@@ -50,7 +50,9 @@ const CEILINGS: Record<string, number> = {
   // Also carries the symbol-key loop in `util.members`, which is what installs `$ZodProperties`'s `Symbol.iterator` on its prototype, and the memoizer's shared reference predicate. Measured 3036 / 3516 / 4611 locally plus 18 headroom.
   // Lowered by the measured −105 when checks stopped writing metadata into the bag at attach time: the string length/format closures and the per-instance bounded regex left every string bundle, and the template literal now derives its own part patterns.
   // Lowered by the measured −17 / −16 / −16 from making z.properties() a check again: the symbol-key loop in `util.members` and the memoizer's callable arm left with the schema role. Measured 3044 / 3418 / 4629 locally plus 18 headroom; the object ceiling had been overtaken to zero headroom on main, so its number moves up by two while the bundle moves down.
-  "zod-mini-string": 3436,
+
+  // factory check snapshots on the check-only properties base measure 3438 gzip bytes plus 28 headroom
+  "zod-mini-string": 3466,
   // Also carries the construction-time discriminator check, which writes a WeakMap entry from `$ZodObject`, so every bundle containing `z.object` pays for it whether or not it builds a discriminated union.
   // Also carries the declared symbol keys from #6448: `normalizeDef` collects the shape's own symbols and the parse loop walks them. Almost none of that is the `Reflect.ownKeys` conversions — reverting all eight of them measures a byte larger.
   // Also carries the memoizer seam from #6482: each container init reads `globalConfig.memoizer` and calls `attach`, which is what lets `zod/mini` opt into cycle support. Measured 4512 locally but 4533 on CI — the gzip stream differs across zlib builds — so the headroom rides on the CI number.
@@ -59,8 +61,9 @@ const CEILINGS: Record<string, number> = {
   // Also carries the symbol-key loop in `util.members`, which is what installs `$ZodProperties`'s `Symbol.iterator` on its prototype, and the memoizer's shared reference predicate. Measured 3036 / 3516 / 4611 locally plus 18 headroom.
   // Also carries the guards `validate` parses under: an `aborted` check in each container loop, and two early exits in the generated object parser. Only a bundle containing a container pays — boolean is byte-identical to main and string measures three bytes smaller — so this ceiling rises by the measured +76 and the other two do not move. Measured 4696 locally plus 18 headroom.
   // Lowered by the measured −69 for the same bag strip: the string and number inits no longer carry pattern derivation or attach-time metadata writes.
-  // Lowered by the measured −17 / −16 / −16 from making z.properties() a check again: the symbol-key loop in `util.members` and the memoizer's callable arm left with the schema role. Measured 3044 / 3418 / 4629 locally plus 18 headroom; the object ceiling had been overtaken to zero headroom on main, so its number moves up by two while the bundle moves down.
-  "zod-mini-object": 4647,
+
+  // factory check snapshots on the check-only properties base measure 4654 gzip bytes plus 28 headroom
+  "zod-mini-object": 4682,
 };
 
 /**
 
@@ -105,6 +105,28 @@ test("deferred initializers are released after construction", () => {
   expect(z.object({ a: z.string() })._zod.deferred).toEqual(undefined);
 });
 
+test("trait initializers run once per instance across repeated entry", () => {
+  const calls: string[] = [];
+  const Base: core.$constructor<any> = core.$constructor<any>("CountedBase", () => calls.push("base"));
+  const Child: core.$constructor<any> = core.$constructor<any>("CountedChild", (inst, def) => {
+    calls.push("child");
+    Base.init(inst, def);
+    Base.init(inst, def);
+  });
+  const constructed = new Child({});
+  Child.init(constructed, {});
+  const direct = Object.create({});
+  Child.init(direct, {});
+  Child.init(direct, {});
+  expect(calls).toEqual(["child", "base", "child", "base"]);
+  for (const inst of [constructed, direct]) {
+    expect([...inst._zod.traits]).toEqual(["CountedChild", "CountedBase"]);
+    expect(inst instanceof Base).toBe(true);
+    expect(inst instanceof Child).toBe(true);
+  }
+  expect(constructed._zod.traits).not.toBe(direct._zod.traits);
+});
+
 test("a trait initializer called directly still installs its members", () => {
   // a direct `init` installs onto the receiver's own prototype, since it is not below the constructor's
   z.string();
 
