Sweep invalid UTF-8 at every position through dump()

Compare dump() of strings with ill-formed UTF-8 (stray continuation bytes, invalid lead bytes, overlong encodings, surrogates, code points above U+10FFFF, and sequences cut short by ASCII, a quote, a backslash, a lead byte, or the end of the string) with an independent reference serializer, for every error handler and with ensure_ascii on and off. The pattern is put at every position of short strings to cross the strides of the bulk scanners, and of longer ones to cross the end of the 512-byte string buffer. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Avoid raw string literals with backslashes in CHECK macros
2026-10-15 10:47:13 +00:00 · 2026-10-15 09:24:33 +02:00 · 2026-10-14 22:38:07 +02:00 · 2026-10-14 09:16:40 +02:00
6 changed files with 1105 additions and 1415 deletions
@@ -23,7 +23,6 @@
    #include <cstdlib> // _byteswap_ushort, _byteswap_ulong, _byteswap_uint64
 #endif

-#include <nlohmann/detail/bit_ops.hpp>
 #include <nlohmann/detail/input/binary_reader.hpp>
 #include <nlohmann/detail/input/string_scan.hpp>
 #include <nlohmann/detail/macro_scope.hpp>
@@ -205,12 +204,24 @@ class binary_writer
            }

            case value_t::number_integer:
+            {
+                if (j.m_data.m_value.number_integer >= 0)
+                {
+                    // CBOR does not differentiate between positive signed
+                    // integers and unsigned integers
+                    write_cbor_head(0x00, static_cast<std::uint64_t>(j.m_data.m_value.number_integer));
+                }
+                else
+                {
+                    // a negative integer n is encoded as -1 - n
+                    write_cbor_head(0x20, static_cast<std::uint64_t>(-1 - j.m_data.m_value.number_integer));
+                }
+                break;
+            }
+
            case value_t::number_unsigned:
            {
-                // one case for both, so that an array mixing negative
-                // (number_integer) and non-negative (number_unsigned) values
-                // does not mispredict the switch
-                write_cbor_integer(j);
+                write_cbor_head(0x00, j.m_data.m_value.number_unsigned);
                break;
            }

@@ -245,7 +256,13 @@ class binary_writer

            case value_t::array:
            {
-                write_cbor_array(j, depth);
+                // step 1: write control byte and the array size
+                write_cbor_head(0x80, j.m_data.m_value.array->size());
+
+                for (const auto& el : *j.m_data.m_value.array)
+                {
+                    write_cbor(el, depth + 1);
+                }
                break;
            }

@@ -403,12 +420,54 @@ class binary_writer
            }

            case value_t::number_integer:
+            {
+                if (j.m_data.m_value.number_integer >= 0)
+                {
+                    // MessagePack does not differentiate between positive
+                    // signed integers and unsigned integers.
+                    write_msgpack_unsigned(static_cast<std::uint64_t>(j.m_data.m_value.number_integer));
+                }
+                else
+                {
+                    if (j.m_data.m_value.number_integer >= -32)
+                    {
+                        // negative fixnum
+                        write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
+                    }
+                    else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int8_t>::min)() &&
+                             j.m_data.m_value.number_integer <= (std::numeric_limits<std::int8_t>::max)())
+                    {
+                        // int 8
+                        oa.write_character(to_char_type(0xD0));
+                        write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
+                    }
+                    else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int16_t>::min)() &&
+                             j.m_data.m_value.number_integer <= (std::numeric_limits<std::int16_t>::max)())
+                    {
+                        // int 16
+                        oa.write_character(to_char_type(0xD1));
+                        write_number(static_cast<std::int16_t>(j.m_data.m_value.number_integer));
+                    }
+                    else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int32_t>::min)() &&
+                             j.m_data.m_value.number_integer <= (std::numeric_limits<std::int32_t>::max)())
+                    {
+                        // int 32
+                        oa.write_character(to_char_type(0xD2));
+                        write_number(static_cast<std::int32_t>(j.m_data.m_value.number_integer));
+                    }
+                    else
+                    {
+                        // int 64
+                        oa.write_character(to_char_type(0xD3));
+                        write_number(static_cast<std::int64_t>(j.m_data.m_value.number_integer));
+                    }
+                }
+                break;
+            }
+
            case value_t::number_unsigned:
            {
-                // one case for both, so that an array mixing negative
-                // (number_integer) and non-negative (number_unsigned) values
-                // does not mispredict the switch
-                write_msgpack_integer(j, std::integral_constant<bool, msgpack_integers_fit_64_bits()>());
+                write_msgpack_unsigned(static_cast<std::uint64_t>(j.m_data.m_value.number_unsigned));
                break;
            }

@@ -426,7 +485,13 @@ class binary_writer

            case value_t::array:
            {
-                write_msgpack_array(j, depth);
+                // step 1: write control byte and the array size
+                write_msgpack_array_prefix(j.m_data.m_value.array->size(), j);
+
+                for (const auto& el : *j.m_data.m_value.array)
+                {
+                    write_msgpack(el, depth + 1);
+                }
                break;
            }

