// position wrote beside it too. The outside reference to a branch pointer pins
+// the third thing: a composed variant is Morphic's own node, so it cannot be
+// taken by, or take from, a $ref.
+func assertAllOfOneOfCooccurrence(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	combo, ok := doc.Types[namedID("Combo")].(*ir.Union)
+	require.True(t, ok, "the union is the value, not a preserved sibling")
+	require.Len(t, combo.Variants, 2)
+	for i, branch := range []string{"A", "B"} {
+		v, ok := doc.Types[combo.Variants[i].Type.Target].(*ir.Model)
+		require.True(t, ok, "variant %d composes as a model", i)
+		require.NotNil(t, v.Base, "the allOf composition rides on every variant")
+		assert.Equal(t, namedID("Base"), v.Base.Target)
+		require.Len(t, v.Mixins, 1)
+		assert.Equal(t, namedID(branch), v.Mixins[0].Target)
+		require.NotNil(t, v.Constraints, "the enclosing schema's own minProperties rides on every variant too (GitHub #407)")
+		require.NotNil(t, v.Constraints.MinProps)
+		assert.Equal(t, int64(2), *v.Constraints.MinProps)
+	}
+
+	mixed, ok := doc.Types[namedID("MixedKinds")].(*ir.Model)
+	require.True(t, ok, "the structural body survives")
+	entry, ok := mixed.Unmodeled["openapi:oneOf"]
+	require.True(t, ok, "and the union it could not absorb survives beside it")
+	assert.Equal(t, ir.ReasonDegradedLowering, entry.Reason)
+
+	bounded, ok := doc.Types[namedID("BoundedKinds")].(*ir.Scalar)
+	require.True(t, ok, "a body that is not a model reduces to a shared primitive and hoists an alias")
+	entry, ok = bounded.Unmodeled["openapi:oneOf"]
+	require.True(t, ok, "which is the node the kept union sits on")
+	assert.Equal(t, ir.ReasonDegradedLowering, entry.Reason)
+	require.NotNil(t, bounded.Constraints, "and the bounds written beside the union sit on it too")
+	require.NotNil(t, bounded.Constraints.MinLength)
+	assert.Equal(t, int64(3), *bounded.Constraints.MinLength)
+
+	outsider, ok := doc.Types[namedID("Outsider")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, outsider.Properties, 1)
+	branchNode, ok := doc.Types[outsider.Properties[0].Type.Target].(*ir.Scalar)
+	require.True(t, ok, "the branch pointer hoists an alias of what the branch references")
+	require.NotNil(t, branchNode.Base)
+	assert.Equal(t, namedID("A"), branchNode.Base.Target,
+		"the reference gets the branch schema, never the variant composed for that branch")
+
+	assertInlineBranchHint(t, doc)
+}
+
+// assertInlineBranchHint pins the hint an inline composition branch takes when
+// an outside reference names its pointer too. The union reaches that node
+// through its composition, and the reference builds it (hoistSubSchema) only
+// where nothing else did, under the hint the composition recorded. An inline
+// branch has only its position to be named by, and the reference path once used
+// the bare ordinal "0" (GitHub #181). The value is asserted because the golden
+// records whichever hint won without saying the two agree, and the corpus
+// carries the shape so the two-order oracle covers it.
+func assertInlineBranchHint(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	const branchID = ir.TypeID("t/anon/components/schemas/InlineHost/oneOf/0")
+
+	host, ok := doc.Types[namedID("InlineHost")].(*ir.Union)
+	require.True(t, ok, "the inline union is the value")
+	require.Len(t, host.Variants, 2)
+	assert.Equal(t, branchID, host.Variants[0].Type.Target,
+		"the union's first variant is the node the branch pointer owns")
+
+	branch, ok := doc.Types[branchID]
+	require.True(t, ok, "the branch pointer owns a node")
+	assert.Equal(t, "variant_0", branch.Common().Name.Hint,
+		"named by position, which is all an inline branch has to be named by")
+
+	outsider, ok := doc.Types[namedID("InlineOutsider")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, outsider.Properties, 1)
+	assert.Equal(t, branchID, outsider.Properties[0].Type.Target,
+		"the outside reference resolves to that same node rather than hoisting a second")
+}
+
+// assertAllOfPositionConstraints pins GitHub #407: a value constraint written
+// beside an allOf composing position reaches the same ir.Model.Constraints
+// field a plain object's does, rather than falling to Unmodeled under a
+// diagnostic that claims the node has no home for it — the node demonstrably
+// does, since ViaModel's sibling proves the field exists and is read.
+func assertAllOfPositionConstraints(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	viaModel, ok := doc.Types[namedID("ViaModel")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, viaModel.Constraints)
+	require.NotNil(t, viaModel.Constraints.MinProps)
+	assert.Equal(t, int64(2), *viaModel.Constraints.MinProps)
+
+	viaAllOf, ok := doc.Types[namedID("ViaAllOf")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, viaAllOf.Base, "the sole allOf $ref still becomes Base")
+	assert.Equal(t, namedID("Base"), viaAllOf.Base.Target)
+	require.NotNil(t, viaAllOf.Constraints, "the composing position's own minProperties reaches the model it built, exactly as a plain object's does")
+	require.NotNil(t, viaAllOf.Constraints.MinProps)
+	assert.Equal(t, int64(2), *viaAllOf.Constraints.MinProps)
+	assert.NotContains(t, viaAllOf.Unmodeled, "openapi:minProperties",
+		"minProperties has a home now, so it is not also kept verbatim")
+	assert.Empty(t, diagsAt(diags, diag.DegradedConstruct, "/components/schemas/ViaAllOf"),
+		"and no diagnostic claims the node has no home for it")
+}
+
+func assertOneOfDiscriminated(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	pet, ok := doc.Types[namedID("Pet")].(*ir.Union)
+	require.True(t, ok, "oneOf survives as a Union node, never collapsed")
+	assert.True(t, pet.Exclusive)
+	assert.True(t, pet.WireTagged, "the discriminator's tag names the variant")
+	require.Len(t, pet.Variants, 2)
+	require.NotNil(t, pet.Discriminator)
+	assert.Equal(t, "petType", pet.Discriminator.PropertyName)
+	assert.Equal(t, namedID("Cat"), pet.Discriminator.Mapping["cat"])
+	assert.Equal(t, namedID("Dog"), pet.Discriminator.Mapping["dog"])
+}
+
+// assertAnyOfDiscriminated pins that the tag mode and Exclusive are independent
+// (ir-design §4.4): a discriminator on an anyOf tags the union without making
+// it exclusive, since a payload may still satisfy both branches.
+func assertAnyOfDiscriminated(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	u, ok := doc.Types[namedID("Resource")].(*ir.Union)
+	require.True(t, ok, "anyOf survives as a Union node, never collapsed")
+	assert.False(t, u.Exclusive, "anyOf admits a payload both branches satisfy")
+	assert.True(t, u.WireTagged, "the discriminator's tag names the variant")
+	require.Len(t, u.Variants, 2)
+	require.NotNil(t, u.Discriminator)
+	assert.Equal(t, "kind", u.Discriminator.PropertyName)
+	assert.Equal(t, namedID("Named"), u.Discriminator.Mapping["named"])
+	assert.Equal(t, namedID("Labelled"), u.Discriminator.Mapping["labelled"])
+}
+
+// assertDiscriminatorInheritance covers the model-hierarchy form of a
+// discriminator, which the union form (oneof-discriminated) does not reach: the
+// tag is declared on the base, each subtype composes the base by $ref, and the
+// wire value each subtype answers to is recorded on the subtype.
+//
+// Both spellings of that value are pinned, because they come from different
+// places: a subtype the base's mapping names takes the mapping key, and one the
+// mapping omits takes OpenAPI's implicit schema name.
+func assertDiscriminatorInheritance(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
+	require.True(t, ok, "the base is a Model, not a Union")
+	require.NotNil(t, pet.Discriminator)
+	tag, ok := propByWire(pet, "petType")
+	require.True(t, ok, "the base declares the tag property itself")
+	assert.Equal(t, tag.ID, pet.Discriminator.Property,
+		"a declared tag property binds by identity, not by wire name")
+	assert.Empty(t, pet.Discriminator.PropertyName,
+		"the name spelling is for a tag no property declares")
+	assert.Equal(t, namedID("Cat"), pet.Discriminator.Mapping["cat"])
+
+	for name, value := range map[string]string{"Cat": "cat", "Dog": "Dog"} {
+		sub, ok := doc.Types[namedID(name)].(*ir.Model)
+		require.True(t, ok, "%s composes as a Model", name)
+		require.NotNil(t, sub.Base, "the discriminated base becomes Base, not a Mixin")
+		assert.Equal(t, namedID("Pet"), sub.Base.Target)
+		assert.Equal(t, value, sub.DiscriminatorValue)
+		assert.Nil(t, sub.Discriminator, "a subtype does not restate its base's discriminator")
+	}
+}
+
+// assertDiscriminatorInlineSubtype covers the subtypes OpenAPI's implicit
+// mapping cannot name (GitHub #517). The implicit tag is the name of the
+// component schema that declares a subtype, so one declared inline — as a
+// property or a union branch — takes no tag, while it still composes the
+// discriminated base. Kennel's Dog shares its key with the component Dog on
+// purpose: a tag read off the pointer gives both the same value.
+func assertDiscriminatorInlineSubtype(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
+	require.True(t, ok, "the base is a Model")
+	require.NotNil(t, pet.Discriminator)
+	assert.Empty(t, pet.Discriminator.Mapping, "every tag in this document is implicit")
+
+	for _, tc := range []struct {
+		id    ir.TypeID
+		value string
+	}{
+		{namedID("Dog"), "Dog"},
+		{"t/anon/components/schemas/Kennel/properties/Dog", ""},
+		{"t/anon/components/schemas/Kennel/properties/pet", ""},
+		{"t/anon/components/schemas/Either/oneOf/0", ""},
+	} {
+		sub, ok := doc.Types[tc.id].(*ir.Model)
+		require.True(t, ok, "%s composes as a Model", tc.id)
+		require.NotNil(t, sub.Base, "%s composes the discriminated base", tc.id)
+		assert.Equal(t, namedID("Pet"), sub.Base.Target)
+		assert.Equal(t, tc.value, sub.DiscriminatorValue,
+			"%s: only a component schema has a name to answer to", tc.id)
+	}
+}
+
+// assertDiscriminatorTransitive covers a hierarchy deeper than the two levels
+// discriminator-inheritance reaches: the subtype's own allOf branch names an
+// intermediate schema that declares no discriminator, so the tag value can only
+// come from an ancestor further up (GitHub #305). What each subtype composes is
+// pinned beside its tag, since depth is the point. The undiscriminated chain
+// beside them is the boundary: depth alone must not manufacture a value. Puppy
+// is named by the mapping, routing a wire value straight onto a grandchild;
+// Whelp is named by nothing and answers to its own schema name three hops down.
+func assertDiscriminatorTransitive(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
+	require.True(t, ok, "the root of the hierarchy is a Model")
+	require.NotNil(t, pet.Discriminator)
+	assert.Equal(t, namedID("Dog"), pet.Discriminator.Mapping["dog"])
+	assert.Equal(t, namedID("Puppy"), pet.Discriminator.Mapping["puppy"],
+		"the base maps a wire value straight onto its grandchild")
+
+	// base is the schema each subtype's own allOf branch names, which is the only
+	// thing a one-hop reading of the chain could see.
+	for _, tc := range []struct{ name, base, value string }{
+		{"Dog", "Pet", "dog"},
+		{"Puppy", "Dog", "puppy"},
+		{"Whelp", "Puppy", "Whelp"},
+	} {
+		sub, ok := doc.Types[namedID(tc.name)].(*ir.Model)
+		require.True(t, ok, "%s composes as a Model", tc.name)
+		require.NotNil(t, sub.Base, "%s composes a base", tc.name)
+		assert.Equal(t, namedID(tc.base), sub.Base.Target,
+			"%s composes %s, not the schema anchoring the hierarchy", tc.name, tc.base)
+		assert.Equal(t, tc.value, sub.DiscriminatorValue,
+			"%s answers to the tag its ancestor spells for it", tc.name)
+		assert.Nil(t, sub.Discriminator, "a subtype does not restate the hierarchy's discriminator")
+	}
+
+	for _, name := range []string{"Shrub", "Sapling"} {
+		sub, ok := doc.Types[namedID(name)].(*ir.Model)
+		require.True(t, ok, "%s composes as a Model", name)
+		require.NotNil(t, sub.Base, "%s composes a base", name)
+		assert.Empty(t, sub.DiscriminatorValue,
+			"%s has no discriminated ancestor, so walking the chain finds no tag", name)
+	}
+}
+
+// assertDiscriminatorAliasMapping covers a mapping that spells two keys for one
+// subtype (GitHub #410). Model.DiscriminatorValue holds one value and a mapping
+// is unordered, so the subtype takes the smallest key in byte order whichever
+// was written first — the fixture writes the larger first — while the base's
+// mapping keeps both, and the election is reported at the subtype as
+// information since nothing is lost.
+func assertDiscriminatorAliasMapping(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
+	require.True(t, ok, "the base is a Model")
+	require.NotNil(t, pet.Discriminator)
+	assert.Equal(t, map[string]ir.TypeID{"alpha": namedID("Dog"), "zulu": namedID("Dog")},
+		pet.Discriminator.Mapping, "the base keeps every key")
+
+	dog, ok := doc.Types[namedID("Dog")].(*ir.Model)
+	require.True(t, ok, "Dog composes as a Model")
+	assert.Equal(t, "alpha", dog.DiscriminatorValue,
+		"the smallest key in byte order, not the first written")
+	assert.True(t, openapitest.HasDiagCodeAt(diags, diag.DegradedConstruct, "/components/schemas/Dog"),
+		"the election is reported at the subtype: %+v", diags)
+}
+
+// assertDiscriminatorDefaultMapping pins Discriminator.Default, whose only source
+// is the 3.2 discriminator.defaultMapping — and with it that a 3.2-only schema
+// keyword compiles without an error diagnostic (GitHub #146). The library checks
+// every schema object against the 3.1 meta-schema whatever the document says, so
+// before this the spec below failed to compile and the field had no witness.
+func assertDiscriminatorDefaultMapping(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	assert.Empty(t, diagsAt(diags, "openapi/validation/validation-invalid-schema",
+		"/components/schemas/Pet/discriminator/defaultMapping"),
+		"a 3.2 keyword in a 3.2 document is not an invalid schema")
+
+	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, pet.Discriminator)
+	assert.Equal(t, namedID("Dog"), pet.Discriminator.Default,
+		"defaultMapping names the variant an unrecognized tag falls back to")
+	assert.Equal(t, namedID("Cat"), pet.Discriminator.Mapping["cat"],
+		"and it is read separately from the mapping")
+}
+
+// assertDiscriminatedUnionBesideModel pins where a discriminator goes when its
+// union is kept verbatim beside a model. Pet's and Animal's routes are not
+// subtypes of them, so pass.Validate would reject the discriminator on the
+// model; it moves whole to Unmodeled beside the union. Vehicle's object
+// variant holds one the same way. Shape's routes are true allOf subtypes, so
+// the model keeps it, and the document validates clean.
+func assertDiscriminatedUnionBesideModel(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	assert.Empty(t, pass.Validate(doc))
+
+	for _, name := range []string{"Pet", "Animal"} {
+		m, ok := doc.Types[namedID(name)].(*ir.Model)
+		require.True(t, ok, name)
+		assert.Nil(t, m.Discriminator, "%s routes to a non-subtype, so the model does not carry it", name)
+		entry, ok := m.Unmodeled["openapi:discriminator"]
+		require.True(t, ok, "%s keeps it verbatim instead", name)
+		assert.Equal(t, ir.ReasonDegradedLowering, entry.Reason)
+		assert.Contains(t, m.Unmodeled, "openapi:oneOf", "beside the union it routes through")
+		assert.True(t, openapitest.HasDiagCodeAt(diags, diag.DegradedConstruct, "/components/schemas/"+name+"/discriminator"))
+	}
+	_, isUnion := doc.Types[namedID("Bird")].(*ir.Union)
+	assert.True(t, isUnion, "Bird writes allOf to Animal but lowers to a union, which is no subtype")
+
+	vehicle, ok := doc.Types[namedID("Vehicle")].(*ir.Union)
+	require.True(t, ok, "a multi-typed body lowers to a union")
+	assert.Contains(t, vehicle.Unmodeled, "openapi:discriminator", "kept beside the union it was written for")
+	variant, ok := doc.Types["t/anon/components/schemas/Vehicle/type/0"].(*ir.Model)
+	require.True(t, ok)
+	assert.Nil(t, variant.Discriminator, "the object variant does not carry it")
+
+	shape, ok := doc.Types[namedID("Shape")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, shape.Discriminator, "every target is a subtype, so it stays")
+	assert.Equal(t, namedID("Circle"), shape.Discriminator.Mapping["circle"])
+	assert.NotContains(t, shape.Unmodeled, "openapi:discriminator")
+}
+
+// assertNullableUnionDiscriminator pins that a discriminator beside a oneOf or
+// anyOf that collapses to nullable X is kept verbatim, with a diagnostic,
+// where the collapse leaves no node with a field for it.
+func assertNullableUnionDiscriminator(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	maybe, ok := doc.Types[namedID("MaybeCat")].(*ir.Scalar)
+	require.True(t, ok, "the component is an alias over the nullable reference")
+	assert.Equal(t, ir.TypeRef{Target: namedID("Cat"), Nullable: true}, *maybe.Base)
+	assert.Contains(t, maybe.Unmodeled, "openapi:discriminator")
+	assert.True(t, openapitest.HasDiagCodeAt(diags, diag.DegradedConstruct, "/components/schemas/MaybeCat"))
+
+	owner, ok := doc.Types[namedID("Owner")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, owner.Properties, 1)
+	assert.Equal(t, ir.TypeRef{Target: namedID("Cat"), Nullable: true}, owner.Properties[0].Type)
+	assert.Contains(t, owner.Properties[0].Unmodeled, "openapi:discriminator", "the property carries it")
+}
+
+func assertAnyOfUntagged(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	u, ok := doc.Types[namedID("StringOrNumber")].(*ir.Union)
+	require.True(t, ok)
+	assert.False(t, u.Exclusive, "anyOf is a non-exclusive union")
+	assert.False(t, u.WireTagged, "with no discriminator, validation infers the variant")
+	assert.Nil(t, u.Discriminator)
+	assert.Len(t, u.Variants, 2)
+}
+
+// assertUnionDecoratedBranch pins a union branch annotated the only way 3.0
+// can, by wrapping its $ref (GitHub #1018). The wrapper lowers to a decorator
+// over Pet that keeps the description, so no information is lost, and its
+// variant is named for Pet while the node keeps the positional hint.
+func assertUnionDecoratedBranch(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	u, ok := doc.Types[namedID("U")].(*ir.Union)
+	require.True(t, ok)
+	require.Len(t, u.Variants, 2)
+	assert.Equal(t, "user", u.Variants[0].Name.Hint)
+	assert.Equal(t, "pet", u.Variants[1].Name.Hint, "named for the $ref it wraps, as 3.1's sibling spelling is")
+
+	branch, ok := doc.Types[u.Variants[1].Type.Target].(*ir.Model)
+	require.True(t, ok, "the wrapped branch is a node of its own")
+	base, decorates := ir.Decorated(branch)
+	require.True(t, decorates, "a description beside the wrapped $ref is an annotation, not a shape")
+	assert.Equal(t, namedID("Pet"), base.Target)
+	assert.Equal(t, "a pet", branch.Docs.Description, "the annotation is kept")
+	assert.Equal(t, "variant_1", branch.Name.Hint, "the node keeps the positional hint")
+}
+
+func assertNegationNot(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("NotFoo")].(*ir.Model)
+	require.True(t, ok)
+	raw, ok := m.Unmodeled["openapi:not"]
+	require.True(t, ok, "not-keyword kept verbatim under Unmodeled")
+	assert.JSONEq(t, `{"required":["b"]}`, string(raw.Value))
+	assert.Equal(t, ir.ReasonValidationOnly, raw.Reason)
+	var found bool
+	for _, d := range diags {
+		if d.Code == "openapi/validation-only-keyword" {
+			found = true
+			assert.Equal(t, ir.SeverityInfo, d.Severity)
+		}
+	}
+	assert.True(t, found, "expected a validation-only-keyword info diagnostic")
+}
diff --git a/compilers/openapi/e2e/conformance_content_test.go b/compilers/openapi/e2e/conformance_content_test.go
new file mode 100644
index 00000000..e1dd7523
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_content_test.go
@@ -0,0 +1,282 @@
+package e2e_test
+
+import (
+	"maps"
+	"slices"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertMultiContent(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "getData")
+	require.True(t, ok)
+	require.Len(t, op.Responses, 1)
+	require.NotNil(t, op.Responses[0].Payload)
+	require.Len(t, op.Responses[0].Payload.Contents, 2, "both media types kept, no primary selection")
+	assert.Equal(t, "application/json", op.Responses[0].Payload.Contents[0].MediaType)
+	assert.Equal(t, "application/xml", op.Responses[0].Payload.Contents[1].MediaType)
+}
+
+func assertMultipartEncoding(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "upload")
+	require.True(t, ok)
+	require.NotNil(t, op.Request)
+	require.Len(t, op.Request.Contents, 1)
+	enc := op.Request.Contents[0].Encoding
+	require.NotEmpty(t, enc, "multipart parts carry PartEncoding keyed by PropID")
+	var sawFile, sawMulti bool
+	var fileHeaders []ir.Property
+	for _, pe := range enc {
+		if pe.Filename {
+			sawFile = true
+			fileHeaders = pe.Headers
+		}
+		if pe.Multi {
+			sawMulti = true
+		}
+	}
+	assert.True(t, sawFile, "binary file part carries Filename")
+	assert.True(t, sawMulti, "array part carries Multi")
+	assertPartHeaders(t, doc, fileHeaders)
+	assertFormPartStyle(t, doc)
+	assertComposedPartEncoding(t, doc)
+}
+
+// assertComposedPartEncoding pins the body that composes its parts rather than
+// declaring them. Reading only the schema node's own properties found none on an
+// allOf wrapper, so the whole encoding block was discarded with no diagnostic and
+// a Content that still looked well-formed, just smaller (GitHub #140).
+//
+// The keys are asserted to be the properties the IR actually holds: §4.3 keeps a
+// composed model's inherited parts on its Base, so a key derived from the
+// composed node's own pointer would name a property that exists nowhere.
+func assertComposedPartEncoding(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	op, ok := opByName(doc, "uploadComposed")
+	require.True(t, ok)
+	require.NotNil(t, op.Request)
+	require.Len(t, op.Request.Contents, 1)
+
+	enc := op.Request.Contents[0].Encoding
+	require.NotEmpty(t, enc, "a composed body keeps the encoding a declared one does")
+
+	inherited := ir.PropID("p/openapi/components/schemas/UploadForm/properties/file")
+	file, ok := enc[inherited]
+	require.True(t, ok, "the inherited part is keyed on the Base that holds it; got keys %v", enc)
+	assert.Equal(t, []string{"image/png"}, file.ContentTypes)
+	assert.True(t, file.Filename, "the structural flag is read off the merged type of the inherited part")
+
+	// Every key must name a property some type in the document declares. A part
+	// keyed by a PropID nothing holds is the failure this lowering can produce
+	// while still looking well-formed.
+	for id := range enc {
+		assert.True(t, propIDExists(doc, id), "encoding key %s names no property in the document", id)
+	}
+}
+
+// propIDExists reports whether any type in doc declares a property with the
+// given ID.
+func propIDExists(doc *ir.Document, id ir.PropID) bool {
+	for _, td := range doc.Types {
+		m, ok := td.(*ir.Model)
+		if !ok {
+			continue
+		}
+		if slices.ContainsFunc(m.Properties, func(p ir.Property) bool { return p.ID == id }) {
+			return true
+		}
+	}
+	return false
+}
+
+// assertFormPartStyle pins the form-serialization half of a part's encoding: a
+// urlencoded body's parts carry the same style/explode pair a query parameter
+// does, on the part rather than on any binding.
+func assertFormPartStyle(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	op, ok := opByName(doc, "submitForm")
+	require.True(t, ok)
+	require.NotNil(t, op.Request)
+	require.Len(t, op.Request.Contents, 1)
+	assert.Equal(t, "application/x-www-form-urlencoded", op.Request.Contents[0].MediaType)
+	enc := op.Request.Contents[0].Encoding
+	require.Len(t, enc, 1)
+	for _, pe := range enc {
+		assert.Equal(t, "form", pe.Style)
+		require.NotNil(t, pe.Explode)
+		assert.True(t, *pe.Explode)
+		assert.True(t, pe.Multi, "the structural flag is read off the part")
+	}
+	// allowReserved has no PartEncoding field, and PartEncoding has no Unmodeled
+	// map, so it is kept on the content keyed by the part it governs. Two
+	// documents differing only in it used to compile to one IR (GitHub #291).
+	entry := unmodeledEntry(t, op.Request.Contents[0].Unmodeled, "openapi:encoding/ids/allowReserved")
+	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+	assert.JSONEq(t, "true", string(entry.Value))
+}
+
+// assertFileBody pins a binary body: the payload's type degrades to bytes and the
+// media types it is carried as move onto Content.File, which is what tells an
+// emitter to generate a stream rather than a model. Both routes to that lowering
+// are covered — a media type with no schema at all, and a string+binary schema.
+func assertFileBody(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "putBlob")
+	require.True(t, ok)
+	require.NotNil(t, op.Request)
+	require.Len(t, op.Request.Contents, 1)
+	req := op.Request.Contents[0]
+	require.NotNil(t, req.File, "application/octet-stream with no schema is a file body")
+	assert.Equal(t, []string{"application/octet-stream"}, req.File.ContentTypes)
+	assert.Equal(t, ir.TypeID("t/prim/bytes"), req.Type.Target)
+
+	resp := firstContent(t, op)
+	require.NotNil(t, resp.File, "a string+binary schema is a file body whatever the media type")
+	assert.Equal(t, []string{"image/png"}, resp.File.ContentTypes)
+	assert.Equal(t, ir.TypeID("t/prim/bytes"), resp.Type.Target)
+}
+
+// assertMediaTypeSpelling pins that a media type is classified by its type alone
+// while the IR keeps the key as written. One content per classification: a
+// multipart body, a form-urlencoded body and a file body with no schema, the
+// last on both sides of an operation.
+func assertMediaTypeSpelling(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	upload, ok := opByName(doc, "upload")
+	require.True(t, ok)
+	multipart := requestContent(t, upload)
+	assert.Equal(t, "Multipart/Form-Data", multipart.MediaType)
+	require.Len(t, multipart.Encoding, 1, "a mixed-case multipart key keeps its part encoding")
+	for _, pe := range multipart.Encoding {
+		assert.Equal(t, []string{"image/png"}, pe.ContentTypes)
+		assert.True(t, pe.Filename)
+	}
+
+	submit, ok := opByName(doc, "submit")
+	require.True(t, ok)
+	form := requestContent(t, submit)
+	assert.Equal(t, "Application/X-WWW-Form-Urlencoded; charset=utf-8", form.MediaType)
+	require.Len(t, form.Encoding, 1, "a parameterized form-urlencoded key keeps its part encoding")
+	for _, pe := range form.Encoding {
+		assert.True(t, pe.Multi)
+	}
+
+	blob, ok := opByName(doc, "putBlob")
+	require.True(t, ok)
+	req := requestContent(t, blob)
+	require.NotNil(t, req.File, "a mixed-case octet-stream key with no schema is a file body")
+	assert.Equal(t, []string{"Application/Octet-Stream"}, req.File.ContentTypes)
+	assert.Equal(t, ir.TypeID("t/prim/bytes"), req.Type.Target)
+
+	resp := firstContent(t, blob)
+	require.NotNil(t, resp.File, "a parameterized octet-stream key with no schema is a file body")
+	assert.Equal(t, []string{"application/octet-stream; type=tar"}, resp.File.ContentTypes)
+	assert.Equal(t, ir.TypeID("t/prim/bytes"), resp.Type.Target)
+}
+
+// assertPartHeaders pins encoding.<part>.headers, a TypeRef position reachable
+// only through a PartEncoding and, before this case, exercised by no corpus
+// spec. It covers both hops a header takes — an inline schema and one behind a
+// $ref through components/headers — and requires each target to be in the
+// registry, which is what gives the referential-closure walker something to
+// check here.
+func assertPartHeaders(t *testing.T, doc *ir.Document, headers []ir.Property) {
+	t.Helper()
+	require.Len(t, headers, 2, "the file part declares two per-part headers")
+	byWire := make(map[string]ir.Property, len(headers))
+	for _, h := range headers {
+		byWire[h.WireName] = h
+	}
+
+	id, ok := byWire["X-Part-Id"]
+	require.True(t, ok, "inline part header lowered; got %v", byWire)
+	assert.Equal(t, ir.TypeID("t/prim/uuid"), id.Type.Target)
+	assert.True(t, id.Required, "a required part header keeps its presence bit")
+	assert.Equal(t, "per-part correlation id", id.Docs.Description)
+
+	sum, ok := byWire["X-Part-Checksum"]
+	require.True(t, ok, "$ref'd part header lowered; got %v", byWire)
+	assert.Equal(t, namedID("Digest"), sum.Type.Target, "a $ref'd header takes the referent's schema")
+	assert.Equal(t, "sha-256 digest of this part", sum.Docs.Description)
+	for _, h := range headers {
+		assert.Contains(t, doc.Types, h.Type.Target, "part header %q must reference a live node", h.WireName)
+	}
+}
+
+// assertSequentialMedia pins the 3.2 sequential-media lowering, including the
+// two forms per-item encoding takes: one Encoding governing every item lands in
+// Content.ItemEncoding, while a positional prefixEncoding — which a single
+// every-item encoding has no ordinals for — takes itself and the tail encoding
+// beside it into Unmodeled instead.
+//
+// It also pins what itemSchema says about the operation, which for a long while
+// was nothing: the keyword states that the body is a sequence of items, so the
+// operation streams, and it says so itself rather than being guessed at from
+// the media type — multipart/mixed is in no streaming media-type list.
+func assertSequentialMedia(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	events, ok := opByName(doc, "streamEvents")
+	require.True(t, ok)
+	c := firstContent(t, events)
+	require.NotNil(t, c.Item, "itemSchema becomes the element type")
+	require.NotNil(t, c.ItemEncoding, "an encoding governing every item lowers structurally")
+	assert.Equal(t, []string{"application/json"}, c.ItemEncoding.ContentTypes)
+	assert.True(t, c.ItemEncoding.Multi, "the construct describes a repeated tail")
+	assert.Empty(t, c.Unmodeled, "nothing is left over once it lowers")
+
+	assert.Equal(t, ir.StreamingServer, events.Streaming)
+	require.NotNil(t, events.ResponseStream)
+	require.NotNil(t, events.ResponseStream.Events)
+	assert.Empty(t, cmp.Diff(*c.Item, *events.ResponseStream.Events),
+		"the declared item schema is the stream element type")
+	assert.Empty(t, events.Provenance.Inferred, "a declared sequence is not a heuristic")
+
+	parts, ok := opByName(doc, "streamParts")
+	require.True(t, ok)
+	pc := firstContent(t, parts)
+	assert.Nil(t, pc.ItemEncoding, "positional prefixes have no every-item form")
+	for _, key := range []string{"openapi:prefixEncoding", "openapi:itemEncoding"} {
+		entry, ok := pc.Unmodeled[key]
+		require.True(t, ok, "%s kept verbatim; got %v", key, pc.Unmodeled)
+		assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+	}
+}
+
+// assertComponentMediaTypes32 pins a 3.2 document using components/mediaTypes
+// while this compiler resolves no reference into it (GitHub #856): nothing is
+// lost, as the section is kept whole and each content entry keeps its $ref, and
+// nothing the dialect defines is called undefined.
+func assertComponentMediaTypes32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	for _, name := range []string{"listEvents", "getEvent"} {
+		op, ok := opByName(doc, name)
+		require.True(t, ok)
+		content := op.Responses[0].Payload.Contents[0]
+		assert.Equal(t, "application/json", content.MediaType)
+		assert.Equal(t, ir.ReasonDegradedLowering, content.Unmodeled["openapi:$ref"].Reason,
+			"%s: the reference is kept, not followed", name)
+	}
+	assert.Equal(t, ir.ReasonNoIRHome, doc.Unmodeled["openapi:components/mediaTypes"].Reason)
+	assert.False(t, openapitest.HasDiag(diags, diag.UnknownObjectKey))
+	openapitest.AssertInfoDiagAt(t, diags, "/components/mediaTypes")
+}
+
+// assertNestedEncoding32 pins GitHub #615's nested Encoding fields: each is kept
+// verbatim under the part's own scope with one info, rather than drawing an
+// unknown-object-key warning and reaching no entry at all.
+func assertNestedEncoding32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "upload")
+	require.True(t, ok)
+	require.NotNil(t, op.Request)
+	content := op.Request.Contents[0]
+	for _, keyword := range []string{"encoding", "prefixEncoding"} {
+		entry, ok := content.Unmodeled["openapi:encoding/note/"+keyword]
+		require.True(t, ok, "%s is kept verbatim; got %v", keyword, slices.Sorted(maps.Keys(content.Unmodeled)))
+		assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+	}
+	assert.False(t, openapitest.HasDiag(diags, diag.UnknownObjectKey),
+		"3.2 defines these keys, so the census must leave them alone")
+}
diff --git a/compilers/openapi/e2e/conformance_docs_test.go b/compilers/openapi/e2e/conformance_docs_test.go
new file mode 100644
index 00000000..44d65296
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_docs_test.go
@@ -0,0 +1,306 @@
+package e2e_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertDeprecation(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "oldOp")
+	require.True(t, ok)
+	assert.NotNil(t, op.Deprecation)
+	m, ok := doc.Types[namedID("OldModel")].(*ir.Model)
+	require.True(t, ok)
+	assert.NotNil(t, m.Deprecation)
+	require.Len(t, m.Properties, 1)
+	assert.NotNil(t, m.Properties[0].Deprecation)
+
+	// A parameter is its own carrier: deprecated written on the parameter object
+	// reaches it without any schema being involved.
+	legacy, ok := paramByName(op, "legacy")
+	require.True(t, ok)
+	assert.NotNil(t, legacy.Deprecation)
+}
+
+func assertExamples(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+
+	// A schema that reduced to a shared primitive keeps its examples on the
+	// declaring property; one that hoists a node of its own keeps them there.
+	n, ok := propByWire(m, "n")
+	require.True(t, ok)
+	assert.Len(t, n.Examples, 2)
+	inner, ok := propByWire(m, "inner")
+	require.True(t, ok)
+	assert.Empty(t, inner.Examples, "an inline object holds its own examples")
+	require.Len(t, doc.Types[inner.Type.Target].Common().Examples, 1)
+
+	// A component's example belongs to the component, not to a use site.
+	c, ok := doc.Types[namedID("C")]
+	require.True(t, ok)
+	require.Len(t, c.Common().Examples, 1)
+	require.NotNil(t, c.Common().Examples[0].Value)
+	assert.Equal(t, "component-level", c.Common().Examples[0].Value.Str)
+
+	// A parameter carries its own examples, keyed by their map key like a media
+	// type's.
+	op, ok := opByName(doc, "getItem")
+	require.True(t, ok)
+	q, ok := paramByName(op, "q")
+	require.True(t, ok)
+	require.Len(t, q.Examples, 1)
+	assert.Equal(t, "one", q.Examples[0].Name)
+	require.NotNil(t, q.Examples[0].Value)
+	assert.Equal(t, "first", q.Examples[0].Value.Str)
+
+	assertResponseExamples(t, doc)
+}
+
+// assertResponseExamples pins the response-side example sites: the plural map on
+// a media type, in every spelling the spec allows, and a response header.
+func assertResponseExamples(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	op, ok := opByName(doc, "getItem")
+	require.True(t, ok)
+	require.Len(t, op.Responses[0].Payload.Contents, 1)
+	ex := op.Responses[0].Payload.Contents[0].Examples
+	require.Len(t, ex, 4, "every entry lowers, in source order")
+
+	// An inline entry and one written as a $ref, which must resolve to the
+	// referenced component's value. Both are named by their map key.
+	require.NotNil(t, ex[0].Value)
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "hello"}, *ex[0].Value)
+	assert.Equal(t, "inline", ex[0].Name)
+	require.NotNil(t, ex[1].Value)
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "world"}, *ex[1].Value)
+	assert.Equal(t, "shared", ex[1].Name)
+
+	// The annotations that surround a value travel with it.
+	assert.Equal(t, "a summary", ex[2].Summary)
+	assert.Equal(t, "a description", ex[2].Description)
+
+	// An externalValue entry carries no inline value, and is kept for the URL.
+	assert.Equal(t, "https://example.com/e.json", ex[3].ExternalURL)
+	assert.Nil(t, ex[3].Value)
+	assert.Equal(t, "hosted elsewhere", ex[3].Summary)
+
+	headers := op.Responses[0].Headers
+	require.Len(t, headers, 1)
+	require.Len(t, headers[0].Examples, 1)
+	require.NotNil(t, headers[0].Examples[0].Value)
+	assert.Equal(t, ir.BigVal("5"), headers[0].Examples[0].Value.Num)
+}
+
+// assertSelfURI pins that a declared `$self` reaches the source's entry rather
+// than a lowered node, since it says where one input document lives. The case
+// witnesses no matrix row: the rows are what an API can express, and the URI a
+// description gives itself is not part of the API it describes.
+func assertSelfURI(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	t.Helper()
+	require.Len(t, doc.Sources, 1)
+	assert.Equal(t, "openapi@3.2", doc.Sources[0].Format)
+	assert.Equal(t, "https://example.com/api/openapi.yaml", doc.Sources[0].SelfURI)
+}
+
+func assertDocsSummaryDesc(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "ping")
+	require.True(t, ok)
+	assert.Equal(t, "Ping the server", op.Docs.Summary)
+	assert.Equal(t, "Returns pong", op.Docs.Description)
+	require.Len(t, op.Docs.ExternalDocs, 1)
+	assert.Equal(t, ir.Link{URL: "https://example.com/docs/ping", Description: "Ping reference"},
+		op.Docs.ExternalDocs[0])
+
+	// A documented scalar alias is documented too: its docs must not depend on
+	// what its body happens to lower to (GitHub #114).
+	sc, ok := doc.Types[namedID("UserId")].(*ir.Scalar)
+	require.True(t, ok)
+	assert.Equal(t, "User identifier", sc.Docs.Summary)
+	assert.Equal(t, "Stable identifier for a user.", sc.Docs.Description)
+
+	// info and the root externalDocs are one Docs on the document: summary and
+	// description come from info, the link from beside it.
+	assert.Equal(t, "A one-line summary of the API.", doc.Docs.Summary)
+	assert.Equal(t, "The long-form description of the API.", doc.Docs.Description)
+	require.Len(t, doc.Docs.ExternalDocs, 1)
+	assert.Equal(t, ir.Link{URL: "https://example.com/docs", Description: "Full guide"},
+		doc.Docs.ExternalDocs[0])
+	require.NotNil(t, doc.License)
+	assert.Equal(t, ir.License{Name: "MIT", Identifier: "MIT"}, *doc.License,
+		"the 3.1 SPDX identifier is its own field, never folded into the name")
+}
+
+// assertRequestBodyDocs pins GitHub #609: a Request Body Object's `description`
+// describes the body rather than any media type inside it, so it reaches
+// Payload.Docs. Both spellings are covered — a body $ref'd from components and
+// one written inline — and the shared component is reached from two operations,
+// so the declaration-pointer path is exercised and one declaration is still one
+// type however many mounts read its docs.
+func assertRequestBodyDocs(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	created, ok := opByName(doc, "createOrder")
+	require.True(t, ok)
+	require.NotNil(t, created.Request)
+	assert.Equal(t, "A shared order body.", created.Request.Docs.Description,
+		"a $ref'd body keeps the component's description")
+
+	replaced, ok := opByName(doc, "replaceOrder")
+	require.True(t, ok)
+	require.NotNil(t, replaced.Request)
+	assert.Equal(t, "A shared order body.", replaced.Request.Docs.Description,
+		"the second mount reads the same declaration's docs")
+
+	shared := ir.TypeID("t/anon/components/requestBodies/OrderBody/content/application~1json/schema")
+	assert.Equal(t, shared, openapitest.BodyTarget(t, created.Request),
+		"a shared body interns at its component pointer (issue #107)")
+	assert.Equal(t, shared, openapitest.BodyTarget(t, replaced.Request),
+		"...once, whichever mount lowered it first")
+
+	draft, ok := opByName(doc, "saveDraft")
+	require.True(t, ok)
+	require.NotNil(t, draft.Request)
+	assert.Equal(t, "A draft saved inline.", draft.Request.Docs.Description,
+		"an inline body's own description reaches the payload too")
+}
+
+// assertRefSiteDocs pins GitHub #610 across every site the fold reaches, in one
+// document: a Reference Object may write `summary` and `description` beside its
+// `$ref`, and OpenAPI says they override the referenced object's. Nothing read
+// them, so a mount's own documentation was silently replaced by the
+// declaration's. The one component referenced from two operations with
+// different overrides also pins the other half: each mount keeps its own and
+// neither mutates the declaration.
+func assertRefSiteDocs(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	widgets, ok := opByName(doc, "listWidgets")
+	require.True(t, ok)
+	gadgets, ok := opByName(doc, "listGadgets")
+	require.True(t, ok)
+
+	// parameters — the two-mount case: the first writes both siblings, the second
+	// only a description, and the declaration's own description is overridden by
+	// both rather than surviving on either.
+	widgetLimit, ok := paramByName(widgets, "limit")
+	require.True(t, ok)
+	assert.Equal(t, "Page size", widgetLimit.Docs.Summary)
+	assert.Equal(t, "How many widgets to return.", widgetLimit.Docs.Description)
+	gadgetLimit, ok := paramByName(gadgets, "limit")
+	require.True(t, ok)
+	assert.Empty(t, gadgetLimit.Docs.Summary, "the second mount writes no summary, so none is invented")
+	assert.Equal(t, "How many gadgets to return.", gadgetLimit.Docs.Description)
+
+	// responses — one mount overrides the description, the other keeps the
+	// declaration's, so neither mutates it.
+	require.Len(t, widgets.Responses, 1)
+	assert.Equal(t, "The listing, as this operation returns it.", widgets.Responses[0].Docs.Description)
+	require.Len(t, gadgets.Responses, 1)
+	assert.Equal(t, "A page of results.", gadgets.Responses[0].Docs.Description,
+		"a mount with no siblings leaves the declaration's description alone")
+
+	// error cases are responses too, and reach the same shared lowering.
+	require.Len(t, widgets.Errors, 1)
+	assert.Equal(t, "No such widget.", widgets.Errors[0].Docs.Description)
+
+	// headers
+	require.Len(t, widgets.Responses[0].Headers, 1)
+	assert.Equal(t, "The unit a rate limit is stated in.", widgets.Responses[0].Headers[0].Docs.Description)
+
+	// examples — the siblings override the Example Object's own pair.
+	require.NotNil(t, widgets.Responses[0].Payload)
+	require.Len(t, widgets.Responses[0].Payload.Contents[0].Examples, 1)
+	example := widgets.Responses[0].Payload.Contents[0].Examples[0]
+	assert.Equal(t, "One page", example.Summary)
+	assert.Equal(t, "A single page of results.", example.Description)
+
+	// request bodies
+	require.NotNil(t, widgets.Request)
+	assert.Equal(t, "The widget to create.", widgets.Request.Docs.Description)
+
+	// security schemes — the aliasing entry takes its own description, and the
+	// declaration it names keeps its own; an alias of the alias writes none, so
+	// it takes the description of the hop beneath it.
+	require.Len(t, doc.Auth, 3)
+	byName := map[string]string{}
+	for _, scheme := range doc.Auth {
+		byName[scheme.Name.Source] = scheme.Docs.Description
+	}
+	assert.Equal(t, "The key this API expects.", byName["ApiKey"])
+	assert.Equal(t, "The declaration's own scheme description.", byName["BaseKey"],
+		"the aliasing entry's siblings do not reach the declaration")
+	assert.Equal(t, "The key this API expects.", byName["KeyAlias"])
+
+	assertAliasHopDocs(t, doc)
+}
+
+// assertAliasHopDocs pins the siblings of an alias, a component that is itself a
+// $ref: they override the declaration it names at every position, and a use
+// site's own override them in turn.
+func assertAliasHopDocs(t *testing.T, doc *ir.Document) {
+	sprocket, ok := opByName(doc, "makeSprocket")
+	require.True(t, ok)
+	limit, ok := paramByName(sprocket, "limit")
+	require.True(t, ok)
+	assert.Equal(t, ir.Docs{Summary: "Sprocket page size", Description: "The alias's own description."}, limit.Docs,
+		"the use site's summary over the alias's description over the declaration's")
+	require.NotNil(t, sprocket.Request)
+	assert.Equal(t, "The alias's own body description.", sprocket.Request.Docs.Description)
+	require.Len(t, sprocket.Responses, 1)
+	require.Len(t, sprocket.Responses[0].Headers, 1)
+	assert.Equal(t, "The alias's own header description.", sprocket.Responses[0].Headers[0].Docs.Description)
+	require.Len(t, sprocket.Responses[0].Payload.Contents[0].Examples, 1)
+	example := sprocket.Responses[0].Payload.Contents[0].Examples[0]
+	assert.Equal(t, "The alias's own summary", example.Summary)
+	assert.Equal(t, "Declared description", example.Description, "the field the alias omits stands")
+	require.Len(t, sprocket.Errors, 1)
+	assert.Equal(t, "The alias's own response description.", sprocket.Errors[0].Docs.Description)
+}
+
+// assertExamples32 pins GitHub #612 at every site the issue names: the 3.2
+// dataValue lowers like `value`, including through a components/examples $ref,
+// and a serializedValue is kept verbatim under Unmodeled wherever it is written,
+// alone or beside a dataValue, rather than dropped.
+func assertExamples32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "list")
+	require.True(t, ok)
+
+	// parameters
+	limit, ok := paramByName(op, "limit")
+	require.True(t, ok)
+	require.Len(t, limit.Examples, 1)
+	require.NotNil(t, limit.Examples[0].Value, "a parameter's dataValue reaches Example.Value")
+	assert.Equal(t, ir.BigVal("5"), limit.Examples[0].Value.Num)
+
+	// headers
+	require.Len(t, op.Responses, 1)
+	require.Len(t, op.Responses[0].Headers, 1)
+	headerExample := op.Responses[0].Headers[0].Examples
+	require.Len(t, headerExample, 1)
+	assert.Equal(t, ir.ReasonNoIRHome, headerExample[0].Unmodeled["openapi:serializedValue"].Reason,
+		"a header's serializedValue keeps the entry verbatim")
+
+	// content, and through it components/examples
+	examples := op.Responses[0].Payload.Contents[0].Examples
+	require.Len(t, examples, 4)
+	byName := map[string]ir.Example{}
+	for _, e := range examples {
+		byName[e.Name] = e
+	}
+	require.NotNil(t, byName["five"].Value)
+	assert.Equal(t, ir.BigVal("5"), byName["five"].Value.Num)
+	require.NotNil(t, byName["one"].Value, "a $ref'd components/examples entry lowers its dataValue")
+	assert.Equal(t, ir.BigVal("1"), byName["one"].Value.Num)
+	assert.Equal(t, ir.ReasonNoIRHome, byName["serial"].Unmodeled["openapi:serializedValue"].Reason)
+	assert.Nil(t, byName["serial"].Value)
+	require.NotNil(t, byName["both"].Value, "a dataValue beside a serializedValue still lowers")
+	assert.Equal(t, ir.BigVal("2"), byName["both"].Value.Num)
+	assert.JSONEq(t, `"\"2\""`, string(byName["both"].Unmodeled["openapi:serializedValue"].Value),
+		"...and the serialized form beside it is kept too")
+
+	openapitest.AssertInfoDiagAt(t, diags,
+		"/paths/~1a/get/responses/200/content/application~1json/examples/both/serializedValue")
+	openapitest.AssertInfoDiagAt(t, diags, "/components/examples/Serial/serializedValue")
+}
diff --git a/compilers/openapi/e2e/conformance_extensions_test.go b/compilers/openapi/e2e/conformance_extensions_test.go
new file mode 100644
index 00000000..ff2b9ebe
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_extensions_test.go
@@ -0,0 +1,179 @@
+package e2e_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertExtensionsX(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+	raw, ok := m.Unmodeled["openapi:x-rate-limit"]
+	require.True(t, ok, "x-* extensions are namespaced under openapi:")
+	assert.JSONEq(t, "100", string(raw.Value))
+	assert.Equal(t, ir.ReasonVendorExtension, raw.Reason)
+
+	assertEveryObjectKeepsItsExtensions(t, doc)
+	assertRawPreservedBinary(t, m)
+}
+
+// assertEveryObjectKeepsItsExtensions holds the whole contract, not the
+// positions that happened to be noticed: every OpenAPI object that admits an
+// x-* keeps it. The fixture writes `x-mark` on each with a value naming the
+// object, so a row that stops arriving names the lowering that stopped reading.
+//
+// Carriers are derived from the value graph: a row says which Unmodeled map the
+// entry must land on by the path the walk reaches it at. The match is a
+// substring one, so a bare ".Unmodeled" ends every path and checks nothing;
+// carrierNarrows holds each row to narrowing the document.
+func assertEveryObjectKeepsItsExtensions(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	sites := unmodeledSites(doc)
+	for _, tc := range []struct{ object, key, want, carrier string }{
+		{"openapi root", "openapi:x-audience", `"public"`, "doc.Unmodeled"},
+		{"info", "openapi:info/x-mark", `"XINFO"`, "doc.Unmodeled"},
+		{"contact", "openapi:info/contact/x-mark", `"XCONTACT"`, "doc.Unmodeled"},
+		{"license", "openapi:info/license/x-mark", `"XLICENSE"`, "doc.Unmodeled"},
+		{"externalDocs", "openapi:externalDocs/x-mark", `"XEXTERNALDOCS"`, "doc.Unmodeled"},
+		{"components", "openapi:components/x-mark", `"XCOMPONENTS"`, "doc.Unmodeled"},
+		{"tag", "openapi:tags/0/x-mark", `"XTAG"`, "doc.Unmodeled"},
+		{"tag externalDocs", "openapi:tags/0/externalDocs/x-mark", `"XTAGEXTERNALDOCS"`, "doc.Unmodeled"},
+		{"server", "openapi:x-mark", `"XSERVER"`, "doc.Servers[0].Unmodeled"},
+		{"server variable", "openapi:x-mark", `"XSERVERVARIABLE"`, "doc.Servers[0].Variables[0].Unmodeled"},
+		{"paths", "openapi:paths/x-mark", `"XPATHS"`, "doc.Services[0].Unmodeled"},
+		{"path item", "openapi:pathItem/x-mark", `"XPATHITEM"`, ".Operations[0].Unmodeled"},
+		{"operation", "openapi:x-internal", `true`, ".Operations[0].Unmodeled"},
+		{"operation externalDocs", "openapi:externalDocs/x-mark", `"XOPERATIONEXTERNALDOCS"`,
+			".Operations[0].Unmodeled"},
+		{"responses", "openapi:responses/x-mark", `"XRESPONSES"`, ".Operations[0].Unmodeled"},
+		{"parameter", "openapi:x-mark", `"XPARAMETER"`, ".Params[0].Unmodeled"},
+		{"request body", "openapi:x-mark", `"XREQUESTBODY"`, ".Request.Unmodeled"},
+		{"media type", "openapi:x-mark", `"XMEDIATYPE"`, ".Contents[0].Unmodeled"},
+		{"encoding", "openapi:encoding/f/x-mark", `"XENCODING"`, ".Contents[0].Unmodeled"},
+		{"example", "openapi:x-mark", `"XEXAMPLE"`, ".Examples[0].Unmodeled"},
+		{"response", "openapi:x-mark", `"XRESPONSE"`, ".Responses[0].Unmodeled"},
+		{"error response", "openapi:x-mark", `"XERRORRESPONSE"`, ".Errors[0].Unmodeled"},
+		{"header", "openapi:x-mark", `"XHEADER"`, ".Headers[0].Unmodeled"},
+		{"callback", "openapi:callbacks/onEvent/x-mark", `"XCALLBACK"`, ".Bindings.HTTP[0].Unmodeled"},
+		{"schema xml", "openapi:xml/x-mark", `"XXML"`, "doc.Types[t/openapi/components/schemas/S].Unmodeled"},
+		{"schema externalDocs", "openapi:externalDocs/x-mark", `"XSCHEMAEXTERNALDOCS"`,
+			"doc.Types[t/openapi/components/schemas/S].Unmodeled"},
+		{"discriminator", "openapi:discriminator/x-mark", `"XDISCRIMINATOR"`,
+			"doc.Types[t/openapi/components/schemas/D].Unmodeled"},
+		{"security scheme", "openapi:x-mark", `"XSECURITYSCHEME"`,
+			"doc.Auth[auth/openapi/components/securitySchemes/k].Unmodeled"},
+		{"oauth flows", "openapi:flows/x-mark", `"XOAUTHFLOWS"`,
+			"doc.Auth[auth/openapi/components/securitySchemes/o].Unmodeled"},
+		{"oauth flow", "openapi:x-mark", `"XOAUTHFLOW"`,
+			"doc.Auth[auth/openapi/components/securitySchemes/o].Flows[0].Unmodeled"},
+	} {
+		site, found := findUnmodeled(sites, tc.key, tc.want)
+		if !assert.True(t, found, "%s extension is dropped: no %s = %s anywhere in the document",
+			tc.object, tc.key, tc.want) {
+			continue
+		}
+		assert.Equal(t, ir.ReasonVendorExtension, site.entry.Reason, "%s extension reason", tc.object)
+		assert.True(t, carrierNarrows(sites, tc.carrier),
+			"%s carrier %q matches every Unmodeled map in the document, so it asserts nothing "+
+				"about where the entry landed", tc.object, tc.carrier)
+		assert.Contains(t, site.path, tc.carrier, "%s extension lands on the wrong carrier", tc.object)
+	}
+}
+
+// carrierNarrows reports whether carrier picks out fewer than all of the
+// document's Unmodeled maps. A carrier that matches every one of them makes the
+// assertion beside it unconditionally true, which is how a row can name the
+// wrong map and still pass.
+//
+// Matching none of them is narrow, not broad, so it passes here and fails on the
+// assertion beside this one: that is a carrier naming a map the document has
+// not got, and reporting it as the vacuous case would name the opposite defect.
+func carrierNarrows(sites []unmodeledSite, carrier string) bool {
+	all, matched := map[string]bool{}, map[string]bool{}
+	for _, site := range sites {
+		all[site.path] = true
+		if strings.Contains(site.path, carrier) {
+			matched[site.path] = true
+		}
+	}
+	return len(matched) < len(all)
+}
+
+// assertRawPreservedBinary pins what a !!binary extension keeps: the base64 the
+// source wrote. Decoding it and storing the bytes in a JSON string lost the
+// spelling on every value and lost the data itself on any byte that is not
+// valid UTF-8, since v1's encoding/json rewrote those to U+FFFD (GitHub #242).
+//
+// The block-form row carries the line breaks with it, because they are part of
+// what the source wrote; base64.StdEncoding skips them, so a consumer resolving
+// the tag reads the same bytes the decode used to store.
+func assertRawPreservedBinary(t *testing.T, m *ir.Model) {
+	t.Helper()
+	for _, tc := range []struct{ key, want string }{
+		{"openapi:x-blob", `"aGVsbG8="`},
+		{"openapi:x-raw", `"/w=="`},
+		{"openapi:x-wrapped", `"aGVs\nbG8=\n"`},
+	} {
+		entry, found := m.Unmodeled[tc.key]
+		require.True(t, found, "%s is preserved; got %v", tc.key, m.Unmodeled)
+		assert.Equal(t, tc.want, string(entry.Value),
+			"%s keeps its base64 text, not the bytes it names", tc.key)
+	}
+}
+
+// assertInlineAnnotations covers the positions with no ir.Property or
+// ir.Parameter to carry what a declaration writes: each keeps its docs, bounds
+// and x-* on a node of its own, while a position declaring nothing still
+// resolves straight to the shared primitive.
+func assertInlineAnnotations(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	elem := assertAnnotatedScalar(t, doc, "t/anon/components/schemas/Codes/items", 3)
+	require.NotNil(t, elem.XML)
+	assert.Equal(t, "Code", elem.XML.Name)
+	assert.Contains(t, elem.Unmodeled, "openapi:x-facet")
+
+	assertAnnotatedScalar(t, doc, "t/anon/components/schemas/CodeIndex/additionalProperties", 64)
+	assertAnnotatedScalar(t, doc,
+		"t/anon/paths/~1codes/get/responses/200/content/application~1json/schema", 8192)
+
+	bare, ok := doc.Types[namedID("Bare")].(*ir.List)
+	require.True(t, ok)
+	assert.Equal(t, ir.TypeID("t/prim/string"), bare.Elem.Target,
+		"an element declaring nothing must not grow a node of its own")
+
+	op, ok := opByName(doc, "listCodes")
+	require.True(t, ok)
+	require.Len(t, op.Params, 1)
+	assertCarriedAnnotations(t, op.Params[0].Docs, op.Params[0].Constraints, op.Params[0].Unmodeled, 4)
+	require.Len(t, op.Responses[0].Headers, 1)
+	h := op.Responses[0].Headers[0]
+	assertCarriedAnnotations(t, h.Docs, h.Constraints, h.Unmodeled, 64)
+}
+
+// assertAnnotatedScalar requires the node at id to be a Scalar carrying a
+// description and the given maxLength.
+func assertAnnotatedScalar(t *testing.T, doc *ir.Document, id ir.TypeID, maxLength int64) *ir.Scalar {
+	t.Helper()
+	sc, ok := doc.Types[id].(*ir.Scalar)
+	require.True(t, ok, "%s must own a Scalar; got %v", id, doc.Types[id])
+	assert.NotEmpty(t, sc.Docs.Description)
+	require.NotNil(t, sc.Constraints)
+	require.NotNil(t, sc.Constraints.MaxLength)
+	assert.Equal(t, maxLength, *sc.Constraints.MaxLength)
+	return sc
+}
+
+// assertCarriedAnnotations requires a parameter's or header's own carrier to
+// hold what its schema declared.
+func assertCarriedAnnotations(t *testing.T, docs ir.Docs, c *ir.Constraints, p ir.Unmodeled, maxLength int64) {
+	t.Helper()
+	assert.NotEmpty(t, docs.Description)
+	require.NotNil(t, c)
+	require.NotNil(t, c.MaxLength)
+	assert.Equal(t, maxLength, *c.MaxLength)
+	assert.NotEmpty(t, p, "the schema's x-* rides on the carrier too")
+}
diff --git a/compilers/openapi/e2e/conformance_nullability_test.go b/compilers/openapi/e2e/conformance_nullability_test.go
new file mode 100644
index 00000000..0dec1aa5
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_nullability_test.go
@@ -0,0 +1,197 @@
+package e2e_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertNullabilityFourStates(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, m.Properties, 4)
+	states := openapitest.PropsByWire(m.Properties)
+	assert.True(t, states["reqPlain"].Required)
+	assert.False(t, states["reqPlain"].Type.Nullable)
+	assert.True(t, states["reqNull"].Required)
+	assert.True(t, states["reqNull"].Type.Nullable)
+	assert.False(t, states["optPlain"].Required)
+	assert.False(t, states["optPlain"].Type.Nullable)
+	assert.False(t, states["optNull"].Required)
+	assert.True(t, states["optNull"].Type.Nullable)
+}
+
+func assertNullable30(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, m.Properties, 1)
+	assert.True(t, m.Properties[0].Type.Nullable, "3.0 nullable lowers to the same IR bit")
+}
+
+func assertNullable31Ref(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("Owner")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, m.Properties, 2)
+	byName := openapitest.PropsByWire(m.Properties)
+
+	assert.True(t, byName["p"].Type.Nullable,
+		"3.1's type-array null spelling normalizes to the same IR bit at a $ref site")
+	assert.Equal(t, namedID("Target"), byName["p"].Type.Target, "the ref resolves to the named component")
+
+	assert.True(t, byName["q"].Type.Nullable,
+		"a union's null branch is stripped into the ref's Nullable bit, so the ref must carry it")
+	assert.Equal(t, namedID("UnionTarget"), byName["q"].Type.Target, "the ref resolves to the union component")
+
+	u, ok := doc.Types[namedID("UnionTarget")].(*ir.Union)
+	require.True(t, ok)
+	assert.Len(t, u.Variants, 2, "the null branch lifts to the ref rather than becoming a variant")
+
+	assertCollapsedBranchHint(t, doc)
+}
+
+// assertCollapsedBranchHint covers the {X, null} collapse's naming of the
+// branch it keeps. The branch pointer is nameable from outside (BranchRef names
+// it) and only the first lowering to reach it interns the node, so the collapse
+// and an outside $ref must derive the same hint, or the document depends on
+// which component is declared first (GitHub #281). The spec declares Collapsed
+// before BranchRef on purpose: that is the order in which the collapse reaches
+// the pointer first. The permutation half is the two-order oracle's
+// (internal/harness).
+func assertCollapsedBranchHint(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	const branchID = ir.TypeID("t/anon/components/schemas/Collapsed/oneOf/0")
+
+	collapsed, ok := doc.Types[namedID("Collapsed")].(*ir.Scalar)
+	require.True(t, ok, "a {X, null} set resolves to its one branch rather than to a union node")
+	require.NotNil(t, collapsed.Base)
+	assert.True(t, collapsed.Base.Nullable, "the null branch lifts onto the reference")
+	assert.Equal(t, branchID, collapsed.Base.Target)
+
+	branch, ok := doc.Types[branchID]
+	require.True(t, ok, "the branch declares a description, so it owns a node of its own")
+	assert.Equal(t, "variant_0", branch.Common().Name.Hint,
+		"the branch is named by its position in the composition, which is what a $ref to it derives too")
+
+	ref, ok := doc.Types[namedID("BranchRef")].(*ir.Scalar)
+	require.True(t, ok)
+	require.NotNil(t, ref.Base)
+	assert.Equal(t, branchID, ref.Base.Target, "the outside reference reaches that same node")
+}
+
+// assertNullableEnum31 covers 3.1's spelling of a nullable enum: `null` listed
+// among the members of a null-admitting type array. The member is normalized
+// onto the Nullable bit of every reference to the enum rather than degrading the
+// declaration to a union of literals, so the claim is the pair: a closed Enum of
+// the scalar members, and null admitted at each use. The golden cannot pin the
+// strip, since the type array already carries the bit and deleting the `null`
+// member moves only the source hash; the member count below does.
+func assertNullableEnum31(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	e, ok := doc.Types[namedID("Color")].(*ir.Enum)
+	require.True(t, ok, "the null member does not cost the declaration its enum-ness")
+	assert.True(t, e.Closed)
+	assert.Equal(t, ir.PrimString, e.ValueType, "null contributes no value type of its own")
+	require.Len(t, e.Members, 2, "the null member is normalized away, the scalar members are not")
+	assert.Equal(t, "red", e.Members[0].Value.Str)
+	assert.Equal(t, "green", e.Members[1].Value.Str)
+	for _, d := range diags {
+		assert.NotEqual(t, "openapi/degraded-construct", d.Code, "normalizing is not degrading: %+v", d)
+	}
+
+	m, ok := doc.Types[namedID("Holder")].(*ir.Model)
+	require.True(t, ok)
+	one, ok := propByWire(m, "one")
+	require.True(t, ok)
+	assert.Equal(t, ir.TypeRef{Target: namedID("Color"), Nullable: true}, one.Type,
+		"a property $ref admits the null the members no longer carry")
+
+	many, ok := propByWire(m, "many")
+	require.True(t, ok)
+	list, ok := doc.Types[many.Type.Target].(*ir.List)
+	require.True(t, ok, "the array property hoists a List")
+	assert.Equal(t, ir.TypeRef{Target: namedID("Color"), Nullable: true}, list.Elem,
+		"and so does a list element, which holds its own reference")
+	assert.False(t, many.Type.Nullable, "the list itself was never declared nullable")
+
+	op, ok := opByName(doc, "pick")
+	require.True(t, ok)
+	p, ok := paramByName(op, "color")
+	require.True(t, ok)
+	assert.Equal(t, ir.TypeRef{Target: namedID("Color"), Nullable: true}, p.Type,
+		"a parameter reaches the same declaration through the operation walk")
+
+	// The two spellings beside Color. A non-empty enum fixes the value space, so
+	// the members decide null admission whether or not a type keyword is written
+	// beside them — and when one is, the two conjoin rather than the type winning.
+	bare, ok := doc.Types[namedID("BareColor")].(*ir.Enum)
+	require.True(t, ok, "a bare enum listing null is still an enum of its scalar members")
+	require.Len(t, bare.Members, 2, "the null member is normalized away here too")
+	assert.Equal(t, ir.PrimString, bare.ValueType, "the kept members supply the value type")
+
+	narrowed, ok := doc.Types[namedID("NarrowedColor")].(*ir.Enum)
+	require.True(t, ok)
+	require.Len(t, narrowed.Members, 2, "nothing to strip: the members never listed null")
+
+	bareRef, ok := propByWire(m, "bare")
+	require.True(t, ok)
+	assert.Equal(t, ir.TypeRef{Target: namedID("BareColor"), Nullable: true}, bareRef.Type,
+		"the bare spelling admits null at its uses, like the type-array spelling of the same set")
+
+	narrowedRef, ok := propByWire(m, "narrowed")
+	require.True(t, ok)
+	assert.Equal(t, ir.TypeRef{Target: namedID("NarrowedColor"), Nullable: false}, narrowedRef.Type,
+		"an enum excluding null must not admit it, whatever the type keyword names")
+}
+
+// assertNullabilityConjunction covers how null admission is decided for a schema
+// whose keywords disagree: JSON Schema conjoins them, so a position admits null
+// when something declares it and nothing takes it away. The claim is agreement:
+// the same constraint written two ways reaches one Nullable bit, which is all an
+// emitter reads.
+//
+// Base and Mixins are asserted to stay bare on purpose. They name one side of a
+// conjunction, so the bit belongs to the usage that names the whole; a
+// composition carrying its own would state one fact in two places that can
+// disagree.
+func assertNullabilityConjunction(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("Holder")].(*ir.Model)
+	require.True(t, ok)
+	props := openapitest.PropsByWire(m.Properties)
+	require.Len(t, props, 5)
+
+	assert.Equal(t, props["direct"].Type.Nullable, props["viaAllOf"].Type.Nullable,
+		"a sole conjunct's null survives the composition that names it")
+	assert.True(t, props["viaAllOf"].Type.Nullable)
+	assert.Equal(t, props["directModel"].Type.Nullable, props["viaAllOfModel"].Type.Nullable,
+		"a model target has no second hop to recover the null from")
+	assert.True(t, props["viaAllOfModel"].Type.Nullable)
+	assert.False(t, props["viaAllOfBoth"].Type.Nullable,
+		"one conjunct forbidding null decides the conjunction")
+
+	for _, name := range []string{"WrapNullableScalar", "WrapNullableModel", "WrapBoth"} {
+		wrap, isModel := doc.Types[namedID(name)].(*ir.Model)
+		require.True(t, isModel, "%s composes as a model", name)
+		if wrap.Base != nil {
+			assert.False(t, wrap.Base.Nullable, "%s.Base names a conjunct, not a usage", name)
+		}
+		for i, mix := range wrap.Mixins {
+			assert.False(t, mix.Nullable, "%s.Mixins[%d] names a conjunct, not a usage", name, i)
+		}
+	}
+
+	plain, ok := doc.Types[namedID("PlainUnion")].(*ir.Union)
+	require.True(t, ok)
+	distributed, ok := doc.Types[namedID("DistributedUnion")].(*ir.Union)
+	require.True(t, ok)
+	require.Len(t, plain.Variants, 2)
+	require.Len(t, distributed.Variants, 2)
+	for i := range plain.Variants {
+		assert.Equal(t, plain.Variants[i].Type.Nullable, distributed.Variants[i].Type.Nullable,
+			"variant %d: distributing a body that declares no type does not change what its branch admits", i)
+	}
+	assert.True(t, plain.Variants[0].Type.Nullable, "the nullable branch is the one that admits null")
+	assert.False(t, plain.Variants[1].Type.Nullable, "and the plain one is not")
+}
diff --git a/compilers/openapi/e2e/conformance_operations_test.go b/compilers/openapi/e2e/conformance_operations_test.go
new file mode 100644
index 00000000..11ec8a5e
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_operations_test.go
@@ -0,0 +1,173 @@
+package e2e_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertTagsGrouping(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	require.Len(t, doc.Services, 1)
+	require.Len(t, doc.Services[0].Groups, 1)
+	assert.Equal(t, "pets", doc.Services[0].Groups[0].Name.Source)
+	require.Len(t, doc.TagDefs, 1)
+	assert.Equal(t, "pets", doc.TagDefs[0].Name)
+}
+
+// assertGroupIdentity pins what identifies a group: the rule that formed it and
+// the key that rule read, never its name. Two pairs among the seven render from
+// the same words — the declared tag "default" and the group untagged operations
+// fall into, the tag "webhooks" and the webhook group — and two tags differ only
+// by what RFC 6901 escapes. Each keeps an ID of its own. The IDs are written out
+// rather than derived, so the test cannot agree with a change to the derivation
+// (GitHub #673).
+func assertGroupIdentity(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	require.Len(t, doc.Services, 1)
+	got := map[ir.GroupID][]string{}
+	for _, g := range doc.Services[0].Groups {
+		require.NotContains(t, got, g.ID, "two groups share an ID")
+		for _, op := range g.Operations {
+			got[g.ID] = append(got[g.ID], op.Name.Source)
+		}
+	}
+	assert.Equal(t, map[ir.GroupID][]string{
+		"g/tags/default":  {"declared"},
+		"g/default":       {"untagged"},
+		"g/tags/webhooks": {"namedLikeWebhooks"},
+		"g/tags/ghost":    {"undeclared"},
+		"g/tags/a~1b":     {"slash"},
+		"g/tags/a~01b":    {"tilde"},
+		"g/webhooks":      {"onEvent"},
+	}, got)
+}
+
+// assertParamIdentity pins what identifies a parameter: the operation it is
+// mounted under, its name as one escaped token, and its location. Two
+// parameters named id in one operation get two IDs; a path-item parameter is one
+// parameter per operation it is copied into; a path item reached from two paths
+// roots each mount's parameters at that mount. The IDs are written out rather
+// than derived, so the test cannot agree with a change to the derivation, and
+// every binding must name its own parameter's ID.
+func assertParamIdentity(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	require.Len(t, doc.Services, 1)
+	got := map[ir.OpID][]ir.ParamID{}
+	svc := doc.Services[0]
+	for _, g := range svc.Groups {
+		for _, op := range g.Operations {
+			for _, p := range op.Params {
+				got[op.ID] = append(got[op.ID], p.ID)
+			}
+			require.Len(t, op.Bindings.HTTP, 1)
+			var bound []ir.ParamID
+			for _, pb := range op.Bindings.HTTP[0].ParamBindings {
+				bound = append(bound, pb.Param)
+			}
+			assert.ElementsMatch(t, got[op.ID], bound, "%s: each binding names its own parameter", op.ID)
+		}
+	}
+	assert.Equal(t, map[ir.OpID][]ir.ParamID{
+		"op/openapi/paths/~1items~1{id}/get": {
+			"param/openapi/paths/~1items~1{id}/get/parameters/id/query",
+			"param/openapi/paths/~1items~1{id}/get/parameters/a~1b/query",
+			"param/openapi/paths/~1items~1{id}/get/parameters/id/path",
+		},
+		"op/openapi/paths/~1items~1{id}/post": {
+			"param/openapi/paths/~1items~1{id}/post/parameters/id/path",
+		},
+		"op/openapi/paths/~1a/get": {"param/openapi/paths/~1a/get/parameters/limit/query"},
+		"op/openapi/paths/~1b/get": {"param/openapi/paths/~1b/get/parameters/limit/query"},
+	}, got)
+}
+
+// assertEnumMemberIdentity pins what identifies an enum member: the value it
+// holds, tagged by kind, under the enum that declares it. The list repeats a
+// value, includes names that spell one canonical word sequence, and carries the
+// characters a pointer token escapes, so a derivation from the name, the
+// position or the unescaped value changes an ID. The IDs are written out, not
+// derived. The repeat is kept, its ID ends in its occurrence number, and it is
+// reported once at its own entry; the string spelling that ID's tail is no
+// repeat.
+func assertEnumMemberIdentity(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	memberIDs := func(id ir.TypeID) []ir.EnumMemberID {
+		enum, ok := doc.Types[id].(*ir.Enum)
+		require.True(t, ok, "%s is an enum", id)
+		got := make([]ir.EnumMemberID, 0, len(enum.Members))
+		for _, m := range enum.Members {
+			got = append(got, m.ID)
+		}
+		return got
+	}
+	assert.Equal(t, []ir.EnumMemberID{
+		"e/openapi/components/schemas/E/s:a-b",
+		"e/openapi/components/schemas/E/s:a_b",
+		"e/openapi/components/schemas/E/s:A B",
+		"e/openapi/components/schemas/E/s:a~0b",
+		"e/openapi/components/schemas/E/s:a-b/2",
+		"e/openapi/components/schemas/E/s:a-b~12",
+	}, memberIDs("t/openapi/components/schemas/E"))
+	assert.Equal(t, []ir.EnumMemberID{
+		"e/openapi/components/schemas/N/n:-1e0",
+		"e/openapi/components/schemas/N/n:1e0",
+		"e/openapi/components/schemas/N/n:0",
+	}, memberIDs("t/openapi/components/schemas/N"))
+	assert.Equal(t, []ir.EnumMemberID{
+		"e/anon/paths/~1status/get/responses/200/content/application~1json/schema/s:open",
+		"e/anon/paths/~1status/get/responses/200/content/application~1json/schema/s:closed",
+	}, memberIDs("t/anon/paths/~1status/get/responses/200/content/application~1json/schema"))
+
+	var repeats []string
+	for _, d := range diags {
+		if d.Code == "openapi/duplicate-enum-value" {
+			repeats = append(repeats, string(d.Provenance.Pointer))
+		}
+	}
+	assert.Equal(t, []string{"/components/schemas/E/enum/4"}, repeats)
+}
+
+func assertHTTPBinding(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "getItem")
+	require.True(t, ok)
+	require.Len(t, op.Bindings.HTTP, 1)
+	hb := op.Bindings.HTTP[0]
+	assert.Equal(t, "GET", hb.Method)
+	assert.Equal(t, "/items/{id}", hb.URITemplate)
+}
+
+// assertTagsGrouping32 is the 3.2 counterpart of assertTagsGrouping, and the
+// first case in the corpus to witness OperationGroup.Groups: a tag declaring a
+// parent nests its group under that parent's, an operation's non-navigational
+// tag does not become the group it is filed under, and the declared 3.2 tag
+// metadata reaches the registry verbatim.
+func assertTagsGrouping32(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	require.Len(t, doc.TagDefs, 4)
+	require.Equal(t, "books", doc.TagDefs[0].Name, "TagDefs keep the document's declaration order")
+	assert.Equal(t, "catalog", doc.TagDefs[0].Parent)
+	assert.Equal(t, "nav", doc.TagDefs[0].Kind)
+	assert.Equal(t, "nav", doc.TagDefs[1].Kind)
+	assert.Equal(t, "badge", doc.TagDefs[2].Kind, "the non-navigational kind is recorded, not interpreted")
+	assert.Empty(t, doc.TagDefs[2].Parent)
+
+	require.Len(t, doc.Services, 1)
+	svc := doc.Services[0]
+	require.Len(t, svc.Groups, 1, "the child nests rather than becoming a second top-level group")
+	catalog := svc.Groups[0]
+	assert.Equal(t, "catalog", catalog.Name.Source)
+	assert.Equal(t, "Everything the library holds", catalog.Docs.Description,
+		"an ancestor created first on its child's behalf still carries its declared docs")
+	require.Len(t, catalog.Operations, 1)
+	assert.Equal(t, "showCatalog", catalog.Operations[0].Name.Source)
+
+	require.Len(t, catalog.Groups, 2, "both children nest, in the order operations first reach them")
+	assert.Equal(t, "magazines", catalog.Groups[1].Name.Source)
+	books := catalog.Groups[0]
+	assert.Equal(t, "books", books.Name.Source)
+	assert.Equal(t, "Book operations", books.Docs.Description)
+	require.Len(t, books.Operations, 1)
+	listBooks := books.Operations[0]
+	assert.Equal(t, "listBooks", listBooks.Name.Source)
+	assert.Equal(t, []string{"beta", "books"}, listBooks.Tags,
+		"tag membership keeps every tag the operation named, badge included")
+}
diff --git a/compilers/openapi/e2e/conformance_params_test.go b/compilers/openapi/e2e/conformance_params_test.go
new file mode 100644
index 00000000..8b0811ac
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_params_test.go
@@ -0,0 +1,555 @@
+package e2e_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertParamStyles(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "search")
+	require.True(t, ok)
+	require.Len(t, op.Bindings.HTTP, 1)
+	byParam := map[string]ir.HTTPParamBinding{}
+	for _, pb := range op.Bindings.HTTP[0].ParamBindings {
+		byParam[pb.WireName] = pb
+	}
+	q := byParam["q"]
+	assert.Equal(t, "form", q.Style, "query default style is form")
+	require.NotNil(t, q.Explode)
+	assert.True(t, *q.Explode, "form default explodes")
+	assert.Equal(t, "deepObject", byParam["filter"].Style)
+	assert.Equal(t, "application/json", byParam["payload"].ContentType, "content-style param records its media type")
+	assert.True(t, byParam["path"].AllowReserved,
+		"reserved characters passing through unescaped is a wire fact, not a style")
+	assert.False(t, q.AllowReserved, "and the default is to escape them")
+
+	// "path" is a query parameter in this 3.1 document, the one location the
+	// keyword belongs to before 3.2 — so a declaration of it, which the
+	// assertion above pins, is not the off-query case the warning reports.
+	assert.Zero(t, openapitest.CountDiagsAt(diags, diag.InapplicableLocationKeyword, ir.SeverityWarning),
+		"a 3.1 query declaration of allowReserved stays silent")
+
+	assertAllowEmptyValueKept(t, op)
+
+	// The path item's shared parameter merges into both of its operations and
+	// interns its schema once, at the path item's own pointer (issue #36).
+	clearSearch, ok := opByName(doc, "clearSearch")