@@ -2,6 +2,45 @@ import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
+test("number factory checks", () => {
+  const schema = z.number({ checks: [z.gte(1), z.lte(3)] as const });
+  const chained = z.number().min(1).max(3);
+  expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<number>();
+  for (const value of [0, 1, 3, 4, Number.NaN, "2", undefined]) {
+    expect(z.validate(schema, value)).toBe(z.validate(chained, value));
+    expect(schema.safeParse(value)).toEqual(chained.safeParse(value));
+  }
+  expect(z.toJSONSchema(schema)).toEqual(z.toJSONSchema(chained));
+  expect(schema.minValue).toBe(1);
+  expect(schema.maxValue).toBe(3);
+  expect(z.coerce.number({ checks: [z.gte(1)] }).parse("2")).toBe(2);
+  const overwritten = z.number({ checks: [z.overwrite<number>((value) => value + 1), z.gte(2)] });
+  expect(overwritten.parse(1)).toBe(2);
+  expect(z.validate(overwritten, 0)).toBe(false);
+  // @ts-expect-error length checks cannot validate numbers
+  z.number({ checks: [z.minLength(1)] });
+});
+
+test("number factory checks snapshot caller arrays", () => {
+  for (const factory of [z.number, z.coerce.number]) {
+    const checks = [z.gte(1)];
+    const schema = factory({ checks });
+    let reads = 0;
+    factory({
+      get checks() {
+        if (++reads > 1) throw new Error("checks read twice");
+        return checks;
+      },
+    });
+    expect(reads).toBe(1);
+    const before = z.toJSONSchema(schema);
+    checks.push(z.gte(10));
+    expect(z.validate(schema, 3)).toBe(true);
+    expect(z.validate(z.compile(schema), 3)).toBe(true);
+    expect(z.toJSONSchema(schema)).toEqual(before);
+  }
+});
+
 test("z.number() basic validation", () => {
   const schema = z.number();
   expect(schema.parse(1234)).toEqual(1234);
 
@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { expect, test } from "vitest";
+import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
@@ -12,6 +12,63 @@ const includesFromIndex2 = z.string().includes("includes", { position: 2 });
 const startsWith = z.string().startsWith("startsWith");
 const endsWith = z.string().endsWith("endsWith");
 
+test("string factory checks", async () => {
+  const schema = z.string({ checks: [z.minLength(1), z.maxLength(3)] as const });
+  const chained = z.string().min(1).max(3);
+  expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<string>();
+  for (const value of ["", "ab", "abcd", 1, undefined]) {
+    expect(z.validate(schema, value)).toBe(z.validate(chained, value));
+    expect(schema.safeParse(value)).toEqual(chained.safeParse(value));
+  }
+  expect(z.toJSONSchema(schema)).toEqual(z.toJSONSchema(chained));
+  expect(schema.minLength).toBe(1);
+  expect(schema.maxLength).toBe(3);
+  expect(schema._zod.parent).toBeUndefined();
+  expect([...schema._zod.traits]).toEqual([...chained._zod.traits]);
+  const extended = schema.max(2);
+  expect(extended._zod.parent).toBe(schema);
+  expect(z.validate(schema, "abc")).toBe(true);
+  expect(z.validate(extended, "abc")).toBe(false);
+  const coerce = z.coerce.string({ checks: [z.minLength(2)] });
+  expect(coerce.parse(12)).toBe("12");
+  expect(z.validate(coerce, 1)).toBe(false);
+  const asyncSchema = z.string({
+    checks: [
+      z.check<string>(async (ctx) => {
+        if (ctx.value !== "ok") ctx.issues.push({ code: "custom", input: ctx.value });
+      }),
+    ],
+  });
+  expect(await asyncSchema.safeParseAsync("ok")).toEqual({ success: true, data: "ok" });
+  expect((await asyncSchema.safeParseAsync("bad")).success).toBe(false);
+  // @ts-expect-error numeric checks cannot validate strings
+  z.string({ checks: [z.gte(1)] });
+});
+
+test("factory checks snapshot caller arrays", () => {
+  for (const factory of [z.string, z.coerce.string]) {
+    for (const initial of [[], [z.minLength(1)]]) {
+      const schema = factory({ checks: initial });
+      let reads = 0;
+      const getterSchema = factory({
+        get checks() {
+          if (++reads > 1) throw new Error("checks read twice");
+          return initial;
+        },
+      });
+      expect(reads).toBe(1);
+      expect(z.validate(getterSchema, "long")).toBe(true);
+      const before = z.toJSONSchema(schema);
+      initial.push(z.minLength(10));
+      expect(schema._zod.def.checks).not.toBe(initial);
+      expect(z.validate(schema, "long")).toBe(true);
+      expect(z.validate(z.compile(schema), "long")).toBe(true);
+      expect(z.toJSONSchema(schema)).toEqual(before);
+      expect(z.validate(schema.check(z.minLength(2)), "long")).toBe(true);
+    }
+  }
+});
+
 test("length checks", () => {
   minFive.parse("12345");
   minFive.parse("123456");
 