@@ -1886,316 +1951,6 @@ class binary_writer
        }
    }

-    /*!
-    @brief size class of an unsigned integer from its bit length
-
-    1, 2, 3, or 4 if @a x fits 1, 2, 4, or 8 bytes. Looked up from the number
-    of leading zero bits instead of found by branches: the sizes of a stream
-    of numbers are hard to predict, and a mispredicted branch costs more than
-    writing the number. (A table, as comparisons are vectorized by clang into
-    slower code.)
-    */
-    static unsigned integer_size_class(const std::uint64_t x) noexcept
-    {
-        static constexpr std::array<std::uint8_t, 64> size_class_by_leading_zeros =
-        {
-            {
-                4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4,
-                3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
-                2, 2, 2, 2, 2, 2, 2, 2,
-                1, 1, 1, 1, 1, 1, 1, 1
-            }
-        };
-        // x | 1 keeps count_leading_zeros() away from 0
-        return size_class_by_leading_zeros[static_cast<std::size_t>(count_leading_zeros(x | 1u))];
-    }
-
-    /*!
-    @brief encode @a first_byte and the low-order bytes of @a value that
-           @a size_class calls for (none, or 1, 2, 4, or 8) in network order
-           to @a out
-    @return the number of characters of the encoding; up to
-            @ref integer_encoding_space characters at @a out are overwritten
-
-    The bytes are written as one byte and one 8-byte word whose bytes after
-    the value are scratch that the caller drops, so that writing them does not
-    depend on the size class. For class 0 the word is all scratch; it is
-    shifted by 60 bits rather than 64, which would be undefined.
-    */
-    std::size_t encode_first_byte_and_tail(CharType* out, const std::uint8_t first_byte, const unsigned size_class, const std::uint64_t value) const noexcept
-    {
-        out[0] = to_char_type(first_byte);
-        const unsigned unused_bits = 64u - ((8u << size_class) >> 1u);
-        const std::uint64_t tail = is_little_endian ? byte_swap(value) >> unused_bits : value << unused_bits;
-        std::memcpy(out + 1, &tail, sizeof(tail));
-        return ((std::size_t{1} << size_class) >> 1u) + 1;
-    }
-
-    /// characters encode_first_byte_and_tail() may overwrite: the first byte
-    /// and one 8-byte word
-    static constexpr std::size_t integer_encoding_space = 9;
-
-    /*!
-    @brief the 64 bits of a number_integer or number_unsigned value, and a mask
-           that is all ones if it is negative, else zero
-
-    Selected through masks rather than branches, as the type and the sign of
-    the values in an array of mixed signs alternate unpredictably (non-negative
-    integers are number_unsigned after parsing). Up to 64 bits, the sign is bit
-    63 of the result (a narrower integer is sign-extended); computing it with
-    masks keeps GCC from branching on the type. A wider integer has to be
-    compared.
-    */
-    static std::uint64_t integer_bits(const BasicJsonType& j, std::uint64_t& sign_mask) noexcept
-    {
-        const bool is_signed = j.m_data.m_type == value_t::number_integer;
-        const std::uint64_t raw = is_signed
-                                  ? static_cast<std::uint64_t>(j.m_data.m_value.number_integer)
-                                  : static_cast<std::uint64_t>(j.m_data.m_value.number_unsigned);
-        sign_mask = sizeof(typename BasicJsonType::number_integer_t) <= sizeof(std::uint64_t)
-                    ? (std::uint64_t{0} - static_cast<std::uint64_t>(is_signed)) & (std::uint64_t{0} - (raw >> 63u))
-                    : std::uint64_t{0} - static_cast<std::uint64_t>(is_signed && j.m_data.m_value.number_integer < 0);
-        return raw;
-    }
-
-    /*!
-    @brief encode the head of a CBOR integer to @a out without branching on its
-           size
-    @return the number of characters of the head
-
-    Same output as @ref write_cbor_head. The lengths of strings and containers
-    are mostly predictable, so their heads keep the branches; the sizes of a
-    run of integers are not, so an integer's head is assembled without them.
-    */
-    std::size_t encode_cbor_integer_head(CharType* out, const std::uint8_t major_type, const std::uint64_t argument) const noexcept
-    {
-        // an argument of at most 23 is in size class 1 (one byte) and is moved
-        // to class 0, the first byte, by subtracting 1
-        const auto is_immediate = static_cast<unsigned>(argument <= 0x17u);
-        const unsigned size_class = integer_size_class(argument) - is_immediate;
-
-        // the first byte: the argument itself if it is immediate, else
-        // 0x17 + size_class, selected through a mask
-        const std::uint64_t immediate_mask = std::uint64_t{0} - is_immediate;
-        const auto first_byte = static_cast<std::uint8_t>(major_type + ((argument & immediate_mask) | ((0x17u + size_class) & ~immediate_mask)));
-        return encode_first_byte_and_tail(out, first_byte, size_class, argument);
-    }
-
-    /*!
-    @brief write an array value (head and elements) as CBOR
-
-    Integer elements, the most common scalar, are written without a call to
-    @ref write_cbor. The loop is kept out of line: inlined into write_cbor, its
-    registers would be saved and restored on every call of write_cbor, which
-    is one call per value nested in an object.
-    */
-    JSON_HEDLEY_NEVER_INLINE
-    void write_cbor_array(const BasicJsonType& j, const std::size_t depth)
-    {
-        write_cbor_head(0x80, j.m_data.m_value.array->size());
-        write_array_elements(j, [this](CharType * out, const BasicJsonType & el)
-        {
-            return encode_cbor_integer(out, el);
-        }, [this, depth](const BasicJsonType & el)
-        {
-            write_cbor(el, depth + 1);
-        });
-    }
-
-    /*!
-    @brief write the elements of the array @a j, runs of integers with
-           @a encode_integer and all other values with @a write_value
-
-    Runs of integers are encoded straight into space reserved from the sink
-    for a whole run: the write pointer stays a local, where it would otherwise
-    be reloaded from the sink for every value, as a store of a character may
-    alias it.
-    */
-    template<typename EncodeInteger, typename WriteValue>
-    void write_array_elements(const BasicJsonType& j, EncodeInteger encode_integer, WriteValue write_value)
-    {
-        constexpr std::size_t max_run = max_reserve_size / integer_encoding_space;
-        auto it = j.m_data.m_value.array->begin();
-        const auto end = j.m_data.m_value.array->end();
-        while (it != end)
-        {
-            if (it->is_number_integer())
-            {
-                CharType* const start = oa.reserve(max_run * integer_encoding_space);
-                CharType* out = start;
-                for (std::size_t n = 0; n < max_run && it != end && it->is_number_integer(); ++n, ++it)
-                {
-                    out += encode_integer(out, *it);
-                }
-                oa.commit(static_cast<std::size_t>(out - start));
-            }
-            else
-            {
-                write_value(*it);
-                ++it;
-            }
-        }
-    }
-
-    /*!
-    @brief write a number_integer or number_unsigned value as a CBOR integer
-
-    A negative integer n has major type 1 and the argument -1 - n, which is ~n.
-    Kept out of line, like the other per-value paths, so that write_cbor stays
-    small (runs of integers in an array are encoded inline instead).
-    */
-    JSON_HEDLEY_NEVER_INLINE
-    void write_cbor_integer(const BasicJsonType& j)
-    {
-        oa.commit(encode_cbor_integer(oa.reserve(integer_encoding_space), j));
-    }
-
-    /// encode a number_integer or number_unsigned value to @a out (see
-    /// @ref write_cbor_integer) and return the number of characters
-    std::size_t encode_cbor_integer(CharType* out, const BasicJsonType& j) const noexcept
-    {
-        std::uint64_t sign_mask = 0;
-        const std::uint64_t raw = integer_bits(j, sign_mask);
-        // ~raw is -1 - n in the 64 bits that are written
-        return encode_cbor_integer_head(out, static_cast<std::uint8_t>(sign_mask & 0x20u), raw ^ sign_mask);
-    }
-
-    /*!
-    @brief whether the MessagePack integers of BasicJsonType are written by
-           @ref encode_msgpack_integer
-
-    It picks the format from the low 64 bits; a wider number type keeps the
-    range checks of @ref write_msgpack on the whole value.
-    */
-    static constexpr bool msgpack_integers_fit_64_bits() noexcept
-    {
-        return sizeof(typename BasicJsonType::number_integer_t) <= sizeof(std::uint64_t)
-               && sizeof(typename BasicJsonType::number_unsigned_t) <= sizeof(std::uint64_t);
-    }
-
-    /*!
-    @brief write a number_integer or number_unsigned value as a MessagePack
-           integer without branching on its sign or size
-
-    Same output as @ref write_msgpack: a non-negative integer as positive fixint
-    (< 128) or uint 8/16/32/64, a negative one as negative fixint (>= -32) or
-    int 8/16/32/64. Kept out of line (see @ref write_cbor_integer).
-    */
-    JSON_HEDLEY_NEVER_INLINE
-    void write_msgpack_integer(const BasicJsonType& j, std::true_type /*fits_64_bits*/)
-    {
-        oa.commit(encode_msgpack_integer(oa.reserve(integer_encoding_space), j));
-    }
-
-    /// encode a number_integer or number_unsigned value to @a out (see
-    /// @ref write_msgpack_integer) and return the number of characters
-    std::size_t encode_msgpack_integer(CharType* out, const BasicJsonType& j) const noexcept
-    {
-        std::uint64_t sign_mask = 0;
-        const std::uint64_t raw = integer_bits(j, sign_mask);
-
-        // A negative n fits int 8/16/32 exactly if 2 * (-1 - n) + 1 fits
-        // uint 8/16/32, so x gives the size class of either sign.
-        const std::uint64_t is_negative = sign_mask & 1u;
-        const std::uint64_t x = ((raw ^ sign_mask) << is_negative) | is_negative;
-
-        // A fixint is at most 127, or at least -32 (x at most 63). It is in
-        // size class 1 and is moved to class 0, the first byte, by subtracting 1.
-        const auto is_fixint = static_cast<unsigned>(x <= (127u ^ (sign_mask & 64u)));
-        const unsigned size_class = integer_size_class(x) - is_fixint;
-
-        // the first byte: the low byte of the integer for a fixint, else the
-        // marker 0xCC..0xCF (uint) or 0xD0..0xD3 (int), selected through a mask
-        const std::uint64_t fixint_mask = std::uint64_t{0} - is_fixint;
-        const std::uint64_t marker = 0xCBu + size_class + (sign_mask & 4u);
-        const auto first_byte = static_cast<std::uint8_t>((raw & fixint_mask) | (marker & ~fixint_mask));
-        return encode_first_byte_and_tail(out, first_byte, size_class, raw);
-    }
-
-    /// write a number_integer or number_unsigned value of a number type wider
-    /// than 64 bits as a MessagePack integer, with range checks on the whole value
-    void write_msgpack_integer(const BasicJsonType& j, std::false_type /*fits_64_bits*/)
-    {
-        if (j.m_data.m_type == value_t::number_unsigned)
-        {
-            write_msgpack_unsigned(static_cast<std::uint64_t>(j.m_data.m_value.number_unsigned));
-            return;
-        }
-
-        if (j.m_data.m_value.number_integer >= 0)
-        {
-            // MessagePack does not differentiate between positive
-            // signed integers and unsigned integers.
-            write_msgpack_unsigned(static_cast<std::uint64_t>(j.m_data.m_value.number_integer));
-        }
-        else
-        {
-            if (j.m_data.m_value.number_integer >= -32)
-            {
-                // negative fixnum
-                write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
-            }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int8_t>::min)() &&
-                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int8_t>::max)())
-            {
-                // int 8
-                oa.write_character(to_char_type(0xD0));
-                write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
-            }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int16_t>::min)() &&
-                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int16_t>::max)())
-            {
-                // int 16
-                oa.write_character(to_char_type(0xD1));
-                write_number(static_cast<std::int16_t>(j.m_data.m_value.number_integer));
-            }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int32_t>::min)() &&
-                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int32_t>::max)())
-            {
-                // int 32
-                oa.write_character(to_char_type(0xD2));
-                write_number(static_cast<std::int32_t>(j.m_data.m_value.number_integer));
-            }
-            else
-            {
-                // int 64
-                oa.write_character(to_char_type(0xD3));
-                write_number(static_cast<std::int64_t>(j.m_data.m_value.number_integer));
-            }
-        }
-    }
-
-    /*!
-    @brief write an array value (head and elements) as MessagePack
-
-    See @ref write_cbor_array.
-    */
-    JSON_HEDLEY_NEVER_INLINE
-    void write_msgpack_array(const BasicJsonType& j, const std::size_t depth)
-    {
-        write_msgpack_array_prefix(j.m_data.m_value.array->size(), j);
-        write_msgpack_array_elements(j, depth, std::integral_constant<bool, msgpack_integers_fit_64_bits()>());
-    }
-
-    void write_msgpack_array_elements(const BasicJsonType& j, const std::size_t depth, std::true_type /*fits_64_bits*/)
-    {
-        write_array_elements(j, [this](CharType * out, const BasicJsonType & el)
-        {
-            return encode_msgpack_integer(out, el);
-        }, [this, depth](const BasicJsonType & el)
-        {
-            write_msgpack(el, depth + 1);
-        });
-    }
-
-    void write_msgpack_array_elements(const BasicJsonType& j, const std::size_t depth, std::false_type /*fits_64_bits*/)
-    {
-        for (const auto& el : *j.m_data.m_value.array)
-        {
-            write_msgpack(el, depth + 1);
-        }
-    }
-
    /*!
    @brief write an object key as a CBOR text string

@@ -8,10 +8,7 @@

 #pragma once

-#include <algorithm> // max
-#include <array> // array
 #include <cstddef> // size_t
-#include <cstring> // memcpy
 #include <memory> // shared_ptr, make_shared
 #include <string> // basic_string
 #include <type_traits> // conditional, integral_constant, is_same
@@ -51,170 +48,32 @@ template<typename CharType> struct output_adapter_protocol
 template<typename CharType>
 using output_adapter_t = std::shared_ptr<output_adapter_protocol<CharType>>;

-/// the largest number of characters a writer may reserve() from a sink at once;
-/// output_vector_sink also appends writes of at least this size with insert()
-constexpr std::size_t max_reserve_size = 256;
-
 /// @brief non-virtual output sink writing into a std::vector
 ///
 /// This sink is not part of the virtual output_adapter_protocol hierarchy: it is
 /// passed to binary_writer by value as a template parameter, so
 /// write_character()/write_characters() are ordinary (inlinable) calls with no
 /// vtable lookup and no shared_ptr. It is used for the common
-/// `to_cbor`/`to_msgpack`/... into a std::vector.
-///
-/// Most writes are a few bytes - a type marker, or a number of 1, 2, 4, or 8
-/// bytes - and appending those with push_back() or insert() cost more than
-/// encoding them: insert() is an out-of-line call into a routine that can insert
-/// anywhere, and resize() is one as well with libstdc++. The sink therefore keeps
-/// its own write position: it grows the vector geometrically ahead of the
-/// position and copies each write to it, so a write is a capacity check and a
-/// short copy. The destructor shrinks the vector to the bytes actually written,
-/// also when a write throws; shrinking a vector never allocates. The sink owns
-/// that trim, so it can be moved but not copied, and the vector must not be used
-/// while the sink is alive.
+/// `to_cbor`/`to_msgpack`/... into a std::vector. output_vector_adapter below
+/// wraps this same sink to provide the virtual interface.
 template<typename CharType, typename AllocatorType = std::allocator<CharType>>
 class output_vector_sink
 {
  public:
    explicit output_vector_sink(std::vector<CharType, AllocatorType>& vec) noexcept
-        : v(&vec), position(vec.size())
-    {}
-
-    output_vector_sink(const output_vector_sink&) = delete;
-    output_vector_sink& operator=(const output_vector_sink&) = delete;
-    output_vector_sink& operator=(output_vector_sink&&) = delete;
-
-    output_vector_sink(output_vector_sink&& other) noexcept
-        : v(other.v), position(other.position)
-    {
-        other.v = nullptr;
-    }
-
-    ~output_vector_sink()
-    {
-        if (v != nullptr)
-        {
-            v->resize(position);
-        }
-    }
-
-    // always inlined: GCC otherwise keeps these out of line in a large
-    // translation unit, and a call per byte or number costs more than the write
-    JSON_HEDLEY_ALWAYS_INLINE
-    void write_character(CharType c)
-    {
-        if (JSON_HEDLEY_UNLIKELY(position == v->size()))
-        {
-            grow(1);
-        }
-        (*v)[position++] = c;
-    }
-
-    // no JSON_HEDLEY_NON_NULL here: binary_writer legitimately passes a null
-    // pointer with length 0 for empty strings/binary values; memcpy must not
-    // see it.
-    JSON_HEDLEY_ALWAYS_INLINE
-    void write_characters(const CharType* s, std::size_t length)
-    {
-        if (JSON_HEDLEY_UNLIKELY(v->size() - position < length))
-        {
-            if (length >= max_reserve_size)
-            {
-                append(s, length);
-                return;
-            }
-            grow(length);
-        }
-        if (length != 0)
-        {
-            std::memcpy(v->data() + position, s, length * sizeof(CharType));
-            position += length;
-        }
-    }
-
-    /// @brief space for writing up to @a length characters directly
-    ///
-    /// Returns a pointer to at least @a length (at most @ref max_reserve_size)
-    /// writable characters at the write position; @ref commit then keeps the
-    /// first ones of them. A writer can store whole words there and keep only
-    /// the bytes it needs, and keep its write pointer in a register across many
-    /// values instead of updating the sink after each.
-    JSON_HEDLEY_ALWAYS_INLINE
-    CharType* reserve(const std::size_t length)
-    {
-        JSON_ASSERT(length <= max_reserve_size);
-        if (JSON_HEDLEY_UNLIKELY(v->size() - position < length))
-        {
-            grow(length);
-        }
-        return v->data() + position;
-    }
-
-    /// keep the first @a length characters written to the space from reserve()
-    JSON_HEDLEY_ALWAYS_INLINE
-    void commit(const std::size_t length) noexcept
-    {
-        position += length;
-    }
-
-  private:
-    /// make room for at least @a length more characters after the position;
-    /// kept out of line so that the write functions stay small enough for
-    /// GCC to inline them into the writer
-    JSON_HEDLEY_NEVER_INLINE
-    void grow(const std::size_t length)
-    {
-        // use the capacity the vector already has, else at least double it;
-        // never less than 64 characters, so that a small value does not
-        // reallocate for every few bytes
-        const std::size_t needed = position + length;
-        v->resize((std::max)(std::size_t{64}, needed <= v->capacity()
-                             ? v->capacity()
-                             : (std::max)(needed, v->capacity() * 2)));
-    }
-
-    /// append @a length (at least max_reserve_size) characters that do not fit
-    /// the space ahead of the position: insert() copies them once into the
-    /// grown vector, where grow() would first zero the new space and then copy
-    /// over it - noticeable for a large string or binary value
-    JSON_HEDLEY_NEVER_INLINE
-    void append(const CharType* s, const std::size_t length)
-    {
-        v->resize(position);
-        if (v->capacity() - position < length)
-        {
-            // grow geometrically, with room for the writes that follow, so
-            // that the next grow() need not reallocate right away
-            v->reserve((std::max)(v->capacity() * 2, position + length + max_reserve_size));
-        }
-        v->insert(v->end(), s, s + length);
-        position = v->size();
-    }
-
-    std::vector<CharType, AllocatorType>* v;
-    /// number of characters of *v written so far
-    std::size_t position;
-};
-
-/// output adapter for byte vectors
-template<typename CharType, typename AllocatorType = std::allocator<CharType>>
-class output_vector_adapter : public output_adapter_protocol<CharType>
-{
-  public:
-    explicit output_vector_adapter(std::vector<CharType, AllocatorType>& vec) noexcept
        : v(vec)
    {}