+	require.True(t, ok, "the path item's second operation is registered")
+	searchReqID, ok := paramByName(op, "requestId")
+	require.True(t, ok, "search inherits the path-item-level parameter")
+	clearReqID, ok := paramByName(clearSearch, "requestId")
+	require.True(t, ok, "clearSearch inherits the same path-item-level parameter")
+	assert.Equal(t, searchReqID.Type.Target, clearReqID.Type.Target,
+		"both operations resolve the shared path-item parameter to the same interned schema")
+	assert.Equal(t, ir.TypeID("t/anon/paths/~1search/parameters/0/schema"), searchReqID.Type.Target,
+		"the shared schema is hoisted at the path item's own pointer, not a per-operation one")
+}
+
+// assertAllowEmptyValueKept covers the one serialization flag ir.HTTPParamBinding
+// has no field for. Style, explode, allowReserved and the content-style media
+// type all land on the binding above; allowEmptyValue used to be read nowhere at
+// all, so a document declaring it produced IR indistinguishable from one that
+// did not (GitHub #39). It is kept on the logical Parameter, which is the
+// carrier at this position with an Unmodeled map.
+func assertAllowEmptyValueKept(t *testing.T, op ir.Operation) {
+	t.Helper()
+	bare, ok := paramByName(op, "bare")
+	require.True(t, ok, "the allowEmptyValue parameter still lowers")
+	entry, ok := bare.Unmodeled["openapi:allowEmptyValue"]
+	require.True(t, ok, "and its declared flag is kept beside it")
+	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+	assert.JSONEq(t, `true`, string(entry.Value))
+}
+
+// paramSlot is what OpenAPI identifies a parameter by: its name and location.
+// Two parameters may legally share a name at different locations, so a map
+// keyed on the name alone silently keeps one of such a pair and compares the
+// other against nothing.
+type paramSlot struct {
+	Name     string
+	Location ir.HTTPLocation
+}
+
+// paramWire is what a parameter's location-dependent serialization resolves to:
+// the style it serializes with, and whether it explodes. The two travel together
+// because OpenAPI settles them together — the location picks the style when none
+// is written, and the style picks explode.
+type paramWire struct {
+	Style   string
+	Explode bool
+}
+
+// paramStylePair is one legal (in, style) combination of the Parameter object.
+type paramStylePair struct {
+	location ir.HTTPLocation
+	style    string
+}
+
+// param names the fixture parameter declaring this pair with one explode
+// spelling: "<location><Style>" and the suffix.
+//
+// It is total rather than slicing p.style directly: the table's own comment
+// points out that querystring takes no style, which is an invitation to add a
+// styleless pair, and a panic inside a name builder says nothing about which
+// pair caused it. TestParamStyleTable_MatchesTheSpecification is what rejects
+// one, with the pair named.
+func (p paramStylePair) param(suffix string) string {
+	return string(p.location) + upperFirst(p.style) + suffix
+}
+
+// upperFirst capitalizes the first letter of an ASCII style name.
+func upperFirst(s string) string {
+	if s == "" {
+		return s
+	}
+	return strings.ToUpper(s[:1]) + s[1:]
+}
+
+// paramStyleLegalPairs is OpenAPI's (in, style) table, read off the
+// specification rather than off the fixture: path takes simple|label|matrix,
+// query form|spaceDelimited|pipeDelimited|deepObject, header simple, cookie
+// form|cookie. querystring is a fifth location that takes no style at all, so
+// it has no pair here and assertQuerystringParam covers it instead.
+func paramStyleLegalPairs() []paramStylePair {
+	return []paramStylePair{
+		{ir.HTTPLocationPath, "simple"},
+		{ir.HTTPLocationPath, "label"},
+		{ir.HTTPLocationPath, "matrix"},
+		{ir.HTTPLocationQuery, "form"},
+		{ir.HTTPLocationQuery, "spaceDelimited"},
+		{ir.HTTPLocationQuery, "pipeDelimited"},
+		{ir.HTTPLocationQuery, "deepObject"},
+		{ir.HTTPLocationHeader, "simple"},
+		{ir.HTTPLocationCookie, "form"},
+		{ir.HTTPLocationCookie, "cookie"},
+	}
+}
+
+// paramStyleDefaultStyles is the other half of the same table: the style each
+// location falls back to when a parameter omits `style` entirely.
+func paramStyleDefaultStyles() []paramStylePair {
+	return []paramStylePair{
+		{ir.HTTPLocationPath, "simple"},
+		{ir.HTTPLocationQuery, "form"},
+		{ir.HTTPLocationHeader, "simple"},
+		{ir.HTTPLocationCookie, "form"},
+	}
+}
+
+// paramStyleExplodeDefault is what `explode` means when omitted: true under
+// form and under 3.2's cookie style, false under every other style a location
+// pairs with.
+func paramStyleExplodeDefault(style string) bool {
+	return style == "form" || style == "cookie"
+}
+
+// paramStyleMatrixWant generates what param-style-matrix.yaml must resolve to
+// from the two tables above, rather than restating it beside them. A literal
+// expectation and the fixture are two copies of one claim, so deleting a row
+// from both leaves nothing to disagree, and counts over a deduplicated set can
+// still pass a shrunk fixture when another parameter resolves the same way.
+// Generating moves the question up: the table and the fixture can still shrink
+// together. TestParamStyleTable_MatchesTheSpecification holds the table to a
+// count that is OpenAPI's rather than this package's.
+func paramStyleMatrixWant() map[paramSlot]paramWire {
+	want := map[paramSlot]paramWire{}
+	for _, p := range paramStyleLegalPairs() {
+		for _, e := range []struct {
+			suffix  string
+			explode bool
+		}{
+			{"Explode", true},
+			{"NoExplode", false},
+			{"DefaultExplode", paramStyleExplodeDefault(p.style)},
+		} {
+			want[paramSlot{p.param(e.suffix), p.location}] = paramWire{p.style, e.explode}
+		}
+	}
+	for _, d := range paramStyleDefaultStyles() {
+		want[paramSlot{string(d.location) + "Defaulted", d.location}] =
+			paramWire{d.style, paramStyleExplodeDefault(d.style)}
+	}
+	return want
+}
+
+// TestParamStyleTable_MatchesTheSpecification anchors the (in, style) table to
+// OpenAPI's own, which a generated expectation cannot do for itself. Deleting a
+// pair and the parameters it generated, then regenerating the golden, leaves
+// every check agreeing with the smaller world; only the specification is outside
+// that loop. 3.2 tabulates the legal combinations and says "Combinations not
+// represented in this table are not permitted", so this count is OpenAPI's and
+// changing it is a claim about the format.
+//
+// It also holds the two halves of the table to each other: a location's default
+// style must be a style that location legally takes.
+func TestParamStyleTable_MatchesTheSpecification(t *testing.T) {
+	t.Parallel()
+	pairs := paramStyleLegalPairs()
+	require.Len(t, pairs, 10,
+		"3.2 permits ten (in, style) pairs; a different number here is a claim about OpenAPI, not about the fixture")
+
+	legal := make(map[paramStylePair]bool, len(pairs))
+	for _, p := range pairs {
+		assert.NotEmpty(t, p.style,
+			"%s: a pair names a style, and a location that takes none belongs in neither table", p.location)
+		assert.NotContains(t, legal, p, "the (%s, %s) pair is listed twice", p.location, p.style)
+		legal[p] = true
+	}
+
+	defaults := paramStyleDefaultStyles()
+	require.Len(t, defaults, 4, "each location that takes a style at all defaults exactly one")
+	locations := make(map[ir.HTTPLocation]bool, len(defaults))
+	for _, d := range defaults {
+		assert.NotContains(t, locations, d.location, "%s is given two default styles", d.location)
+		locations[d.location] = true
+		assert.Contains(t, legal, d,
+			"%s defaults to style %q, which is not a pair the table says that location takes",
+			d.location, d.style)
+	}
+}
+
+// assertParamStyleMatrix pins the whole of OpenAPI's location-dependent
+// serialization table at once, against a generated expectation rather than a
+// spot check per location.
+//
+// The table used to be readable for a whole location without any golden
+// noticing: deleting cookie from the arm that defaults it to form left the
+// entire suite green, because no committed spec declared a cookie parameter.
+// Comparing the resolved (style, explode) of every parameter closes that by
+// construction — a location that loses its arm changes rows here.
+func assertParamStyleMatrix(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "styleMatrix")
+	require.True(t, ok)
+	require.Len(t, op.Bindings.HTTP, 1)
+
+	got := make(map[paramSlot]paramWire, len(op.Bindings.HTTP[0].ParamBindings))
+	for _, pb := range op.Bindings.HTTP[0].ParamBindings {
+		require.NotNil(t, pb.Explode, "%s: explode resolves to a value, never to nothing", pb.WireName)
+		slot := paramSlot{Name: pb.WireName, Location: pb.Location}
+		require.NotContains(t, got, slot, "two parameter bindings share the slot %+v", slot)
+		got[slot] = paramWire{Style: pb.Style, Explode: *pb.Explode}
+	}
+	if diff := cmp.Diff(paramStyleMatrixWant(), got); diff != "" {
+		t.Errorf("resolved parameter serialization (-want +got):\n%s", diff)
+	}
+
+	assertQuerystringParam(t, doc)
+}
+
+// assertQuerystringParam covers the 3.2 location that binds the whole query
+// string. It may declare neither style nor schema, so the media type its
+// one-entry content map names is the whole of its stated serialization.
+//
+// It has an operation to itself because 3.2 forbids a querystring parameter from
+// sharing one, or its path item, with any `in: query` parameter; the test
+// asserts the operation binds exactly one.
+//
+// It carries neither style nor explode: 3.2 gives the location no style, and
+// explode qualifies a style there is none of (GitHub #334). Both are pinned so a
+// stamped form/true default cannot return.
+func assertQuerystringParam(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	op, ok := opByName(doc, "querystringOnly")
+	require.True(t, ok, "the querystring parameter's own operation is registered")
+	require.Len(t, op.Bindings.HTTP, 1)
+	require.Len(t, op.Bindings.HTTP[0].ParamBindings, 1,
+		"the querystring location shares its operation with no other parameter")
+
+	binding := op.Bindings.HTTP[0].ParamBindings[0]
+	require.Equal(t, ir.HTTPLocationQuerystring, binding.Location)
+	require.Equal(t, "querystringWhole", binding.WireName, "the querystring parameter binds")
+	assert.Equal(t, "application/x-www-form-urlencoded", binding.ContentType,
+		"its media type is where its serialization is actually stated")
+	assert.Empty(t, binding.Style, "style is not a legal keyword at in: querystring")
+	assert.Nil(t, binding.Explode, "and explode qualifies a style there is none of")
+}
+
+// assertParamQuerystring pins the 3.2 querystring location, where the whole
+// query string binds from the parameter's content: the binding carries that
+// media type and neither style nor explode, which the location forbids (GitHub
+// #334).
+//
+// The third operation holds what param-style-matrix does not: only the default
+// is suppressed, so a declared explode survives at a location that takes no
+// style. param-style-matrix declares neither keyword there, so reverting the
+// early return that dropped a declared explode leaves it green. This case also
+// pins the one diag.InvalidLocationKeyword this fixture raises; see that code's
+// GoDoc for why it is a warning.
+func assertParamQuerystring(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	report, ok := opByName(doc, "runReport")
+	require.True(t, ok)
+	require.Len(t, report.Bindings.HTTP, 1)
+	require.Len(t, report.Bindings.HTTP[0].ParamBindings, 1)
+	qs := report.Bindings.HTTP[0].ParamBindings[0]
+	assert.Equal(t, ir.HTTPLocationQuerystring, qs.Location)
+	assert.Equal(t, "application/x-www-form-urlencoded", qs.ContentType,
+		"the media type is the whole of a querystring binding's declared serialization")
+	assert.Empty(t, qs.Style, "style is not a legal keyword at in: querystring")
+	assert.Nil(t, qs.Explode, "and explode qualifies a style there is none of")
+
+	summary, ok := opByName(doc, "summarize")
+	require.True(t, ok)
+	require.Len(t, summary.Bindings.HTTP, 1)
+	require.Len(t, summary.Bindings.HTTP[0].ParamBindings, 1)
+	q := summary.Bindings.HTTP[0].ParamBindings[0]
+	assert.Equal(t, ir.HTTPLocationQuery, q.Location)
+	assert.Equal(t, "form", q.Style, "a query parameter still takes its own location's default")
+	require.NotNil(t, q.Explode)
+	assert.True(t, *q.Explode)
+
+	raw, ok := opByName(doc, "rawReport")
+	require.True(t, ok)
+	require.Len(t, raw.Bindings.HTTP, 1)
+	require.Len(t, raw.Bindings.HTTP[0].ParamBindings, 1)
+	declared := raw.Bindings.HTTP[0].ParamBindings[0]
+	assert.Equal(t, ir.HTTPLocationQuerystring, declared.Location)
+	assert.Empty(t, declared.Style, "no style is invented beside a declared explode either")
+	require.NotNil(t, declared.Explode, "but the explode the document declares is not dropped")
+	assert.False(t, *declared.Explode)
+
+	assert.Equal(t,
+		"parameter field explode is not allowed for in=querystring; lowered as declared",
+		openapitest.DiagMessageAt(t, diags, diag.InvalidLocationKeyword, ir.SeverityWarning,
+			"/paths/~1reports~1raw/get/parameters/0/explode"))
+}
+
+// assertQuerystringForbiddenKeywords pins the construct assertParamQuerystring's
+// rawReport operation cannot see on its own: explode and allowReserved reported
+// at their own pointers rather than only one of the two. See
+// diag.InvalidLocationKeyword's GoDoc for why the parser catches neither and why
+// this compiler's report is a warning. Both values still lower as declared:
+// dropping content the document states is an emitter's call, not a compiler's.
+func assertQuerystringForbiddenKeywords(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	explodeOp, ok := opByName(doc, "explodeOnly")
+	require.True(t, ok)
+	require.Len(t, explodeOp.Bindings.HTTP, 1)
+	require.Len(t, explodeOp.Bindings.HTTP[0].ParamBindings, 1)
+	explodeBinding := explodeOp.Bindings.HTTP[0].ParamBindings[0]
+	assert.Equal(t, ir.HTTPLocationQuerystring, explodeBinding.Location)
+	require.NotNil(t, explodeBinding.Explode, "the declared explode is not dropped")
+	assert.False(t, *explodeBinding.Explode)
+	assert.Equal(t,
+		"parameter field explode is not allowed for in=querystring; lowered as declared",
+		openapitest.DiagMessageAt(t, diags, diag.InvalidLocationKeyword, ir.SeverityWarning,
+			"/paths/~1a/get/parameters/0/explode"))
+
+	reservedOp, ok := opByName(doc, "reservedOnly")
+	require.True(t, ok)
+	require.Len(t, reservedOp.Bindings.HTTP, 1)
+	require.Len(t, reservedOp.Bindings.HTTP[0].ParamBindings, 1)
+	reservedBinding := reservedOp.Bindings.HTTP[0].ParamBindings[0]
+	assert.Equal(t, ir.HTTPLocationQuerystring, reservedBinding.Location)
+	assert.True(t, reservedBinding.AllowReserved, "the declared allowReserved is not dropped")
+	assert.Equal(t,
+		"parameter field allowReserved is not allowed for in=querystring; lowered as declared",
+		openapitest.DiagMessageAt(t, diags, diag.InvalidLocationKeyword, ir.SeverityWarning,
+			"/paths/~1b/get/parameters/0/allowReserved"))
+}
+
+// assertParamAllowReservedLocations pins diag.InapplicableLocationKeyword
+// through the whole compile: OpenAPI 3.1 applies allowReserved to in: query
+// alone, so a path, header or cookie declaration is reported at the keyword's
+// own pointer, a declared false among them, while a query declaration stays
+// silent. Every declared value still lowers as declared.
+func assertParamAllowReservedLocations(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "report")
+	require.True(t, ok)
+	require.Len(t, op.Bindings.HTTP, 1)
+	byParam := map[string]ir.HTTPParamBinding{}
+	for _, pb := range op.Bindings.HTTP[0].ParamBindings {
+		byParam[pb.WireName] = pb
+	}
+	require.Len(t, byParam, 4, "every declared parameter binds exactly once")
+
+	assert.True(t, byParam["id"].AllowReserved, "a path declaration still lowers as declared")
+	assert.True(t, byParam["X-Trace"].AllowReserved, "a header declaration still lowers as declared")
+	assert.False(t, byParam["session"].AllowReserved, "a declared false is kept as false")
+	assert.True(t, byParam["q"].AllowReserved, "a query declaration lowers as declared")
+
+	const rule = " in OpenAPI 3.1, which applies it to in=query alone; lowered as declared"
+	want := map[string]string{
+		"/paths/~1reports~1{id}/get/parameters/0/allowReserved": "parameter field allowReserved has no effect for in=path" + rule,
+		"/paths/~1reports~1{id}/get/parameters/1/allowReserved": "parameter field allowReserved has no effect for in=header" + rule,
+		"/paths/~1reports~1{id}/get/parameters/2/allowReserved": "parameter field allowReserved has no effect for in=cookie" + rule,
+	}
+	got := map[string]string{}
+	for _, d := range diags {
+		if d.Code == diag.InapplicableLocationKeyword {
+			assert.Equal(t, ir.SeverityWarning, d.Severity)
+			assert.NotContains(t, got, string(d.Provenance.Pointer), "one declaration, one report")
+			got[string(d.Provenance.Pointer)] = d.Message
+		}
+	}
+	assert.Equal(t, want, got)
+}
+
+// assertParamRefInheritance pins the rule
+// docs/compilers/openapi.md#ref-use-site at a parameter whose schema is a $ref:
+// docs, deprecation and default come from the referent when the use site is
+// silent, and from the use site when it is not. Constraints inherit at neither
+// carrier, so the identical property is asserted beside it (GitHub #131). The
+// bound the use site declares beside the $ref is asserted at both carriers
+// against the referent's own: use-site precedence would publish 100 as the
+// whole truth while the document enforces 64 (§12.2, GitHub #428).
+func assertParamRefInheritance(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "listItems")
+	require.True(t, ok)
+	cursor, ok := paramByName(op, "cursor")
+	require.True(t, ok)
+	assert.Equal(t, ir.Docs{Summary: "Cursor", Description: "Opaque pagination cursor."}, cursor.Docs)
+	assert.NotNil(t, cursor.Deprecation)
+	require.NotNil(t, cursor.Default)
+	assert.Equal(t, "0", cursor.Default.Str)
+	assert.Nil(t, cursor.Constraints, "the referent's bound stays on the referent")
+
+	override, ok := paramByName(op, "override")
+	require.True(t, ok)
+	assert.Equal(t, "Cursor for this endpoint only.", override.Docs.Description,
+		"a description beside the $ref wins over the referent's")
+	assert.Equal(t, "Cursor", override.Docs.Summary,
+		"...and a keyword the use site is silent about still inherits")
+	require.NotNil(t, override.Default)
+	assert.Equal(t, "9", override.Default.Str)
+	require.NotNil(t, override.Constraints, "a bound beside the $ref lands on the carrier")
+	require.NotNil(t, override.Constraints.MaxLength)
+	assert.Equal(t, int64(100), *override.Constraints.MaxLength,
+		"and it is the use site's own, not narrowed against the referent's here")
+
+	holder, ok := doc.Types[namedID("Holder")].(*ir.Model)
+	require.True(t, ok)
+	prop, ok := propByWire(holder, "cursor")
+	require.True(t, ok)
+	assert.Equal(t, cursor.Docs, prop.Docs, "the property inherits exactly what the parameter does")
+	assert.NotNil(t, prop.Deprecation)
+	require.NotNil(t, prop.Default)
+	assert.Equal(t, *cursor.Default, *prop.Default)
+	assert.Nil(t, prop.Constraints, "neither carrier inherits the referent's constraints")
+
+	overrideProp, ok := propByWire(holder, "override")
+	require.True(t, ok)
+	assert.Equal(t, override.Constraints, overrideProp.Constraints,
+		"and a property keeps its own bound exactly as the parameter does")
+
+	decl, ok := doc.Types[namedID("Cursor")].(*ir.Scalar)
+	require.True(t, ok)
+	require.NotNil(t, decl.Constraints)
+	require.NotNil(t, decl.Constraints.MaxLength)
+	assert.Equal(t, int64(64), *decl.Constraints.MaxLength,
+		"a consumer that wants the bound reads it off the referent, and conjoins "+
+			"it with the use site's: both are in force, and 64 is the narrower")
+}
+
+// assertHeaderContentSchema pins that both spellings of a header's type lower
+// alike. The content spelling used to reach lowerHeader with no schema at all —
+// the header became t/prim/any and its constraints and xml hints went with it,
+// without a diagnostic (GitHub #139).
+//
+// The two headers declare the same type deliberately: comparing them against
+// each other, rather than against a written-out expectation, is what makes the
+// assertion about the spellings agreeing rather than about one of them.
+func assertHeaderContentSchema(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "getReport")
+	require.True(t, ok)
+	require.Len(t, op.Responses, 1)
+	headers := op.Responses[0].Headers
+	require.Len(t, headers, 4)
+
+	bySchema, ok := headerByWire(headers, "X-Report-Schema")
+	require.True(t, ok)
+	byContent, ok := headerByWire(headers, "X-Report-Content")
+	require.True(t, ok)
+
+	assert.Equal(t, bySchema.Type, byContent.Type,
+		"a content-style header resolves the same type as the schema spelling")
+	assert.NotEqual(t, ir.TypeID("t/prim/any"), byContent.Type.Target,
+		"the type is resolved rather than degraded to the top type")
+	assert.Equal(t, bySchema.Constraints, byContent.Constraints,
+		"the constraints written under content are not dropped with the schema")
+	require.NotNil(t, byContent.XML)
+	assert.Equal(t, "ReportContent", byContent.XML.Name,
+		"the xml hints written under content reach the header")
+
+	require.NotNil(t, byContent.Encoding)
+	assert.Equal(t, "application/xml", byContent.Encoding.MediaType,
+		"the media type serializing the header's value is kept, which the schema spelling has none of")
+	assert.Nil(t, bySchema.Encoding, "the schema spelling names no media type")
+
+	byRef, ok := headerByWire(headers, "X-Report-Ref")
+	require.True(t, ok)
+	assert.Equal(t, namedID("ReportID"), byRef.Type.Target,
+		"a $ref under content resolves to the named component, not to an anonymous copy")
+
+	assertHeaderStyleAndExplodeKept(t, headers)
+	assertNoErrorDiags(t, diags)
+}
+
+// assertHeaderStyleAndExplodeKept covers the header keywords ir.Property has no
+// field for. A header's explode decides whether a collection value is written as
+// one repeated field or one joined value, so dropping it left the IR unable to
+// say how the header goes on the wire — and it was dropped without a word
+// (GitHub #39). Kept verbatim, since the IR can close the gap by adding fields.
+func assertHeaderStyleAndExplodeKept(t *testing.T, headers []ir.Property) {
+	t.Helper()
+	list, ok := headerByWire(headers, "X-Report-List")
+	require.True(t, ok)
+
+	for key, want := range map[string]string{
+		"openapi:style":   `"simple"`,
+		"openapi:explode": `true`,
+	} {
+		entry, found := list.Unmodeled[key]
+		require.True(t, found, "%s is kept", key)
+		assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+		assert.JSONEq(t, want, string(entry.Value))
+	}
+
+	plain, ok := headerByWire(headers, "X-Report-Schema")
+	require.True(t, ok)
+	assert.NotContains(t, plain.Unmodeled, "openapi:explode",
+		"a header that declares neither keyword records neither")
+}
+
+// assertParamContentFields pins GitHub #611: electing a parameter's or header's
+// `content` spelling reads the whole Media Type Object rather than only its
+// schema, so the object's examples reach the carrier and what the carrier has no
+// home for is kept verbatim under the content entry's own scope. The schema
+// spelling beside them elects no media type and records none of it.
+func assertParamContentFields(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "search")
+	require.True(t, ok)
+
+	filter, ok := paramByName(op, "filter")
+	require.True(t, ok)
+	require.Len(t, filter.Examples, 1, "the media type's examples reach the parameter")
+	assert.Equal(t, "one", filter.Examples[0].Name)
+	assert.Equal(t, "One kind", filter.Examples[0].Summary)
+
+	const scope = "openapi:content/application~1json/"
+	assert.Equal(t, ir.ReasonVendorExtension, filter.Unmodeled[scope+"x-note"].Reason)
+	assert.Equal(t, ir.ReasonNoIRHome, filter.Unmodeled[scope+"itemSchema"].Reason,
+		"a parser-modelled field with no ir.Parameter home is kept rather than dropped")
+
+	plain, ok := paramByName(op, "plain")
+	require.True(t, ok)
+	assert.Empty(t, plain.Examples, "the schema spelling elects no media type to take examples from")
+	assert.Empty(t, plain.Unmodeled, "nor any content-scoped entry")
+
+	require.Len(t, op.Responses, 1)
+	require.Len(t, op.Responses[0].Headers, 1)
+	header := op.Responses[0].Headers[0]
+	require.Len(t, header.Examples, 2, "the header's own example and its media type's are both kept")
+	assert.Empty(t, header.Examples[0].Name, "its own singular example comes first")
+	assert.Equal(t, "hit", header.Examples[1].Name)
+	assert.Equal(t, ir.ReasonVendorExtension, header.Unmodeled[scope+"x-hdr"].Reason)
+
+	openapitest.AssertInfoDiagAt(t, diags,
+		"/paths/~1search/get/parameters/0/content/application~1json/itemSchema")
+}
diff --git a/compilers/openapi/e2e/conformance_pathitems_test.go b/compilers/openapi/e2e/conformance_pathitems_test.go
new file mode 100644
index 00000000..ec94cc4f
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_pathitems_test.go
@@ -0,0 +1,310 @@
+package e2e_test
+
+import (
+	"encoding/json/jsontext"
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertWebhooks(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "onNewPet")
+	require.True(t, ok)
+	require.Len(t, op.Bindings.HTTP, 1)
+	assert.True(t, op.Bindings.HTTP[0].IsWebhook, "webhook operation carries IsWebhook")
+	assert.Equal(t, "newPet", op.Bindings.HTTP[0].WebhookName, "the webhooks-map key names the event")
+	assert.Empty(t, op.Bindings.HTTP[0].URITemplate, "a webhook carries no URI template")
+	assertPathItemServersKept(t, op, "https://hooks.example.com")
+	assertOwnServersKeptBesideThem(t, op, "https://hooks-override.example.com")
+	assertWebhookGroupIsAHint(t, doc)
+
+	// Two keys a URI template would misstate: braces that belong to the event's
+	// name, and the empty key, which names nothing. Neither declares an
+	// operationId, so the hint is built from the method and the key.
+	ops := allOperations(doc)
+	for _, hook := range []struct {
+		id        ir.OpID
+		key, hint string
+	}{
+		{"op/openapi/webhooks/{tenant}.created/post", "{tenant}.created", "post_tenant_created"},
+		{"op/openapi/webhooks//post", "", "post"},
+	} {
+		i := slices.IndexFunc(ops, func(op ir.Operation) bool { return op.ID == hook.id })
+		require.GreaterOrEqual(t, i, 0, "the webhook keyed %q is mounted", hook.key)
+		require.Len(t, ops[i].Bindings.HTTP, 1)
+		b := ops[i].Bindings.HTTP[0]
+		assert.True(t, b.IsWebhook)
+		assert.Equal(t, hook.key, b.WebhookName, "the key, verbatim")
+		assert.Empty(t, b.URITemplate, "a webhook has no URI template")
+		assert.Equal(t, hook.hint, ops[i].Name.Hint)
+	}
+}
+
+// assertOwnServersKeptBesideThem pins the overriding half of the servers pair in
+// the corpus, so the two-order oracle and the JSON round-trip see it. OpenAPI
+// says an operation's own servers override its path item's, so keeping only the
+// path item's recorded the superseded list and dropped the effective one.
+//
+// The two keys are asserted together because the hazard is that they collapse
+// into one: a single key holding both would leave the surviving list depending
+// on which lowering ran last, which only a two-order diff can see.
+func assertOwnServersKeptBesideThem(t *testing.T, op ir.Operation, url string) {
+	t.Helper()
+	entry, ok := op.Unmodeled["openapi:operationServers"]
+	require.True(t, ok, "the operation's own servers are kept beside its path item's")
+	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+	assert.JSONEq(t, `[{"url":"`+url+`"}]`, string(entry.Value))
+	assert.NotEqual(t, entry.Value, op.Unmodeled["openapi:servers"].Value,
+		"and the two keys hold different declarations, not one overwriting the other")
+}
+
+// assertPathItemServersKept pins that a path item's servers survive whichever
+// parent the path item hangs from. The preserve-plus-diagnostic path used to be
+// reached only from the `paths` walk, so the same override written on a webhook
+// or a callback disappeared with nothing said (GitHub #39).
+func assertPathItemServersKept(t *testing.T, op ir.Operation, url string) {
+	t.Helper()
+	entry, ok := op.Unmodeled["openapi:servers"]
+	require.True(t, ok, "the path item's servers are kept on the operation")
+	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+	assert.JSONEq(t, `[{"url":"`+url+`"}]`, string(entry.Value))
+}
+
+// assertWebhookGroupIsAHint pins which of the two things the group's name is.
+// The compiler synthesizes the group to hold webhook operations, so no document
+// declares it and Naming.Source — the spelling the source used — is the wrong
+// channel; the "default" group the tag walk synthesizes carries a Hint for the
+// same reason (GitHub #184).
+//
+// Asserted here rather than left to the golden because the golden records the
+// value either way: a reader diffing it sees a name move between two fields
+// without being told which one is correct.
+func assertWebhookGroupIsAHint(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	require.Len(t, doc.Services, 1)
+	for _, g := range doc.Services[0].Groups {
+		if g.Name.Hint != "webhooks" {
+			continue
+		}
+		assert.Empty(t, g.Name.Source, "a group no document declares carries no source spelling")
+		assert.Empty(t, g.Name.Canonical, "and no words derived from one")
+		return
+	}
+	t.Fatal("no group carries the webhooks hint")
+}
+
+func assertCallbacks(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "subscribe")
+	require.True(t, ok)
+	require.Len(t, op.Bindings.HTTP, 1)
+	require.Len(t, op.Bindings.HTTP[0].Callbacks, 1)
+	assert.Equal(t, "{$request.body#/callbackUrl}", op.Bindings.HTTP[0].Callbacks[0].Expression)
+	assert.NotEmpty(t, op.Bindings.HTTP[0].Callbacks[0].Operations)
+	cb, ok := opByName(doc, "onEvent")
+	require.True(t, ok, "the callback operation is registered alongside its parent")
+	assertPathItemServersKept(t, cb, "https://callbacks.example.com")
+	assert.NotContains(t, op.Unmodeled, "openapi:servers",
+		"the callback's own servers stay on the callback, not on the parent")
+}
+
+// assertPathItemAnchoredKey pins that an undeclared path-item key whose value
+// carries a YAML anchor is kept and reported exactly as a plainly-valued one
+// beside it is (GitHub #412), rather than reaching the IR in no form and with no
+// diagnostic. Each key is asserted with its own marker so an entry recovered
+// under the wrong key cannot pass for the right one.
+func assertPathItemAnchoredKey(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "getX")
+	require.True(t, ok)
+
+	for _, tc := range []struct{ key, marker, at string }{
+		{"openapi:pathItem/bogusAnchored", "ANCHORED", "/paths/~1x/bogusAnchored"},
+		{"openapi:pathItem/plainBogus", "PLAIN", "/paths/~1x/plainBogus"},
+	} {
+		entry := unmodeledEntry(t, op.Unmodeled, tc.key)
+		assert.JSONEq(t, `{"responses":{"200":{"description":"`+tc.marker+`"}}}`, string(entry.Value),
+			"%s keeps the value the source wrote", tc.key)
+		assert.Equal(t, ir.ReasonOutOfScope, entry.Reason,
+			"OpenAPI defines no such key on a path item, so no IR node is coming for it")
+		assert.Equal(t, jsontext.Pointer(tc.at), entry.Provenance.Pointer)
+		assert.Equal(t, []ir.Severity{ir.SeverityWarning},
+			diagsAt(diags, "openapi/unknown-object-key", tc.at),
+			"%s is announced once, at the key's own pointer, graded as any undeclared key", tc.key)
+	}
+}
+
+// assertPathItemRefSiblings pins what the fields a path item writes beside its
+// $ref lower to, and that the item the $ref names still mounts unchanged.
+//
+// The operation written beside the reference is a declaration of its own: it
+// mounts at the path's own pointers, and the item-level constructs written
+// beside it reach every operation mounted at that path — the referent's
+// included — which is why the summary is asserted on the referenced item's
+// operation as well as on the sibling's (GitHub #577).
+func assertPathItemRefSiblings(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	t.Helper()
+	sibling, ok := opByName(doc, "putA")
+	require.True(t, ok, "the operation written beside the $ref reaches the IR")
+	assert.Equal(t, ir.OpID("op/openapi/paths/~1a/put"), sibling.ID)
+	assert.Equal(t, jsontext.Pointer("/paths/~1a/put"), sibling.Provenance.Pointer,
+		"a sibling operation is declared where it is mounted, not at the item it references")
+	assert.Equal(t, []string{"PUT"}, methodsOf(sibling))
+
+	for _, tc := range []struct{ key, value, at string }{
+		{"openapi:pathItemSummary", `"written beside the ref"`, "/paths/~1a/summary"},
+		{"openapi:servers", `[{"url":"https://beside.example"}]`, "/paths/~1a/servers"},
+		{"openapi:pathItem/x-beside", `"use"`, "/paths/~1a/x-beside"},
+		{"openapi:pathItem/bogusBeside", `{"responses":{"200":{"description":"BESIDE"}}}`,
+			"/paths/~1a/bogusBeside"},
+	} {
+		entry := unmodeledEntry(t, sibling.Unmodeled, tc.key)
+		assert.JSONEq(t, tc.value, string(entry.Value), "%s keeps what the use site declared", tc.key)
+		assert.Equal(t, jsontext.Pointer(tc.at), entry.Provenance.Pointer)
+	}
+	assert.Equal(t, []ir.Severity{ir.SeverityWarning},
+		diagsAt(diags, "openapi/unknown-object-key", "/paths/~1a/bogusBeside"),
+		"the use site's undeclared key is announced at its own pointer, as any other is")
+
+	require.Len(t, sibling.Params, 1, "the use site's item parameter merges into its operation")
+	assert.Equal(t, "beside", sibling.Params[0].Name.Source)
+	assert.Equal(t, jsontext.Pointer("/paths/~1a/parameters/0"), sibling.Params[0].Provenance.Pointer)
+
+	// The referenced item's own operation keeps mounting at both paths, and the
+	// constructs written beside the reference reach it too.
+	atA := opByID(t, doc, "op/openapi/paths/~1a/get")
+	assert.Equal(t, "getB", atA.Name.Source)
+	assert.Equal(t, jsontext.Pointer("/paths/~1b/get"), atA.Provenance.Pointer)
+	assert.Contains(t, atA.Unmodeled, "openapi:pathItemSummary")
+	atB := opByID(t, doc, "op/openapi/paths/~1b/get")
+	assert.Equal(t, jsontext.Pointer("/paths/~1b/get"), atB.Provenance.Pointer)
+	assert.NotContains(t, atB.Unmodeled, "openapi:pathItemSummary",
+		"the referent's own path keeps only what it declares")
+}
+
+// methodsOf returns the wire methods an operation's HTTP bindings declare.
+func methodsOf(op ir.Operation) []string {
+	methods := make([]string, 0, len(op.Bindings.HTTP))
+	for _, b := range op.Bindings.HTTP {
+		methods = append(methods, b.Method)
+	}
+	return methods
+}
+
+// opByID returns the operation carrying id, which is what tells two mounts of
+// one $ref'd declaration apart where a source name cannot.
+func opByID(t *testing.T, doc *ir.Document, id string) ir.Operation {
+	t.Helper()
+	for _, g := range doc.Services[0].Groups {
+		for _, op := range g.Operations {
+			if string(op.ID) == id {
+				return op
+			}
+		}
+	}
+	t.Fatalf("operation %s not found", id)
+	return ir.Operation{}
+}
+
+// assertPathItemDocs pins that a path item's own documentation survives at every
+// route that reaches a path item, and that keeping it costs the operation
+// nothing it declared for itself.
+//
+// It is kept rather than merged: ir.Docs holds the operation's summary and
+// description, a path item's pair documents the path, and merging the two would
+// need a precedence rule and would attach to an operation text its author never
+// wrote. So the assertion is that both subjects survive side by side.
+func assertPathItemDocs(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	for _, tc := range []struct{ op, summary, description string }{
+		{"listPets", "Pet collection", "Everything addressable at /pets."},
+		{"createPet", "Pet collection", "Everything addressable at /pets."},
+		{"onPetCreated", "Creation callback", "Delivered once the pet exists."},
+		{"onPetDeleted", "Pet deleted", "Delivered when a pet is removed."},
+	} {
+		op, ok := opByName(doc, tc.op)
+		require.True(t, ok, "operation %s", tc.op)
+		assertPathItemDocsKept(t, op, tc.summary, tc.description)
+	}
+
+	listPets, ok := opByName(doc, "listPets")
+	require.True(t, ok)
+	assert.Equal(t, "List pets", listPets.Docs.Summary,
+		"the operation's own summary is what Docs holds")
+	assert.Equal(t, "Returns every pet.", listPets.Docs.Description)
+
+	createPet, ok := opByName(doc, "createPet")
+	require.True(t, ok)
+	assert.Empty(t, createPet.Docs.Summary,
+		"and an operation that documents nothing has nothing invented for it")
+
+	// And the decision is announced at the operation that carries the entry,
+	// once, rather than being taken silently.
+	assert.Equal(t, []ir.Severity{ir.SeverityInfo},
+		diagsAt(diags, "openapi/degraded-construct", "/paths/~1pets/get"))
+	assert.Equal(t, []ir.Severity{ir.SeverityInfo},
+		diagsAt(diags, "openapi/degraded-construct", "/webhooks/petDeleted/post"))
+}
+
+// assertPathItemDocsKept checks one operation kept the pair its own path item
+// declared, under the keys that name which object the text came from.
+func assertPathItemDocsKept(t *testing.T, op ir.Operation, summary, description string) {
+	t.Helper()
+	kept, ok := op.Unmodeled["openapi:pathItemSummary"]
+	require.True(t, ok, "the path item's summary is kept on %s", op.ID)
+	assert.Equal(t, ir.ReasonNoIRHome, kept.Reason)
+	assert.JSONEq(t, `"`+summary+`"`, string(kept.Value))
+
+	kept, ok = op.Unmodeled["openapi:pathItemDescription"]
+	require.True(t, ok, "the path item's description is kept on %s", op.ID)
+	assert.Equal(t, ir.ReasonNoIRHome, kept.Reason)
+	assert.JSONEq(t, `"`+description+`"`, string(kept.Value))
+}
+
+// assertPathItemOperations pins that every operation a 3.2 path item declares
+// becomes an ir.Operation, whichever field declared it and whichever of the
+// three routes reaches the path item.
+//
+// The walk read the fixed method fields and nothing else, so an
+// additionalOperations entry was dropped entire — and with it every type
+// reachable only through it, which is why the request body's schema is asserted
+// to be in the registry rather than merely referenced from an operation.
+func assertPathItemOperations(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	for _, tc := range []struct{ op, method string }{
+		{"queryIndex", "QUERY"},
+		{"purgeIndex", "PURGE"},
+		{"mixedCaseIndex", "mIxEdCase"},
+		{"purgeCallback", "PURGE"},
+		{"onFlush", "FLUSH"},
+	} {
+		op, ok := opByName(doc, tc.op)
+		require.True(t, ok, "operation %s", tc.op)
+		require.Len(t, op.Bindings.HTTP, 1)
+		assert.Equal(t, tc.method, op.Bindings.HTTP[0].Method,
+			"%s binds the method as the source spelled it", tc.op)
+	}
+
+	onFlush, ok := opByName(doc, "onFlush")
+	require.True(t, ok)
+	assert.True(t, onFlush.Bindings.HTTP[0].IsWebhook,
+		"a webhook mount marks the binding whichever field declared the operation")
+	assert.Equal(t, "cacheFlushed", onFlush.Bindings.HTTP[0].WebhookName,
+		"the webhooks-map key names the event")
+	assert.Empty(t, onFlush.Bindings.HTTP[0].URITemplate)
+
+	subscribe, ok := opByName(doc, "subscribeIndex")
+	require.True(t, ok)
+	require.Len(t, subscribe.Bindings.HTTP, 1)
+	require.Len(t, subscribe.Bindings.HTTP[0].Callbacks, 1)
+	purgeCallback, ok := opByName(doc, "purgeCallback")
+	require.True(t, ok)
+	assert.Equal(t, []ir.OpID{purgeCallback.ID}, subscribe.Bindings.HTTP[0].Callbacks[0].Operations,
+		"an expression declaring only additionalOperations still binds to its parent")
+
+	queryIndex, ok := opByName(doc, "queryIndex")
+	require.True(t, ok)
+	assert.NotNil(t, doc.Types[openapitest.BodyTarget(t, queryIndex.Request)],
+		"the request body schema is interned, not merely referenced")
+}
diff --git a/compilers/openapi/e2e/conformance_responses_test.go b/compilers/openapi/e2e/conformance_responses_test.go
new file mode 100644
index 00000000..c16b70c2
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_responses_test.go
@@ -0,0 +1,145 @@
+package e2e_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertPerStatusErrors(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op, ok := opByName(doc, "getWidgets")
+	require.True(t, ok)
+	require.Len(t, op.Responses, 1, "the 2xx success response")
+	faults := map[ir.StatusRange]string{}
+	byRange := map[ir.StatusRange]ir.ErrorCase{}
+	for _, ec := range op.Errors {
+		require.Len(t, ec.Conditions.StatusCodes, 1)
+		rng := ec.Conditions.StatusCodes[0]
+		byRange[rng] = ec
+		faults[rng] = ec.Fault
+	}
+	assert.Equal(t, map[ir.StatusRange]string{
+		{From: 404, To: 404}: "client",
+		{From: 429, To: 429}: "client",
+		{From: 500, To: 599}: "server",
+	}, faults, "each range classified from its own status")
+	require.NotNil(t, op.Default, "the default is classed neither way, so it is no error case")
+	assert.Equal(t, []ir.StatusRange{{}}, op.Default.Conditions.StatusCodes, "the catch-all alone")
+	assert.Equal(t, "default", op.Default.Name.Hint)
+
+	assertErrorCaseIsAResponse(t, byRange)
+}
+
+// assertErrorCaseIsAResponse holds the three fields ir.ErrorCase gained in
+// GitHub #422 to the claim ir.Response already carried: every status spelling,
+// every header and every media type survives, whatever the status class.
+//
+// The 5XX case doubles as the control: an error response declaring no headers
+// and no content gets neither, so what the other two carry marks a declaration
+// rather than appearing on every error case.
+func assertErrorCaseIsAResponse(t *testing.T, byRange map[ir.StatusRange]ir.ErrorCase) {
+	t.Helper()
+	hints := map[ir.StatusRange]string{}
+	for rng, ec := range byRange {
+		hints[rng] = ec.Name.Hint
+	}
+	assert.Equal(t, map[ir.StatusRange]string{
+		{From: 404, To: 404}: "404",
+		{From: 429, To: 429}: "429",
+		{From: 500, To: 599}: "5_xx",
+	}, hints, "the key as declared, then neutralized")
+
+	notFound, ok := byRange[ir.StatusRange{From: 404, To: 404}]
+	require.True(t, ok)
+	require.NotNil(t, notFound.Payload)
+	require.Len(t, notFound.Payload.Contents, 1)
+	assert.Equal(t, "application/json", notFound.Payload.Contents[0].MediaType,
+		"a single-media error keeps the key it was written under")
+
+	throttled, ok := byRange[ir.StatusRange{From: 429, To: 429}]
+	require.True(t, ok)
+	require.NotNil(t, throttled.Payload)
+	require.Len(t, throttled.Payload.Contents, 2, "every media type is kept, none elected")
+	assert.Equal(t, "t/openapi/components/schemas/Problem",
+		string(throttled.Payload.Contents[1].Type.Target),
+		"the second media type keeps its own schema rather than the first's")
+	wire := make([]string, 0, len(throttled.Headers))
+	for _, h := range throttled.Headers {
+		wire = append(wire, h.WireName)
+	}
+	assert.Equal(t, []string{"Retry-After", "X-RateLimit-Remaining"}, wire,
+		"the headers that only ever appear on an error status are structural")
+
+	serverErr, ok := byRange[ir.StatusRange{From: 500, To: 599}]
+	require.True(t, ok)
+	assert.Nil(t, serverErr.Payload, "an error response declaring no content gets no payload")
+	assert.Empty(t, serverErr.Headers, "an error response declaring no headers gets none")
+	for rng, ec := range byRange {
+		assert.NotContains(t, ec.Unmodeled, "openapi:content", "%v keeps no content map", rng)
+		assert.NotContains(t, ec.Unmodeled, "openapi:headers", "%v keeps no headers map", rng)
+	}
+}
+
+// assertDefaultResponse pins that a `default` response lowers to the operation's
+// Default, whole, in the three shapes it takes: the operation's only response,
+// the fallback beside a success, and a bare one with no body. In none is the
+// catch-all among Errors, since `default` answers successes and failures alike
+// and the compiler classes it as neither (ir-design §7.2). The control is the
+// 200 beside the default, which stays a Response.
+func assertDefaultResponse(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	catchAll := []ir.StatusRange{{From: 0, To: 0}}
+	byOp := map[string]ir.Operation{}
+	for _, name := range []string{"purgeCache", "getItem", "ping"} {
+		op, ok := opByName(doc, name)
+		require.True(t, ok, "operation %s", name)
+		require.NotNil(t, op.Default, "%s: the default is kept as Default", name)
+		assert.Empty(t, op.Errors, "%s: the catch-all is no error case", name)
+		assert.Equal(t, catchAll, op.Default.Conditions.StatusCodes, "%s: the catch-all alone", name)
+		assert.Equal(t, "default", op.Default.Name.Hint, "%s: the key as written", name)
+		byOp[name] = op
+	}
+
+	purge := byOp["purgeCache"]
+	assert.Empty(t, purge.Responses, "a lone default is the operation's whole description of the outcome")
+	require.NotNil(t, purge.Default.Payload)
+	require.Len(t, purge.Default.Payload.Contents, 1)
+	assert.Equal(t, "application/json", purge.Default.Payload.Contents[0].MediaType)
+	assert.Equal(t, "the cache was purged, or it was not", purge.Default.Docs.Description)
+
+	item := byOp["getItem"]
+	require.Len(t, item.Responses, 1, "the 200 stays a Response beside the default")
+	assert.Equal(t, []ir.StatusRange{{From: 200, To: 200}}, item.Responses[0].Conditions.StatusCodes)
+	require.NotNil(t, item.Default.Payload)
+	require.Len(t, item.Default.Payload.Contents, 1)
+	assert.Equal(t, namedID("Problem"), item.Default.Payload.Contents[0].Type.Target,
+		"the default keeps its own body, apart from the success one")
+	require.NotNil(t, item.Responses[0].Payload)
+	assert.Equal(t, namedID("Item"), item.Responses[0].Payload.Contents[0].Type.Target)
+
+	ping := byOp["ping"]
+	assert.Empty(t, ping.Responses)
+	assert.Nil(t, ping.Default.Payload, "a default declaring no content gets no payload")
+	assert.Equal(t, "pong", ping.Default.Docs.Description)
+}
+
+// assertResponseSummary32 pins GitHub #615's Response.summary: the 3.2 field
+// reaches Docs.Summary on both status classes, because it is read in the one
+// shared lowering both use, and the document draws no unknown-key warning for a
+// key its dialect defines.
+func assertResponseSummary32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "deleteItem")
+	require.True(t, ok)
+	require.Len(t, op.Responses, 1)
+	assert.Equal(t, "The item was deleted", op.Responses[0].Docs.Summary)
+	assert.Equal(t, "The long form of the same fact.", op.Responses[0].Docs.Description)
+
+	require.Len(t, op.Errors, 1)
+	assert.Equal(t, "No such item", op.Errors[0].Docs.Summary,
+		"an error case is lowered by the same function, so it reads the field too")
+	assert.Empty(t, diagsAt(diags, diag.UnknownObjectKey, "/paths/~1items~1{id}/delete/responses/204/summary"),
+		"a key 3.2 defines is not an undefined key")
+}
diff --git a/compilers/openapi/e2e/conformance_scalars_test.go b/compilers/openapi/e2e/conformance_scalars_test.go
new file mode 100644
index 00000000..29d62e17
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_scalars_test.go
@@ -0,0 +1,408 @@
+package e2e_test
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+// assertEnumString pins a string enum and its one-member form, which is an
+// Enum as well: an `enum` keyword lowers to an Enum whatever its member count,
+// and only `const` lowers to a Literal (ir-design §4.5).
+func assertEnumString(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	e, ok := doc.Types[namedID("Color")].(*ir.Enum)
+	require.True(t, ok)
+	assert.Equal(t, ir.PrimString, e.ValueType)
+	assert.True(t, e.Closed)
+	require.Len(t, e.Members, 3)
+	assert.Equal(t, "red", e.Members[0].Value.Str)
+	assert.Equal(t, "blue", e.Members[2].Value.Str)
+
+	pinned, ok := doc.Types[namedID("Pinned")].(*ir.Enum)
+	require.True(t, ok, "a one-member enum is an Enum; got %T", doc.Types[namedID("Pinned")])
+	assert.Equal(t, ir.PrimString, pinned.ValueType)
+	assert.True(t, pinned.Closed)
+	require.Len(t, pinned.Members, 1)
+	assert.Equal(t, "only", pinned.Members[0].Value.Str)
+}
+
+func assertEnumNumeric(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	e, ok := doc.Types[namedID("BigCodes")].(*ir.Enum)
+	require.True(t, ok)
+	assert.Equal(t, ir.PrimInteger, e.ValueType)
+	require.Len(t, e.Members, 2)
+	assert.Equal(t, ir.ValueNumber, e.Members[1].Value.Kind)
+	// BigVal member value preserves the full 64-bit integer.
+	assert.Equal(t, ir.BigVal("9007199254740993"), e.Members[1].Value.Num)
+}
+
+// assertEmptyEnum covers `enum: []`: legal JSON Schema whose value space holds
+// no member, so the position accepts no instance. The IR says that exactly,
+// since a closed Enum admits its members and nothing else. Reading the keyword
+// off `len(enum) > 0` cannot tell an empty list from an absent one, so the
+// position would widen to what its siblings admit (GitHub #278). Holder's
+// `colour` is in the corpus so that a change reaching every enum, not only the
+// empty one, reddens this.
+func assertEmptyEnum(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	empty := map[string]ir.PrimKind{
+		"Nothing":          ir.PrimString,
+		"Bare":             ir.PrimAny,
+		"BesideProperties": ir.PrimAny,
+		"BesideAllOf":      ir.PrimAny,
+	}
+	for name, valueType := range empty {
+		e, ok := doc.Types[namedID(name)].(*ir.Enum)
+		require.True(t, ok, "%s lowers to an Enum, got %T", name, doc.Types[namedID(name)])
+		assert.True(t, e.Closed, "%s admits its members and nothing else", name)
+		assert.Empty(t, e.Members, "%s declares no member", name)
+		assert.Equal(t, valueType, e.ValueType,
+			"%s takes the declared scalar type where one is written", name)
+		assert.Equal(t, []ir.Severity{ir.SeverityWarning},
+			diagsAt(diags, "openapi/empty-enum", "/components/schemas/"+name),
+			"%s is reported once, since nobody writes an empty member list on purpose", name)
+	}
+
+	// An Enum has no home for a property set or a composition, so what the empty
+	// enum is written beside stays verbatim rather than being traded for it.
+	props := unmodeledEntry(t, doc.Types[namedID("BesideProperties")].Common().Unmodeled, "openapi:properties")
+	assert.Equal(t, ir.ReasonDegradedLowering, props.Reason)
+	assert.JSONEq(t, `{"x":{"type":"string"}}`, string(props.Value))
+	composed := unmodeledEntry(t, doc.Types[namedID("BesideAllOf")].Common().Unmodeled, "openapi:allOf")
+	assert.Equal(t, ir.ReasonDegradedLowering, composed.Reason)
+	assert.JSONEq(t, `[{"$ref":"#/components/schemas/Base"}]`, string(composed.Value))
+
+	holder, ok := doc.Types[namedID("Holder")].(*ir.Model)
+	require.True(t, ok)
+	colour, ok := propByWire(holder, "colour")
+	require.True(t, ok)
+	populated, ok := doc.Types[colour.Type.Target].(*ir.Enum)
+	require.True(t, ok, "a populated enum beside the degenerate ones is unaffected")
+	require.Len(t, populated.Members, 2)
+	assert.Equal(t, ir.PrimString, populated.ValueType)
+	assert.Empty(t, diagsAt(diags, "openapi/empty-enum", "/components/schemas/Holder/properties/colour"),
+		"and reports nothing")
+}
+
+// assertMissingArrayItems pins that a 3.0 schema writing type array and no
+// items is reported once, at its own pointer, wherever it sits and whatever it
+// lowers to: Choice is a union of literals (GitHub #650). Copy's $ref names
+// Holder's property coordinate and is declared first, so the property is
+// lowered twice. Holder's typed and empty arrays write items, so the list is
+// every report the document draws.
+func assertMissingArrayItems(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	var got []string
+	for _, d := range diags {
+		if d.Code == "openapi/missing-array-items" {
+			assert.Equal(t, ir.SeverityWarning, d.Severity, "at %s", d.Provenance.Pointer)
+			got = append(got, string(d.Provenance.Pointer))
+		}
+	}
+	slices.Sort(got)
+	assert.Equal(t, []string{
+		"/components/schemas/Bare",
+		"/components/schemas/Choice",
+		"/components/schemas/Holder/properties/tags",
+		"/paths/~1things/get/parameters/0/schema",
+	}, got)
+
+	bare, ok := doc.Types[namedID("Bare")].(*ir.List)
+	require.True(t, ok, "Bare still lowers to a List, got %T", doc.Types[namedID("Bare")])
+	assert.Equal(t, ir.TypeID("t/prim/any"), bare.Elem.Target, "over the top type")
+}
+
+func assertScalarFormat(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	h, ok := doc.Types[namedID("Holder")].(*ir.Model)
+	require.True(t, ok)
+	color, ok := propByWire(h, "color")
+	require.True(t, ok)
+	sc, ok := doc.Types[color.Type.Target].(*ir.Scalar)
+	require.True(t, ok, "unknown format hoists a named Scalar")
+	require.NotNil(t, sc.Encoding)
+	assert.Equal(t, "hex-color", sc.Encoding.Name)
+	require.NotNil(t, sc.Base)
+	assert.Equal(t, ir.TypeID("t/prim/string"), sc.Base.Target)
+	assert.False(t, color.Secret, "an ordinary format asks for no redaction")
+	// The bound survives the hoist the unknown format forced (GitHub #147).
+	require.NotNil(t, sc.Constraints, "the hoisted format scalar carries its own bounds")
+	require.NotNil(t, sc.Constraints.MinLength)
+	assert.Equal(t, int64(4), *sc.Constraints.MinLength)
+
+	// format: password asks for the value to be redacted and names no shape, so
+	// a property whose schema owns no node holds it, and its type is the bare
+	// string's (secret-format covers every other position).
+	token, ok := propByWire(h, "token")
+	require.True(t, ok)
+	assert.True(t, token.Secret)
+	assert.Equal(t, ir.PrimTypeID(ir.PrimString), token.Type.Target)
+
+	// An integer width selects its primitive whichever numeric type carries it.
+	for wire, want := range map[string]ir.PrimKind{"small": ir.PrimInt8, "count": ir.PrimUint32} {
+		p, ok := propByWire(h, wire)
+		require.True(t, ok)
+		assert.Equal(t, ir.PrimTypeID(want), p.Type.Target, "%s selects the shared primitive", wire)
+	}
+	// A float format on an integer admits only integral values, which no
+	// primitive narrower than integer holds, so it hoists over integer.
+	whole, ok := propByWire(h, "whole")
+	require.True(t, ok)
+	ws, ok := doc.Types[whole.Type.Target].(*ir.Scalar)
+	require.True(t, ok, "a pairing no primitive holds hoists a Scalar")
+	require.NotNil(t, ws.Base)
+	assert.Equal(t, ir.PrimTypeID(ir.PrimInteger), ws.Base.Target)
+	require.NotNil(t, ws.Encoding)
+	assert.Equal(t, "double", ws.Encoding.Name)
+}
+
+// assertSecretFormat pins where `format: password` lands at every position the
+// compiler reaches: Sensitive on the node a position owns, whatever its kind;
+// Property.Secret at a property or header owning none; and verbatim on a
+// parameter, which has no field. It reads the nodes rather than the golden's
+// bytes, so a fact that moved to another carrier still fails (GitHub #579).
+func assertSecretFormat(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	pw := requireSensitiveAlias(t, doc, namedID("Pw"), ir.PrimTypeID(ir.PrimString), "component schema")
+	require.NotNil(t, pw.Constraints, "the bound written beside the format stays on the node")
+	assert.Equal(t, new(int64(8)), pw.Constraints.MinLength)
+
+	assertSecretCarriers(t, doc)
+	assertSecretNodes(t, doc)
+	assertSecretOperation(t, doc, diags)
+
+	// The guard: a bare string keeps the shared primitive, and a shared node
+	// never carries one declaration's annotations (GitHub #116).
+	plain, ok := propByWire(secretModel(t, doc, "Login"), "plain")
+	require.True(t, ok)
+	assert.Equal(t, ir.PrimTypeID(ir.PrimString), plain.Type.Target)
+	assert.False(t, plain.Secret)
+	assert.False(t, doc.Types[ir.PrimTypeID(ir.PrimString)].Common().Sensitive)
+	assert.False(t, doc.Types[namedID("Plain")].Common().Sensitive, "a referent beside which a use wrote it")
+}
+
+// assertSecretCarriers covers the properties of Login that own no node, where
+// Property.Secret is the home, and the wrappers whose type reaches the
+// Sensitive node instead.
+func assertSecretCarriers(t *testing.T, doc *ir.Document) {
+	login := secretModel(t, doc, "Login")
+	for _, tc := range []struct {
+		wire   string
+		target ir.TypeID
+	}{
+		{"inline", ir.PrimTypeID(ir.PrimString)},
+		{"pin", ir.PrimTypeID(ir.PrimInteger)},
+		{"viaRef", namedID("Pw")},      // inherited from the referent, as deprecated is
+		{"viaAlias", namedID("Chain")}, // from the end of the $ref chain
+		{"beside", namedID("Plain")},   // written beside the $ref, binding the use
+	} {
+		p, ok := propByWire(login, tc.wire)
+		require.True(t, ok, tc.wire)
+		assert.True(t, p.Secret, "%s: the property is the carrier", tc.wire)
+		assert.Equal(t, tc.target, p.Type.Target, "%s: the redaction names no shape", tc.wire)
+	}
+	inline, ok := propByWire(login, "inline")
+	require.True(t, ok)
+	assert.Equal(t, "shown on the property", inline.Docs.Description, "no node takes the docs away")
+
+	// A wrapper's own schema writes no redaction; its type reaches the node
+	// that does, along a nullable reference or a Base.
+	nullable, ok := propByWire(login, "nullable")
+	require.True(t, ok)
+	assert.False(t, nullable.Secret, "the node holds it, not a copy on the use")
+	assert.Equal(t, ir.TypeRef{Target: namedID("Pw"), Nullable: true}, nullable.Type)
+	wrapped, ok := propByWire(login, "wrapped")
+	require.True(t, ok)
+	assert.False(t, wrapped.Secret, "the node holds it, not a copy on the use")
+	m, ok := doc.Types[wrapped.Type.Target].(*ir.Model)
+	require.True(t, ok, "an allOf over one $ref is a model")
+	require.NotNil(t, m.Base)
+	assert.Equal(t, namedID("Pw"), m.Base.Target)
+	chain, ok := doc.Types[namedID("Chain")].(*ir.Scalar)
+	require.True(t, ok, "an alias component is a Scalar")
+	require.NotNil(t, chain.Base)
+	assert.Equal(t, namedID("Pw"), chain.Base.Target)
+
+	// A property whose schema owns a node leaves the redaction on it.
+	pick, ok := propByWire(login, "pick")
+	require.True(t, ok)
+	assert.False(t, pick.Secret, "one home per declaration")
+	assert.Equal(t, ir.KindEnum, requireSensitive(t, doc, pick.Type.Target, "enum property").Kind())
+}
+
+// assertSecretNodes covers the positions with no carrier: each owns a node, an
+// alias over the bare type where the shape alone would own none.
+func assertSecretNodes(t *testing.T, doc *ir.Document) {
+	arr, ok := propByWire(secretModel(t, doc, "Login"), "arr")
+	require.True(t, ok)
+	list, ok := doc.Types[arr.Type.Target].(*ir.List)
+	require.True(t, ok)
+	items := requireSensitiveAlias(t, doc, list.Elem.Target, ir.PrimTypeID(ir.PrimString), "array items")
+	require.NotNil(t, items.Constraints)
+	assert.Equal(t, new(int64(64)), items.Constraints.MaxLength)
+
+	bag := secretModel(t, doc, "Bag")
+	require.NotNil(t, bag.AdditionalProps)
+	requireSensitiveAlias(t, doc, bag.AdditionalProps.Value.Target, ir.PrimTypeID(ir.PrimString), "additionalProperties")
+	require.Len(t, bag.AdditionalProps.Patterns, 1)
+	requireSensitiveAlias(t, doc, bag.AdditionalProps.Patterns[0].Value.Target, ir.PrimTypeID(ir.PrimString),
+		"patternProperties")
+
+	pair, ok := doc.Types[namedID("Pair")].(*ir.Tuple)
+	require.True(t, ok)
+	require.Len(t, pair.Elems, 1)
+	requireSensitiveAlias(t, doc, pair.Elems[0].Target, ir.PrimTypeID(ir.PrimString), "prefixItems")
+
+	tokens, ok := doc.Types[namedID("Tokens")].(*ir.List)
+	require.True(t, ok)
+	requireSensitiveAlias(t, doc, tokens.Elem.Target, namedID("Plain"), "items beside a $ref")
+
+	either, ok := doc.Types[namedID("Either")].(*ir.Union)
+	require.True(t, ok)
+	require.Len(t, either.Variants, 2)
+	requireSensitiveAlias(t, doc, either.Variants[0].Type.Target, ir.PrimTypeID(ir.PrimString), "union branch")
+	assert.False(t, either.Sensitive, "the branch is redacted, not the union")
+
+	assert.Equal(t, ir.KindLiteral, requireSensitive(t, doc, namedID("Code"), "const").Kind())
+	requireSensitiveAlias(t, doc, namedID("Opaque"), ir.PrimTypeID(ir.PrimAny), "untyped")
+	encoded, ok := requireSensitive(t, doc, namedID("Encoded"), "beside contentEncoding").(*ir.Scalar)
+	require.True(t, ok)
+	require.NotNil(t, encoded.Encoding)
+	assert.Equal(t, "base64", encoded.Encoding.Name, "contentEncoding alone names the encoding")
+}
+
+// assertSecretOperation covers the parameters, bodies and headers.
+func assertSecretOperation(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	op, ok := opByName(doc, "login")
+	require.True(t, ok)
+
+	token, ok := paramByName(op, "X-Token")
+	require.True(t, ok)
+	assert.Equal(t, ir.PrimTypeID(ir.PrimString), token.Type.Target, "a parameter owns no node for it")
+	assert.Equal(t, "the session token", token.Docs.Description)
+	require.Contains(t, token.Unmodeled, "openapi:format", "ir.Parameter has no field (GitHub #578)")
+	assert.Equal(t, ir.ReasonNoIRHome, token.Unmodeled["openapi:format"].Reason)
+	assert.Equal(t, []ir.Severity{ir.SeverityInfo},
+		diagsAt(diags, "openapi/degraded-construct", "/paths/~1login/post/parameters/0/schema/format"))
+	key, ok := paramByName(op, "api_key")
+	require.True(t, ok)
+	assert.Equal(t, namedID("Pw"), key.Type.Target, "a referent's redaction is its own node's")
+	assert.NotContains(t, key.Unmodeled, "openapi:format")
+
+	str := ir.PrimTypeID(ir.PrimString)
+	requireSensitiveAlias(t, doc, openapitest.BodyTarget(t, op.Request), str, "request content schema")
+	require.Len(t, op.Responses, 1)
+	requireSensitiveAlias(t, doc, openapitest.BodyTarget(t, op.Responses[0].Payload), str, "response content schema")
+
+	require.Len(t, op.Responses[0].Headers, 2)
+	header := op.Responses[0].Headers[0]
+	assert.True(t, header.Secret, "a header is a property carrier")
+	assert.Equal(t, ir.PrimTypeID(ir.PrimString), header.Type.Target)
+	assert.Equal(t, ir.TypeRef{Target: namedID("Pw"), Nullable: true}, op.Responses[0].Headers[1].Type)
+}
+
+// secretModel returns the secret-format component name as a Model.
+func secretModel(t *testing.T, doc *ir.Document, name string) *ir.Model {
+	t.Helper()
+	m, ok := doc.Types[namedID(name)].(*ir.Model)
+	require.True(t, ok, "%s is a model", name)
+	return m
+}
+
+// requireSensitive requires the node at id to exist and be Sensitive.
+func requireSensitive(t *testing.T, doc *ir.Document, id ir.TypeID, position string) ir.TypeDef {
+	t.Helper()
+	node, ok := doc.Types[id]
+	require.True(t, ok, "%s: nothing is interned at %s", position, id)
+	assert.True(t, node.Common().Sensitive, "%s: whole-type redaction", position)
+	return node
+}
+
+// requireSensitiveAlias requires the node at id to be a Sensitive alias: the
+// Scalar over base a position owns where its shape alone is that shared base,
+// with no encoding, since a redaction is none.
+func requireSensitiveAlias(t *testing.T, doc *ir.Document, id, base ir.TypeID, position string) *ir.Scalar {
+	t.Helper()
+	sc, ok := requireSensitive(t, doc, id, position).(*ir.Scalar)
+	require.True(t, ok, "%s: a Scalar", position)
+	require.NotNil(t, sc.Base, "%s: a base", position)
+	assert.Equal(t, base, sc.Base.Target, "%s: over its shape", position)
+	assert.Nil(t, sc.Encoding, "%s: the redaction is no encoding", position)
+	return sc
+}
+
+// assertXMLHints covers the XML wire shape, whose hints attach at two carriers
+// with different scopes: a type node holds the root element shape, a property
+// holds a per-use override. A position that owns a node keeps them there, so
+// which carrier a hint lands on follows what the position lowered to.
+func assertXMLHints(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	book, ok := doc.Types[namedID("Book")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, book.XML)
+	assert.Equal(t, ir.XMLHints{Name: "book", Namespace: "urn:example:books", Prefix: "bk"}, *book.XML)
+
+	isbn, ok := propByWire(book, "isbn")
+	require.True(t, ok)
+	require.NotNil(t, isbn.XML, "a scalar property has no node of its own, so the property carries them")
+	assert.Equal(t, ir.XMLHints{Namespace: "urn:example:books", Prefix: "bk", NodeType: "attribute"},
+		*isbn.XML, "attribute: true is the node type, not a flag of its own")
+
+	authors, ok := propByWire(book, "authors")
+	require.True(t, ok)
+	assert.Nil(t, authors.XML, "an array owns a node, which is where its hints go")
+	list, ok := doc.Types[authors.Type.Target].(*ir.List)
+	require.True(t, ok)
+	require.NotNil(t, list.XML)
+	assert.True(t, list.XML.Wrapped, "wrapping is a property of the collection")
+	elem, ok := doc.Types[list.Elem.Target]
+	require.True(t, ok)
+	require.NotNil(t, elem.Common().XML)
+	assert.Equal(t, "author", elem.Common().XML.Name)
+}
+
+func assertEncodingByte(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	h, ok := doc.Types[namedID("Holder")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, h.Properties, 1)
+	sc, ok := doc.Types[h.Properties[0].Type.Target].(*ir.Scalar)
+	require.True(t, ok)
+	require.NotNil(t, sc.Encoding)
+	assert.Equal(t, "base64", sc.Encoding.Name)
+	require.NotNil(t, sc.Encoding.WireType)
+	assert.Equal(t, ir.TypeID("t/prim/string"), sc.Encoding.WireType.Target)
+	require.NotNil(t, sc.Base)
+	assert.Equal(t, ir.TypeID("t/prim/bytes"), sc.Base.Target)
+
+	// A scalar that hoists a node because of its format must keep the bounds it
+	// wrote beside it: owning the pointer is what stops the shared alias path
+	// attaching them afterwards (GitHub #147).
+	require.NotNil(t, sc.Constraints, "the hoisted byte scalar carries its own bounds")
+	require.NotNil(t, sc.Constraints.MinLength)
+	assert.Equal(t, int64(5), *sc.Constraints.MinLength)
+	require.NotNil(t, sc.Constraints.MaxLength)
+	assert.Equal(t, int64(9), *sc.Constraints.MaxLength)
+}
+
+// assertXMLNodeType32 pins GitHub #615's xml.nodeType: ir.XMLHints.NodeType
+// already existed and its GoDoc already named the version, so the fix is the
+// wiring, and the dialect's key is no longer reported as undefined.
+func assertXMLNodeType32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	report, ok := doc.Types[namedID("Report")].(*ir.Model)
+	require.True(t, ok)
+	id, ok := propByWire(report, "id")
+	require.True(t, ok)
+	require.NotNil(t, id.XML)
+	assert.Equal(t, "attribute", id.XML.NodeType)
+
+	body, ok := propByWire(report, "body")
+	require.True(t, ok)
+	require.NotNil(t, body.XML)
+	assert.Equal(t, "text", body.XML.NodeType)
+	assert.Equal(t, "B", body.XML.Name, "the object's other fields still lower as they did")
+	assert.Equal(t, "p", body.XML.Prefix)
+
+	assert.Empty(t, diagsAt(diags, diag.UnknownObjectKey, "/components/schemas/Report/properties/id/xml/nodeType"),
+		"a key 3.2 defines is not an undefined key")
+}
diff --git a/compilers/openapi/e2e/conformance_security_test.go b/compilers/openapi/e2e/conformance_security_test.go
new file mode 100644
index 00000000..a95fa555
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_security_test.go
@@ -0,0 +1,184 @@
+package e2e_test
+
+import (
+	"encoding/json/jsontext"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertServersVariables(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	require.Len(t, doc.Servers, 1)
+	assert.Equal(t, "https://{env}.example.com/v1", doc.Servers[0].URLTemplate)
+	assert.Equal(t, "primary", doc.Servers[0].Name.Source,
+		"a 3.2 server name is the server's naming, not part of its description")
+	require.Len(t, doc.Servers[0].Variables, 1)
+	v := doc.Servers[0].Variables[0]
+	assert.Equal(t, "env", v.Name)
+	assert.Equal(t, "api", v.Default)
+	assert.Equal(t, []string{"api", "staging"}, v.Enum)
+}
+
+func assertSecuritySchemes(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	kinds := map[ir.AuthKind]bool{}
+	for _, s := range doc.Auth {
+		kinds[s.Kind] = true
+	}
+	assert.True(t, kinds[ir.AuthKindAPIKey])
+	assert.True(t, kinds[ir.AuthKindHTTPBasic])
+	assert.True(t, kinds[ir.AuthKindHTTPBearer])
+	assert.True(t, kinds[ir.AuthKindOAuth2])
+	assert.True(t, kinds[ir.AuthKindOpenIDConnect])
+	assert.True(t, kinds[ir.AuthKindMutualTLS])
+	assertSchemeDetail(t, doc)
+}
+
+// assertSchemeDetail pins the per-scheme detail beyond the mechanism kind: the
+// annotations any scheme can carry, the RFC 7235 token an unmodelled HTTP scheme
+// degrades to, and the two OAuth2 endpoints beyond the token URL.
+func assertSchemeDetail(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	byName := make(map[string]ir.AuthScheme, len(doc.Auth))
+	for _, s := range doc.Auth {
+		byName[s.Name.Source] = s
+	}
+
+	key, ok := byName["apiKeyAuth"]
+	require.True(t, ok)
+	assert.Equal(t, "Static per-tenant key.", key.Docs.Description)
+	assert.NotNil(t, key.Deprecation, "a scheme can be deprecated like any other entity")
+	entry, ok := key.Unmodeled["openapi:x-rotation-days"]
+	require.True(t, ok, "a scheme's x-* extensions ride on the scheme; got %v", key.Unmodeled)
+	assert.Equal(t, ir.ReasonVendorExtension, entry.Reason)
+
+	digest, ok := byName["digestAuth"]
+	require.True(t, ok)
+	assert.Equal(t, ir.AuthKindCustom, digest.Kind, "only basic and bearer get first-class kinds")
+	assert.Equal(t, "digest", digest.Scheme, "the token itself is kept rather than dropped")
+
+	stray, ok := byName["strayFieldAuth"]
+	require.True(t, ok)
+	assert.Empty(t, stray.BearerFormat, "an apiKey has no bearer-token format to fill")
+	kept, ok := stray.Unmodeled["openapi:bearerFormat"]
+	require.True(t, ok, "a field the type does not define is kept, not dropped; got %v", stray.Unmodeled)
+	assert.Equal(t, ir.ReasonDegradedLowering, kept.Reason)
+	assert.Equal(t, ir.RawValue(`"JWT"`), kept.Value, "kept as the document wrote it")
+
+	oauth, ok := byName["oauth2Auth"]
+	require.True(t, ok)
+	assert.Equal(t, "https://example.com/.well-known/oauth-authorization-server",
+		oauth.OAuth2MetadataURL)
+	require.Len(t, oauth.Flows, 1)
+	assert.Equal(t, "https://example.com/refresh", oauth.Flows[0].RefreshURL)
+}
+
+// assertOAuth2NoFlow pins where a flowless oauth2 declaration is reported: once,
+// at the declaration, however many of the document's aliases reach it, and
+// never for a scheme whose metadata URL states its endpoints or that declares a
+// flow. Every entry interns either way (GitHub #646).
+func assertOAuth2NoFlow(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	t.Helper()
+	const code = "openapi/oauth2-no-flow"
+	reported := map[string]bool{"emptyFlows": true, "unknownFlowsOnly": true}
+	byPointer := map[jsontext.Pointer]ir.AuthScheme{}
+	for _, s := range doc.Auth {
+		byPointer[s.Provenance.Pointer] = s
+	}
+	for _, name := range []string{
+		"aliasFirst", "aliasSecond", "emptyFlows", "unknownFlowsOnly", "metadataOnly", "declaredFlow",
+	} {
+		s, ok := byPointer[jsontext.Pointer("/components/securitySchemes/"+name)]
+		require.True(t, ok, "%s interns, flowless or not", name)
+		assert.Equal(t, ir.AuthKindOAuth2, s.Kind, "%s", name)
+		var want []ir.Severity
+		if reported[name] {
+			want = []ir.Severity{ir.SeverityWarning}
+		}
+		assert.Equal(t, want, diagsAt(diags, code, "/components/securitySchemes/"+name),
+			"%s: reported once at a flowless declaration, never at an alias or a control", name)
+	}
+	n := 0
+	for _, d := range diags {
+		if d.Code == code {
+			n++
+		}
+	}
+	assert.Equal(t, 2, n, "two flowless declarations, two reports: %+v", diags)
+	assert.Equal(t, "https://example.com/.well-known/oauth-authorization-server",
+		byPointer["/components/securitySchemes/metadataOnly"].OAuth2MetadataURL, "the control's metadata URL is kept")
+}
+
+// assertOAuthFlowFields pins that a URL written on a flow whose kind does not
+// define it is kept in that flow's Unmodeled, in no IR slot, and announced once
+// at its own pointer, and that scopes keep the order the document writes them
+// (GitHub #865, #639).
+func assertOAuthFlowFields(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	t.Helper()
+	byName := make(map[string]ir.AuthScheme, len(doc.Auth))
+	for _, s := range doc.Auth {
+		byName[s.Name.Source] = s
+	}
+	const e = "https://example.com/"
+	cases := []struct {
+		kind, keyword, field string
+		// authorize and token are what the flow's own fields lower to; stray is
+		// the undefined field's value as the document wrote it.
+		authorize, token, stray string
+	}{
+		{"authorization_code", "authorizationCode", "deviceAuthorizationUrl", e + "authorize", e + "token", e + "device-undefined"},
+		{"client_credentials", "clientCredentials", "authorizationUrl", "", e + "token", e + "authorize-undefined"},
+		{"implicit", "implicit", "tokenUrl", e + "authorize", "", e + "token-undefined"},
+		{"device", "deviceAuthorization", "authorizationUrl", e + "device", e + "token", e + "authorize-undefined"},
+	}
+	flows := map[string]ir.OAuthFlow{}
+	for _, fl := range byName["flowFields"].Flows {
+		flows[fl.Kind] = fl
+	}
+	require.Len(t, flows, len(cases), "every declared flow lowers")
+	for _, tc := range cases {
+		fl := flows[tc.kind]
+		pointer := "/components/securitySchemes/flowFields/flows/" + tc.keyword + "/" + tc.field
+		assert.Equal(t, tc.authorize, fl.AuthorizationURL, "%s: only a defined field fills this slot", tc.kind)
+		assert.Equal(t, tc.token, fl.TokenURL, "%s: only a defined field fills this slot", tc.kind)
+		require.Len(t, fl.Unmodeled, 1, "%s keeps its one undefined field: %v", tc.kind, fl.Unmodeled)
+		kept, ok := fl.Unmodeled["openapi:"+tc.field]
+		require.True(t, ok, "%s keeps %s; got %v", tc.kind, tc.field, fl.Unmodeled)
+		assert.Equal(t, ir.ReasonDegradedLowering, kept.Reason)
+		assert.Equal(t, ir.RawValue(`"`+tc.stray+`"`), kept.Value)
+		assert.Equal(t, jsontext.Pointer(pointer), kept.Provenance.Pointer)
+		assert.Equal(t, []ir.Severity{ir.SeverityInfo}, diagsAt(diags, diag.DegradedConstruct, pointer),
+			"%s: announced once at the field", tc.kind)
+	}
+	var announced int
+	for _, d := range diags {
+		if d.Code == diag.DegradedConstruct {
+			announced++
+		}
+	}
+	assert.Equal(t, len(cases), announced, "one announcement per kept field: %+v", diags)
+
+	scoped := byName["scopeOrder"].Flows
+	require.Len(t, scoped, 1)
+	assert.Empty(t, cmp.Diff([]ir.OAuthScope{
+		{Name: "write", Description: "Modify data"},
+		{Name: "read", Description: "Read data"},
+		{Name: "admin", Description: "Full access"},
+	}, scoped[0].Scopes), "scopes keep source order")
+}
+
+func assertSecurityOrAnd(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	require.Len(t, doc.Services, 1)
+	auth := doc.Services[0].Auth
+	require.Len(t, auth, 3, "OR of three options in source order")
+	assert.Len(t, auth[0].Schemes, 1)
+	assert.Len(t, auth[1].Schemes, 2, "the ANDed option requires two schemes together")
+	assert.Empty(t, auth[2].Schemes, "the empty option means no auth is acceptable")
+	op, ok := opByName(doc, "publicOp")
+	require.True(t, ok)
+	assert.Empty(t, op.Auth, "security: [] makes the operation explicitly public")
+}
diff --git a/compilers/openapi/e2e/conformance_test.go b/compilers/openapi/e2e/conformance_test.go
index 92eb9014..b225b051 100644
--- a/compilers/openapi/e2e/conformance_test.go
+++ b/compilers/openapi/e2e/conformance_test.go
@@ -5,9 +5,7 @@
 package e2e_test // external test package — exercises only the public API
 
