From d002c5e598ea5796bd76004f7d0fd450f1463cf5 Mon Sep 17 00:00:00 2001
From: Juan Cruz Viotti <jv@jviotti.com>
Date: Sat, 24 Oct 2026 14:30:47 -0300
Subject: [PATCH 1/2] Separate JSON Pointer fragment tokens before decoding
 them

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
---
 .../include/sourcemeta/core/jsonpointer.h     |   6 +-
 src/core/jsonpointer/jsonpointer.cc           |  65 ++++---
 src/core/jsonschema/frame.cc                  |  43 +++--
 .../jsonpointer_fragment_to_pointer_test.cc   |  55 +++++-
 test/jsonschema/jsonschema_frame_test.cc      | 161 ++++++++++++++++++
 5 files changed, 291 insertions(+), 39 deletions(-)

diff --git a/src/core/jsonpointer/include/sourcemeta/core/jsonpointer.h b/src/core/jsonpointer/include/sourcemeta/core/jsonpointer.h
index 20c92a82c0..72700b7f3e 100644
--- a/src/core/jsonpointer/include/sourcemeta/core/jsonpointer.h
+++ b/src/core/jsonpointer/include/sourcemeta/core/jsonpointer.h
@@ -409,9 +409,9 @@ auto to_pointer(
     -> Pointer;
 
 /// @ingroup jsonpointer
-/// Parse the URI fragment representation of a JSON Pointer, percent-decoding
-/// the fragment data before interpretation as mandated by RFC 3986, Section
-/// 2.4 and RFC 6901, Section 6. The result is not set if the URI has no
+/// Parse the URI fragment representation of a JSON Pointer. A percent-encoded
+/// slash is data within a reference token rather than a separator, as RFC
+/// 3986, Section 2.4 requires. The result is not set if the URI has no
 /// fragment or if its fragment is not a valid JSON Pointer. For example:
 ///
 /// ```cpp
diff --git a/src/core/jsonpointer/jsonpointer.cc b/src/core/jsonpointer/jsonpointer.cc
index 67470cbf09..7c6a68b552 100644
--- a/src/core/jsonpointer/jsonpointer.cc
+++ b/src/core/jsonpointer/jsonpointer.cc
@@ -11,7 +11,6 @@
 #include "stringify.h"
 
 #include <cassert>     // assert
-#include <cstddef>     // std::size_t
 #include <iterator>    // std::cbegin, std::cend, std::prev, std::advance
 #include <memory>      // std::allocator
 #include <optional>    // std::optional, std::nullopt
@@ -24,6 +23,19 @@
 
 namespace {
 
+// A slash that comes out of an escape is data within the reference token it
+// falls in, which is the escape that RFC 6901 Section 3 gives it
+auto append_reference_token(sourcemeta::core::JSON::String &output,
+                            const std::string_view token) -> void {
+  for (const auto character : sourcemeta::core::URI::unescape(token)) {
+    if (character == '/') {
+      output.append("~1");
+    } else {
+      output.push_back(character);
+    }
+  }
+}
+
 template <template <typename T> typename Allocator, typename V,
           typename PointerT = sourcemeta::core::GenericPointer<
               typename V::String,
@@ -336,34 +348,41 @@ auto fragment_to_pointer(const URI &uri) -> std::optional<Pointer> {
     return std::nullopt;
   }
 
+  const auto &value{fragment.value()};
+  if (value.empty()) {
+    return Pointer{};
+  }
+
   // When a URI is dereferenced, the components and subcomponents significant
-  // to the scheme-specific dereferencing process (if any) must be parsed and
-  // separated before the percent-encoded octets within those components can
-  // be safely decoded.
+  // to the dereferencing process must be parsed and separated before the
+  // percent-encoded octets within them can be safely decoded, as the data
+  // would otherwise be mistaken for a delimiter. The only exception is an
+  // octet that stands for an unreserved character, which may be decoded at
+  // any time.
   // See https://www.rfc-editor.org/rfc/rfc3986#section-2.4
-  const auto &value{fragment.value()};
+  //
+  // The slash that precedes every reference token is the delimiter here, and
+  // a reserved character is not equivalent to the octet that stands for it,
+  // so a slash that was percent-encoded is data within the token it falls in
+  // rather than the start of the next one.
+  // See https://www.rfc-editor.org/rfc/rfc3986#section-2.2
+  // See https://www.rfc-editor.org/rfc/rfc6901#section-3
+  if (value.front() != '/') {
+    return std::nullopt;
+  }
+
   JSON::String input;
   input.reserve(value.size());
-  for (std::size_t index = 0; index < value.size(); ++index) {
-    const auto character{value[index]};
-    if (character == '%' && index + 2 < value.size()) {
-      const auto high{sourcemeta::core::hex_digit_value(value[index + 1])};
-      const auto low{sourcemeta::core::hex_digit_value(value[index + 2])};
-      if (high >= 0 && low >= 0) {
-        input.push_back(static_cast<char>((high * 16) + low));
-        index += 2;
-        continue;
-      }
+  auto rest{value.substr(1)};
+  while (true) {
+    const auto parts{split_once(rest, '/')};
+    input.push_back('/');
+    append_reference_token(input, parts.has_value() ? parts->first : rest);
+    if (!parts.has_value()) {
+      break;
     }
 