-    void write_character(CharType c) override
+    void write_character(CharType c)
    {
        v.push_back(c);
    }

    // no JSON_HEDLEY_NON_NULL here: binary_writer legitimately passes a null
-    // pointer with length 0 for empty strings/binary values; appending an empty
-    // range is a no-op
-    void write_characters(const CharType* s, std::size_t length) override
+    // pointer with length 0 for empty strings/binary values. Appending an empty
+    // range is a no-op; the type-erased path tolerates this via the (unattributed)
+    // virtual base, and the concrete sink must do the same.
+    void write_characters(const CharType* s, std::size_t length)
    {
        v.insert(v.end(), s, s + length);
    }
@@ -223,6 +82,33 @@ class output_vector_adapter : public output_adapter_protocol<CharType>
    std::vector<CharType, AllocatorType>& v;
 };

+/// output adapter for byte vectors
+///
+/// The appending itself lives in output_vector_sink; this class only adds the
+/// virtual output_adapter_protocol interface on top of it, so both the
+/// type-erased and the templated path share one implementation.
+template<typename CharType, typename AllocatorType = std::allocator<CharType>>
+class output_vector_adapter : public output_adapter_protocol<CharType>
+{
+  public:
+    explicit output_vector_adapter(std::vector<CharType, AllocatorType>& vec) noexcept
+        : sink(vec)
+    {}
+
+    void write_character(CharType c) override
+    {
+        sink.write_character(c);
+    }
+
+    void write_characters(const CharType* s, std::size_t length) override
+    {
+        sink.write_characters(s, length);
+    }
+
+  private:
+    output_vector_sink<CharType, AllocatorType> sink;
+};
+
 #ifndef JSON_NO_IO
 /// output adapter for output streams
 template<typename CharType>
@@ -302,24 +188,8 @@ class output_adapter_sink
        oa->write_characters(s, length);
    }

-    /// space for writing up to @a length characters (see
-    /// output_vector_sink::reserve)
-    CharType* reserve(const std::size_t length) noexcept
-    {
-        JSON_ASSERT(length <= max_reserve_size);
-        static_cast<void>(length);
-        return reserved.data();
-    }
-
-    /// write the first @a length characters written to the space from reserve()
-    void commit(const std::size_t length)
-    {
-        oa->write_characters(reserved.data(), length);
-    }
-
  private:
    output_adapter_t<CharType> oa;
-    std::array<CharType, max_reserve_size> reserved{};
 };

 /// @brief whether std::basic_string<CharType> has a non-deprecated std::char_traits
@@ -772,6 +772,33 @@ class serializer
                        break;
                    }
                }
+
+                // A byte below 0x60 is a complete code point and needs no
+                // UTF-8 decoding. The scanner stops only at a control
+                // character, a quote, or a backslash in that range, so look up
+                // its escape sequence and write all 8 bytes of the table entry
+                // straight into the write buffer; only the length stored in the
+                // last byte of the entry is kept.
+                if (data[i] < 0x60)
+                {
+                    // emit any bytes still pending in string_buffer first to
+                    // preserve output order
+                    if (bytes != 0)
+                    {
+                        put_buffer(string_buffer, bytes);
+                        bytes = 0;
+                    }
+                    const auto& escape = ascii_escapes()[data[i]];
+                    if (JSON_HEDLEY_UNLIKELY(write_buffer.size() - write_buffer_pos < escape.size()))
+                    {
+                        flush();
+                    }
+                    std::memcpy(write_buffer.data() + write_buffer_pos, escape.data(), escape.size());
+                    write_buffer_pos += static_cast<std::size_t>(escape[7]);
+                    bytes_after_last_accept = 0;
+                    undumped_chars = 0;
+                    continue;
+                }
            }

            const auto byte = static_cast<std::uint8_t>(s[i]);
@@ -780,92 +807,39 @@ class serializer
            {
                case UTF8_ACCEPT:  // decode found a new code point
                {
-                    switch (codepoint)
+                    // the code point is at least 0x60 (smaller ones are handled
+                    // above) and is not printable ASCII (which the scanner
+                    // copies): it is DEL (0x7F) under EnsureAscii or a non-ASCII
+                    // character
+                    if (EnsureAscii)
                    {
-                        case 0x08: // backspace
+                        JSON_ASSERT(codepoint >= 0x7F);
+                        if (error_handler == error_handler_t::keep)
                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 'b';
-                            break;
+                            // this character was buffered as raw bytes below
+                            // in case it turned out to be part of an
+                            // ill-formed sequence (which is kept as is); now
+                            // that it decoded to a well-formed code point,
+                            // undo that and \u-escape it like any other
+                            // character instead
+                            bytes = bytes_after_last_accept;
                        }
-
-                        case 0x09: // horizontal tab
+                        if (codepoint <= 0xFFFF)
                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 't';
-                            break;
+                            write_u_escape(bytes, static_cast<std::uint16_t>(codepoint));
                        }
-
-                        case 0x0A: // newline
+                        else
                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 'n';
-                            break;
-                        }
-
-                        case 0x0C: // formfeed
-                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 'f';
-                            break;
-                        }
-
-                        case 0x0D: // carriage return
-                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 'r';
-                            break;
-                        }
-
-                        case 0x22: // quotation mark
-                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = '"';
-                            break;
-                        }
-
-                        case 0x5C: // reverse solidus
-                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = '\\';
-                            break;
-                        }
-
-                        default:
-                        {
-                            // escape control characters (0x00..0x1F) or, if
-                            // EnsureAscii parameter is used, non-ASCII characters
-                            if ((codepoint <= 0x1F) || (EnsureAscii && (codepoint >= 0x7F)))
-                            {
-                                if (EnsureAscii && error_handler == error_handler_t::keep)
-                                {
-                                    // this character was buffered as raw bytes
-                                    // below in case it turned out to be part of
-                                    // an ill-formed sequence (which is kept as
-                                    // is); now that it decoded to a well-formed
-                                    // code point, undo that and \u-escape it
-                                    // like any other character instead
-                                    bytes = bytes_after_last_accept;
-                                }
-                                if (codepoint <= 0xFFFF)
-                                {
-                                    write_u_escape(bytes, static_cast<std::uint16_t>(codepoint));
-                                }
-                                else
-                                {
-                                    write_u_escape(bytes, static_cast<std::uint16_t>(0xD7C0u + (codepoint >> 10u)));
-                                    write_u_escape(bytes, static_cast<std::uint16_t>(0xDC00u + (codepoint & 0x3FFu)));
-                                }
-                            }
-                            else
-                            {
-                                // copy byte to buffer (all previous bytes
-                                // been copied have in default case above)
-                                string_buffer[bytes++] = s[i];
-                            }
-                            break;
+                            write_u_escape(bytes, static_cast<std::uint16_t>(0xD7C0u + (codepoint >> 10u)));
+                            write_u_escape(bytes, static_cast<std::uint16_t>(0xDC00u + (codepoint & 0x3FFu)));
                        }
                    }
+                    else
+                    {
+                        // copy byte to buffer (all previous bytes of the
+                        // sequence have been copied in the default case below)
+                        string_buffer[bytes++] = s[i];
+                    }

                    // write buffer and reset index; there must be 13 bytes
                    // left, as this is the maximal number of bytes to be
@@ -1253,6 +1227,121 @@ class serializer
        }
    }