 import (
-	"encoding/json/jsontext"
 	"encoding/json/v2"
-	"maps"
 	"os"
 	"path/filepath"
 	"slices"
@@ -20,11 +18,8 @@ import (
 
 	"github.com/dexpace/morphic/compilers"
 	"github.com/dexpace/morphic/compilers/openapi"
-	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
-	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
 	"github.com/dexpace/morphic/ir"
 	"github.com/dexpace/morphic/ir/irtest"
-	"github.com/dexpace/morphic/pass"
 )
 
 // conformanceDir is the corpus of one minimal spec per capability row of
@@ -326,4196 +321,3 @@ func assertOnlyErrorDiags(t *testing.T, diags []ir.Diagnostic, want []string) {
 		assert.True(t, drawn[code], "the spec is listed as invalid but draws no %s", code)
 	}
 }
-
-func assertNamedTypes(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	user, ok := doc.Types[namedID("User")].(*ir.Model)
-	require.True(t, ok, "named schema User present under its pointer-derived ID")
-	assert.False(t, user.Anonymous)
-	addr, ok := propByWire(user, "address")
-	require.True(t, ok)
-	assert.Equal(t, namedID("Address"), addr.Type.Target)
-	_, ok = doc.Types[namedID("Address")].(*ir.Model)
-	assert.True(t, ok, "referenced Address resolves in the registry")
-}
-
-// assertNeutralNaming covers invariant 4's second half: Naming.Canonical is a
-// neutral word sequence whatever the source spelled the word boundaries as.
-// Real specs use dots (namespaced components, versioned fields, enum values),
-// brackets (deep-object query parameters) and hyphens (headers), so this spec
-// writes each where a segmentation fault would show. Naming.Hint is covered by
-// the same spec: its context strings carry the punctuation, and a hint such as
-// "rollout.state" is a name no emitter can render (GitHub #54).
-func assertNeutralNaming(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	require.Len(t, doc.Services, 1)
-	svc := doc.Services[0]
-	assert.Equal(t, "neutral_naming_api", svc.Name.Canonical, "info.title")
-	require.Len(t, svc.Groups, 1)
-	assert.Equal(t, "inventory_core", svc.Groups[0].Name.Canonical, "tag")
-
-	op, ok := opByName(doc, "widgets.list")
-	require.True(t, ok, "operation present under its source operationId")
-	assert.Equal(t, "widgets_list", op.Name.Canonical, "operationId")
-	byParam := map[string]string{}
-	for _, p := range op.Params {
-		byParam[p.Name.Source] = p.Name.Canonical
-	}
-	assert.Equal(t, "widget_id", byParam["widget.id"], "path parameter")
-	assert.Equal(t, "filter_name", byParam["filter[name]"], "bracketed query parameter")
-
-	widget, ok := doc.Types[namedID("com.example.Widget")].(*ir.Model)
-	require.True(t, ok, "namespaced component keeps its pointer-derived ID")
-	assert.Equal(t, "com_example_widget", widget.Name.Canonical, "component name")
-	assert.Equal(t, "com.example.Widget", widget.Name.Source, "the source spelling is kept beside it")
-	name, ok := propByWire(widget, "widget.name")
-	require.True(t, ok)
-	assert.Equal(t, "widget_name", name.Name.Canonical, "property name")
-	version, ok := propByWire(widget, "api.version.v2")
-	require.True(t, ok)
-	assert.Equal(t, "api_version_v_2", version.Name.Canonical,
-		"the letter/digit boundary still splits inside a dotted segment")
-
-	assertNeutralNamingLeaves(t, doc, widget, op)
-}
-
-// assertNeutralNamingLeaves checks the three canonicals that hang off another
-// node rather than off the service walk: an enum member under a property, a
-// header under a response, a scheme in the auth registry.
-func assertNeutralNamingLeaves(t *testing.T, doc *ir.Document, widget *ir.Model, op ir.Operation) {
-	t.Helper()
-	state, ok := propByWire(widget, "rollout.state")
-	require.True(t, ok)
-	rollout, ok := doc.Types[state.Type.Target].(*ir.Enum)
-	require.True(t, ok, "the enum property hoists an Enum node")
-	require.NotEmpty(t, rollout.Members)
-	assert.Equal(t, "in_progress", rollout.Members[0].Name.Canonical, "enum member")
-	assert.Equal(t, "rollout_state", rollout.Name.Hint,
-		"the hoisted node's hint is words too, not the property key verbatim")
-
-	require.Len(t, op.Responses, 1)
-	require.Len(t, op.Responses[0].Headers, 1)
-	assert.Equal(t, "x_rate_limit", op.Responses[0].Headers[0].Name.Canonical, "response header")
-
-	require.Len(t, doc.Auth, 1)
-	for _, scheme := range doc.Auth {
-		assert.Equal(t, "oauth_2_client", scheme.Name.Canonical, "security scheme")
-	}
-}
-
-// assertEmptyNames is the complement of assertNeutralNaming: every position
-// where the source names an entity with the empty string, which is a legal
-// OpenAPI document at each of them. The compiler used to pass "" through as a
-// Naming with nothing in any channel, leaving an emitter no identifier to render
-// and satisfying every neutrality check vacuously (GitHub #251). Each of these
-// now carries the minted hint instead, and irverify's presence rule — swept over
-// this corpus by TestVerify_Corpus — is what holds the general case.
-func assertEmptyNames(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	require.Len(t, doc.Services, 1)
-	require.Len(t, doc.Services[0].Groups, 1)
-	assert.Equal(t, "empty", doc.Services[0].Groups[0].Name.Hint, "tag declared as \"\"")
-
-	require.Len(t, doc.Auth, 1)
-	for _, scheme := range doc.Auth {
-		assert.Equal(t, "empty", scheme.Name.Hint, "security scheme keyed \"\"")
-	}
-
-	blank, ok := doc.Types[ir.TypeID("t/anon/components/schemas/")]
-	require.True(t, ok, "a component schema keyed \"\" is hoisted at its own pointer")
-	assert.Equal(t, "empty", blank.Common().Name.Hint, "component schema keyed \"\"")
-
-	assertEmptyEnumMember(t, doc)
-	assertEmptyNamedProperty(t, doc)
-	assertEmptyDerivedHints(t, doc)
-}
-
-// assertEmptyEnumMember covers the enum member the issue was reported against,
-// and beside it the collision the minted word can cause: "" and "empty" are two
-// distinct values, and a member named for each lands on the same word.
-//
-// The IR keeps them apart — two members, two values, one in each name channel —
-// because uniquifying identifiers is an emitter's job and always has been:
-// "red" and "Red" already canonicalize to the same words. This pins that the
-// minted name does not merge or drop a member, which is the only part of the
-// collision the IR is answerable for.
-func assertEmptyEnumMember(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	rollout, ok := doc.Types[namedID("Rollout")].(*ir.Enum)
-	require.True(t, ok)
-	require.Len(t, rollout.Members, 3, "no member is merged away by the shared word")
-
-	assert.Equal(t, "empty", rollout.Members[0].Name.Hint, "enum member whose value is \"\"")
-	assert.Empty(t, rollout.Members[0].Name.Source, "nothing is fabricated into the source channel")
-	assert.Empty(t, rollout.Members[0].Value.Str, "the value itself is kept as the empty string")
-
-	declared := rollout.Members[1]
-	assert.Equal(t, "empty", declared.Name.Source, "a member whose value really is \"empty\"")
-	assert.Equal(t, "empty", declared.Name.Canonical, "named through the declared channels, not the hint")
-	assert.Empty(t, declared.Name.Hint)
-
-	assert.Equal(t, "done", rollout.Members[2].Name.Source, "the ordinary sibling is unaffected")
-}
-
-// assertEmptyNamedProperty covers the two entities one property keyed "" makes:
-// the property, and the inline schema hoisted at its position, whose context
-// hint is derived from the same empty name.
-func assertEmptyNamedProperty(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	widget, ok := doc.Types[namedID("Widget")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, widget.Properties, 1)
-	prop := widget.Properties[0]
-	assert.Equal(t, "empty", prop.Name.Hint, "property keyed \"\"")
-	assert.Empty(t, prop.WireName, "the wire key itself is still the empty string")
-
-	inline, ok := doc.Types[prop.Type.Target]
-	require.True(t, ok, "the property's inline object is hoisted")
-	assert.Equal(t, ir.TypeID("t/anon/components/schemas/Widget/properties/"), prop.Type.Target)
-	assert.Equal(t, "empty", inline.Common().Name.Hint,
-		"a hint derived from an empty position is minted, not passed through empty")
-}
-
-// composedHints is every node in the corpus spec whose hint is built out of an
-// enclosing node's. Each pairs an unnamed position with the role or index that
-// distinguishes the child from its siblings — a list element, a map value, a
-// pattern group, a tuple slot or rest, an enum branch, a composed union
-// variant. A slice rather than a map so a failure names them in a fixed order.
-var composedHints = []struct {
-	id   ir.TypeID
-	hint string
-}{
-	{"t/anon/components/schemas/List/properties//items", "empty_item"},
-	{"t/anon/components/schemas/Maps/properties//additionalProperties", "empty_value"},
-	{"t/anon/components/schemas/Patterns/properties//patternProperties/^x", "empty_pattern"},
-	{"t/anon/components/schemas/Tuple/properties//prefixItems/0", "empty_0"},
-	{"t/anon/components/schemas/Tuple/properties//items", "empty_item"},
-	{"t/anon/components/schemas/Mixed/properties//enum/0", "empty_0"},
-	{"t/anon/components/schemas/Mixed/properties//enum/1", "empty_1"},
-	{"t/composed/components/schemas/Host/properties//oneOf/0", "empty_alt"},
-}
-
-// assertEmptyDerivedHints covers hints a child composes from an enclosing
-// node's. Concatenating onto an empty hint once yielded a leading "_", which is
-// non-empty so irverify's presence check passes it, yet no grammar produces it.
-//
-// composedHints has no row for contentSchema, which an empty-named property
-// reaches (#743). The sequential media type's itemSchema cannot need one: both
-// callers of lowerPayload pass a non-empty hint, since ids.ComponentEntry
-// refuses a component keyed "" and the fallbacks are "response" and "request".
-// A composed variant of an inline branch is absent too:
-// docs/compilers/openapi.md#union-beside-structure keeps that union verbatim,
-// so only the $ref form the Host case uses reaches composedVariant.
-func assertEmptyDerivedHints(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	mixed, ok := doc.Types[namedID("Mixed")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, mixed.Properties, 1)
-	union, ok := doc.Types[mixed.Properties[0].Type.Target].(*ir.Union)
-	require.True(t, ok, "a heterogeneous enum lowers to a union of literals")
-	assert.Equal(t, "empty", union.Name.Hint, "the enclosing node keeps the plain minted hint")
-
-	for _, tc := range composedHints {
-		node, found := doc.Types[tc.id]
-		require.True(t, found, "no node at %s; the composition site moved", tc.id)
-		assert.Equal(t, tc.hint, node.Common().Name.Hint, "composed hint at %s", tc.id)
-	}
-}
-
-func assertInlineTypes(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	order, ok := doc.Types[namedID("Order")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, order.Properties, 1)
-	shipping := order.Properties[0]
-	// hoisted exactly once, under its pointer-derived anonymous ID.
-	assert.Equal(t, ir.TypeID("t/anon/components/schemas/Order/properties/shipping"),
-		shipping.Type.Target)
-	inline, ok := doc.Types[shipping.Type.Target].(*ir.Model)
-	require.True(t, ok, "the inline object was hoisted as its own type")
-	assert.True(t, inline.Anonymous)
-	assert.Equal(t, "shipping", inline.Name.Hint)
-}
-
-// assertInlineHoistPositions pins the six operation-side positions an inline
-// composite can be declared at against the ID each one's source pointer derives.
-// Neither inline-types.yaml nor the inlinePositions table in
-// compilers/openapi/internal/schema reaches a parameter, response header,
-// webhook or callback, which are lowered a layer up.
-//
-// The referring site must point at the derived ID, which a moved position
-// changes. The six targets must also be six distinct nodes, which survives a
-// synchronized edit: a hoist collapsing identical bodies and an updated
-// expectation would otherwise agree. The fixture writes one body at all six so a
-// collapse is reachable.
-func assertInlineHoistPositions(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	got := inlineHoistPositionRefs(t, doc)
-	if diff := cmp.Diff(inlineHoistPositionIDs(), got); diff != "" {
-		t.Errorf("hoisted node per source position (-want +got):\n%s", diff)
-	}
-
-	owner := map[ir.TypeID]string{}
-	for position, id := range got {
-		assert.NotContains(t, owner, id,
-			"the %s and %s positions share one node, %s", owner[id], position, id)
-		owner[id] = position
-
-		node, found := doc.Types[id]
-		require.True(t, found, "%s: nothing is interned at %s", position, id)
-		model, ok := node.(*ir.Model)
-		require.True(t, ok, "%s: the inline object hoisted as a model", position)
-		assert.True(t, model.Anonymous, "%s: a minted node is anonymous", position)
-		assert.Len(t, model.Properties, 1, "%s: it kept the body it was declared with", position)
-	}
-}
-
-// inlineHoistPositionIDs is the ID each position's source pointer derives,
-// spelled out so a node that moves to another pointer is a diff rather than a
-// silently different document.
-func inlineHoistPositionIDs() map[string]ir.TypeID {
-	const order = "t/anon/paths/~1orders/post"
-	return map[string]ir.TypeID{
-		"parameter schema":       order + "/parameters/0/schema",
-		"response-header schema": order + "/responses/200/headers/X-Order-Trace/schema",
-		"request-body property":  order + "/requestBody/content/application~1json/schema/properties/shipping",
-		"response-body property": order + "/responses/200/content/application~1json/schema/properties/receipt",
-		"webhook body":           "t/anon/webhooks/onShipped/post/requestBody/content/application~1json/schema",
-		"callback body": order + "/callbacks/onProgress/{$request.body#~1callbackUrl}" +
-			"/post/requestBody/content/application~1json/schema",
-	}
-}
-
-// inlineHoistPositionRefs reads back what each declaring site actually refers
-// to. It walks from the operation rather than from doc.Types so a node interned
-// at the right ID but wired to nothing still fails.
-func inlineHoistPositionRefs(t *testing.T, doc *ir.Document) map[string]ir.TypeID {
-	t.Helper()
-	order, ok := opByName(doc, "placeOrder")
-	require.True(t, ok)
-	audit, ok := paramByName(order, "audit")
-	require.True(t, ok, "the operation declares its inline-schema parameter")
-	require.Len(t, order.Responses, 1)
-	require.Len(t, order.Responses[0].Headers, 1, "the response declares its inline-schema header")
-	webhook, ok := opByName(doc, "onShipped")
-	require.True(t, ok, "the webhook operation is registered")
-	callback, ok := opByName(doc, "onProgress")
-	require.True(t, ok, "the callback operation is registered")
-
-	return map[string]ir.TypeID{
-		"parameter schema":       audit.Type.Target,
-		"response-header schema": order.Responses[0].Headers[0].Type.Target,
-		"request-body property":  inlinePropTarget(t, doc, openapitest.BodyTarget(t, order.Request), "shipping"),
-		"response-body property": inlinePropTarget(t, doc, openapitest.BodyTarget(t, order.Responses[0].Payload), "receipt"),
-		"webhook body":           openapitest.BodyTarget(t, webhook.Request),
-		"callback body":          openapitest.BodyTarget(t, callback.Request),
-	}
-}
-
-// inlinePropTarget returns the type the named property of the model at id refers
-// to — the body-property positions, one level inside a body root.
-func inlinePropTarget(t *testing.T, doc *ir.Document, id ir.TypeID, wire string) ir.TypeID {
-	t.Helper()
-	model, ok := doc.Types[id].(*ir.Model)
-	require.True(t, ok, "the body at %s hoisted as a model", id)
-	prop, ok := propByWire(model, wire)
-	require.True(t, ok, "the body declares the property %q", wire)
-	return prop.Type.Target
-}
-
-// assertSharedResponseAcrossStatus reads the one shape that puts lowerResponse
-// and lowerErrorCase on the same declaration: a components/responses entry
-// mounted at both a success and an error status. Both intern the body type at
-// the component's pointer, so the two mints race for it and the loser's naming
-// hint is discarded, which the order-invariance oracle reports as an
-// order-dependent registry. The hint derives from the declaration pointer, the
-// same whichever side reaches it first. No other corpus spec reaches one
-// response component from both sides, so the oracle needs this one to ask.
-func assertSharedResponseAcrossStatus(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op := operationAt(t, doc, "GET", "/widgets")
-	require.Len(t, op.Responses, 1, "the success mount")
-	require.Len(t, op.Errors, 1, "and the error mount, of the one component")
-
-	success := op.Responses[0].Payload.Contents[0].Type.Target
-	failure := op.Errors[0].Payload.Contents[0].Type.Target
-	assert.Equal(t, success, failure, "one declaration is one type, reached from either status")
-
-	td, ok := doc.Types[success]
-	require.True(t, ok)
-	assert.Equal(t, "envelope", td.Common().Name.Hint,
-		"the hint comes from the declaration, not from whichever status class minted it first")
-
-	created := operationAt(t, doc, "POST", "/widgets").Responses[0].Payload.Contents[0].Type.Target
-	rejected := operationAt(t, doc, "POST", "/gadgets").Errors[0].Payload.Contents[0].Type.Target
-	assert.Equal(t, created, rejected, "a path-pointer $ref reaches the same one type")
-	td, ok = doc.Types[created]
-	require.True(t, ok)
-	assert.Equal(t, "response", td.Common().Name.Hint,
-		"with no component to name it, both sides fall back to the one word")
-}
-
-// assertComponentReuse covers the non-schema half of `$ref`: OpenAPI lets a
-// parameter, requestBody, response, header, callback, or whole path item be
-// declared once under components and referenced from many operations. Each
-// lowers at its declaration, so the shared node is interned once however many
-// operations reach it, while the operations that reach it stay distinct.
-func assertComponentReuse(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	widgets := operationAt(t, doc, "GET", "/widgets")
-	gadgets := operationAt(t, doc, "GET", "/gadgets")
-	order := operationAt(t, doc, "POST", "/orders")
-	assert.NotEqual(t, widgets.ID, gadgets.ID, "one path item mounted twice is two operations")
-	assert.Equal(t, widgets.Provenance.Pointer, gadgets.Provenance.Pointer,
-		"...both written at the one component that declares them")
-
-	// Every hoisted type in this document belongs to a component declaration:
-	// no operation contributes a pointer of its own, because none declares a
-	// schema of its own.
-	for id, td := range doc.Types {
-		if td.Common().Provenance.Pointer == "" {
-			continue // shared primitives are pointerless by construction
-		}
-		assert.True(t, strings.HasPrefix(string(td.Common().Provenance.Pointer), "/components/"),
-			"type %s hoists at a component declaration, not a use site", id)
-	}
-
-	sortID := ir.TypeID("t/anon/components/parameters/Sort/schema")
-	require.Len(t, widgets.Params, 1)
-	require.Len(t, gadgets.Params, 1)
-	assert.Equal(t, sortID, widgets.Params[0].Type.Target)
-	assert.Equal(t, sortID, gadgets.Params[0].Type.Target, "the shared parameter interns once")
-
-	listedID := ir.TypeID("t/anon/components/responses/Listed/content/application~1json/schema")
-	assert.Equal(t, listedID, openapitest.BodyTarget(t, widgets.Responses[0].Payload))
-	assert.Equal(t, listedID, openapitest.BodyTarget(t, order.Responses[0].Payload),
-		"a response reused across unrelated operations interns once")
-
-	bodyID := ir.TypeID("t/anon/components/requestBodies/OrderBody/content/application~1json/schema")
-	require.NotNil(t, order.Request)
-	assert.Equal(t, bodyID, openapitest.BodyTarget(t, order.Request))
-	assert.Equal(t, "order_body", doc.Types[bodyID].Common().Name.Hint,
-		"a shared body is named after its component, not the operation that reached it first")
-
-	require.Len(t, widgets.Responses[0].Headers, 1)
-	header := widgets.Responses[0].Headers[0]
-	assert.Equal(t, ir.TypeID("t/anon/components/headers/RateUnit/schema"), header.Type.Target)
-	assert.Equal(t, jsontext.Pointer("/components/responses/Listed/headers/X-Rate-Unit"), header.Provenance.Pointer,
-		"the header's identity is the map entry that binds its name")
-
-	require.Len(t, order.Bindings.HTTP[0].Callbacks, 1)
-	assert.Equal(t, "{$request.body#/callbackUrl}", order.Bindings.HTTP[0].Callbacks[0].Expression)
-	_, ok := opByName(doc, "onShipped")
-	assert.True(t, ok, "the shared callback's operation is registered alongside its parent")
-}
-
-func assertAllOfInheritance(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	d, ok := doc.Types[namedID("Derived")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, d.Base, "sole allOf $ref becomes Base")
-	assert.Equal(t, namedID("Base"), d.Base.Target)
-	assert.Empty(t, d.Mixins)
-	_, ok = propByWire(d, "extra")
-	assert.True(t, ok, "property declared alongside allOf survives")
-	// Model-level detail declared alongside allOf must be captured, not dropped.
-	assert.Equal(t, "A Base specialized with one extra field.", d.Docs.Description,
-		"composed schema keeps its description")
-	assert.NotNil(t, d.Deprecation, "composed schema keeps deprecated")
-	assert.Equal(t, ir.AdditionalClosed, d.Additional,
-		"composed schema keeps additionalProperties: false")
-	assert.Contains(t, d.Unmodeled, "openapi:x-team", "composed schema keeps x-* extensions")
-}
-
-func assertAllOfMixins(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	c, ok := doc.Types[namedID("C")].(*ir.Model)
-	require.True(t, ok)
-	assert.Nil(t, c.Base, "multiple non-hierarchy refs stay Mixins, none is Base")
-	require.Len(t, c.Mixins, 2)
-	assert.Equal(t, namedID("A"), c.Mixins[0].Target)
-	assert.Equal(t, namedID("B"), c.Mixins[1].Target)
-}
-
-func assertAllOfInlineMerge(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("Merged")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, m.Base)
-	assert.Equal(t, namedID("Base"), m.Base.Target)
-	_, ok = propByWire(m, "name")
-	assert.True(t, ok, "inline allOf branch contributes its properties")
-}
-
-// assertAllOfNestedInline pins the flattening of
-// docs/compilers/openapi.md#allof-classification: a nested spelling classifies
-// as the flat one does and keeps each property's own pointer. A wrapper writing
-// nothing else is kept nowhere; one that also writes a keyword is kept whole,
-// with one diagnostic.
-func assertAllOfNestedInline(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("M")].(*ir.Model)
-	require.True(t, ok)
-	assert.Nil(t, m.Base, "two refs and no hierarchy: none is Base")
-	require.Len(t, m.Mixins, 2)
-	assert.Equal(t, namedID("A"), m.Mixins[0].Target)
-	assert.Equal(t, namedID("B"), m.Mixins[1].Target)
-	assert.Empty(t, m.Unmodeled, "the wrapper is flattened, not kept verbatim")
-
-	n, ok := doc.Types[namedID("Nested2")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, n.Base, "the sole ref two wrappers down is the Base")
-	assert.Equal(t, namedID("A"), n.Base.Target)
-	c, ok := propByWire(n, "c")
-	require.True(t, ok)
-	assert.Equal(t, jsontext.Pointer("/components/schemas/Nested2/allOf/0/allOf/1/properties/c"),
-		c.Provenance.Pointer)
-
-	mixed, ok := doc.Types[namedID("Mixed")].(*ir.Model)
-	require.True(t, ok)
-	mc, ok := propByWire(mixed, "c")
-	require.True(t, ok)
-	assert.True(t, mc.Required, "the wrapper's required list reaches the property inside it")
-	wires := make([]string, 0, len(mixed.Properties))
-	for _, p := range mixed.Properties {
-		wires = append(wires, p.WireName)
-	}
-	assert.Equal(t, []string{"c", "w"}, wires, "the wrapper's own property merges after its branches'")
-
-	closed, ok := doc.Types[namedID("Closed")].(*ir.Model)
-	require.True(t, ok)
-	assert.Equal(t, ir.AdditionalClosed, closed.Additional, "a false inside a wrapper still closes")
-	assert.Contains(t, closed.Unmodeled, "openapi:allOf/0/allOf/0")
-	assert.NotContains(t, closed.Unmodeled, "openapi:allOf/0")
-
-	described, ok := doc.Types[namedID("Described")].(*ir.Model)
-	require.True(t, ok)
-	assert.Nil(t, described.Base)
-	require.Len(t, described.Mixins, 2, "the wrapper's refs compose despite its description")
-	assert.Equal(t, namedID("A"), described.Mixins[0].Target)
-	assert.Equal(t, namedID("B"), described.Mixins[1].Target)
-	assert.Contains(t, described.Unmodeled, "openapi:allOf/0", "the wrapper is kept whole")
-
-	for _, id := range []ir.TypeID{"t/composed/components/schemas/U/oneOf/0", "t/composed/components/schemas/U/oneOf/1"} {
-		variant, ok := doc.Types[id].(*ir.Model)
-		require.True(t, ok, "%s should be a composed variant", id)
-		assert.Equal(t, ir.AdditionalClosed, variant.Additional, "%s: a false nested beside a oneOf closes every variant", id)
-		assert.Contains(t, variant.Unmodeled, "openapi:allOf/0/allOf/2/allOf/0", "%s keeps the false at its path", id)
-		a, ok := propByWire(variant, "a")
-		require.True(t, ok, id)
-		assert.True(t, a.Required, "%s: the wrapper's required list reaches the variant's property", id)
-	}
-
-	for _, d := range diags {
-		if d.Code == diag.DegradedConstruct && d.Provenance.Pointer == "/components/schemas/Described/allOf/0" {
-			continue // the one kept wrapper
-		}
-		assert.NotEqual(t, diag.DegradedConstruct, d.Code, "flattening is exact: %+v", d)
-	}
-}
-
-func assertAllOfRequiredOnly(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	d, ok := doc.Types[namedID("Derived")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, d.Base, "the $ref branch still becomes Base")
-	name, ok := propByWire(d, "name")
-	require.True(t, ok, "the inline branch's own property survives")
-	assert.True(t, name.Required,
-		"a required-only allOf branch attaches across the whole composition, not just its own properties map (issue #29)")
-}
-
-// assertRequiredMembers pins where a `required` name lands when no property of
-// the object it is written for declares it (ir-design §4.3): in Model.Requires,
-// once, beside the Required on the properties it does name. The four shapes are
-// four ways an object lowers: a plain object, an allOf making a property its
-// base declares required, an object whose catch-all governs the name, which
-// stays a Model rather than becoming a map since a map requires no key, and the
-// object variant of a multi-typed schema.
-func assertRequiredMembers(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	plain, ok := doc.Types[namedID("Plain")].(*ir.Model)
-	require.True(t, ok)
-	id, ok := propByWire(plain, "id")
-	require.True(t, ok)
-	assert.True(t, id.Required, "a declared name is Required on its property")
-	assert.Equal(t, []string{"ghost"}, plain.Requires, "an undeclared one is listed, and the declared one is not")
-
-	created, ok := doc.Types[namedID("CreatedUser")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, created.Base)
-	assert.Equal(t, namedID("User"), created.Base.Target)
-	assert.Empty(t, created.Properties, "the base declares id, so the composed model has no property for it")
-	assert.Equal(t, []string{"id"}, created.Requires, "the inherited property it makes required")
-	user, ok := doc.Types[namedID("User")].(*ir.Model)
-	require.True(t, ok)
-	assert.Empty(t, user.Requires, "the base is not made to require what only its subtype does")
-	userID, ok := propByWire(user, "id")
-	require.True(t, ok)
-	assert.False(t, userID.Required, "and its own property stays optional")
-
-	tagged, ok := doc.Types[namedID("Tagged")].(*ir.Model)
-	require.True(t, ok, "a required name beside a catch-all keeps the object a Model, not a map")
-	assert.NotNil(t, tagged.AdditionalProps)
-	assert.Empty(t, tagged.Properties)
-	assert.Equal(t, []string{"a"}, tagged.Requires, "required only because the catch-all governs it")
-	_, isMap := ir.AsMap(tagged)
-	assert.False(t, isMap, "AsMap keeps a model that requires a member a Model")
-
-	either, ok := doc.Types[namedID("Either")].(*ir.Union)
-	require.True(t, ok)
-	var object *ir.Model
-	for _, v := range either.Variants {
-		if m, isModel := doc.Types[v.Type.Target].(*ir.Model); isModel {
-			object = m
-		}
-	}
-	require.NotNil(t, object, "the object variant is a Model")
-	variantID, ok := propByWire(object, "id")
-	require.True(t, ok)
-	assert.True(t, variantID.Required)
-	assert.Equal(t, []string{"extra"}, object.Requires, "the variant lists what it declares nowhere")
-}
-
-// assertAllOfOneOfCooccurrence pins both halves of the co-declared composition
-// rule: §4.3 distributes a union whose branches all name referents, and the
-// rule docs/compilers/openapi.md#union-beside-structure keeps one with an
-// inline branch verbatim rather than distributing it halfway. The verbatim half
-// is covered over a model body, which owns a node already, and over a scalar
-// one, which does not — there the alias hoisted for the union carries what the
-// position wrote beside it too. The outside reference to a branch pointer pins
-// the third thing: a composed variant is Morphic's own node, so it cannot be
-// taken by, or take from, a $ref.
-func assertAllOfOneOfCooccurrence(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	combo, ok := doc.Types[namedID("Combo")].(*ir.Union)
-	require.True(t, ok, "the union is the value, not a preserved sibling")
-	require.Len(t, combo.Variants, 2)
-	for i, branch := range []string{"A", "B"} {
-		v, ok := doc.Types[combo.Variants[i].Type.Target].(*ir.Model)
-		require.True(t, ok, "variant %d composes as a model", i)
-		require.NotNil(t, v.Base, "the allOf composition rides on every variant")
-		assert.Equal(t, namedID("Base"), v.Base.Target)
-		require.Len(t, v.Mixins, 1)
-		assert.Equal(t, namedID(branch), v.Mixins[0].Target)
-		require.NotNil(t, v.Constraints, "the enclosing schema's own minProperties rides on every variant too (GitHub #407)")
-		require.NotNil(t, v.Constraints.MinProps)
-		assert.Equal(t, int64(2), *v.Constraints.MinProps)
-	}
-
-	mixed, ok := doc.Types[namedID("MixedKinds")].(*ir.Model)
-	require.True(t, ok, "the structural body survives")
-	entry, ok := mixed.Unmodeled["openapi:oneOf"]
-	require.True(t, ok, "and the union it could not absorb survives beside it")
-	assert.Equal(t, ir.ReasonDegradedLowering, entry.Reason)
-
-	bounded, ok := doc.Types[namedID("BoundedKinds")].(*ir.Scalar)
-	require.True(t, ok, "a body that is not a model reduces to a shared primitive and hoists an alias")
-	entry, ok = bounded.Unmodeled["openapi:oneOf"]
-	require.True(t, ok, "which is the node the kept union sits on")
-	assert.Equal(t, ir.ReasonDegradedLowering, entry.Reason)
-	require.NotNil(t, bounded.Constraints, "and the bounds written beside the union sit on it too")
-	require.NotNil(t, bounded.Constraints.MinLength)
-	assert.Equal(t, int64(3), *bounded.Constraints.MinLength)
-
-	outsider, ok := doc.Types[namedID("Outsider")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, outsider.Properties, 1)
-	branchNode, ok := doc.Types[outsider.Properties[0].Type.Target].(*ir.Scalar)
-	require.True(t, ok, "the branch pointer hoists an alias of what the branch references")
-	require.NotNil(t, branchNode.Base)
-	assert.Equal(t, namedID("A"), branchNode.Base.Target,
-		"the reference gets the branch schema, never the variant composed for that branch")
-
-	assertInlineBranchHint(t, doc)
-}
-
-// assertInlineBranchHint pins the hint an inline composition branch takes when
-// an outside reference names its pointer too. The union reaches that node
-// through its composition, and the reference builds it (hoistSubSchema) only
-// where nothing else did, under the hint the composition recorded. An inline
-// branch has only its position to be named by, and the reference path once used
-// the bare ordinal "0" (GitHub #181). The value is asserted because the golden
-// records whichever hint won without saying the two agree, and the corpus
-// carries the shape so the two-order oracle covers it.
-func assertInlineBranchHint(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	const branchID = ir.TypeID("t/anon/components/schemas/InlineHost/oneOf/0")
-
-	host, ok := doc.Types[namedID("InlineHost")].(*ir.Union)
-	require.True(t, ok, "the inline union is the value")
-	require.Len(t, host.Variants, 2)
-	assert.Equal(t, branchID, host.Variants[0].Type.Target,
-		"the union's first variant is the node the branch pointer owns")
-
-	branch, ok := doc.Types[branchID]
-	require.True(t, ok, "the branch pointer owns a node")
-	assert.Equal(t, "variant_0", branch.Common().Name.Hint,
-		"named by position, which is all an inline branch has to be named by")
-
-	outsider, ok := doc.Types[namedID("InlineOutsider")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, outsider.Properties, 1)
-	assert.Equal(t, branchID, outsider.Properties[0].Type.Target,
-		"the outside reference resolves to that same node rather than hoisting a second")
-}
-
-// assertAllOfPositionConstraints pins GitHub #407: a value constraint written
-// beside an allOf composing position reaches the same ir.Model.Constraints
-// field a plain object's does, rather than falling to Unmodeled under a
-// diagnostic that claims the node has no home for it — the node demonstrably
-// does, since ViaModel's sibling proves the field exists and is read.
-func assertAllOfPositionConstraints(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	viaModel, ok := doc.Types[namedID("ViaModel")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, viaModel.Constraints)
-	require.NotNil(t, viaModel.Constraints.MinProps)
-	assert.Equal(t, int64(2), *viaModel.Constraints.MinProps)
-
-	viaAllOf, ok := doc.Types[namedID("ViaAllOf")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, viaAllOf.Base, "the sole allOf $ref still becomes Base")
-	assert.Equal(t, namedID("Base"), viaAllOf.Base.Target)
-	require.NotNil(t, viaAllOf.Constraints, "the composing position's own minProperties reaches the model it built, exactly as a plain object's does")
-	require.NotNil(t, viaAllOf.Constraints.MinProps)
-	assert.Equal(t, int64(2), *viaAllOf.Constraints.MinProps)
-	assert.NotContains(t, viaAllOf.Unmodeled, "openapi:minProperties",
-		"minProperties has a home now, so it is not also kept verbatim")
-	assert.Empty(t, diagsAt(diags, diag.DegradedConstruct, "/components/schemas/ViaAllOf"),
-		"and no diagnostic claims the node has no home for it")
-}
-
-func assertOneOfDiscriminated(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	pet, ok := doc.Types[namedID("Pet")].(*ir.Union)
-	require.True(t, ok, "oneOf survives as a Union node, never collapsed")
-	assert.True(t, pet.Exclusive)
-	assert.True(t, pet.WireTagged, "the discriminator's tag names the variant")
-	require.Len(t, pet.Variants, 2)
-	require.NotNil(t, pet.Discriminator)
-	assert.Equal(t, "petType", pet.Discriminator.PropertyName)
-	assert.Equal(t, namedID("Cat"), pet.Discriminator.Mapping["cat"])
-	assert.Equal(t, namedID("Dog"), pet.Discriminator.Mapping["dog"])
-}
-
-// assertAnyOfDiscriminated pins that the tag mode and Exclusive are independent
-// (ir-design §4.4): a discriminator on an anyOf tags the union without making
-// it exclusive, since a payload may still satisfy both branches.
-func assertAnyOfDiscriminated(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	u, ok := doc.Types[namedID("Resource")].(*ir.Union)
-	require.True(t, ok, "anyOf survives as a Union node, never collapsed")
-	assert.False(t, u.Exclusive, "anyOf admits a payload both branches satisfy")
-	assert.True(t, u.WireTagged, "the discriminator's tag names the variant")
-	require.Len(t, u.Variants, 2)
-	require.NotNil(t, u.Discriminator)
-	assert.Equal(t, "kind", u.Discriminator.PropertyName)
-	assert.Equal(t, namedID("Named"), u.Discriminator.Mapping["named"])
-	assert.Equal(t, namedID("Labelled"), u.Discriminator.Mapping["labelled"])
-}
-
-// assertDiscriminatorInheritance covers the model-hierarchy form of a
-// discriminator, which the union form (oneof-discriminated) does not reach: the
-// tag is declared on the base, each subtype composes the base by $ref, and the
-// wire value each subtype answers to is recorded on the subtype.
-//
-// Both spellings of that value are pinned, because they come from different
-// places: a subtype the base's mapping names takes the mapping key, and one the
-// mapping omits takes OpenAPI's implicit schema name.
-func assertDiscriminatorInheritance(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
-	require.True(t, ok, "the base is a Model, not a Union")
-	require.NotNil(t, pet.Discriminator)
-	tag, ok := propByWire(pet, "petType")
-	require.True(t, ok, "the base declares the tag property itself")
-	assert.Equal(t, tag.ID, pet.Discriminator.Property,
-		"a declared tag property binds by identity, not by wire name")
-	assert.Empty(t, pet.Discriminator.PropertyName,
-		"the name spelling is for a tag no property declares")
-	assert.Equal(t, namedID("Cat"), pet.Discriminator.Mapping["cat"])
-
-	for name, value := range map[string]string{"Cat": "cat", "Dog": "Dog"} {
-		sub, ok := doc.Types[namedID(name)].(*ir.Model)
-		require.True(t, ok, "%s composes as a Model", name)
-		require.NotNil(t, sub.Base, "the discriminated base becomes Base, not a Mixin")
-		assert.Equal(t, namedID("Pet"), sub.Base.Target)
-		assert.Equal(t, value, sub.DiscriminatorValue)
-		assert.Nil(t, sub.Discriminator, "a subtype does not restate its base's discriminator")
-	}
-}
-
-// assertDiscriminatorInlineSubtype covers the subtypes OpenAPI's implicit
-// mapping cannot name (GitHub #517). The implicit tag is the name of the
-// component schema that declares a subtype, so one declared inline — as a
-// property or a union branch — takes no tag, while it still composes the
-// discriminated base. Kennel's Dog shares its key with the component Dog on
-// purpose: a tag read off the pointer gives both the same value.
-func assertDiscriminatorInlineSubtype(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
-	require.True(t, ok, "the base is a Model")
-	require.NotNil(t, pet.Discriminator)
-	assert.Empty(t, pet.Discriminator.Mapping, "every tag in this document is implicit")
-
-	for _, tc := range []struct {
-		id    ir.TypeID
-		value string
-	}{
-		{namedID("Dog"), "Dog"},
-		{"t/anon/components/schemas/Kennel/properties/Dog", ""},
-		{"t/anon/components/schemas/Kennel/properties/pet", ""},
-		{"t/anon/components/schemas/Either/oneOf/0", ""},
-	} {
-		sub, ok := doc.Types[tc.id].(*ir.Model)
-		require.True(t, ok, "%s composes as a Model", tc.id)
-		require.NotNil(t, sub.Base, "%s composes the discriminated base", tc.id)
-		assert.Equal(t, namedID("Pet"), sub.Base.Target)
-		assert.Equal(t, tc.value, sub.DiscriminatorValue,
-			"%s: only a component schema has a name to answer to", tc.id)
-	}
-}
-
-// assertDiscriminatorTransitive covers a hierarchy deeper than the two levels
-// discriminator-inheritance reaches: the subtype's own allOf branch names an
-// intermediate schema that declares no discriminator, so the tag value can only
-// come from an ancestor further up (GitHub #305). What each subtype composes is
-// pinned beside its tag, since depth is the point. The undiscriminated chain
-// beside them is the boundary: depth alone must not manufacture a value. Puppy
-// is named by the mapping, routing a wire value straight onto a grandchild;
-// Whelp is named by nothing and answers to its own schema name three hops down.
-func assertDiscriminatorTransitive(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
-	require.True(t, ok, "the root of the hierarchy is a Model")
-	require.NotNil(t, pet.Discriminator)
-	assert.Equal(t, namedID("Dog"), pet.Discriminator.Mapping["dog"])
-	assert.Equal(t, namedID("Puppy"), pet.Discriminator.Mapping["puppy"],
-		"the base maps a wire value straight onto its grandchild")
-
-	// base is the schema each subtype's own allOf branch names, which is the only
-	// thing a one-hop reading of the chain could see.
-	for _, tc := range []struct{ name, base, value string }{
-		{"Dog", "Pet", "dog"},
-		{"Puppy", "Dog", "puppy"},
-		{"Whelp", "Puppy", "Whelp"},
-	} {
-		sub, ok := doc.Types[namedID(tc.name)].(*ir.Model)
-		require.True(t, ok, "%s composes as a Model", tc.name)
-		require.NotNil(t, sub.Base, "%s composes a base", tc.name)
-		assert.Equal(t, namedID(tc.base), sub.Base.Target,
-			"%s composes %s, not the schema anchoring the hierarchy", tc.name, tc.base)
-		assert.Equal(t, tc.value, sub.DiscriminatorValue,
-			"%s answers to the tag its ancestor spells for it", tc.name)
-		assert.Nil(t, sub.Discriminator, "a subtype does not restate the hierarchy's discriminator")
-	}
-
-	for _, name := range []string{"Shrub", "Sapling"} {
-		sub, ok := doc.Types[namedID(name)].(*ir.Model)
-		require.True(t, ok, "%s composes as a Model", name)
-		require.NotNil(t, sub.Base, "%s composes a base", name)
-		assert.Empty(t, sub.DiscriminatorValue,
-			"%s has no discriminated ancestor, so walking the chain finds no tag", name)
-	}
-}
-
-// assertDiscriminatorAliasMapping covers a mapping that spells two keys for one
-// subtype (GitHub #410). Model.DiscriminatorValue holds one value and a mapping
-// is unordered, so the subtype takes the smallest key in byte order whichever
-// was written first — the fixture writes the larger first — while the base's
-// mapping keeps both, and the election is reported at the subtype as
-// information since nothing is lost.
-func assertDiscriminatorAliasMapping(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
-	require.True(t, ok, "the base is a Model")
-	require.NotNil(t, pet.Discriminator)
-	assert.Equal(t, map[string]ir.TypeID{"alpha": namedID("Dog"), "zulu": namedID("Dog")},
-		pet.Discriminator.Mapping, "the base keeps every key")
-
-	dog, ok := doc.Types[namedID("Dog")].(*ir.Model)
-	require.True(t, ok, "Dog composes as a Model")
-	assert.Equal(t, "alpha", dog.DiscriminatorValue,
-		"the smallest key in byte order, not the first written")
-	assert.True(t, openapitest.HasDiagCodeAt(diags, diag.DegradedConstruct, "/components/schemas/Dog"),
-		"the election is reported at the subtype: %+v", diags)
-}
-
-// assertDiscriminatorDefaultMapping pins Discriminator.Default, whose only source
-// is the 3.2 discriminator.defaultMapping — and with it that a 3.2-only schema
-// keyword compiles without an error diagnostic (GitHub #146). The library checks
-// every schema object against the 3.1 meta-schema whatever the document says, so
-// before this the spec below failed to compile and the field had no witness.
-func assertDiscriminatorDefaultMapping(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	assert.Empty(t, diagsAt(diags, "openapi/validation/validation-invalid-schema",
-		"/components/schemas/Pet/discriminator/defaultMapping"),
-		"a 3.2 keyword in a 3.2 document is not an invalid schema")
-
-	pet, ok := doc.Types[namedID("Pet")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, pet.Discriminator)
-	assert.Equal(t, namedID("Dog"), pet.Discriminator.Default,
-		"defaultMapping names the variant an unrecognized tag falls back to")
-	assert.Equal(t, namedID("Cat"), pet.Discriminator.Mapping["cat"],
-		"and it is read separately from the mapping")
-}
-
-// assertDiscriminatedUnionBesideModel pins where a discriminator goes when its
-// union is kept verbatim beside a model. Pet's and Animal's routes are not
-// subtypes of them, so pass.Validate would reject the discriminator on the
-// model; it moves whole to Unmodeled beside the union. Vehicle's object
-// variant holds one the same way. Shape's routes are true allOf subtypes, so
-// the model keeps it, and the document validates clean.
-func assertDiscriminatedUnionBesideModel(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	assert.Empty(t, pass.Validate(doc))
-
-	for _, name := range []string{"Pet", "Animal"} {
-		m, ok := doc.Types[namedID(name)].(*ir.Model)
-		require.True(t, ok, name)
-		assert.Nil(t, m.Discriminator, "%s routes to a non-subtype, so the model does not carry it", name)
-		entry, ok := m.Unmodeled["openapi:discriminator"]
-		require.True(t, ok, "%s keeps it verbatim instead", name)
-		assert.Equal(t, ir.ReasonDegradedLowering, entry.Reason)
-		assert.Contains(t, m.Unmodeled, "openapi:oneOf", "beside the union it routes through")
-		assert.True(t, openapitest.HasDiagCodeAt(diags, diag.DegradedConstruct, "/components/schemas/"+name+"/discriminator"))
-	}
-	_, isUnion := doc.Types[namedID("Bird")].(*ir.Union)
-	assert.True(t, isUnion, "Bird writes allOf to Animal but lowers to a union, which is no subtype")
-
-	vehicle, ok := doc.Types[namedID("Vehicle")].(*ir.Union)
-	require.True(t, ok, "a multi-typed body lowers to a union")
-	assert.Contains(t, vehicle.Unmodeled, "openapi:discriminator", "kept beside the union it was written for")
-	variant, ok := doc.Types["t/anon/components/schemas/Vehicle/type/0"].(*ir.Model)
-	require.True(t, ok)
-	assert.Nil(t, variant.Discriminator, "the object variant does not carry it")
-
-	shape, ok := doc.Types[namedID("Shape")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, shape.Discriminator, "every target is a subtype, so it stays")
-	assert.Equal(t, namedID("Circle"), shape.Discriminator.Mapping["circle"])
-	assert.NotContains(t, shape.Unmodeled, "openapi:discriminator")
-}
-
-// assertNullableUnionDiscriminator pins that a discriminator beside a oneOf or
-// anyOf that collapses to nullable X is kept verbatim, with a diagnostic,
-// where the collapse leaves no node with a field for it.
-func assertNullableUnionDiscriminator(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	maybe, ok := doc.Types[namedID("MaybeCat")].(*ir.Scalar)
-	require.True(t, ok, "the component is an alias over the nullable reference")
-	assert.Equal(t, ir.TypeRef{Target: namedID("Cat"), Nullable: true}, *maybe.Base)
-	assert.Contains(t, maybe.Unmodeled, "openapi:discriminator")
-	assert.True(t, openapitest.HasDiagCodeAt(diags, diag.DegradedConstruct, "/components/schemas/MaybeCat"))
-
-	owner, ok := doc.Types[namedID("Owner")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, owner.Properties, 1)
-	assert.Equal(t, ir.TypeRef{Target: namedID("Cat"), Nullable: true}, owner.Properties[0].Type)
-	assert.Contains(t, owner.Properties[0].Unmodeled, "openapi:discriminator", "the property carries it")
-}
-
-func assertAnyOfUntagged(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	u, ok := doc.Types[namedID("StringOrNumber")].(*ir.Union)
-	require.True(t, ok)
-	assert.False(t, u.Exclusive, "anyOf is a non-exclusive union")
-	assert.False(t, u.WireTagged, "with no discriminator, validation infers the variant")
-	assert.Nil(t, u.Discriminator)
-	assert.Len(t, u.Variants, 2)
-}
-
-// assertUnionDecoratedBranch pins a union branch annotated the only way 3.0
-// can, by wrapping its $ref (GitHub #1018). The wrapper lowers to a decorator
-// over Pet that keeps the description, so no information is lost, and its
-// variant is named for Pet while the node keeps the positional hint.
-func assertUnionDecoratedBranch(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	u, ok := doc.Types[namedID("U")].(*ir.Union)
-	require.True(t, ok)
-	require.Len(t, u.Variants, 2)
-	assert.Equal(t, "user", u.Variants[0].Name.Hint)
-	assert.Equal(t, "pet", u.Variants[1].Name.Hint, "named for the $ref it wraps, as 3.1's sibling spelling is")
-
-	branch, ok := doc.Types[u.Variants[1].Type.Target].(*ir.Model)
-	require.True(t, ok, "the wrapped branch is a node of its own")
-	base, decorates := ir.Decorated(branch)
-	require.True(t, decorates, "a description beside the wrapped $ref is an annotation, not a shape")
-	assert.Equal(t, namedID("Pet"), base.Target)
-	assert.Equal(t, "a pet", branch.Docs.Description, "the annotation is kept")
-	assert.Equal(t, "variant_1", branch.Name.Hint, "the node keeps the positional hint")
-}
-
-func assertNegationNot(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("NotFoo")].(*ir.Model)
-	require.True(t, ok)
-	raw, ok := m.Unmodeled["openapi:not"]
-	require.True(t, ok, "not-keyword kept verbatim under Unmodeled")
-	assert.JSONEq(t, `{"required":["b"]}`, string(raw.Value))
-	assert.Equal(t, ir.ReasonValidationOnly, raw.Reason)
-	var found bool
-	for _, d := range diags {
-		if d.Code == "openapi/validation-only-keyword" {
-			found = true
-			assert.Equal(t, ir.SeverityInfo, d.Severity)
-		}
-	}
-	assert.True(t, found, "expected a validation-only-keyword info diagnostic")
-}
-
-// assertEnumString pins a string enum and its one-member form, which is an
-// Enum as well: an `enum` keyword lowers to an Enum whatever its member count,
-// and only `const` lowers to a Literal (ir-design §4.5).
-func assertEnumString(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	e, ok := doc.Types[namedID("Color")].(*ir.Enum)
-	require.True(t, ok)
-	assert.Equal(t, ir.PrimString, e.ValueType)
-	assert.True(t, e.Closed)
-	require.Len(t, e.Members, 3)
-	assert.Equal(t, "red", e.Members[0].Value.Str)
-	assert.Equal(t, "blue", e.Members[2].Value.Str)
-
-	pinned, ok := doc.Types[namedID("Pinned")].(*ir.Enum)
-	require.True(t, ok, "a one-member enum is an Enum; got %T", doc.Types[namedID("Pinned")])
-	assert.Equal(t, ir.PrimString, pinned.ValueType)
-	assert.True(t, pinned.Closed)
-	require.Len(t, pinned.Members, 1)
-	assert.Equal(t, "only", pinned.Members[0].Value.Str)
-}
-
-func assertEnumNumeric(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	e, ok := doc.Types[namedID("BigCodes")].(*ir.Enum)
-	require.True(t, ok)
-	assert.Equal(t, ir.PrimInteger, e.ValueType)
-	require.Len(t, e.Members, 2)
-	assert.Equal(t, ir.ValueNumber, e.Members[1].Value.Kind)
-	// BigVal member value preserves the full 64-bit integer.
-	assert.Equal(t, ir.BigVal("9007199254740993"), e.Members[1].Value.Num)
-}
-
-// assertEmptyEnum covers `enum: []`: legal JSON Schema whose value space holds
-// no member, so the position accepts no instance. The IR says that exactly,
-// since a closed Enum admits its members and nothing else. Reading the keyword
-// off `len(enum) > 0` cannot tell an empty list from an absent one, so the
-// position would widen to what its siblings admit (GitHub #278). Holder's
-// `colour` is in the corpus so that a change reaching every enum, not only the
-// empty one, reddens this.
-func assertEmptyEnum(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	empty := map[string]ir.PrimKind{
-		"Nothing":          ir.PrimString,
-		"Bare":             ir.PrimAny,
-		"BesideProperties": ir.PrimAny,
-		"BesideAllOf":      ir.PrimAny,
-	}
-	for name, valueType := range empty {
-		e, ok := doc.Types[namedID(name)].(*ir.Enum)
-		require.True(t, ok, "%s lowers to an Enum, got %T", name, doc.Types[namedID(name)])
-		assert.True(t, e.Closed, "%s admits its members and nothing else", name)
-		assert.Empty(t, e.Members, "%s declares no member", name)
-		assert.Equal(t, valueType, e.ValueType,
-			"%s takes the declared scalar type where one is written", name)
-		assert.Equal(t, []ir.Severity{ir.SeverityWarning},
-			diagsAt(diags, "openapi/empty-enum", "/components/schemas/"+name),
-			"%s is reported once, since nobody writes an empty member list on purpose", name)
-	}
-
-	// An Enum has no home for a property set or a composition, so what the empty
-	// enum is written beside stays verbatim rather than being traded for it.
-	props := unmodeledEntry(t, doc.Types[namedID("BesideProperties")].Common().Unmodeled, "openapi:properties")
-	assert.Equal(t, ir.ReasonDegradedLowering, props.Reason)
-	assert.JSONEq(t, `{"x":{"type":"string"}}`, string(props.Value))
-	composed := unmodeledEntry(t, doc.Types[namedID("BesideAllOf")].Common().Unmodeled, "openapi:allOf")
-	assert.Equal(t, ir.ReasonDegradedLowering, composed.Reason)
-	assert.JSONEq(t, `[{"$ref":"#/components/schemas/Base"}]`, string(composed.Value))
-
-	holder, ok := doc.Types[namedID("Holder")].(*ir.Model)
-	require.True(t, ok)
-	colour, ok := propByWire(holder, "colour")
-	require.True(t, ok)
-	populated, ok := doc.Types[colour.Type.Target].(*ir.Enum)
-	require.True(t, ok, "a populated enum beside the degenerate ones is unaffected")
-	require.Len(t, populated.Members, 2)
-	assert.Equal(t, ir.PrimString, populated.ValueType)
-	assert.Empty(t, diagsAt(diags, "openapi/empty-enum", "/components/schemas/Holder/properties/colour"),
-		"and reports nothing")
-}
-
-// assertMissingArrayItems pins that a 3.0 schema writing type array and no
-// items is reported once, at its own pointer, wherever it sits and whatever it
-// lowers to: Choice is a union of literals (GitHub #650). Copy's $ref names
-// Holder's property coordinate and is declared first, so the property is
-// lowered twice. Holder's typed and empty arrays write items, so the list is
-// every report the document draws.
-func assertMissingArrayItems(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	var got []string
-	for _, d := range diags {
-		if d.Code == "openapi/missing-array-items" {
-			assert.Equal(t, ir.SeverityWarning, d.Severity, "at %s", d.Provenance.Pointer)
-			got = append(got, string(d.Provenance.Pointer))
-		}
-	}
-	slices.Sort(got)
-	assert.Equal(t, []string{
-		"/components/schemas/Bare",
-		"/components/schemas/Choice",
-		"/components/schemas/Holder/properties/tags",
-		"/paths/~1things/get/parameters/0/schema",
-	}, got)
-
-	bare, ok := doc.Types[namedID("Bare")].(*ir.List)
-	require.True(t, ok, "Bare still lowers to a List, got %T", doc.Types[namedID("Bare")])
-	assert.Equal(t, ir.TypeID("t/prim/any"), bare.Elem.Target, "over the top type")
-}
-
-func assertScalarFormat(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	h, ok := doc.Types[namedID("Holder")].(*ir.Model)
-	require.True(t, ok)
-	color, ok := propByWire(h, "color")
-	require.True(t, ok)
-	sc, ok := doc.Types[color.Type.Target].(*ir.Scalar)
-	require.True(t, ok, "unknown format hoists a named Scalar")
-	require.NotNil(t, sc.Encoding)
-	assert.Equal(t, "hex-color", sc.Encoding.Name)
-	require.NotNil(t, sc.Base)
-	assert.Equal(t, ir.TypeID("t/prim/string"), sc.Base.Target)
-	assert.False(t, color.Secret, "an ordinary format asks for no redaction")
-	// The bound survives the hoist the unknown format forced (GitHub #147).
-	require.NotNil(t, sc.Constraints, "the hoisted format scalar carries its own bounds")
-	require.NotNil(t, sc.Constraints.MinLength)
-	assert.Equal(t, int64(4), *sc.Constraints.MinLength)
-
-	// format: password asks for the value to be redacted and names no shape, so
-	// a property whose schema owns no node holds it, and its type is the bare
-	// string's (secret-format covers every other position).
-	token, ok := propByWire(h, "token")
-	require.True(t, ok)
-	assert.True(t, token.Secret)
-	assert.Equal(t, ir.PrimTypeID(ir.PrimString), token.Type.Target)
-
-	// An integer width selects its primitive whichever numeric type carries it.
-	for wire, want := range map[string]ir.PrimKind{"small": ir.PrimInt8, "count": ir.PrimUint32} {
-		p, ok := propByWire(h, wire)
-		require.True(t, ok)
-		assert.Equal(t, ir.PrimTypeID(want), p.Type.Target, "%s selects the shared primitive", wire)
-	}
-	// A float format on an integer admits only integral values, which no
-	// primitive narrower than integer holds, so it hoists over integer.
-	whole, ok := propByWire(h, "whole")
-	require.True(t, ok)
-	ws, ok := doc.Types[whole.Type.Target].(*ir.Scalar)
-	require.True(t, ok, "a pairing no primitive holds hoists a Scalar")
-	require.NotNil(t, ws.Base)
-	assert.Equal(t, ir.PrimTypeID(ir.PrimInteger), ws.Base.Target)
-	require.NotNil(t, ws.Encoding)
-	assert.Equal(t, "double", ws.Encoding.Name)
-}
-
-// assertSecretFormat pins where `format: password` lands at every position the
-// compiler reaches: Sensitive on the node a position owns, whatever its kind;
-// Property.Secret at a property or header owning none; and verbatim on a
-// parameter, which has no field. It reads the nodes rather than the golden's
-// bytes, so a fact that moved to another carrier still fails (GitHub #579).
-func assertSecretFormat(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	pw := requireSensitiveAlias(t, doc, namedID("Pw"), ir.PrimTypeID(ir.PrimString), "component schema")
-	require.NotNil(t, pw.Constraints, "the bound written beside the format stays on the node")
-	assert.Equal(t, new(int64(8)), pw.Constraints.MinLength)
-
-	assertSecretCarriers(t, doc)
-	assertSecretNodes(t, doc)
-	assertSecretOperation(t, doc, diags)
-
-	// The guard: a bare string keeps the shared primitive, and a shared node
-	// never carries one declaration's annotations (GitHub #116).
-	plain, ok := propByWire(secretModel(t, doc, "Login"), "plain")
-	require.True(t, ok)
-	assert.Equal(t, ir.PrimTypeID(ir.PrimString), plain.Type.Target)
-	assert.False(t, plain.Secret)
-	assert.False(t, doc.Types[ir.PrimTypeID(ir.PrimString)].Common().Sensitive)
-	assert.False(t, doc.Types[namedID("Plain")].Common().Sensitive, "a referent beside which a use wrote it")
-}
-
-// assertSecretCarriers covers the properties of Login that own no node, where
-// Property.Secret is the home, and the wrappers whose type reaches the
-// Sensitive node instead.
-func assertSecretCarriers(t *testing.T, doc *ir.Document) {
-	login := secretModel(t, doc, "Login")
-	for _, tc := range []struct {
-		wire   string
-		target ir.TypeID
-	}{
-		{"inline", ir.PrimTypeID(ir.PrimString)},
-		{"pin", ir.PrimTypeID(ir.PrimInteger)},
-		{"viaRef", namedID("Pw")},      // inherited from the referent, as deprecated is
-		{"viaAlias", namedID("Chain")}, // from the end of the $ref chain
-		{"beside", namedID("Plain")},   // written beside the $ref, binding the use
-	} {
-		p, ok := propByWire(login, tc.wire)
-		require.True(t, ok, tc.wire)
-		assert.True(t, p.Secret, "%s: the property is the carrier", tc.wire)
-		assert.Equal(t, tc.target, p.Type.Target, "%s: the redaction names no shape", tc.wire)
-	}
-	inline, ok := propByWire(login, "inline")
-	require.True(t, ok)
-	assert.Equal(t, "shown on the property", inline.Docs.Description, "no node takes the docs away")
-
-	// A wrapper's own schema writes no redaction; its type reaches the node
-	// that does, along a nullable reference or a Base.
-	nullable, ok := propByWire(login, "nullable")
-	require.True(t, ok)
-	assert.False(t, nullable.Secret, "the node holds it, not a copy on the use")
-	assert.Equal(t, ir.TypeRef{Target: namedID("Pw"), Nullable: true}, nullable.Type)
-	wrapped, ok := propByWire(login, "wrapped")
-	require.True(t, ok)
-	assert.False(t, wrapped.Secret, "the node holds it, not a copy on the use")
-	m, ok := doc.Types[wrapped.Type.Target].(*ir.Model)
-	require.True(t, ok, "an allOf over one $ref is a model")
-	require.NotNil(t, m.Base)
-	assert.Equal(t, namedID("Pw"), m.Base.Target)
-	chain, ok := doc.Types[namedID("Chain")].(*ir.Scalar)
-	require.True(t, ok, "an alias component is a Scalar")
-	require.NotNil(t, chain.Base)
-	assert.Equal(t, namedID("Pw"), chain.Base.Target)
-
-	// A property whose schema owns a node leaves the redaction on it.
-	pick, ok := propByWire(login, "pick")
-	require.True(t, ok)
-	assert.False(t, pick.Secret, "one home per declaration")
-	assert.Equal(t, ir.KindEnum, requireSensitive(t, doc, pick.Type.Target, "enum property").Kind())
-}
-
-// assertSecretNodes covers the positions with no carrier: each owns a node, an
-// alias over the bare type where the shape alone would own none.
-func assertSecretNodes(t *testing.T, doc *ir.Document) {
-	arr, ok := propByWire(secretModel(t, doc, "Login"), "arr")
-	require.True(t, ok)
-	list, ok := doc.Types[arr.Type.Target].(*ir.List)
-	require.True(t, ok)
-	items := requireSensitiveAlias(t, doc, list.Elem.Target, ir.PrimTypeID(ir.PrimString), "array items")
-	require.NotNil(t, items.Constraints)
-	assert.Equal(t, new(int64(64)), items.Constraints.MaxLength)
-
-	bag := secretModel(t, doc, "Bag")
-	require.NotNil(t, bag.AdditionalProps)
-	requireSensitiveAlias(t, doc, bag.AdditionalProps.Value.Target, ir.PrimTypeID(ir.PrimString), "additionalProperties")
-	require.Len(t, bag.AdditionalProps.Patterns, 1)
-	requireSensitiveAlias(t, doc, bag.AdditionalProps.Patterns[0].Value.Target, ir.PrimTypeID(ir.PrimString),
-		"patternProperties")
-
-	pair, ok := doc.Types[namedID("Pair")].(*ir.Tuple)
-	require.True(t, ok)
-	require.Len(t, pair.Elems, 1)
-	requireSensitiveAlias(t, doc, pair.Elems[0].Target, ir.PrimTypeID(ir.PrimString), "prefixItems")
-
-	tokens, ok := doc.Types[namedID("Tokens")].(*ir.List)
-	require.True(t, ok)
-	requireSensitiveAlias(t, doc, tokens.Elem.Target, namedID("Plain"), "items beside a $ref")
-
-	either, ok := doc.Types[namedID("Either")].(*ir.Union)
-	require.True(t, ok)
-	require.Len(t, either.Variants, 2)
-	requireSensitiveAlias(t, doc, either.Variants[0].Type.Target, ir.PrimTypeID(ir.PrimString), "union branch")
-	assert.False(t, either.Sensitive, "the branch is redacted, not the union")
-
-	assert.Equal(t, ir.KindLiteral, requireSensitive(t, doc, namedID("Code"), "const").Kind())
-	requireSensitiveAlias(t, doc, namedID("Opaque"), ir.PrimTypeID(ir.PrimAny), "untyped")
-	encoded, ok := requireSensitive(t, doc, namedID("Encoded"), "beside contentEncoding").(*ir.Scalar)
-	require.True(t, ok)
-	require.NotNil(t, encoded.Encoding)
-	assert.Equal(t, "base64", encoded.Encoding.Name, "contentEncoding alone names the encoding")
-}
-
-// assertSecretOperation covers the parameters, bodies and headers.
-func assertSecretOperation(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "login")
-	require.True(t, ok)
-
-	token, ok := paramByName(op, "X-Token")
-	require.True(t, ok)
-	assert.Equal(t, ir.PrimTypeID(ir.PrimString), token.Type.Target, "a parameter owns no node for it")
-	assert.Equal(t, "the session token", token.Docs.Description)
-	require.Contains(t, token.Unmodeled, "openapi:format", "ir.Parameter has no field (GitHub #578)")
-	assert.Equal(t, ir.ReasonNoIRHome, token.Unmodeled["openapi:format"].Reason)
-	assert.Equal(t, []ir.Severity{ir.SeverityInfo},
-		diagsAt(diags, "openapi/degraded-construct", "/paths/~1login/post/parameters/0/schema/format"))
-	key, ok := paramByName(op, "api_key")
-	require.True(t, ok)
-	assert.Equal(t, namedID("Pw"), key.Type.Target, "a referent's redaction is its own node's")
-	assert.NotContains(t, key.Unmodeled, "openapi:format")
-
-	str := ir.PrimTypeID(ir.PrimString)
-	requireSensitiveAlias(t, doc, openapitest.BodyTarget(t, op.Request), str, "request content schema")
-	require.Len(t, op.Responses, 1)
-	requireSensitiveAlias(t, doc, openapitest.BodyTarget(t, op.Responses[0].Payload), str, "response content schema")
-
-	require.Len(t, op.Responses[0].Headers, 2)
-	header := op.Responses[0].Headers[0]
-	assert.True(t, header.Secret, "a header is a property carrier")
-	assert.Equal(t, ir.PrimTypeID(ir.PrimString), header.Type.Target)
-	assert.Equal(t, ir.TypeRef{Target: namedID("Pw"), Nullable: true}, op.Responses[0].Headers[1].Type)
-}
-
-// secretModel returns the secret-format component name as a Model.
-func secretModel(t *testing.T, doc *ir.Document, name string) *ir.Model {
-	t.Helper()
-	m, ok := doc.Types[namedID(name)].(*ir.Model)
-	require.True(t, ok, "%s is a model", name)
-	return m
-}
-
-// requireSensitive requires the node at id to exist and be Sensitive.
-func requireSensitive(t *testing.T, doc *ir.Document, id ir.TypeID, position string) ir.TypeDef {
-	t.Helper()
-	node, ok := doc.Types[id]
-	require.True(t, ok, "%s: nothing is interned at %s", position, id)
-	assert.True(t, node.Common().Sensitive, "%s: whole-type redaction", position)
-	return node
-}
-
-// requireSensitiveAlias requires the node at id to be a Sensitive alias: the
-// Scalar over base a position owns where its shape alone is that shared base,
-// with no encoding, since a redaction is none.
-func requireSensitiveAlias(t *testing.T, doc *ir.Document, id, base ir.TypeID, position string) *ir.Scalar {
-	t.Helper()
-	sc, ok := requireSensitive(t, doc, id, position).(*ir.Scalar)
-	require.True(t, ok, "%s: a Scalar", position)
-	require.NotNil(t, sc.Base, "%s: a base", position)
-	assert.Equal(t, base, sc.Base.Target, "%s: over its shape", position)
-	assert.Nil(t, sc.Encoding, "%s: the redaction is no encoding", position)
-	return sc
-}
-
-// assertXMLHints covers the XML wire shape, whose hints attach at two carriers