-    input.push_back(character);
-  }
-
-  if (input.empty()) {
-    return Pointer{};
-  }
-  if (input.front() != '/') {
-    return std::nullopt;
+    rest = parts->second;
   }
 
   try {
diff --git a/src/core/jsonschema/frame.cc b/src/core/jsonschema/frame.cc
index b021aec08c..33925e7778 100644
--- a/src/core/jsonschema/frame.cc
+++ b/src/core/jsonschema/frame.cc
@@ -426,7 +426,10 @@ auto locate(const Locations &locations,
 
 // The spelling that every location is framed under and that every reference
 // destination is held to, which is what makes a URI that comes from anywhere
-// else comparable to either of them
+// else comparable to either of them. RFC 3986 Section 6.2.2.2 leaves a
+// percent-encoded reserved character where it stands, and RFC 6901 Section 6
+// only asks for the characters a fragment disallows to be encoded, so one
+// pointer has more than one spelling to begin with
 auto canonicalize_reference(const sourcemeta::core::JSON::String &uri)
     -> std::optional<sourcemeta::core::JSON::String> {
   try {
@@ -439,6 +442,18 @@ auto canonicalize_reference(const sourcemeta::core::JSON::String &uri)
   }
 }
 
+// A lookup that came up empty is only worth repeating under a spelling it has
+// not tried yet
+auto other_spelling(const sourcemeta::core::JSON::String &uri)
+    -> std::optional<sourcemeta::core::JSON::String> {
+  const auto canonical{canonicalize_reference(uri)};
+  if (!canonical.has_value() || canonical.value() == uri) {
+    return std::nullopt;
+  }
+
+  return canonical;
+}
+
 auto set_base_and_fragment(sourcemeta::core::SchemaFrame::Reference &entry)
     -> void {
   const std::string_view destination_view{entry.destination};
@@ -2028,6 +2043,19 @@ auto SchemaFrame::location(const SchemaReferenceType type,
     return result->second;
   }
 
+  // Asking for a location of a given kind is the same question asked of the
+  // same places as asking for one of either kind, so a URI that reaches here
+  // is settled the same way before it is given up on
+  const auto canonical{other_spelling(uri_string)};
+  if (!canonical.has_value()) {
+    return std::nullopt;
+  }
+
+  const auto canonical_result{this->locations_.find({type, canonical.value()})};
+  if (canonical_result != this->locations_.cend()) {
+    return canonical_result->second;
+  }
+
   return std::nullopt;
 }
 
@@ -2122,15 +2150,10 @@ auto SchemaFrame::traverse(const std::string_view uri) const
     return direct;
   }
 
-  // Framing writes every location down under the canonical spelling of its
-  // URI, and holds the destination of every reference to that same spelling,
-  // so one that reaches here spelled any other way names what a reference
-  // spelled identically would reach. RFC 3986 Section 6.2.2.2 leaves a
-  // percent-encoded reserved character where it stands, and RFC 6901 Section
-  // 6 only asks for the characters a fragment disallows to be encoded, so one
-  // pointer has more than one spelling to begin with
-  const auto canonical{canonicalize_reference(uri_string)};
-  if (!canonical.has_value() || canonical.value() == uri_string) {
+  // A URI that reaches here spelled any other way names what a reference
+  // spelled identically would reach
+  const auto canonical{other_spelling(uri_string)};
+  if (!canonical.has_value()) {
     return std::nullopt;
   }
 
diff --git a/test/jsonpointer/jsonpointer_fragment_to_pointer_test.cc b/test/jsonpointer/jsonpointer_fragment_to_pointer_test.cc
index b0d624d35c..d3588f929e 100644
--- a/test/jsonpointer/jsonpointer_fragment_to_pointer_test.cc
+++ b/test/jsonpointer/jsonpointer_fragment_to_pointer_test.cc
@@ -85,24 +85,73 @@ TEST(uri_with_percent_encoded_caret) {
   EXPECT_EQ(pointer.value().at(0).to_property(), "e^f");
 }
 