+    /*!
+    @brief the JSON form of each character below 0x60
+
+    Entry c holds the escape sequence of character c - the short form for
+    \\b, \\t, \\n, \\f, \\r, \\" and \\\\, \\u00xx for the other control characters -
+    or c itself if it needs no escaping, padded with zeros to 7 bytes. The last
+    byte is the length of the sequence. The 8 bytes of an entry are copied at
+    once, so writing an escape needs neither a branch nor a byte-wise loop.
+    */
+    static const std::array<std::array<char, 8>, 0x60>& ascii_escapes() noexcept
+    {
+        static const std::array<std::array<char, 8>, 0x60> escapes =
+        {
+            {
+                {{'\\', 'u', '0', '0', '0', '0', 0, 6}}, // 0x00
+                {{'\\', 'u', '0', '0', '0', '1', 0, 6}}, // 0x01
+                {{'\\', 'u', '0', '0', '0', '2', 0, 6}}, // 0x02
+                {{'\\', 'u', '0', '0', '0', '3', 0, 6}}, // 0x03
+                {{'\\', 'u', '0', '0', '0', '4', 0, 6}}, // 0x04
+                {{'\\', 'u', '0', '0', '0', '5', 0, 6}}, // 0x05
+                {{'\\', 'u', '0', '0', '0', '6', 0, 6}}, // 0x06
+                {{'\\', 'u', '0', '0', '0', '7', 0, 6}}, // 0x07
+                {{'\\', 'b', 0, 0, 0, 0, 0, 2}}, // 0x08
+                {{'\\', 't', 0, 0, 0, 0, 0, 2}}, // 0x09
+                {{'\\', 'n', 0, 0, 0, 0, 0, 2}}, // 0x0A
+                {{'\\', 'u', '0', '0', '0', 'b', 0, 6}}, // 0x0B
+                {{'\\', 'f', 0, 0, 0, 0, 0, 2}}, // 0x0C
+                {{'\\', 'r', 0, 0, 0, 0, 0, 2}}, // 0x0D
+                {{'\\', 'u', '0', '0', '0', 'e', 0, 6}}, // 0x0E
+                {{'\\', 'u', '0', '0', '0', 'f', 0, 6}}, // 0x0F
+                {{'\\', 'u', '0', '0', '1', '0', 0, 6}}, // 0x10
+                {{'\\', 'u', '0', '0', '1', '1', 0, 6}}, // 0x11
+                {{'\\', 'u', '0', '0', '1', '2', 0, 6}}, // 0x12
+                {{'\\', 'u', '0', '0', '1', '3', 0, 6}}, // 0x13
+                {{'\\', 'u', '0', '0', '1', '4', 0, 6}}, // 0x14
+                {{'\\', 'u', '0', '0', '1', '5', 0, 6}}, // 0x15
+                {{'\\', 'u', '0', '0', '1', '6', 0, 6}}, // 0x16
+                {{'\\', 'u', '0', '0', '1', '7', 0, 6}}, // 0x17
+                {{'\\', 'u', '0', '0', '1', '8', 0, 6}}, // 0x18
+                {{'\\', 'u', '0', '0', '1', '9', 0, 6}}, // 0x19
+                {{'\\', 'u', '0', '0', '1', 'a', 0, 6}}, // 0x1A
+                {{'\\', 'u', '0', '0', '1', 'b', 0, 6}}, // 0x1B
+                {{'\\', 'u', '0', '0', '1', 'c', 0, 6}}, // 0x1C
+                {{'\\', 'u', '0', '0', '1', 'd', 0, 6}}, // 0x1D
+                {{'\\', 'u', '0', '0', '1', 'e', 0, 6}}, // 0x1E
+                {{'\\', 'u', '0', '0', '1', 'f', 0, 6}}, // 0x1F
+                {{' ', 0, 0, 0, 0, 0, 0, 1}}, // 0x20
+                {{'!', 0, 0, 0, 0, 0, 0, 1}}, // 0x21
+                {{'\\', '"', 0, 0, 0, 0, 0, 2}}, // 0x22
+                {{'#', 0, 0, 0, 0, 0, 0, 1}}, // 0x23
+                {{'$', 0, 0, 0, 0, 0, 0, 1}}, // 0x24
+                {{'%', 0, 0, 0, 0, 0, 0, 1}}, // 0x25
+                {{'&', 0, 0, 0, 0, 0, 0, 1}}, // 0x26
+                {{'\'', 0, 0, 0, 0, 0, 0, 1}}, // 0x27
+                {{'(', 0, 0, 0, 0, 0, 0, 1}}, // 0x28
+                {{')', 0, 0, 0, 0, 0, 0, 1}}, // 0x29
+                {{'*', 0, 0, 0, 0, 0, 0, 1}}, // 0x2A
+                {{'+', 0, 0, 0, 0, 0, 0, 1}}, // 0x2B
+                {{',', 0, 0, 0, 0, 0, 0, 1}}, // 0x2C
+                {{'-', 0, 0, 0, 0, 0, 0, 1}}, // 0x2D
+                {{'.', 0, 0, 0, 0, 0, 0, 1}}, // 0x2E
+                {{'/', 0, 0, 0, 0, 0, 0, 1}}, // 0x2F
+                {{'0', 0, 0, 0, 0, 0, 0, 1}}, // 0x30
+                {{'1', 0, 0, 0, 0, 0, 0, 1}}, // 0x31
+                {{'2', 0, 0, 0, 0, 0, 0, 1}}, // 0x32
+                {{'3', 0, 0, 0, 0, 0, 0, 1}}, // 0x33
+                {{'4', 0, 0, 0, 0, 0, 0, 1}}, // 0x34
+                {{'5', 0, 0, 0, 0, 0, 0, 1}}, // 0x35
+                {{'6', 0, 0, 0, 0, 0, 0, 1}}, // 0x36
+                {{'7', 0, 0, 0, 0, 0, 0, 1}}, // 0x37
+                {{'8', 0, 0, 0, 0, 0, 0, 1}}, // 0x38
+                {{'9', 0, 0, 0, 0, 0, 0, 1}}, // 0x39
+                {{':', 0, 0, 0, 0, 0, 0, 1}}, // 0x3A
+                {{';', 0, 0, 0, 0, 0, 0, 1}}, // 0x3B
+                {{'<', 0, 0, 0, 0, 0, 0, 1}}, // 0x3C
+                {{'=', 0, 0, 0, 0, 0, 0, 1}}, // 0x3D
+                {{'>', 0, 0, 0, 0, 0, 0, 1}}, // 0x3E
+                {{'?', 0, 0, 0, 0, 0, 0, 1}}, // 0x3F
+                {{'@', 0, 0, 0, 0, 0, 0, 1}}, // 0x40
+                {{'A', 0, 0, 0, 0, 0, 0, 1}}, // 0x41
+                {{'B', 0, 0, 0, 0, 0, 0, 1}}, // 0x42
+                {{'C', 0, 0, 0, 0, 0, 0, 1}}, // 0x43
+                {{'D', 0, 0, 0, 0, 0, 0, 1}}, // 0x44
+                {{'E', 0, 0, 0, 0, 0, 0, 1}}, // 0x45
+                {{'F', 0, 0, 0, 0, 0, 0, 1}}, // 0x46
+                {{'G', 0, 0, 0, 0, 0, 0, 1}}, // 0x47
+                {{'H', 0, 0, 0, 0, 0, 0, 1}}, // 0x48
+                {{'I', 0, 0, 0, 0, 0, 0, 1}}, // 0x49
+                {{'J', 0, 0, 0, 0, 0, 0, 1}}, // 0x4A
+                {{'K', 0, 0, 0, 0, 0, 0, 1}}, // 0x4B
+                {{'L', 0, 0, 0, 0, 0, 0, 1}}, // 0x4C
+                {{'M', 0, 0, 0, 0, 0, 0, 1}}, // 0x4D
+                {{'N', 0, 0, 0, 0, 0, 0, 1}}, // 0x4E
+                {{'O', 0, 0, 0, 0, 0, 0, 1}}, // 0x4F
+                {{'P', 0, 0, 0, 0, 0, 0, 1}}, // 0x50
+                {{'Q', 0, 0, 0, 0, 0, 0, 1}}, // 0x51
+                {{'R', 0, 0, 0, 0, 0, 0, 1}}, // 0x52
+                {{'S', 0, 0, 0, 0, 0, 0, 1}}, // 0x53
+                {{'T', 0, 0, 0, 0, 0, 0, 1}}, // 0x54
+                {{'U', 0, 0, 0, 0, 0, 0, 1}}, // 0x55
+                {{'V', 0, 0, 0, 0, 0, 0, 1}}, // 0x56
+                {{'W', 0, 0, 0, 0, 0, 0, 1}}, // 0x57
+                {{'X', 0, 0, 0, 0, 0, 0, 1}}, // 0x58
+                {{'Y', 0, 0, 0, 0, 0, 0, 1}}, // 0x59
+                {{'Z', 0, 0, 0, 0, 0, 0, 1}}, // 0x5A
+                {{'[', 0, 0, 0, 0, 0, 0, 1}}, // 0x5B
+                {{'\\', '\\', 0, 0, 0, 0, 0, 2}}, // 0x5C
+                {{']', 0, 0, 0, 0, 0, 0, 1}}, // 0x5D
+                {{'^', 0, 0, 0, 0, 0, 0, 1}}, // 0x5E
+                {{'_', 0, 0, 0, 0, 0, 0, 1}}, // 0x5F
+            }
+        };
+        return escapes;
+    }
+
    /*!
     * @brief write a lowercase "\\uXXXX" escape sequence into @a string_buffer
     *
@@ -21619,8 +21619,6 @@ NLOHMANN_JSON_NAMESPACE_END
    #include <cstdlib> // _byteswap_ushort, _byteswap_ulong, _byteswap_uint64
 #endif

-// #include <nlohmann/detail/bit_ops.hpp>
-
 // #include <nlohmann/detail/input/binary_reader.hpp>

 // #include <nlohmann/detail/input/string_scan.hpp>
@@ -21640,10 +21638,7 @@ NLOHMANN_JSON_NAMESPACE_END



-#include <algorithm> // max
-#include <array> // array
 #include <cstddef> // size_t
-#include <cstring> // memcpy
 #include <memory> // shared_ptr, make_shared
 #include <string> // basic_string
 #include <type_traits> // conditional, integral_constant, is_same
@@ -21684,170 +21679,32 @@ template<typename CharType> struct output_adapter_protocol
 template<typename CharType>
 using output_adapter_t = std::shared_ptr<output_adapter_protocol<CharType>>;

-/// the largest number of characters a writer may reserve() from a sink at once;
-/// output_vector_sink also appends writes of at least this size with insert()
-constexpr std::size_t max_reserve_size = 256;
-
 /// @brief non-virtual output sink writing into a std::vector
 ///
 /// This sink is not part of the virtual output_adapter_protocol hierarchy: it is
 /// passed to binary_writer by value as a template parameter, so
 /// write_character()/write_characters() are ordinary (inlinable) calls with no
 /// vtable lookup and no shared_ptr. It is used for the common
-/// `to_cbor`/`to_msgpack`/... into a std::vector.
-///
-/// Most writes are a few bytes - a type marker, or a number of 1, 2, 4, or 8
-/// bytes - and appending those with push_back() or insert() cost more than
-/// encoding them: insert() is an out-of-line call into a routine that can insert
-/// anywhere, and resize() is one as well with libstdc++. The sink therefore keeps
-/// its own write position: it grows the vector geometrically ahead of the
-/// position and copies each write to it, so a write is a capacity check and a
-/// short copy. The destructor shrinks the vector to the bytes actually written,
-/// also when a write throws; shrinking a vector never allocates. The sink owns
-/// that trim, so it can be moved but not copied, and the vector must not be used
-/// while the sink is alive.
+/// `to_cbor`/`to_msgpack`/... into a std::vector. output_vector_adapter below
+/// wraps this same sink to provide the virtual interface.
 template<typename CharType, typename AllocatorType = std::allocator<CharType>>
 class output_vector_sink
 {
  public:
    explicit output_vector_sink(std::vector<CharType, AllocatorType>& vec) noexcept
-        : v(&vec), position(vec.size())
-    {}
-
-    output_vector_sink(const output_vector_sink&) = delete;
-    output_vector_sink& operator=(const output_vector_sink&) = delete;
-    output_vector_sink& operator=(output_vector_sink&&) = delete;
-
-    output_vector_sink(output_vector_sink&& other) noexcept
-        : v(other.v), position(other.position)
-    {
-        other.v = nullptr;
-    }
-
-    ~output_vector_sink()
-    {
-        if (v != nullptr)
-        {
-            v->resize(position);
-        }
-    }
-
-    // always inlined: GCC otherwise keeps these out of line in a large
-    // translation unit, and a call per byte or number costs more than the write
-    JSON_HEDLEY_ALWAYS_INLINE
-    void write_character(CharType c)
-    {
-        if (JSON_HEDLEY_UNLIKELY(position == v->size()))
-        {
-            grow(1);
-        }
-        (*v)[position++] = c;
-    }
-
-    // no JSON_HEDLEY_NON_NULL here: binary_writer legitimately passes a null
-    // pointer with length 0 for empty strings/binary values; memcpy must not
-    // see it.
-    JSON_HEDLEY_ALWAYS_INLINE
-    void write_characters(const CharType* s, std::size_t length)
-    {
-        if (JSON_HEDLEY_UNLIKELY(v->size() - position < length))
-        {
-            if (length >= max_reserve_size)
-            {
-                append(s, length);
-                return;
-            }
-            grow(length);
-        }
-        if (length != 0)
-        {
-            std::memcpy(v->data() + position, s, length * sizeof(CharType));
-            position += length;
-        }
-    }
-
-    /// @brief space for writing up to @a length characters directly
-    ///
-    /// Returns a pointer to at least @a length (at most @ref max_reserve_size)
-    /// writable characters at the write position; @ref commit then keeps the
-    /// first ones of them. A writer can store whole words there and keep only
-    /// the bytes it needs, and keep its write pointer in a register across many
-    /// values instead of updating the sink after each.
-    JSON_HEDLEY_ALWAYS_INLINE
-    CharType* reserve(const std::size_t length)
-    {
-        JSON_ASSERT(length <= max_reserve_size);
-        if (JSON_HEDLEY_UNLIKELY(v->size() - position < length))
-        {
-            grow(length);
-        }
-        return v->data() + position;
-    }
-
-    /// keep the first @a length characters written to the space from reserve()
-    JSON_HEDLEY_ALWAYS_INLINE
-    void commit(const std::size_t length) noexcept
-    {
-        position += length;
-    }
-
-  private:
-    /// make room for at least @a length more characters after the position;
-    /// kept out of line so that the write functions stay small enough for
-    /// GCC to inline them into the writer
-    JSON_HEDLEY_NEVER_INLINE
-    void grow(const std::size_t length)
-    {
-        // use the capacity the vector already has, else at least double it;
-        // never less than 64 characters, so that a small value does not
-        // reallocate for every few bytes
-        const std::size_t needed = position + length;
-        v->resize((std::max)(std::size_t{64}, needed <= v->capacity()
-                             ? v->capacity()
-                             : (std::max)(needed, v->capacity() * 2)));
-    }
-
-    /// append @a length (at least max_reserve_size) characters that do not fit
-    /// the space ahead of the position: insert() copies them once into the
-    /// grown vector, where grow() would first zero the new space and then copy
-    /// over it - noticeable for a large string or binary value
-    JSON_HEDLEY_NEVER_INLINE
-    void append(const CharType* s, const std::size_t length)
-    {
-        v->resize(position);
-        if (v->capacity() - position < length)
-        {
-            // grow geometrically, with room for the writes that follow, so
-            // that the next grow() need not reallocate right away
-            v->reserve((std::max)(v->capacity() * 2, position + length + max_reserve_size));
-        }
-        v->insert(v->end(), s, s + length);
-        position = v->size();
-    }
-
-    std::vector<CharType, AllocatorType>* v;
-    /// number of characters of *v written so far
-    std::size_t position;
-};
-
-/// output adapter for byte vectors
-template<typename CharType, typename AllocatorType = std::allocator<CharType>>
-class output_vector_adapter : public output_adapter_protocol<CharType>
-{
-  public:
-    explicit output_vector_adapter(std::vector<CharType, AllocatorType>& vec) noexcept
        : v(vec)
    {}