-// with different scopes: a type node holds the root element shape, a property
-// holds a per-use override. A position that owns a node keeps them there, so
-// which carrier a hint lands on follows what the position lowered to.
-func assertXMLHints(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	book, ok := doc.Types[namedID("Book")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, book.XML)
-	assert.Equal(t, ir.XMLHints{Name: "book", Namespace: "urn:example:books", Prefix: "bk"}, *book.XML)
-
-	isbn, ok := propByWire(book, "isbn")
-	require.True(t, ok)
-	require.NotNil(t, isbn.XML, "a scalar property has no node of its own, so the property carries them")
-	assert.Equal(t, ir.XMLHints{Namespace: "urn:example:books", Prefix: "bk", NodeType: "attribute"},
-		*isbn.XML, "attribute: true is the node type, not a flag of its own")
-
-	authors, ok := propByWire(book, "authors")
-	require.True(t, ok)
-	assert.Nil(t, authors.XML, "an array owns a node, which is where its hints go")
-	list, ok := doc.Types[authors.Type.Target].(*ir.List)
-	require.True(t, ok)
-	require.NotNil(t, list.XML)
-	assert.True(t, list.XML.Wrapped, "wrapping is a property of the collection")
-	elem, ok := doc.Types[list.Elem.Target]
-	require.True(t, ok)
-	require.NotNil(t, elem.Common().XML)
-	assert.Equal(t, "author", elem.Common().XML.Name)
-}
-
-func assertEncodingByte(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	h, ok := doc.Types[namedID("Holder")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, h.Properties, 1)
-	sc, ok := doc.Types[h.Properties[0].Type.Target].(*ir.Scalar)
-	require.True(t, ok)
-	require.NotNil(t, sc.Encoding)
-	assert.Equal(t, "base64", sc.Encoding.Name)
-	require.NotNil(t, sc.Encoding.WireType)
-	assert.Equal(t, ir.TypeID("t/prim/string"), sc.Encoding.WireType.Target)
-	require.NotNil(t, sc.Base)
-	assert.Equal(t, ir.TypeID("t/prim/bytes"), sc.Base.Target)
-
-	// A scalar that hoists a node because of its format must keep the bounds it
-	// wrote beside it: owning the pointer is what stops the shared alias path
-	// attaching them afterwards (GitHub #147).
-	require.NotNil(t, sc.Constraints, "the hoisted byte scalar carries its own bounds")
-	require.NotNil(t, sc.Constraints.MinLength)
-	assert.Equal(t, int64(5), *sc.Constraints.MinLength)
-	require.NotNil(t, sc.Constraints.MaxLength)
-	assert.Equal(t, int64(9), *sc.Constraints.MaxLength)
-}
-
-func assertNullabilityFourStates(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, m.Properties, 4)
-	states := openapitest.PropsByWire(m.Properties)
-	assert.True(t, states["reqPlain"].Required)
-	assert.False(t, states["reqPlain"].Type.Nullable)
-	assert.True(t, states["reqNull"].Required)
-	assert.True(t, states["reqNull"].Type.Nullable)
-	assert.False(t, states["optPlain"].Required)
-	assert.False(t, states["optPlain"].Type.Nullable)
-	assert.False(t, states["optNull"].Required)
-	assert.True(t, states["optNull"].Type.Nullable)
-}
-
-func assertNullable30(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, m.Properties, 1)
-	assert.True(t, m.Properties[0].Type.Nullable, "3.0 nullable lowers to the same IR bit")
-}
-
-func assertNullable31Ref(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("Owner")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, m.Properties, 2)
-	byName := openapitest.PropsByWire(m.Properties)
-
-	assert.True(t, byName["p"].Type.Nullable,
-		"3.1's type-array null spelling normalizes to the same IR bit at a $ref site")
-	assert.Equal(t, namedID("Target"), byName["p"].Type.Target, "the ref resolves to the named component")
-
-	assert.True(t, byName["q"].Type.Nullable,
-		"a union's null branch is stripped into the ref's Nullable bit, so the ref must carry it")
-	assert.Equal(t, namedID("UnionTarget"), byName["q"].Type.Target, "the ref resolves to the union component")
-
-	u, ok := doc.Types[namedID("UnionTarget")].(*ir.Union)
-	require.True(t, ok)
-	assert.Len(t, u.Variants, 2, "the null branch lifts to the ref rather than becoming a variant")
-
-	assertCollapsedBranchHint(t, doc)
-}
-
-// assertCollapsedBranchHint covers the {X, null} collapse's naming of the
-// branch it keeps. The branch pointer is nameable from outside (BranchRef names
-// it) and only the first lowering to reach it interns the node, so the collapse
-// and an outside $ref must derive the same hint, or the document depends on
-// which component is declared first (GitHub #281). The spec declares Collapsed
-// before BranchRef on purpose: that is the order in which the collapse reaches
-// the pointer first. The permutation half is the two-order oracle's
-// (internal/harness).
-func assertCollapsedBranchHint(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	const branchID = ir.TypeID("t/anon/components/schemas/Collapsed/oneOf/0")
-
-	collapsed, ok := doc.Types[namedID("Collapsed")].(*ir.Scalar)
-	require.True(t, ok, "a {X, null} set resolves to its one branch rather than to a union node")
-	require.NotNil(t, collapsed.Base)
-	assert.True(t, collapsed.Base.Nullable, "the null branch lifts onto the reference")
-	assert.Equal(t, branchID, collapsed.Base.Target)
-
-	branch, ok := doc.Types[branchID]
-	require.True(t, ok, "the branch declares a description, so it owns a node of its own")
-	assert.Equal(t, "variant_0", branch.Common().Name.Hint,
-		"the branch is named by its position in the composition, which is what a $ref to it derives too")
-
-	ref, ok := doc.Types[namedID("BranchRef")].(*ir.Scalar)
-	require.True(t, ok)
-	require.NotNil(t, ref.Base)
-	assert.Equal(t, branchID, ref.Base.Target, "the outside reference reaches that same node")
-}
-
-// assertNullableEnum31 covers 3.1's spelling of a nullable enum: `null` listed
-// among the members of a null-admitting type array. The member is normalized
-// onto the Nullable bit of every reference to the enum rather than degrading the
-// declaration to a union of literals, so the claim is the pair: a closed Enum of
-// the scalar members, and null admitted at each use. The golden cannot pin the
-// strip, since the type array already carries the bit and deleting the `null`
-// member moves only the source hash; the member count below does.
-func assertNullableEnum31(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	e, ok := doc.Types[namedID("Color")].(*ir.Enum)
-	require.True(t, ok, "the null member does not cost the declaration its enum-ness")
-	assert.True(t, e.Closed)
-	assert.Equal(t, ir.PrimString, e.ValueType, "null contributes no value type of its own")
-	require.Len(t, e.Members, 2, "the null member is normalized away, the scalar members are not")
-	assert.Equal(t, "red", e.Members[0].Value.Str)
-	assert.Equal(t, "green", e.Members[1].Value.Str)
-	for _, d := range diags {
-		assert.NotEqual(t, "openapi/degraded-construct", d.Code, "normalizing is not degrading: %+v", d)
-	}
-
-	m, ok := doc.Types[namedID("Holder")].(*ir.Model)
-	require.True(t, ok)
-	one, ok := propByWire(m, "one")
-	require.True(t, ok)
-	assert.Equal(t, ir.TypeRef{Target: namedID("Color"), Nullable: true}, one.Type,
-		"a property $ref admits the null the members no longer carry")
-
-	many, ok := propByWire(m, "many")
-	require.True(t, ok)
-	list, ok := doc.Types[many.Type.Target].(*ir.List)
-	require.True(t, ok, "the array property hoists a List")
-	assert.Equal(t, ir.TypeRef{Target: namedID("Color"), Nullable: true}, list.Elem,
-		"and so does a list element, which holds its own reference")
-	assert.False(t, many.Type.Nullable, "the list itself was never declared nullable")
-
-	op, ok := opByName(doc, "pick")
-	require.True(t, ok)
-	p, ok := paramByName(op, "color")
-	require.True(t, ok)
-	assert.Equal(t, ir.TypeRef{Target: namedID("Color"), Nullable: true}, p.Type,
-		"a parameter reaches the same declaration through the operation walk")
-
-	// The two spellings beside Color. A non-empty enum fixes the value space, so
-	// the members decide null admission whether or not a type keyword is written
-	// beside them — and when one is, the two conjoin rather than the type winning.
-	bare, ok := doc.Types[namedID("BareColor")].(*ir.Enum)
-	require.True(t, ok, "a bare enum listing null is still an enum of its scalar members")
-	require.Len(t, bare.Members, 2, "the null member is normalized away here too")
-	assert.Equal(t, ir.PrimString, bare.ValueType, "the kept members supply the value type")
-
-	narrowed, ok := doc.Types[namedID("NarrowedColor")].(*ir.Enum)
-	require.True(t, ok)
-	require.Len(t, narrowed.Members, 2, "nothing to strip: the members never listed null")
-
-	bareRef, ok := propByWire(m, "bare")
-	require.True(t, ok)
-	assert.Equal(t, ir.TypeRef{Target: namedID("BareColor"), Nullable: true}, bareRef.Type,
-		"the bare spelling admits null at its uses, like the type-array spelling of the same set")
-
-	narrowedRef, ok := propByWire(m, "narrowed")
-	require.True(t, ok)
-	assert.Equal(t, ir.TypeRef{Target: namedID("NarrowedColor"), Nullable: false}, narrowedRef.Type,
-		"an enum excluding null must not admit it, whatever the type keyword names")
-}
-
-// assertNullabilityConjunction covers how null admission is decided for a schema
-// whose keywords disagree: JSON Schema conjoins them, so a position admits null
-// when something declares it and nothing takes it away. The claim is agreement:
-// the same constraint written two ways reaches one Nullable bit, which is all an
-// emitter reads.
-//
-// Base and Mixins are asserted to stay bare on purpose. They name one side of a
-// conjunction, so the bit belongs to the usage that names the whole; a
-// composition carrying its own would state one fact in two places that can
-// disagree.
-func assertNullabilityConjunction(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("Holder")].(*ir.Model)
-	require.True(t, ok)
-	props := openapitest.PropsByWire(m.Properties)
-	require.Len(t, props, 5)
-
-	assert.Equal(t, props["direct"].Type.Nullable, props["viaAllOf"].Type.Nullable,
-		"a sole conjunct's null survives the composition that names it")
-	assert.True(t, props["viaAllOf"].Type.Nullable)
-	assert.Equal(t, props["directModel"].Type.Nullable, props["viaAllOfModel"].Type.Nullable,
-		"a model target has no second hop to recover the null from")
-	assert.True(t, props["viaAllOfModel"].Type.Nullable)
-	assert.False(t, props["viaAllOfBoth"].Type.Nullable,
-		"one conjunct forbidding null decides the conjunction")
-
-	for _, name := range []string{"WrapNullableScalar", "WrapNullableModel", "WrapBoth"} {
-		wrap, isModel := doc.Types[namedID(name)].(*ir.Model)
-		require.True(t, isModel, "%s composes as a model", name)
-		if wrap.Base != nil {
-			assert.False(t, wrap.Base.Nullable, "%s.Base names a conjunct, not a usage", name)
-		}
-		for i, mix := range wrap.Mixins {
-			assert.False(t, mix.Nullable, "%s.Mixins[%d] names a conjunct, not a usage", name, i)
-		}
-	}
-
-	plain, ok := doc.Types[namedID("PlainUnion")].(*ir.Union)
-	require.True(t, ok)
-	distributed, ok := doc.Types[namedID("DistributedUnion")].(*ir.Union)
-	require.True(t, ok)
-	require.Len(t, plain.Variants, 2)
-	require.Len(t, distributed.Variants, 2)
-	for i := range plain.Variants {
-		assert.Equal(t, plain.Variants[i].Type.Nullable, distributed.Variants[i].Type.Nullable,
-			"variant %d: distributing a body that declares no type does not change what its branch admits", i)
-	}
-	assert.True(t, plain.Variants[0].Type.Nullable, "the nullable branch is the one that admits null")
-	assert.False(t, plain.Variants[1].Type.Nullable, "and the plain one is not")
-}
-
-func assertDefaults(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-	n, ok := propByWire(m, "n")
-	require.True(t, ok)
-	require.NotNil(t, n.Default)
-	assert.Equal(t, ir.ValueNumber, n.Default.Kind)
-	assert.Equal(t, ir.BigVal("9007199254740993"), n.Default.Num)
-
-	// A declaration-site default reaches the referencing property, and the
-	// declaration keeps it verbatim because the type node has no field for it.
-	viaRef, ok := propByWire(m, "viaRef")
-	require.True(t, ok)
-	require.NotNil(t, viaRef.Default, "the referent's default binds the reference site")
-	assert.Equal(t, ir.BigVal("41"), viaRef.Default.Num)
-
-	decl, ok := doc.Types[namedID("DeclaredDefault")].(*ir.Scalar)
-	require.True(t, ok)
-	entry, ok := decl.Unmodeled["openapi:default"]
-	require.True(t, ok, "the declaration's own default is kept as residue")
-	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-	assert.JSONEq(t, `41`, string(entry.Value))
-
-	assertNonScalarDefaults(t, m)
-}
-
-// assertNonScalarDefaults pins the Value payloads a default reaches beyond string
-// and number: a boolean, a base64 !!binary scalar, and a sequence. Each selects a
-// different payload field, and Kind is what says which one carries meaning.
-func assertNonScalarDefaults(t *testing.T, m *ir.Model) {
-	t.Helper()
-	flag, ok := propByWire(m, "flag")
-	require.True(t, ok)
-	require.NotNil(t, flag.Default)
-	assert.Equal(t, ir.Value{Kind: ir.ValueBool, Bool: true}, *flag.Default)
-
-	blob, ok := propByWire(m, "blob")
-	require.True(t, ok)
-	require.NotNil(t, blob.Default)
-	assert.Equal(t, ir.ValueBytes, blob.Default.Kind)
-	assert.Equal(t, []byte("hi"), blob.Default.Bytes, "a !!binary default is decoded, not kept as text")
-
-	list, ok := propByWire(m, "list")
-	require.True(t, ok)
-	require.NotNil(t, list.Default)
-	assert.Equal(t, ir.ValueList, list.Default.Kind)
-	require.Len(t, list.Default.List, 2)
-	assert.Equal(t, ir.BigVal("1"), list.Default.List[0].Num)
-	assert.Equal(t, ir.BigVal("2"), list.Default.List[1].Num)
-}
-
-// assertYAMLTimestampScalars covers a YAML 1.1 quirk: an unquoted date like
-// 2021-01-01 resolves to tag !!timestamp, not !!str. It must survive as the
-// literal string everywhere OpenAPI's JSON data model can carry one — enum,
-// const, a property default, a schema-level example, and a media-type example —
-// with nothing dropped or degraded to null.
-//
-// "Everywhere" spans both channels a date can land in. It used to mean only the
-// ir.Value one, and the raw-JSON one went on rewriting a date to RFC 3339 with
-// this fixture green (GitHub #242); assertRawPreservedDates is the other half.
-func assertYAMLTimestampScalars(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	// R's `not` announces the §4.7 carve-out, and D's `format: date` announces
-	// that an ir.Enum has no Encoding field to put it in, so it is kept verbatim
-	// beside the enum rather than dropped. Those two are the only notices any
-	// site here is allowed to say, and neither is about a date: one that was
-	// dropped or degraded reports itself as a warning, which is what this fixture
-	// exists to catch.
-	for _, d := range diags {
-		assert.Equal(t, ir.SeverityInfo, d.Severity,
-			"every unquoted date converts cleanly; nothing is dropped or degraded: %+v", d)
-		if d.Code == "openapi/degraded-construct" && d.Provenance.Pointer == "/components/schemas/D" {
-			continue
-		}
-		assert.Equal(t, "openapi/validation-only-keyword", d.Code,
-			"the §4.7 carve-out is the only other notice this fixture expects: %+v", d)
-	}
-
-	d, ok := doc.Types[namedID("D")].(*ir.Enum)
-	require.True(t, ok, "D stays a closed Enum of the real dates, not a union of null literals")
-	assert.Equal(t, ir.PrimString, d.ValueType)
-	require.Len(t, d.Members, 2)
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, d.Members[0].Value)
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2022-02-02"}, d.Members[1].Value)
-
-	k, ok := doc.Types[namedID("K")].(*ir.Literal)
-	require.True(t, ok, "K's const hoists a real Literal, not the schemaless top type")
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, k.Value)
-
-	s, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-	require.Len(t, s.Properties, 1)
-	prop := s.Properties[0]
-	require.NotNil(t, prop.Default, "the property default is preserved")
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, *prop.Default)
-	require.Len(t, prop.Examples, 1, "the schema-level example is preserved")
-	require.NotNil(t, prop.Examples[0].Value)
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, *prop.Examples[0].Value)
-
-	op, ok := opByName(doc, "getItem")
-	require.True(t, ok)
-	require.NotNil(t, op.Responses[0].Payload)
-	require.Len(t, op.Responses[0].Payload.Contents, 1)
-	mediaExamples := op.Responses[0].Payload.Contents[0].Examples
-	require.Len(t, mediaExamples, 1, "the media-type example is preserved")
-	require.NotNil(t, mediaExamples[0].Value)
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, *mediaExamples[0].Value)
-
-	assertRawPreservedDates(t, doc)
-}
-
-// assertRawPreservedDates pins the source spelling of a date kept as raw JSON,
-// at both sites that channel has: a vendor extension and the §4.7
-// validation-only carve-out. Each wants the text the source wrote — resolving
-// the tag and re-rendering it hands the construct a padding, a time and a zone
-// nobody asked for, and the resolved form cannot be read back to the spelling.
-func assertRawPreservedDates(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	r, ok := doc.Types[namedID("R")].(*ir.Model)
-	require.True(t, ok)
-	kept := r.Unmodeled
-
-	for _, tc := range []struct{ key, want string }{
-		{"openapi:x-effective", `"2021-1-1"`},
-		{"openapi:x-window", `{"from":"2021-1-1","to":"2022-2-2"}`},
-		{"openapi:not", `{"const":"2021-1-1"}`},
-	} {
-		entry, found := kept[tc.key]
-		require.True(t, found, "%s is preserved; got %v", tc.key, kept)
-		assert.Equal(t, tc.want, string(entry.Value),
-			"%s keeps the date as written, not as RFC 3339 spells it", tc.key)
-	}
-}
-
-func assertConstraints(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-	ratio, ok := propByWire(m, "ratio")
-	require.True(t, ok)
-	c := ratio.Constraints
-	require.NotNil(t, c)
-	// Exact decimal strings — a float64 path would corrupt all three.
-	require.NotNil(t, c.Min)
-	require.NotNil(t, c.Max)
-	require.NotNil(t, c.MultipleOf)
-	assert.Equal(t, ir.BigVal("0.30000000000000004"), *c.Min)
-	assert.Equal(t, ir.BigVal("9007199254740993"), *c.Max)
-	assert.Equal(t, ir.BigVal("0.1"), *c.MultipleOf)
-
-	// The object's own cardinality bound lands on the Model, not on a property
-	// and not nowhere (GitHub #129).
-	require.NotNil(t, m.Constraints)
-	require.NotNil(t, m.Constraints.MinProps)
-	require.NotNil(t, m.Constraints.MaxProps)
-	assert.Equal(t, int64(1), *m.Constraints.MinProps)
-	assert.Equal(t, int64(4), *m.Constraints.MaxProps)
-
-	assertLengthAndCollectionBounds(t, doc, m)
-	assertCoDeclaredBounds(t, m, diags)
-	assertCoDeclaredBoundKept(t, doc, m)
-}
-
-// assertCoDeclaredBounds pins the 2020-12 rule that a side declaring both of
-// its keywords carries both: minimum and exclusiveMinimum are independent and
-// conjunctive, ir.Constraints has a field for each, and neither is chosen over
-// the other (GitHub #33, #425).
-//
-// Both directions are here on purpose. The property bounded below has the
-// inclusive keyword as its tighter bound and the one bounded above the
-// exclusive one, so a reader that kept the tighter alone answers the two
-// differently — and a reader that always kept the exclusive keyword passes the
-// second on its own.
-func assertCoDeclaredBounds(t *testing.T, m *ir.Model, diags []ir.Diagnostic) {
-	t.Helper()
-	low, ok := propByWire(m, "atLeastTen")
-	require.True(t, ok)
-	require.NotNil(t, low.Constraints)
-	require.NotNil(t, low.Constraints.Min)
-	require.NotNil(t, low.Constraints.ExclusiveMin)
-	assert.Equal(t, ir.BigVal("10"), *low.Constraints.Min, "minimum as written")
-	assert.Equal(t, ir.BigVal("0"), *low.Constraints.ExclusiveMin,
-		"and the looser exclusiveMinimum beside it, not dropped for being implied")
-
-	high, ok := propByWire(m, "underTen")
-	require.True(t, ok)
-	require.NotNil(t, high.Constraints)
-	require.NotNil(t, high.Constraints.Max)
-	require.NotNil(t, high.Constraints.ExclusiveMax)
-	assert.Equal(t, ir.BigVal("100"), *high.Constraints.Max, "maximum as written")
-	assert.Equal(t, ir.BigVal("10"), *high.Constraints.ExclusiveMax, "and exclusiveMaximum beside it")
-
-	for _, d := range diags {
-		assert.NotContains(t, d.Message, "exclusiveMinimum",
-			"a pair that reaches two fields is not a degradation to report")
-	}
-}
-
-// assertCoDeclaredBoundKept is the losslessness half of the same rule: with a
-// field per keyword there is nothing left over, so neither carrier keeps a bound
-// verbatim. Nothing is restated beside constraints that hold it all — an entry
-// there would give one bound two homes, and {minimum: 10, exclusiveMinimum: 0}
-// is told from {minimum: 10} by the fields themselves (GitHub #286).
-func assertCoDeclaredBoundKept(t *testing.T, doc *ir.Document, m *ir.Model) {
-	t.Helper()
-	low, ok := propByWire(m, "atLeastTen")
-	require.True(t, ok)
-	assert.Empty(t, low.Unmodeled, "the property keeps nothing beside its constraints")
-
-	high, ok := propByWire(m, "underTen")
-	require.True(t, ok)
-	assert.Empty(t, high.Unmodeled, "and neither does the side settled the other way")
-
-	alias, ok := doc.Types[namedID("Bounded")].(*ir.Scalar)
-	require.True(t, ok, "a component reducing to a shared primitive owns an alias node")
-	require.NotNil(t, alias.Constraints)
-	require.NotNil(t, alias.Constraints.Min)
-	require.NotNil(t, alias.Constraints.ExclusiveMin)
-	assert.Equal(t, ir.BigVal("0"), *alias.Constraints.ExclusiveMin,
-		"a node carries both bounds, exactly as a property does")
-	assert.Empty(t, alias.Unmodeled)
-}
-
-// assertLengthAndCollectionBounds pins the non-numeric bounds: a string length
-// pair on the declaring property, and a collection bound on the List the array
-// position hoisted, which is the node that describes the collection.
-func assertLengthAndCollectionBounds(t *testing.T, doc *ir.Document, m *ir.Model) {
-	t.Helper()
-	label, ok := propByWire(m, "label")
-	require.True(t, ok)
-	require.NotNil(t, label.Constraints)
-	require.NotNil(t, label.Constraints.MinLength)
-	require.NotNil(t, label.Constraints.MaxLength)
-	assert.Equal(t, int64(2), *label.Constraints.MinLength)
-	assert.Equal(t, int64(8), *label.Constraints.MaxLength)
-
-	tags, ok := propByWire(m, "tags")
-	require.True(t, ok)
-	list, ok := doc.Types[tags.Type.Target].(*ir.List)
-	require.True(t, ok, "an array position hoists a List")
-	require.NotNil(t, list.Constraints)
-	require.NotNil(t, list.Constraints.MinItems)
-	require.NotNil(t, list.Constraints.MaxItems)
-	assert.Equal(t, int64(1), *list.Constraints.MinItems)
-	assert.Equal(t, int64(5), *list.Constraints.MaxItems)
-	assert.True(t, list.Constraints.UniqueItems)
-}
-
-func assertNumericPrecision(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-
-	// Bounds beyond float64 range and a huge integer beyond int64, exact.
-	bounded, ok := propByWire(m, "bounded")
-	require.True(t, ok)
-	require.NotNil(t, bounded.Constraints)
-	require.NotNil(t, bounded.Constraints.Min)
-	require.NotNil(t, bounded.Constraints.Max)
-	require.NotNil(t, bounded.Constraints.MultipleOf)
-	assert.Equal(t, ir.BigVal("1.8e308"), *bounded.Constraints.Min)
-	assert.Equal(t, ir.BigVal("123456789012345678901234567890"), *bounded.Constraints.Max)
-	assert.Equal(t, ir.BigVal("1e-30"), *bounded.Constraints.MultipleOf)
-
-	// A leading-dot spelling is canonicalized to JSON form; a high-precision
-	// decimal is kept to the last digit.
-	exclusive, ok := propByWire(m, "exclusive")
-	require.True(t, ok)
-	require.NotNil(t, exclusive.Constraints)
-	require.NotNil(t, exclusive.Constraints.ExclusiveMin)
-	require.NotNil(t, exclusive.Constraints.ExclusiveMax)
-	assert.Equal(t, ir.BigVal("0.5"), *exclusive.Constraints.ExclusiveMin)
-	assert.Equal(t, ir.BigVal("0.12345678901234567890123456789"), *exclusive.Constraints.ExclusiveMax)
-
-	// A default beyond float64 range is captured as a number, not a string.
-	withDefault, ok := propByWire(m, "withDefault")
-	require.True(t, ok)
-	require.NotNil(t, withDefault.Default)
-	assert.Equal(t, ir.ValueNumber, withDefault.Default.Kind)
-	assert.Equal(t, ir.BigVal("1.8e308"), withDefault.Default.Num)
-
-	// A const beyond float64 range hoists a Literal over the exact number.
-	pinned, ok := propByWire(m, "pinned")
-	require.True(t, ok)
-	lit, ok := doc.Types[pinned.Type.Target].(*ir.Literal)
-	require.True(t, ok)
-	assert.Equal(t, ir.ValueNumber, lit.Value.Kind)
-	assert.Equal(t, ir.BigVal("1.8e308"), lit.Value.Num)
-
-	// Numeric enum members keep their exact value past int64 range.
-	choice, ok := propByWire(m, "choice")
-	require.True(t, ok)
-	enum, ok := doc.Types[choice.Type.Target].(*ir.Enum)
-	require.True(t, ok)
-	require.Len(t, enum.Members, 2)
-	assert.Equal(t, ir.BigVal("123456789012345678901234567890"), enum.Members[1].Value.Num)
-
-	// A leading-dot example is canonicalized losslessly.
-	sampled, ok := propByWire(m, "sampled")
-	require.True(t, ok)
-	require.Len(t, sampled.Examples, 1)
-	require.NotNil(t, sampled.Examples[0].Value)
-	assert.Equal(t, ir.BigVal("0.5"), sampled.Examples[0].Value.Num)
-
-	assertYAMLIntegerBases(t, doc, m)
-	assertRawPreservedNumbers(t, m)
-}
-
-// assertRawPreservedNumbers pins the second numeric channel: the constructs kept
-// verbatim as raw JSON rather than lowered into a Value. It rounded every one of
-// these through float64 until GitHub #32 — a 30-digit extension came back as
-// 1.2345678901234568e+29 — which no case in this corpus could see, because none
-// of them carried a number a float64 cannot hold.
-func assertRawPreservedNumbers(t *testing.T, m *ir.Model) {
-	t.Helper()
-	preserved, ok := propByWire(m, "preserved")
-	require.True(t, ok)
-	kept := preserved.Unmodeled
-
-	for _, tc := range []struct{ key, want string }{
-		{"openapi:x-precise-limit", "123456789012345678901234567890"},
-		{"openapi:x-precise-step", "1.000000000000000000001"},
-		{"openapi:x-precise-scale", "1.10"},
-		{"openapi:not", `{"const":123456789012345678901234567890}`},
-	} {
-		entry, found := kept[tc.key]
-		require.True(t, found, "%s is preserved; got %v", tc.key, kept)
-		assert.Equal(t, tc.want, string(entry.Value),
-			"%s is preserved as written, not as a float64 can spell it", tc.key)
-	}
-}
-
-// assertYAMLIntegerBases pins the value every numeric site stores for an integer
-// whose YAML base comes from its prefix. Reading the source spelling as base 10
-// would store 644 where the document said 420, and would do it silently.
-func assertYAMLIntegerBases(t *testing.T, doc *ir.Document, m *ir.Model) {
-	t.Helper()
-	mode, ok := propByWire(m, "mode")
-	require.True(t, ok)
-	require.NotNil(t, mode.Default)
-	assert.Equal(t, ir.BigVal("420"), mode.Default.Num, "0644 is octal in YAML")
-
-	enum, ok := doc.Types[mode.Type.Target].(*ir.Enum)
-	require.True(t, ok)
-	require.Len(t, enum.Members, 2)
-	assert.Equal(t, ir.BigVal("420"), enum.Members[0].Value.Num)
-	assert.Equal(t, ir.BigVal("493"), enum.Members[1].Value.Num)
-
-	bounds, ok := propByWire(m, "bounds")
-	require.True(t, ok)
-	require.NotNil(t, bounds.Constraints)
-	require.NotNil(t, bounds.Constraints.Min)
-	require.NotNil(t, bounds.Constraints.Max)
-	require.NotNil(t, bounds.Constraints.MultipleOf)
-	assert.Equal(t, ir.BigVal("15"), *bounds.Constraints.Min, "017 is octal")
-	assert.Equal(t, ir.BigVal("31"), *bounds.Constraints.Max, "0x1f is hex")
-	assert.Equal(t, ir.BigVal("10"), *bounds.Constraints.MultipleOf, "0b1010 is binary")
-	require.Len(t, bounds.Examples, 1)
-	require.NotNil(t, bounds.Examples[0].Value)
-	assert.Equal(t, ir.BigVal("30"), bounds.Examples[0].Value.Num, "0b11110 is binary")
-
-	// "_" is a separator, and a leading zero YAML resolves as a decimal float
-	// still has to come out as a JSON-valid literal.
-	counted, ok := propByWire(m, "counted")
-	require.True(t, ok)
-	require.NotNil(t, counted.Default)
-	assert.Equal(t, ir.BigVal("1000000"), counted.Default.Num)
-	loose, ok := propByWire(m, "loose")
-	require.True(t, ok)
-	require.NotNil(t, loose.Default)
-	assert.Equal(t, ir.BigVal("9"), loose.Default.Num)
-}
-
-func assertReadOnlyWriteOnly(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-	r, ok := propByWire(m, "r")
-	require.True(t, ok)
-	w, ok := propByWire(m, "w")
-	require.True(t, ok)
-	assert.Equal(t, ir.Visibility{Only: []ir.Lifecycle{ir.LifecycleRead, ir.LifecycleDelete, ir.LifecycleQuery}}, r.Visibility)
-	assert.Equal(t, ir.Visibility{Only: []ir.Lifecycle{ir.LifecycleCreate, ir.LifecycleUpdate}}, w.Visibility)
-
-	// A declaration-site readOnly reaches the referencing property, and the
-	// declaration keeps it verbatim because the type node has no field for it.
-	viaRef, ok := propByWire(m, "viaRef")
-	require.True(t, ok)
-	assert.Equal(t, r.Visibility, viaRef.Visibility, "the referent's readOnly binds the reference site")
-
-	decl, ok := doc.Types[namedID("DeclaredReadOnly")].(*ir.Scalar)
-	require.True(t, ok)
-	entry, ok := decl.Unmodeled["openapi:readOnly"]
-	require.True(t, ok, "the declaration's own readOnly is kept as residue")
-	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-	assert.JSONEq(t, `true`, string(entry.Value))
-
-	assertBothFlagsAreVisibleNowhere(t, m, diags)
-}
-
-// assertBothFlagsAreVisibleNowhere pins the contradictory pairing in both its
-// spellings: written on one schema, and written across a $ref that already
-// carries the other flag. Each admits no lifecycle at all and each is reported,
-// where declaring both used to lower exactly as readOnly alone did and say
-// nothing (GitHub #276).
-func assertBothFlagsAreVisibleNowhere(t *testing.T, m *ir.Model, diags []ir.Diagnostic) {
-	t.Helper()
-	for _, wire := range []string{"both", "bothViaRef"} {
-		p, ok := propByWire(m, wire)
-		require.True(t, ok)
-		assert.Equal(t, ir.Visibility{None: true}, p.Visibility,
-			"readOnly and writeOnly both in force admit no lifecycle: %s", wire)
-		assert.Equal(t, []ir.Severity{ir.SeverityWarning},
-			diagsAt(diags, diag.DisjointVisibility, "/components/schemas/S/properties/"+wire),
-			"the contradiction is reported once, at the position that wrote it: %s", wire)
-	}
-}
-
-func assertRecursive(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	n, ok := doc.Types[namedID("Node")].(*ir.Model)
-	require.True(t, ok)
-	next, ok := propByWire(n, "next")
-	require.True(t, ok)
-	assert.Equal(t, namedID("Node"), next.Type.Target, "self-reference terminates on the interned ID")
-}
-
-// assertMaps pins ir-design §4.6's line between the two map shapes: an object
-// whose one member fact is its catch-all is a MapT, carrying its value type and
-// entry bounds, and a catch-all beside anything else is a Model's
-// AdditionalProps. An explicit `true` types the catch-all as the top type in
-// either.
-func assertMaps(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	i64 := func(v int64) *int64 { return &v }
-	for name, want := range map[string]*ir.MapT{
-		"OpenMap":    {Value: ir.TypeRef{Target: "t/prim/integer"}},
-		"AnyMap":     {Value: ir.TypeRef{Target: "t/prim/any"}},
-		"BoundedMap": {Value: ir.TypeRef{Target: "t/prim/string"}, Constraints: &ir.Constraints{MinProps: i64(1), MaxProps: i64(10)}},
-	} {
-		mt, ok := doc.Types[namedID(name)].(*ir.MapT)
-		require.True(t, ok, "%s is a map and nothing else; got %T", name, doc.Types[namedID(name)])
-		assert.Nil(t, mt.Key, "%s has string keys", name)
-		assert.Equal(t, want.Value, mt.Value, name)
-		assert.Empty(t, cmp.Diff(want.Constraints, mt.Constraints), name)
-	}
-	pm, ok := doc.Types[namedID("PatternMap")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, pm.AdditionalProps)
-	require.Len(t, pm.AdditionalProps.Patterns, 1)
-	assert.Equal(t, "^x-", pm.AdditionalProps.Patterns[0].Pattern)
-	rec, ok := doc.Types[namedID("OpenRecord")].(*ir.Model)
-	require.True(t, ok)
-	require.NotNil(t, rec.AdditionalProps, "an explicit true is a catch-all, not an unwritten keyword")
-	assert.Equal(t, ir.TypeRef{Target: "t/prim/any"}, rec.AdditionalProps.Value)
-	cr, ok := doc.Types[namedID("ClosedRecord")].(*ir.Model)
-	require.True(t, ok)
-	assert.Equal(t, ir.AdditionalClosed, cr.Additional)
-	ca, ok := doc.Types[namedID("ClosedAfter")].(*ir.Model)
-	require.True(t, ok)
-	assert.Equal(t, ir.AdditionalClosedAfterComposition, ca.Additional)
-}
-
-// assertTuples pins what each prefixItems tuple admits past its elements and
-// the bounds beside them (GitHub #597). Only `items: false` closes a tuple, and
-// a typed rest is lowered into the type graph as a List's items is, at the same
-// pointer and under the same hint. All of it is modeled, so no tuple keeps
-// anything beside itself or reports a degradation.
-func assertTuples(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	t.Helper()
-	i64 := func(v int64) *int64 { return &v }
-	pair := []ir.TypeRef{{Target: "t/prim/string"}, {Target: "t/prim/integer"}}
-	restID := ir.TypeID("t/anon/components/schemas/PairWithRest/items")
-	for _, tc := range []struct {
-		name   string
-		elems  []ir.TypeRef
-		rest   ir.TypeID // "" = no element may follow
-		bounds *ir.Constraints
-	}{
-		{"ClosedPair", pair, "", nil},
-		{"Pair", pair, "t/prim/any", nil},
-		{"PairWithRest", pair[:1], restID, nil},
-		{"ExactPair", pair, "", &ir.Constraints{MinItems: i64(2)}},
-		{"BoundedClosedPair", pair, "", &ir.Constraints{MinItems: i64(1), MaxItems: i64(2), UniqueItems: true}},
-	} {
-		tup, ok := doc.Types[namedID(tc.name)].(*ir.Tuple)
-		require.True(t, ok, "%s: prefixItems hoists a Tuple; got %T", tc.name, doc.Types[namedID(tc.name)])
-		assert.Equal(t, tc.elems, tup.Elems, tc.name)
-		if tc.rest == "" {
-			assert.Nil(t, tup.Rest, "%s: no element may follow the head", tc.name)
-		} else if assert.NotNil(t, tup.Rest, tc.name) {
-			assert.Equal(t, tc.rest, tup.Rest.Target, tc.name)
-		}
-		assert.Equal(t, tc.bounds, tup.Constraints, tc.name)
-		assert.Empty(t, tup.Unmodeled, "%s: a modeled rest keeps nothing beside it", tc.name)
-		assert.Empty(t, diagsAt(diags, "openapi/degraded-construct", "/components/schemas/"+tc.name), tc.name)
-	}
-
-	rest, ok := doc.Types[restID].(*ir.Model)
-	require.True(t, ok, "the inline rest is hoisted at its own pointer; got %T", doc.Types[restID])
-	assert.Equal(t, "pair_with_rest_item", rest.Name.Hint, "named as a List's items would be")
-	_, ok = propByWire(rest, "flag")
-	assert.True(t, ok, "the rest's own properties reach the IR")
-}
-
-func assertLiteralConst(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	l, ok := doc.Types[namedID("Version")].(*ir.Literal)
-	require.True(t, ok, "const hoists a Literal")
-	assert.Equal(t, ir.ValueString, l.Value.Kind)
-	assert.Equal(t, "v1", l.Value.Str)
-
-	// An unrepresentable const still hoists a node, and a node that admits any
-	// value is the only honest one: a Literal here would have to invent a value.
-	_, ok = doc.Types[namedID("Opaque")].(*ir.Any)
-	assert.True(t, ok, "an unconvertible const hoists the top type; got %T", doc.Types[namedID("Opaque")])
-	assert.Equal(t, []ir.Severity{ir.SeverityWarning},
-		diagsAt(diags, "openapi/degraded-construct", "/components/schemas/Opaque"),
-		"degrading a declared value is a warning, not silent")
-}
-
-func assertTagsGrouping(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	require.Len(t, doc.Services, 1)
-	require.Len(t, doc.Services[0].Groups, 1)
-	assert.Equal(t, "pets", doc.Services[0].Groups[0].Name.Source)
-	require.Len(t, doc.TagDefs, 1)
-	assert.Equal(t, "pets", doc.TagDefs[0].Name)
-}
-
-// assertGroupIdentity pins what identifies a group: the rule that formed it and
-// the key that rule read, never its name. Two pairs among the seven render from
-// the same words — the declared tag "default" and the group untagged operations
-// fall into, the tag "webhooks" and the webhook group — and two tags differ only
-// by what RFC 6901 escapes. Each keeps an ID of its own. The IDs are written out
-// rather than derived, so the test cannot agree with a change to the derivation
-// (GitHub #673).
-func assertGroupIdentity(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	require.Len(t, doc.Services, 1)
-	got := map[ir.GroupID][]string{}
-	for _, g := range doc.Services[0].Groups {
-		require.NotContains(t, got, g.ID, "two groups share an ID")
-		for _, op := range g.Operations {
-			got[g.ID] = append(got[g.ID], op.Name.Source)
-		}
-	}
-	assert.Equal(t, map[ir.GroupID][]string{
-		"g/tags/default":  {"declared"},
-		"g/default":       {"untagged"},
-		"g/tags/webhooks": {"namedLikeWebhooks"},
-		"g/tags/ghost":    {"undeclared"},
-		"g/tags/a~1b":     {"slash"},
-		"g/tags/a~01b":    {"tilde"},
-		"g/webhooks":      {"onEvent"},
-	}, got)
-}
-
-// assertParamIdentity pins what identifies a parameter: the operation it is
-// mounted under, its name as one escaped token, and its location. Two
-// parameters named id in one operation get two IDs; a path-item parameter is one
-// parameter per operation it is copied into; a path item reached from two paths
-// roots each mount's parameters at that mount. The IDs are written out rather
-// than derived, so the test cannot agree with a change to the derivation, and
-// every binding must name its own parameter's ID.
-func assertParamIdentity(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	require.Len(t, doc.Services, 1)
-	got := map[ir.OpID][]ir.ParamID{}
-	svc := doc.Services[0]
-	for _, g := range svc.Groups {
-		for _, op := range g.Operations {
-			for _, p := range op.Params {
-				got[op.ID] = append(got[op.ID], p.ID)
-			}
-			require.Len(t, op.Bindings.HTTP, 1)
-			var bound []ir.ParamID
-			for _, pb := range op.Bindings.HTTP[0].ParamBindings {
-				bound = append(bound, pb.Param)
-			}
-			assert.ElementsMatch(t, got[op.ID], bound, "%s: each binding names its own parameter", op.ID)
-		}
-	}
-	assert.Equal(t, map[ir.OpID][]ir.ParamID{
-		"op/openapi/paths/~1items~1{id}/get": {
-			"param/openapi/paths/~1items~1{id}/get/parameters/id/query",
-			"param/openapi/paths/~1items~1{id}/get/parameters/a~1b/query",
-			"param/openapi/paths/~1items~1{id}/get/parameters/id/path",
-		},
-		"op/openapi/paths/~1items~1{id}/post": {
-			"param/openapi/paths/~1items~1{id}/post/parameters/id/path",
-		},
-		"op/openapi/paths/~1a/get": {"param/openapi/paths/~1a/get/parameters/limit/query"},
-		"op/openapi/paths/~1b/get": {"param/openapi/paths/~1b/get/parameters/limit/query"},
-	}, got)
-}
-
-// assertEnumMemberIdentity pins what identifies an enum member: the value it
-// holds, tagged by kind, under the enum that declares it. The list repeats a
-// value, includes names that spell one canonical word sequence, and carries the
-// characters a pointer token escapes, so a derivation from the name, the
-// position or the unescaped value changes an ID. The IDs are written out, not
-// derived. The repeat is kept, its ID ends in its occurrence number, and it is
-// reported once at its own entry; the string spelling that ID's tail is no
-// repeat.
-func assertEnumMemberIdentity(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	memberIDs := func(id ir.TypeID) []ir.EnumMemberID {
-		enum, ok := doc.Types[id].(*ir.Enum)
-		require.True(t, ok, "%s is an enum", id)
-		got := make([]ir.EnumMemberID, 0, len(enum.Members))
-		for _, m := range enum.Members {
-			got = append(got, m.ID)
-		}
-		return got
-	}
-	assert.Equal(t, []ir.EnumMemberID{
-		"e/openapi/components/schemas/E/s:a-b",
-		"e/openapi/components/schemas/E/s:a_b",
-		"e/openapi/components/schemas/E/s:A B",
-		"e/openapi/components/schemas/E/s:a~0b",
-		"e/openapi/components/schemas/E/s:a-b/2",
-		"e/openapi/components/schemas/E/s:a-b~12",
-	}, memberIDs("t/openapi/components/schemas/E"))
-	assert.Equal(t, []ir.EnumMemberID{
-		"e/openapi/components/schemas/N/n:-1e0",
-		"e/openapi/components/schemas/N/n:1e0",
-		"e/openapi/components/schemas/N/n:0",
-	}, memberIDs("t/openapi/components/schemas/N"))
-	assert.Equal(t, []ir.EnumMemberID{
-		"e/anon/paths/~1status/get/responses/200/content/application~1json/schema/s:open",
-		"e/anon/paths/~1status/get/responses/200/content/application~1json/schema/s:closed",
-	}, memberIDs("t/anon/paths/~1status/get/responses/200/content/application~1json/schema"))
-
-	var repeats []string
-	for _, d := range diags {
-		if d.Code == "openapi/duplicate-enum-value" {
-			repeats = append(repeats, string(d.Provenance.Pointer))
-		}
-	}
-	assert.Equal(t, []string{"/components/schemas/E/enum/4"}, repeats)
-}
-
-func assertHTTPBinding(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "getItem")
-	require.True(t, ok)
-	require.Len(t, op.Bindings.HTTP, 1)
-	hb := op.Bindings.HTTP[0]
-	assert.Equal(t, "GET", hb.Method)
-	assert.Equal(t, "/items/{id}", hb.URITemplate)
-}
-
-func assertParamStyles(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "search")
-	require.True(t, ok)
-	require.Len(t, op.Bindings.HTTP, 1)
-	byParam := map[string]ir.HTTPParamBinding{}
-	for _, pb := range op.Bindings.HTTP[0].ParamBindings {
-		byParam[pb.WireName] = pb
-	}
-	q := byParam["q"]
-	assert.Equal(t, "form", q.Style, "query default style is form")
-	require.NotNil(t, q.Explode)
-	assert.True(t, *q.Explode, "form default explodes")
-	assert.Equal(t, "deepObject", byParam["filter"].Style)
-	assert.Equal(t, "application/json", byParam["payload"].ContentType, "content-style param records its media type")
-	assert.True(t, byParam["path"].AllowReserved,
-		"reserved characters passing through unescaped is a wire fact, not a style")
-	assert.False(t, q.AllowReserved, "and the default is to escape them")
-
-	// "path" is a query parameter in this 3.1 document, the one location the
-	// keyword belongs to before 3.2 — so a declaration of it, which the
-	// assertion above pins, is not the off-query case the warning reports.
-	assert.Zero(t, openapitest.CountDiagsAt(diags, diag.InapplicableLocationKeyword, ir.SeverityWarning),
-		"a 3.1 query declaration of allowReserved stays silent")
-
-	assertAllowEmptyValueKept(t, op)
-
-	// The path item's shared parameter merges into both of its operations and
-	// interns its schema once, at the path item's own pointer (issue #36).
-	clearSearch, ok := opByName(doc, "clearSearch")
-	require.True(t, ok, "the path item's second operation is registered")
-	searchReqID, ok := paramByName(op, "requestId")
-	require.True(t, ok, "search inherits the path-item-level parameter")
-	clearReqID, ok := paramByName(clearSearch, "requestId")
-	require.True(t, ok, "clearSearch inherits the same path-item-level parameter")
-	assert.Equal(t, searchReqID.Type.Target, clearReqID.Type.Target,
-		"both operations resolve the shared path-item parameter to the same interned schema")
-	assert.Equal(t, ir.TypeID("t/anon/paths/~1search/parameters/0/schema"), searchReqID.Type.Target,
-		"the shared schema is hoisted at the path item's own pointer, not a per-operation one")
-}
-
-// assertAllowEmptyValueKept covers the one serialization flag ir.HTTPParamBinding
-// has no field for. Style, explode, allowReserved and the content-style media
-// type all land on the binding above; allowEmptyValue used to be read nowhere at
-// all, so a document declaring it produced IR indistinguishable from one that
-// did not (GitHub #39). It is kept on the logical Parameter, which is the
-// carrier at this position with an Unmodeled map.
-func assertAllowEmptyValueKept(t *testing.T, op ir.Operation) {
-	t.Helper()
-	bare, ok := paramByName(op, "bare")
-	require.True(t, ok, "the allowEmptyValue parameter still lowers")
-	entry, ok := bare.Unmodeled["openapi:allowEmptyValue"]
-	require.True(t, ok, "and its declared flag is kept beside it")
-	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-	assert.JSONEq(t, `true`, string(entry.Value))
-}
-
-// paramSlot is what OpenAPI identifies a parameter by: its name and location.
-// Two parameters may legally share a name at different locations, so a map
-// keyed on the name alone silently keeps one of such a pair and compares the
-// other against nothing.
-type paramSlot struct {
-	Name     string
-	Location ir.HTTPLocation
-}
-
-// paramWire is what a parameter's location-dependent serialization resolves to:
-// the style it serializes with, and whether it explodes. The two travel together
-// because OpenAPI settles them together — the location picks the style when none
-// is written, and the style picks explode.
-type paramWire struct {
-	Style   string
-	Explode bool
-}
-
-// paramStylePair is one legal (in, style) combination of the Parameter object.
-type paramStylePair struct {
-	location ir.HTTPLocation
-	style    string
-}
-
-// param names the fixture parameter declaring this pair with one explode
-// spelling: "<location><Style>" and the suffix.
-//
-// It is total rather than slicing p.style directly: the table's own comment
-// points out that querystring takes no style, which is an invitation to add a
-// styleless pair, and a panic inside a name builder says nothing about which
-// pair caused it. TestParamStyleTable_MatchesTheSpecification is what rejects
-// one, with the pair named.
-func (p paramStylePair) param(suffix string) string {
-	return string(p.location) + upperFirst(p.style) + suffix
-}
-
-// upperFirst capitalizes the first letter of an ASCII style name.
-func upperFirst(s string) string {
-	if s == "" {
-		return s
-	}
-	return strings.ToUpper(s[:1]) + s[1:]
-}
-
-// paramStyleLegalPairs is OpenAPI's (in, style) table, read off the
-// specification rather than off the fixture: path takes simple|label|matrix,
-// query form|spaceDelimited|pipeDelimited|deepObject, header simple, cookie
-// form|cookie. querystring is a fifth location that takes no style at all, so
-// it has no pair here and assertQuerystringParam covers it instead.
-func paramStyleLegalPairs() []paramStylePair {
-	return []paramStylePair{
-		{ir.HTTPLocationPath, "simple"},
-		{ir.HTTPLocationPath, "label"},
-		{ir.HTTPLocationPath, "matrix"},
-		{ir.HTTPLocationQuery, "form"},
-		{ir.HTTPLocationQuery, "spaceDelimited"},
-		{ir.HTTPLocationQuery, "pipeDelimited"},
-		{ir.HTTPLocationQuery, "deepObject"},
-		{ir.HTTPLocationHeader, "simple"},
-		{ir.HTTPLocationCookie, "form"},
-		{ir.HTTPLocationCookie, "cookie"},
-	}
-}
-
-// paramStyleDefaultStyles is the other half of the same table: the style each
-// location falls back to when a parameter omits `style` entirely.
-func paramStyleDefaultStyles() []paramStylePair {
-	return []paramStylePair{
-		{ir.HTTPLocationPath, "simple"},
-		{ir.HTTPLocationQuery, "form"},
-		{ir.HTTPLocationHeader, "simple"},
-		{ir.HTTPLocationCookie, "form"},
-	}
-}
-
-// paramStyleExplodeDefault is what `explode` means when omitted: true under
-// form and under 3.2's cookie style, false under every other style a location
-// pairs with.
-func paramStyleExplodeDefault(style string) bool {
-	return style == "form" || style == "cookie"
-}
-
-// paramStyleMatrixWant generates what param-style-matrix.yaml must resolve to
-// from the two tables above, rather than restating it beside them. A literal
-// expectation and the fixture are two copies of one claim, so deleting a row
-// from both leaves nothing to disagree, and counts over a deduplicated set can
-// still pass a shrunk fixture when another parameter resolves the same way.
-// Generating moves the question up: the table and the fixture can still shrink
-// together. TestParamStyleTable_MatchesTheSpecification holds the table to a
-// count that is OpenAPI's rather than this package's.
-func paramStyleMatrixWant() map[paramSlot]paramWire {
-	want := map[paramSlot]paramWire{}
-	for _, p := range paramStyleLegalPairs() {
-		for _, e := range []struct {
-			suffix  string
-			explode bool
-		}{
-			{"Explode", true},
-			{"NoExplode", false},
-			{"DefaultExplode", paramStyleExplodeDefault(p.style)},
-		} {
-			want[paramSlot{p.param(e.suffix), p.location}] = paramWire{p.style, e.explode}
-		}
-	}
-	for _, d := range paramStyleDefaultStyles() {
-		want[paramSlot{string(d.location) + "Defaulted", d.location}] =
-			paramWire{d.style, paramStyleExplodeDefault(d.style)}
-	}
-	return want
-}
-
-// TestParamStyleTable_MatchesTheSpecification anchors the (in, style) table to
-// OpenAPI's own, which a generated expectation cannot do for itself. Deleting a
-// pair and the parameters it generated, then regenerating the golden, leaves
-// every check agreeing with the smaller world; only the specification is outside
-// that loop. 3.2 tabulates the legal combinations and says "Combinations not
-// represented in this table are not permitted", so this count is OpenAPI's and
-// changing it is a claim about the format.
-//
-// It also holds the two halves of the table to each other: a location's default
-// style must be a style that location legally takes.
-func TestParamStyleTable_MatchesTheSpecification(t *testing.T) {
-	t.Parallel()
-	pairs := paramStyleLegalPairs()
-	require.Len(t, pairs, 10,
-		"3.2 permits ten (in, style) pairs; a different number here is a claim about OpenAPI, not about the fixture")
-
-	legal := make(map[paramStylePair]bool, len(pairs))
-	for _, p := range pairs {
-		assert.NotEmpty(t, p.style,
-			"%s: a pair names a style, and a location that takes none belongs in neither table", p.location)
-		assert.NotContains(t, legal, p, "the (%s, %s) pair is listed twice", p.location, p.style)
-		legal[p] = true
-	}
-
-	defaults := paramStyleDefaultStyles()
-	require.Len(t, defaults, 4, "each location that takes a style at all defaults exactly one")
-	locations := make(map[ir.HTTPLocation]bool, len(defaults))
-	for _, d := range defaults {
-		assert.NotContains(t, locations, d.location, "%s is given two default styles", d.location)
-		locations[d.location] = true
-		assert.Contains(t, legal, d,
-			"%s defaults to style %q, which is not a pair the table says that location takes",
-			d.location, d.style)
-	}
-}
-
-// assertParamStyleMatrix pins the whole of OpenAPI's location-dependent
-// serialization table at once, against a generated expectation rather than a
-// spot check per location.
-//
-// The table used to be readable for a whole location without any golden
-// noticing: deleting cookie from the arm that defaults it to form left the
-// entire suite green, because no committed spec declared a cookie parameter.
-// Comparing the resolved (style, explode) of every parameter closes that by
-// construction — a location that loses its arm changes rows here.
-func assertParamStyleMatrix(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "styleMatrix")
-	require.True(t, ok)
-	require.Len(t, op.Bindings.HTTP, 1)
-
-	got := make(map[paramSlot]paramWire, len(op.Bindings.HTTP[0].ParamBindings))
-	for _, pb := range op.Bindings.HTTP[0].ParamBindings {
-		require.NotNil(t, pb.Explode, "%s: explode resolves to a value, never to nothing", pb.WireName)
-		slot := paramSlot{Name: pb.WireName, Location: pb.Location}
-		require.NotContains(t, got, slot, "two parameter bindings share the slot %+v", slot)
-		got[slot] = paramWire{Style: pb.Style, Explode: *pb.Explode}
-	}
-	if diff := cmp.Diff(paramStyleMatrixWant(), got); diff != "" {
-		t.Errorf("resolved parameter serialization (-want +got):\n%s", diff)
-	}
-
-	assertQuerystringParam(t, doc)
-}
-
-// assertQuerystringParam covers the 3.2 location that binds the whole query
-// string. It may declare neither style nor schema, so the media type its
-// one-entry content map names is the whole of its stated serialization.
-//
-// It has an operation to itself because 3.2 forbids a querystring parameter from
-// sharing one, or its path item, with any `in: query` parameter; the test
-// asserts the operation binds exactly one.
-//
-// It carries neither style nor explode: 3.2 gives the location no style, and
-// explode qualifies a style there is none of (GitHub #334). Both are pinned so a
-// stamped form/true default cannot return.
-func assertQuerystringParam(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	op, ok := opByName(doc, "querystringOnly")
-	require.True(t, ok, "the querystring parameter's own operation is registered")
-	require.Len(t, op.Bindings.HTTP, 1)
-	require.Len(t, op.Bindings.HTTP[0].ParamBindings, 1,
-		"the querystring location shares its operation with no other parameter")
-
-	binding := op.Bindings.HTTP[0].ParamBindings[0]
-	require.Equal(t, ir.HTTPLocationQuerystring, binding.Location)
-	require.Equal(t, "querystringWhole", binding.WireName, "the querystring parameter binds")
-	assert.Equal(t, "application/x-www-form-urlencoded", binding.ContentType,
-		"its media type is where its serialization is actually stated")
-	assert.Empty(t, binding.Style, "style is not a legal keyword at in: querystring")
-	assert.Nil(t, binding.Explode, "and explode qualifies a style there is none of")
-}
-
-// assertParamQuerystring pins the 3.2 querystring location, where the whole
-// query string binds from the parameter's content: the binding carries that
-// media type and neither style nor explode, which the location forbids (GitHub
-// #334).
-//
-// The third operation holds what param-style-matrix does not: only the default
-// is suppressed, so a declared explode survives at a location that takes no
-// style. param-style-matrix declares neither keyword there, so reverting the
-// early return that dropped a declared explode leaves it green. This case also
-// pins the one diag.InvalidLocationKeyword this fixture raises; see that code's
-// GoDoc for why it is a warning.
-func assertParamQuerystring(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	report, ok := opByName(doc, "runReport")
-	require.True(t, ok)
-	require.Len(t, report.Bindings.HTTP, 1)
-	require.Len(t, report.Bindings.HTTP[0].ParamBindings, 1)
-	qs := report.Bindings.HTTP[0].ParamBindings[0]
-	assert.Equal(t, ir.HTTPLocationQuerystring, qs.Location)
-	assert.Equal(t, "application/x-www-form-urlencoded", qs.ContentType,
-		"the media type is the whole of a querystring binding's declared serialization")
-	assert.Empty(t, qs.Style, "style is not a legal keyword at in: querystring")
-	assert.Nil(t, qs.Explode, "and explode qualifies a style there is none of")
-
-	summary, ok := opByName(doc, "summarize")
-	require.True(t, ok)
-	require.Len(t, summary.Bindings.HTTP, 1)
-	require.Len(t, summary.Bindings.HTTP[0].ParamBindings, 1)
-	q := summary.Bindings.HTTP[0].ParamBindings[0]
-	assert.Equal(t, ir.HTTPLocationQuery, q.Location)
-	assert.Equal(t, "form", q.Style, "a query parameter still takes its own location's default")
-	require.NotNil(t, q.Explode)
-	assert.True(t, *q.Explode)
-
-	raw, ok := opByName(doc, "rawReport")
-	require.True(t, ok)
-	require.Len(t, raw.Bindings.HTTP, 1)
-	require.Len(t, raw.Bindings.HTTP[0].ParamBindings, 1)
-	declared := raw.Bindings.HTTP[0].ParamBindings[0]
-	assert.Equal(t, ir.HTTPLocationQuerystring, declared.Location)
-	assert.Empty(t, declared.Style, "no style is invented beside a declared explode either")
-	require.NotNil(t, declared.Explode, "but the explode the document declares is not dropped")
-	assert.False(t, *declared.Explode)
-
-	assert.Equal(t,
-		"parameter field explode is not allowed for in=querystring; lowered as declared",
-		openapitest.DiagMessageAt(t, diags, diag.InvalidLocationKeyword, ir.SeverityWarning,
-			"/paths/~1reports~1raw/get/parameters/0/explode"))
-}
-
-// assertQuerystringForbiddenKeywords pins the construct assertParamQuerystring's
-// rawReport operation cannot see on its own: explode and allowReserved reported
-// at their own pointers rather than only one of the two. See
-// diag.InvalidLocationKeyword's GoDoc for why the parser catches neither and why
-// this compiler's report is a warning. Both values still lower as declared:
-// dropping content the document states is an emitter's call, not a compiler's.
-func assertQuerystringForbiddenKeywords(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	explodeOp, ok := opByName(doc, "explodeOnly")
-	require.True(t, ok)
-	require.Len(t, explodeOp.Bindings.HTTP, 1)
-	require.Len(t, explodeOp.Bindings.HTTP[0].ParamBindings, 1)
-	explodeBinding := explodeOp.Bindings.HTTP[0].ParamBindings[0]
-	assert.Equal(t, ir.HTTPLocationQuerystring, explodeBinding.Location)
-	require.NotNil(t, explodeBinding.Explode, "the declared explode is not dropped")
-	assert.False(t, *explodeBinding.Explode)
-	assert.Equal(t,
-		"parameter field explode is not allowed for in=querystring; lowered as declared",
-		openapitest.DiagMessageAt(t, diags, diag.InvalidLocationKeyword, ir.SeverityWarning,
-			"/paths/~1a/get/parameters/0/explode"))
-
-	reservedOp, ok := opByName(doc, "reservedOnly")
-	require.True(t, ok)
-	require.Len(t, reservedOp.Bindings.HTTP, 1)
-	require.Len(t, reservedOp.Bindings.HTTP[0].ParamBindings, 1)
-	reservedBinding := reservedOp.Bindings.HTTP[0].ParamBindings[0]
-	assert.Equal(t, ir.HTTPLocationQuerystring, reservedBinding.Location)
-	assert.True(t, reservedBinding.AllowReserved, "the declared allowReserved is not dropped")
-	assert.Equal(t,
-		"parameter field allowReserved is not allowed for in=querystring; lowered as declared",
-		openapitest.DiagMessageAt(t, diags, diag.InvalidLocationKeyword, ir.SeverityWarning,
-			"/paths/~1b/get/parameters/0/allowReserved"))
-}
-
-// assertParamAllowReservedLocations pins diag.InapplicableLocationKeyword
-// through the whole compile: OpenAPI 3.1 applies allowReserved to in: query
-// alone, so a path, header or cookie declaration is reported at the keyword's
-// own pointer, a declared false among them, while a query declaration stays
-// silent. Every declared value still lowers as declared.
-func assertParamAllowReservedLocations(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "report")
-	require.True(t, ok)
-	require.Len(t, op.Bindings.HTTP, 1)
-	byParam := map[string]ir.HTTPParamBinding{}
-	for _, pb := range op.Bindings.HTTP[0].ParamBindings {
-		byParam[pb.WireName] = pb
-	}
-	require.Len(t, byParam, 4, "every declared parameter binds exactly once")
-
-	assert.True(t, byParam["id"].AllowReserved, "a path declaration still lowers as declared")
-	assert.True(t, byParam["X-Trace"].AllowReserved, "a header declaration still lowers as declared")
-	assert.False(t, byParam["session"].AllowReserved, "a declared false is kept as false")
-	assert.True(t, byParam["q"].AllowReserved, "a query declaration lowers as declared")
-
-	const rule = " in OpenAPI 3.1, which applies it to in=query alone; lowered as declared"
-	want := map[string]string{
-		"/paths/~1reports~1{id}/get/parameters/0/allowReserved": "parameter field allowReserved has no effect for in=path" + rule,
-		"/paths/~1reports~1{id}/get/parameters/1/allowReserved": "parameter field allowReserved has no effect for in=header" + rule,
-		"/paths/~1reports~1{id}/get/parameters/2/allowReserved": "parameter field allowReserved has no effect for in=cookie" + rule,
-	}
-	got := map[string]string{}
-	for _, d := range diags {
-		if d.Code == diag.InapplicableLocationKeyword {
-			assert.Equal(t, ir.SeverityWarning, d.Severity)
-			assert.NotContains(t, got, string(d.Provenance.Pointer), "one declaration, one report")
-			got[string(d.Provenance.Pointer)] = d.Message
-		}
-	}
-	assert.Equal(t, want, got)
-}
-
-// assertParamRefInheritance pins the rule
-// docs/compilers/openapi.md#ref-use-site at a parameter whose schema is a $ref:
-// docs, deprecation and default come from the referent when the use site is
-// silent, and from the use site when it is not. Constraints inherit at neither
-// carrier, so the identical property is asserted beside it (GitHub #131). The
-// bound the use site declares beside the $ref is asserted at both carriers
-// against the referent's own: use-site precedence would publish 100 as the
-// whole truth while the document enforces 64 (§12.2, GitHub #428).
-func assertParamRefInheritance(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "listItems")
-	require.True(t, ok)
-	cursor, ok := paramByName(op, "cursor")
-	require.True(t, ok)
-	assert.Equal(t, ir.Docs{Summary: "Cursor", Description: "Opaque pagination cursor."}, cursor.Docs)
-	assert.NotNil(t, cursor.Deprecation)
-	require.NotNil(t, cursor.Default)
-	assert.Equal(t, "0", cursor.Default.Str)
-	assert.Nil(t, cursor.Constraints, "the referent's bound stays on the referent")
-
-	override, ok := paramByName(op, "override")
-	require.True(t, ok)
-	assert.Equal(t, "Cursor for this endpoint only.", override.Docs.Description,
-		"a description beside the $ref wins over the referent's")
-	assert.Equal(t, "Cursor", override.Docs.Summary,
-		"...and a keyword the use site is silent about still inherits")
-	require.NotNil(t, override.Default)
-	assert.Equal(t, "9", override.Default.Str)
-	require.NotNil(t, override.Constraints, "a bound beside the $ref lands on the carrier")
-	require.NotNil(t, override.Constraints.MaxLength)
-	assert.Equal(t, int64(100), *override.Constraints.MaxLength,
-		"and it is the use site's own, not narrowed against the referent's here")
-
-	holder, ok := doc.Types[namedID("Holder")].(*ir.Model)
-	require.True(t, ok)
-	prop, ok := propByWire(holder, "cursor")
-	require.True(t, ok)
-	assert.Equal(t, cursor.Docs, prop.Docs, "the property inherits exactly what the parameter does")
-	assert.NotNil(t, prop.Deprecation)
-	require.NotNil(t, prop.Default)
-	assert.Equal(t, *cursor.Default, *prop.Default)
-	assert.Nil(t, prop.Constraints, "neither carrier inherits the referent's constraints")
-
-	overrideProp, ok := propByWire(holder, "override")
-	require.True(t, ok)
-	assert.Equal(t, override.Constraints, overrideProp.Constraints,
-		"and a property keeps its own bound exactly as the parameter does")
-
-	decl, ok := doc.Types[namedID("Cursor")].(*ir.Scalar)
-	require.True(t, ok)
-	require.NotNil(t, decl.Constraints)
-	require.NotNil(t, decl.Constraints.MaxLength)
-	assert.Equal(t, int64(64), *decl.Constraints.MaxLength,
-		"a consumer that wants the bound reads it off the referent, and conjoins "+
-			"it with the use site's: both are in force, and 64 is the narrower")
-}
-
-// assertHeaderContentSchema pins that both spellings of a header's type lower
-// alike. The content spelling used to reach lowerHeader with no schema at all —
-// the header became t/prim/any and its constraints and xml hints went with it,
-// without a diagnostic (GitHub #139).
-//
-// The two headers declare the same type deliberately: comparing them against
-// each other, rather than against a written-out expectation, is what makes the
-// assertion about the spellings agreeing rather than about one of them.
-func assertHeaderContentSchema(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "getReport")
-	require.True(t, ok)
-	require.Len(t, op.Responses, 1)
-	headers := op.Responses[0].Headers
-	require.Len(t, headers, 4)
-
-	bySchema, ok := headerByWire(headers, "X-Report-Schema")
-	require.True(t, ok)
-	byContent, ok := headerByWire(headers, "X-Report-Content")
-	require.True(t, ok)
-
-	assert.Equal(t, bySchema.Type, byContent.Type,
-		"a content-style header resolves the same type as the schema spelling")
-	assert.NotEqual(t, ir.TypeID("t/prim/any"), byContent.Type.Target,
-		"the type is resolved rather than degraded to the top type")
-	assert.Equal(t, bySchema.Constraints, byContent.Constraints,
-		"the constraints written under content are not dropped with the schema")
-	require.NotNil(t, byContent.XML)
-	assert.Equal(t, "ReportContent", byContent.XML.Name,
-		"the xml hints written under content reach the header")
-
-	require.NotNil(t, byContent.Encoding)
-	assert.Equal(t, "application/xml", byContent.Encoding.MediaType,
-		"the media type serializing the header's value is kept, which the schema spelling has none of")
-	assert.Nil(t, bySchema.Encoding, "the schema spelling names no media type")
-
-	byRef, ok := headerByWire(headers, "X-Report-Ref")
-	require.True(t, ok)
-	assert.Equal(t, namedID("ReportID"), byRef.Type.Target,
-		"a $ref under content resolves to the named component, not to an anonymous copy")
-
-	assertHeaderStyleAndExplodeKept(t, headers)
-	assertNoErrorDiags(t, diags)
-}
-
-// assertHeaderStyleAndExplodeKept covers the header keywords ir.Property has no
-// field for. A header's explode decides whether a collection value is written as