+// RFC 3986 Section 2.4 separates the subcomponents of a URI before decoding
+// the percent-encoded octets within them, and RFC 3986 Section 2.2 keeps a
+// reserved character from being equivalent to the octet that stands for it, so
+// the slash that RFC 6901 Section 3 puts in front of every reference token is
+// never one that was percent-encoded
 TEST(uri_with_percent_encoded_slash) {
   const sourcemeta::core::URI uri{"#/foo%2Fbar"};
   const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
   EXPECT_TRUE(pointer.has_value());
+  EXPECT_EQ(pointer.value().size(), 1);
+  EXPECT_TRUE(pointer.value().at(0).is_property());
+  EXPECT_EQ(pointer.value().at(0).to_property(), "foo/bar");
+}
+
+TEST(uri_with_lowercase_percent_encoded_slash) {
+  const sourcemeta::core::URI uri{"#/foo%2fbar"};
+  const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
+  EXPECT_TRUE(pointer.has_value());
+  EXPECT_EQ(pointer.value().size(), 1);
+  EXPECT_TRUE(pointer.value().at(0).is_property());
+  EXPECT_EQ(pointer.value().at(0).to_property(), "foo/bar");
+}
+
+TEST(uri_with_percent_encoded_slash_and_an_unencoded_one) {
+  const sourcemeta::core::URI uri{"#/foo%2Fbar/baz"};
+  const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
+  EXPECT_TRUE(pointer.has_value());
   EXPECT_EQ(pointer.value().size(), 2);
   EXPECT_TRUE(pointer.value().at(0).is_property());
-  EXPECT_EQ(pointer.value().at(0).to_property(), "foo");
+  EXPECT_EQ(pointer.value().at(0).to_property(), "foo/bar");
   EXPECT_TRUE(pointer.value().at(1).is_property());
-  EXPECT_EQ(pointer.value().at(1).to_property(), "bar");
+  EXPECT_EQ(pointer.value().at(1).to_property(), "baz");
 }
 
+// RFC 6901 Section 3 wants a slash in front of every reference token, and a
+// percent-encoded one does not stand in for it, so nothing opens the first
+// token here
 TEST(uri_with_percent_encoded_leading_slash) {
   const sourcemeta::core::URI uri{"#%2Ffoo"};
   const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
+  EXPECT_FALSE(pointer.has_value());
+}
+
+// RFC 3986 Section 2.4 lets an octet that stands for an unreserved character
+// be decoded at any time, and the tilde is one, so it still forms the escape
+// that RFC 6901 Section 3 reads it as
+TEST(uri_with_percent_encoded_tilde_forming_an_escape) {
+  const sourcemeta::core::URI uri{"#/a%7E1b"};
+  const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
   EXPECT_TRUE(pointer.has_value());
   EXPECT_EQ(pointer.value().size(), 1);
   EXPECT_TRUE(pointer.value().at(0).is_property());
-  EXPECT_EQ(pointer.value().at(0).to_property(), "foo");
+  EXPECT_EQ(pointer.value().at(0).to_property(), "a/b");
+}
+
+TEST(uri_with_percent_encoded_slash_next_to_a_tilde) {
+  const sourcemeta::core::URI uri{"#/a~%2Fb"};
+  const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
+  EXPECT_FALSE(pointer.has_value());
+}
+
+TEST(round_trip_token_with_a_slash) {
+  const sourcemeta::core::Pointer pointer{"foo/bar"};
+  const auto result{
+      sourcemeta::core::fragment_to_pointer(sourcemeta::core::to_uri(pointer))};
+  EXPECT_TRUE(result.has_value());
+  EXPECT_EQ(result.value(), pointer);
 }
 