@@ -1,5 +1,5 @@
 import { Validator } from "@seriousme/openapi-schema-validator";
-import { describe, expect, test } from "vitest";
+import { describe, expect, test, vi } from "vitest";
 import * as z from "zod";
 // import * as zCore from "zod/v4/core";
 
@@ -3235,67 +3235,85 @@ test("basic registry", () => {
   `);
 });
 
-test("large registry converts in linear time", () => {
-  const count = 2000;
-  const convert = (withIntersection: boolean) => {
+function countMapScanWork<T>(convert: () => T): { result: T; work: number } {
+  const entries = Map.prototype.entries;
+  const values = Map.prototype.values;
+  let work = 0;
+  const entriesSpy = vi.spyOn(Map.prototype, "entries").mockImplementation(function (this: Map<unknown, unknown>) {
+    work += this.size;
+    return entries.call(this);
+  } as typeof Map.prototype.entries);
+  const valuesSpy = vi.spyOn(Map.prototype, "values").mockImplementation(function (this: Map<unknown, unknown>) {
+    work += this.size;
+    return values.call(this);
+  } as typeof Map.prototype.values);
+  try {
+    return { result: convert(), work };
+  } finally {
+    entriesSpy.mockRestore();
+    valuesSpy.mockRestore();
+  }
+}
+
+test("large registry conversion performs linear map-scan work", () => {
+  const count = 64;
+  const convert = (size: number, withIntersection: boolean) => {
     const registry = z.registry<{ id: string }>();
-    for (let i = 0; i < count; i++) {
+    for (let i = 0; i < size; i++) {
       registry.add(
         z.object({ id: z.string(), name: z.string(), count: z.number(), nested: z.object({ a: z.boolean() }) }),
         { id: `Type${i}` }
       );
     }
     if (withIntersection) registry.add(z.object({ a: z.string() }).and(z.object({ b: z.string() })), { id: "Inter" });
 
-    const start = performance.now();
-    const { schemas } = z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` });
-    return { schemas, elapsed: performance.now() - start };
+    return countMapScanWork(() => z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` }));
   };
 
-  const plain = convert(false);
-  expect(Object.keys(plain.schemas)).toHaveLength(count);
-  expect(plain.schemas.Type0).toMatchObject({
+  const plain = convert(count, false);
+  const plainDouble = convert(count * 2, false);
+  expect(Object.keys(plain.result.schemas)).toHaveLength(count);
+  expect(plain.result.schemas.Type0).toMatchObject({
     $id: "https://example.com/Type0.json",
     type: "object",
     properties: { nested: { type: "object" } },
   });
-  expect(plain.schemas[`Type${count - 1}`]!.$id).toBe(`https://example.com/Type${count - 1}.json`);
+  expect(plain.result.schemas[`Type${count - 1}`]!.$id).toBe(`https://example.com/Type${count - 1}.json`);
+  expect(plain.work).toBeGreaterThan(0);
+  expect(plainDouble.work).toBeLessThanOrEqual(plain.work * 2);
 
-  // The whole-map passes in extractDefs/finalize used to re-run once per registered schema, which made this quadratic: ~9s of CPU at this size before the passes were hoisted, ~50ms after.
-  expect(plain.elapsed).toBeLessThan(5000);
-
-  // The intersection fold walks the whole map as well, so it has to run inside the same guard. Hoisting it back out costs ~10x at this size. Comparing the two conversions rather than asserting a fixed budget keeps this independent of how fast the machine is.
-  const folded = convert(true);
-  expect(folded.schemas.Inter).toMatchObject({ type: "object", properties: { a: {}, b: {} } });
-  expect(folded.elapsed).toBeLessThan(plain.elapsed * 4 + 100);
+  const folded = convert(count, true);
+  const foldedDouble = convert(count * 2, true);
+  expect(folded.result.schemas.Inter).toMatchObject({ type: "object", properties: { a: {}, b: {} } });
+  expect(folded.work).toBeGreaterThan(0);
+  expect(foldedDouble.work).toBeLessThanOrEqual(folded.work * 2);
 });
 