-// one repeated field or one joined value, so dropping it left the IR unable to
-// say how the header goes on the wire — and it was dropped without a word
-// (GitHub #39). Kept verbatim, since the IR can close the gap by adding fields.
-func assertHeaderStyleAndExplodeKept(t *testing.T, headers []ir.Property) {
-	t.Helper()
-	list, ok := headerByWire(headers, "X-Report-List")
-	require.True(t, ok)
-
-	for key, want := range map[string]string{
-		"openapi:style":   `"simple"`,
-		"openapi:explode": `true`,
-	} {
-		entry, found := list.Unmodeled[key]
-		require.True(t, found, "%s is kept", key)
-		assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-		assert.JSONEq(t, want, string(entry.Value))
-	}
-
-	plain, ok := headerByWire(headers, "X-Report-Schema")
-	require.True(t, ok)
-	assert.NotContains(t, plain.Unmodeled, "openapi:explode",
-		"a header that declares neither keyword records neither")
-}
-
-func assertMultiContent(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "getData")
-	require.True(t, ok)
-	require.Len(t, op.Responses, 1)
-	require.NotNil(t, op.Responses[0].Payload)
-	require.Len(t, op.Responses[0].Payload.Contents, 2, "both media types kept, no primary selection")
-	assert.Equal(t, "application/json", op.Responses[0].Payload.Contents[0].MediaType)
-	assert.Equal(t, "application/xml", op.Responses[0].Payload.Contents[1].MediaType)
-}
-
-func assertMultipartEncoding(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "upload")
-	require.True(t, ok)
-	require.NotNil(t, op.Request)
-	require.Len(t, op.Request.Contents, 1)
-	enc := op.Request.Contents[0].Encoding
-	require.NotEmpty(t, enc, "multipart parts carry PartEncoding keyed by PropID")
-	var sawFile, sawMulti bool
-	var fileHeaders []ir.Property
-	for _, pe := range enc {
-		if pe.Filename {
-			sawFile = true
-			fileHeaders = pe.Headers
-		}
-		if pe.Multi {
-			sawMulti = true
-		}
-	}
-	assert.True(t, sawFile, "binary file part carries Filename")
-	assert.True(t, sawMulti, "array part carries Multi")
-	assertPartHeaders(t, doc, fileHeaders)
-	assertFormPartStyle(t, doc)
-	assertComposedPartEncoding(t, doc)
-}
-
-// assertComposedPartEncoding pins the body that composes its parts rather than
-// declaring them. Reading only the schema node's own properties found none on an
-// allOf wrapper, so the whole encoding block was discarded with no diagnostic and
-// a Content that still looked well-formed, just smaller (GitHub #140).
-//
-// The keys are asserted to be the properties the IR actually holds: §4.3 keeps a
-// composed model's inherited parts on its Base, so a key derived from the
-// composed node's own pointer would name a property that exists nowhere.
-func assertComposedPartEncoding(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	op, ok := opByName(doc, "uploadComposed")
-	require.True(t, ok)
-	require.NotNil(t, op.Request)
-	require.Len(t, op.Request.Contents, 1)
-
-	enc := op.Request.Contents[0].Encoding
-	require.NotEmpty(t, enc, "a composed body keeps the encoding a declared one does")
-
-	inherited := ir.PropID("p/openapi/components/schemas/UploadForm/properties/file")
-	file, ok := enc[inherited]
-	require.True(t, ok, "the inherited part is keyed on the Base that holds it; got keys %v", enc)
-	assert.Equal(t, []string{"image/png"}, file.ContentTypes)
-	assert.True(t, file.Filename, "the structural flag is read off the merged type of the inherited part")
-
-	// Every key must name a property some type in the document declares. A part
-	// keyed by a PropID nothing holds is the failure this lowering can produce
-	// while still looking well-formed.
-	for id := range enc {
-		assert.True(t, propIDExists(doc, id), "encoding key %s names no property in the document", id)
-	}
-}
-
-// propIDExists reports whether any type in doc declares a property with the
-// given ID.
-func propIDExists(doc *ir.Document, id ir.PropID) bool {
-	for _, td := range doc.Types {
-		m, ok := td.(*ir.Model)
-		if !ok {
-			continue
-		}
-		if slices.ContainsFunc(m.Properties, func(p ir.Property) bool { return p.ID == id }) {
-			return true
-		}
-	}
-	return false
-}
-
-// assertFormPartStyle pins the form-serialization half of a part's encoding: a
-// urlencoded body's parts carry the same style/explode pair a query parameter
-// does, on the part rather than on any binding.
-func assertFormPartStyle(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	op, ok := opByName(doc, "submitForm")
-	require.True(t, ok)
-	require.NotNil(t, op.Request)
-	require.Len(t, op.Request.Contents, 1)
-	assert.Equal(t, "application/x-www-form-urlencoded", op.Request.Contents[0].MediaType)
-	enc := op.Request.Contents[0].Encoding
-	require.Len(t, enc, 1)
-	for _, pe := range enc {
-		assert.Equal(t, "form", pe.Style)
-		require.NotNil(t, pe.Explode)
-		assert.True(t, *pe.Explode)
-		assert.True(t, pe.Multi, "the structural flag is read off the part")
-	}
-	// allowReserved has no PartEncoding field, and PartEncoding has no Unmodeled
-	// map, so it is kept on the content keyed by the part it governs. Two
-	// documents differing only in it used to compile to one IR (GitHub #291).
-	entry := unmodeledEntry(t, op.Request.Contents[0].Unmodeled, "openapi:encoding/ids/allowReserved")
-	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-	assert.JSONEq(t, "true", string(entry.Value))
-}
-
-// assertFileBody pins a binary body: the payload's type degrades to bytes and the
-// media types it is carried as move onto Content.File, which is what tells an
-// emitter to generate a stream rather than a model. Both routes to that lowering
-// are covered — a media type with no schema at all, and a string+binary schema.
-func assertFileBody(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "putBlob")
-	require.True(t, ok)
-	require.NotNil(t, op.Request)
-	require.Len(t, op.Request.Contents, 1)
-	req := op.Request.Contents[0]
-	require.NotNil(t, req.File, "application/octet-stream with no schema is a file body")
-	assert.Equal(t, []string{"application/octet-stream"}, req.File.ContentTypes)
-	assert.Equal(t, ir.TypeID("t/prim/bytes"), req.Type.Target)
-
-	resp := firstContent(t, op)
-	require.NotNil(t, resp.File, "a string+binary schema is a file body whatever the media type")
-	assert.Equal(t, []string{"image/png"}, resp.File.ContentTypes)
-	assert.Equal(t, ir.TypeID("t/prim/bytes"), resp.Type.Target)
-}
-
-// assertMediaTypeSpelling pins that a media type is classified by its type alone
-// while the IR keeps the key as written. One content per classification: a
-// multipart body, a form-urlencoded body and a file body with no schema, the
-// last on both sides of an operation.
-func assertMediaTypeSpelling(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	upload, ok := opByName(doc, "upload")
-	require.True(t, ok)
-	multipart := requestContent(t, upload)
-	assert.Equal(t, "Multipart/Form-Data", multipart.MediaType)
-	require.Len(t, multipart.Encoding, 1, "a mixed-case multipart key keeps its part encoding")
-	for _, pe := range multipart.Encoding {
-		assert.Equal(t, []string{"image/png"}, pe.ContentTypes)
-		assert.True(t, pe.Filename)
-	}
-
-	submit, ok := opByName(doc, "submit")
-	require.True(t, ok)
-	form := requestContent(t, submit)
-	assert.Equal(t, "Application/X-WWW-Form-Urlencoded; charset=utf-8", form.MediaType)
-	require.Len(t, form.Encoding, 1, "a parameterized form-urlencoded key keeps its part encoding")
-	for _, pe := range form.Encoding {
-		assert.True(t, pe.Multi)
-	}
-
-	blob, ok := opByName(doc, "putBlob")
-	require.True(t, ok)
-	req := requestContent(t, blob)
-	require.NotNil(t, req.File, "a mixed-case octet-stream key with no schema is a file body")
-	assert.Equal(t, []string{"Application/Octet-Stream"}, req.File.ContentTypes)
-	assert.Equal(t, ir.TypeID("t/prim/bytes"), req.Type.Target)
-
-	resp := firstContent(t, blob)
-	require.NotNil(t, resp.File, "a parameterized octet-stream key with no schema is a file body")
-	assert.Equal(t, []string{"application/octet-stream; type=tar"}, resp.File.ContentTypes)
-	assert.Equal(t, ir.TypeID("t/prim/bytes"), resp.Type.Target)
-}
-
-// assertPartHeaders pins encoding.<part>.headers, a TypeRef position reachable
-// only through a PartEncoding and, before this case, exercised by no corpus
-// spec. It covers both hops a header takes — an inline schema and one behind a
-// $ref through components/headers — and requires each target to be in the
-// registry, which is what gives the referential-closure walker something to
-// check here.
-func assertPartHeaders(t *testing.T, doc *ir.Document, headers []ir.Property) {
-	t.Helper()
-	require.Len(t, headers, 2, "the file part declares two per-part headers")
-	byWire := make(map[string]ir.Property, len(headers))
-	for _, h := range headers {
-		byWire[h.WireName] = h
-	}
-
-	id, ok := byWire["X-Part-Id"]
-	require.True(t, ok, "inline part header lowered; got %v", byWire)
-	assert.Equal(t, ir.TypeID("t/prim/uuid"), id.Type.Target)
-	assert.True(t, id.Required, "a required part header keeps its presence bit")
-	assert.Equal(t, "per-part correlation id", id.Docs.Description)
-
-	sum, ok := byWire["X-Part-Checksum"]
-	require.True(t, ok, "$ref'd part header lowered; got %v", byWire)
-	assert.Equal(t, namedID("Digest"), sum.Type.Target, "a $ref'd header takes the referent's schema")
-	assert.Equal(t, "sha-256 digest of this part", sum.Docs.Description)
-	for _, h := range headers {
-		assert.Contains(t, doc.Types, h.Type.Target, "part header %q must reference a live node", h.WireName)
-	}
-}
-
-// assertSequentialMedia pins the 3.2 sequential-media lowering, including the
-// two forms per-item encoding takes: one Encoding governing every item lands in
-// Content.ItemEncoding, while a positional prefixEncoding — which a single
-// every-item encoding has no ordinals for — takes itself and the tail encoding
-// beside it into Unmodeled instead.
-//
-// It also pins what itemSchema says about the operation, which for a long while
-// was nothing: the keyword states that the body is a sequence of items, so the
-// operation streams, and it says so itself rather than being guessed at from
-// the media type — multipart/mixed is in no streaming media-type list.
-func assertSequentialMedia(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	events, ok := opByName(doc, "streamEvents")
-	require.True(t, ok)
-	c := firstContent(t, events)
-	require.NotNil(t, c.Item, "itemSchema becomes the element type")
-	require.NotNil(t, c.ItemEncoding, "an encoding governing every item lowers structurally")
-	assert.Equal(t, []string{"application/json"}, c.ItemEncoding.ContentTypes)
-	assert.True(t, c.ItemEncoding.Multi, "the construct describes a repeated tail")
-	assert.Empty(t, c.Unmodeled, "nothing is left over once it lowers")
-
-	assert.Equal(t, ir.StreamingServer, events.Streaming)
-	require.NotNil(t, events.ResponseStream)
-	require.NotNil(t, events.ResponseStream.Events)
-	assert.Empty(t, cmp.Diff(*c.Item, *events.ResponseStream.Events),
-		"the declared item schema is the stream element type")
-	assert.Empty(t, events.Provenance.Inferred, "a declared sequence is not a heuristic")
-
-	parts, ok := opByName(doc, "streamParts")
-	require.True(t, ok)
-	pc := firstContent(t, parts)
-	assert.Nil(t, pc.ItemEncoding, "positional prefixes have no every-item form")
-	for _, key := range []string{"openapi:prefixEncoding", "openapi:itemEncoding"} {
-		entry, ok := pc.Unmodeled[key]
-		require.True(t, ok, "%s kept verbatim; got %v", key, pc.Unmodeled)
-		assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-	}
-}
-
-func assertPerStatusErrors(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "getWidgets")
-	require.True(t, ok)
-	require.Len(t, op.Responses, 1, "the 2xx success response")
-	faults := map[ir.StatusRange]string{}
-	byRange := map[ir.StatusRange]ir.ErrorCase{}
-	for _, ec := range op.Errors {
-		require.Len(t, ec.Conditions.StatusCodes, 1)
-		rng := ec.Conditions.StatusCodes[0]
-		byRange[rng] = ec
-		faults[rng] = ec.Fault
-	}
-	assert.Equal(t, map[ir.StatusRange]string{
-		{From: 404, To: 404}: "client",
-		{From: 429, To: 429}: "client",
-		{From: 500, To: 599}: "server",
-	}, faults, "each range classified from its own status")
-	require.NotNil(t, op.Default, "the default is classed neither way, so it is no error case")
-	assert.Equal(t, []ir.StatusRange{{}}, op.Default.Conditions.StatusCodes, "the catch-all alone")
-	assert.Equal(t, "default", op.Default.Name.Hint)
-
-	assertErrorCaseIsAResponse(t, byRange)
-}
-
-// assertErrorCaseIsAResponse holds the three fields ir.ErrorCase gained in
-// GitHub #422 to the claim ir.Response already carried: every status spelling,
-// every header and every media type survives, whatever the status class.
-//
-// The 5XX case doubles as the control: an error response declaring no headers
-// and no content gets neither, so what the other two carry marks a declaration
-// rather than appearing on every error case.
-func assertErrorCaseIsAResponse(t *testing.T, byRange map[ir.StatusRange]ir.ErrorCase) {
-	t.Helper()
-	hints := map[ir.StatusRange]string{}
-	for rng, ec := range byRange {
-		hints[rng] = ec.Name.Hint
-	}
-	assert.Equal(t, map[ir.StatusRange]string{
-		{From: 404, To: 404}: "404",
-		{From: 429, To: 429}: "429",
-		{From: 500, To: 599}: "5_xx",
-	}, hints, "the key as declared, then neutralized")
-
-	notFound, ok := byRange[ir.StatusRange{From: 404, To: 404}]
-	require.True(t, ok)
-	require.NotNil(t, notFound.Payload)
-	require.Len(t, notFound.Payload.Contents, 1)
-	assert.Equal(t, "application/json", notFound.Payload.Contents[0].MediaType,
-		"a single-media error keeps the key it was written under")
-
-	throttled, ok := byRange[ir.StatusRange{From: 429, To: 429}]
-	require.True(t, ok)
-	require.NotNil(t, throttled.Payload)
-	require.Len(t, throttled.Payload.Contents, 2, "every media type is kept, none elected")
-	assert.Equal(t, "t/openapi/components/schemas/Problem",
-		string(throttled.Payload.Contents[1].Type.Target),
-		"the second media type keeps its own schema rather than the first's")
-	wire := make([]string, 0, len(throttled.Headers))
-	for _, h := range throttled.Headers {
-		wire = append(wire, h.WireName)
-	}
-	assert.Equal(t, []string{"Retry-After", "X-RateLimit-Remaining"}, wire,
-		"the headers that only ever appear on an error status are structural")
-
-	serverErr, ok := byRange[ir.StatusRange{From: 500, To: 599}]
-	require.True(t, ok)
-	assert.Nil(t, serverErr.Payload, "an error response declaring no content gets no payload")
-	assert.Empty(t, serverErr.Headers, "an error response declaring no headers gets none")
-	for rng, ec := range byRange {
-		assert.NotContains(t, ec.Unmodeled, "openapi:content", "%v keeps no content map", rng)
-		assert.NotContains(t, ec.Unmodeled, "openapi:headers", "%v keeps no headers map", rng)
-	}
-}
-
-// assertDefaultResponse pins that a `default` response lowers to the operation's
-// Default, whole, in the three shapes it takes: the operation's only response,
-// the fallback beside a success, and a bare one with no body. In none is the
-// catch-all among Errors, since `default` answers successes and failures alike
-// and the compiler classes it as neither (ir-design §7.2). The control is the
-// 200 beside the default, which stays a Response.
-func assertDefaultResponse(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	catchAll := []ir.StatusRange{{From: 0, To: 0}}
-	byOp := map[string]ir.Operation{}
-	for _, name := range []string{"purgeCache", "getItem", "ping"} {
-		op, ok := opByName(doc, name)
-		require.True(t, ok, "operation %s", name)
-		require.NotNil(t, op.Default, "%s: the default is kept as Default", name)
-		assert.Empty(t, op.Errors, "%s: the catch-all is no error case", name)
-		assert.Equal(t, catchAll, op.Default.Conditions.StatusCodes, "%s: the catch-all alone", name)
-		assert.Equal(t, "default", op.Default.Name.Hint, "%s: the key as written", name)
-		byOp[name] = op
-	}
-
-	purge := byOp["purgeCache"]
-	assert.Empty(t, purge.Responses, "a lone default is the operation's whole description of the outcome")
-	require.NotNil(t, purge.Default.Payload)
-	require.Len(t, purge.Default.Payload.Contents, 1)
-	assert.Equal(t, "application/json", purge.Default.Payload.Contents[0].MediaType)
-	assert.Equal(t, "the cache was purged, or it was not", purge.Default.Docs.Description)
-
-	item := byOp["getItem"]
-	require.Len(t, item.Responses, 1, "the 200 stays a Response beside the default")
-	assert.Equal(t, []ir.StatusRange{{From: 200, To: 200}}, item.Responses[0].Conditions.StatusCodes)
-	require.NotNil(t, item.Default.Payload)
-	require.Len(t, item.Default.Payload.Contents, 1)
-	assert.Equal(t, namedID("Problem"), item.Default.Payload.Contents[0].Type.Target,
-		"the default keeps its own body, apart from the success one")
-	require.NotNil(t, item.Responses[0].Payload)
-	assert.Equal(t, namedID("Item"), item.Responses[0].Payload.Contents[0].Type.Target)
-
-	ping := byOp["ping"]
-	assert.Empty(t, ping.Responses)
-	assert.Nil(t, ping.Default.Payload, "a default declaring no content gets no payload")
-	assert.Equal(t, "pong", ping.Default.Docs.Description)
-}
-
-func assertWebhooks(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "onNewPet")
-	require.True(t, ok)
-	require.Len(t, op.Bindings.HTTP, 1)
-	assert.True(t, op.Bindings.HTTP[0].IsWebhook, "webhook operation carries IsWebhook")
-	assert.Equal(t, "newPet", op.Bindings.HTTP[0].WebhookName, "the webhooks-map key names the event")
-	assert.Empty(t, op.Bindings.HTTP[0].URITemplate, "a webhook carries no URI template")
-	assertPathItemServersKept(t, op, "https://hooks.example.com")
-	assertOwnServersKeptBesideThem(t, op, "https://hooks-override.example.com")
-	assertWebhookGroupIsAHint(t, doc)
-
-	// Two keys a URI template would misstate: braces that belong to the event's
-	// name, and the empty key, which names nothing. Neither declares an
-	// operationId, so the hint is built from the method and the key.
-	ops := allOperations(doc)
-	for _, hook := range []struct {
-		id        ir.OpID
-		key, hint string
-	}{
-		{"op/openapi/webhooks/{tenant}.created/post", "{tenant}.created", "post_tenant_created"},
-		{"op/openapi/webhooks//post", "", "post"},
-	} {
-		i := slices.IndexFunc(ops, func(op ir.Operation) bool { return op.ID == hook.id })
-		require.GreaterOrEqual(t, i, 0, "the webhook keyed %q is mounted", hook.key)
-		require.Len(t, ops[i].Bindings.HTTP, 1)
-		b := ops[i].Bindings.HTTP[0]
-		assert.True(t, b.IsWebhook)
-		assert.Equal(t, hook.key, b.WebhookName, "the key, verbatim")
-		assert.Empty(t, b.URITemplate, "a webhook has no URI template")
-		assert.Equal(t, hook.hint, ops[i].Name.Hint)
-	}
-}
-
-// assertOwnServersKeptBesideThem pins the overriding half of the servers pair in
-// the corpus, so the two-order oracle and the JSON round-trip see it. OpenAPI
-// says an operation's own servers override its path item's, so keeping only the
-// path item's recorded the superseded list and dropped the effective one.
-//
-// The two keys are asserted together because the hazard is that they collapse
-// into one: a single key holding both would leave the surviving list depending
-// on which lowering ran last, which only a two-order diff can see.
-func assertOwnServersKeptBesideThem(t *testing.T, op ir.Operation, url string) {
-	t.Helper()
-	entry, ok := op.Unmodeled["openapi:operationServers"]
-	require.True(t, ok, "the operation's own servers are kept beside its path item's")
-	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-	assert.JSONEq(t, `[{"url":"`+url+`"}]`, string(entry.Value))
-	assert.NotEqual(t, entry.Value, op.Unmodeled["openapi:servers"].Value,
-		"and the two keys hold different declarations, not one overwriting the other")
-}
-
-// assertPathItemServersKept pins that a path item's servers survive whichever
-// parent the path item hangs from. The preserve-plus-diagnostic path used to be
-// reached only from the `paths` walk, so the same override written on a webhook
-// or a callback disappeared with nothing said (GitHub #39).
-func assertPathItemServersKept(t *testing.T, op ir.Operation, url string) {
-	t.Helper()
-	entry, ok := op.Unmodeled["openapi:servers"]
-	require.True(t, ok, "the path item's servers are kept on the operation")
-	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-	assert.JSONEq(t, `[{"url":"`+url+`"}]`, string(entry.Value))
-}
-
-// assertWebhookGroupIsAHint pins which of the two things the group's name is.
-// The compiler synthesizes the group to hold webhook operations, so no document
-// declares it and Naming.Source — the spelling the source used — is the wrong
-// channel; the "default" group the tag walk synthesizes carries a Hint for the
-// same reason (GitHub #184).
-//
-// Asserted here rather than left to the golden because the golden records the
-// value either way: a reader diffing it sees a name move between two fields
-// without being told which one is correct.
-func assertWebhookGroupIsAHint(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	require.Len(t, doc.Services, 1)
-	for _, g := range doc.Services[0].Groups {
-		if g.Name.Hint != "webhooks" {
-			continue
-		}
-		assert.Empty(t, g.Name.Source, "a group no document declares carries no source spelling")
-		assert.Empty(t, g.Name.Canonical, "and no words derived from one")
-		return
-	}
-	t.Fatal("no group carries the webhooks hint")
-}
-
-func assertCallbacks(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "subscribe")
-	require.True(t, ok)
-	require.Len(t, op.Bindings.HTTP, 1)
-	require.Len(t, op.Bindings.HTTP[0].Callbacks, 1)
-	assert.Equal(t, "{$request.body#/callbackUrl}", op.Bindings.HTTP[0].Callbacks[0].Expression)
-	assert.NotEmpty(t, op.Bindings.HTTP[0].Callbacks[0].Operations)
-	cb, ok := opByName(doc, "onEvent")
-	require.True(t, ok, "the callback operation is registered alongside its parent")
-	assertPathItemServersKept(t, cb, "https://callbacks.example.com")
-	assert.NotContains(t, op.Unmodeled, "openapi:servers",
-		"the callback's own servers stay on the callback, not on the parent")
-}
-
-// assertPathItemAnchoredKey pins that an undeclared path-item key whose value
-// carries a YAML anchor is kept and reported exactly as a plainly-valued one
-// beside it is (GitHub #412), rather than reaching the IR in no form and with no
-// diagnostic. Each key is asserted with its own marker so an entry recovered
-// under the wrong key cannot pass for the right one.
-func assertPathItemAnchoredKey(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "getX")
-	require.True(t, ok)
-
-	for _, tc := range []struct{ key, marker, at string }{
-		{"openapi:pathItem/bogusAnchored", "ANCHORED", "/paths/~1x/bogusAnchored"},
-		{"openapi:pathItem/plainBogus", "PLAIN", "/paths/~1x/plainBogus"},
-	} {
-		entry := unmodeledEntry(t, op.Unmodeled, tc.key)
-		assert.JSONEq(t, `{"responses":{"200":{"description":"`+tc.marker+`"}}}`, string(entry.Value),
-			"%s keeps the value the source wrote", tc.key)
-		assert.Equal(t, ir.ReasonOutOfScope, entry.Reason,
-			"OpenAPI defines no such key on a path item, so no IR node is coming for it")
-		assert.Equal(t, jsontext.Pointer(tc.at), entry.Provenance.Pointer)
-		assert.Equal(t, []ir.Severity{ir.SeverityWarning},
-			diagsAt(diags, "openapi/unknown-object-key", tc.at),
-			"%s is announced once, at the key's own pointer, graded as any undeclared key", tc.key)
-	}
-}
-
-// assertPathItemRefSiblings pins what the fields a path item writes beside its
-// $ref lower to, and that the item the $ref names still mounts unchanged.
-//
-// The operation written beside the reference is a declaration of its own: it
-// mounts at the path's own pointers, and the item-level constructs written
-// beside it reach every operation mounted at that path — the referent's
-// included — which is why the summary is asserted on the referenced item's
-// operation as well as on the sibling's (GitHub #577).
-func assertPathItemRefSiblings(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	t.Helper()
-	sibling, ok := opByName(doc, "putA")
-	require.True(t, ok, "the operation written beside the $ref reaches the IR")
-	assert.Equal(t, ir.OpID("op/openapi/paths/~1a/put"), sibling.ID)
-	assert.Equal(t, jsontext.Pointer("/paths/~1a/put"), sibling.Provenance.Pointer,
-		"a sibling operation is declared where it is mounted, not at the item it references")
-	assert.Equal(t, []string{"PUT"}, methodsOf(sibling))
-
-	for _, tc := range []struct{ key, value, at string }{
-		{"openapi:pathItemSummary", `"written beside the ref"`, "/paths/~1a/summary"},
-		{"openapi:servers", `[{"url":"https://beside.example"}]`, "/paths/~1a/servers"},
-		{"openapi:pathItem/x-beside", `"use"`, "/paths/~1a/x-beside"},
-		{"openapi:pathItem/bogusBeside", `{"responses":{"200":{"description":"BESIDE"}}}`,
-			"/paths/~1a/bogusBeside"},
-	} {
-		entry := unmodeledEntry(t, sibling.Unmodeled, tc.key)
-		assert.JSONEq(t, tc.value, string(entry.Value), "%s keeps what the use site declared", tc.key)
-		assert.Equal(t, jsontext.Pointer(tc.at), entry.Provenance.Pointer)
-	}
-	assert.Equal(t, []ir.Severity{ir.SeverityWarning},
-		diagsAt(diags, "openapi/unknown-object-key", "/paths/~1a/bogusBeside"),
-		"the use site's undeclared key is announced at its own pointer, as any other is")
-
-	require.Len(t, sibling.Params, 1, "the use site's item parameter merges into its operation")
-	assert.Equal(t, "beside", sibling.Params[0].Name.Source)
-	assert.Equal(t, jsontext.Pointer("/paths/~1a/parameters/0"), sibling.Params[0].Provenance.Pointer)
-
-	// The referenced item's own operation keeps mounting at both paths, and the
-	// constructs written beside the reference reach it too.
-	atA := opByID(t, doc, "op/openapi/paths/~1a/get")
-	assert.Equal(t, "getB", atA.Name.Source)
-	assert.Equal(t, jsontext.Pointer("/paths/~1b/get"), atA.Provenance.Pointer)
-	assert.Contains(t, atA.Unmodeled, "openapi:pathItemSummary")
-	atB := opByID(t, doc, "op/openapi/paths/~1b/get")
-	assert.Equal(t, jsontext.Pointer("/paths/~1b/get"), atB.Provenance.Pointer)
-	assert.NotContains(t, atB.Unmodeled, "openapi:pathItemSummary",
-		"the referent's own path keeps only what it declares")
-}
-
-// methodsOf returns the wire methods an operation's HTTP bindings declare.
-func methodsOf(op ir.Operation) []string {
-	methods := make([]string, 0, len(op.Bindings.HTTP))
-	for _, b := range op.Bindings.HTTP {
-		methods = append(methods, b.Method)
-	}
-	return methods
-}
-
-// opByID returns the operation carrying id, which is what tells two mounts of
-// one $ref'd declaration apart where a source name cannot.
-func opByID(t *testing.T, doc *ir.Document, id string) ir.Operation {
-	t.Helper()
-	for _, g := range doc.Services[0].Groups {
-		for _, op := range g.Operations {
-			if string(op.ID) == id {
-				return op
-			}
-		}
-	}
-	t.Fatalf("operation %s not found", id)
-	return ir.Operation{}
-}
-
-// assertPathItemDocs pins that a path item's own documentation survives at every
-// route that reaches a path item, and that keeping it costs the operation
-// nothing it declared for itself.
-//
-// It is kept rather than merged: ir.Docs holds the operation's summary and
-// description, a path item's pair documents the path, and merging the two would
-// need a precedence rule and would attach to an operation text its author never
-// wrote. So the assertion is that both subjects survive side by side.
-func assertPathItemDocs(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	for _, tc := range []struct{ op, summary, description string }{
-		{"listPets", "Pet collection", "Everything addressable at /pets."},
-		{"createPet", "Pet collection", "Everything addressable at /pets."},
-		{"onPetCreated", "Creation callback", "Delivered once the pet exists."},
-		{"onPetDeleted", "Pet deleted", "Delivered when a pet is removed."},
-	} {
-		op, ok := opByName(doc, tc.op)
-		require.True(t, ok, "operation %s", tc.op)
-		assertPathItemDocsKept(t, op, tc.summary, tc.description)
-	}
-
-	listPets, ok := opByName(doc, "listPets")
-	require.True(t, ok)
-	assert.Equal(t, "List pets", listPets.Docs.Summary,
-		"the operation's own summary is what Docs holds")
-	assert.Equal(t, "Returns every pet.", listPets.Docs.Description)
-
-	createPet, ok := opByName(doc, "createPet")
-	require.True(t, ok)
-	assert.Empty(t, createPet.Docs.Summary,
-		"and an operation that documents nothing has nothing invented for it")
-
-	// And the decision is announced at the operation that carries the entry,
-	// once, rather than being taken silently.
-	assert.Equal(t, []ir.Severity{ir.SeverityInfo},
-		diagsAt(diags, "openapi/degraded-construct", "/paths/~1pets/get"))
-	assert.Equal(t, []ir.Severity{ir.SeverityInfo},
-		diagsAt(diags, "openapi/degraded-construct", "/webhooks/petDeleted/post"))
-}
-
-// assertPathItemDocsKept checks one operation kept the pair its own path item
-// declared, under the keys that name which object the text came from.
-func assertPathItemDocsKept(t *testing.T, op ir.Operation, summary, description string) {
-	t.Helper()
-	kept, ok := op.Unmodeled["openapi:pathItemSummary"]
-	require.True(t, ok, "the path item's summary is kept on %s", op.ID)
-	assert.Equal(t, ir.ReasonNoIRHome, kept.Reason)
-	assert.JSONEq(t, `"`+summary+`"`, string(kept.Value))
-
-	kept, ok = op.Unmodeled["openapi:pathItemDescription"]
-	require.True(t, ok, "the path item's description is kept on %s", op.ID)
-	assert.Equal(t, ir.ReasonNoIRHome, kept.Reason)
-	assert.JSONEq(t, `"`+description+`"`, string(kept.Value))
-}
-
-// assertPathItemOperations pins that every operation a 3.2 path item declares
-// becomes an ir.Operation, whichever field declared it and whichever of the
-// three routes reaches the path item.
-//
-// The walk read the fixed method fields and nothing else, so an
-// additionalOperations entry was dropped entire — and with it every type
-// reachable only through it, which is why the request body's schema is asserted
-// to be in the registry rather than merely referenced from an operation.
-func assertPathItemOperations(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	for _, tc := range []struct{ op, method string }{
-		{"queryIndex", "QUERY"},
-		{"purgeIndex", "PURGE"},
-		{"mixedCaseIndex", "mIxEdCase"},
-		{"purgeCallback", "PURGE"},
-		{"onFlush", "FLUSH"},
-	} {
-		op, ok := opByName(doc, tc.op)
-		require.True(t, ok, "operation %s", tc.op)
-		require.Len(t, op.Bindings.HTTP, 1)
-		assert.Equal(t, tc.method, op.Bindings.HTTP[0].Method,
-			"%s binds the method as the source spelled it", tc.op)
-	}
-
-	onFlush, ok := opByName(doc, "onFlush")
-	require.True(t, ok)
-	assert.True(t, onFlush.Bindings.HTTP[0].IsWebhook,
-		"a webhook mount marks the binding whichever field declared the operation")
-	assert.Equal(t, "cacheFlushed", onFlush.Bindings.HTTP[0].WebhookName,
-		"the webhooks-map key names the event")
-	assert.Empty(t, onFlush.Bindings.HTTP[0].URITemplate)
-
-	subscribe, ok := opByName(doc, "subscribeIndex")
-	require.True(t, ok)
-	require.Len(t, subscribe.Bindings.HTTP, 1)
-	require.Len(t, subscribe.Bindings.HTTP[0].Callbacks, 1)
-	purgeCallback, ok := opByName(doc, "purgeCallback")
-	require.True(t, ok)
-	assert.Equal(t, []ir.OpID{purgeCallback.ID}, subscribe.Bindings.HTTP[0].Callbacks[0].Operations,
-		"an expression declaring only additionalOperations still binds to its parent")
-
-	queryIndex, ok := opByName(doc, "queryIndex")
-	require.True(t, ok)
-	assert.NotNil(t, doc.Types[openapitest.BodyTarget(t, queryIndex.Request)],
-		"the request body schema is interned, not merely referenced")
-}
-
-func assertDeprecation(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "oldOp")
-	require.True(t, ok)
-	assert.NotNil(t, op.Deprecation)
-	m, ok := doc.Types[namedID("OldModel")].(*ir.Model)
-	require.True(t, ok)
-	assert.NotNil(t, m.Deprecation)
-	require.Len(t, m.Properties, 1)
-	assert.NotNil(t, m.Properties[0].Deprecation)
-
-	// A parameter is its own carrier: deprecated written on the parameter object
-	// reaches it without any schema being involved.
-	legacy, ok := paramByName(op, "legacy")
-	require.True(t, ok)
-	assert.NotNil(t, legacy.Deprecation)
-}
-
-func assertExamples(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-
-	// A schema that reduced to a shared primitive keeps its examples on the
-	// declaring property; one that hoists a node of its own keeps them there.
-	n, ok := propByWire(m, "n")
-	require.True(t, ok)
-	assert.Len(t, n.Examples, 2)
-	inner, ok := propByWire(m, "inner")
-	require.True(t, ok)
-	assert.Empty(t, inner.Examples, "an inline object holds its own examples")
-	require.Len(t, doc.Types[inner.Type.Target].Common().Examples, 1)
-
-	// A component's example belongs to the component, not to a use site.
-	c, ok := doc.Types[namedID("C")]
-	require.True(t, ok)
-	require.Len(t, c.Common().Examples, 1)
-	require.NotNil(t, c.Common().Examples[0].Value)
-	assert.Equal(t, "component-level", c.Common().Examples[0].Value.Str)
-
-	// A parameter carries its own examples, keyed by their map key like a media
-	// type's.
-	op, ok := opByName(doc, "getItem")
-	require.True(t, ok)
-	q, ok := paramByName(op, "q")
-	require.True(t, ok)
-	require.Len(t, q.Examples, 1)
-	assert.Equal(t, "one", q.Examples[0].Name)
-	require.NotNil(t, q.Examples[0].Value)
-	assert.Equal(t, "first", q.Examples[0].Value.Str)
-
-	assertResponseExamples(t, doc)
-}
-
-// assertResponseExamples pins the response-side example sites: the plural map on
-// a media type, in every spelling the spec allows, and a response header.
-func assertResponseExamples(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	op, ok := opByName(doc, "getItem")
-	require.True(t, ok)
-	require.Len(t, op.Responses[0].Payload.Contents, 1)
-	ex := op.Responses[0].Payload.Contents[0].Examples
-	require.Len(t, ex, 4, "every entry lowers, in source order")
-
-	// An inline entry and one written as a $ref, which must resolve to the
-	// referenced component's value. Both are named by their map key.
-	require.NotNil(t, ex[0].Value)
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "hello"}, *ex[0].Value)
-	assert.Equal(t, "inline", ex[0].Name)
-	require.NotNil(t, ex[1].Value)
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "world"}, *ex[1].Value)
-	assert.Equal(t, "shared", ex[1].Name)
-
-	// The annotations that surround a value travel with it.
-	assert.Equal(t, "a summary", ex[2].Summary)
-	assert.Equal(t, "a description", ex[2].Description)
-
-	// An externalValue entry carries no inline value, and is kept for the URL.
-	assert.Equal(t, "https://example.com/e.json", ex[3].ExternalURL)
-	assert.Nil(t, ex[3].Value)
-	assert.Equal(t, "hosted elsewhere", ex[3].Summary)
-
-	headers := op.Responses[0].Headers
-	require.Len(t, headers, 1)
-	require.Len(t, headers[0].Examples, 1)
-	require.NotNil(t, headers[0].Examples[0].Value)
-	assert.Equal(t, ir.BigVal("5"), headers[0].Examples[0].Value.Num)
-}
-
-// assertSelfURI pins that a declared `$self` reaches the source's entry rather
-// than a lowered node, since it says where one input document lives. The case
-// witnesses no matrix row: the rows are what an API can express, and the URI a
-// description gives itself is not part of the API it describes.
-func assertSelfURI(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	t.Helper()
-	require.Len(t, doc.Sources, 1)
-	assert.Equal(t, "openapi@3.2", doc.Sources[0].Format)
-	assert.Equal(t, "https://example.com/api/openapi.yaml", doc.Sources[0].SelfURI)
-}
-
-func assertDocsSummaryDesc(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	op, ok := opByName(doc, "ping")
-	require.True(t, ok)
-	assert.Equal(t, "Ping the server", op.Docs.Summary)
-	assert.Equal(t, "Returns pong", op.Docs.Description)
-	require.Len(t, op.Docs.ExternalDocs, 1)
-	assert.Equal(t, ir.Link{URL: "https://example.com/docs/ping", Description: "Ping reference"},
-		op.Docs.ExternalDocs[0])
-
-	// A documented scalar alias is documented too: its docs must not depend on
-	// what its body happens to lower to (GitHub #114).
-	sc, ok := doc.Types[namedID("UserId")].(*ir.Scalar)
-	require.True(t, ok)
-	assert.Equal(t, "User identifier", sc.Docs.Summary)
-	assert.Equal(t, "Stable identifier for a user.", sc.Docs.Description)
-
-	// info and the root externalDocs are one Docs on the document: summary and
-	// description come from info, the link from beside it.
-	assert.Equal(t, "A one-line summary of the API.", doc.Docs.Summary)
-	assert.Equal(t, "The long-form description of the API.", doc.Docs.Description)
-	require.Len(t, doc.Docs.ExternalDocs, 1)
-	assert.Equal(t, ir.Link{URL: "https://example.com/docs", Description: "Full guide"},
-		doc.Docs.ExternalDocs[0])
-	require.NotNil(t, doc.License)
-	assert.Equal(t, ir.License{Name: "MIT", Identifier: "MIT"}, *doc.License,
-		"the 3.1 SPDX identifier is its own field, never folded into the name")
-}
-
-// assertRequestBodyDocs pins GitHub #609: a Request Body Object's `description`
-// describes the body rather than any media type inside it, so it reaches
-// Payload.Docs. Both spellings are covered — a body $ref'd from components and
-// one written inline — and the shared component is reached from two operations,
-// so the declaration-pointer path is exercised and one declaration is still one
-// type however many mounts read its docs.
-func assertRequestBodyDocs(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	created, ok := opByName(doc, "createOrder")
-	require.True(t, ok)
-	require.NotNil(t, created.Request)
-	assert.Equal(t, "A shared order body.", created.Request.Docs.Description,
-		"a $ref'd body keeps the component's description")
-
-	replaced, ok := opByName(doc, "replaceOrder")
-	require.True(t, ok)
-	require.NotNil(t, replaced.Request)
-	assert.Equal(t, "A shared order body.", replaced.Request.Docs.Description,
-		"the second mount reads the same declaration's docs")
-
-	shared := ir.TypeID("t/anon/components/requestBodies/OrderBody/content/application~1json/schema")
-	assert.Equal(t, shared, openapitest.BodyTarget(t, created.Request),
-		"a shared body interns at its component pointer (issue #107)")
-	assert.Equal(t, shared, openapitest.BodyTarget(t, replaced.Request),
-		"...once, whichever mount lowered it first")
-
-	draft, ok := opByName(doc, "saveDraft")
-	require.True(t, ok)
-	require.NotNil(t, draft.Request)
-	assert.Equal(t, "A draft saved inline.", draft.Request.Docs.Description,
-		"an inline body's own description reaches the payload too")
-}
-
-// assertRefSiteDocs pins GitHub #610 across every site the fold reaches, in one
-// document: a Reference Object may write `summary` and `description` beside its
-// `$ref`, and OpenAPI says they override the referenced object's. Nothing read
-// them, so a mount's own documentation was silently replaced by the
-// declaration's. The one component referenced from two operations with
-// different overrides also pins the other half: each mount keeps its own and
-// neither mutates the declaration.
-func assertRefSiteDocs(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	widgets, ok := opByName(doc, "listWidgets")
-	require.True(t, ok)
-	gadgets, ok := opByName(doc, "listGadgets")
-	require.True(t, ok)
-
-	// parameters — the two-mount case: the first writes both siblings, the second
-	// only a description, and the declaration's own description is overridden by
-	// both rather than surviving on either.
-	widgetLimit, ok := paramByName(widgets, "limit")
-	require.True(t, ok)
-	assert.Equal(t, "Page size", widgetLimit.Docs.Summary)
-	assert.Equal(t, "How many widgets to return.", widgetLimit.Docs.Description)
-	gadgetLimit, ok := paramByName(gadgets, "limit")
-	require.True(t, ok)
-	assert.Empty(t, gadgetLimit.Docs.Summary, "the second mount writes no summary, so none is invented")
-	assert.Equal(t, "How many gadgets to return.", gadgetLimit.Docs.Description)
-
-	// responses — one mount overrides the description, the other keeps the
-	// declaration's, so neither mutates it.
-	require.Len(t, widgets.Responses, 1)
-	assert.Equal(t, "The listing, as this operation returns it.", widgets.Responses[0].Docs.Description)
-	require.Len(t, gadgets.Responses, 1)
-	assert.Equal(t, "A page of results.", gadgets.Responses[0].Docs.Description,
-		"a mount with no siblings leaves the declaration's description alone")
-
-	// error cases are responses too, and reach the same shared lowering.
-	require.Len(t, widgets.Errors, 1)
-	assert.Equal(t, "No such widget.", widgets.Errors[0].Docs.Description)
-
-	// headers
-	require.Len(t, widgets.Responses[0].Headers, 1)
-	assert.Equal(t, "The unit a rate limit is stated in.", widgets.Responses[0].Headers[0].Docs.Description)
-
-	// examples — the siblings override the Example Object's own pair.
-	require.NotNil(t, widgets.Responses[0].Payload)
-	require.Len(t, widgets.Responses[0].Payload.Contents[0].Examples, 1)
-	example := widgets.Responses[0].Payload.Contents[0].Examples[0]
-	assert.Equal(t, "One page", example.Summary)
-	assert.Equal(t, "A single page of results.", example.Description)
-
-	// request bodies
-	require.NotNil(t, widgets.Request)
-	assert.Equal(t, "The widget to create.", widgets.Request.Docs.Description)
-
-	// security schemes — the aliasing entry takes its own description, and the
-	// declaration it names keeps its own; an alias of the alias writes none, so
-	// it takes the description of the hop beneath it.
-	require.Len(t, doc.Auth, 3)
-	byName := map[string]string{}
-	for _, scheme := range doc.Auth {
-		byName[scheme.Name.Source] = scheme.Docs.Description
-	}
-	assert.Equal(t, "The key this API expects.", byName["ApiKey"])
-	assert.Equal(t, "The declaration's own scheme description.", byName["BaseKey"],
-		"the aliasing entry's siblings do not reach the declaration")
-	assert.Equal(t, "The key this API expects.", byName["KeyAlias"])
-
-	assertAliasHopDocs(t, doc)
-}
-
-// assertAliasHopDocs pins the siblings of an alias, a component that is itself a
-// $ref: they override the declaration it names at every position, and a use
-// site's own override them in turn.
-func assertAliasHopDocs(t *testing.T, doc *ir.Document) {
-	sprocket, ok := opByName(doc, "makeSprocket")
-	require.True(t, ok)
-	limit, ok := paramByName(sprocket, "limit")
-	require.True(t, ok)
-	assert.Equal(t, ir.Docs{Summary: "Sprocket page size", Description: "The alias's own description."}, limit.Docs,
-		"the use site's summary over the alias's description over the declaration's")
-	require.NotNil(t, sprocket.Request)
-	assert.Equal(t, "The alias's own body description.", sprocket.Request.Docs.Description)
-	require.Len(t, sprocket.Responses, 1)
-	require.Len(t, sprocket.Responses[0].Headers, 1)
-	assert.Equal(t, "The alias's own header description.", sprocket.Responses[0].Headers[0].Docs.Description)
-	require.Len(t, sprocket.Responses[0].Payload.Contents[0].Examples, 1)
-	example := sprocket.Responses[0].Payload.Contents[0].Examples[0]
-	assert.Equal(t, "The alias's own summary", example.Summary)
-	assert.Equal(t, "Declared description", example.Description, "the field the alias omits stands")
-	require.Len(t, sprocket.Errors, 1)
-	assert.Equal(t, "The alias's own response description.", sprocket.Errors[0].Docs.Description)
-}
-
-// assertParamContentFields pins GitHub #611: electing a parameter's or header's
-// `content` spelling reads the whole Media Type Object rather than only its
-// schema, so the object's examples reach the carrier and what the carrier has no
-// home for is kept verbatim under the content entry's own scope. The schema
-// spelling beside them elects no media type and records none of it.
-func assertParamContentFields(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "search")
-	require.True(t, ok)
-
-	filter, ok := paramByName(op, "filter")
-	require.True(t, ok)
-	require.Len(t, filter.Examples, 1, "the media type's examples reach the parameter")
-	assert.Equal(t, "one", filter.Examples[0].Name)
-	assert.Equal(t, "One kind", filter.Examples[0].Summary)
-
-	const scope = "openapi:content/application~1json/"
-	assert.Equal(t, ir.ReasonVendorExtension, filter.Unmodeled[scope+"x-note"].Reason)
-	assert.Equal(t, ir.ReasonNoIRHome, filter.Unmodeled[scope+"itemSchema"].Reason,
-		"a parser-modelled field with no ir.Parameter home is kept rather than dropped")
-
-	plain, ok := paramByName(op, "plain")
-	require.True(t, ok)
-	assert.Empty(t, plain.Examples, "the schema spelling elects no media type to take examples from")
-	assert.Empty(t, plain.Unmodeled, "nor any content-scoped entry")
-
-	require.Len(t, op.Responses, 1)
-	require.Len(t, op.Responses[0].Headers, 1)
-	header := op.Responses[0].Headers[0]
-	require.Len(t, header.Examples, 2, "the header's own example and its media type's are both kept")
-	assert.Empty(t, header.Examples[0].Name, "its own singular example comes first")
-	assert.Equal(t, "hit", header.Examples[1].Name)
-	assert.Equal(t, ir.ReasonVendorExtension, header.Unmodeled[scope+"x-hdr"].Reason)
-
-	openapitest.AssertInfoDiagAt(t, diags,
-		"/paths/~1search/get/parameters/0/content/application~1json/itemSchema")
-}
-
-// assertExamples32 pins GitHub #612 at every site the issue names: the 3.2
-// dataValue lowers like `value`, including through a components/examples $ref,
-// and a serializedValue is kept verbatim under Unmodeled wherever it is written,
-// alone or beside a dataValue, rather than dropped.
-func assertExamples32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "list")
-	require.True(t, ok)
-
-	// parameters
-	limit, ok := paramByName(op, "limit")
-	require.True(t, ok)
-	require.Len(t, limit.Examples, 1)
-	require.NotNil(t, limit.Examples[0].Value, "a parameter's dataValue reaches Example.Value")
-	assert.Equal(t, ir.BigVal("5"), limit.Examples[0].Value.Num)
-
-	// headers
-	require.Len(t, op.Responses, 1)
-	require.Len(t, op.Responses[0].Headers, 1)
-	headerExample := op.Responses[0].Headers[0].Examples
-	require.Len(t, headerExample, 1)
-	assert.Equal(t, ir.ReasonNoIRHome, headerExample[0].Unmodeled["openapi:serializedValue"].Reason,
-		"a header's serializedValue keeps the entry verbatim")
-
-	// content, and through it components/examples
-	examples := op.Responses[0].Payload.Contents[0].Examples
-	require.Len(t, examples, 4)
-	byName := map[string]ir.Example{}
-	for _, e := range examples {
-		byName[e.Name] = e
-	}
-	require.NotNil(t, byName["five"].Value)
-	assert.Equal(t, ir.BigVal("5"), byName["five"].Value.Num)
-	require.NotNil(t, byName["one"].Value, "a $ref'd components/examples entry lowers its dataValue")
-	assert.Equal(t, ir.BigVal("1"), byName["one"].Value.Num)
-	assert.Equal(t, ir.ReasonNoIRHome, byName["serial"].Unmodeled["openapi:serializedValue"].Reason)
-	assert.Nil(t, byName["serial"].Value)
-	require.NotNil(t, byName["both"].Value, "a dataValue beside a serializedValue still lowers")
-	assert.Equal(t, ir.BigVal("2"), byName["both"].Value.Num)
-	assert.JSONEq(t, `"\"2\""`, string(byName["both"].Unmodeled["openapi:serializedValue"].Value),
-		"...and the serialized form beside it is kept too")
-
-	openapitest.AssertInfoDiagAt(t, diags,
-		"/paths/~1a/get/responses/200/content/application~1json/examples/both/serializedValue")
-	openapitest.AssertInfoDiagAt(t, diags, "/components/examples/Serial/serializedValue")
-}
-
-// assertTagsGrouping32 is the 3.2 counterpart of assertTagsGrouping, and the
-// first case in the corpus to witness OperationGroup.Groups: a tag declaring a
-// parent nests its group under that parent's, an operation's non-navigational
-// tag does not become the group it is filed under, and the declared 3.2 tag
-// metadata reaches the registry verbatim.
-func assertTagsGrouping32(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	require.Len(t, doc.TagDefs, 4)
-	require.Equal(t, "books", doc.TagDefs[0].Name, "TagDefs keep the document's declaration order")
-	assert.Equal(t, "catalog", doc.TagDefs[0].Parent)
-	assert.Equal(t, "nav", doc.TagDefs[0].Kind)
-	assert.Equal(t, "nav", doc.TagDefs[1].Kind)
-	assert.Equal(t, "badge", doc.TagDefs[2].Kind, "the non-navigational kind is recorded, not interpreted")
-	assert.Empty(t, doc.TagDefs[2].Parent)
-
-	require.Len(t, doc.Services, 1)
-	svc := doc.Services[0]
-	require.Len(t, svc.Groups, 1, "the child nests rather than becoming a second top-level group")
-	catalog := svc.Groups[0]
-	assert.Equal(t, "catalog", catalog.Name.Source)
-	assert.Equal(t, "Everything the library holds", catalog.Docs.Description,
-		"an ancestor created first on its child's behalf still carries its declared docs")
-	require.Len(t, catalog.Operations, 1)
-	assert.Equal(t, "showCatalog", catalog.Operations[0].Name.Source)
-
-	require.Len(t, catalog.Groups, 2, "both children nest, in the order operations first reach them")
-	assert.Equal(t, "magazines", catalog.Groups[1].Name.Source)
-	books := catalog.Groups[0]
-	assert.Equal(t, "books", books.Name.Source)
-	assert.Equal(t, "Book operations", books.Docs.Description)
-	require.Len(t, books.Operations, 1)
-	listBooks := books.Operations[0]
-	assert.Equal(t, "listBooks", listBooks.Name.Source)
-	assert.Equal(t, []string{"beta", "books"}, listBooks.Tags,
-		"tag membership keeps every tag the operation named, badge included")
-}
-
-// assertResponseSummary32 pins GitHub #615's Response.summary: the 3.2 field
-// reaches Docs.Summary on both status classes, because it is read in the one
-// shared lowering both use, and the document draws no unknown-key warning for a
-// key its dialect defines.
-func assertResponseSummary32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "deleteItem")
-	require.True(t, ok)
-	require.Len(t, op.Responses, 1)
-	assert.Equal(t, "The item was deleted", op.Responses[0].Docs.Summary)
-	assert.Equal(t, "The long form of the same fact.", op.Responses[0].Docs.Description)
-
-	require.Len(t, op.Errors, 1)
-	assert.Equal(t, "No such item", op.Errors[0].Docs.Summary,
-		"an error case is lowered by the same function, so it reads the field too")
-	assert.Empty(t, diagsAt(diags, diag.UnknownObjectKey, "/paths/~1items~1{id}/delete/responses/204/summary"),
-		"a key 3.2 defines is not an undefined key")
-}
-
-// assertComponentMediaTypes32 pins a 3.2 document using components/mediaTypes
-// while this compiler resolves no reference into it (GitHub #856): nothing is
-// lost, as the section is kept whole and each content entry keeps its $ref, and
-// nothing the dialect defines is called undefined.
-func assertComponentMediaTypes32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	for _, name := range []string{"listEvents", "getEvent"} {
-		op, ok := opByName(doc, name)
-		require.True(t, ok)
-		content := op.Responses[0].Payload.Contents[0]
-		assert.Equal(t, "application/json", content.MediaType)
-		assert.Equal(t, ir.ReasonDegradedLowering, content.Unmodeled["openapi:$ref"].Reason,
-			"%s: the reference is kept, not followed", name)
-	}
-	assert.Equal(t, ir.ReasonNoIRHome, doc.Unmodeled["openapi:components/mediaTypes"].Reason)
-	assert.False(t, openapitest.HasDiag(diags, diag.UnknownObjectKey))
-	openapitest.AssertInfoDiagAt(t, diags, "/components/mediaTypes")
-}
-
-// assertXMLNodeType32 pins GitHub #615's xml.nodeType: ir.XMLHints.NodeType
-// already existed and its GoDoc already named the version, so the fix is the
-// wiring, and the dialect's key is no longer reported as undefined.
-func assertXMLNodeType32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	report, ok := doc.Types[namedID("Report")].(*ir.Model)
-	require.True(t, ok)
-	id, ok := propByWire(report, "id")
-	require.True(t, ok)
-	require.NotNil(t, id.XML)
-	assert.Equal(t, "attribute", id.XML.NodeType)
-
-	body, ok := propByWire(report, "body")
-	require.True(t, ok)
-	require.NotNil(t, body.XML)
-	assert.Equal(t, "text", body.XML.NodeType)
-	assert.Equal(t, "B", body.XML.Name, "the object's other fields still lower as they did")
-	assert.Equal(t, "p", body.XML.Prefix)
-
-	assert.Empty(t, diagsAt(diags, diag.UnknownObjectKey, "/components/schemas/Report/properties/id/xml/nodeType"),
-		"a key 3.2 defines is not an undefined key")
-}
-
-// assertNestedEncoding32 pins GitHub #615's nested Encoding fields: each is kept
-// verbatim under the part's own scope with one info, rather than drawing an
-// unknown-object-key warning and reaching no entry at all.
-func assertNestedEncoding32(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	op, ok := opByName(doc, "upload")
-	require.True(t, ok)
-	require.NotNil(t, op.Request)
-	content := op.Request.Contents[0]
-	for _, keyword := range []string{"encoding", "prefixEncoding"} {
-		entry, ok := content.Unmodeled["openapi:encoding/note/"+keyword]
-		require.True(t, ok, "%s is kept verbatim; got %v", keyword, slices.Sorted(maps.Keys(content.Unmodeled)))
-		assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-	}
-	assert.False(t, openapitest.HasDiag(diags, diag.UnknownObjectKey),
-		"3.2 defines these keys, so the census must leave them alone")
-}
-
-// assertUnreferencedComponents pins GitHub #616: every component entry no
-// lowering followed a reference to is kept verbatim on the document, under the
-// section and name it was declared with, a link a lowered response names among
-// them, while the entry the paths do name lowers as it always did. No matrix
-// row: the case is a preservation claim.
-func assertUnreferencedComponents(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	for _, section := range []string{
-		"responses", "parameters", "examples", "requestBodies",
-		"headers", "links", "callbacks", "pathItems",
-	} {
-		key := "openapi:components/" + section + "/Unused"
-		entry, ok := doc.Unmodeled[key]
-		require.True(t, ok, "%s is kept verbatim; got %v", section, slices.Sorted(maps.Keys(doc.Unmodeled)))
-		assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
-		assert.Equal(t, "/components/"+section+"/Unused", string(entry.Provenance.Pointer),
-			"the entry is located at its own declaration, not at the carrier holding it")
-	}
-	assert.NotContains(t, doc.Unmodeled, "openapi:components/responses/Used",
-		"an entry a reference reaches is lowered, not also kept verbatim")
-	assert.Contains(t, doc.Unmodeled, "openapi:components/links/Next",
-		"a link the lowered response's links map names is kept: nothing follows that reference")
-	assert.Contains(t, doc.Unmodeled, "openapi:components/mediaTypes",
-		"3.2's mediaTypes is kept whole until a reference into it is followed (GitHub #856)")
-
-	op, ok := opByName(doc, "getA")
-	require.True(t, ok)
-	require.Len(t, op.Responses, 1)
-	assert.Equal(t, "reached from the paths", op.Responses[0].Docs.Description)
-	assert.False(t, openapitest.HasDiag(diags, diag.UnknownObjectKey))
-}
-
-func assertExtensionsX(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	m, ok := doc.Types[namedID("S")].(*ir.Model)
-	require.True(t, ok)
-	raw, ok := m.Unmodeled["openapi:x-rate-limit"]
-	require.True(t, ok, "x-* extensions are namespaced under openapi:")
-	assert.JSONEq(t, "100", string(raw.Value))
-	assert.Equal(t, ir.ReasonVendorExtension, raw.Reason)
-
-	assertEveryObjectKeepsItsExtensions(t, doc)
-	assertRawPreservedBinary(t, m)
-}
-
-// assertEveryObjectKeepsItsExtensions holds the whole contract, not the
-// positions that happened to be noticed: every OpenAPI object that admits an
-// x-* keeps it. The fixture writes `x-mark` on each with a value naming the
-// object, so a row that stops arriving names the lowering that stopped reading.
-//
-// Carriers are derived from the value graph: a row says which Unmodeled map the
-// entry must land on by the path the walk reaches it at. The match is a
-// substring one, so a bare ".Unmodeled" ends every path and checks nothing;
-// carrierNarrows holds each row to narrowing the document.
-func assertEveryObjectKeepsItsExtensions(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	sites := unmodeledSites(doc)
-	for _, tc := range []struct{ object, key, want, carrier string }{
-		{"openapi root", "openapi:x-audience", `"public"`, "doc.Unmodeled"},
-		{"info", "openapi:info/x-mark", `"XINFO"`, "doc.Unmodeled"},
-		{"contact", "openapi:info/contact/x-mark", `"XCONTACT"`, "doc.Unmodeled"},
-		{"license", "openapi:info/license/x-mark", `"XLICENSE"`, "doc.Unmodeled"},
-		{"externalDocs", "openapi:externalDocs/x-mark", `"XEXTERNALDOCS"`, "doc.Unmodeled"},
-		{"components", "openapi:components/x-mark", `"XCOMPONENTS"`, "doc.Unmodeled"},
-		{"tag", "openapi:tags/0/x-mark", `"XTAG"`, "doc.Unmodeled"},
-		{"tag externalDocs", "openapi:tags/0/externalDocs/x-mark", `"XTAGEXTERNALDOCS"`, "doc.Unmodeled"},
-		{"server", "openapi:x-mark", `"XSERVER"`, "doc.Servers[0].Unmodeled"},
-		{"server variable", "openapi:x-mark", `"XSERVERVARIABLE"`, "doc.Servers[0].Variables[0].Unmodeled"},
-		{"paths", "openapi:paths/x-mark", `"XPATHS"`, "doc.Services[0].Unmodeled"},
-		{"path item", "openapi:pathItem/x-mark", `"XPATHITEM"`, ".Operations[0].Unmodeled"},
-		{"operation", "openapi:x-internal", `true`, ".Operations[0].Unmodeled"},
-		{"operation externalDocs", "openapi:externalDocs/x-mark", `"XOPERATIONEXTERNALDOCS"`,
-			".Operations[0].Unmodeled"},
-		{"responses", "openapi:responses/x-mark", `"XRESPONSES"`, ".Operations[0].Unmodeled"},
-		{"parameter", "openapi:x-mark", `"XPARAMETER"`, ".Params[0].Unmodeled"},
-		{"request body", "openapi:x-mark", `"XREQUESTBODY"`, ".Request.Unmodeled"},
-		{"media type", "openapi:x-mark", `"XMEDIATYPE"`, ".Contents[0].Unmodeled"},
-		{"encoding", "openapi:encoding/f/x-mark", `"XENCODING"`, ".Contents[0].Unmodeled"},
-		{"example", "openapi:x-mark", `"XEXAMPLE"`, ".Examples[0].Unmodeled"},
-		{"response", "openapi:x-mark", `"XRESPONSE"`, ".Responses[0].Unmodeled"},
-		{"error response", "openapi:x-mark", `"XERRORRESPONSE"`, ".Errors[0].Unmodeled"},
-		{"header", "openapi:x-mark", `"XHEADER"`, ".Headers[0].Unmodeled"},
-		{"callback", "openapi:callbacks/onEvent/x-mark", `"XCALLBACK"`, ".Bindings.HTTP[0].Unmodeled"},
-		{"schema xml", "openapi:xml/x-mark", `"XXML"`, "doc.Types[t/openapi/components/schemas/S].Unmodeled"},
-		{"schema externalDocs", "openapi:externalDocs/x-mark", `"XSCHEMAEXTERNALDOCS"`,
-			"doc.Types[t/openapi/components/schemas/S].Unmodeled"},
-		{"discriminator", "openapi:discriminator/x-mark", `"XDISCRIMINATOR"`,
-			"doc.Types[t/openapi/components/schemas/D].Unmodeled"},
-		{"security scheme", "openapi:x-mark", `"XSECURITYSCHEME"`,
-			"doc.Auth[auth/openapi/components/securitySchemes/k].Unmodeled"},
-		{"oauth flows", "openapi:flows/x-mark", `"XOAUTHFLOWS"`,
-			"doc.Auth[auth/openapi/components/securitySchemes/o].Unmodeled"},
-		{"oauth flow", "openapi:x-mark", `"XOAUTHFLOW"`,
-			"doc.Auth[auth/openapi/components/securitySchemes/o].Flows[0].Unmodeled"},
-	} {
-		site, found := findUnmodeled(sites, tc.key, tc.want)
-		if !assert.True(t, found, "%s extension is dropped: no %s = %s anywhere in the document",
-			tc.object, tc.key, tc.want) {
-			continue
-		}
-		assert.Equal(t, ir.ReasonVendorExtension, site.entry.Reason, "%s extension reason", tc.object)
-		assert.True(t, carrierNarrows(sites, tc.carrier),
-			"%s carrier %q matches every Unmodeled map in the document, so it asserts nothing "+
-				"about where the entry landed", tc.object, tc.carrier)
-		assert.Contains(t, site.path, tc.carrier, "%s extension lands on the wrong carrier", tc.object)
-	}
-}
-
-// carrierNarrows reports whether carrier picks out fewer than all of the
-// document's Unmodeled maps. A carrier that matches every one of them makes the
-// assertion beside it unconditionally true, which is how a row can name the
-// wrong map and still pass.
-//
-// Matching none of them is narrow, not broad, so it passes here and fails on the
-// assertion beside this one: that is a carrier naming a map the document has
-// not got, and reporting it as the vacuous case would name the opposite defect.
-func carrierNarrows(sites []unmodeledSite, carrier string) bool {
-	all, matched := map[string]bool{}, map[string]bool{}
-	for _, site := range sites {
-		all[site.path] = true
-		if strings.Contains(site.path, carrier) {
-			matched[site.path] = true
-		}
-	}
-	return len(matched) < len(all)
-}
-
-// assertRawPreservedBinary pins what a !!binary extension keeps: the base64 the
-// source wrote. Decoding it and storing the bytes in a JSON string lost the
-// spelling on every value and lost the data itself on any byte that is not
-// valid UTF-8, since v1's encoding/json rewrote those to U+FFFD (GitHub #242).
-//
-// The block-form row carries the line breaks with it, because they are part of
-// what the source wrote; base64.StdEncoding skips them, so a consumer resolving
-// the tag reads the same bytes the decode used to store.
-func assertRawPreservedBinary(t *testing.T, m *ir.Model) {
-	t.Helper()
-	for _, tc := range []struct{ key, want string }{
-		{"openapi:x-blob", `"aGVsbG8="`},
-		{"openapi:x-raw", `"/w=="`},
-		{"openapi:x-wrapped", `"aGVs\nbG8=\n"`},
-	} {
-		entry, found := m.Unmodeled[tc.key]
-		require.True(t, found, "%s is preserved; got %v", tc.key, m.Unmodeled)
-		assert.Equal(t, tc.want, string(entry.Value),
-			"%s keeps its base64 text, not the bytes it names", tc.key)
-	}
-}
-
-// assertInlineAnnotations covers the positions with no ir.Property or
-// ir.Parameter to carry what a declaration writes: each keeps its docs, bounds
-// and x-* on a node of its own, while a position declaring nothing still
-// resolves straight to the shared primitive.
-func assertInlineAnnotations(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	elem := assertAnnotatedScalar(t, doc, "t/anon/components/schemas/Codes/items", 3)
-	require.NotNil(t, elem.XML)
-	assert.Equal(t, "Code", elem.XML.Name)
-	assert.Contains(t, elem.Unmodeled, "openapi:x-facet")
-
-	assertAnnotatedScalar(t, doc, "t/anon/components/schemas/CodeIndex/additionalProperties", 64)
-	assertAnnotatedScalar(t, doc,
-		"t/anon/paths/~1codes/get/responses/200/content/application~1json/schema", 8192)
-
-	bare, ok := doc.Types[namedID("Bare")].(*ir.List)
-	require.True(t, ok)
-	assert.Equal(t, ir.TypeID("t/prim/string"), bare.Elem.Target,
-		"an element declaring nothing must not grow a node of its own")
-
-	op, ok := opByName(doc, "listCodes")
-	require.True(t, ok)
-	require.Len(t, op.Params, 1)
-	assertCarriedAnnotations(t, op.Params[0].Docs, op.Params[0].Constraints, op.Params[0].Unmodeled, 4)
-	require.Len(t, op.Responses[0].Headers, 1)
-	h := op.Responses[0].Headers[0]
-	assertCarriedAnnotations(t, h.Docs, h.Constraints, h.Unmodeled, 64)
-}
-
-// assertAnnotatedScalar requires the node at id to be a Scalar carrying a
-// description and the given maxLength.
-func assertAnnotatedScalar(t *testing.T, doc *ir.Document, id ir.TypeID, maxLength int64) *ir.Scalar {
-	t.Helper()
-	sc, ok := doc.Types[id].(*ir.Scalar)
-	require.True(t, ok, "%s must own a Scalar; got %v", id, doc.Types[id])
-	assert.NotEmpty(t, sc.Docs.Description)
-	require.NotNil(t, sc.Constraints)
-	require.NotNil(t, sc.Constraints.MaxLength)
-	assert.Equal(t, maxLength, *sc.Constraints.MaxLength)
-	return sc
-}
-
-// assertCarriedAnnotations requires a parameter's or header's own carrier to
-// hold what its schema declared.
-func assertCarriedAnnotations(t *testing.T, docs ir.Docs, c *ir.Constraints, p ir.Unmodeled, maxLength int64) {
-	t.Helper()
-	assert.NotEmpty(t, docs.Description)
-	require.NotNil(t, c)
-	require.NotNil(t, c.MaxLength)
-	assert.Equal(t, maxLength, *c.MaxLength)
-	assert.NotEmpty(t, p, "the schema's x-* rides on the carrier too")
-}
-
-func assertServersVariables(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	require.Len(t, doc.Servers, 1)
-	assert.Equal(t, "https://{env}.example.com/v1", doc.Servers[0].URLTemplate)
-	assert.Equal(t, "primary", doc.Servers[0].Name.Source,
-		"a 3.2 server name is the server's naming, not part of its description")
-	require.Len(t, doc.Servers[0].Variables, 1)
-	v := doc.Servers[0].Variables[0]
-	assert.Equal(t, "env", v.Name)