 TEST(uri_with_lowercase_percent_encoding) {
diff --git a/test/jsonschema/jsonschema_frame_test.cc b/test/jsonschema/jsonschema_frame_test.cc
index 459ce8aca7..51a2cccb03 100644
--- a/test/jsonschema/jsonschema_frame_test.cc
+++ b/test/jsonschema/jsonschema_frame_test.cc
@@ -2435,3 +2435,164 @@ TEST(traverse_a_uri_that_does_not_parse) {
 
   EXPECT_FALSE(frame.traverse("http://[").has_value());
 }
+
+// Asking for a location of a given kind is the same question asked of the
+// same places as asking for one of either kind, so a URI that comes from
+// outside framing is settled the same way before the lookup gives up on it
+TEST(location_of_a_pointer_fragment_that_percent_encodes_a_reserved_character) {
+  const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://example.com/escaped",
+    "$ref": "#/$defs/a%3Ab",
+    "$defs": { "a:b": { "type": "string" } }
+  })JSON");
+
+  const sourcemeta::core::SchemaFrame frame{
+      sourcemeta::core::SchemaFrame::Mode::References, document,
+      sourcemeta::core::schema_walker, sourcemeta::core::schema_resolver};
+
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame
+                    .location(sourcemeta::core::SchemaReferenceType::Static,
+                              "https://example.com/escaped#/$defs/a:b")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/a:b");
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame
+                    .location(sourcemeta::core::SchemaReferenceType::Static,
+                              "https://example.com/escaped#/$defs/a%3Ab")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/a:b");
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame
+                    .location(sourcemeta::core::SchemaReferenceType::Static,
+                              "https://example.com/escaped#/$defs/a%3ab")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/a:b");
+  EXPECT_FALSE(frame
+                   .location(sourcemeta::core::SchemaReferenceType::Dynamic,
+                             "https://example.com/escaped#/$defs/a%3Ab")
+                   .has_value());
+}
+
+TEST(location_of_a_uri_that_is_not_normalised) {
+  const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://example.com/schema",
+    "$defs": {
+      "foo": { "$anchor": "bar" },
+      "baz": { "$dynamicAnchor": "qux" }
+    }
+  })JSON");
+
+  const sourcemeta::core::SchemaFrame frame{
+      sourcemeta::core::SchemaFrame::Mode::Locations, document,
+      sourcemeta::core::schema_walker, sourcemeta::core::schema_resolver};
+
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame
+                    .location(sourcemeta::core::SchemaReferenceType::Static,
+                              "HTTPS://EXAMPLE.COM:443/schema#bar")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/foo");
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame
+                    .location(sourcemeta::core::SchemaReferenceType::Static,
+                              "https://example.com/./schema#bar")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/foo");
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame
+                    .location(sourcemeta::core::SchemaReferenceType::Dynamic,
+                              "HTTPS://EXAMPLE.COM:443/schema#qux")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/baz");
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame
+                    .location(sourcemeta::core::SchemaReferenceType::Static,
+                              "HTTPS://EXAMPLE.COM:443/schema#qux")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/baz");
+  EXPECT_FALSE(frame
+                   .location(sourcemeta::core::SchemaReferenceType::Dynamic,
+                             "HTTPS://EXAMPLE.COM:443/schema#bar")
+                   .has_value());
+  EXPECT_FALSE(frame
+                   .location(sourcemeta::core::SchemaReferenceType::Dynamic,
+                             "https://example.com/schema#bar")
+                   .has_value());
+}
+
+TEST(location_of_a_uri_that_does_not_parse) {
+  const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://example.com/schema"
+  })JSON");
+
+  const sourcemeta::core::SchemaFrame frame{
+      sourcemeta::core::SchemaFrame::Mode::Locations, document,
+      sourcemeta::core::schema_walker, sourcemeta::core::schema_resolver};
+
+  EXPECT_FALSE(
+      frame.location(sourcemeta::core::SchemaReferenceType::Static, "http://[")
+          .has_value());
+}
+
+// RFC 3986 Section 2.2 keeps a percent-encoded slash from standing in for the
+// one that RFC 6901 Section 3 puts in front of every reference token, so the
+// two spellings below name two different places
+TEST(location_of_a_pointer_fragment_that_percent_encodes_a_delimiter) {
+  const sourcemeta::core::JSON document = sourcemeta::core::parse_json(R"JSON({
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://example.com/slash",
+    "$defs": {
+      "a/b": { "type": "string" },
+      "a": { "b": { "type": "number" } }
+    }
+  })JSON");
+
+  const sourcemeta::core::SchemaFrame frame{
+      sourcemeta::core::SchemaFrame::Mode::Pointers, document,
+      sourcemeta::core::schema_walker, sourcemeta::core::schema_resolver};
+
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame.traverse("https://example.com/slash#/$defs/a~1b")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/a~1b");
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame.traverse("https://example.com/slash#/$defs/a%2Fb")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/a~1b");
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame.traverse("https://example.com/slash#/$defs/a/b")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/a/b");
+  EXPECT_EQ(sourcemeta::core::to_string(
+                frame
+                    .location(sourcemeta::core::SchemaReferenceType::Static,
+                              "https://example.com/slash#/$defs/a%2Fb")
+                    .value()
+                    .get()
+                    .pointer),
+            "/$defs/a~1b");
+}