-    void write_character(CharType c) override
+    void write_character(CharType c)
    {
        v.push_back(c);
    }

    // no JSON_HEDLEY_NON_NULL here: binary_writer legitimately passes a null
-    // pointer with length 0 for empty strings/binary values; appending an empty
-    // range is a no-op
-    void write_characters(const CharType* s, std::size_t length) override
+    // pointer with length 0 for empty strings/binary values. Appending an empty
+    // range is a no-op; the type-erased path tolerates this via the (unattributed)
+    // virtual base, and the concrete sink must do the same.
+    void write_characters(const CharType* s, std::size_t length)
    {
        v.insert(v.end(), s, s + length);
    }
@@ -21856,6 +21713,33 @@ class output_vector_adapter : public output_adapter_protocol<CharType>
    std::vector<CharType, AllocatorType>& v;
 };

+/// output adapter for byte vectors
+///
+/// The appending itself lives in output_vector_sink; this class only adds the
+/// virtual output_adapter_protocol interface on top of it, so both the
+/// type-erased and the templated path share one implementation.
+template<typename CharType, typename AllocatorType = std::allocator<CharType>>
+class output_vector_adapter : public output_adapter_protocol<CharType>
+{
+  public:
+    explicit output_vector_adapter(std::vector<CharType, AllocatorType>& vec) noexcept
+        : sink(vec)
+    {}
+
+    void write_character(CharType c) override
+    {
+        sink.write_character(c);
+    }
+
+    void write_characters(const CharType* s, std::size_t length) override
+    {
+        sink.write_characters(s, length);
+    }
+
+  private:
+    output_vector_sink<CharType, AllocatorType> sink;
+};
+
 #ifndef JSON_NO_IO
 /// output adapter for output streams
 template<typename CharType>
@@ -21935,24 +21819,8 @@ class output_adapter_sink
        oa->write_characters(s, length);
    }

-    /// space for writing up to @a length characters (see
-    /// output_vector_sink::reserve)
-    CharType* reserve(const std::size_t length) noexcept
-    {
-        JSON_ASSERT(length <= max_reserve_size);
-        static_cast<void>(length);
-        return reserved.data();
-    }
-
-    /// write the first @a length characters written to the space from reserve()
-    void commit(const std::size_t length)
-    {
-        oa->write_characters(reserved.data(), length);
-    }
-
  private:
    output_adapter_t<CharType> oa;
-    std::array<CharType, max_reserve_size> reserved{};
 };

 /// @brief whether std::basic_string<CharType> has a non-deprecated std::char_traits
@@ -22237,12 +22105,24 @@ class binary_writer
            }

            case value_t::number_integer:
+            {
+                if (j.m_data.m_value.number_integer >= 0)
+                {
+                    // CBOR does not differentiate between positive signed
+                    // integers and unsigned integers
+                    write_cbor_head(0x00, static_cast<std::uint64_t>(j.m_data.m_value.number_integer));
+                }
+                else
+                {
+                    // a negative integer n is encoded as -1 - n
+                    write_cbor_head(0x20, static_cast<std::uint64_t>(-1 - j.m_data.m_value.number_integer));
+                }
+                break;
+            }
+
            case value_t::number_unsigned:
            {
-                // one case for both, so that an array mixing negative
-                // (number_integer) and non-negative (number_unsigned) values
-                // does not mispredict the switch
-                write_cbor_integer(j);
+                write_cbor_head(0x00, j.m_data.m_value.number_unsigned);
                break;
            }

@@ -22277,7 +22157,13 @@ class binary_writer

            case value_t::array:
            {
-                write_cbor_array(j, depth);
+                // step 1: write control byte and the array size
+                write_cbor_head(0x80, j.m_data.m_value.array->size());
+
+                for (const auto& el : *j.m_data.m_value.array)
+                {
+                    write_cbor(el, depth + 1);
+                }
                break;
            }

@@ -22435,12 +22321,54 @@ class binary_writer
            }

            case value_t::number_integer:
+            {
+                if (j.m_data.m_value.number_integer >= 0)
+                {
+                    // MessagePack does not differentiate between positive
+                    // signed integers and unsigned integers.
+                    write_msgpack_unsigned(static_cast<std::uint64_t>(j.m_data.m_value.number_integer));
+                }
+                else
+                {
+                    if (j.m_data.m_value.number_integer >= -32)
+                    {
+                        // negative fixnum
+                        write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
+                    }
+                    else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int8_t>::min)() &&
+                             j.m_data.m_value.number_integer <= (std::numeric_limits<std::int8_t>::max)())
+                    {
+                        // int 8
+                        oa.write_character(to_char_type(0xD0));
+                        write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
+                    }
+                    else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int16_t>::min)() &&
+                             j.m_data.m_value.number_integer <= (std::numeric_limits<std::int16_t>::max)())
+                    {
+                        // int 16
+                        oa.write_character(to_char_type(0xD1));
+                        write_number(static_cast<std::int16_t>(j.m_data.m_value.number_integer));
+                    }
+                    else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int32_t>::min)() &&
+                             j.m_data.m_value.number_integer <= (std::numeric_limits<std::int32_t>::max)())
+                    {
+                        // int 32
+                        oa.write_character(to_char_type(0xD2));
+                        write_number(static_cast<std::int32_t>(j.m_data.m_value.number_integer));
+                    }
+                    else
+                    {
+                        // int 64
+                        oa.write_character(to_char_type(0xD3));
+                        write_number(static_cast<std::int64_t>(j.m_data.m_value.number_integer));
+                    }
+                }
+                break;
+            }
+
            case value_t::number_unsigned:
            {
-                // one case for both, so that an array mixing negative
-                // (number_integer) and non-negative (number_unsigned) values
-                // does not mispredict the switch
-                write_msgpack_integer(j, std::integral_constant<bool, msgpack_integers_fit_64_bits()>());
+                write_msgpack_unsigned(static_cast<std::uint64_t>(j.m_data.m_value.number_unsigned));
                break;
            }

@@ -22458,7 +22386,13 @@ class binary_writer

            case value_t::array:
            {
-                write_msgpack_array(j, depth);
+                // step 1: write control byte and the array size
+                write_msgpack_array_prefix(j.m_data.m_value.array->size(), j);
+
+                for (const auto& el : *j.m_data.m_value.array)
+                {
+                    write_msgpack(el, depth + 1);
+                }
                break;
            }