-	assert.Equal(t, "api", v.Default)
-	assert.Equal(t, []string{"api", "staging"}, v.Enum)
-}
-
-func assertSecuritySchemes(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	kinds := map[ir.AuthKind]bool{}
-	for _, s := range doc.Auth {
-		kinds[s.Kind] = true
-	}
-	assert.True(t, kinds[ir.AuthKindAPIKey])
-	assert.True(t, kinds[ir.AuthKindHTTPBasic])
-	assert.True(t, kinds[ir.AuthKindHTTPBearer])
-	assert.True(t, kinds[ir.AuthKindOAuth2])
-	assert.True(t, kinds[ir.AuthKindOpenIDConnect])
-	assert.True(t, kinds[ir.AuthKindMutualTLS])
-	assertSchemeDetail(t, doc)
-}
-
-// assertSchemeDetail pins the per-scheme detail beyond the mechanism kind: the
-// annotations any scheme can carry, the RFC 7235 token an unmodelled HTTP scheme
-// degrades to, and the two OAuth2 endpoints beyond the token URL.
-func assertSchemeDetail(t *testing.T, doc *ir.Document) {
-	t.Helper()
-	byName := make(map[string]ir.AuthScheme, len(doc.Auth))
-	for _, s := range doc.Auth {
-		byName[s.Name.Source] = s
-	}
-
-	key, ok := byName["apiKeyAuth"]
-	require.True(t, ok)
-	assert.Equal(t, "Static per-tenant key.", key.Docs.Description)
-	assert.NotNil(t, key.Deprecation, "a scheme can be deprecated like any other entity")
-	entry, ok := key.Unmodeled["openapi:x-rotation-days"]
-	require.True(t, ok, "a scheme's x-* extensions ride on the scheme; got %v", key.Unmodeled)
-	assert.Equal(t, ir.ReasonVendorExtension, entry.Reason)
-
-	digest, ok := byName["digestAuth"]
-	require.True(t, ok)
-	assert.Equal(t, ir.AuthKindCustom, digest.Kind, "only basic and bearer get first-class kinds")
-	assert.Equal(t, "digest", digest.Scheme, "the token itself is kept rather than dropped")
-
-	stray, ok := byName["strayFieldAuth"]
-	require.True(t, ok)
-	assert.Empty(t, stray.BearerFormat, "an apiKey has no bearer-token format to fill")
-	kept, ok := stray.Unmodeled["openapi:bearerFormat"]
-	require.True(t, ok, "a field the type does not define is kept, not dropped; got %v", stray.Unmodeled)
-	assert.Equal(t, ir.ReasonDegradedLowering, kept.Reason)
-	assert.Equal(t, ir.RawValue(`"JWT"`), kept.Value, "kept as the document wrote it")
-
-	oauth, ok := byName["oauth2Auth"]
-	require.True(t, ok)
-	assert.Equal(t, "https://example.com/.well-known/oauth-authorization-server",
-		oauth.OAuth2MetadataURL)
-	require.Len(t, oauth.Flows, 1)
-	assert.Equal(t, "https://example.com/refresh", oauth.Flows[0].RefreshURL)
-}
-
-// assertOAuth2NoFlow pins where a flowless oauth2 declaration is reported: once,
-// at the declaration, however many of the document's aliases reach it, and
-// never for a scheme whose metadata URL states its endpoints or that declares a
-// flow. Every entry interns either way (GitHub #646).
-func assertOAuth2NoFlow(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	t.Helper()
-	const code = "openapi/oauth2-no-flow"
-	reported := map[string]bool{"emptyFlows": true, "unknownFlowsOnly": true}
-	byPointer := map[jsontext.Pointer]ir.AuthScheme{}
-	for _, s := range doc.Auth {
-		byPointer[s.Provenance.Pointer] = s
-	}
-	for _, name := range []string{
-		"aliasFirst", "aliasSecond", "emptyFlows", "unknownFlowsOnly", "metadataOnly", "declaredFlow",
-	} {
-		s, ok := byPointer[jsontext.Pointer("/components/securitySchemes/"+name)]
-		require.True(t, ok, "%s interns, flowless or not", name)
-		assert.Equal(t, ir.AuthKindOAuth2, s.Kind, "%s", name)
-		var want []ir.Severity
-		if reported[name] {
-			want = []ir.Severity{ir.SeverityWarning}
-		}
-		assert.Equal(t, want, diagsAt(diags, code, "/components/securitySchemes/"+name),
-			"%s: reported once at a flowless declaration, never at an alias or a control", name)
-	}
-	n := 0
-	for _, d := range diags {
-		if d.Code == code {
-			n++
-		}
-	}
-	assert.Equal(t, 2, n, "two flowless declarations, two reports: %+v", diags)
-	assert.Equal(t, "https://example.com/.well-known/oauth-authorization-server",
-		byPointer["/components/securitySchemes/metadataOnly"].OAuth2MetadataURL, "the control's metadata URL is kept")
-}
-
-// assertNoValidationFinding requires that the rule table reported nothing
-// about the document, which is what the required-field cases below are about.
-func assertNoValidationFinding(t *testing.T, diags []ir.Diagnostic) {
-	t.Helper()
-	for _, d := range diags {
-		assert.False(t, strings.HasPrefix(d.Code, diag.Validation+"/"), "unexpected validation finding: %+v", d)
-	}
-}
-
-// assertEmptyRequiredValues pins that a REQUIRED field written as the empty
-// string, which every minor's schema admits, is no finding and lowers as
-// written: the empty server URL, the parameter the document named "", and each
-// security scheme with an empty name or URL (GitHub #622).
-func assertEmptyRequiredValues(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	t.Helper()
-	assertNoValidationFinding(t, diags)
-	require.Len(t, doc.Servers, 2)
-	assert.Empty(t, doc.Servers[0].URLTemplate)
-	require.Len(t, doc.Servers[1].Variables, 2)
-	assert.Equal(t, "base", doc.Servers[1].Variables[1].Name)
-
-	ops := allOperations(doc)
-	require.Len(t, ops, 1)
-	require.Len(t, ops[0].Params, 1)
-	assert.Equal(t, ir.Naming{Hint: "empty"}, ops[0].Params[0].Name, "the empty name is minted a hint")
-	require.Len(t, ops[0].Responses, 1)
-	assert.Empty(t, ops[0].Responses[0].Docs.Description)
-
-	require.Len(t, doc.Auth, 3, "every scheme interns")
-	assert.Len(t, doc.Auth["auth/openapi/components/securitySchemes/oauth"].Flows, 4)
-	assert.Equal(t, ir.AuthKindAPIKey, doc.Auth["auth/openapi/components/securitySchemes/key"].Kind)
-	assert.Equal(t, ir.AuthKindOpenIDConnect, doc.Auth["auth/openapi/components/securitySchemes/oidc"].Kind)
-}
-
-// assertRelaxedRequiredFields pins the two fields a minor stopped requiring,
-// left out of a 3.2 document: an operation declaring no responses lowers with
-// none, and a response declaring no description lowers undocumented, inline
-// and as a component alike (GitHub #622).
-func assertRelaxedRequiredFields(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	t.Helper()
-	assertNoValidationFinding(t, diags)
-	byName := map[string]ir.Operation{}
-	for _, op := range allOperations(doc) {
-		byName[op.Name.Source] = op
-	}
-	send := byName["sendEvent"]
-	assert.Empty(t, send.Responses, "no responses declared, none lowered")
-	assert.Empty(t, send.Errors)
-
-	list := byName["listEvents"]
-	require.Len(t, list.Responses, 1)
-	assert.Empty(t, list.Responses[0].Docs.Description)
-	assert.Len(t, list.Responses[0].Headers, 1)
-	require.Len(t, list.Errors, 1, "the component response lowers at its status")
-	assert.Empty(t, list.Errors[0].Docs.Description)
-	require.NotNil(t, list.Errors[0].Payload)
-}
-
-// assertEmptyRequestContent pins a request body whose content map is empty: it
-// lowers to a Payload naming no media type that keeps whether it must be sent,
-// its description and its x-*, and is warned once at each declaration,
-// whichever operations share it (GitHub #622).
-func assertEmptyRequestContent(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	t.Helper()
-	const code = "openapi/empty-request-content"
-	byName := map[string]ir.Operation{}
-	for _, op := range allOperations(doc) {
-		byName[op.Name.Source] = op
-	}
-	inline := byName["postInline"].Request
-	require.NotNil(t, inline)
-	assert.Empty(t, inline.Contents)
-	assert.Equal(t, new(true), inline.Required)
-	assert.Equal(t, "A body naming no media type.", inline.Docs.Description)
-	assert.Contains(t, inline.Unmodeled, "openapi:x-origin")
-	for _, name := range []string{"postShared", "putShared"} {
-		shared := byName[name].Request
-		require.NotNil(t, shared, name)
-		assert.Empty(t, shared.Contents, name)
-	}
-	n := 0
-	for _, d := range diags {
-		if d.Code == code {
-			n++
-		}
-	}
-	assert.Equal(t, 2, n, "two declarations, two reports: %+v", diags)
-	for _, at := range []string{"/paths/~1inline/post/requestBody/content", "/components/requestBodies/Empty/content"} {
-		assert.Equal(t, []ir.Severity{ir.SeverityWarning}, diagsAt(diags, code, at), at)
-	}
-}
-
-// assertOAuthFlowFields pins that a URL written on a flow whose kind does not
-// define it is kept in that flow's Unmodeled, in no IR slot, and announced once
-// at its own pointer, and that scopes keep the order the document writes them
-// (GitHub #865, #639).
-func assertOAuthFlowFields(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
-	t.Helper()
-	byName := make(map[string]ir.AuthScheme, len(doc.Auth))
-	for _, s := range doc.Auth {
-		byName[s.Name.Source] = s
-	}
-	const e = "https://example.com/"
-	cases := []struct {
-		kind, keyword, field string
-		// authorize and token are what the flow's own fields lower to; stray is
-		// the undefined field's value as the document wrote it.
-		authorize, token, stray string
-	}{
-		{"authorization_code", "authorizationCode", "deviceAuthorizationUrl", e + "authorize", e + "token", e + "device-undefined"},
-		{"client_credentials", "clientCredentials", "authorizationUrl", "", e + "token", e + "authorize-undefined"},
-		{"implicit", "implicit", "tokenUrl", e + "authorize", "", e + "token-undefined"},
-		{"device", "deviceAuthorization", "authorizationUrl", e + "device", e + "token", e + "authorize-undefined"},
-	}
-	flows := map[string]ir.OAuthFlow{}
-	for _, fl := range byName["flowFields"].Flows {
-		flows[fl.Kind] = fl
-	}
-	require.Len(t, flows, len(cases), "every declared flow lowers")
-	for _, tc := range cases {
-		fl := flows[tc.kind]
-		pointer := "/components/securitySchemes/flowFields/flows/" + tc.keyword + "/" + tc.field
-		assert.Equal(t, tc.authorize, fl.AuthorizationURL, "%s: only a defined field fills this slot", tc.kind)
-		assert.Equal(t, tc.token, fl.TokenURL, "%s: only a defined field fills this slot", tc.kind)
-		require.Len(t, fl.Unmodeled, 1, "%s keeps its one undefined field: %v", tc.kind, fl.Unmodeled)
-		kept, ok := fl.Unmodeled["openapi:"+tc.field]
-		require.True(t, ok, "%s keeps %s; got %v", tc.kind, tc.field, fl.Unmodeled)
-		assert.Equal(t, ir.ReasonDegradedLowering, kept.Reason)
-		assert.Equal(t, ir.RawValue(`"`+tc.stray+`"`), kept.Value)
-		assert.Equal(t, jsontext.Pointer(pointer), kept.Provenance.Pointer)
-		assert.Equal(t, []ir.Severity{ir.SeverityInfo}, diagsAt(diags, diag.DegradedConstruct, pointer),
-			"%s: announced once at the field", tc.kind)
-	}
-	var announced int
-	for _, d := range diags {
-		if d.Code == diag.DegradedConstruct {
-			announced++
-		}
-	}
-	assert.Equal(t, len(cases), announced, "one announcement per kept field: %+v", diags)
-
-	scoped := byName["scopeOrder"].Flows
-	require.Len(t, scoped, 1)
-	assert.Empty(t, cmp.Diff([]ir.OAuthScope{
-		{Name: "write", Description: "Modify data"},
-		{Name: "read", Description: "Read data"},
-		{Name: "admin", Description: "Full access"},
-	}, scoped[0].Scopes), "scopes keep source order")
-}
-
-func assertSecurityOrAnd(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
-	require.Len(t, doc.Services, 1)
-	auth := doc.Services[0].Auth
-	require.Len(t, auth, 3, "OR of three options in source order")
-	assert.Len(t, auth[0].Schemes, 1)
-	assert.Len(t, auth[1].Schemes, 2, "the ANDed option requires two schemes together")
-	assert.Empty(t, auth[2].Schemes, "the empty option means no auth is acceptable")
-	op, ok := opByName(doc, "publicOp")
-	require.True(t, ok)
-	assert.Empty(t, op.Auth, "security: [] makes the operation explicitly public")
-}
-
-// assertReachedOutsideModel pins that an object written under an x- key is
-// checked as one the model declares when a $ref reaches it, a discriminator
-// mapping names it, or a $ref nested in such an object does (GitHub #872):
-// each construct OpenAPI 3.2 added draws its warning once, at the pointer it is
-// written at, and a finding about a scheme reached that way is placed where its
-// field is written, as for the scheme written inline (#879).
-func assertReachedOutsideModel(t *testing.T, _ *ir.Document, diags []ir.Diagnostic) {
-	t.Helper()
-	const later = "openapi/later-version-construct"
-	written := []string{
-		"/x-lib/Pet/xml/nodeType", "/x-lib/Owner/xml/nodeType", "/x-lib/Cat/xml/nodeType", "/x-responses/Listed/summary",
-	}
-	for _, at := range written {
-		assert.Equal(t, []ir.Severity{ir.SeverityWarning}, diagsAt(diags, later, at), "%s", at)
-	}
-	n := 0
-	for _, d := range diags {
-		if d.Code == later {
-			n++
-		}
-	}
-	assert.Equal(t, len(written), n, "one warning per construct, none elsewhere: %+v", diags)
-	assert.Equal(t, []ir.Severity{ir.SeverityWarning},
-		diagsAt(diags, "openapi/validation/validation-type-mismatch", "/x-schemes/key/description"),
-		"the table's finding on the reached scheme, where the field is written (GitHub #879)")
-}
diff --git a/compilers/openapi/e2e/conformance_types_test.go b/compilers/openapi/e2e/conformance_types_test.go
new file mode 100644
index 00000000..c0382b53
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_types_test.go
@@ -0,0 +1,567 @@
+package e2e_test
+
+import (
+	"encoding/json/jsontext"
+	"maps"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertNamedTypes(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	user, ok := doc.Types[namedID("User")].(*ir.Model)
+	require.True(t, ok, "named schema User present under its pointer-derived ID")
+	assert.False(t, user.Anonymous)
+	addr, ok := propByWire(user, "address")
+	require.True(t, ok)
+	assert.Equal(t, namedID("Address"), addr.Type.Target)
+	_, ok = doc.Types[namedID("Address")].(*ir.Model)
+	assert.True(t, ok, "referenced Address resolves in the registry")
+}
+
+// assertNeutralNaming covers invariant 4's second half: Naming.Canonical is a
+// neutral word sequence whatever the source spelled the word boundaries as.
+// Real specs use dots (namespaced components, versioned fields, enum values),
+// brackets (deep-object query parameters) and hyphens (headers), so this spec
+// writes each where a segmentation fault would show. Naming.Hint is covered by
+// the same spec: its context strings carry the punctuation, and a hint such as
+// "rollout.state" is a name no emitter can render (GitHub #54).
+func assertNeutralNaming(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	require.Len(t, doc.Services, 1)
+	svc := doc.Services[0]
+	assert.Equal(t, "neutral_naming_api", svc.Name.Canonical, "info.title")
+	require.Len(t, svc.Groups, 1)
+	assert.Equal(t, "inventory_core", svc.Groups[0].Name.Canonical, "tag")
+
+	op, ok := opByName(doc, "widgets.list")
+	require.True(t, ok, "operation present under its source operationId")
+	assert.Equal(t, "widgets_list", op.Name.Canonical, "operationId")
+	byParam := map[string]string{}
+	for _, p := range op.Params {
+		byParam[p.Name.Source] = p.Name.Canonical
+	}
+	assert.Equal(t, "widget_id", byParam["widget.id"], "path parameter")
+	assert.Equal(t, "filter_name", byParam["filter[name]"], "bracketed query parameter")
+
+	widget, ok := doc.Types[namedID("com.example.Widget")].(*ir.Model)
+	require.True(t, ok, "namespaced component keeps its pointer-derived ID")
+	assert.Equal(t, "com_example_widget", widget.Name.Canonical, "component name")
+	assert.Equal(t, "com.example.Widget", widget.Name.Source, "the source spelling is kept beside it")
+	name, ok := propByWire(widget, "widget.name")
+	require.True(t, ok)
+	assert.Equal(t, "widget_name", name.Name.Canonical, "property name")
+	version, ok := propByWire(widget, "api.version.v2")
+	require.True(t, ok)
+	assert.Equal(t, "api_version_v_2", version.Name.Canonical,
+		"the letter/digit boundary still splits inside a dotted segment")
+
+	assertNeutralNamingLeaves(t, doc, widget, op)
+}
+
+// assertNeutralNamingLeaves checks the three canonicals that hang off another
+// node rather than off the service walk: an enum member under a property, a
+// header under a response, a scheme in the auth registry.
+func assertNeutralNamingLeaves(t *testing.T, doc *ir.Document, widget *ir.Model, op ir.Operation) {
+	t.Helper()
+	state, ok := propByWire(widget, "rollout.state")
+	require.True(t, ok)
+	rollout, ok := doc.Types[state.Type.Target].(*ir.Enum)
+	require.True(t, ok, "the enum property hoists an Enum node")
+	require.NotEmpty(t, rollout.Members)
+	assert.Equal(t, "in_progress", rollout.Members[0].Name.Canonical, "enum member")
+	assert.Equal(t, "rollout_state", rollout.Name.Hint,
+		"the hoisted node's hint is words too, not the property key verbatim")
+
+	require.Len(t, op.Responses, 1)
+	require.Len(t, op.Responses[0].Headers, 1)
+	assert.Equal(t, "x_rate_limit", op.Responses[0].Headers[0].Name.Canonical, "response header")
+
+	require.Len(t, doc.Auth, 1)
+	for _, scheme := range doc.Auth {
+		assert.Equal(t, "oauth_2_client", scheme.Name.Canonical, "security scheme")
+	}
+}
+
+// assertEmptyNames is the complement of assertNeutralNaming: every position
+// where the source names an entity with the empty string, which is a legal
+// OpenAPI document at each of them. The compiler used to pass "" through as a
+// Naming with nothing in any channel, leaving an emitter no identifier to render
+// and satisfying every neutrality check vacuously (GitHub #251). Each of these
+// now carries the minted hint instead, and irverify's presence rule — swept over
+// this corpus by TestVerify_Corpus — is what holds the general case.
+func assertEmptyNames(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	require.Len(t, doc.Services, 1)
+	require.Len(t, doc.Services[0].Groups, 1)
+	assert.Equal(t, "empty", doc.Services[0].Groups[0].Name.Hint, "tag declared as \"\"")
+
+	require.Len(t, doc.Auth, 1)
+	for _, scheme := range doc.Auth {
+		assert.Equal(t, "empty", scheme.Name.Hint, "security scheme keyed \"\"")
+	}
+
+	blank, ok := doc.Types[ir.TypeID("t/anon/components/schemas/")]
+	require.True(t, ok, "a component schema keyed \"\" is hoisted at its own pointer")
+	assert.Equal(t, "empty", blank.Common().Name.Hint, "component schema keyed \"\"")
+
+	assertEmptyEnumMember(t, doc)
+	assertEmptyNamedProperty(t, doc)
+	assertEmptyDerivedHints(t, doc)
+}
+
+// assertEmptyEnumMember covers the enum member the issue was reported against,
+// and beside it the collision the minted word can cause: "" and "empty" are two
+// distinct values, and a member named for each lands on the same word.
+//
+// The IR keeps them apart — two members, two values, one in each name channel —
+// because uniquifying identifiers is an emitter's job and always has been:
+// "red" and "Red" already canonicalize to the same words. This pins that the
+// minted name does not merge or drop a member, which is the only part of the
+// collision the IR is answerable for.
+func assertEmptyEnumMember(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	rollout, ok := doc.Types[namedID("Rollout")].(*ir.Enum)
+	require.True(t, ok)
+	require.Len(t, rollout.Members, 3, "no member is merged away by the shared word")
+
+	assert.Equal(t, "empty", rollout.Members[0].Name.Hint, "enum member whose value is \"\"")
+	assert.Empty(t, rollout.Members[0].Name.Source, "nothing is fabricated into the source channel")
+	assert.Empty(t, rollout.Members[0].Value.Str, "the value itself is kept as the empty string")
+
+	declared := rollout.Members[1]
+	assert.Equal(t, "empty", declared.Name.Source, "a member whose value really is \"empty\"")
+	assert.Equal(t, "empty", declared.Name.Canonical, "named through the declared channels, not the hint")
+	assert.Empty(t, declared.Name.Hint)
+
+	assert.Equal(t, "done", rollout.Members[2].Name.Source, "the ordinary sibling is unaffected")
+}
+
+// assertEmptyNamedProperty covers the two entities one property keyed "" makes:
+// the property, and the inline schema hoisted at its position, whose context
+// hint is derived from the same empty name.
+func assertEmptyNamedProperty(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	widget, ok := doc.Types[namedID("Widget")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, widget.Properties, 1)
+	prop := widget.Properties[0]
+	assert.Equal(t, "empty", prop.Name.Hint, "property keyed \"\"")
+	assert.Empty(t, prop.WireName, "the wire key itself is still the empty string")
+
+	inline, ok := doc.Types[prop.Type.Target]
+	require.True(t, ok, "the property's inline object is hoisted")
+	assert.Equal(t, ir.TypeID("t/anon/components/schemas/Widget/properties/"), prop.Type.Target)
+	assert.Equal(t, "empty", inline.Common().Name.Hint,
+		"a hint derived from an empty position is minted, not passed through empty")
+}
+
+// composedHints is every node in the corpus spec whose hint is built out of an
+// enclosing node's. Each pairs an unnamed position with the role or index that
+// distinguishes the child from its siblings — a list element, a map value, a
+// pattern group, a tuple slot or rest, an enum branch, a composed union
+// variant. A slice rather than a map so a failure names them in a fixed order.
+var composedHints = []struct {
+	id   ir.TypeID
+	hint string
+}{
+	{"t/anon/components/schemas/List/properties//items", "empty_item"},
+	{"t/anon/components/schemas/Maps/properties//additionalProperties", "empty_value"},
+	{"t/anon/components/schemas/Patterns/properties//patternProperties/^x", "empty_pattern"},
+	{"t/anon/components/schemas/Tuple/properties//prefixItems/0", "empty_0"},
+	{"t/anon/components/schemas/Tuple/properties//items", "empty_item"},
+	{"t/anon/components/schemas/Mixed/properties//enum/0", "empty_0"},
+	{"t/anon/components/schemas/Mixed/properties//enum/1", "empty_1"},
+	{"t/composed/components/schemas/Host/properties//oneOf/0", "empty_alt"},
+}
+
+// assertEmptyDerivedHints covers hints a child composes from an enclosing
+// node's. Concatenating onto an empty hint once yielded a leading "_", which is
+// non-empty so irverify's presence check passes it, yet no grammar produces it.
+//
+// composedHints has no row for contentSchema, which an empty-named property
+// reaches (#743). The sequential media type's itemSchema cannot need one: both
+// callers of lowerPayload pass a non-empty hint, since ids.ComponentEntry
+// refuses a component keyed "" and the fallbacks are "response" and "request".
+// A composed variant of an inline branch is absent too:
+// docs/compilers/openapi.md#union-beside-structure keeps that union verbatim,
+// so only the $ref form the Host case uses reaches composedVariant.
+func assertEmptyDerivedHints(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	mixed, ok := doc.Types[namedID("Mixed")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, mixed.Properties, 1)
+	union, ok := doc.Types[mixed.Properties[0].Type.Target].(*ir.Union)
+	require.True(t, ok, "a heterogeneous enum lowers to a union of literals")
+	assert.Equal(t, "empty", union.Name.Hint, "the enclosing node keeps the plain minted hint")
+
+	for _, tc := range composedHints {
+		node, found := doc.Types[tc.id]
+		require.True(t, found, "no node at %s; the composition site moved", tc.id)
+		assert.Equal(t, tc.hint, node.Common().Name.Hint, "composed hint at %s", tc.id)
+	}
+}
+
+func assertInlineTypes(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	order, ok := doc.Types[namedID("Order")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, order.Properties, 1)
+	shipping := order.Properties[0]
+	// hoisted exactly once, under its pointer-derived anonymous ID.
+	assert.Equal(t, ir.TypeID("t/anon/components/schemas/Order/properties/shipping"),
+		shipping.Type.Target)
+	inline, ok := doc.Types[shipping.Type.Target].(*ir.Model)
+	require.True(t, ok, "the inline object was hoisted as its own type")
+	assert.True(t, inline.Anonymous)
+	assert.Equal(t, "shipping", inline.Name.Hint)
+}
+
+// assertInlineHoistPositions pins the six operation-side positions an inline
+// composite can be declared at against the ID each one's source pointer derives.
+// Neither inline-types.yaml nor the inlinePositions table in
+// compilers/openapi/internal/schema reaches a parameter, response header,
+// webhook or callback, which are lowered a layer up.
+//
+// The referring site must point at the derived ID, which a moved position
+// changes. The six targets must also be six distinct nodes, which survives a
+// synchronized edit: a hoist collapsing identical bodies and an updated
+// expectation would otherwise agree. The fixture writes one body at all six so a
+// collapse is reachable.
+func assertInlineHoistPositions(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	got := inlineHoistPositionRefs(t, doc)
+	if diff := cmp.Diff(inlineHoistPositionIDs(), got); diff != "" {
+		t.Errorf("hoisted node per source position (-want +got):\n%s", diff)
+	}
+
+	owner := map[ir.TypeID]string{}
+	for position, id := range got {
+		assert.NotContains(t, owner, id,
+			"the %s and %s positions share one node, %s", owner[id], position, id)
+		owner[id] = position
+
+		node, found := doc.Types[id]
+		require.True(t, found, "%s: nothing is interned at %s", position, id)
+		model, ok := node.(*ir.Model)
+		require.True(t, ok, "%s: the inline object hoisted as a model", position)
+		assert.True(t, model.Anonymous, "%s: a minted node is anonymous", position)
+		assert.Len(t, model.Properties, 1, "%s: it kept the body it was declared with", position)
+	}
+}
+
+// inlineHoistPositionIDs is the ID each position's source pointer derives,
+// spelled out so a node that moves to another pointer is a diff rather than a
+// silently different document.
+func inlineHoistPositionIDs() map[string]ir.TypeID {
+	const order = "t/anon/paths/~1orders/post"
+	return map[string]ir.TypeID{
+		"parameter schema":       order + "/parameters/0/schema",
+		"response-header schema": order + "/responses/200/headers/X-Order-Trace/schema",
+		"request-body property":  order + "/requestBody/content/application~1json/schema/properties/shipping",
+		"response-body property": order + "/responses/200/content/application~1json/schema/properties/receipt",
+		"webhook body":           "t/anon/webhooks/onShipped/post/requestBody/content/application~1json/schema",
+		"callback body": order + "/callbacks/onProgress/{$request.body#~1callbackUrl}" +
+			"/post/requestBody/content/application~1json/schema",
+	}
+}
+
+// inlineHoistPositionRefs reads back what each declaring site actually refers
+// to. It walks from the operation rather than from doc.Types so a node interned
+// at the right ID but wired to nothing still fails.
+func inlineHoistPositionRefs(t *testing.T, doc *ir.Document) map[string]ir.TypeID {
+	t.Helper()
+	order, ok := opByName(doc, "placeOrder")
+	require.True(t, ok)
+	audit, ok := paramByName(order, "audit")
+	require.True(t, ok, "the operation declares its inline-schema parameter")
+	require.Len(t, order.Responses, 1)
+	require.Len(t, order.Responses[0].Headers, 1, "the response declares its inline-schema header")
+	webhook, ok := opByName(doc, "onShipped")
+	require.True(t, ok, "the webhook operation is registered")
+	callback, ok := opByName(doc, "onProgress")
+	require.True(t, ok, "the callback operation is registered")
+
+	return map[string]ir.TypeID{
+		"parameter schema":       audit.Type.Target,
+		"response-header schema": order.Responses[0].Headers[0].Type.Target,
+		"request-body property":  inlinePropTarget(t, doc, openapitest.BodyTarget(t, order.Request), "shipping"),
+		"response-body property": inlinePropTarget(t, doc, openapitest.BodyTarget(t, order.Responses[0].Payload), "receipt"),
+		"webhook body":           openapitest.BodyTarget(t, webhook.Request),
+		"callback body":          openapitest.BodyTarget(t, callback.Request),
+	}
+}
+
+// inlinePropTarget returns the type the named property of the model at id refers
+// to — the body-property positions, one level inside a body root.
+func inlinePropTarget(t *testing.T, doc *ir.Document, id ir.TypeID, wire string) ir.TypeID {
+	t.Helper()
+	model, ok := doc.Types[id].(*ir.Model)
+	require.True(t, ok, "the body at %s hoisted as a model", id)
+	prop, ok := propByWire(model, wire)
+	require.True(t, ok, "the body declares the property %q", wire)
+	return prop.Type.Target
+}
+
+// assertSharedResponseAcrossStatus reads the one shape that puts lowerResponse
+// and lowerErrorCase on the same declaration: a components/responses entry
+// mounted at both a success and an error status. Both intern the body type at
+// the component's pointer, so the two mints race for it and the loser's naming
+// hint is discarded, which the order-invariance oracle reports as an
+// order-dependent registry. The hint derives from the declaration pointer, the
+// same whichever side reaches it first. No other corpus spec reaches one
+// response component from both sides, so the oracle needs this one to ask.
+func assertSharedResponseAcrossStatus(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	op := operationAt(t, doc, "GET", "/widgets")
+	require.Len(t, op.Responses, 1, "the success mount")
+	require.Len(t, op.Errors, 1, "and the error mount, of the one component")
+
+	success := op.Responses[0].Payload.Contents[0].Type.Target
+	failure := op.Errors[0].Payload.Contents[0].Type.Target
+	assert.Equal(t, success, failure, "one declaration is one type, reached from either status")
+
+	td, ok := doc.Types[success]
+	require.True(t, ok)
+	assert.Equal(t, "envelope", td.Common().Name.Hint,
+		"the hint comes from the declaration, not from whichever status class minted it first")
+
+	created := operationAt(t, doc, "POST", "/widgets").Responses[0].Payload.Contents[0].Type.Target
+	rejected := operationAt(t, doc, "POST", "/gadgets").Errors[0].Payload.Contents[0].Type.Target
+	assert.Equal(t, created, rejected, "a path-pointer $ref reaches the same one type")
+	td, ok = doc.Types[created]
+	require.True(t, ok)
+	assert.Equal(t, "response", td.Common().Name.Hint,
+		"with no component to name it, both sides fall back to the one word")
+}
+
+// assertComponentReuse covers the non-schema half of `$ref`: OpenAPI lets a
+// parameter, requestBody, response, header, callback, or whole path item be
+// declared once under components and referenced from many operations. Each
+// lowers at its declaration, so the shared node is interned once however many
+// operations reach it, while the operations that reach it stay distinct.
+func assertComponentReuse(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	widgets := operationAt(t, doc, "GET", "/widgets")
+	gadgets := operationAt(t, doc, "GET", "/gadgets")
+	order := operationAt(t, doc, "POST", "/orders")
+	assert.NotEqual(t, widgets.ID, gadgets.ID, "one path item mounted twice is two operations")
+	assert.Equal(t, widgets.Provenance.Pointer, gadgets.Provenance.Pointer,
+		"...both written at the one component that declares them")
+
+	// Every hoisted type in this document belongs to a component declaration:
+	// no operation contributes a pointer of its own, because none declares a
+	// schema of its own.
+	for id, td := range doc.Types {
+		if td.Common().Provenance.Pointer == "" {
+			continue // shared primitives are pointerless by construction
+		}
+		assert.True(t, strings.HasPrefix(string(td.Common().Provenance.Pointer), "/components/"),
+			"type %s hoists at a component declaration, not a use site", id)
+	}
+
+	sortID := ir.TypeID("t/anon/components/parameters/Sort/schema")
+	require.Len(t, widgets.Params, 1)
+	require.Len(t, gadgets.Params, 1)
+	assert.Equal(t, sortID, widgets.Params[0].Type.Target)
+	assert.Equal(t, sortID, gadgets.Params[0].Type.Target, "the shared parameter interns once")
+
+	listedID := ir.TypeID("t/anon/components/responses/Listed/content/application~1json/schema")
+	assert.Equal(t, listedID, openapitest.BodyTarget(t, widgets.Responses[0].Payload))
+	assert.Equal(t, listedID, openapitest.BodyTarget(t, order.Responses[0].Payload),
+		"a response reused across unrelated operations interns once")
+
+	bodyID := ir.TypeID("t/anon/components/requestBodies/OrderBody/content/application~1json/schema")
+	require.NotNil(t, order.Request)
+	assert.Equal(t, bodyID, openapitest.BodyTarget(t, order.Request))
+	assert.Equal(t, "order_body", doc.Types[bodyID].Common().Name.Hint,
+		"a shared body is named after its component, not the operation that reached it first")
+
+	require.Len(t, widgets.Responses[0].Headers, 1)
+	header := widgets.Responses[0].Headers[0]
+	assert.Equal(t, ir.TypeID("t/anon/components/headers/RateUnit/schema"), header.Type.Target)
+	assert.Equal(t, jsontext.Pointer("/components/responses/Listed/headers/X-Rate-Unit"), header.Provenance.Pointer,
+		"the header's identity is the map entry that binds its name")
+
+	require.Len(t, order.Bindings.HTTP[0].Callbacks, 1)
+	assert.Equal(t, "{$request.body#/callbackUrl}", order.Bindings.HTTP[0].Callbacks[0].Expression)
+	_, ok := opByName(doc, "onShipped")
+	assert.True(t, ok, "the shared callback's operation is registered alongside its parent")
+}
+
+func assertReadOnlyWriteOnly(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+	r, ok := propByWire(m, "r")
+	require.True(t, ok)
+	w, ok := propByWire(m, "w")
+	require.True(t, ok)
+	assert.Equal(t, ir.Visibility{Only: []ir.Lifecycle{ir.LifecycleRead, ir.LifecycleDelete, ir.LifecycleQuery}}, r.Visibility)
+	assert.Equal(t, ir.Visibility{Only: []ir.Lifecycle{ir.LifecycleCreate, ir.LifecycleUpdate}}, w.Visibility)
+
+	// A declaration-site readOnly reaches the referencing property, and the
+	// declaration keeps it verbatim because the type node has no field for it.
+	viaRef, ok := propByWire(m, "viaRef")
+	require.True(t, ok)
+	assert.Equal(t, r.Visibility, viaRef.Visibility, "the referent's readOnly binds the reference site")
+
+	decl, ok := doc.Types[namedID("DeclaredReadOnly")].(*ir.Scalar)
+	require.True(t, ok)
+	entry, ok := decl.Unmodeled["openapi:readOnly"]
+	require.True(t, ok, "the declaration's own readOnly is kept as residue")
+	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+	assert.JSONEq(t, `true`, string(entry.Value))
+
+	assertBothFlagsAreVisibleNowhere(t, m, diags)
+}
+
+// assertBothFlagsAreVisibleNowhere pins the contradictory pairing in both its
+// spellings: written on one schema, and written across a $ref that already
+// carries the other flag. Each admits no lifecycle at all and each is reported,
+// where declaring both used to lower exactly as readOnly alone did and say
+// nothing (GitHub #276).
+func assertBothFlagsAreVisibleNowhere(t *testing.T, m *ir.Model, diags []ir.Diagnostic) {
+	t.Helper()
+	for _, wire := range []string{"both", "bothViaRef"} {
+		p, ok := propByWire(m, wire)
+		require.True(t, ok)
+		assert.Equal(t, ir.Visibility{None: true}, p.Visibility,
+			"readOnly and writeOnly both in force admit no lifecycle: %s", wire)
+		assert.Equal(t, []ir.Severity{ir.SeverityWarning},
+			diagsAt(diags, diag.DisjointVisibility, "/components/schemas/S/properties/"+wire),
+			"the contradiction is reported once, at the position that wrote it: %s", wire)
+	}
+}
+
+func assertRecursive(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	n, ok := doc.Types[namedID("Node")].(*ir.Model)
+	require.True(t, ok)
+	next, ok := propByWire(n, "next")
+	require.True(t, ok)
+	assert.Equal(t, namedID("Node"), next.Type.Target, "self-reference terminates on the interned ID")
+}
+
+// assertMaps pins ir-design §4.6's line between the two map shapes: an object
+// whose one member fact is its catch-all is a MapT, carrying its value type and
+// entry bounds, and a catch-all beside anything else is a Model's
+// AdditionalProps. An explicit `true` types the catch-all as the top type in
+// either.
+func assertMaps(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	i64 := func(v int64) *int64 { return &v }
+	for name, want := range map[string]*ir.MapT{
+		"OpenMap":    {Value: ir.TypeRef{Target: "t/prim/integer"}},
+		"AnyMap":     {Value: ir.TypeRef{Target: "t/prim/any"}},
+		"BoundedMap": {Value: ir.TypeRef{Target: "t/prim/string"}, Constraints: &ir.Constraints{MinProps: i64(1), MaxProps: i64(10)}},
+	} {
+		mt, ok := doc.Types[namedID(name)].(*ir.MapT)
+		require.True(t, ok, "%s is a map and nothing else; got %T", name, doc.Types[namedID(name)])
+		assert.Nil(t, mt.Key, "%s has string keys", name)
+		assert.Equal(t, want.Value, mt.Value, name)
+		assert.Empty(t, cmp.Diff(want.Constraints, mt.Constraints), name)
+	}
+	pm, ok := doc.Types[namedID("PatternMap")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, pm.AdditionalProps)
+	require.Len(t, pm.AdditionalProps.Patterns, 1)
+	assert.Equal(t, "^x-", pm.AdditionalProps.Patterns[0].Pattern)
+	rec, ok := doc.Types[namedID("OpenRecord")].(*ir.Model)
+	require.True(t, ok)
+	require.NotNil(t, rec.AdditionalProps, "an explicit true is a catch-all, not an unwritten keyword")
+	assert.Equal(t, ir.TypeRef{Target: "t/prim/any"}, rec.AdditionalProps.Value)
+	cr, ok := doc.Types[namedID("ClosedRecord")].(*ir.Model)
+	require.True(t, ok)
+	assert.Equal(t, ir.AdditionalClosed, cr.Additional)
+	ca, ok := doc.Types[namedID("ClosedAfter")].(*ir.Model)
+	require.True(t, ok)
+	assert.Equal(t, ir.AdditionalClosedAfterComposition, ca.Additional)
+}
+
+// assertTuples pins what each prefixItems tuple admits past its elements and
+// the bounds beside them (GitHub #597). Only `items: false` closes a tuple, and
+// a typed rest is lowered into the type graph as a List's items is, at the same
+// pointer and under the same hint. All of it is modeled, so no tuple keeps
+// anything beside itself or reports a degradation.
+func assertTuples(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	t.Helper()
+	i64 := func(v int64) *int64 { return &v }
+	pair := []ir.TypeRef{{Target: "t/prim/string"}, {Target: "t/prim/integer"}}
+	restID := ir.TypeID("t/anon/components/schemas/PairWithRest/items")
+	for _, tc := range []struct {
+		name   string
+		elems  []ir.TypeRef
+		rest   ir.TypeID // "" = no element may follow
+		bounds *ir.Constraints
+	}{
+		{"ClosedPair", pair, "", nil},
+		{"Pair", pair, "t/prim/any", nil},
+		{"PairWithRest", pair[:1], restID, nil},
+		{"ExactPair", pair, "", &ir.Constraints{MinItems: i64(2)}},
+		{"BoundedClosedPair", pair, "", &ir.Constraints{MinItems: i64(1), MaxItems: i64(2), UniqueItems: true}},
+	} {
+		tup, ok := doc.Types[namedID(tc.name)].(*ir.Tuple)
+		require.True(t, ok, "%s: prefixItems hoists a Tuple; got %T", tc.name, doc.Types[namedID(tc.name)])
+		assert.Equal(t, tc.elems, tup.Elems, tc.name)
+		if tc.rest == "" {
+			assert.Nil(t, tup.Rest, "%s: no element may follow the head", tc.name)
+		} else if assert.NotNil(t, tup.Rest, tc.name) {
+			assert.Equal(t, tc.rest, tup.Rest.Target, tc.name)
+		}
+		assert.Equal(t, tc.bounds, tup.Constraints, tc.name)
+		assert.Empty(t, tup.Unmodeled, "%s: a modeled rest keeps nothing beside it", tc.name)
+		assert.Empty(t, diagsAt(diags, "openapi/degraded-construct", "/components/schemas/"+tc.name), tc.name)
+	}
+
+	rest, ok := doc.Types[restID].(*ir.Model)
+	require.True(t, ok, "the inline rest is hoisted at its own pointer; got %T", doc.Types[restID])
+	assert.Equal(t, "pair_with_rest_item", rest.Name.Hint, "named as a List's items would be")
+	_, ok = propByWire(rest, "flag")
+	assert.True(t, ok, "the rest's own properties reach the IR")
+}
+
+func assertLiteralConst(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	l, ok := doc.Types[namedID("Version")].(*ir.Literal)
+	require.True(t, ok, "const hoists a Literal")
+	assert.Equal(t, ir.ValueString, l.Value.Kind)
+	assert.Equal(t, "v1", l.Value.Str)
+
+	// An unrepresentable const still hoists a node, and a node that admits any
+	// value is the only honest one: a Literal here would have to invent a value.
+	_, ok = doc.Types[namedID("Opaque")].(*ir.Any)
+	assert.True(t, ok, "an unconvertible const hoists the top type; got %T", doc.Types[namedID("Opaque")])
+	assert.Equal(t, []ir.Severity{ir.SeverityWarning},
+		diagsAt(diags, "openapi/degraded-construct", "/components/schemas/Opaque"),
+		"degrading a declared value is a warning, not silent")
+}
+
+// assertUnreferencedComponents pins GitHub #616: every component entry no
+// lowering followed a reference to is kept verbatim on the document, under the
+// section and name it was declared with, a link a lowered response names among
+// them, while the entry the paths do name lowers as it always did. No matrix
+// row: the case is a preservation claim.
+func assertUnreferencedComponents(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	for _, section := range []string{
+		"responses", "parameters", "examples", "requestBodies",
+		"headers", "links", "callbacks", "pathItems",
+	} {
+		key := "openapi:components/" + section + "/Unused"
+		entry, ok := doc.Unmodeled[key]
+		require.True(t, ok, "%s is kept verbatim; got %v", section, slices.Sorted(maps.Keys(doc.Unmodeled)))
+		assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+		assert.Equal(t, "/components/"+section+"/Unused", string(entry.Provenance.Pointer),
+			"the entry is located at its own declaration, not at the carrier holding it")
+	}
+	assert.NotContains(t, doc.Unmodeled, "openapi:components/responses/Used",
+		"an entry a reference reaches is lowered, not also kept verbatim")
+	assert.Contains(t, doc.Unmodeled, "openapi:components/links/Next",
+		"a link the lowered response's links map names is kept: nothing follows that reference")
+	assert.Contains(t, doc.Unmodeled, "openapi:components/mediaTypes",
+		"3.2's mediaTypes is kept whole until a reference into it is followed (GitHub #856)")
+
+	op, ok := opByName(doc, "getA")
+	require.True(t, ok)
+	require.Len(t, op.Responses, 1)
+	assert.Equal(t, "reached from the paths", op.Responses[0].Docs.Description)
+	assert.False(t, openapitest.HasDiag(diags, diag.UnknownObjectKey))
+}
diff --git a/compilers/openapi/e2e/conformance_validation_test.go b/compilers/openapi/e2e/conformance_validation_test.go
new file mode 100644
index 00000000..1e6fc143
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_validation_test.go
@@ -0,0 +1,131 @@
+package e2e_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/ir"
+)
+
+// assertNoValidationFinding requires that the rule table reported nothing
+// about the document, which is what the required-field cases below are about.
+func assertNoValidationFinding(t *testing.T, diags []ir.Diagnostic) {
+	t.Helper()
+	for _, d := range diags {
+		assert.False(t, strings.HasPrefix(d.Code, diag.Validation+"/"), "unexpected validation finding: %+v", d)
+	}
+}
+
+// assertEmptyRequiredValues pins that a REQUIRED field written as the empty
+// string, which every minor's schema admits, is no finding and lowers as
+// written: the empty server URL, the parameter the document named "", and each
+// security scheme with an empty name or URL (GitHub #622).
+func assertEmptyRequiredValues(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	t.Helper()
+	assertNoValidationFinding(t, diags)
+	require.Len(t, doc.Servers, 2)
+	assert.Empty(t, doc.Servers[0].URLTemplate)
+	require.Len(t, doc.Servers[1].Variables, 2)
+	assert.Equal(t, "base", doc.Servers[1].Variables[1].Name)
+
+	ops := allOperations(doc)
+	require.Len(t, ops, 1)
+	require.Len(t, ops[0].Params, 1)
+	assert.Equal(t, ir.Naming{Hint: "empty"}, ops[0].Params[0].Name, "the empty name is minted a hint")
+	require.Len(t, ops[0].Responses, 1)
+	assert.Empty(t, ops[0].Responses[0].Docs.Description)
+
+	require.Len(t, doc.Auth, 3, "every scheme interns")
+	assert.Len(t, doc.Auth["auth/openapi/components/securitySchemes/oauth"].Flows, 4)
+	assert.Equal(t, ir.AuthKindAPIKey, doc.Auth["auth/openapi/components/securitySchemes/key"].Kind)
+	assert.Equal(t, ir.AuthKindOpenIDConnect, doc.Auth["auth/openapi/components/securitySchemes/oidc"].Kind)
+}
+
+// assertRelaxedRequiredFields pins the two fields a minor stopped requiring,
+// left out of a 3.2 document: an operation declaring no responses lowers with
+// none, and a response declaring no description lowers undocumented, inline
+// and as a component alike (GitHub #622).
+func assertRelaxedRequiredFields(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	t.Helper()
+	assertNoValidationFinding(t, diags)
+	byName := map[string]ir.Operation{}
+	for _, op := range allOperations(doc) {
+		byName[op.Name.Source] = op
+	}
+	send := byName["sendEvent"]
+	assert.Empty(t, send.Responses, "no responses declared, none lowered")
+	assert.Empty(t, send.Errors)
+
+	list := byName["listEvents"]
+	require.Len(t, list.Responses, 1)
+	assert.Empty(t, list.Responses[0].Docs.Description)
+	assert.Len(t, list.Responses[0].Headers, 1)
+	require.Len(t, list.Errors, 1, "the component response lowers at its status")
+	assert.Empty(t, list.Errors[0].Docs.Description)
+	require.NotNil(t, list.Errors[0].Payload)
+}
+
+// assertEmptyRequestContent pins a request body whose content map is empty: it
+// lowers to a Payload naming no media type that keeps whether it must be sent,
+// its description and its x-*, and is warned once at each declaration,
+// whichever operations share it (GitHub #622).
+func assertEmptyRequestContent(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	t.Helper()
+	const code = "openapi/empty-request-content"
+	byName := map[string]ir.Operation{}
+	for _, op := range allOperations(doc) {
+		byName[op.Name.Source] = op
+	}
+	inline := byName["postInline"].Request
+	require.NotNil(t, inline)
+	assert.Empty(t, inline.Contents)
+	assert.Equal(t, new(true), inline.Required)
+	assert.Equal(t, "A body naming no media type.", inline.Docs.Description)
+	assert.Contains(t, inline.Unmodeled, "openapi:x-origin")
+	for _, name := range []string{"postShared", "putShared"} {
+		shared := byName[name].Request
+		require.NotNil(t, shared, name)
+		assert.Empty(t, shared.Contents, name)
+	}
+	n := 0
+	for _, d := range diags {
+		if d.Code == code {
+			n++
+		}
+	}
+	assert.Equal(t, 2, n, "two declarations, two reports: %+v", diags)
+	for _, at := range []string{"/paths/~1inline/post/requestBody/content", "/components/requestBodies/Empty/content"} {
+		assert.Equal(t, []ir.Severity{ir.SeverityWarning}, diagsAt(diags, code, at), at)
+	}
+}
+
+// assertReachedOutsideModel pins that an object written under an x- key is
+// checked as one the model declares when a $ref reaches it, a discriminator
+// mapping names it, or a $ref nested in such an object does (GitHub #872):
+// each construct OpenAPI 3.2 added draws its warning once, at the pointer it is
+// written at, and a finding about a scheme reached that way is placed where its
+// field is written, as for the scheme written inline (#879).
+func assertReachedOutsideModel(t *testing.T, _ *ir.Document, diags []ir.Diagnostic) {
+	t.Helper()
+	const later = "openapi/later-version-construct"
+	written := []string{
+		"/x-lib/Pet/xml/nodeType", "/x-lib/Owner/xml/nodeType", "/x-lib/Cat/xml/nodeType", "/x-responses/Listed/summary",
+	}
+	for _, at := range written {
+		assert.Equal(t, []ir.Severity{ir.SeverityWarning}, diagsAt(diags, later, at), "%s", at)
+	}
+	n := 0
+	for _, d := range diags {
+		if d.Code == later {
+			n++
+		}
+	}
+	assert.Equal(t, len(written), n, "one warning per construct, none elsewhere: %+v", diags)
+	assert.Equal(t, []ir.Severity{ir.SeverityWarning},
+		diagsAt(diags, "openapi/validation/validation-type-mismatch", "/x-schemes/key/description"),
+		"the table's finding on the reached scheme, where the field is written (GitHub #879)")
+}
diff --git a/compilers/openapi/e2e/conformance_values_test.go b/compilers/openapi/e2e/conformance_values_test.go
new file mode 100644
index 00000000..337c3273
--- /dev/null
+++ b/compilers/openapi/e2e/conformance_values_test.go
@@ -0,0 +1,380 @@
+package e2e_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/ir"
+)
+
+func assertDefaults(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+	n, ok := propByWire(m, "n")
+	require.True(t, ok)
+	require.NotNil(t, n.Default)
+	assert.Equal(t, ir.ValueNumber, n.Default.Kind)
+	assert.Equal(t, ir.BigVal("9007199254740993"), n.Default.Num)
+
+	// A declaration-site default reaches the referencing property, and the
+	// declaration keeps it verbatim because the type node has no field for it.
+	viaRef, ok := propByWire(m, "viaRef")
+	require.True(t, ok)
+	require.NotNil(t, viaRef.Default, "the referent's default binds the reference site")
+	assert.Equal(t, ir.BigVal("41"), viaRef.Default.Num)
+
+	decl, ok := doc.Types[namedID("DeclaredDefault")].(*ir.Scalar)
+	require.True(t, ok)
+	entry, ok := decl.Unmodeled["openapi:default"]
+	require.True(t, ok, "the declaration's own default is kept as residue")
+	assert.Equal(t, ir.ReasonNoIRHome, entry.Reason)
+	assert.JSONEq(t, `41`, string(entry.Value))
+
+	assertNonScalarDefaults(t, m)
+}
+
+// assertNonScalarDefaults pins the Value payloads a default reaches beyond string
+// and number: a boolean, a base64 !!binary scalar, and a sequence. Each selects a
+// different payload field, and Kind is what says which one carries meaning.
+func assertNonScalarDefaults(t *testing.T, m *ir.Model) {
+	t.Helper()
+	flag, ok := propByWire(m, "flag")
+	require.True(t, ok)
+	require.NotNil(t, flag.Default)
+	assert.Equal(t, ir.Value{Kind: ir.ValueBool, Bool: true}, *flag.Default)
+
+	blob, ok := propByWire(m, "blob")
+	require.True(t, ok)
+	require.NotNil(t, blob.Default)
+	assert.Equal(t, ir.ValueBytes, blob.Default.Kind)
+	assert.Equal(t, []byte("hi"), blob.Default.Bytes, "a !!binary default is decoded, not kept as text")
+
+	list, ok := propByWire(m, "list")
+	require.True(t, ok)
+	require.NotNil(t, list.Default)
+	assert.Equal(t, ir.ValueList, list.Default.Kind)
+	require.Len(t, list.Default.List, 2)
+	assert.Equal(t, ir.BigVal("1"), list.Default.List[0].Num)
+	assert.Equal(t, ir.BigVal("2"), list.Default.List[1].Num)
+}
+
+// assertYAMLTimestampScalars covers a YAML 1.1 quirk: an unquoted date like
+// 2021-01-01 resolves to tag !!timestamp, not !!str. It must survive as the
+// literal string everywhere OpenAPI's JSON data model can carry one — enum,
+// const, a property default, a schema-level example, and a media-type example —
+// with nothing dropped or degraded to null.
+//
+// "Everywhere" spans both channels a date can land in. It used to mean only the
+// ir.Value one, and the raw-JSON one went on rewriting a date to RFC 3339 with
+// this fixture green (GitHub #242); assertRawPreservedDates is the other half.
+func assertYAMLTimestampScalars(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	// R's `not` announces the §4.7 carve-out, and D's `format: date` announces
+	// that an ir.Enum has no Encoding field to put it in, so it is kept verbatim
+	// beside the enum rather than dropped. Those two are the only notices any
+	// site here is allowed to say, and neither is about a date: one that was
+	// dropped or degraded reports itself as a warning, which is what this fixture
+	// exists to catch.
+	for _, d := range diags {
+		assert.Equal(t, ir.SeverityInfo, d.Severity,
+			"every unquoted date converts cleanly; nothing is dropped or degraded: %+v", d)
+		if d.Code == "openapi/degraded-construct" && d.Provenance.Pointer == "/components/schemas/D" {
+			continue
+		}
+		assert.Equal(t, "openapi/validation-only-keyword", d.Code,
+			"the §4.7 carve-out is the only other notice this fixture expects: %+v", d)
+	}
+
+	d, ok := doc.Types[namedID("D")].(*ir.Enum)
+	require.True(t, ok, "D stays a closed Enum of the real dates, not a union of null literals")
+	assert.Equal(t, ir.PrimString, d.ValueType)
+	require.Len(t, d.Members, 2)
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, d.Members[0].Value)
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2022-02-02"}, d.Members[1].Value)
+
+	k, ok := doc.Types[namedID("K")].(*ir.Literal)
+	require.True(t, ok, "K's const hoists a real Literal, not the schemaless top type")
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, k.Value)
+
+	s, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+	require.Len(t, s.Properties, 1)
+	prop := s.Properties[0]
+	require.NotNil(t, prop.Default, "the property default is preserved")
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, *prop.Default)
+	require.Len(t, prop.Examples, 1, "the schema-level example is preserved")
+	require.NotNil(t, prop.Examples[0].Value)
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, *prop.Examples[0].Value)
+
+	op, ok := opByName(doc, "getItem")
+	require.True(t, ok)
+	require.NotNil(t, op.Responses[0].Payload)
+	require.Len(t, op.Responses[0].Payload.Contents, 1)
+	mediaExamples := op.Responses[0].Payload.Contents[0].Examples
+	require.Len(t, mediaExamples, 1, "the media-type example is preserved")
+	require.NotNil(t, mediaExamples[0].Value)
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "2021-01-01"}, *mediaExamples[0].Value)
+
+	assertRawPreservedDates(t, doc)
+}
+
+// assertRawPreservedDates pins the source spelling of a date kept as raw JSON,
+// at both sites that channel has: a vendor extension and the §4.7
+// validation-only carve-out. Each wants the text the source wrote — resolving
+// the tag and re-rendering it hands the construct a padding, a time and a zone
+// nobody asked for, and the resolved form cannot be read back to the spelling.
+func assertRawPreservedDates(t *testing.T, doc *ir.Document) {
+	t.Helper()
+	r, ok := doc.Types[namedID("R")].(*ir.Model)
+	require.True(t, ok)
+	kept := r.Unmodeled
+
+	for _, tc := range []struct{ key, want string }{
+		{"openapi:x-effective", `"2021-1-1"`},
+		{"openapi:x-window", `{"from":"2021-1-1","to":"2022-2-2"}`},
+		{"openapi:not", `{"const":"2021-1-1"}`},
+	} {
+		entry, found := kept[tc.key]
+		require.True(t, found, "%s is preserved; got %v", tc.key, kept)
+		assert.Equal(t, tc.want, string(entry.Value),
+			"%s keeps the date as written, not as RFC 3339 spells it", tc.key)
+	}
+}
+
+func assertConstraints(t *testing.T, doc *ir.Document, diags []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+	ratio, ok := propByWire(m, "ratio")
+	require.True(t, ok)
+	c := ratio.Constraints
+	require.NotNil(t, c)
+	// Exact decimal strings — a float64 path would corrupt all three.
+	require.NotNil(t, c.Min)
+	require.NotNil(t, c.Max)
+	require.NotNil(t, c.MultipleOf)
+	assert.Equal(t, ir.BigVal("0.30000000000000004"), *c.Min)
+	assert.Equal(t, ir.BigVal("9007199254740993"), *c.Max)
+	assert.Equal(t, ir.BigVal("0.1"), *c.MultipleOf)
+
+	// The object's own cardinality bound lands on the Model, not on a property
+	// and not nowhere (GitHub #129).
+	require.NotNil(t, m.Constraints)
+	require.NotNil(t, m.Constraints.MinProps)
+	require.NotNil(t, m.Constraints.MaxProps)
+	assert.Equal(t, int64(1), *m.Constraints.MinProps)
+	assert.Equal(t, int64(4), *m.Constraints.MaxProps)
+
+	assertLengthAndCollectionBounds(t, doc, m)
+	assertCoDeclaredBounds(t, m, diags)
+	assertCoDeclaredBoundKept(t, doc, m)
+}
+
+// assertCoDeclaredBounds pins the 2020-12 rule that a side declaring both of
+// its keywords carries both: minimum and exclusiveMinimum are independent and
+// conjunctive, ir.Constraints has a field for each, and neither is chosen over
+// the other (GitHub #33, #425).
+//
+// Both directions are here on purpose. The property bounded below has the
+// inclusive keyword as its tighter bound and the one bounded above the
+// exclusive one, so a reader that kept the tighter alone answers the two
+// differently — and a reader that always kept the exclusive keyword passes the
+// second on its own.
+func assertCoDeclaredBounds(t *testing.T, m *ir.Model, diags []ir.Diagnostic) {
+	t.Helper()
+	low, ok := propByWire(m, "atLeastTen")
+	require.True(t, ok)
+	require.NotNil(t, low.Constraints)
+	require.NotNil(t, low.Constraints.Min)
+	require.NotNil(t, low.Constraints.ExclusiveMin)
+	assert.Equal(t, ir.BigVal("10"), *low.Constraints.Min, "minimum as written")
+	assert.Equal(t, ir.BigVal("0"), *low.Constraints.ExclusiveMin,
+		"and the looser exclusiveMinimum beside it, not dropped for being implied")
+
+	high, ok := propByWire(m, "underTen")
+	require.True(t, ok)
+	require.NotNil(t, high.Constraints)
+	require.NotNil(t, high.Constraints.Max)
+	require.NotNil(t, high.Constraints.ExclusiveMax)
+	assert.Equal(t, ir.BigVal("100"), *high.Constraints.Max, "maximum as written")
+	assert.Equal(t, ir.BigVal("10"), *high.Constraints.ExclusiveMax, "and exclusiveMaximum beside it")
+
+	for _, d := range diags {
+		assert.NotContains(t, d.Message, "exclusiveMinimum",
+			"a pair that reaches two fields is not a degradation to report")
+	}
+}
+
+// assertCoDeclaredBoundKept is the losslessness half of the same rule: with a
+// field per keyword there is nothing left over, so neither carrier keeps a bound
+// verbatim. Nothing is restated beside constraints that hold it all — an entry
+// there would give one bound two homes, and {minimum: 10, exclusiveMinimum: 0}
+// is told from {minimum: 10} by the fields themselves (GitHub #286).
+func assertCoDeclaredBoundKept(t *testing.T, doc *ir.Document, m *ir.Model) {
+	t.Helper()
+	low, ok := propByWire(m, "atLeastTen")
+	require.True(t, ok)
+	assert.Empty(t, low.Unmodeled, "the property keeps nothing beside its constraints")
+
+	high, ok := propByWire(m, "underTen")
+	require.True(t, ok)
+	assert.Empty(t, high.Unmodeled, "and neither does the side settled the other way")
+
+	alias, ok := doc.Types[namedID("Bounded")].(*ir.Scalar)
+	require.True(t, ok, "a component reducing to a shared primitive owns an alias node")
+	require.NotNil(t, alias.Constraints)
+	require.NotNil(t, alias.Constraints.Min)
+	require.NotNil(t, alias.Constraints.ExclusiveMin)
+	assert.Equal(t, ir.BigVal("0"), *alias.Constraints.ExclusiveMin,
+		"a node carries both bounds, exactly as a property does")
+	assert.Empty(t, alias.Unmodeled)
+}
+
+// assertLengthAndCollectionBounds pins the non-numeric bounds: a string length
+// pair on the declaring property, and a collection bound on the List the array
+// position hoisted, which is the node that describes the collection.
+func assertLengthAndCollectionBounds(t *testing.T, doc *ir.Document, m *ir.Model) {
+	t.Helper()
+	label, ok := propByWire(m, "label")
+	require.True(t, ok)
+	require.NotNil(t, label.Constraints)
+	require.NotNil(t, label.Constraints.MinLength)
+	require.NotNil(t, label.Constraints.MaxLength)
+	assert.Equal(t, int64(2), *label.Constraints.MinLength)
+	assert.Equal(t, int64(8), *label.Constraints.MaxLength)
+
+	tags, ok := propByWire(m, "tags")
+	require.True(t, ok)
+	list, ok := doc.Types[tags.Type.Target].(*ir.List)
+	require.True(t, ok, "an array position hoists a List")
+	require.NotNil(t, list.Constraints)
+	require.NotNil(t, list.Constraints.MinItems)
+	require.NotNil(t, list.Constraints.MaxItems)
+	assert.Equal(t, int64(1), *list.Constraints.MinItems)
+	assert.Equal(t, int64(5), *list.Constraints.MaxItems)
+	assert.True(t, list.Constraints.UniqueItems)
+}
+
+func assertNumericPrecision(t *testing.T, doc *ir.Document, _ []ir.Diagnostic) {
+	m, ok := doc.Types[namedID("S")].(*ir.Model)
+	require.True(t, ok)
+
+	// Bounds beyond float64 range and a huge integer beyond int64, exact.
+	bounded, ok := propByWire(m, "bounded")
+	require.True(t, ok)
+	require.NotNil(t, bounded.Constraints)
+	require.NotNil(t, bounded.Constraints.Min)
+	require.NotNil(t, bounded.Constraints.Max)
+	require.NotNil(t, bounded.Constraints.MultipleOf)
+	assert.Equal(t, ir.BigVal("1.8e308"), *bounded.Constraints.Min)
+	assert.Equal(t, ir.BigVal("123456789012345678901234567890"), *bounded.Constraints.Max)
+	assert.Equal(t, ir.BigVal("1e-30"), *bounded.Constraints.MultipleOf)
+
+	// A leading-dot spelling is canonicalized to JSON form; a high-precision
+	// decimal is kept to the last digit.
+	exclusive, ok := propByWire(m, "exclusive")
+	require.True(t, ok)
+	require.NotNil(t, exclusive.Constraints)
+	require.NotNil(t, exclusive.Constraints.ExclusiveMin)
+	require.NotNil(t, exclusive.Constraints.ExclusiveMax)
+	assert.Equal(t, ir.BigVal("0.5"), *exclusive.Constraints.ExclusiveMin)
+	assert.Equal(t, ir.BigVal("0.12345678901234567890123456789"), *exclusive.Constraints.ExclusiveMax)
+
+	// A default beyond float64 range is captured as a number, not a string.
+	withDefault, ok := propByWire(m, "withDefault")
+	require.True(t, ok)
+	require.NotNil(t, withDefault.Default)
+	assert.Equal(t, ir.ValueNumber, withDefault.Default.Kind)
+	assert.Equal(t, ir.BigVal("1.8e308"), withDefault.Default.Num)
+
+	// A const beyond float64 range hoists a Literal over the exact number.
+	pinned, ok := propByWire(m, "pinned")
+	require.True(t, ok)
+	lit, ok := doc.Types[pinned.Type.Target].(*ir.Literal)
+	require.True(t, ok)
+	assert.Equal(t, ir.ValueNumber, lit.Value.Kind)
+	assert.Equal(t, ir.BigVal("1.8e308"), lit.Value.Num)
+
+	// Numeric enum members keep their exact value past int64 range.
+	choice, ok := propByWire(m, "choice")
+	require.True(t, ok)
+	enum, ok := doc.Types[choice.Type.Target].(*ir.Enum)
+	require.True(t, ok)
+	require.Len(t, enum.Members, 2)
+	assert.Equal(t, ir.BigVal("123456789012345678901234567890"), enum.Members[1].Value.Num)
+
+	// A leading-dot example is canonicalized losslessly.
+	sampled, ok := propByWire(m, "sampled")
+	require.True(t, ok)
+	require.Len(t, sampled.Examples, 1)
+	require.NotNil(t, sampled.Examples[0].Value)
+	assert.Equal(t, ir.BigVal("0.5"), sampled.Examples[0].Value.Num)
+
+	assertYAMLIntegerBases(t, doc, m)
+	assertRawPreservedNumbers(t, m)
+}
+
+// assertRawPreservedNumbers pins the second numeric channel: the constructs kept
+// verbatim as raw JSON rather than lowered into a Value. It rounded every one of
+// these through float64 until GitHub #32 — a 30-digit extension came back as
+// 1.2345678901234568e+29 — which no case in this corpus could see, because none
+// of them carried a number a float64 cannot hold.
+func assertRawPreservedNumbers(t *testing.T, m *ir.Model) {
+	t.Helper()
+	preserved, ok := propByWire(m, "preserved")
+	require.True(t, ok)
+	kept := preserved.Unmodeled
+
+	for _, tc := range []struct{ key, want string }{
+		{"openapi:x-precise-limit", "123456789012345678901234567890"},
+		{"openapi:x-precise-step", "1.000000000000000000001"},
+		{"openapi:x-precise-scale", "1.10"},
+		{"openapi:not", `{"const":123456789012345678901234567890}`},
+	} {
+		entry, found := kept[tc.key]
+		require.True(t, found, "%s is preserved; got %v", tc.key, kept)
+		assert.Equal(t, tc.want, string(entry.Value),
+			"%s is preserved as written, not as a float64 can spell it", tc.key)
+	}
+}
+
+// assertYAMLIntegerBases pins the value every numeric site stores for an integer
+// whose YAML base comes from its prefix. Reading the source spelling as base 10
+// would store 644 where the document said 420, and would do it silently.
+func assertYAMLIntegerBases(t *testing.T, doc *ir.Document, m *ir.Model) {
+	t.Helper()
+	mode, ok := propByWire(m, "mode")
+	require.True(t, ok)
+	require.NotNil(t, mode.Default)
+	assert.Equal(t, ir.BigVal("420"), mode.Default.Num, "0644 is octal in YAML")
+
+	enum, ok := doc.Types[mode.Type.Target].(*ir.Enum)
+	require.True(t, ok)
+	require.Len(t, enum.Members, 2)
+	assert.Equal(t, ir.BigVal("420"), enum.Members[0].Value.Num)
+	assert.Equal(t, ir.BigVal("493"), enum.Members[1].Value.Num)
+
+	bounds, ok := propByWire(m, "bounds")
+	require.True(t, ok)
+	require.NotNil(t, bounds.Constraints)
+	require.NotNil(t, bounds.Constraints.Min)
+	require.NotNil(t, bounds.Constraints.Max)
+	require.NotNil(t, bounds.Constraints.MultipleOf)
+	assert.Equal(t, ir.BigVal("15"), *bounds.Constraints.Min, "017 is octal")
+	assert.Equal(t, ir.BigVal("31"), *bounds.Constraints.Max, "0x1f is hex")
+	assert.Equal(t, ir.BigVal("10"), *bounds.Constraints.MultipleOf, "0b1010 is binary")
+	require.Len(t, bounds.Examples, 1)
+	require.NotNil(t, bounds.Examples[0].Value)
+	assert.Equal(t, ir.BigVal("30"), bounds.Examples[0].Value.Num, "0b11110 is binary")
+
+	// "_" is a separator, and a leading zero YAML resolves as a decimal float
+	// still has to come out as a JSON-valid literal.
+	counted, ok := propByWire(m, "counted")
+	require.True(t, ok)
+	require.NotNil(t, counted.Default)
+	assert.Equal(t, ir.BigVal("1000000"), counted.Default.Num)
+	loose, ok := propByWire(m, "loose")
+	require.True(t, ok)
+	require.NotNil(t, loose.Default)
+	assert.Equal(t, ir.BigVal("9"), loose.Default.Num)
+}