From 8d4fa193f87864339c63f07a6f18ed99f7e94008 Mon Sep 17 00:00:00 2001
From: Juan Cruz Viotti <jv@jviotti.com>
Date: Sat, 24 Oct 2026 15:02:28 -0300
Subject: [PATCH 2/2] More fixes

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
---
 .../include/sourcemeta/core/jsonpointer.h     |  7 +--
 src/core/jsonpointer/jsonpointer.cc           | 37 ++++++++++-----
 src/core/jsonschema/frame.cc                  |  6 +--
 .../sourcemeta/core/jsonschema_frame.h        |  4 +-
 .../jsonpointer_fragment_to_pointer_test.cc   | 47 +++++++++++++------
 test/jsonschema/jsonschema_frame_test.cc      | 20 +++-----
 6 files changed, 73 insertions(+), 48 deletions(-)

diff --git a/src/core/jsonpointer/include/sourcemeta/core/jsonpointer.h b/src/core/jsonpointer/include/sourcemeta/core/jsonpointer.h
index 72700b7f3e..2ffe0b2d3c 100644
--- a/src/core/jsonpointer/include/sourcemeta/core/jsonpointer.h
+++ b/src/core/jsonpointer/include/sourcemeta/core/jsonpointer.h
@@ -409,9 +409,10 @@ auto to_pointer(
     -> Pointer;
 
 /// @ingroup jsonpointer
-/// Parse the URI fragment representation of a JSON Pointer. A percent-encoded
-/// slash is data within a reference token rather than a separator, as RFC
-/// 3986, Section 2.4 requires. The result is not set if the URI has no
+/// Parse the URI fragment representation of a JSON Pointer. Reference tokens
+/// are separated before their octets are decoded, so a percent-encoded slash
+/// neither separates two tokens, per RFC 3986, Section 2.2, nor belongs to
+/// one, per RFC 6901, Section 3. The result is not set if the URI has no
 /// fragment or if its fragment is not a valid JSON Pointer. For example:
 ///
 /// ```cpp
diff --git a/src/core/jsonpointer/jsonpointer.cc b/src/core/jsonpointer/jsonpointer.cc
index 7c6a68b552..983f5cc63a 100644
--- a/src/core/jsonpointer/jsonpointer.cc
+++ b/src/core/jsonpointer/jsonpointer.cc
@@ -23,17 +23,27 @@
 
 namespace {
 
-// A slash that comes out of an escape is data within the reference token it
-// falls in, which is the escape that RFC 6901 Section 3 gives it
+// The slash that belongs to a reference token is spelled `~1`, and the
+// transformation evaluation applies to a token is alone in turning that back
+// into one, so a token still holding a slash once its octets are decoded
+// conforms to no reference token and is an error condition rather than a
+// member name
+// See https://www.rfc-editor.org/rfc/rfc6901#section-3
+// See https://www.rfc-editor.org/rfc/rfc6901#section-4
 auto append_reference_token(sourcemeta::core::JSON::String &output,
-                            const std::string_view token) -> void {
-  for (const auto character : sourcemeta::core::URI::unescape(token)) {
-    if (character == '/') {
-      output.append("~1");
-    } else {
-      output.push_back(character);
-    }
+                            const std::string_view token) -> bool {
+  if (token.find('%') == std::string_view::npos) {
+    output.append(token);
+    return true;
+  }
+
+  const auto decoded{sourcemeta::core::URI::unescape(token)};
+  if (decoded.find('/') != std::string::npos) {
+    return false;
   }
+
+  output.append(decoded);
+  return true;
 }
 