-test("a registry of records with numeric keys converts in linear time", () => {
-  const count = 2000;
-  const convert = (key: (i: number) => z.core.$ZodType) => {
+test("a registry of records with numeric keys performs linear map-scan work", () => {
+  const count = 64;
+  const convert = (size: number, key: (i: number) => z.core.$ZodType) => {
     const registry = z.registry<{ id: string }>();
-    for (let i = 0; i < count; i++) {
+    for (let i = 0; i < size; i++) {
       registry.add(z.object({ m: z.record(key(i) as z.core.$ZodRecordKey, z.boolean()) }), { id: `Type${i}` });
     }
-    const start = performance.now();
-    const { schemas } = z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` });
-    return { schemas, elapsed: performance.now() - start };
+    return countMapScanWork(() => z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` }));
   };
 
-  const string = convert(() => z.string());
-  const numeric = convert(() => z.number());
-  expect(numeric.schemas.Type0).toMatchObject({
+  const numeric = convert(count, () => z.number());
+  const numericDouble = convert(count * 2, () => z.number());
+  expect(numeric.result.schemas.Type0).toMatchObject({
     properties: { m: { propertyNames: { type: "string", pattern: "^-?\\d+(?:\\.\\d+)?$" } } },
   });
+  expect(numeric.work).toBeGreaterThan(0);
+  expect(numericDouble.work).toBeLessThanOrEqual(numeric.work * 2);
 
-  // The rewrite has to find every carrier the flatten copied `propertyNames` onto, which means a pass over the whole seen map. Running that once per record rather than once per conversion cost ~10x at this size. A string key needs no rewrite at all, so comparing against it keeps this independent of how fast the machine is.
-  expect(numeric.elapsed).toBeLessThan(string.elapsed * 2 + 50);
-
-  // An extracted key resolves through a map built once per conversion rather than a search per reference. There is no stable timing control for that — extraction has its own $defs cost, which swamps the difference — so this only pins the shape.
-  const extracted = convert((i) => z.number().meta({ id: `Key${i}` }));
-  expect(extracted.schemas.Type0).toMatchObject({
+  const extracted = convert(count, (i) => z.number().meta({ id: `Key${i}` }));
+  const extractedDouble = convert(count * 2, (i) => z.number().meta({ id: `Key${i}` }));
+  expect(extracted.result.schemas.Type0).toMatchObject({
     properties: { m: { propertyNames: { type: "string", pattern: "^-?\\d+(?:\\.\\d+)?$" } } },
   });
+  expect(extracted.work).toBeGreaterThan(0);
+  expect(extractedDouble.work).toBeLessThanOrEqual(extracted.work * 2);
 });
 
 test("registry extracts unregistered subschemas into __shared", () => {
@@ -3849,6 +3867,31 @@ test("input JSON schema resolves requiredness past transform and catch wrappers"
   expect(required(z.object({ a: z.transform((v: unknown) => String(v)).pipe(z.string()) }))).toEqual(["a"]);
 });
 
+test("object required keys preserve shape order and direction", () => {
+  const symbol = Symbol("symbol");
+  const shape: z.ZodRawShape = {
+    10: z.string(),
+    2: z.string().optional(),
+    plain: z.string(),
+    optional: z.string().optional(),
+    defaulted: z.string().default("x"),
+    caught: z.string().catch("x"),
+    [symbol]: z.string(),
+  };
+  Object.defineProperty(shape, "__proto__", { value: z.string(), enumerable: true });
+  Object.defineProperty(shape, "hidden", { value: z.string(), enumerable: false });
+
+  const input = z.toJSONSchema(z.object(shape), { io: "input", unrepresentable: "any" });
+  const output = z.toJSONSchema(z.object(shape), { io: "output", unrepresentable: "any" });
+
+  expect(Object.keys(input.properties!)).toEqual(["2", "10", "plain", "optional", "defaulted", "caught", "__proto__"]);
+  expect(input.required).toEqual(["10", "plain", "caught", "__proto__"]);
+  expect(output.required).toEqual(["10", "plain", "defaulted", "caught", "__proto__"]);
+  expect(Object.prototype.hasOwnProperty.call(input.properties!, "__proto__")).toBe(true);
+  expect(input.properties).not.toHaveProperty("hidden");
+  expect(Object.getOwnPropertySymbols(input.properties!)).toEqual([]);
+});
+
 test("strip output-side examples from input JSON schema for codec", () => {
   const codec = z
     .codec(z.string(), z.number(), { decode: (s) => Number(s), encode: (n) => String(n) })