From 75af03fc5656640e7a74179965c2c2f94c429c4a Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 21:56:16 +0300
Subject: [PATCH 04/11] test(compilers/openapi): move lowering tests to the
 packages they test

Four root files drove a single internal lowering through a fixture only
the root declared, so they covered nothing in the package they tested
and kept a second copy of every package's fixture alive at the root.

The constraint tests move to internal/schema, whose ConstraintsOf
reports what they pin; the component-schema and property tests go there
too, and the service test to internal/operation, each onto the fixture
of the same name that package already had. The unpreservable tests,
which compile whole documents, move to e2e, and the reason sweep among
them reads a full compile rather than a partial one.

Five tests are deleted rather than moved, because a test in the package
under test already pins what they did. compile's
TestTypes_InternIsIdempotentAndRecordsBeforeBuilding and
TestTypes_PrimRefInternsOnceAndNamesNoSource kill every mutant of Intern
and PrimRef the root's TestIntern_ and TestPrimID_ kill, and one they
let through. annotation's TestAt_ tests kill each mutant of At the
root's three TestSiteAt_ tests kill. With them goes the root's lowerer
fixture, which nothing uses any more.
---
 .../openapi/constraints_internal_test.go      | 250 -----------------
 .../openapi/{ => e2e}/unpreservable_test.go   |   6 +-
 compilers/openapi/helpers_test.go             | 126 ---------
 compilers/openapi/hoist_test.go               |  33 ---
 .../internal/operation/operations_test.go     |  34 +++
 .../internal/schema/constraints_test.go       | 238 ++++++++++++++++
 .../openapi/internal/schema/property_test.go  |  41 +++
 .../openapi/internal/schema/schema_test.go    | 117 ++++++++
 compilers/openapi/resolve_internal_test.go    | 265 ------------------
 docs/compilers/openapi.md                     |   6 +-
 docs/micro-compiler-design.md                 |   2 +-
 11 files changed, 438 insertions(+), 680 deletions(-)
 delete mode 100644 compilers/openapi/constraints_internal_test.go
 rename compilers/openapi/{ => e2e}/unpreservable_test.go (98%)
 delete mode 100644 compilers/openapi/hoist_test.go
 delete mode 100644 compilers/openapi/resolve_internal_test.go

diff --git a/compilers/openapi/constraints_internal_test.go b/compilers/openapi/constraints_internal_test.go
deleted file mode 100644
index 4270f554..00000000
--- a/compilers/openapi/constraints_internal_test.go
+++ /dev/null
@@ -1,250 +0,0 @@
-package openapi
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
-	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
-	"github.com/dexpace/morphic/ir"
-)
-
-func TestConstraints_ExclusiveBoolean30(t *testing.T) {
-	t.Parallel()
-	spec := openapitest.ComponentSpecVer("3.0.3", `    S:
-      type: object
-      properties:
-        n:
-          type: integer
-          minimum: 5
-          exclusiveMinimum: true
-          maximum: 10
-          exclusiveMaximum: true
-`)
-	// The library models exclusiveMinimum/Maximum as numbers and flags the valid
-	// 3.0 boolean form with a type-mismatch; because those keywords are Morphic's
-	// to own, load suppresses that false positive, so a valid 3.0 boolean exclusive
-	// bound lowers cleanly with the flag set and no error diagnostic.
-	doc, diags := lowerSpec(t, spec)
-	openapitest.RequireNoErrorDiags(t, diags)
-	c := propConstraints(t, doc, "S", "n")
-	// The modifier is a spelling of the exclusive bound, so the literal it
-	// modified lands in the exclusive field and the inclusive one is left empty
-	// — the same constraints the 2020-12 spelling of "x > 5, x < 10" produces.
-	assert.Nil(t, c.Min, "the modified minimum does not also stay inclusive")
-	assert.Nil(t, c.Max)
-	require.NotNil(t, c.ExclusiveMin)
-	require.NotNil(t, c.ExclusiveMax)
-	assert.Equal(t, ir.BigVal("5"), *c.ExclusiveMin)
-	assert.Equal(t, ir.BigVal("10"), *c.ExclusiveMax)
-}
-
-func TestConstraints_ExclusiveNumeric31(t *testing.T) {
-	t.Parallel()
-	spec := openapitest.ComponentSpec(`    S:
-      type: object
-      properties:
-        n:
-          type: number
-          exclusiveMinimum: 1.5
-          exclusiveMaximum: 9.5
-`)
-	doc, diags := lowerSpec(t, spec)
-	openapitest.RequireNoErrorDiags(t, diags)
-	c := propConstraints(t, doc, "S", "n")
-	assert.Nil(t, c.Min)
-	assert.Nil(t, c.Max)
-	require.NotNil(t, c.ExclusiveMin)
-	require.NotNil(t, c.ExclusiveMax)
-	assert.Equal(t, ir.BigVal("1.5"), *c.ExclusiveMin)
-	assert.Equal(t, ir.BigVal("9.5"), *c.ExclusiveMax)
-}
-
-func TestConstraints_MalformedNumericLiterals(t *testing.T) {
-	t.Parallel()
-	spec := openapitest.ComponentSpec(`    S:
-      type: object
-      properties:
-        a: {type: number, minimum: .inf}
-        b: {type: number, exclusiveMinimum: .inf}
-`)
-	doc, diags := lowerSpec(t, spec)
-	require.NotNil(t, doc)
-	var count int
-	for _, d := range diags {
-		if d.Code == diag.NumericPrecision {
-			count++
-			assert.Equal(t, ir.SeverityError, d.Severity)
-		}
-	}
-	assert.GreaterOrEqual(t, count, 2, "both malformed literals error")
-}
-
-func TestConstraints_NumericPrecisionSurvives(t *testing.T) {
-	t.Parallel()
-	spec := openapitest.ComponentSpec(`    S:
-      type: object
-      properties:
-        ratio:
-          type: number
-          minimum: 0.30000000000000004
-          maximum: 9007199254740993
-          multipleOf: 0.1
-`)
-	doc, diags := lowerSpec(t, spec)
-	openapitest.RequireNoErrorDiags(t, diags)
-	m := doc.Types[componentID("S")].(*ir.Model)
-	c := m.Properties[0].Constraints
-	require.NotNil(t, c)
-	// Exact decimal strings — a float64 path would corrupt all three.
-	assert.Equal(t, ir.BigVal("0.30000000000000004"), *c.Min)
-	assert.Equal(t, ir.BigVal("9007199254740993"), *c.Max)
-	assert.Equal(t, ir.BigVal("0.1"), *c.MultipleOf)
-}
-
-func TestConstraints_LosslessNumericLiterals(t *testing.T) {
-	t.Parallel()
-	cases := []struct {
-		name    string
-		literal string
-		want    ir.BigVal
-	}{
-		{"beyond float64 range", "1.8e308", "1.8e308"},
-		{"far beyond float64 range", "1e400", "1e400"},
-		{"leading dot spelling", ".5", "0.5"},
-		{"trailing dot spelling", "5.", "5"},
-		{"huge integer beyond int64", "123456789012345678901234567890", "123456789012345678901234567890"},
-		{"high-precision decimal", "0.12345678901234567890123456789", "0.12345678901234567890123456789"},
-		{"exponential notation", "6.022e23", "6.022e23"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			spec := openapitest.ComponentSpec("    S:\n      type: object\n      properties:\n        n: {type: number, minimum: " + tc.literal + "}\n")
-			doc, diags := lowerSpec(t, spec)
-			// A valid number, however spelled, is accepted with no error: the
-			// library's float64/JSON complaint is not surfaced.
-			openapitest.RequireNoErrorDiags(t, diags)
-			c := propConstraints(t, doc, "S", "n")
-			require.NotNil(t, c.Min)
-			assert.Equal(t, tc.want, *c.Min)
-		})
-	}
-}
-
-// TestConstraints_HoistedSubSchemaBadBoundSingleError pins that a malformed bound
-// on a component-property sub-schema reached by a $ref is reported exactly once,
-// even though the sub-schema's constraints are read from two positions (the owning
-// property and the $ref hoist).
-//
-// What holds it is identity de-duplication in compile.Diags. Both reads stamp
-// this same pointer, so the two diagnostics agree in severity, code, message and
-// provenance, and the second is dropped as a repeat. Removing that dedup is what
-// reddens this test — it then reports the identical error twice.
-func TestConstraints_HoistedSubSchemaBadBoundSingleError(t *testing.T) {
-	t.Parallel()
-	spec := openapitest.ComponentSpec("    Foo:\n      type: object\n      properties:\n        bar: {type: number, minimum: hello}\n" +
-		"    User:\n      type: object\n      properties:\n        b: {$ref: '#/components/schemas/Foo/properties/bar'}\n")
-	_, diags := lowerSpec(t, spec)
-	assert.Equal(t, 1, openapitest.CountDiagsAt(diags, diag.NumericPrecision, ir.SeverityError),
-		"one error for the shared bad bound, got: %+v", diags)
-}
-
-// TestConstraints_ExclusiveWrongDialectForm pins that an exclusiveMinimum/Maximum
-// written in the wrong form for the document's dialect is reported as a single
-// error, not silently accepted as a degenerate constraint: a boolean under the
-// 2020-12 dialect (3.1/3.2) and a number under 3.0.
-func TestConstraints_ExclusiveWrongDialectForm(t *testing.T) {
-	t.Parallel()
-	cases := []struct {
-		name, version, value string
-	}{
-		{"boolean under 3.1", "3.1.0", "true"},
-		{"boolean under 3.2", "3.2.0", "false"},
-		{"number under 3.0", "3.0.3", "5"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			spec := openapitest.ComponentSpecVer(tc.version,
-				"    S:\n      type: object\n      properties:\n        n: {type: number, exclusiveMinimum: "+tc.value+"}\n")
-			doc, diags := lowerSpec(t, spec)
-			require.NotNil(t, doc)
-			assert.Equal(t, 1, openapitest.CountDiagsAt(diags, diag.ExclusiveBoundForm, ir.SeverityError),
-				"one dialect-form error, got: %+v", diags)
-			// The degenerate bound is dropped, not recorded.
-			m, ok := typeByName(doc, "S").(*ir.Model)
-			require.True(t, ok)
-			for _, p := range m.Properties {
-				if p.WireName == "n" && p.Constraints != nil {
-					assert.Nil(t, p.Constraints.ExclusiveMin, "wrong-form exclusive bound is not set")
-				}
-			}
-		})
-	}
-}
-
-func TestConstraints_TypeWrongBoundYieldsSingleError(t *testing.T) {
-	t.Parallel()
-	spec := openapitest.ComponentSpec("    S:\n      type: object\n      properties:\n        n: {type: number, minimum: hello}\n")
-	_, diags := lowerSpec(t, spec)
-	// Exactly one diagnostic: Morphic's error with the schema's own provenance.
-	// The library emits two redundant float64 type-mismatch findings on the same
-	// keyword; load suppresses both because Morphic owns numeric-bound keywords.
-	require.Len(t, diags, 1, "one diagnostic for a type-wrong bound, got: %+v", diags)
-	assert.Equal(t, diag.NumericPrecision, diags[0].Code)
-	assert.Equal(t, ir.SeverityError, diags[0].Severity)
-	assert.NotEmpty(t, diags[0].Provenance.Pointer)
-}
-
-func TestConstraints_NonNumericMinimumErrors(t *testing.T) {
-	t.Parallel()
-	spec := openapitest.ComponentSpec("    S:\n      type: object\n      properties:\n        n: {type: number, minimum: hello}\n")
-	doc, diags := lowerSpec(t, spec)
-	require.NotNil(t, doc)
-	// A genuinely non-numeric bound is never dropped silently: Morphic owns the
-	// keyword and reports it as an error with the property's exact provenance.
-	var reported bool
-	for _, d := range diags {
-		if d.Code == diag.NumericPrecision {
-			reported = true
-			assert.Equal(t, ir.SeverityError, d.Severity)
-		}
-	}
-	assert.True(t, reported, "a non-numeric minimum yields an error diagnostic")
-}
-
-// propConstraints returns the constraints of a named model's property.
-func propConstraints(t *testing.T, doc *ir.Document, model, wire string) *ir.Constraints {
-	t.Helper()
-	m, ok := typeByName(doc, model).(*ir.Model)
-	require.True(t, ok)
-	for _, p := range m.Properties {
-		if p.WireName == wire {
-			require.NotNil(t, p.Constraints, "property %s has constraints", wire)
-			return p.Constraints
-		}
-	}
-	t.Fatalf("property %s not found", wire)
-	return nil
-}
-
-// TestComponentConstraints_DiagnosticProvenance covers the diagnostic-stamping
-// loop: a scalar component whose numeric bound is not a valid number surfaces a
-// numeric-precision error stamped with the component's own pointer.
-func TestComponentConstraints_DiagnosticProvenance(t *testing.T) {
-	t.Parallel()
-	spec := openapitest.ComponentSpec("    BadN: {type: number, minimum: hello}\n")
-	_, diags := lowerSpec(t, spec)
-	var found bool
-	for _, d := range diags {
-		if d.Code == diag.NumericPrecision {
-			found = true
-			assert.NotEmpty(t, d.Provenance.Pointer, "component numeric diagnostic carries its pointer")
-			assert.Equal(t, ir.SeverityError, d.Severity, "a non-numeric bound is an error")
-		}
-	}
-	assert.True(t, found, "a non-numeric component bound is reported")
-}
diff --git a/compilers/openapi/unpreservable_test.go b/compilers/openapi/e2e/unpreservable_test.go
similarity index 98%
rename from compilers/openapi/unpreservable_test.go
rename to compilers/openapi/e2e/unpreservable_test.go
index f1f0b147..609edc2e 100644
--- a/compilers/openapi/unpreservable_test.go
+++ b/compilers/openapi/e2e/unpreservable_test.go
@@ -1,4 +1,4 @@
-package openapi
+package e2e_test
 
 import (
 	"encoding/json/jsontext"
@@ -253,8 +253,10 @@ paths:
         content: {application/json: {schema: {type: string}}}
       responses: {"204": {description: ok}}
 `
-	doc, svc, diags := lowerServiceSpec(t, spec)
+	doc, diags := parseFull(t, spec)
 	openapitest.RequireNoErrorDiags(t, diags)
+	require.Len(t, doc.Services, 1, "the document declares one service")
+	svc := doc.Services[0]
 
 	// S witnesses vendor_extension, validation_only (its constraint-only union
 	// joins `not` there) and out_of_scope (its $schema); T's items, which its
diff --git a/compilers/openapi/helpers_test.go b/compilers/openapi/helpers_test.go
index b5d2b7ff..4a5bb85f 100644
--- a/compilers/openapi/helpers_test.go
+++ b/compilers/openapi/helpers_test.go
@@ -3,121 +3,10 @@ package openapi
 import (
 	"testing"
 
-	soa "github.com/speakeasy-api/openapi/openapi"
-	"github.com/stretchr/testify/require"
-
-	"github.com/dexpace/morphic/compilers"
-	"github.com/dexpace/morphic/compilers/compile"
-	"github.com/dexpace/morphic/compilers/openapi/internal/auth"
-	"github.com/dexpace/morphic/compilers/openapi/internal/load"
-	"github.com/dexpace/morphic/compilers/openapi/internal/lowering"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
-	"github.com/dexpace/morphic/compilers/openapi/internal/operation"
-	"github.com/dexpace/morphic/compilers/openapi/internal/overlay"
-	"github.com/dexpace/morphic/compilers/openapi/internal/schema"
 	"github.com/dexpace/morphic/ir"
 )
 
-// parseFull runs the whole public compiler pipeline over src.
-//
-// It is one of the copies openapitest cannot hold: a helper that drives the
-// compiler has to import it, and this package's own internal tests could then
-// not import openapitest at all. The copies are written identically so a reader
-// comparing them finds no difference to account for.
-func parseFull(t *testing.T, src string) (*ir.Document, []ir.Diagnostic) {
-	t.Helper()
-	doc, diags, err := New().Compile(t.Context(),
-		[]compilers.Source{openapitest.SourceOf(src)}, compilers.Options{})
-	require.NoError(t, err)
-	require.NotNil(t, doc)
-	return doc, diags
-}
-
-// loweredFor loads src and returns the lowerer over it with nothing lowered
-// yet, plus the load diagnostics, so a test can drive one entry point at a
-// time. lowerSpec builds on this same load path to also lower components.
-func loweredFor(t *testing.T, src string) (*lowerer, []ir.Diagnostic) {
-	t.Helper()
-	source := compilers.Source{Path: "spec.yaml", Data: []byte(src)}
-	loadedDoc, diags, err := load.Load(t.Context(), 0, source, loadOptions(Options{}.withDefaults(), nil, source))
-	require.NoError(t, err)
-	require.NotNil(t, loadedDoc, "load returned no document: %+v", diags)
-	return newLowerer(loadedDoc, Options{}.withDefaults()), diags
-}
-
-// lowerSpec loads src and lowers its component schemas, returning the document
-// under construction and all diagnostics. It drives the same lowerer Compile
-// will use, without requiring the not-yet-written operation lowering.
-func lowerSpec(t *testing.T, src string) (*ir.Document, []ir.Diagnostic) {
-	t.Helper()
-	l, diags := loweredFor(t, src)
-	l.diags.AppendAll(schema.LowerComponentSchemas(t.Context(), l.ctx, l.types)) // named components; the entry Compile's run() calls first
-	doc := l.document(t)
-	return doc, append(diags, l.diags.List()...)
-}
-
-// lowerServiceSpec lowers components and the service layer of src.
-func lowerServiceSpec(t *testing.T, src string) (*ir.Document, ir.Service, []ir.Diagnostic) {
-	t.Helper()
-	doc, diags := func() (*ir.Document, []ir.Diagnostic) {
-		source := compilers.Source{Path: "spec.yaml", Data: []byte(src)}
-		loadedDoc, loadDiags, err := load.Load(t.Context(), 0, source, loadOptions(Options{}.withDefaults(), nil, source))
-		require.NoError(t, err)
-		require.NotNil(t, loadedDoc)
-		l := newLowerer(loadedDoc, Options{}.withDefaults())
-		l.diags.AppendAll(schema.LowerComponentSchemas(t.Context(), l.ctx, l.types))
-		auth, authDiags := auth.LowerSecuritySchemes(l.ctx)
-		l.out.Auth = auth
-		l.diags.AppendAll(authDiags)
-		svc, tagDefs, svcDiags := operation.LowerService(t.Context(), l.ctx.WithAuth(l.out.Auth), l.types)
-		l.out.TagDefs = tagDefs
-		l.diags.AppendAll(svcDiags)
-		l.out.Services = []ir.Service{svc}
-		doc := l.document(t)
-		return doc, append(loadDiags, l.diags.List()...)
-	}()
-	require.Len(t, doc.Services, 1)
-	return doc, doc.Services[0], diags
-}
-
-// lowerer is test scaffolding, not a compiler type. The compiler has no such
-// struct: every lowering is a function of the context and the registry, and
-// run owns the document being built (#177). Tests that drive one lowering in
-// isolation still want those four things in one place, and holding them here
-// keeps that convenience out of the production call graph.
-type lowerer struct {
-	ctx   lowering.Ctx
-	out   *ir.Document
-	types *compile.Types
-	diags compile.Diags
-}
-
-// lowererOver is the only place the fixture's fields are initialised. Both
-// entry points below build on it, so a field added to lowerer cannot reach one
-// of them and miss the other — which is what newRawLowerer, hand-constructing
-// the struct beside newLowerer, used to allow.
-func lowererOver(ctx lowering.Ctx) *lowerer {
-	types := compile.NewTypes()
-	return &lowerer{
-		ctx:   ctx,
-		out:   &ir.Document{},
-		types: types,
-	}
-}
-
-// newLowerer builds the fixture over one loaded document, as run would. There
-// is no srcIndex parameter: every test drives a single source, and the one the
-// compiler varies lives in run's caller now.
-func newLowerer(doc *load.Document, opts Options) *lowerer {
-	return lowererOver(loweringCtx(doc, opts))
-}
-
-// newRawLowerer builds a lowerer over a hand-constructed document, bypassing the
-// parser so nil slice/map entries (which the parser panics on) can be exercised.
-func newRawLowerer(doc *soa.OpenAPI) *lowerer {
-	return lowererOver(lowering.New(0, doc, ir.SourceInfo{}, "", lowering.Limits{}, lowering.StreamingMedia{}, lowering.ExtensionPromotions{}, lowering.NullableWidening{}, overlay.Origin{}))
-}
-
 // componentID is the stable TypeID of a components-named schema, or of a
 // sub-schema beneath one ("Holder/properties/inner").
 //
@@ -142,18 +31,3 @@ func assertHasErrorCode(t *testing.T, diags []ir.Diagnostic, code string) {
 	t.Helper()
 	openapitest.AssertHasCode(t, diags, code, ir.SeverityError)
 }
-
-// document finishes the registry as run does once every lowering has
-// returned, and returns the document under construction holding it. What the
-// settling reports joins the fixture's diagnostics; a refusal is a compiler bug
-// no fixture provokes, so one fails the test.
-func (l *lowerer) document(t *testing.T) *ir.Document {
-	t.Helper()
-	reg, settled := l.types.Finish(t.Context())
-	for _, d := range settled {
-		require.NotEqual(t, compile.RegistryRefused, d.Code, "the registry refused an entry: %s", d.Message)
-	}
-	l.diags.AppendAll(settled)
-	l.out.Types = reg
-	return l.out
-}
diff --git a/compilers/openapi/hoist_test.go b/compilers/openapi/hoist_test.go
deleted file mode 100644
index 8d04654f..00000000
--- a/compilers/openapi/hoist_test.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package openapi
-
-import (
-	"testing"
-
-	soa "github.com/speakeasy-api/openapi/openapi"
-	"github.com/stretchr/testify/assert"
-
-	"github.com/dexpace/morphic/compilers/openapi/internal/load"
-	"github.com/dexpace/morphic/ir"
-)
-
-func TestIntern_IdempotentOnSamePointer(t *testing.T) {
-	t.Parallel()
-	l := newRawLowerer(&soa.OpenAPI{})
-	calls := 0
-	build := func() ir.TypeDef {
-		calls++
-		return &ir.Primitive{ID: "x", Prim: ir.PrimString}
-	}
-	first := l.types.Intern("/p", "x", build)
-	second := l.types.Intern("/p", "x", build)
-	assert.Equal(t, first, second)
-	assert.Equal(t, 1, calls, "build runs only on first intern of a pointer")
-}
-
-func TestPrimID_SecondCallReuses(t *testing.T) {
-	t.Parallel()
-	l := newLowerer(&load.Document{Doc: nil, Source: ir.SourceInfo{}}, Options{}.withDefaults())
-	first := l.types.PrimID(ir.PrimString)
-	second := l.types.PrimID(ir.PrimString)
-	assert.Equal(t, first, second, "interned primitive reused on second call")
-}
diff --git a/compilers/openapi/internal/operation/operations_test.go b/compilers/openapi/internal/operation/operations_test.go
index 9a7bda0e..2bd3a3bd 100644
--- a/compilers/openapi/internal/operation/operations_test.go
+++ b/compilers/openapi/internal/operation/operations_test.go
@@ -756,3 +756,37 @@ func TestXML_NodeTypeIsReadAtEveryVersion(t *testing.T) {
 		})
 	}
 }
+
+// TestLowerService_PercentEncodedEntryRefKeepsTheDeclaredCoordinate covers the
+// same identity defect on the components that are not schemas, where it was
+// wholly silent. Their entries resolve through the library, so the value arrived
+// intact and no unresolved-ref was ever emitted; only the pointer the entry
+// carried stayed encoded, and every ID hoisted beneath it inherited the
+// encoding — here the response's own content schema.
+func TestLowerService_PercentEncodedEntryRefKeepsTheDeclaredCoordinate(t *testing.T) {
+	t.Parallel()
+	doc, _, diags := lowerServiceSpec(t, `openapi: 3.1.0
+info: {title: T, version: "1"}
+paths:
+  /a:
+    get:
+      responses:
+        '200': {$ref: '#/components/responses/My%2DResp'}
+components:
+  responses:
+    My-Resp:
+      description: ok
+      content:
+        application/json:
+          schema: {type: object, properties: {q: {type: string}}}
+`)
+	openapitest.RequireNoErrorDiags(t, diags)
+
+	const want = ir.TypeID("t/anon/components/responses/My-Resp/content/application~1json/schema")
+	assert.Contains(t, doc.Types, want,
+		"the response body is hoisted at the coordinate the component declares")
+	for id := range doc.Types {
+		assert.NotContains(t, string(id), "%",
+			"no node is interned at an encoded path")
+	}
+}
diff --git a/compilers/openapi/internal/schema/constraints_test.go b/compilers/openapi/internal/schema/constraints_test.go
index e74f0241..3d9b4827 100644
--- a/compilers/openapi/internal/schema/constraints_test.go
+++ b/compilers/openapi/internal/schema/constraints_test.go
@@ -154,3 +154,241 @@ func bigValOf(v string) *ir.BigVal {
 	b := ir.BigVal(v)
 	return &b
 }
+
+func TestConstraints_ExclusiveBoolean30(t *testing.T) {
+	t.Parallel()
+	spec := openapitest.ComponentSpecVer("3.0.3", `    S:
+      type: object
+      properties:
+        n:
+          type: integer
+          minimum: 5
+          exclusiveMinimum: true
+          maximum: 10
+          exclusiveMaximum: true
+`)
+	// The library models exclusiveMinimum/Maximum as numbers and flags the valid
+	// 3.0 boolean form with a type-mismatch; because those keywords are Morphic's
+	// to own, load suppresses that false positive, so a valid 3.0 boolean exclusive
+	// bound lowers cleanly with the flag set and no error diagnostic.
+	doc, diags := lowerSpec(t, spec)
+	openapitest.RequireNoErrorDiags(t, diags)
+	c := propConstraints(t, doc, "S", "n")
+	// The modifier is a spelling of the exclusive bound, so the literal it
+	// modified lands in the exclusive field and the inclusive one is left empty
+	// — the same constraints the 2020-12 spelling of "x > 5, x < 10" produces.
+	assert.Nil(t, c.Min, "the modified minimum does not also stay inclusive")
+	assert.Nil(t, c.Max)
+	require.NotNil(t, c.ExclusiveMin)
+	require.NotNil(t, c.ExclusiveMax)
+	assert.Equal(t, ir.BigVal("5"), *c.ExclusiveMin)
+	assert.Equal(t, ir.BigVal("10"), *c.ExclusiveMax)
+}
+
+func TestConstraints_ExclusiveNumeric31(t *testing.T) {
+	t.Parallel()
+	spec := openapitest.ComponentSpec(`    S:
+      type: object
+      properties:
+        n:
+          type: number
+          exclusiveMinimum: 1.5
+          exclusiveMaximum: 9.5
+`)
+	doc, diags := lowerSpec(t, spec)
+	openapitest.RequireNoErrorDiags(t, diags)
+	c := propConstraints(t, doc, "S", "n")
+	assert.Nil(t, c.Min)
+	assert.Nil(t, c.Max)
+	require.NotNil(t, c.ExclusiveMin)
+	require.NotNil(t, c.ExclusiveMax)
+	assert.Equal(t, ir.BigVal("1.5"), *c.ExclusiveMin)
+	assert.Equal(t, ir.BigVal("9.5"), *c.ExclusiveMax)
+}
+
+func TestConstraints_MalformedNumericLiterals(t *testing.T) {
+	t.Parallel()
+	spec := openapitest.ComponentSpec(`    S:
+      type: object
+      properties:
+        a: {type: number, minimum: .inf}
+        b: {type: number, exclusiveMinimum: .inf}
+`)
+	doc, diags := lowerSpec(t, spec)
+	require.NotNil(t, doc)
+	var count int
+	for _, d := range diags {
+		if d.Code == diag.NumericPrecision {
+			count++
+			assert.Equal(t, ir.SeverityError, d.Severity)
+		}
+	}
+	assert.GreaterOrEqual(t, count, 2, "both malformed literals error")
+}
+
+func TestConstraints_NumericPrecisionSurvives(t *testing.T) {
+	t.Parallel()
+	spec := openapitest.ComponentSpec(`    S:
+      type: object
+      properties:
+        ratio:
+          type: number
+          minimum: 0.30000000000000004
+          maximum: 9007199254740993
+          multipleOf: 0.1
+`)
+	doc, diags := lowerSpec(t, spec)
+	openapitest.RequireNoErrorDiags(t, diags)
+	m := doc.Types[componentID("S")].(*ir.Model)
+	c := m.Properties[0].Constraints
+	require.NotNil(t, c)
+	// Exact decimal strings — a float64 path would corrupt all three.
+	assert.Equal(t, ir.BigVal("0.30000000000000004"), *c.Min)
+	assert.Equal(t, ir.BigVal("9007199254740993"), *c.Max)
+	assert.Equal(t, ir.BigVal("0.1"), *c.MultipleOf)
+}
+
+func TestConstraints_LosslessNumericLiterals(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name    string
+		literal string
+		want    ir.BigVal
+	}{
+		{"beyond float64 range", "1.8e308", "1.8e308"},
+		{"far beyond float64 range", "1e400", "1e400"},
+		{"leading dot spelling", ".5", "0.5"},
+		{"trailing dot spelling", "5.", "5"},
+		{"huge integer beyond int64", "123456789012345678901234567890", "123456789012345678901234567890"},
+		{"high-precision decimal", "0.12345678901234567890123456789", "0.12345678901234567890123456789"},
+		{"exponential notation", "6.022e23", "6.022e23"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			spec := openapitest.ComponentSpec("    S:\n      type: object\n      properties:\n        n: {type: number, minimum: " + tc.literal + "}\n")
+			doc, diags := lowerSpec(t, spec)
+			// A valid number, however spelled, is accepted with no error: the
+			// library's float64/JSON complaint is not surfaced.
+			openapitest.RequireNoErrorDiags(t, diags)
+			c := propConstraints(t, doc, "S", "n")
+			require.NotNil(t, c.Min)
+			assert.Equal(t, tc.want, *c.Min)
+		})
+	}
+}
+
+// TestConstraints_HoistedSubSchemaBadBoundSingleError pins that a malformed bound
+// on a component-property sub-schema reached by a $ref is reported exactly once,
+// even though the sub-schema's constraints are read from two positions (the owning
+// property and the $ref hoist).
+//
+// What holds it is identity de-duplication in compile.Diags. Both reads stamp
+// this same pointer, so the two diagnostics agree in severity, code, message and
+// provenance, and the second is dropped as a repeat. Removing that dedup is what
+// reddens this test — it then reports the identical error twice.
+func TestConstraints_HoistedSubSchemaBadBoundSingleError(t *testing.T) {
+	t.Parallel()
+	spec := openapitest.ComponentSpec("    Foo:\n      type: object\n      properties:\n        bar: {type: number, minimum: hello}\n" +
+		"    User:\n      type: object\n      properties:\n        b: {$ref: '#/components/schemas/Foo/properties/bar'}\n")
+	_, diags := lowerSpec(t, spec)
+	assert.Equal(t, 1, openapitest.CountDiagsAt(diags, diag.NumericPrecision, ir.SeverityError),
+		"one error for the shared bad bound, got: %+v", diags)
+}
+
+// TestConstraints_ExclusiveWrongDialectForm pins that an exclusiveMinimum/Maximum
+// written in the wrong form for the document's dialect is reported as a single
+// error, not silently accepted as a degenerate constraint: a boolean under the
+// 2020-12 dialect (3.1/3.2) and a number under 3.0.
+func TestConstraints_ExclusiveWrongDialectForm(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name, version, value string
+	}{
+		{"boolean under 3.1", "3.1.0", "true"},
+		{"boolean under 3.2", "3.2.0", "false"},
+		{"number under 3.0", "3.0.3", "5"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			spec := openapitest.ComponentSpecVer(tc.version,
+				"    S:\n      type: object\n      properties:\n        n: {type: number, exclusiveMinimum: "+tc.value+"}\n")
+			doc, diags := lowerSpec(t, spec)
+			require.NotNil(t, doc)
+			assert.Equal(t, 1, openapitest.CountDiagsAt(diags, diag.ExclusiveBoundForm, ir.SeverityError),
+				"one dialect-form error, got: %+v", diags)
+			// The degenerate bound is dropped, not recorded.
+			m, ok := typeByName(doc, "S").(*ir.Model)
+			require.True(t, ok)
+			for _, p := range m.Properties {
+				if p.WireName == "n" && p.Constraints != nil {
+					assert.Nil(t, p.Constraints.ExclusiveMin, "wrong-form exclusive bound is not set")
+				}
+			}
+		})
+	}
+}
+
+func TestConstraints_TypeWrongBoundYieldsSingleError(t *testing.T) {
+	t.Parallel()
+	spec := openapitest.ComponentSpec("    S:\n      type: object\n      properties:\n        n: {type: number, minimum: hello}\n")
+	_, diags := lowerSpec(t, spec)
+	// Exactly one diagnostic: Morphic's error with the schema's own provenance.
+	// The library emits two redundant float64 type-mismatch findings on the same
+	// keyword; load suppresses both because Morphic owns numeric-bound keywords.
+	require.Len(t, diags, 1, "one diagnostic for a type-wrong bound, got: %+v", diags)
+	assert.Equal(t, diag.NumericPrecision, diags[0].Code)
+	assert.Equal(t, ir.SeverityError, diags[0].Severity)
+	assert.NotEmpty(t, diags[0].Provenance.Pointer)
+}
+
+func TestConstraints_NonNumericMinimumErrors(t *testing.T) {
+	t.Parallel()
+	spec := openapitest.ComponentSpec("    S:\n      type: object\n      properties:\n        n: {type: number, minimum: hello}\n")
+	doc, diags := lowerSpec(t, spec)
+	require.NotNil(t, doc)
+	// A genuinely non-numeric bound is never dropped silently: Morphic owns the
+	// keyword and reports it as an error with the property's exact provenance.
+	var reported bool
+	for _, d := range diags {
+		if d.Code == diag.NumericPrecision {
+			reported = true
+			assert.Equal(t, ir.SeverityError, d.Severity)
+		}
+	}
+	assert.True(t, reported, "a non-numeric minimum yields an error diagnostic")
+}
+
+// propConstraints returns the constraints of a named model's property.
+func propConstraints(t *testing.T, doc *ir.Document, model, wire string) *ir.Constraints {
+	t.Helper()
+	m, ok := typeByName(doc, model).(*ir.Model)
+	require.True(t, ok)
+	for _, p := range m.Properties {
+		if p.WireName == wire {
+			require.NotNil(t, p.Constraints, "property %s has constraints", wire)
+			return p.Constraints
+		}
+	}
+	t.Fatalf("property %s not found", wire)
+	return nil
+}
+
+// TestComponentConstraints_DiagnosticProvenance covers the diagnostic-stamping
+// loop: a scalar component whose numeric bound is not a valid number surfaces a
+// numeric-precision error stamped with the component's own pointer.
+func TestComponentConstraints_DiagnosticProvenance(t *testing.T) {
+	t.Parallel()
+	spec := openapitest.ComponentSpec("    BadN: {type: number, minimum: hello}\n")
+	_, diags := lowerSpec(t, spec)
+	var found bool
+	for _, d := range diags {
+		if d.Code == diag.NumericPrecision {
+			found = true
+			assert.NotEmpty(t, d.Provenance.Pointer, "component numeric diagnostic carries its pointer")
+			assert.Equal(t, ir.SeverityError, d.Severity, "a non-numeric bound is an error")
+		}
+	}
+	assert.True(t, found, "a non-numeric component bound is reported")
+}
diff --git a/compilers/openapi/internal/schema/property_test.go b/compilers/openapi/internal/schema/property_test.go
index 944dae62..69a2d0b4 100644
--- a/compilers/openapi/internal/schema/property_test.go
+++ b/compilers/openapi/internal/schema/property_test.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
 	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
+	"github.com/dexpace/morphic/compilers/openapi/internal/schema"
 	"github.com/dexpace/morphic/ir"
 )
 
@@ -435,3 +436,43 @@ type carrierDocKeyword struct {
 	write func(value string) string
 	read  func(ir.Docs) string
 }
+
+// TestFillPropertyExamples_RefSiblingExampleBindsTheSite locks in the
+// $ref-sibling-example behaviour at a property position: an example written
+// beside a $ref binds the property, not the referent, because
+// fillPropertyExamples resolves it directly rather than through site.
+// Property f's $ref targets a named component (Target), so
+// resolve.Scope.ComponentRef resolves it directly without ever calling
+// hoistSubSchema. TestSchemaSiblings_RefdSubSchemaKeepsThem covers the
+// analogous hoistSubSchema path, where the $ref target is an internal
+// sub-schema pointer rather than a named component.
+func TestFillPropertyExamples_RefSiblingExampleBindsTheSite(t *testing.T) {
+	t.Parallel()
+	l, _ := loweredFor(t, `openapi: 3.1.0
+info: {title: t, version: "1"}
+paths: {}
+components:
+  schemas:
+    Target: {type: string}
+    Holder:
+      type: object
+      properties:
+        f:
+          $ref: '#/components/schemas/Target'
+          example: at-reference
+`)
+	l.diags.AppendAll(schema.LowerComponentSchemas(t.Context(), l.ctx, l.types))
+
+	target := typeByName(l.document(t), "Target")
+	require.NotNil(t, target)
+	assert.Empty(t, target.Common().Examples,
+		"an example beside a $ref must not attach to the referent")
+
+	holder, ok := typeByName(l.document(t), "Holder").(*ir.Model)
+	require.True(t, ok, "Holder must own a Model node")
+	f, ok := openapitest.PropsByWire(holder.Properties)["f"]
+	require.True(t, ok, "property f must be present")
+	require.Len(t, f.Examples, 1, "the example beside the $ref must bind the property")
+	require.NotNil(t, f.Examples[0].Value)
+	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "at-reference"}, *f.Examples[0].Value)
+}
diff --git a/compilers/openapi/internal/schema/schema_test.go b/compilers/openapi/internal/schema/schema_test.go
index ed49718f..080e7b88 100644
--- a/compilers/openapi/internal/schema/schema_test.go
+++ b/compilers/openapi/internal/schema/schema_test.go
@@ -829,3 +829,120 @@ func asKind[T ir.TypeDef](t *testing.T, td ir.TypeDef) T {
 	require.True(t, ok, "lowered to %T", td)
 	return got
 }
+
+// TestLowerComponentSchema_RefSiblingConstraintBindsTheSite locks in the
+// $ref-sibling-constraint behaviour at a named component: lowerComponentSchema
+// resolves the component's own site via annotation.At, so a bound written
+// beside the $ref (S: {$ref: Target, minimum: 5}) binds S, not Target.
+func TestLowerComponentSchema_RefSiblingConstraintBindsTheSite(t *testing.T) {
+	t.Parallel()
+	l, _ := loweredFor(t, `openapi: 3.1.0
+info: {title: t, version: "1"}
+paths: {}
+components:
+  schemas:
+    Target: {type: integer}
+    S:
+      $ref: '#/components/schemas/Target'
+      minimum: 5
+`)
+	l.diags.AppendAll(schema.LowerComponentSchemas(t.Context(), l.ctx, l.types))
+
+	sc, ok := typeByName(l.document(t), "S").(*ir.Scalar)
+	require.True(t, ok, "S aliases Target and must own a Scalar node")
+	require.NotNil(t, sc.Constraints, "a bound beside a $ref binds S, not Target")
+	require.NotNil(t, sc.Constraints.Min)
+	assert.Equal(t, "5", sc.Constraints.Min.String())
+
+	target := typeByName(l.document(t), "Target")
+	require.NotNil(t, target)
+	tsc, ok := target.(*ir.Scalar)
+	require.True(t, ok, "Target aliases a primitive and must own a Scalar node")
+	assert.Nil(t, tsc.Constraints, "the referent must not acquire the site's bound")
+}
+
+// TestLowerComponentSchemas_PercentEncodedRefResolves pins that a $ref whose
+// fragment is percent-encoded reaches the component it names. A $ref is a URI, so
+// `#/components/schemas/Foo%2DBar` addresses "Foo-Bar", and the resolver reads it
+// that way; comparing the raw fragment against declared names instead called a
+// resolved reference unresolved and left the property as `any`, losing the type
+// from a spec-correct document (GitHub #40). Each name here is legal under
+// OpenAPI's own component-name rule (^[a-zA-Z0-9.\-_]+$), so the escape is the
+// only thing under test.
+func TestLowerComponentSchemas_PercentEncodedRefResolves(t *testing.T) {
+	t.Parallel()
+	cases := []struct{ name, decl, encoded string }{
+		{"hyphen", "Foo-Bar", "Foo%2DBar"},
+		{"underscore", "Foo_Bar", "Foo%5FBar"},
+		{"dot", "Foo.Bar", "Foo%2EBar"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			doc, diags := lowerSpec(t, openapitest.ComponentSpec(
+				"    "+tc.decl+": {type: string}\n"+
+					"    User: {type: object, properties: {x: {$ref: '#/components/schemas/"+tc.encoded+"'}}}\n"))
+			openapitest.RequireNoErrorDiags(t, diags)
+
+			user, ok := typeByName(doc, "User").(*ir.Model)
+			require.True(t, ok, "User must own a Model node")
+			require.Len(t, user.Properties, 1)
+			assert.Equal(t, componentID(tc.decl), user.Properties[0].Type.Target,
+				"the encoded fragment names the declared component")
+		})
+	}
+}
+
+// TestLowerComponentSchemas_PercentEncodedRefHoistsAtTheDeclaredCoordinate pins
+// the identity half of the same fix, which the resolution half hides: a pointer
+// *through* an encoded component name addresses a sub-schema an unencoded
+// pointer also addresses, so the two must intern one node, at the declared
+// coordinate and not at `.../Foo%2DBar/properties/inner`, a path no source
+// coordinate spells (the derivation GitHub #141 refused for anchors). A second
+// node raises no diagnostic. Both spellings appear because the encoded ref
+// alone lands on one node either way, and only its name would be wrong.
+func TestLowerComponentSchemas_PercentEncodedRefHoistsAtTheDeclaredCoordinate(t *testing.T) {
+	t.Parallel()
+	doc, diags := lowerSpec(t, openapitest.ComponentSpec(
+		"    Foo-Bar: {type: object, properties: {inner: {type: object, properties: {n: {type: integer}}}}}\n"+
+			"    User:\n      type: object\n      properties:\n"+
+			"        a: {$ref: '#/components/schemas/Foo-Bar/properties/inner'}\n"+
+			"        b: {$ref: '#/components/schemas/Foo%2DBar/properties/inner'}\n"))
+	openapitest.RequireNoErrorDiags(t, diags)
+
+	user, ok := typeByName(doc, "User").(*ir.Model)
+	require.True(t, ok, "User must own a Model node")
+	props := openapitest.PropsByWire(user.Properties)
+	require.Len(t, props, 2)
+
+	const want = ir.TypeID("t/anon/components/schemas/Foo-Bar/properties/inner")
+	assert.Equal(t, want, props["a"].Type.Target)
+	assert.Equal(t, want, props["b"].Type.Target,
+		"the encoded spelling addresses the position the declaration spells, not one of its own")
+	assert.Contains(t, doc.Types, want, "and that ID is backed by a node")
+	for id := range doc.Types {
+		assert.NotContains(t, string(id), "%",
+			"no node is interned at an encoded path: nothing in this document is named with one")
+	}
+}
+
+// TestLowerComponentSchemas_PercentEncodedDiscriminatorMapping covers the third
+// consumer of the pointer, and the one whose failure is loudest: a mapping entry
+// whose target does not resolve is dropped, so an encoded target silently cost
+// the union a branch of its polymorphic dispatch rather than merely degrading a
+// position's type. InternalPointer's contract has always named discriminator
+// mappings alongside $ref; nothing exercised that half.
+func TestLowerComponentSchemas_PercentEncodedDiscriminatorMapping(t *testing.T) {
+	t.Parallel()
+	doc, diags := lowerSpec(t, openapitest.ComponentSpec(
+		"    Cat-A: {type: object, properties: {kind: {type: string}}}\n"+
+			"    Pet:\n      oneOf: [{$ref: '#/components/schemas/Cat-A'}]\n"+
+			"      discriminator: {propertyName: kind, mapping: {cat: '#/components/schemas/Cat%2DA'}}\n"))
+	openapitest.RequireNoErrorDiags(t, diags)
+
+	pet, ok := typeByName(doc, "Pet").(*ir.Union)
+	require.True(t, ok, "Pet must own a Union node")
+	require.NotNil(t, pet.Discriminator, "the discriminator survives lowering")
+	assert.Equal(t, map[string]ir.TypeID{"cat": componentID("Cat-A")}, pet.Discriminator.Mapping,
+		"the encoded mapping target names the declared component, and the entry is kept")
+}
diff --git a/compilers/openapi/resolve_internal_test.go b/compilers/openapi/resolve_internal_test.go
deleted file mode 100644
index c3f5cf3e..00000000
--- a/compilers/openapi/resolve_internal_test.go
+++ /dev/null
@@ -1,265 +0,0 @@
-package openapi
-
-import (
-	"testing"
-
-	oas3 "github.com/speakeasy-api/openapi/jsonschema/oas3"
-	"github.com/speakeasy-api/openapi/references"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/dexpace/morphic/compilers/openapi/internal/annotation"
-	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
-	"github.com/dexpace/morphic/compilers/openapi/internal/schema"
-	"github.com/dexpace/morphic/ir"
-)
-
-func TestSiteAt_DeclarationHasNoReferent(t *testing.T) {
-	t.Parallel()
-	l, _ := loweredFor(t, `openapi: 3.1.0
-info: {title: t, version: "1"}
-paths: {}
-components:
-  schemas:
-    S: {type: string, description: d}
-`)
-	js := l.ctx.Doc.Components.GetSchemas().GetOrZero("S")
-	require.NotNil(t, js)
-
-	s := annotation.At(js)
-	assert.Equal(t, annotation.Declaration, s.Kind)
-	require.NotNil(t, s.Node)
-	assert.Equal(t, "d", s.Node.GetDescription())
-	assert.Nil(t, s.Referent, "a declaration site has no referent")
-}
-
-// TestSiteAt_ReferenceCarriesItsOwnNode pins a reference site: At gives the
-// schema written there and no referent, which a reader that inherits asks the
-// scope for (resolve.Scope.TargetSchema), one hop away.
-func TestSiteAt_ReferenceCarriesItsOwnNode(t *testing.T) {
-	t.Parallel()
-	l, _ := loweredFor(t, `openapi: 3.1.0
-info: {title: t, version: "1"}
-paths: {}
-components:
-  schemas:
-    Target: {type: string, description: target-desc}
-    S:
-      $ref: '#/components/schemas/Target'
-      description: site-desc
-`)
-	js := l.ctx.Doc.Components.GetSchemas().GetOrZero("S")
-	require.NotNil(t, js)
-
-	s := annotation.At(js)
-	assert.Equal(t, annotation.Reference, s.Kind)
-	require.NotNil(t, s.Node)
-	assert.Equal(t, "site-desc", s.Node.GetDescription(), "Node is the schema written here")
-	assert.Nil(t, s.Referent)
-	referent := l.ctx.RefScope().TargetSchema(js, s.Node)
-	require.NotNil(t, referent)
-	assert.Equal(t, "target-desc", referent.GetDescription(), "the referent is one hop away")
-}
-
-// TestSiteAt_EmptyRefIsDeclaration pins the narrower classification: a $ref
-// pointer present but empty never resolves (IsReference is false for it), so
-// annotation.At reports a declaration, not a reference with a nil Referent.
-func TestSiteAt_EmptyRefIsDeclaration(t *testing.T) {
-	t.Parallel()
-	js := oas3.NewJSONSchemaFromSchema[oas3.Referenceable](&oas3.Schema{Ref: new(references.Reference(""))})
-
-	s := annotation.At(js)
-	assert.Equal(t, annotation.Declaration, s.Kind, "an empty $ref resolves nowhere, so it is not a reference site")
-	assert.Nil(t, s.Referent)
-}
-
-// TestLowerComponentSchema_RefSiblingConstraintBindsTheSite locks in the
-// $ref-sibling-constraint behaviour at a named component: lowerComponentSchema
-// resolves the component's own site via annotation.At, so a bound written
-// beside the $ref (S: {$ref: Target, minimum: 5}) binds S, not Target.
-func TestLowerComponentSchema_RefSiblingConstraintBindsTheSite(t *testing.T) {
-	t.Parallel()
-	l, _ := loweredFor(t, `openapi: 3.1.0
-info: {title: t, version: "1"}
-paths: {}
-components:
-  schemas:
-    Target: {type: integer}
-    S:
-      $ref: '#/components/schemas/Target'
-      minimum: 5
-`)
-	l.diags.AppendAll(schema.LowerComponentSchemas(t.Context(), l.ctx, l.types))
-
-	sc, ok := typeByName(l.document(t), "S").(*ir.Scalar)
-	require.True(t, ok, "S aliases Target and must own a Scalar node")
-	require.NotNil(t, sc.Constraints, "a bound beside a $ref binds S, not Target")
-	require.NotNil(t, sc.Constraints.Min)
-	assert.Equal(t, "5", sc.Constraints.Min.String())
-
-	target := typeByName(l.document(t), "Target")
-	require.NotNil(t, target)
-	tsc, ok := target.(*ir.Scalar)
-	require.True(t, ok, "Target aliases a primitive and must own a Scalar node")
-	assert.Nil(t, tsc.Constraints, "the referent must not acquire the site's bound")
-}
-
-// TestFillPropertyExamples_RefSiblingExampleBindsTheSite locks in the
-// $ref-sibling-example behaviour at a property position: an example written
-// beside a $ref binds the property, not the referent, because
-// fillPropertyExamples resolves it directly rather than through site.
-// Property f's $ref targets a named component (Target), so
-// resolve.Scope.ComponentRef resolves it directly without ever calling
-// hoistSubSchema. TestSchemaSiblings_RefdSubSchemaKeepsThem covers the
-// analogous hoistSubSchema path, where the $ref target is an internal
-// sub-schema pointer rather than a named component.
-func TestFillPropertyExamples_RefSiblingExampleBindsTheSite(t *testing.T) {
-	t.Parallel()
-	l, _ := loweredFor(t, `openapi: 3.1.0
-info: {title: t, version: "1"}
-paths: {}
-components:
-  schemas:
-    Target: {type: string}
-    Holder:
-      type: object
-      properties:
-        f:
-          $ref: '#/components/schemas/Target'
-          example: at-reference
-`)
-	l.diags.AppendAll(schema.LowerComponentSchemas(t.Context(), l.ctx, l.types))
-
-	target := typeByName(l.document(t), "Target")
-	require.NotNil(t, target)
-	assert.Empty(t, target.Common().Examples,
-		"an example beside a $ref must not attach to the referent")
-
-	holder, ok := typeByName(l.document(t), "Holder").(*ir.Model)
-	require.True(t, ok, "Holder must own a Model node")
-	f, ok := openapitest.PropsByWire(holder.Properties)["f"]
-	require.True(t, ok, "property f must be present")
-	require.Len(t, f.Examples, 1, "the example beside the $ref must bind the property")
-	require.NotNil(t, f.Examples[0].Value)
-	assert.Equal(t, ir.Value{Kind: ir.ValueString, Str: "at-reference"}, *f.Examples[0].Value)
-}
-
-// TestLowerComponentSchemas_PercentEncodedRefResolves pins that a $ref whose
-// fragment is percent-encoded reaches the component it names. A $ref is a URI, so
-// `#/components/schemas/Foo%2DBar` addresses "Foo-Bar", and the resolver reads it
-// that way; comparing the raw fragment against declared names instead called a
-// resolved reference unresolved and left the property as `any`, losing the type
-// from a spec-correct document (GitHub #40). Each name here is legal under
-// OpenAPI's own component-name rule (^[a-zA-Z0-9.\-_]+$), so the escape is the
-// only thing under test.
-func TestLowerComponentSchemas_PercentEncodedRefResolves(t *testing.T) {
-	t.Parallel()
-	cases := []struct{ name, decl, encoded string }{
-		{"hyphen", "Foo-Bar", "Foo%2DBar"},
-		{"underscore", "Foo_Bar", "Foo%5FBar"},
-		{"dot", "Foo.Bar", "Foo%2EBar"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			doc, diags := lowerSpec(t, openapitest.ComponentSpec(
-				"    "+tc.decl+": {type: string}\n"+
-					"    User: {type: object, properties: {x: {$ref: '#/components/schemas/"+tc.encoded+"'}}}\n"))
-			openapitest.RequireNoErrorDiags(t, diags)
-
-			user, ok := typeByName(doc, "User").(*ir.Model)
-			require.True(t, ok, "User must own a Model node")
-			require.Len(t, user.Properties, 1)
-			assert.Equal(t, componentID(tc.decl), user.Properties[0].Type.Target,
-				"the encoded fragment names the declared component")
-		})
-	}
-}
-
-// TestLowerComponentSchemas_PercentEncodedRefHoistsAtTheDeclaredCoordinate pins
-// the identity half of the same fix, which the resolution half hides: a pointer
-// *through* an encoded component name addresses a sub-schema an unencoded
-// pointer also addresses, so the two must intern one node, at the declared
-// coordinate and not at `.../Foo%2DBar/properties/inner`, a path no source
-// coordinate spells (the derivation GitHub #141 refused for anchors). A second
-// node raises no diagnostic. Both spellings appear because the encoded ref
-// alone lands on one node either way, and only its name would be wrong.
-func TestLowerComponentSchemas_PercentEncodedRefHoistsAtTheDeclaredCoordinate(t *testing.T) {
-	t.Parallel()
-	doc, diags := lowerSpec(t, openapitest.ComponentSpec(
-		"    Foo-Bar: {type: object, properties: {inner: {type: object, properties: {n: {type: integer}}}}}\n"+
-			"    User:\n      type: object\n      properties:\n"+
-			"        a: {$ref: '#/components/schemas/Foo-Bar/properties/inner'}\n"+
-			"        b: {$ref: '#/components/schemas/Foo%2DBar/properties/inner'}\n"))
-	openapitest.RequireNoErrorDiags(t, diags)
-
-	user, ok := typeByName(doc, "User").(*ir.Model)
-	require.True(t, ok, "User must own a Model node")
-	props := openapitest.PropsByWire(user.Properties)
-	require.Len(t, props, 2)
-
-	const want = ir.TypeID("t/anon/components/schemas/Foo-Bar/properties/inner")
-	assert.Equal(t, want, props["a"].Type.Target)
-	assert.Equal(t, want, props["b"].Type.Target,
-		"the encoded spelling addresses the position the declaration spells, not one of its own")
-	assert.Contains(t, doc.Types, want, "and that ID is backed by a node")
-	for id := range doc.Types {
-		assert.NotContains(t, string(id), "%",
-			"no node is interned at an encoded path: nothing in this document is named with one")
-	}
-}
-
-// TestLowerService_PercentEncodedEntryRefKeepsTheDeclaredCoordinate covers the
-// same identity defect on the components that are not schemas, where it was
-// wholly silent. Their entries resolve through the library, so the value arrived
-// intact and no unresolved-ref was ever emitted; only the pointer the entry
-// carried stayed encoded, and every ID hoisted beneath it inherited the
-// encoding — here the response's own content schema.
-func TestLowerService_PercentEncodedEntryRefKeepsTheDeclaredCoordinate(t *testing.T) {
-	t.Parallel()
-	doc, _, diags := lowerServiceSpec(t, `openapi: 3.1.0
-info: {title: T, version: "1"}
-paths:
-  /a:
-    get:
-      responses:
-        '200': {$ref: '#/components/responses/My%2DResp'}
-components:
-  responses:
-    My-Resp:
-      description: ok
-      content:
-        application/json:
-          schema: {type: object, properties: {q: {type: string}}}
-`)
-	openapitest.RequireNoErrorDiags(t, diags)
-
-	const want = ir.TypeID("t/anon/components/responses/My-Resp/content/application~1json/schema")
-	assert.Contains(t, doc.Types, want,
-		"the response body is hoisted at the coordinate the component declares")
-	for id := range doc.Types {
-		assert.NotContains(t, string(id), "%",
-			"no node is interned at an encoded path")
-	}
-}
-
-// TestLowerComponentSchemas_PercentEncodedDiscriminatorMapping covers the third
-// consumer of the pointer, and the one whose failure is loudest: a mapping entry
-// whose target does not resolve is dropped, so an encoded target silently cost
-// the union a branch of its polymorphic dispatch rather than merely degrading a
-// position's type. InternalPointer's contract has always named discriminator
-// mappings alongside $ref; nothing exercised that half.
-func TestLowerComponentSchemas_PercentEncodedDiscriminatorMapping(t *testing.T) {
-	t.Parallel()
-	doc, diags := lowerSpec(t, openapitest.ComponentSpec(
-		"    Cat-A: {type: object, properties: {kind: {type: string}}}\n"+
-			"    Pet:\n      oneOf: [{$ref: '#/components/schemas/Cat-A'}]\n"+
-			"      discriminator: {propertyName: kind, mapping: {cat: '#/components/schemas/Cat%2DA'}}\n"))
-	openapitest.RequireNoErrorDiags(t, diags)
-
-	pet, ok := typeByName(doc, "Pet").(*ir.Union)
-	require.True(t, ok, "Pet must own a Union node")
-	require.NotNil(t, pet.Discriminator, "the discriminator survives lowering")
-	assert.Equal(t, map[string]ir.TypeID{"cat": componentID("Cat-A")}, pet.Discriminator.Mapping,
-		"the encoded mapping target names the declared component, and the entry is kept")
-}
diff --git a/docs/compilers/openapi.md b/docs/compilers/openapi.md
index 03d06ef4..edf9bf04 100644
--- a/docs/compilers/openapi.md
+++ b/docs/compilers/openapi.md
@@ -1814,9 +1814,9 @@ on an object.
 - Cases: `constraints`, `numeric-precision`
 - Codes: `openapi/invalid-numeric-literal`, `openapi/invalid-exclusive-bound`,
   `openapi/degraded-construct`
-- Tests: `openapi.TestConstraints_ExclusiveBoolean30`,
-  `openapi.TestConstraints_ExclusiveWrongDialectForm`,
-  `openapi.TestConstraints_LosslessNumericLiterals`
+- Tests: `schema.TestConstraints_ExclusiveBoolean30`,
+  `schema.TestConstraints_ExclusiveWrongDialectForm`,
+  `schema.TestConstraints_LosslessNumericLiterals`
 - Status: partly built: a bound beside a `oneOf` or `anyOf` that lowers to a `Union` is dropped in
   silence (#848), and so is one beside a multi-typed schema that no carrier holds
   ([`type-arrays`](#type-arrays), #852); and an integer bound past what a 64-bit integer holds
diff --git a/docs/micro-compiler-design.md b/docs/micro-compiler-design.md
index efeb408d..8da22ca2 100644
--- a/docs/micro-compiler-design.md
+++ b/docs/micro-compiler-design.md
@@ -324,7 +324,7 @@ reports the identical error twice, printing the two provenances side by side.
 
 ```bash
 # the test that holds it, and what reddens it
-go test ./compilers/openapi -run TestConstraints_HoistedSubSchemaBadBoundSingleError
+go test ./compilers/openapi/internal/schema -run TestConstraints_HoistedSubSchemaBadBoundSingleError
 ```
 
 ## 5. The OpenAPI split

From e01c9958711da82ff983c93fe60b59400cdb14f2 Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 21:58:33 +0300
Subject: [PATCH 05/11] test: name unit test files for the file they test

Thirty-seven test files held tests of one source file under a name that
sorted nowhere near it: load's entry_internal_test.go tested Load in
load.go, engine's document_test.go tested Engine in engine.go, bind's
bind_test.go tested table.go. A reader looking for a file's tests could
not find them by name.

Each is renamed to start with the file it tests, keeping its topic
(load_entry_internal_test.go, engine_document_test.go, table_test.go),
so it sorts beside that file. A file is renamed only when every test in
it names a declaration of one source file; one whose tests name several
files is a scenario and keeps its name, as do main_test.go files,
test-only packages and packages with one source file. Only the comment
in engine/main_test.go that named a renamed file changes.
---
 cmd/morphic/{edgecases_test.go => main_edge_cases_test.go}   | 0
 cmd/morphic/{explain_test.go => main_explain_test.go}        | 0
 compilers/{configure_test.go => compilers_configure_test.go} | 0
 .../openapi/internal/bind/{bind_test.go => table_test.go}    | 0
 .../internal/bind/{through_test.go => table_through_test.go} | 0
 .../detect/{reading_test.go => recognize_reading_test.go}    | 0
 ...ngs_internal_test.go => bindings_corpus_internal_test.go} | 0
 ...internal_test.go => external_readerseam_internal_test.go} | 0
 .../{entry_internal_test.go => load_entry_internal_test.go}  | 0
 ...ileuri_internal_test.go => load_fileuri_internal_test.go} | 0
 ...rafted_internal_test.go => load_grafted_internal_test.go} | 0
 ...tdefs_internal_test.go => load_rootdefs_internal_test.go} | 0
 ...{tagged_internal_test.go => load_tagged_internal_test.go} | 0
 .../{documents_test.go => lowering_documents_test.go}        | 0
 .../internal/oas/{table_test.go => types_table_test.go}      | 0
 .../{budgets_test.go => operations_budgets_test.go}          | 0
 .../resolve/{holds_test.go => resolve_holds_test.go}         | 0
 .../schema/{budgets_test.go => schema_budgets_test.go}       | 0
 engine/{concurrency_test.go => engine_concurrency_test.go}   | 0
 engine/{document_test.go => engine_document_test.go}         | 0
 engine/{new_test.go => engine_new_test.go}                   | 0
 ...{sources_corpus_test.go => engine_sources_corpus_test.go} | 0
 engine/{sources_test.go => engine_sources_test.go}           | 0
 engine/{transform_test.go => engine_transform_test.go}       | 0
 engine/main_test.go                                          | 5 +++--
 .../{confinedopen_test.go => disk_confinedopen_test.go}      | 0
 .../{fetch_internal_test.go => disk_fetch_internal_test.go}  | 0
 ...ned_internal_test.go => disk_readopened_internal_test.go} | 0
 ...esolve_internal_test.go => disk_resolve_internal_test.go} | 0
 .../{special_unix_test.go => disk_special_unix_test.go}      | 0
 ...ri_internal_test.go => location_fileuri_internal_test.go} | 0
 ...ds_internal_test.go => jsonshape_bounds_internal_test.go} | 0
 ir/irfacts/{walk_test.go => index_walk_test.go}              | 0
 .../{verify_corpus_test.go => irverify_corpus_test.go}       | 0
 .../{verify_engine_test.go => irverify_engine_test.go}       | 0
 ir/irverify/{messages_test.go => irverify_messages_test.go}  | 0
 .../{walkchecks_test.go => irverify_walkchecks_test.go}      | 0
 .../{walkdepth_test.go => irverify_walkdepth_test.go}        | 0
 38 files changed, 3 insertions(+), 2 deletions(-)
 rename cmd/morphic/{edgecases_test.go => main_edge_cases_test.go} (100%)
 rename cmd/morphic/{explain_test.go => main_explain_test.go} (100%)
 rename compilers/{configure_test.go => compilers_configure_test.go} (100%)
 rename compilers/openapi/internal/bind/{bind_test.go => table_test.go} (100%)
 rename compilers/openapi/internal/bind/{through_test.go => table_through_test.go} (100%)
 rename compilers/openapi/internal/detect/{reading_test.go => recognize_reading_test.go} (100%)
 rename compilers/openapi/internal/load/{corpus_bindings_internal_test.go => bindings_corpus_internal_test.go} (100%)
 rename compilers/openapi/internal/load/{readerseam_internal_test.go => external_readerseam_internal_test.go} (100%)
 rename compilers/openapi/internal/load/{entry_internal_test.go => load_entry_internal_test.go} (100%)
 rename compilers/openapi/internal/load/{fileuri_internal_test.go => load_fileuri_internal_test.go} (100%)
 rename compilers/openapi/internal/load/{grafted_internal_test.go => load_grafted_internal_test.go} (100%)
 rename compilers/openapi/internal/load/{rootdefs_internal_test.go => load_rootdefs_internal_test.go} (100%)
 rename compilers/openapi/internal/load/{tagged_internal_test.go => load_tagged_internal_test.go} (100%)
 rename compilers/openapi/internal/lowering/{documents_test.go => lowering_documents_test.go} (100%)
 rename compilers/openapi/internal/oas/{table_test.go => types_table_test.go} (100%)
 rename compilers/openapi/internal/operation/{budgets_test.go => operations_budgets_test.go} (100%)
 rename compilers/openapi/internal/resolve/{holds_test.go => resolve_holds_test.go} (100%)
 rename compilers/openapi/internal/schema/{budgets_test.go => schema_budgets_test.go} (100%)
 rename engine/{concurrency_test.go => engine_concurrency_test.go} (100%)
 rename engine/{document_test.go => engine_document_test.go} (100%)
 rename engine/{new_test.go => engine_new_test.go} (100%)
 rename engine/{sources_corpus_test.go => engine_sources_corpus_test.go} (100%)
 rename engine/{sources_test.go => engine_sources_test.go} (100%)
 rename engine/{transform_test.go => engine_transform_test.go} (100%)
 rename engine/reader/{confinedopen_test.go => disk_confinedopen_test.go} (100%)
 rename engine/reader/{fetch_internal_test.go => disk_fetch_internal_test.go} (100%)
 rename engine/reader/{readopened_internal_test.go => disk_readopened_internal_test.go} (100%)
 rename engine/reader/{resolve_internal_test.go => disk_resolve_internal_test.go} (100%)
 rename engine/reader/{special_unix_test.go => disk_special_unix_test.go} (100%)
 rename engine/reader/{fileuri_internal_test.go => location_fileuri_internal_test.go} (100%)
 rename internal/jsonshape/{bounds_internal_test.go => jsonshape_bounds_internal_test.go} (100%)
 rename ir/irfacts/{walk_test.go => index_walk_test.go} (100%)
 rename ir/irverify/{verify_corpus_test.go => irverify_corpus_test.go} (100%)
 rename ir/irverify/{verify_engine_test.go => irverify_engine_test.go} (100%)
 rename ir/irverify/{messages_test.go => irverify_messages_test.go} (100%)
 rename ir/irverify/{walkchecks_test.go => irverify_walkchecks_test.go} (100%)
 rename ir/irverify/{walkdepth_test.go => irverify_walkdepth_test.go} (100%)

diff --git a/cmd/morphic/edgecases_test.go b/cmd/morphic/main_edge_cases_test.go
similarity index 100%
rename from cmd/morphic/edgecases_test.go
rename to cmd/morphic/main_edge_cases_test.go
diff --git a/cmd/morphic/explain_test.go b/cmd/morphic/main_explain_test.go
similarity index 100%
rename from cmd/morphic/explain_test.go
rename to cmd/morphic/main_explain_test.go
diff --git a/compilers/configure_test.go b/compilers/compilers_configure_test.go
similarity index 100%
rename from compilers/configure_test.go
rename to compilers/compilers_configure_test.go
diff --git a/compilers/openapi/internal/bind/bind_test.go b/compilers/openapi/internal/bind/table_test.go
similarity index 100%
rename from compilers/openapi/internal/bind/bind_test.go
rename to compilers/openapi/internal/bind/table_test.go
diff --git a/compilers/openapi/internal/bind/through_test.go b/compilers/openapi/internal/bind/table_through_test.go
similarity index 100%
rename from compilers/openapi/internal/bind/through_test.go
rename to compilers/openapi/internal/bind/table_through_test.go
diff --git a/compilers/openapi/internal/detect/reading_test.go b/compilers/openapi/internal/detect/recognize_reading_test.go
similarity index 100%
rename from compilers/openapi/internal/detect/reading_test.go
rename to compilers/openapi/internal/detect/recognize_reading_test.go
diff --git a/compilers/openapi/internal/load/corpus_bindings_internal_test.go b/compilers/openapi/internal/load/bindings_corpus_internal_test.go
similarity index 100%
rename from compilers/openapi/internal/load/corpus_bindings_internal_test.go
rename to compilers/openapi/internal/load/bindings_corpus_internal_test.go
diff --git a/compilers/openapi/internal/load/readerseam_internal_test.go b/compilers/openapi/internal/load/external_readerseam_internal_test.go
similarity index 100%
rename from compilers/openapi/internal/load/readerseam_internal_test.go
rename to compilers/openapi/internal/load/external_readerseam_internal_test.go
diff --git a/compilers/openapi/internal/load/entry_internal_test.go b/compilers/openapi/internal/load/load_entry_internal_test.go
similarity index 100%
rename from compilers/openapi/internal/load/entry_internal_test.go
rename to compilers/openapi/internal/load/load_entry_internal_test.go
diff --git a/compilers/openapi/internal/load/fileuri_internal_test.go b/compilers/openapi/internal/load/load_fileuri_internal_test.go
similarity index 100%
rename from compilers/openapi/internal/load/fileuri_internal_test.go
rename to compilers/openapi/internal/load/load_fileuri_internal_test.go
diff --git a/compilers/openapi/internal/load/grafted_internal_test.go b/compilers/openapi/internal/load/load_grafted_internal_test.go
similarity index 100%
rename from compilers/openapi/internal/load/grafted_internal_test.go
rename to compilers/openapi/internal/load/load_grafted_internal_test.go
diff --git a/compilers/openapi/internal/load/rootdefs_internal_test.go b/compilers/openapi/internal/load/load_rootdefs_internal_test.go
similarity index 100%
rename from compilers/openapi/internal/load/rootdefs_internal_test.go
rename to compilers/openapi/internal/load/load_rootdefs_internal_test.go
diff --git a/compilers/openapi/internal/load/tagged_internal_test.go b/compilers/openapi/internal/load/load_tagged_internal_test.go
similarity index 100%
rename from compilers/openapi/internal/load/tagged_internal_test.go
rename to compilers/openapi/internal/load/load_tagged_internal_test.go
diff --git a/compilers/openapi/internal/lowering/documents_test.go b/compilers/openapi/internal/lowering/lowering_documents_test.go
similarity index 100%
rename from compilers/openapi/internal/lowering/documents_test.go
rename to compilers/openapi/internal/lowering/lowering_documents_test.go
diff --git a/compilers/openapi/internal/oas/table_test.go b/compilers/openapi/internal/oas/types_table_test.go
similarity index 100%
rename from compilers/openapi/internal/oas/table_test.go
rename to compilers/openapi/internal/oas/types_table_test.go
diff --git a/compilers/openapi/internal/operation/budgets_test.go b/compilers/openapi/internal/operation/operations_budgets_test.go
similarity index 100%
rename from compilers/openapi/internal/operation/budgets_test.go
rename to compilers/openapi/internal/operation/operations_budgets_test.go
diff --git a/compilers/openapi/internal/resolve/holds_test.go b/compilers/openapi/internal/resolve/resolve_holds_test.go
similarity index 100%
rename from compilers/openapi/internal/resolve/holds_test.go
rename to compilers/openapi/internal/resolve/resolve_holds_test.go
diff --git a/compilers/openapi/internal/schema/budgets_test.go b/compilers/openapi/internal/schema/schema_budgets_test.go
similarity index 100%
rename from compilers/openapi/internal/schema/budgets_test.go
rename to compilers/openapi/internal/schema/schema_budgets_test.go
diff --git a/engine/concurrency_test.go b/engine/engine_concurrency_test.go
similarity index 100%
rename from engine/concurrency_test.go
rename to engine/engine_concurrency_test.go
diff --git a/engine/document_test.go b/engine/engine_document_test.go
similarity index 100%
rename from engine/document_test.go
rename to engine/engine_document_test.go
diff --git a/engine/new_test.go b/engine/engine_new_test.go
similarity index 100%
rename from engine/new_test.go
rename to engine/engine_new_test.go
diff --git a/engine/sources_corpus_test.go b/engine/engine_sources_corpus_test.go
similarity index 100%
rename from engine/sources_corpus_test.go
rename to engine/engine_sources_corpus_test.go
diff --git a/engine/sources_test.go b/engine/engine_sources_test.go
similarity index 100%
rename from engine/sources_test.go
rename to engine/engine_sources_test.go
diff --git a/engine/transform_test.go b/engine/engine_transform_test.go
similarity index 100%
rename from engine/transform_test.go
rename to engine/engine_transform_test.go
diff --git a/engine/main_test.go b/engine/main_test.go
index 4b6acc6d..c9fe2535 100644
--- a/engine/main_test.go
+++ b/engine/main_test.go
@@ -7,8 +7,9 @@ import (
 )
 