 template <template <typename T> typename Allocator, typename V,
@@ -363,8 +373,7 @@ auto fragment_to_pointer(const URI &uri) -> std::optional<Pointer> {
   //
   // The slash that precedes every reference token is the delimiter here, and
   // a reserved character is not equivalent to the octet that stands for it,
-  // so a slash that was percent-encoded is data within the token it falls in
-  // rather than the start of the next one.
+  // so a slash that was percent-encoded never separates two tokens.
   // See https://www.rfc-editor.org/rfc/rfc3986#section-2.2
   // See https://www.rfc-editor.org/rfc/rfc6901#section-3
   if (value.front() != '/') {
@@ -377,7 +386,11 @@ auto fragment_to_pointer(const URI &uri) -> std::optional<Pointer> {
   while (true) {
     const auto parts{split_once(rest, '/')};
     input.push_back('/');
-    append_reference_token(input, parts.has_value() ? parts->first : rest);
+    if (!append_reference_token(input,
+                                parts.has_value() ? parts->first : rest)) {
+      return std::nullopt;
+    }
+
     if (!parts.has_value()) {
       break;
     }
diff --git a/src/core/jsonschema/frame.cc b/src/core/jsonschema/frame.cc
index 33925e7778..d773866a60 100644
--- a/src/core/jsonschema/frame.cc
+++ b/src/core/jsonschema/frame.cc
@@ -2043,9 +2043,9 @@ auto SchemaFrame::location(const SchemaReferenceType type,
     return result->second;
   }
 
-  // Asking for a location of a given kind is the same question asked of the
-  // same places as asking for one of either kind, so a URI that reaches here
-  // is settled the same way before it is given up on
+  // A URI is settled the same way whichever kind of location it is asked
+  // for, as the kind narrows which places answer rather than how the name of
+  // a place is spelled
   const auto canonical{other_spelling(uri_string)};
   if (!canonical.has_value()) {
     return std::nullopt;
diff --git a/src/core/jsonschema/include/sourcemeta/core/jsonschema_frame.h b/src/core/jsonschema/include/sourcemeta/core/jsonschema_frame.h
index 13160fdc7e..6eca1cd713 100644
--- a/src/core/jsonschema/include/sourcemeta/core/jsonschema_frame.h
+++ b/src/core/jsonschema/include/sourcemeta/core/jsonschema_frame.h
@@ -214,7 +214,9 @@ class SOURCEMETA_CORE_JSONSCHEMA_EXPORT SchemaFrame {
             const sourcemeta::core::WeakPointer &pointer) const
       -> std::optional<std::reference_wrapper<const Reference>>;
 
-  /// Get a specific location entry by reference type and URI
+  /// Get a specific location entry by reference type and URI, settling the
+  /// spelling of the URI the way framing settles the one it files a location
+  /// under
   [[nodiscard]] auto location(const SchemaReferenceType type,
                               const std::string_view uri) const
       -> std::optional<std::reference_wrapper<const Location>>;
diff --git a/test/jsonpointer/jsonpointer_fragment_to_pointer_test.cc b/test/jsonpointer/jsonpointer_fragment_to_pointer_test.cc
index d3588f929e..a839a84438 100644
--- a/test/jsonpointer/jsonpointer_fragment_to_pointer_test.cc
+++ b/test/jsonpointer/jsonpointer_fragment_to_pointer_test.cc
@@ -89,34 +89,51 @@ TEST(uri_with_percent_encoded_caret) {
 // the percent-encoded octets within them, and RFC 3986 Section 2.2 keeps a
 // reserved character from being equivalent to the octet that stands for it, so
 // the slash that RFC 6901 Section 3 puts in front of every reference token is
-// never one that was percent-encoded
+// never one that was percent-encoded. RFC 6901 Section 3 gives the slash that
+// belongs to a token the one spelling `~1`, so a decoded one leaves the
+// fragment conforming to nothing
 TEST(uri_with_percent_encoded_slash) {
   const sourcemeta::core::URI uri{"#/foo%2Fbar"};
-  const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
-  EXPECT_TRUE(pointer.has_value());
-  EXPECT_EQ(pointer.value().size(), 1);
-  EXPECT_TRUE(pointer.value().at(0).is_property());
-  EXPECT_EQ(pointer.value().at(0).to_property(), "foo/bar");
+  EXPECT_FALSE(sourcemeta::core::fragment_to_pointer(uri).has_value());
 }
 