@@ -23918,316 +23852,6 @@ class binary_writer
        }
    }

-    /*!
-    @brief size class of an unsigned integer from its bit length
-
-    1, 2, 3, or 4 if @a x fits 1, 2, 4, or 8 bytes. Looked up from the number
-    of leading zero bits instead of found by branches: the sizes of a stream
-    of numbers are hard to predict, and a mispredicted branch costs more than
-    writing the number. (A table, as comparisons are vectorized by clang into
-    slower code.)
-    */
-    static unsigned integer_size_class(const std::uint64_t x) noexcept
-    {
-        static constexpr std::array<std::uint8_t, 64> size_class_by_leading_zeros =
-        {
-            {
-                4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4,
-                3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
-                2, 2, 2, 2, 2, 2, 2, 2,
-                1, 1, 1, 1, 1, 1, 1, 1
-            }
-        };
-        // x | 1 keeps count_leading_zeros() away from 0
-        return size_class_by_leading_zeros[static_cast<std::size_t>(count_leading_zeros(x | 1u))];
-    }
-
-    /*!
-    @brief encode @a first_byte and the low-order bytes of @a value that
-           @a size_class calls for (none, or 1, 2, 4, or 8) in network order
-           to @a out
-    @return the number of characters of the encoding; up to
-            @ref integer_encoding_space characters at @a out are overwritten
-
-    The bytes are written as one byte and one 8-byte word whose bytes after
-    the value are scratch that the caller drops, so that writing them does not
-    depend on the size class. For class 0 the word is all scratch; it is
-    shifted by 60 bits rather than 64, which would be undefined.
-    */
-    std::size_t encode_first_byte_and_tail(CharType* out, const std::uint8_t first_byte, const unsigned size_class, const std::uint64_t value) const noexcept
-    {
-        out[0] = to_char_type(first_byte);
-        const unsigned unused_bits = 64u - ((8u << size_class) >> 1u);
-        const std::uint64_t tail = is_little_endian ? byte_swap(value) >> unused_bits : value << unused_bits;
-        std::memcpy(out + 1, &tail, sizeof(tail));
-        return ((std::size_t{1} << size_class) >> 1u) + 1;
-    }
-
-    /// characters encode_first_byte_and_tail() may overwrite: the first byte
-    /// and one 8-byte word
-    static constexpr std::size_t integer_encoding_space = 9;
-
-    /*!
-    @brief the 64 bits of a number_integer or number_unsigned value, and a mask
-           that is all ones if it is negative, else zero
-
-    Selected through masks rather than branches, as the type and the sign of
-    the values in an array of mixed signs alternate unpredictably (non-negative
-    integers are number_unsigned after parsing). Up to 64 bits, the sign is bit
-    63 of the result (a narrower integer is sign-extended); computing it with
-    masks keeps GCC from branching on the type. A wider integer has to be
-    compared.
-    */
-    static std::uint64_t integer_bits(const BasicJsonType& j, std::uint64_t& sign_mask) noexcept
-    {
-        const bool is_signed = j.m_data.m_type == value_t::number_integer;
-        const std::uint64_t raw = is_signed
-                                  ? static_cast<std::uint64_t>(j.m_data.m_value.number_integer)
-                                  : static_cast<std::uint64_t>(j.m_data.m_value.number_unsigned);
-        sign_mask = sizeof(typename BasicJsonType::number_integer_t) <= sizeof(std::uint64_t)
-                    ? (std::uint64_t{0} - static_cast<std::uint64_t>(is_signed)) & (std::uint64_t{0} - (raw >> 63u))
-                    : std::uint64_t{0} - static_cast<std::uint64_t>(is_signed && j.m_data.m_value.number_integer < 0);
-        return raw;
-    }
-
-    /*!
-    @brief encode the head of a CBOR integer to @a out without branching on its
-           size
-    @return the number of characters of the head
-
-    Same output as @ref write_cbor_head. The lengths of strings and containers
-    are mostly predictable, so their heads keep the branches; the sizes of a
-    run of integers are not, so an integer's head is assembled without them.
-    */
-    std::size_t encode_cbor_integer_head(CharType* out, const std::uint8_t major_type, const std::uint64_t argument) const noexcept
-    {
-        // an argument of at most 23 is in size class 1 (one byte) and is moved
-        // to class 0, the first byte, by subtracting 1
-        const auto is_immediate = static_cast<unsigned>(argument <= 0x17u);
-        const unsigned size_class = integer_size_class(argument) - is_immediate;
-
-        // the first byte: the argument itself if it is immediate, else
-        // 0x17 + size_class, selected through a mask
-        const std::uint64_t immediate_mask = std::uint64_t{0} - is_immediate;
-        const auto first_byte = static_cast<std::uint8_t>(major_type + ((argument & immediate_mask) | ((0x17u + size_class) & ~immediate_mask)));
-        return encode_first_byte_and_tail(out, first_byte, size_class, argument);
-    }
-
-    /*!
-    @brief write an array value (head and elements) as CBOR
-
-    Integer elements, the most common scalar, are written without a call to
-    @ref write_cbor. The loop is kept out of line: inlined into write_cbor, its
-    registers would be saved and restored on every call of write_cbor, which
-    is one call per value nested in an object.
-    */
-    JSON_HEDLEY_NEVER_INLINE
-    void write_cbor_array(const BasicJsonType& j, const std::size_t depth)
-    {
-        write_cbor_head(0x80, j.m_data.m_value.array->size());
-        write_array_elements(j, [this](CharType * out, const BasicJsonType & el)
-        {
-            return encode_cbor_integer(out, el);
-        }, [this, depth](const BasicJsonType & el)
-        {
-            write_cbor(el, depth + 1);
-        });
-    }
-
-    /*!
-    @brief write the elements of the array @a j, runs of integers with
-           @a encode_integer and all other values with @a write_value
-
-    Runs of integers are encoded straight into space reserved from the sink
-    for a whole run: the write pointer stays a local, where it would otherwise
-    be reloaded from the sink for every value, as a store of a character may
-    alias it.
-    */
-    template<typename EncodeInteger, typename WriteValue>
-    void write_array_elements(const BasicJsonType& j, EncodeInteger encode_integer, WriteValue write_value)
-    {
-        constexpr std::size_t max_run = max_reserve_size / integer_encoding_space;
-        auto it = j.m_data.m_value.array->begin();
-        const auto end = j.m_data.m_value.array->end();
-        while (it != end)
-        {
-            if (it->is_number_integer())
-            {
-                CharType* const start = oa.reserve(max_run * integer_encoding_space);
-                CharType* out = start;
-                for (std::size_t n = 0; n < max_run && it != end && it->is_number_integer(); ++n, ++it)
-                {
-                    out += encode_integer(out, *it);
-                }
-                oa.commit(static_cast<std::size_t>(out - start));
-            }
-            else
-            {
-                write_value(*it);
-                ++it;
-            }
-        }
-    }
-
-    /*!
-    @brief write a number_integer or number_unsigned value as a CBOR integer
-
-    A negative integer n has major type 1 and the argument -1 - n, which is ~n.
-    Kept out of line, like the other per-value paths, so that write_cbor stays
-    small (runs of integers in an array are encoded inline instead).
-    */
-    JSON_HEDLEY_NEVER_INLINE
-    void write_cbor_integer(const BasicJsonType& j)
-    {
-        oa.commit(encode_cbor_integer(oa.reserve(integer_encoding_space), j));
-    }
-
-    /// encode a number_integer or number_unsigned value to @a out (see
-    /// @ref write_cbor_integer) and return the number of characters
-    std::size_t encode_cbor_integer(CharType* out, const BasicJsonType& j) const noexcept
-    {
-        std::uint64_t sign_mask = 0;
-        const std::uint64_t raw = integer_bits(j, sign_mask);
-        // ~raw is -1 - n in the 64 bits that are written
-        return encode_cbor_integer_head(out, static_cast<std::uint8_t>(sign_mask & 0x20u), raw ^ sign_mask);
-    }
-
-    /*!
-    @brief whether the MessagePack integers of BasicJsonType are written by
-           @ref encode_msgpack_integer
-
-    It picks the format from the low 64 bits; a wider number type keeps the
-    range checks of @ref write_msgpack on the whole value.
-    */
-    static constexpr bool msgpack_integers_fit_64_bits() noexcept
-    {
-        return sizeof(typename BasicJsonType::number_integer_t) <= sizeof(std::uint64_t)
-               && sizeof(typename BasicJsonType::number_unsigned_t) <= sizeof(std::uint64_t);
-    }
-
-    /*!
-    @brief write a number_integer or number_unsigned value as a MessagePack
-           integer without branching on its sign or size
-
-    Same output as @ref write_msgpack: a non-negative integer as positive fixint
-    (< 128) or uint 8/16/32/64, a negative one as negative fixint (>= -32) or
-    int 8/16/32/64. Kept out of line (see @ref write_cbor_integer).
-    */
-    JSON_HEDLEY_NEVER_INLINE
-    void write_msgpack_integer(const BasicJsonType& j, std::true_type /*fits_64_bits*/)
-    {
-        oa.commit(encode_msgpack_integer(oa.reserve(integer_encoding_space), j));
-    }
-
-    /// encode a number_integer or number_unsigned value to @a out (see
-    /// @ref write_msgpack_integer) and return the number of characters
-    std::size_t encode_msgpack_integer(CharType* out, const BasicJsonType& j) const noexcept
-    {
-        std::uint64_t sign_mask = 0;
-        const std::uint64_t raw = integer_bits(j, sign_mask);
-
-        // A negative n fits int 8/16/32 exactly if 2 * (-1 - n) + 1 fits
-        // uint 8/16/32, so x gives the size class of either sign.
-        const std::uint64_t is_negative = sign_mask & 1u;
-        const std::uint64_t x = ((raw ^ sign_mask) << is_negative) | is_negative;
-
-        // A fixint is at most 127, or at least -32 (x at most 63). It is in
-        // size class 1 and is moved to class 0, the first byte, by subtracting 1.
-        const auto is_fixint = static_cast<unsigned>(x <= (127u ^ (sign_mask & 64u)));
-        const unsigned size_class = integer_size_class(x) - is_fixint;
-
-        // the first byte: the low byte of the integer for a fixint, else the
-        // marker 0xCC..0xCF (uint) or 0xD0..0xD3 (int), selected through a mask
-        const std::uint64_t fixint_mask = std::uint64_t{0} - is_fixint;
-        const std::uint64_t marker = 0xCBu + size_class + (sign_mask & 4u);
-        const auto first_byte = static_cast<std::uint8_t>((raw & fixint_mask) | (marker & ~fixint_mask));
-        return encode_first_byte_and_tail(out, first_byte, size_class, raw);
-    }
-
-    /// write a number_integer or number_unsigned value of a number type wider
-    /// than 64 bits as a MessagePack integer, with range checks on the whole value
-    void write_msgpack_integer(const BasicJsonType& j, std::false_type /*fits_64_bits*/)
-    {
-        if (j.m_data.m_type == value_t::number_unsigned)
-        {
-            write_msgpack_unsigned(static_cast<std::uint64_t>(j.m_data.m_value.number_unsigned));
-            return;
-        }
-
-        if (j.m_data.m_value.number_integer >= 0)
-        {
-            // MessagePack does not differentiate between positive
-            // signed integers and unsigned integers.
-            write_msgpack_unsigned(static_cast<std::uint64_t>(j.m_data.m_value.number_integer));
-        }
-        else
-        {
-            if (j.m_data.m_value.number_integer >= -32)
-            {
-                // negative fixnum
-                write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
-            }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int8_t>::min)() &&
-                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int8_t>::max)())
-            {
-                // int 8
-                oa.write_character(to_char_type(0xD0));
-                write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
-            }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int16_t>::min)() &&
-                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int16_t>::max)())
-            {
-                // int 16
-                oa.write_character(to_char_type(0xD1));
-                write_number(static_cast<std::int16_t>(j.m_data.m_value.number_integer));
-            }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int32_t>::min)() &&
-                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int32_t>::max)())
-            {
-                // int 32
-                oa.write_character(to_char_type(0xD2));
-                write_number(static_cast<std::int32_t>(j.m_data.m_value.number_integer));
-            }
-            else
-            {
-                // int 64
-                oa.write_character(to_char_type(0xD3));
-                write_number(static_cast<std::int64_t>(j.m_data.m_value.number_integer));
-            }
-        }
-    }
-
-    /*!
-    @brief write an array value (head and elements) as MessagePack
-
-    See @ref write_cbor_array.
-    */
-    JSON_HEDLEY_NEVER_INLINE
-    void write_msgpack_array(const BasicJsonType& j, const std::size_t depth)
-    {
-        write_msgpack_array_prefix(j.m_data.m_value.array->size(), j);
-        write_msgpack_array_elements(j, depth, std::integral_constant<bool, msgpack_integers_fit_64_bits()>());
-    }
-
-    void write_msgpack_array_elements(const BasicJsonType& j, const std::size_t depth, std::true_type /*fits_64_bits*/)
-    {
-        write_array_elements(j, [this](CharType * out, const BasicJsonType & el)
-        {
-            return encode_msgpack_integer(out, el);
-        }, [this, depth](const BasicJsonType & el)
-        {
-            write_msgpack(el, depth + 1);
-        });
-    }
-
-    void write_msgpack_array_elements(const BasicJsonType& j, const std::size_t depth, std::false_type /*fits_64_bits*/)
-    {
-        for (const auto& el : *j.m_data.m_value.array)
-        {
-            write_msgpack(el, depth + 1);
-        }
-    }
-
    /*!
    @brief write an object key as a CBOR text string