 // TestMain runs this package's tests through leakcheck.Main.
-// TestEngine_ConcurrentRunSharesOneEngine, in concurrency_test.go, fans work
-// out over sync.WaitGroup.Go, which starts a real goroutine per worker.
+// TestEngine_ConcurrentRunSharesOneEngine, in engine_concurrency_test.go,
+// fans work out over sync.WaitGroup.Go, which starts a real goroutine per
+// worker.
 func TestMain(m *testing.M) {
 	leakcheck.Main(m)
 }
diff --git a/engine/reader/confinedopen_test.go b/engine/reader/disk_confinedopen_test.go
similarity index 100%
rename from engine/reader/confinedopen_test.go
rename to engine/reader/disk_confinedopen_test.go
diff --git a/engine/reader/fetch_internal_test.go b/engine/reader/disk_fetch_internal_test.go
similarity index 100%
rename from engine/reader/fetch_internal_test.go
rename to engine/reader/disk_fetch_internal_test.go
diff --git a/engine/reader/readopened_internal_test.go b/engine/reader/disk_readopened_internal_test.go
similarity index 100%
rename from engine/reader/readopened_internal_test.go
rename to engine/reader/disk_readopened_internal_test.go
diff --git a/engine/reader/resolve_internal_test.go b/engine/reader/disk_resolve_internal_test.go
similarity index 100%
rename from engine/reader/resolve_internal_test.go
rename to engine/reader/disk_resolve_internal_test.go
diff --git a/engine/reader/special_unix_test.go b/engine/reader/disk_special_unix_test.go
similarity index 100%
rename from engine/reader/special_unix_test.go
rename to engine/reader/disk_special_unix_test.go
diff --git a/engine/reader/fileuri_internal_test.go b/engine/reader/location_fileuri_internal_test.go
similarity index 100%
rename from engine/reader/fileuri_internal_test.go
rename to engine/reader/location_fileuri_internal_test.go
diff --git a/internal/jsonshape/bounds_internal_test.go b/internal/jsonshape/jsonshape_bounds_internal_test.go
similarity index 100%
rename from internal/jsonshape/bounds_internal_test.go
rename to internal/jsonshape/jsonshape_bounds_internal_test.go
diff --git a/ir/irfacts/walk_test.go b/ir/irfacts/index_walk_test.go
similarity index 100%
rename from ir/irfacts/walk_test.go
rename to ir/irfacts/index_walk_test.go
diff --git a/ir/irverify/verify_corpus_test.go b/ir/irverify/irverify_corpus_test.go
similarity index 100%
rename from ir/irverify/verify_corpus_test.go
rename to ir/irverify/irverify_corpus_test.go
diff --git a/ir/irverify/verify_engine_test.go b/ir/irverify/irverify_engine_test.go
similarity index 100%
rename from ir/irverify/verify_engine_test.go
rename to ir/irverify/irverify_engine_test.go
diff --git a/ir/irverify/messages_test.go b/ir/irverify/irverify_messages_test.go
similarity index 100%
rename from ir/irverify/messages_test.go
rename to ir/irverify/irverify_messages_test.go
diff --git a/ir/irverify/walkchecks_test.go b/ir/irverify/irverify_walkchecks_test.go
similarity index 100%
rename from ir/irverify/walkchecks_test.go
rename to ir/irverify/irverify_walkchecks_test.go
diff --git a/ir/irverify/walkdepth_test.go b/ir/irverify/irverify_walkdepth_test.go
similarity index 100%
rename from ir/irverify/walkdepth_test.go
rename to ir/irverify/irverify_walkdepth_test.go

From c122f4d41a2544f0965aab150270e4bea6aa5511 Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 22:00:14 +0300
Subject: [PATCH 06/11] test(internal/archtest): hold qualified test citations
 to their package

TestDocuments_NameOnlyTestsThatExist read a span such as
`openapi.TestCompile_X` as no test name at all, since its pattern began
at Test, so a citation naming the package a test used to live in passed
unread. Moving tests between packages is exactly when that goes stale.

declaredTests now records the package declaring each test, an external
test package under the package it tests, and a span qualified as
pkg.TestName must name a test of package pkg. The lowering
specification's citation shape, `package.TestName`, joins the
placeholders.
---
 internal/archtest/testnames_test.go | 75 +++++++++++++++++++----------
 1 file changed, 50 insertions(+), 25 deletions(-)

diff --git a/internal/archtest/testnames_test.go b/internal/archtest/testnames_test.go
index 9a8a9b15..7642d56d 100644
--- a/internal/archtest/testnames_test.go
+++ b/internal/archtest/testnames_test.go
@@ -19,20 +19,23 @@ import (
 )
 
 // testNameSpan is a span of code that is a test's name alone, optionally
-// followed by a subtest path, which is not read.
-var testNameSpan = regexp.MustCompile(`^(Test[A-Za-z0-9_]*)(?:/\S*)?$`)
+// qualified by its package's name and followed by a subtest path, which is not
+// read.
+var testNameSpan = regexp.MustCompile(`^(?:([a-z][a-z0-9]*)\.)?(Test[A-Za-z0-9_]*)(?:/\S*)?$`)
 
 // testNamePlaceholders are the spans written as a test's name that stand for
 // no test, each with the reason.
 var testNamePlaceholders = map[string]string{
 	"TestFunc_Scenario": "the root guidance's naming convention, spelled as a shape",
+	"package.TestName":  "the lowering specification's citation form, spelled as a shape",
 }
 
 // TestDocuments_NameOnlyTestsThatExist reads every Markdown document of the
-// repository and fails on a span of code naming a test no test file declares.
-// The documents send a reader to a test by name — the contributor guide's
-// steps each name the check that fails when the step is missed — so a test
-// renamed without them sends the reader nowhere.
+// repository and fails on a span of code naming a test no test file declares,
+// or, written as pkg.TestName, none of package pkg's does. The documents send
+// a reader to a test by name — the contributor guide's steps each name the
+// check that fails when the step is missed — so a test renamed or moved
+// without them sends the reader nowhere.
 func TestDocuments_NameOnlyTestsThatExist(t *testing.T) {
 	t.Parallel()
 	root := repoRoot(t)
@@ -51,7 +54,7 @@ func TestDocuments_NameOnlyTestsThatExist(t *testing.T) {
 // that declared lacks, and counts the names it read. A span naming a family by
 // its prefix, `TestLoweringSpec` for the TestLoweringSpec_ tests, names a test
 // when one is declared in that family.
-func testNameProblems(root string, declared map[string]bool) ([]string, int, error) {
+func testNameProblems(root string, declared map[string]map[string]bool) ([]string, int, error) {
 	var problems []string
 	named := 0
 	err := keydoc.Walk(root, ".", func(path string) error {
@@ -66,13 +69,18 @@ func testNameProblems(root string, declared map[string]bool) ([]string, int, err
 		for i, line := range strings.Split(string(text), "\n") {
 			for _, span := range keydoc.Spans(line) {
 				m := testNameSpan.FindStringSubmatch(span)
-				if m == nil || testNamePlaceholders[m[1]] != "" {
+				if m == nil || testNamePlaceholders[strings.TrimPrefix(m[1]+"."+m[2], ".")] != "" {
 					continue
 				}
 				named++
-				if !declaresTest(declared, m[1]) {
-					problems = append(problems, fmt.Sprintf("%s:%d names %q, which no test file declares", rel, i+1, span))
+				if declaresTest(declared, m[1], m[2]) {
+					continue
+				}
+				which := "no test file"
+				if m[1] != "" {
+					which = "no test file of package " + m[1]
 				}
+				problems = append(problems, fmt.Sprintf("%s:%d names %q, which %s declares", rel, i+1, span, which))
 			}
 		}
 		return nil
@@ -81,13 +89,13 @@ func testNameProblems(root string, declared map[string]bool) ([]string, int, err
 }
 
 // declaresTest reports whether declared holds name, or a test in the family
-// name prefixes.
-func declaresTest(declared map[string]bool, name string) bool {
-	if declared[name] {
-		return true
-	}
-	for d := range declared {
-		if strings.HasPrefix(d, name+"_") {
+// name prefixes, in package pkg, or in any package when pkg is empty.
+func declaresTest(declared map[string]map[string]bool, pkg, name string) bool {
+	for d, pkgs := range declared {
+		if d != name && !strings.HasPrefix(d, name+"_") {
+			continue
+		}
+		if pkg == "" || pkgs[pkg] {
 			return true
 		}
 	}
@@ -95,16 +103,22 @@ func declaresTest(declared map[string]bool, name string) bool {
 }
 
 // declaredTests returns the name of every test function the test files under
-// root declare: a top-level Test… taking a *testing.T alone.
-func declaredTests(root string) (map[string]bool, error) {
-	out := map[string]bool{}
+// root declare, a top-level Test… taking a *testing.T alone, with the names of
+// the packages declaring it. An external test package counts as the package it
+// tests, the name a document qualifies its tests by.
+func declaredTests(root string) (map[string]map[string]bool, error) {
+	out := map[string]map[string]bool{}
 	err := walkGoFiles(root, func(rel string, _ *token.FileSet, f *ast.File) {
 		if !strings.HasSuffix(rel, "_test.go") {
 			return
 		}
+		pkg := strings.TrimSuffix(f.Name.Name, "_test")
 		for _, decl := range f.Decls {
 			if fn, ok := decl.(*ast.FuncDecl); ok && takesTestingT(fn) {
-				out[fn.Name.Name] = true
+				if out[fn.Name.Name] == nil {
+					out[fn.Name.Name] = map[string]bool{}
+				}
+				out[fn.Name.Name][pkg] = true
 			}
 		}
 	})
@@ -130,7 +144,8 @@ func takesTestingT(fn *ast.FuncDecl) bool {
 
 // TestTestNameProblems_ReportsANameNoTestDeclares plants names in Markdown a
 // test declares, a family prefix, a subtest, a placeholder, a name inside a
-// longer span, and names nothing declares, in a document and under testdata.
+// longer span, and names nothing declares, in a document and under testdata,
+// each bare and qualified by its package, the wrong one and one no file has.
 func TestTestNameProblems_ReportsANameNoTestDeclares(t *testing.T) {
 	t.Parallel()
 	root := t.TempDir()
@@ -138,22 +153,32 @@ func TestTestNameProblems_ReportsANameNoTestDeclares(t *testing.T) {
 		"package a\n\nimport \"testing\"\n\nfunc TestReal(t *testing.T) {}\n\n"+
 			"func TestFamily_One(t *testing.T) {}\n\nfunc TestHelper() {}\n")
 	writeDocFile(t, filepath.Join(root, "a", "b.go"), "package a\n\nfunc TestNotATest(t *testing.T) {}\n")
+	writeDocFile(t, filepath.Join(root, "b", "b_test.go"),
+		"package b_test\n\nimport \"testing\"\n\nfunc TestOther(t *testing.T) {}\n")
 	writeDocFile(t, filepath.Join(root, "GUIDE.md"), "Run `TestReal`, `TestFamily`, `TestReal/sub` and\n"+
-		"`TestFunc_Scenario`; `go test -run TestGone` is a command.\n`TestGone` and `TestHelper` and `TestNotATest`.\n")
+		"`TestFunc_Scenario`; `go test -run TestGone` is a command.\n`TestGone` and `TestHelper` and `TestNotATest`.\n"+
+		"`a.TestReal`, `a.TestFamily`, `b.TestOther/sub` and `package.TestName`.\n"+
+		"`b.TestReal` and `c.TestReal`.\n")
 	writeDocFile(t, filepath.Join(root, "x", "testdata", "fixture.md"), "`TestUnread`\n")
 	writeDocFile(t, filepath.Join(root, ".hidden", "h.md"), "`TestUnreadHidden`\n")
 
 	declared, err := declaredTests(root)
 	require.NoError(t, err)
-	assert.Equal(t, map[string]bool{"TestReal": true, "TestFamily_One": true}, declared)
+	assert.Equal(t, map[string]map[string]bool{
+		"TestReal":       {"a": true},
+		"TestFamily_One": {"a": true},
+		"TestOther":      {"b": true},
+	}, declared, "a test is recorded under its package, an external test package's under the package it tests")
 
 	problems, named, err := testNameProblems(root, declared)
 	require.NoError(t, err)
-	assert.Equal(t, 6, named, "each name read is counted once")
+	assert.Equal(t, 11, named, "each name read is counted once")
 	assert.Equal(t, []string{
 		`GUIDE.md:3 names "TestGone", which no test file declares`,
 		`GUIDE.md:3 names "TestHelper", which no test file declares`,
 		`GUIDE.md:3 names "TestNotATest", which no test file declares`,
+		`GUIDE.md:5 names "b.TestReal", which no test file of package b declares`,
+		`GUIDE.md:5 names "c.TestReal", which no test file of package c declares`,
 	}, problems)
 
 	_, _, err = testNameProblems(filepath.Join(root, "absent"), declared)

From affc5e1160daa4432d408ce698a6c2c7748580cd Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 22:04:15 +0300
Subject: [PATCH 07/11] test: place method tests and split two-subject test
 files

The renaming pass read a test's subject from a function or type its name
names, so a test named for a method or an initialism missed: oas's
TestCheck_ tests are of Checker.Check in engine.go, nodeview's of View
methods in nodeview.go, lowering's within tests of Ctx.InScope in
lowering.go, the root's SourceTable tests of Compiler.SourceTable in
openapi.go, and keydoc's TestYAMLComment_ of yamlComment in cite.go.
Their files are renamed to sort beside those files.

Two files held the tests of two source files under one name.
compile_test.go becomes types_test.go and gives its Diags tests to
diags_test.go; harness's internal_test.go becomes
harness_internal_test.go and gives the in-package tests of path.go to
path_internal_test.go, with the stub compiler both use in
helpers_internal_test.go. The declarations are byte-identical.
---
 compilers/compile/diags_test.go               |  70 ++++++++
 .../{compile_test.go => types_test.go}        |  59 -------
 ...within_test.go => lowering_within_test.go} |   0
 ...go => nodeview_documentpath_bench_test.go} |   0
 ...est.go => nodeview_model_internal_test.go} |   0
 ...code_test.go => engine_check_code_test.go} |   0
 ...ds_test.go => engine_check_fields_test.go} |   0
 ...ter_test.go => engine_check_later_test.go} |   0
 ...les_test.go => engine_check_rules_test.go} |   0
 ...ax_test.go => engine_check_syntax_test.go} |   0
 ...le_test.go => openapi_sourcetable_test.go} |   0
 ...ernal_test.go => harness_internal_test.go} | 150 ------------------
 internal/harness/helpers_internal_test.go     |  71 +++++++++
 internal/harness/path_internal_test.go        | 103 ++++++++++++
 ...nal_test.go => cite_yaml_internal_test.go} |   0
 15 files changed, 244 insertions(+), 209 deletions(-)
 create mode 100644 compilers/compile/diags_test.go
 rename compilers/compile/{compile_test.go => types_test.go} (85%)
 rename compilers/openapi/internal/lowering/{within_test.go => lowering_within_test.go} (100%)
 rename compilers/openapi/internal/nodeview/{documentpath_bench_test.go => nodeview_documentpath_bench_test.go} (100%)
 rename compilers/openapi/internal/nodeview/{model_internal_test.go => nodeview_model_internal_test.go} (100%)
 rename compilers/openapi/internal/oas/{check_code_test.go => engine_check_code_test.go} (100%)
 rename compilers/openapi/internal/oas/{check_fields_test.go => engine_check_fields_test.go} (100%)
 rename compilers/openapi/internal/oas/{check_later_test.go => engine_check_later_test.go} (100%)
 rename compilers/openapi/internal/oas/{check_rules_test.go => engine_check_rules_test.go} (100%)
 rename compilers/openapi/internal/oas/{check_syntax_test.go => engine_check_syntax_test.go} (100%)
 rename compilers/openapi/{sourcetable_test.go => openapi_sourcetable_test.go} (100%)
 rename internal/harness/{internal_test.go => harness_internal_test.go} (74%)
 create mode 100644 internal/harness/helpers_internal_test.go
 create mode 100644 internal/harness/path_internal_test.go
 rename internal/keydoc/{yaml_internal_test.go => cite_yaml_internal_test.go} (100%)

diff --git a/compilers/compile/diags_test.go b/compilers/compile/diags_test.go
new file mode 100644
index 00000000..09739e4d
--- /dev/null
+++ b/compilers/compile/diags_test.go
@@ -0,0 +1,70 @@
+package compile_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers/compile"
+	"github.com/dexpace/morphic/ir"
+)
+
+// TestDiags_DedupesByFullIdentity pins that the collapse is by identity and
+// nothing coarser: two findings differing in any one field both survive.
+func TestDiags_DedupesByFullIdentity(t *testing.T) {
+	t.Parallel()
+	base := ir.Diagnostic{
+		Severity:   ir.SeverityError,
+		Code:       "x/y",
+		Message:    "m",
+		Provenance: ir.Provenance{Source: 0, Pointer: "/p"},
+	}
+	differs := map[string]func(d *ir.Diagnostic){
+		"severity":        func(d *ir.Diagnostic) { d.Severity = ir.SeverityInfo },
+		"code":            func(d *ir.Diagnostic) { d.Code = "x/z" },
+		"message":         func(d *ir.Diagnostic) { d.Message = "other" },
+		"source":          func(d *ir.Diagnostic) { d.Provenance.Source = 1 },
+		"pointer":         func(d *ir.Diagnostic) { d.Provenance.Pointer = "/q" },
+		"inferredBy":      func(d *ir.Diagnostic) { d.Provenance.Inferred = "guess" },
+		"position line":   func(d *ir.Diagnostic) { d.Provenance.Position.Line = 5 },
+		"position column": func(d *ir.Diagnostic) { d.Provenance.Position.Column = 5 },
+		"node":            func(d *ir.Diagnostic) { d.Provenance.Node = "op/x" },
+	}
+	for name, mutate := range differs {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			var d compile.Diags
+			d.Append(base)
+			d.Append(base)
+			require.Equal(t, 1, d.Len(), "an identical repeat collapses")
+
+			other := base
+			mutate(&other)
+			d.Append(other)
+			assert.Equal(t, 2, d.Len(), "a diagnostic differing in %s is a distinct finding", name)
+		})
+	}
+}
+
+func TestDiags_AppendAllPreservesFirstSeenOrder(t *testing.T) {
+	t.Parallel()
+	mk := func(code string) ir.Diagnostic {
+		return ir.Diagnostic{Severity: ir.SeverityError, Code: code}
+	}
+	var d compile.Diags
+	d.AppendAll([]ir.Diagnostic{mk("a"), mk("b"), mk("a"), mk("c")})
+
+	got := make([]string, 0, d.Len())
+	for _, x := range d.List() {
+		got = append(got, x.Code)
+	}
+	assert.Equal(t, []string{"a", "b", "c"}, got)
+}
+
+func TestDiags_ZeroValueIsUsable(t *testing.T) {
+	t.Parallel()
+	var d compile.Diags
+	assert.Zero(t, d.Len())
+	assert.Empty(t, d.List())
+}
diff --git a/compilers/compile/compile_test.go b/compilers/compile/types_test.go
similarity index 85%
rename from compilers/compile/compile_test.go
rename to compilers/compile/types_test.go
index df37c016..9f4f1d35 100644
--- a/compilers/compile/compile_test.go
+++ b/compilers/compile/types_test.go
@@ -146,65 +146,6 @@ func TestTypes_RegistryIsTheLiveMap(t *testing.T) {
 	assert.Contains(t, types.String(), "types: 1")
 }
 
-// TestDiags_DedupesByFullIdentity pins that the collapse is by identity and
-// nothing coarser: two findings differing in any one field both survive.
-func TestDiags_DedupesByFullIdentity(t *testing.T) {
-	t.Parallel()
-	base := ir.Diagnostic{
-		Severity:   ir.SeverityError,
-		Code:       "x/y",
-		Message:    "m",
-		Provenance: ir.Provenance{Source: 0, Pointer: "/p"},
-	}
-	differs := map[string]func(d *ir.Diagnostic){
-		"severity":        func(d *ir.Diagnostic) { d.Severity = ir.SeverityInfo },
-		"code":            func(d *ir.Diagnostic) { d.Code = "x/z" },
-		"message":         func(d *ir.Diagnostic) { d.Message = "other" },
-		"source":          func(d *ir.Diagnostic) { d.Provenance.Source = 1 },
-		"pointer":         func(d *ir.Diagnostic) { d.Provenance.Pointer = "/q" },
-		"inferredBy":      func(d *ir.Diagnostic) { d.Provenance.Inferred = "guess" },
-		"position line":   func(d *ir.Diagnostic) { d.Provenance.Position.Line = 5 },
-		"position column": func(d *ir.Diagnostic) { d.Provenance.Position.Column = 5 },
-		"node":            func(d *ir.Diagnostic) { d.Provenance.Node = "op/x" },
-	}
-	for name, mutate := range differs {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			var d compile.Diags
-			d.Append(base)
-			d.Append(base)
-			require.Equal(t, 1, d.Len(), "an identical repeat collapses")
-
-			other := base
-			mutate(&other)
-			d.Append(other)
-			assert.Equal(t, 2, d.Len(), "a diagnostic differing in %s is a distinct finding", name)
-		})
-	}
-}
-
-func TestDiags_AppendAllPreservesFirstSeenOrder(t *testing.T) {
-	t.Parallel()
-	mk := func(code string) ir.Diagnostic {
-		return ir.Diagnostic{Severity: ir.SeverityError, Code: code}
-	}
-	var d compile.Diags
-	d.AppendAll([]ir.Diagnostic{mk("a"), mk("b"), mk("a"), mk("c")})
-
-	got := make([]string, 0, d.Len())
-	for _, x := range d.List() {
-		got = append(got, x.Code)
-	}
-	assert.Equal(t, []string{"a", "b", "c"}, got)
-}
-
-func TestDiags_ZeroValueIsUsable(t *testing.T) {
-	t.Parallel()
-	var d compile.Diags
-	assert.Zero(t, d.Len())
-	assert.Empty(t, d.List())
-}
-
 // TestTypes_RefusesEntriesTheRegistryCannotHold covers the boundary this type
 // exists to hold. It owns the registry's invariants, so it is also the one place
 // able to manufacture the malformed states irverify and pass.Validate report —
diff --git a/compilers/openapi/internal/lowering/within_test.go b/compilers/openapi/internal/lowering/lowering_within_test.go
similarity index 100%
rename from compilers/openapi/internal/lowering/within_test.go
rename to compilers/openapi/internal/lowering/lowering_within_test.go
diff --git a/compilers/openapi/internal/nodeview/documentpath_bench_test.go b/compilers/openapi/internal/nodeview/nodeview_documentpath_bench_test.go
similarity index 100%
rename from compilers/openapi/internal/nodeview/documentpath_bench_test.go
rename to compilers/openapi/internal/nodeview/nodeview_documentpath_bench_test.go
diff --git a/compilers/openapi/internal/nodeview/model_internal_test.go b/compilers/openapi/internal/nodeview/nodeview_model_internal_test.go
similarity index 100%
rename from compilers/openapi/internal/nodeview/model_internal_test.go
rename to compilers/openapi/internal/nodeview/nodeview_model_internal_test.go
diff --git a/compilers/openapi/internal/oas/check_code_test.go b/compilers/openapi/internal/oas/engine_check_code_test.go
similarity index 100%
rename from compilers/openapi/internal/oas/check_code_test.go
rename to compilers/openapi/internal/oas/engine_check_code_test.go
diff --git a/compilers/openapi/internal/oas/check_fields_test.go b/compilers/openapi/internal/oas/engine_check_fields_test.go
similarity index 100%
rename from compilers/openapi/internal/oas/check_fields_test.go
rename to compilers/openapi/internal/oas/engine_check_fields_test.go
diff --git a/compilers/openapi/internal/oas/check_later_test.go b/compilers/openapi/internal/oas/engine_check_later_test.go
similarity index 100%
rename from compilers/openapi/internal/oas/check_later_test.go
rename to compilers/openapi/internal/oas/engine_check_later_test.go
diff --git a/compilers/openapi/internal/oas/check_rules_test.go b/compilers/openapi/internal/oas/engine_check_rules_test.go
similarity index 100%
rename from compilers/openapi/internal/oas/check_rules_test.go
rename to compilers/openapi/internal/oas/engine_check_rules_test.go
diff --git a/compilers/openapi/internal/oas/check_syntax_test.go b/compilers/openapi/internal/oas/engine_check_syntax_test.go
similarity index 100%
rename from compilers/openapi/internal/oas/check_syntax_test.go
rename to compilers/openapi/internal/oas/engine_check_syntax_test.go
diff --git a/compilers/openapi/sourcetable_test.go b/compilers/openapi/openapi_sourcetable_test.go
similarity index 100%
rename from compilers/openapi/sourcetable_test.go
rename to compilers/openapi/openapi_sourcetable_test.go
diff --git a/internal/harness/internal_test.go b/internal/harness/harness_internal_test.go
similarity index 74%
rename from internal/harness/internal_test.go
rename to internal/harness/harness_internal_test.go
index 05958eb0..59544268 100644
--- a/internal/harness/internal_test.go
+++ b/internal/harness/harness_internal_test.go
@@ -1,7 +1,6 @@
 package harness
 
 import (
-	"bytes"
 	"context"
 	"encoding/json/v2"
 	"errors"
@@ -14,26 +13,10 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexpace/morphic/compilers"
-	"github.com/dexpace/morphic/engine"
-	"github.com/dexpace/morphic/internal/testspec"
 	"github.com/dexpace/morphic/ir"
 	"github.com/dexpace/morphic/ir/irverify"
 )
 
-// emptySHA256 is the SHA-256 of zero bytes in lowercase hex, the digest a
-// source table entry carries.
-const emptySHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-
-// tables returns the source table and service every compiled document carries,
-// and the namespaces their IDs and the fixtures' types live in, so a stub
-// document reaches the oracle it is named for rather than the checks of the
-// tables.
-func tables() ([]ir.SourceInfo, []ir.Service, map[string][]string) {
-	return []ir.SourceInfo{{Format: "openapi@3.1", Path: "api.yaml", Hash: emptySHA256}},
-		[]ir.Service{{ID: "s/x/S", Name: ir.Naming{Source: "svc", Canonical: "svc"}}},
-		map[string][]string{ir.IDKindType: {"x"}, ir.IDKindService: {"x"}}
-}
-
 // badExtDoc returns a document that cannot be marshalled: its Unmodeled holds
 // an ir.RawValue with malformed bytes, which the encoder refuses when it writes
 // the value into the document.
@@ -349,78 +332,6 @@ func TestCheck_NondeterministicOutcome(t *testing.T) {
 	assert.Equal(t, OutcomeNondeterministic, r.Outcome)
 }
 
-func TestIsSnapshot_Names(t *testing.T) {
-	assert.True(t, isSnapshot("ir.golden.json"), "golden IR snapshots are skipped")
-	assert.True(t, isSnapshot("unwitnessed.golden.txt"), "whatever their extension")
-	assert.False(t, isSnapshot("api.yaml"))
-	assert.False(t, isSnapshot("golden.yaml"), "the marker is a name part, not any name containing the word")
-}
-
-func TestCheckFile_ReadErrorOnDirectory(t *testing.T) {
-	// os.ReadFile of a directory fails with EISDIR, which checkFile surfaces as a
-	// Go error rather than a Result.
-	_, err := checkFile(context.Background(), t.TempDir())
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "harness: read")
-}
-
-func TestListDir_WalkErrorPropagates(t *testing.T) {
-	// SpecFiles stats its path first, so a walk that fails is reached here, with
-	// a directory that does not exist: WalkDir invokes the callback with a
-	// non-nil error, which listDir wraps and returns.
-	reg, err := newRegistry()
-	require.NoError(t, err)
-
-	files, err := listDir(context.Background(), reg, filepath.Join(t.TempDir(), "absent"))
-	require.Error(t, err)
-	assert.Nil(t, files)
-	assert.Contains(t, err.Error(), "harness: walk")
-}
-
-func TestCheckPath_UnreadableSpecInADirectoryErrors(t *testing.T) {
-	// A broken symlink cannot be read to decide whether a compiler takes it. The
-	// sweep aborts with that error rather than a silent skip, since a file it
-	// passed over would be one it never checked.
-	dir := t.TempDir()
-	link := filepath.Join(dir, "spec.yaml")
-	require.NoError(t, os.Symlink(filepath.Join(dir, "no-such-target"), link))
-
-	results, err := CheckPath(context.Background(), dir)
-	require.Error(t, err)
-	assert.Nil(t, results)
-	assert.Contains(t, err.Error(), "harness: read")
-}
-
-// stubFormat is the format stubCompiler serves, one the engine does not carry.
-var stubFormat = compilers.SourceFormat{Name: "stub", Version: "1.0"}
-
-// stubCompiler is a compiler the engine does not register. It takes any source
-// that mentions its marker, and lower stands for its lowering.
-type stubCompiler struct {
-	lower func(sources []compilers.Source) (*ir.Document, []ir.Diagnostic, error)
-}
-
-func (stubCompiler) Formats() []compilers.SourceFormat {
-	return []compilers.SourceFormat{stubFormat}
-}
-
-func (stubCompiler) Detect(src compilers.Source, _ compilers.Options) (compilers.Recognition, []ir.Diagnostic, bool) {
-	if !bytes.Contains(src.Data, []byte("stub:")) {
-		return compilers.Recognition{}, nil, false
-	}
-	return compilers.Recognition{Format: stubFormat}, nil, true
-}
-
-func (stubCompiler) DecodeOptions(compilers.OptionSet) (any, error) { return nil, nil }
-
-func (stubCompiler) SourceTable(sources []compilers.Source, _ compilers.Options) []ir.SourceInfo {
-	return []ir.SourceInfo{{Path: sources[0].Path}}
-}
-
-func (c stubCompiler) Compile(_ context.Context, sources []compilers.Source, _ compilers.Options) (*ir.Document, []ir.Diagnostic, error) {
-	return c.lower(sources)
-}
-
 // stubDocument is a sound document for the one source, naming the first key of
 // its text as a model, so a lowering that reads it reads the mapping's order.
 func stubDocument(sources []compilers.Source, byFirstKey bool) *ir.Document {
@@ -440,22 +351,6 @@ func stubDocument(sources []compilers.Source, byFirstKey bool) *ir.Document {
 // oracle has entries to permute.
 const stubSource = "stub: 1\na: x\nb: y\n"
 
-// withCompilers makes sweeps compile with the engine's built-ins and extra for
-// the rest of the test.
-func withCompilers(t *testing.T, extra ...compilers.Compiler) {
-	t.Helper()
-	replaceRegistered(t, func() []compilers.Compiler { return append(engine.Compilers(), extra...) })
-}
-
-// replaceRegistered makes sweeps compile with the set f gives, for the rest of
-// the test.
-func replaceRegistered(t *testing.T, f func() []compilers.Compiler) {
-	t.Helper()
-	orig := registered
-	t.Cleanup(func() { registered = orig })
-	registered = f
-}
-
 // TestCheck_ASecondRegisteredCompilerIsSweptWithEveryOracle is the point of
 // compiling through the registry: a compiler added beside the built-ins gets its
 // files listed, compiled and put through the oracles with no change to the
@@ -533,51 +428,6 @@ func (openapiLike) Formats() []compilers.SourceFormat {
 	return []compilers.SourceFormat{{Name: "openapi", Version: "3.1"}}
 }
 
-func TestSpecFiles_AnEmptyCompilerSetIsAnError(t *testing.T) {
-	replaceRegistered(t, func() []compilers.Compiler { return nil })
-
-	files, err := SpecFiles(context.Background(), t.TempDir())
-	require.Error(t, err)
-	assert.Nil(t, files)
-	assert.Contains(t, err.Error(), "no compilers registered")
-}
-
-// namelessClaim recognizes every source and names no dialect for it, which the
-// registry refuses as a breach of the compiler contract.
-type namelessClaim struct{ stubCompiler }
-
-func (namelessClaim) Detect(compilers.Source, compilers.Options) (compilers.Recognition, []ir.Diagnostic, bool) {
-	return compilers.Recognition{}, nil, true
-}
-
-// TestSpecFiles_ABreachDetectionFindsIsAnError holds listing to the contract as
-// compiling is held to it: a compiler whose claim names nothing is its own fault,
-// reported rather than read as a file that is not a spec.
-func TestSpecFiles_ABreachDetectionFindsIsAnError(t *testing.T) {
-	withCompilers(t, namelessClaim{})
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "api.txt"), []byte("words"), 0o600))
-
-	files, err := SpecFiles(context.Background(), dir)
-	require.ErrorIs(t, err, compilers.ErrContract)
-	assert.Nil(t, files)
-	assert.Contains(t, err.Error(), "harness: detect")
-}
-
-func TestSpecFiles_AFileThatCannotBeReadIsAnError(t *testing.T) {
-	orig := readSpecFile
-	t.Cleanup(func() { readSpecFile = orig })
-	readSpecFile = func(string) ([]byte, error) { return nil, errors.New("read boom") }
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "api.yaml"), []byte(testspec.Minimal), 0o600))
-
-	files, err := SpecFiles(context.Background(), dir)
-	require.Error(t, err)
-	assert.Nil(t, files)
-	assert.Contains(t, err.Error(), "harness: read")
-	assert.Contains(t, err.Error(), "read boom")
-}
-
 // TestCheck_AFindingOnTheDocumentAloneIsRead pins that the sweep reads both of
 // a compiler's channels: one storing its error on the document alone is
 // classified by it, as the engine judges the run by it.
diff --git a/internal/harness/helpers_internal_test.go b/internal/harness/helpers_internal_test.go
new file mode 100644
index 00000000..823c1353
--- /dev/null
+++ b/internal/harness/helpers_internal_test.go
@@ -0,0 +1,71 @@
+package harness
+
+import (
+	"bytes"
+	"context"
+	"testing"
+
+	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/engine"
+	"github.com/dexpace/morphic/ir"
+)
+
+// emptySHA256 is the SHA-256 of zero bytes in lowercase hex, the digest a
+// source table entry carries.
+const emptySHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+
+// tables returns the source table and service every compiled document carries,
+// and the namespaces their IDs and the fixtures' types live in, so a stub
+// document reaches the oracle it is named for rather than the checks of the
+// tables.
+func tables() ([]ir.SourceInfo, []ir.Service, map[string][]string) {
+	return []ir.SourceInfo{{Format: "openapi@3.1", Path: "api.yaml", Hash: emptySHA256}},
+		[]ir.Service{{ID: "s/x/S", Name: ir.Naming{Source: "svc", Canonical: "svc"}}},
+		map[string][]string{ir.IDKindType: {"x"}, ir.IDKindService: {"x"}}
+}
+
+// stubFormat is the format stubCompiler serves, one the engine does not carry.
+var stubFormat = compilers.SourceFormat{Name: "stub", Version: "1.0"}
+
+// stubCompiler is a compiler the engine does not register. It takes any source
+// that mentions its marker, and lower stands for its lowering.
+type stubCompiler struct {
+	lower func(sources []compilers.Source) (*ir.Document, []ir.Diagnostic, error)
+}
+
+func (stubCompiler) Formats() []compilers.SourceFormat {
+	return []compilers.SourceFormat{stubFormat}
+}
+
+func (stubCompiler) Detect(src compilers.Source, _ compilers.Options) (compilers.Recognition, []ir.Diagnostic, bool) {
+	if !bytes.Contains(src.Data, []byte("stub:")) {
+		return compilers.Recognition{}, nil, false
+	}
+	return compilers.Recognition{Format: stubFormat}, nil, true
+}
+
+func (stubCompiler) DecodeOptions(compilers.OptionSet) (any, error) { return nil, nil }
+
+func (stubCompiler) SourceTable(sources []compilers.Source, _ compilers.Options) []ir.SourceInfo {
+	return []ir.SourceInfo{{Path: sources[0].Path}}
+}
+
+func (c stubCompiler) Compile(_ context.Context, sources []compilers.Source, _ compilers.Options) (*ir.Document, []ir.Diagnostic, error) {
+	return c.lower(sources)
+}
+
+// withCompilers makes sweeps compile with the engine's built-ins and extra for
+// the rest of the test.
+func withCompilers(t *testing.T, extra ...compilers.Compiler) {
+	t.Helper()
+	replaceRegistered(t, func() []compilers.Compiler { return append(engine.Compilers(), extra...) })
+}
+
+// replaceRegistered makes sweeps compile with the set f gives, for the rest of
+// the test.
+func replaceRegistered(t *testing.T, f func() []compilers.Compiler) {
+	t.Helper()
+	orig := registered
+	t.Cleanup(func() { registered = orig })
+	registered = f
+}
diff --git a/internal/harness/path_internal_test.go b/internal/harness/path_internal_test.go
new file mode 100644
index 00000000..dec73f50
--- /dev/null
+++ b/internal/harness/path_internal_test.go
@@ -0,0 +1,103 @@
+package harness
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/compilers"
+	"github.com/dexpace/morphic/internal/testspec"
+	"github.com/dexpace/morphic/ir"
+)
+
+func TestIsSnapshot_Names(t *testing.T) {
+	assert.True(t, isSnapshot("ir.golden.json"), "golden IR snapshots are skipped")
+	assert.True(t, isSnapshot("unwitnessed.golden.txt"), "whatever their extension")
+	assert.False(t, isSnapshot("api.yaml"))
+	assert.False(t, isSnapshot("golden.yaml"), "the marker is a name part, not any name containing the word")
+}
+
+func TestCheckFile_ReadErrorOnDirectory(t *testing.T) {
+	// os.ReadFile of a directory fails with EISDIR, which checkFile surfaces as a
+	// Go error rather than a Result.
+	_, err := checkFile(context.Background(), t.TempDir())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "harness: read")
+}
+
+func TestListDir_WalkErrorPropagates(t *testing.T) {
+	// SpecFiles stats its path first, so a walk that fails is reached here, with
+	// a directory that does not exist: WalkDir invokes the callback with a
+	// non-nil error, which listDir wraps and returns.
+	reg, err := newRegistry()
+	require.NoError(t, err)
+
+	files, err := listDir(context.Background(), reg, filepath.Join(t.TempDir(), "absent"))
+	require.Error(t, err)
+	assert.Nil(t, files)
+	assert.Contains(t, err.Error(), "harness: walk")
+}
+
+func TestCheckPath_UnreadableSpecInADirectoryErrors(t *testing.T) {
+	// A broken symlink cannot be read to decide whether a compiler takes it. The
+	// sweep aborts with that error rather than a silent skip, since a file it
+	// passed over would be one it never checked.
+	dir := t.TempDir()
+	link := filepath.Join(dir, "spec.yaml")
+	require.NoError(t, os.Symlink(filepath.Join(dir, "no-such-target"), link))
+
+	results, err := CheckPath(context.Background(), dir)
+	require.Error(t, err)
+	assert.Nil(t, results)
+	assert.Contains(t, err.Error(), "harness: read")
+}
+
+func TestSpecFiles_AnEmptyCompilerSetIsAnError(t *testing.T) {
+	replaceRegistered(t, func() []compilers.Compiler { return nil })
+
+	files, err := SpecFiles(context.Background(), t.TempDir())
+	require.Error(t, err)
+	assert.Nil(t, files)
+	assert.Contains(t, err.Error(), "no compilers registered")
+}
+
+// namelessClaim recognizes every source and names no dialect for it, which the
+// registry refuses as a breach of the compiler contract.
+type namelessClaim struct{ stubCompiler }
+
+func (namelessClaim) Detect(compilers.Source, compilers.Options) (compilers.Recognition, []ir.Diagnostic, bool) {
+	return compilers.Recognition{}, nil, true
+}
+
+// TestSpecFiles_ABreachDetectionFindsIsAnError holds listing to the contract as
+// compiling is held to it: a compiler whose claim names nothing is its own fault,
+// reported rather than read as a file that is not a spec.
+func TestSpecFiles_ABreachDetectionFindsIsAnError(t *testing.T) {
+	withCompilers(t, namelessClaim{})
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "api.txt"), []byte("words"), 0o600))
+
+	files, err := SpecFiles(context.Background(), dir)
+	require.ErrorIs(t, err, compilers.ErrContract)
+	assert.Nil(t, files)
+	assert.Contains(t, err.Error(), "harness: detect")
+}
+
+func TestSpecFiles_AFileThatCannotBeReadIsAnError(t *testing.T) {
+	orig := readSpecFile
+	t.Cleanup(func() { readSpecFile = orig })
+	readSpecFile = func(string) ([]byte, error) { return nil, errors.New("read boom") }
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "api.yaml"), []byte(testspec.Minimal), 0o600))
+
+	files, err := SpecFiles(context.Background(), dir)
+	require.Error(t, err)
+	assert.Nil(t, files)
+	assert.Contains(t, err.Error(), "harness: read")
+	assert.Contains(t, err.Error(), "read boom")
+}
diff --git a/internal/keydoc/yaml_internal_test.go b/internal/keydoc/cite_yaml_internal_test.go
similarity index 100%
rename from internal/keydoc/yaml_internal_test.go
rename to internal/keydoc/cite_yaml_internal_test.go

From bdb31a98be1b950fd483a2167ba559b69e425179 Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 22:10:15 +0300
Subject: [PATCH 08/11] test: correct what the test moves left pointing
 elsewhere

The moves left comments describing where code used to be: a helper's
"above" that meant the file it left, two comments naming a test file in
another package by its old home, the e2e package comment, which claimed
every test there compiles a spec, and a design note that placed the
whole-compiler suites at the top level. A test moved into
internal/schema was still named for fillPropertyExamples, which is
fillPropertyAnnotations now, and its comment said the function resolved
the example itself; it is renamed and says what does. The bomb fixture
path both packages declare now says what the fixture is. Comments name a
test or a symbol rather than a file where one serves, so the next move
leaves them true.
---
 compilers/openapi/budgets_test.go                         | 2 ++
 compilers/openapi/e2e/doc_test.go                         | 7 ++++---
 compilers/openapi/e2e/helpers_test.go                     | 4 +++-
 .../openapi/internal/load/unprepared_internal_test.go     | 5 +++--
 compilers/openapi/internal/schema/declaration_test.go     | 4 ++--
 compilers/openapi/internal/schema/property_test.go        | 8 ++++----
 docs/micro-compiler-design.md                             | 7 ++++---
 7 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/compilers/openapi/budgets_test.go b/compilers/openapi/budgets_test.go
index 1ecd5e66..26444fee 100644
--- a/compilers/openapi/budgets_test.go
+++ b/compilers/openapi/budgets_test.go
@@ -25,6 +25,8 @@ import (
 	"github.com/dexpace/morphic/ir"
 )
 
+// amplificationBombFixture is a document whose YAML aliases expand it to many
+// times its own size, which no alias budget admits.
 const amplificationBombFixture = "../../testdata/openapi/amplification_alias_bomb.yaml"
 
 // enumSpec is a minimal document whose one component declares a string enum of
diff --git a/compilers/openapi/e2e/doc_test.go b/compilers/openapi/e2e/doc_test.go
index d77c8e5c..012666ee 100644
--- a/compilers/openapi/e2e/doc_test.go
+++ b/compilers/openapi/e2e/doc_test.go
@@ -1,7 +1,8 @@
 // Package e2e_test holds the OpenAPI compiler's end-to-end tests: the
-// conformance corpus, the goldens, fuzzing, benchmarks, and scenarios several
-// internal packages decide together, each compiling a spec through openapi.New
-// and reading what comes out.
+// conformance corpus and the lowering specification held to it, the goldens,
+// fuzzing, benchmarks, and scenarios several internal packages decide
+// together, which is to say what the compiler does as a whole rather than
+// what one of its packages decides.
 //
 // It is a package of its own because coverage counts only a package's own
 // tests. Nothing here is covered by them, so the code they reach still needs
diff --git a/compilers/openapi/e2e/helpers_test.go b/compilers/openapi/e2e/helpers_test.go
index 4688eca6..bbbf16fe 100644
--- a/compilers/openapi/e2e/helpers_test.go
+++ b/compilers/openapi/e2e/helpers_test.go
@@ -27,6 +27,8 @@ import (
 // corpus, addressed relative to this test file.
 const goldenPetstore = "../../../testdata/golden/openapi/petstore.yaml"
 
+// amplificationBombFixture is a document whose YAML aliases expand it to many
+// times its own size, which no alias budget admits.
 const amplificationBombFixture = "../../../testdata/openapi/amplification_alias_bomb.yaml"
 
 // parseFull runs the whole public compiler pipeline over src. That reach back
@@ -56,7 +58,7 @@ func compileAnnotationSpec(t *testing.T, name, spec string) (*ir.Document, []ir.
 
 // compileBesideExpectingErrors compiles root, written beside ext, with
 // external references allowed, and returns the diagnostics instead of
-// requiring none: the twin comparisons above need a clean compile, and a
+// requiring none: compileBeside's twin comparisons need a clean compile, and a
 // refused external document needs the diagnostic itself.
 func compileBesideExpectingErrors(t *testing.T, ext, root string) []ir.Diagnostic {
 	t.Helper()
diff --git a/compilers/openapi/internal/load/unprepared_internal_test.go b/compilers/openapi/internal/load/unprepared_internal_test.go
index a20d804c..8ca56dde 100644
--- a/compilers/openapi/internal/load/unprepared_internal_test.go
+++ b/compilers/openapi/internal/load/unprepared_internal_test.go
@@ -79,8 +79,9 @@ func rootReferencing(url string) string {
 		"paths:\n  /x: {$ref: \"" + url + "#/paths/~1x\"}\n"
 }
 
-// anchoredExternalDoc anchors both of /x's operations, the way anchors_test.go's
-// "an operation" case does: the parser folds a path item's methods into a map
+// anchoredExternalDoc anchors both of /x's operations, the way the "an
+// operation" case of TestCompile_AnAnchoredEntryCompilesAsItsUnanchoredTwin
+// does: the parser folds a path item's methods into a map
 // and skips an entry whose value carries an anchor, so an external document
 // read without this compiler's own anchor release drops whichever of these the
 // resolver parses itself.
diff --git a/compilers/openapi/internal/schema/declaration_test.go b/compilers/openapi/internal/schema/declaration_test.go
index 7cb5fa58..86796b5d 100644
--- a/compilers/openapi/internal/schema/declaration_test.go
+++ b/compilers/openapi/internal/schema/declaration_test.go
@@ -680,8 +680,8 @@ func stolenPositions() []stolenPosition {
 }
 
 // assertResidueKeptAndAnnounced checks one residue keyword's entry and its
-// diagnostic together. compilers/openapi's annotations_test.go has
-// assertResidueKept and assertResidueDiag for the same job in two calls; this
+// diagnostic together. The end-to-end tests' assertResidueKept and
+// assertResidueDiag (compilers/openapi/e2e) do the same job in two calls; this
 // package cannot import them, so the pairing lives here under a name that is
 // not a transposition of either.
 func assertResidueKeptAndAnnounced(t *testing.T, p ir.Unmodeled, diags []ir.Diagnostic, keyword, wantJSON string) {
diff --git a/compilers/openapi/internal/schema/property_test.go b/compilers/openapi/internal/schema/property_test.go
index 69a2d0b4..7c29c627 100644
--- a/compilers/openapi/internal/schema/property_test.go
+++ b/compilers/openapi/internal/schema/property_test.go
@@ -437,16 +437,16 @@ type carrierDocKeyword struct {
 	read  func(ir.Docs) string
 }
 
-// TestFillPropertyExamples_RefSiblingExampleBindsTheSite locks in the
+// TestFillPropertyAnnotations_RefSiblingExampleBindsTheSite locks in the
 // $ref-sibling-example behaviour at a property position: an example written
-// beside a $ref binds the property, not the referent, because
-// fillPropertyExamples resolves it directly rather than through site.
+// beside a $ref binds the property, not the referent, because a $ref position
+// hoists no node, so fillPropertyAnnotations records it on the property.
 // Property f's $ref targets a named component (Target), so
 // resolve.Scope.ComponentRef resolves it directly without ever calling
 // hoistSubSchema. TestSchemaSiblings_RefdSubSchemaKeepsThem covers the
 // analogous hoistSubSchema path, where the $ref target is an internal
 // sub-schema pointer rather than a named component.
-func TestFillPropertyExamples_RefSiblingExampleBindsTheSite(t *testing.T) {
+func TestFillPropertyAnnotations_RefSiblingExampleBindsTheSite(t *testing.T) {
 	t.Parallel()
 	l, _ := loweredFor(t, `openapi: 3.1.0
 info: {title: t, version: "1"}
diff --git a/docs/micro-compiler-design.md b/docs/micro-compiler-design.md
index 8da22ca2..40330c97 100644
--- a/docs/micro-compiler-design.md
+++ b/docs/micro-compiler-design.md
@@ -483,9 +483,10 @@ grep -h '^package ' $(git ls-files 'compilers/openapi/*_test.go') | sort | uniq
 Tests move with the code they cover, and an internal test for `value.go` becomes an internal test of
 `internal/value` unchanged. The ones that will bite are the suites spanning concerns —
 `conformance_test.go`, `golden_test.go`, `annotations_test.go`, `fuzz_test.go` — which exercise the
-whole compiler and belong at the top level as external tests against `Compile`. Any test that
-survives only by reaching across a new boundary is evidence the boundary is in the wrong place, and
-should be treated as such rather than worked around with an export.
+whole compiler and belong at the top level as external tests against `Compile`; they now sit in
+`compilers/openapi/e2e`, a package of test files only. Any test that survives only by reaching
+across a new boundary is evidence the boundary is in the wrong place, and should be treated as such
+rather than worked around with an export.
 
 The 100% coverage gate is what makes this safe: a helper stranded on the wrong side of a split shows
 up immediately as an uncovered statement rather than as quietly dead code.

From e4dc2526d4fe94e48aa12e28bc2af5d3d26e8ccb Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Fri, 23 Oct 2026 22:10:15 +0300
Subject: [PATCH 09/11] docs: say where each kind of test lives

CONTRIBUTING gains a "Where a test goes" section before the recipes: a
unit test sits in the _test.go named after the file declaring what its
name says it tests, a scenario or a whole-package check in a file named
for it, and an end-to-end test of the OpenAPI compiler in
compilers/openapi/e2e, whose helpers_test.go holds what several of its
files share. Each rule names the check that fails when it is missed, or
says nothing does. The conformance step now says the assertion goes in
its construct's family file, and the root guidance's layout lists e2e/.
---
 CLAUDE.md       |  2 ++
 CONTRIBUTING.md | 24 +++++++++++++++++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index c5329ca1..3fdbb701 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -131,6 +131,8 @@ compilers/   Layer 1 — the Compiler contract and the format-keyed registry. Im
     internal/  Layer 1 — that compiler's own packages, each with its own allowlist rather than
              the compiler's. The ordering among them is real and enforced, from diag (reaches
              only ir) up to operation, document and detect. None may reach the compiler above it.
+    e2e/     Test files only, so outside the layering: that compiler's end-to-end tests, the
+             conformance corpus and goldens among them, compiled through its public face.
 pass/        Layer 1 — IR → IR passes. Imports ir and ir/irfacts.
 emitters/*   Layer 2 — imports ir, ir/irfacts + emitter contract; never compiler. (Not built yet.)
 engine/      Layer 3 — orchestration; imports everything below. It owns every read, write and
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index de3c6e5f..2d8c6268 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -34,6 +34,27 @@ Read the documents for your layer, and skip the rest until you need them.
 | The IR | `ir-design.md`, `architecture.md` §2.5, `prior-art.md` | `reference-learnings.md` |
 | An emitter (none exists yet) | [`emitter-design.md`](docs/emitter-design.md), `architecture.md` §2.3 to §2.5 | `prior-art.md` |
 
+### Where a test goes
+
+- **A unit test sits beside the code it tests,** in its package, in the `_test.go` named after the
+  file that declares what the test's name says it tests, as `TestTypes_RegisterTakesNoCoordinate`,
+  of `Types` in `compilers/compile/types.go`, sits in `types_test.go`. Once a file's tests split by
+  topic, each part keeps that prefix, as `load_entry_internal_test.go` does beside `load.go`. A
+  scenario several files of a package decide together goes in a file named for the scenario, as
+  `pass/validate_propids_test.go` is, a check over a whole package in one named for what it checks,
+  as `ir/nofloat_test.go` is, and in a package of one source file a test file needs no prefix.
+  *Fails if missed:* `make coverage`, for a test in another package than its code, since coverage
+  counts only a package's own tests. Nothing fails for a test in the wrong file of its package.
+- **An end-to-end test of the OpenAPI compiler goes in `compilers/openapi/e2e`,** in a file named
+  for the construct: a test that compiles a spec through `openapi.New` and reads what comes out,
+  the conformance corpus and the goldens among them. The package holds no code, so such a test
+  covers nothing, and the code it reaches still needs a unit test beside it; `compilers/openapi`
+  itself holds only the tests of its own files. A helper several of the package's files share is
+  in its `helpers_test.go`, except the corpus's own reader, which `conformance_test.go` declares,
+  and a fixture the files of one construct share, which stays with that construct.
+  *Fails if missed:* `make coverage`, for code only an end-to-end test reaches. Nothing fails for an
+  end-to-end test written in the compiler's own package.
+
 ## Add a lowering rule to the OpenAPI compiler
 
 A lowering rule says how one OpenAPI construct reaches the IR: the field it fills, what it keeps in
@@ -77,7 +98,8 @@ A lowering rule says how one OpenAPI construct reaches the IR: the field it fill
    `conformanceCases()` in `compilers/openapi/e2e/conformance_test.go` naming its assertion, list it
    under each [`ir-spec-matrix.md`](docs/ir-spec-matrix.md) row it witnesses in
    `testdata/conformance/openapi/matrix.md` (none, for a case that pins only a diagnostic), write
-   the assertion, and name the case in the rule's Cases field. Then write its golden alone, since
+   the assertion in the `conformance_<family>_test.go` of its construct, and name the case in the
+   rule's Cases field. Then write its golden alone, since
    a run that also reaches `TestConformance_TableNamesEveryCorpusSpec` reads the directory before
    the golden exists:
 

From 4060058f53bb35924667302e17bee248c678def9 Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Sat, 24 Oct 2026 01:54:24 +0300
Subject: [PATCH 10/11] test(compilers/openapi): move the XML nodeType test
 beside its rule

TestXML_NodeTypeIsReadAtEveryVersion sat in operation's tests, yet the
document it compiles declares no path: what it pins is a property's
XML.NodeType, which the schema lowering attaches, and the
later-version-construct warning load's rule table reports below 3.2.
Neither is the operation package's code.

It moves to the end-to-end later_version_test.go, beside the other
later-version constructs, and compiles through the public face in place
of operation's fixture. operation's coverage is unchanged, and the test
still fails when nodeType is never read.
---
 compilers/openapi/e2e/later_version_test.go   | 33 +++++++++++++++++++
 .../internal/operation/operations_test.go     | 32 ------------------
 2 files changed, 33 insertions(+), 32 deletions(-)

diff --git a/compilers/openapi/e2e/later_version_test.go b/compilers/openapi/e2e/later_version_test.go
index f60eec75..9ebc89c1 100644
--- a/compilers/openapi/e2e/later_version_test.go
+++ b/compilers/openapi/e2e/later_version_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/dexpace/morphic/compilers"
 	"github.com/dexpace/morphic/compilers/openapi"
 	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/openapitest"
 	"github.com/dexpace/morphic/ir"
 )
 
@@ -107,3 +108,35 @@ func TestLaterVersionConstructs_LowerAsInTheVersionThatAddedThem(t *testing.T) {
 	assert.Subset(t, later30, later31, "what 3.2 added is owed to 3.0 as to 3.1")
 	assert.Greater(t, len(later30), len(later31), "and what 3.1 added to 3.0 alone")
 }
+
+// TestXML_NodeTypeIsReadAtEveryVersion pins the 3.2 XML nodeType:
+// ir.XMLHints.NodeType already existed and its GoDoc already named the version,
+// so this is the wiring. Below 3.2 it reads the same, and load adds that the
+// field is a later version's (GitHub #864).
+func TestXML_NodeTypeIsReadAtEveryVersion(t *testing.T) {
+	t.Parallel()
+	const body = `    S:
+      type: object
+      properties:
+        n:
+          type: string
+          xml: {nodeType: text}
+`
+	for _, version := range []string{"3.2.0", "3.1.0", "3.0.3"} {
+		t.Run(version, func(t *testing.T) {
+			t.Parallel()
+			doc, diags := parseFull(t, "openapi: "+version+
+				"\ninfo: {title: T, version: \"1\"}\npaths: {}\ncomponents:\n  schemas:\n"+body)
+			openapitest.RequireNoErrorDiags(t, diags)
+			model, ok := doc.Types[ir.TypeID("t/openapi/components/schemas/S")].(*ir.Model)
+			require.True(t, ok)
+			prop, ok := openapitest.PropsByWire(model.Properties)["n"]
+			require.True(t, ok)
+			require.NotNil(t, prop.XML)
+			assert.Equal(t, "text", prop.XML.NodeType)
+			assert.False(t, openapitest.HasDiag(diags, diag.UnknownObjectKey))
+			assert.Equal(t, version != "3.2.0", openapitest.HasDiagCodeAt(diags, diag.LaterVersionConstruct,
+				"/components/schemas/S/properties/n/xml/nodeType"))
+		})
+	}
+}
diff --git a/compilers/openapi/internal/operation/operations_test.go b/compilers/openapi/internal/operation/operations_test.go
index 2bd3a3bd..be3d7e65 100644
--- a/compilers/openapi/internal/operation/operations_test.go
+++ b/compilers/openapi/internal/operation/operations_test.go
@@ -725,38 +725,6 @@ func TestOperations_OwnServersFindingIsNotInferred(t *testing.T) {
 	assert.Equal(t, op.Provenance.Pointer, found[0].Provenance.Pointer, "and still reported at the operation")
 }
 
-// TestXML_NodeTypeIsReadAtEveryVersion pins the 3.2 XML nodeType:
-// ir.XMLHints.NodeType already existed and its GoDoc already named the version,
-// so this is the wiring. Below 3.2 it reads the same, and load adds that the
-// field is a later version's (GitHub #864).
-func TestXML_NodeTypeIsReadAtEveryVersion(t *testing.T) {
-	t.Parallel()
-	const body = `    S:
-      type: object
-      properties:
-        n:
-          type: string
-          xml: {nodeType: text}
-`
-	for _, version := range []string{"3.2.0", "3.1.0", "3.0.3"} {
-		t.Run(version, func(t *testing.T) {
-			t.Parallel()
-			doc, _, diags := lowerServiceSpec(t, "openapi: "+version+
-				"\ninfo: {title: T, version: \"1\"}\npaths: {}\ncomponents:\n  schemas:\n"+body)
-			openapitest.RequireNoErrorDiags(t, diags)
-			model, ok := doc.Types[ir.TypeID("t/openapi/components/schemas/S")].(*ir.Model)
-			require.True(t, ok)
-			prop, ok := openapitest.PropsByWire(model.Properties)["n"]
-			require.True(t, ok)
-			require.NotNil(t, prop.XML)
-			assert.Equal(t, "text", prop.XML.NodeType)
-			assert.False(t, openapitest.HasDiag(diags, diag.UnknownObjectKey))
-			assert.Equal(t, version != "3.2.0", openapitest.HasDiagCodeAt(diags, diag.LaterVersionConstruct,
-				"/components/schemas/S/properties/n/xml/nodeType"))
-		})
-	}
-}
-
 // TestLowerService_PercentEncodedEntryRefKeepsTheDeclaredCoordinate covers the
 // same identity defect on the components that are not schemas, where it was
 // wholly silent. Their entries resolve through the library, so the value arrived

From 35ec7d01a3b011a5516fcf5f1d4606d5c3f768b1 Mon Sep 17 00:00:00 2001
From: OmarAlJarrah <o.mazari.om63@gmail.com>
Date: Sat, 24 Oct 2026 01:57:36 +0300
Subject: [PATCH 11/11] test: fix commands, citations and paths the moves left
 stale

Two doc comments in the end-to-end package still told a reader to
regenerate goldens with `go test ./compilers/openapi -run ...`, which
now runs no test; they name compilers/openapi/e2e. TestConformance's
comment also sent the reader to TestConformance_UnwitnessedIRFields, and
the CLI's readOnlyDirDest to TestWriteCompiled_ReadOnlyDirFails, both
gone before this change; they name the census and
atomicfile.TestReplace_ReadOnlyDirFails, which hold those facts now.

reproducerDir and corpusRoot stayed in the files the helpers reading
them left, and reproducerDir's comment still pointed at "the reader
below"; both now sit with the other fixture paths in helpers_test.go,
the comment naming what derives from it.

The placement rule in CONTRIBUTING called any test that compiles a spec
through openapi.New end-to-end, which would send internal packages' own
tests, which compile whole specs to reach their code, out of the package
their coverage counts in. It now turns on whose code decides what a test
asserts. docs/architecture.md's package tree gains e2e/.
---
 CONTRIBUTING.md                            | 18 +++++++++++-------
 cmd/morphic/main_edge_cases_test.go        |  4 ++--
 compilers/openapi/e2e/conformance_test.go  | 12 +++++++-----
 compilers/openapi/e2e/cycles_test.go       |  7 -------
 compilers/openapi/e2e/golden_test.go       |  2 +-
 compilers/openapi/e2e/helpers_test.go      | 15 ++++++++++++++-
 compilers/openapi/e2e/reuse_corpus_test.go |  3 ---
 docs/architecture.md                       |  2 ++
 8 files changed, 37 insertions(+), 26 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2d8c6268..50207854 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -46,14 +46,18 @@ Read the documents for your layer, and skip the rest until you need them.
   *Fails if missed:* `make coverage`, for a test in another package than its code, since coverage
   counts only a package's own tests. Nothing fails for a test in the wrong file of its package.
 - **An end-to-end test of the OpenAPI compiler goes in `compilers/openapi/e2e`,** in a file named
-  for the construct: a test that compiles a spec through `openapi.New` and reads what comes out,
-  the conformance corpus and the goldens among them. The package holds no code, so such a test
-  covers nothing, and the code it reaches still needs a unit test beside it; `compilers/openapi`
-  itself holds only the tests of its own files. A helper several of the package's files share is
-  in its `helpers_test.go`, except the corpus's own reader, which `conformance_test.go` declares,
-  and a fixture the files of one construct share, which stays with that construct.
+  for the construct or the property it checks: a test of what the compiler does as a whole, which no
+  one package decides, such as the conformance corpus, the goldens, fuzzing, benchmarks and a
+  scenario several packages settle together. A test of one package's code stays in that package even
+  when it compiles a whole spec through `openapi.New` to reach the code, as `internal/schema`'s
+  `parseFull` tests do, since only there does it count toward that package's coverage. The e2e
+  package holds no code, so its tests cover nothing, and the code they reach still needs a unit test
+  beside it; `compilers/openapi` itself holds only the tests of its own files. A helper several of
+  the package's files share is in its `helpers_test.go`, except the corpus's own reader, which
+  `conformance_test.go` declares, and a fixture the files of one construct share, which stays with
+  that construct.
   *Fails if missed:* `make coverage`, for code only an end-to-end test reaches. Nothing fails for an
-  end-to-end test written in the compiler's own package.
+  end-to-end test written in the compiler's own package or in one of its internal packages.
 
 ## Add a lowering rule to the OpenAPI compiler
 
diff --git a/cmd/morphic/main_edge_cases_test.go b/cmd/morphic/main_edge_cases_test.go
index 6f109000..8f5b16ca 100644
--- a/cmd/morphic/main_edge_cases_test.go
+++ b/cmd/morphic/main_edge_cases_test.go
@@ -163,8 +163,8 @@ func missingParentDest(t *testing.T) string {
 }
 
 // readOnlyDirDest returns a writable file inside a read-only directory — the
-// shape TestWriteCompiled_ReadOnlyDirFails pins, where the destination itself
-// could be rewritten but its directory will not take the temp file.
+// shape atomicfile.TestReplace_ReadOnlyDirFails pins, where the destination
+// itself could be rewritten but its directory will not take the temp file.
 func readOnlyDirDest(t *testing.T) string {
 	t.Helper()
 	if os.Geteuid() == 0 {
diff --git a/compilers/openapi/e2e/conformance_test.go b/compilers/openapi/e2e/conformance_test.go
index b225b051..e07a0bc6 100644
--- a/compilers/openapi/e2e/conformance_test.go
+++ b/compilers/openapi/e2e/conformance_test.go
@@ -32,13 +32,15 @@ const witnessDoc = "matrix.md"
 
 // TestConformance drives one minimal spec per OpenAPI-expressible capability
 // through the full compiler and asserts lossless capture: a focused
-// capability-specific assertion plus a byte-exact golden IR snapshot. Regenerate
-// the goldens with `go test ./compilers/openapi -run TestConformance -update`.
+// capability-specific assertion plus a byte-exact golden IR snapshot.
+// Regenerate the goldens with
+// `go test ./compilers/openapi/e2e -run TestConformance -update`.
 //
 // What the corpus does not cover is derived, not described, so nothing about
-// its reach is claimed by hand: TestConformance_UnwitnessedIRFields snapshots
-// every ir field no committed spec drives to a non-zero value. Some of what it
-// lists no spec can reach, such as a field only another source format writes.
+// its reach is claimed by hand: `go test ./cmd/morphic-census` holds
+// testdata/unwitnessed.golden.txt to every IR fact no committed spec sets. Some
+// of what it lists no spec can reach, such as a field only another source
+// format writes.
 func TestConformance(t *testing.T) {
 	t.Parallel()
 	for _, tc := range conformanceCases() {
diff --git a/compilers/openapi/e2e/cycles_test.go b/compilers/openapi/e2e/cycles_test.go
index 07ca63e3..5efbc5ef 100644
--- a/compilers/openapi/e2e/cycles_test.go
+++ b/compilers/openapi/e2e/cycles_test.go
@@ -629,13 +629,6 @@ components:
 	assert.Empty(t, cyclicRefSites(diags), "a pointer that names an undeclared key is unresolved, not cyclic")
 }
 
-// reproducerDir is where the cycle fixtures live. The reader below, the table
-// guard above and the fuzz seeds all derive their paths from it, so none of them
-// can end up looking somewhere the others are not — which matters most for the
-// seed loader, since it ignores a read error and a wrong path there would cost
-// the fuzzer its seeds in silence.
-const reproducerDir = "../../../testdata/openapi"
-
 // TestCompile_MergeChainPastBoundStillCompiles pins that a legal document whose
 // `<<` merge chain runs past the mapping view's depth bound is compiled. The
 // alias scan weighs aliases rather than expanding merges through that view, so
diff --git a/compilers/openapi/e2e/golden_test.go b/compilers/openapi/e2e/golden_test.go
index 03a80040..be32991e 100644
--- a/compilers/openapi/e2e/golden_test.go
+++ b/compilers/openapi/e2e/golden_test.go
@@ -19,7 +19,7 @@ import (
 
 // TestGolden lowers a full petstore-style document and compares its IR against a
 // byte-exact golden snapshot. Regenerate it with
-// `go test ./compilers/openapi -run TestGolden -update`.
+// `go test ./compilers/openapi/e2e -run TestGolden -update`.
 func TestGolden(t *testing.T) {
 	t.Parallel()
 	data, err := os.ReadFile("../../../testdata/golden/openapi/petstore.yaml")
diff --git a/compilers/openapi/e2e/helpers_test.go b/compilers/openapi/e2e/helpers_test.go
index bbbf16fe..3a66a058 100644
--- a/compilers/openapi/e2e/helpers_test.go
+++ b/compilers/openapi/e2e/helpers_test.go
@@ -24,13 +24,25 @@ import (
 )
 
 // goldenPetstore is the larger real-ish spec seeded alongside the conformance
-// corpus, addressed relative to this test file.
+// corpus, addressed relative to this package.
 const goldenPetstore = "../../../testdata/golden/openapi/petstore.yaml"
 
 // amplificationBombFixture is a document whose YAML aliases expand it to many
 // times its own size, which no alias budget admits.
 const amplificationBombFixture = "../../../testdata/openapi/amplification_alias_bomb.yaml"
 
+// reproducerDir is where the cycle fixtures live. readReproducer,
+// TestCycleReproducers_EveryFixtureIsExercised and FuzzCycleDetector's seeds
+// all derive their paths from it, so none of them can end up looking somewhere
+// the others are not — which matters most for the seed loader, since it
+// ignores a read error and a wrong path there would cost the fuzzer its seeds
+// in silence.
+const reproducerDir = "../../../testdata/openapi"
+
+// corpusRoot is every committed spec directory, addressed relative to this
+// package.
+const corpusRoot = "../../../testdata"
+
 // parseFull runs the whole public compiler pipeline over src. That reach back
 // through openapi is also why openapitest cannot hold it — see that package's
 // doc comment.
@@ -126,6 +138,7 @@ func (r *recordingReader) locations() []string {
 	return out
 }
 
+// readReproducer reads the named fixture from reproducerDir.
 func readReproducer(t *testing.T, file string) []byte {
 	t.Helper()
 	data, err := os.ReadFile(filepath.Join(reproducerDir, file+".yaml"))
diff --git a/compilers/openapi/e2e/reuse_corpus_test.go b/compilers/openapi/e2e/reuse_corpus_test.go
index 3ed594e5..c7e0099c 100644
--- a/compilers/openapi/e2e/reuse_corpus_test.go
+++ b/compilers/openapi/e2e/reuse_corpus_test.go
@@ -74,6 +74,3 @@ func encodeDoc(t *testing.T, doc any) string {
 	require.NoError(t, err)
 	return string(encoded)
 }
-
-// corpusRoot is every committed spec directory, addressed relative to this file.
-const corpusRoot = "../../../testdata"
diff --git a/docs/architecture.md b/docs/architecture.md
index 775e0821..7600c16a 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -385,6 +385,8 @@ morphic/
 │   ├── openapi/            #           OpenAPI 3.x → IR (milestone 1). The public face: the
 │   │   │                   #           Compiler, its Options, and the run that calls the
 │   │   │                   #           lowerings below in order.
+│   │   ├── e2e/            #             Its end-to-end tests: test files only, compiling through
+│   │   │                   #             that face, so they cover no package.
 │   │   └── internal/       #             Its own packages, each below that face:
 │   │       ├── diag/       #             diagnostic codes and the constructor
 │   │       ├── ids/        #             pointer construction; pointer → TypeID