 TEST(uri_with_lowercase_percent_encoded_slash) {
   const sourcemeta::core::URI uri{"#/foo%2fbar"};
-  const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
-  EXPECT_TRUE(pointer.has_value());
-  EXPECT_EQ(pointer.value().size(), 1);
-  EXPECT_TRUE(pointer.value().at(0).is_property());
-  EXPECT_EQ(pointer.value().at(0).to_property(), "foo/bar");
+  EXPECT_FALSE(sourcemeta::core::fragment_to_pointer(uri).has_value());
 }
 
 TEST(uri_with_percent_encoded_slash_and_an_unencoded_one) {
   const sourcemeta::core::URI uri{"#/foo%2Fbar/baz"};
+  EXPECT_FALSE(sourcemeta::core::fragment_to_pointer(uri).has_value());
+}
+
+TEST(uri_with_percent_encoded_slash_as_a_whole_token) {
+  const sourcemeta::core::URI uri{"#/%2F"};
+  EXPECT_FALSE(sourcemeta::core::fragment_to_pointer(uri).has_value());
+}
+
+TEST(uri_with_percent_encoded_slash_ending_a_token) {
+  const sourcemeta::core::URI uri{"#/foo%2F"};
+  EXPECT_FALSE(sourcemeta::core::fragment_to_pointer(uri).has_value());
+}
+
+TEST(uri_with_percent_encoded_slash_after_an_empty_token) {
+  const sourcemeta::core::URI uri{"#//%2F"};
+  EXPECT_FALSE(sourcemeta::core::fragment_to_pointer(uri).has_value());
+}
+
+TEST(uri_with_percent_encoded_slash_before_another_token) {
+  const sourcemeta::core::URI uri{"#/%2F/x"};
+  EXPECT_FALSE(sourcemeta::core::fragment_to_pointer(uri).has_value());
+}
+
+TEST(uri_with_a_lone_separator) {
+  const sourcemeta::core::URI uri{"#/"};
   const auto pointer{sourcemeta::core::fragment_to_pointer(uri)};
   EXPECT_TRUE(pointer.has_value());
-  EXPECT_EQ(pointer.value().size(), 2);
+  EXPECT_EQ(pointer.value().size(), 1);
   EXPECT_TRUE(pointer.value().at(0).is_property());
-  EXPECT_EQ(pointer.value().at(0).to_property(), "foo/bar");
-  EXPECT_TRUE(pointer.value().at(1).is_property());
-  EXPECT_EQ(pointer.value().at(1).to_property(), "baz");
+  EXPECT_EQ(pointer.value().at(0).to_property(), "");
 }
 
 // RFC 6901 Section 3 wants a slash in front of every reference token, and a
diff --git a/test/jsonschema/jsonschema_frame_test.cc b/test/jsonschema/jsonschema_frame_test.cc
index 51a2cccb03..2b187b1447 100644
--- a/test/jsonschema/jsonschema_frame_test.cc
+++ b/test/jsonschema/jsonschema_frame_test.cc
@@ -2575,24 +2575,16 @@ TEST(location_of_a_pointer_fragment_that_percent_encodes_a_delimiter) {
                     .get()
                     .pointer),
             "/$defs/a~1b");
-  EXPECT_EQ(sourcemeta::core::to_string(
-                frame.traverse("https://example.com/slash#/$defs/a%2Fb")
-                    .value()
-                    .get()
-                    .pointer),
-            "/$defs/a~1b");
   EXPECT_EQ(sourcemeta::core::to_string(
                 frame.traverse("https://example.com/slash#/$defs/a/b")
                     .value()
                     .get()
                     .pointer),
             "/$defs/a/b");
-  EXPECT_EQ(sourcemeta::core::to_string(
-                frame
-                    .location(sourcemeta::core::SchemaReferenceType::Static,
-                              "https://example.com/slash#/$defs/a%2Fb")
-                    .value()
-                    .get()
-                    .pointer),
-            "/$defs/a~1b");
+  EXPECT_FALSE(
+      frame.traverse("https://example.com/slash#/$defs/a%2Fb").has_value());
+  EXPECT_FALSE(frame
+                   .location(sourcemeta::core::SchemaReferenceType::Static,
+                             "https://example.com/slash#/$defs/a%2Fb")
+                   .has_value());
 }