@@ -27463,6 +27087,33 @@ class serializer
                        break;
                    }
                }
+
+                // A byte below 0x60 is a complete code point and needs no
+                // UTF-8 decoding. The scanner stops only at a control
+                // character, a quote, or a backslash in that range, so look up
+                // its escape sequence and write all 8 bytes of the table entry
+                // straight into the write buffer; only the length stored in the
+                // last byte of the entry is kept.
+                if (data[i] < 0x60)
+                {
+                    // emit any bytes still pending in string_buffer first to
+                    // preserve output order
+                    if (bytes != 0)
+                    {
+                        put_buffer(string_buffer, bytes);
+                        bytes = 0;
+                    }
+                    const auto& escape = ascii_escapes()[data[i]];
+                    if (JSON_HEDLEY_UNLIKELY(write_buffer.size() - write_buffer_pos < escape.size()))
+                    {
+                        flush();
+                    }
+                    std::memcpy(write_buffer.data() + write_buffer_pos, escape.data(), escape.size());
+                    write_buffer_pos += static_cast<std::size_t>(escape[7]);
+                    bytes_after_last_accept = 0;
+                    undumped_chars = 0;
+                    continue;
+                }
            }

            const auto byte = static_cast<std::uint8_t>(s[i]);
@@ -27471,92 +27122,39 @@ class serializer
            {
                case UTF8_ACCEPT:  // decode found a new code point
                {
-                    switch (codepoint)
+                    // the code point is at least 0x60 (smaller ones are handled
+                    // above) and is not printable ASCII (which the scanner
+                    // copies): it is DEL (0x7F) under EnsureAscii or a non-ASCII
+                    // character
+                    if (EnsureAscii)
                    {
-                        case 0x08: // backspace
+                        JSON_ASSERT(codepoint >= 0x7F);
+                        if (error_handler == error_handler_t::keep)
                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 'b';
-                            break;
+                            // this character was buffered as raw bytes below
+                            // in case it turned out to be part of an
+                            // ill-formed sequence (which is kept as is); now
+                            // that it decoded to a well-formed code point,
+                            // undo that and \u-escape it like any other
+                            // character instead
+                            bytes = bytes_after_last_accept;
                        }
-
-                        case 0x09: // horizontal tab
+                        if (codepoint <= 0xFFFF)
                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 't';
-                            break;
+                            write_u_escape(bytes, static_cast<std::uint16_t>(codepoint));
                        }
-
-                        case 0x0A: // newline
+                        else
                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 'n';
-                            break;
-                        }
-
-                        case 0x0C: // formfeed
-                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 'f';
-                            break;
-                        }
-
-                        case 0x0D: // carriage return
-                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = 'r';
-                            break;
-                        }
-
-                        case 0x22: // quotation mark
-                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = '"';
-                            break;
-                        }
-
-                        case 0x5C: // reverse solidus
-                        {
-                            string_buffer[bytes++] = '\\';
-                            string_buffer[bytes++] = '\\';
-                            break;
-                        }
-
-                        default:
-                        {
-                            // escape control characters (0x00..0x1F) or, if
-                            // EnsureAscii parameter is used, non-ASCII characters
-                            if ((codepoint <= 0x1F) || (EnsureAscii && (codepoint >= 0x7F)))
-                            {
-                                if (EnsureAscii && error_handler == error_handler_t::keep)
-                                {
-                                    // this character was buffered as raw bytes
-                                    // below in case it turned out to be part of
-                                    // an ill-formed sequence (which is kept as
-                                    // is); now that it decoded to a well-formed
-                                    // code point, undo that and \u-escape it
-                                    // like any other character instead
-                                    bytes = bytes_after_last_accept;
-                                }
-                                if (codepoint <= 0xFFFF)
-                                {
-                                    write_u_escape(bytes, static_cast<std::uint16_t>(codepoint));
-                                }
-                                else
-                                {
-                                    write_u_escape(bytes, static_cast<std::uint16_t>(0xD7C0u + (codepoint >> 10u)));
-                                    write_u_escape(bytes, static_cast<std::uint16_t>(0xDC00u + (codepoint & 0x3FFu)));
-                                }
-                            }
-                            else
-                            {
-                                // copy byte to buffer (all previous bytes
-                                // been copied have in default case above)
-                                string_buffer[bytes++] = s[i];
-                            }
-                            break;
+                            write_u_escape(bytes, static_cast<std::uint16_t>(0xD7C0u + (codepoint >> 10u)));
+                            write_u_escape(bytes, static_cast<std::uint16_t>(0xDC00u + (codepoint & 0x3FFu)));
                        }
                    }
+                    else
+                    {
+                        // copy byte to buffer (all previous bytes of the
+                        // sequence have been copied in the default case below)
+                        string_buffer[bytes++] = s[i];
+                    }

                    // write buffer and reset index; there must be 13 bytes
                    // left, as this is the maximal number of bytes to be
@@ -27944,6 +27542,121 @@ class serializer
        }
    }

+    /*!
+    @brief the JSON form of each character below 0x60
+
+    Entry c holds the escape sequence of character c - the short form for
+    \\b, \\t, \\n, \\f, \\r, \\" and \\\\, \\u00xx for the other control characters -
+    or c itself if it needs no escaping, padded with zeros to 7 bytes. The last
+    byte is the length of the sequence. The 8 bytes of an entry are copied at
+    once, so writing an escape needs neither a branch nor a byte-wise loop.
+    */
+    static const std::array<std::array<char, 8>, 0x60>& ascii_escapes() noexcept
+    {
+        static const std::array<std::array<char, 8>, 0x60> escapes =
+        {
+            {
+                {{'\\', 'u', '0', '0', '0', '0', 0, 6}}, // 0x00
+                {{'\\', 'u', '0', '0', '0', '1', 0, 6}}, // 0x01
+                {{'\\', 'u', '0', '0', '0', '2', 0, 6}}, // 0x02
+                {{'\\', 'u', '0', '0', '0', '3', 0, 6}}, // 0x03
+                {{'\\', 'u', '0', '0', '0', '4', 0, 6}}, // 0x04
+                {{'\\', 'u', '0', '0', '0', '5', 0, 6}}, // 0x05
+                {{'\\', 'u', '0', '0', '0', '6', 0, 6}}, // 0x06
+                {{'\\', 'u', '0', '0', '0', '7', 0, 6}}, // 0x07
+                {{'\\', 'b', 0, 0, 0, 0, 0, 2}}, // 0x08
+                {{'\\', 't', 0, 0, 0, 0, 0, 2}}, // 0x09
+                {{'\\', 'n', 0, 0, 0, 0, 0, 2}}, // 0x0A
+                {{'\\', 'u', '0', '0', '0', 'b', 0, 6}}, // 0x0B
+                {{'\\', 'f', 0, 0, 0, 0, 0, 2}}, // 0x0C
+                {{'\\', 'r', 0, 0, 0, 0, 0, 2}}, // 0x0D
+                {{'\\', 'u', '0', '0', '0', 'e', 0, 6}}, // 0x0E
+                {{'\\', 'u', '0', '0', '0', 'f', 0, 6}}, // 0x0F
+                {{'\\', 'u', '0', '0', '1', '0', 0, 6}}, // 0x10
+                {{'\\', 'u', '0', '0', '1', '1', 0, 6}}, // 0x11
+                {{'\\', 'u', '0', '0', '1', '2', 0, 6}}, // 0x12
+                {{'\\', 'u', '0', '0', '1', '3', 0, 6}}, // 0x13
+                {{'\\', 'u', '0', '0', '1', '4', 0, 6}}, // 0x14
+                {{'\\', 'u', '0', '0', '1', '5', 0, 6}}, // 0x15
+                {{'\\', 'u', '0', '0', '1', '6', 0, 6}}, // 0x16
+                {{'\\', 'u', '0', '0', '1', '7', 0, 6}}, // 0x17
+                {{'\\', 'u', '0', '0', '1', '8', 0, 6}}, // 0x18
+                {{'\\', 'u', '0', '0', '1', '9', 0, 6}}, // 0x19
+                {{'\\', 'u', '0', '0', '1', 'a', 0, 6}}, // 0x1A
+                {{'\\', 'u', '0', '0', '1', 'b', 0, 6}}, // 0x1B
+                {{'\\', 'u', '0', '0', '1', 'c', 0, 6}}, // 0x1C
+                {{'\\', 'u', '0', '0', '1', 'd', 0, 6}}, // 0x1D
+                {{'\\', 'u', '0', '0', '1', 'e', 0, 6}}, // 0x1E
+                {{'\\', 'u', '0', '0', '1', 'f', 0, 6}}, // 0x1F
+                {{' ', 0, 0, 0, 0, 0, 0, 1}}, // 0x20
+                {{'!', 0, 0, 0, 0, 0, 0, 1}}, // 0x21
+                {{'\\', '"', 0, 0, 0, 0, 0, 2}}, // 0x22
+                {{'#', 0, 0, 0, 0, 0, 0, 1}}, // 0x23
+                {{'$', 0, 0, 0, 0, 0, 0, 1}}, // 0x24
+                {{'%', 0, 0, 0, 0, 0, 0, 1}}, // 0x25
+                {{'&', 0, 0, 0, 0, 0, 0, 1}}, // 0x26
+                {{'\'', 0, 0, 0, 0, 0, 0, 1}}, // 0x27
+                {{'(', 0, 0, 0, 0, 0, 0, 1}}, // 0x28
+                {{')', 0, 0, 0, 0, 0, 0, 1}}, // 0x29
+                {{'*', 0, 0, 0, 0, 0, 0, 1}}, // 0x2A
+                {{'+', 0, 0, 0, 0, 0, 0, 1}}, // 0x2B
+                {{',', 0, 0, 0, 0, 0, 0, 1}}, // 0x2C
+                {{'-', 0, 0, 0, 0, 0, 0, 1}}, // 0x2D
+                {{'.', 0, 0, 0, 0, 0, 0, 1}}, // 0x2E
+                {{'/', 0, 0, 0, 0, 0, 0, 1}}, // 0x2F
+                {{'0', 0, 0, 0, 0, 0, 0, 1}}, // 0x30
+                {{'1', 0, 0, 0, 0, 0, 0, 1}}, // 0x31
+                {{'2', 0, 0, 0, 0, 0, 0, 1}}, // 0x32
+                {{'3', 0, 0, 0, 0, 0, 0, 1}}, // 0x33
+                {{'4', 0, 0, 0, 0, 0, 0, 1}}, // 0x34
+                {{'5', 0, 0, 0, 0, 0, 0, 1}}, // 0x35
+                {{'6', 0, 0, 0, 0, 0, 0, 1}}, // 0x36
+                {{'7', 0, 0, 0, 0, 0, 0, 1}}, // 0x37
+                {{'8', 0, 0, 0, 0, 0, 0, 1}}, // 0x38
+                {{'9', 0, 0, 0, 0, 0, 0, 1}}, // 0x39
+                {{':', 0, 0, 0, 0, 0, 0, 1}}, // 0x3A
+                {{';', 0, 0, 0, 0, 0, 0, 1}}, // 0x3B
+                {{'<', 0, 0, 0, 0, 0, 0, 1}}, // 0x3C
+                {{'=', 0, 0, 0, 0, 0, 0, 1}}, // 0x3D
+                {{'>', 0, 0, 0, 0, 0, 0, 1}}, // 0x3E
+                {{'?', 0, 0, 0, 0, 0, 0, 1}}, // 0x3F
+                {{'@', 0, 0, 0, 0, 0, 0, 1}}, // 0x40
+                {{'A', 0, 0, 0, 0, 0, 0, 1}}, // 0x41
+                {{'B', 0, 0, 0, 0, 0, 0, 1}}, // 0x42
+                {{'C', 0, 0, 0, 0, 0, 0, 1}}, // 0x43
+                {{'D', 0, 0, 0, 0, 0, 0, 1}}, // 0x44
+                {{'E', 0, 0, 0, 0, 0, 0, 1}}, // 0x45
+                {{'F', 0, 0, 0, 0, 0, 0, 1}}, // 0x46
+                {{'G', 0, 0, 0, 0, 0, 0, 1}}, // 0x47
+                {{'H', 0, 0, 0, 0, 0, 0, 1}}, // 0x48
+                {{'I', 0, 0, 0, 0, 0, 0, 1}}, // 0x49
+                {{'J', 0, 0, 0, 0, 0, 0, 1}}, // 0x4A
+                {{'K', 0, 0, 0, 0, 0, 0, 1}}, // 0x4B
+                {{'L', 0, 0, 0, 0, 0, 0, 1}}, // 0x4C
+                {{'M', 0, 0, 0, 0, 0, 0, 1}}, // 0x4D
+                {{'N', 0, 0, 0, 0, 0, 0, 1}}, // 0x4E
+                {{'O', 0, 0, 0, 0, 0, 0, 1}}, // 0x4F
+                {{'P', 0, 0, 0, 0, 0, 0, 1}}, // 0x50
+                {{'Q', 0, 0, 0, 0, 0, 0, 1}}, // 0x51
+                {{'R', 0, 0, 0, 0, 0, 0, 1}}, // 0x52
+                {{'S', 0, 0, 0, 0, 0, 0, 1}}, // 0x53
+                {{'T', 0, 0, 0, 0, 0, 0, 1}}, // 0x54
+                {{'U', 0, 0, 0, 0, 0, 0, 1}}, // 0x55
+                {{'V', 0, 0, 0, 0, 0, 0, 1}}, // 0x56
+                {{'W', 0, 0, 0, 0, 0, 0, 1}}, // 0x57
+                {{'X', 0, 0, 0, 0, 0, 0, 1}}, // 0x58
+                {{'Y', 0, 0, 0, 0, 0, 0, 1}}, // 0x59
+                {{'Z', 0, 0, 0, 0, 0, 0, 1}}, // 0x5A
+                {{'[', 0, 0, 0, 0, 0, 0, 1}}, // 0x5B
+                {{'\\', '\\', 0, 0, 0, 0, 0, 2}}, // 0x5C
+                {{']', 0, 0, 0, 0, 0, 0, 1}}, // 0x5D
+                {{'^', 0, 0, 0, 0, 0, 0, 1}}, // 0x5E
+                {{'_', 0, 0, 0, 0, 0, 0, 1}}, // 0x5F
+            }
+        };
+        return escapes;
+    }
+
    /*!
     * @brief write a lowercase "\\uXXXX" escape sequence into @a string_buffer
     *
@@ -13,7 +13,6 @@ using nlohmann::json;

 #include <cstdint>
 #include <limits>
-#include <sstream>
 #include <string>
 #include <vector>

@@ -36,17 +35,6 @@ std::vector<json> test_values()
        big_object[std::to_string(i)] = i;
    }

-    // large strings and binary values between small ones: a write too large
-    // for the space the vector sink has ahead takes a different path than a
-    // small one, and the small writes after it must still land behind it
-    json large_payloads = json::array();
-    for (int i = 0; i < 50; ++i)
-    {
-        large_payloads.push_back(std::string(300, static_cast<char>('a' + (i % 26))));
-        large_payloads.push_back(i);
-        large_payloads.push_back(json::binary(std::vector<std::uint8_t>(static_cast<std::size_t>(100 * i), static_cast<std::uint8_t>(i))));
-    }
-
    return
    {
        json(nullptr), json(true), json(false),
@@ -58,8 +46,7 @@ std::vector<json> test_values()
        json::array(), json::object(),
        json::array({1, 2, 3}), json({{"a", 1}, {"b", nullptr}}),
        json({{"nested", {{"deep", json::array({1, "two", 3.0, nullptr})}}}}),
-        big_array, big_object, large_payloads,
-        json::binary(std::vector<std::uint8_t>(5000, 0x42))
+        big_array, big_object
    };
 }

@@ -183,256 +170,6 @@ TEST_CASE("binary writer output sinks")
    }
 }

-namespace
-{
-
-// the CBOR head of an integer, encoded independently of binary_writer
-void reference_cbor_head(std::vector<std::uint8_t>& out, const std::uint8_t major_type, const std::uint64_t argument)
-{
-    if (argument <= 23)
-    {
-        out.push_back(static_cast<std::uint8_t>(major_type + argument));
-        return;
-    }
-
-    int length = 8;
-    std::uint8_t additional = 27;
-    if (argument <= 0xFF)
-    {
-        length = 1;
-        additional = 24;
-    }
-    else if (argument <= 0xFFFF)
-    {
-        length = 2;
-        additional = 25;
-    }
-    else if (argument <= 0xFFFFFFFF)
-    {
-        length = 4;
-        additional = 26;
-    }
-
-    out.push_back(static_cast<std::uint8_t>(major_type + additional));
-    for (int i = length - 1; i >= 0; --i)
-    {
-        out.push_back(static_cast<std::uint8_t>(argument >> (8 * i)));
-    }
-}
-
-// the CBOR encoding of an integer value
-void reference_cbor_integer(std::vector<std::uint8_t>& out, const json& j)
-{
-    if (j.is_number_unsigned())
-    {
-        reference_cbor_head(out, 0x00, j.get<std::uint64_t>());
-        return;
-    }
-
-    const auto n = j.get<std::int64_t>();
-    if (n >= 0)
-    {
-        reference_cbor_head(out, 0x00, static_cast<std::uint64_t>(n));
-    }
-    else
-    {
-        reference_cbor_head(out, 0x20, static_cast<std::uint64_t>(-1 - n));
-    }
-}
-
-// the MessagePack encoding of an integer value, encoded independently of
-// binary_writer
-void reference_msgpack_integer(std::vector<std::uint8_t>& out, const json& j)
-{
-    const auto put = [&out](const std::uint8_t marker, const std::uint64_t bits, const int length)
-    {
-        out.push_back(marker);
-        for (int i = length - 1; i >= 0; --i)
-        {
-            out.push_back(static_cast<std::uint8_t>(bits >> (8 * i)));
-        }
-    };
-
-    if (j.is_number_unsigned() || j.get<std::int64_t>() >= 0)
-    {
-        const auto u = j.get<std::uint64_t>();
-        if (u < 128)
-        {
-            out.push_back(static_cast<std::uint8_t>(u));
-        }
-        else if (u <= 0xFF)
-        {
-            put(0xCC, u, 1);
-        }
-        else if (u <= 0xFFFF)
-        {
-            put(0xCD, u, 2);
-        }
-        else if (u <= 0xFFFFFFFF)
-        {
-            put(0xCE, u, 4);
-        }
-        else
-        {
-            put(0xCF, u, 8);
-        }
-        return;
-    }
-
-    const auto n = j.get<std::int64_t>();
-    const auto bits = static_cast<std::uint64_t>(n);
-    if (n >= -32)
-    {
-        out.push_back(static_cast<std::uint8_t>(bits));
-    }
-    else if (n >= -128)
-    {
-        put(0xD0, bits, 1);
-    }
-    else if (n >= -32768)
-    {
-        put(0xD1, bits, 2);
-    }
-    else if (n >= -2147483648LL)
-    {
-        put(0xD2, bits, 4);
-    }
-    else
-    {
-        put(0xD3, bits, 8);
-    }
-}
-
-// integers at every boundary of the CBOR and MessagePack sizes, signed and
-// unsigned
-std::vector<json> boundary_integers()
-{
-    std::vector<json> result;
-    const std::uint64_t boundaries[] =
-    {
-        0, 1, 22, 23, 24, 25, 31, 32, 33, 126, 127, 128, 129, 254, 255, 256, 257,
-        32766, 32767, 32768, 32769, 65534, 65535, 65536, 65537,
-        2147483646ULL, 2147483647ULL, 2147483648ULL, 2147483649ULL,
-        4294967294ULL, 4294967295ULL, 4294967296ULL, 4294967297ULL,
-        9223372036854775806ULL, 9223372036854775807ULL, 9223372036854775808ULL,
-        18446744073709551614ULL, 18446744073709551615ULL
-    };
-    for (const std::uint64_t u : boundaries)
-    {
-        result.emplace_back(u);
-        if (u <= static_cast<std::uint64_t>((std::numeric_limits<std::int64_t>::max)()))
-        {
-            const auto n = static_cast<std::int64_t>(u);
-            result.emplace_back(static_cast<json::number_integer_t>(n));
-            result.emplace_back(static_cast<json::number_integer_t>(-n));
-            result.emplace_back(static_cast<json::number_integer_t>(-n - 1));
-        }
-    }
-    return result;
-}
-
-} // namespace
-
-// Arrays of integers are written in runs straight into space reserved from the
-// sink, with branch-free encodings; check them against independent encoders for
-// runs shorter and longer than one reservation, broken up by other values, and
-// through each sink.
-TEST_CASE("CBOR and MessagePack integer arrays")
-{
-    const std::vector<json> integers = boundary_integers();
-
-    for (const std::size_t length :
-            {
-                std::size_t{1}, std::size_t{27}, std::size_t{28}, std::size_t{29}, std::size_t{57}, std::size_t{1000}
-            })
-    {
-        for (const std::size_t break_every :
-                {
-                    std::size_t{0}, std::size_t{1}, std::size_t{7}, std::size_t{28}
-                })
-        {
-            CAPTURE(length)
-            CAPTURE(break_every)
-
-            json array = json::array();
-            std::vector<std::uint8_t> expected_cbor;
-            std::vector<std::uint8_t> expected_msgpack;
-            for (std::size_t i = 0; i < length; ++i)
-            {
-                if (break_every != 0 && i % (break_every + 1) == break_every)
-                {
-                    array.push_back("x");
-                    expected_cbor.push_back(0x61);
-                    expected_cbor.push_back('x');
-                    expected_msgpack.push_back(0xA1);
-                    expected_msgpack.push_back('x');
-                }
-                else
-                {
-                    const json& value = integers[(i * 7) % integers.size()];
-                    array.push_back(value);
-                    reference_cbor_integer(expected_cbor, value);
-                    reference_msgpack_integer(expected_msgpack, value);
-                }
-            }
-
-            std::vector<std::uint8_t> head;
-            reference_cbor_head(head, 0x80, length);
-            expected_cbor.insert(expected_cbor.begin(), head.begin(), head.end());
-
-            head.clear();
-            if (length <= 15)
-            {
-                head.push_back(static_cast<std::uint8_t>(0x90 + length));
-            }
-            else
-            {
-                head = {0xDC, static_cast<std::uint8_t>(length >> 8), static_cast<std::uint8_t>(length)};
-            }
-            expected_msgpack.insert(expected_msgpack.begin(), head.begin(), head.end());
-
-            CHECK(json::to_cbor(array) == expected_cbor);
-            CHECK(json::to_msgpack(array) == expected_msgpack);
-
-            std::vector<std::uint8_t> through_adapter = {0xAA};
-            json::to_cbor(array, through_adapter);
-            CHECK(std::vector<std::uint8_t>(through_adapter.begin() + 1, through_adapter.end()) == expected_cbor);
-            through_adapter = {0xAA};
-            json::to_msgpack(array, through_adapter);
-            CHECK(std::vector<std::uint8_t>(through_adapter.begin() + 1, through_adapter.end()) == expected_msgpack);
-
-            std::ostringstream stream;
-            json::to_cbor(array, stream);
-            std::string streamed = stream.str();
-            CHECK(std::vector<std::uint8_t>(streamed.begin(), streamed.end()) == expected_cbor);
-            stream.str("");
-            json::to_msgpack(array, stream);
-            streamed = stream.str();
-            CHECK(std::vector<std::uint8_t>(streamed.begin(), streamed.end()) == expected_msgpack);
-
-            CHECK(json::from_cbor(expected_cbor) == array);
-            CHECK(json::from_msgpack(expected_msgpack) == array);
-
-            // the same array as object members
-            const json object = {{"a", array}, {"b", array}};
-            CHECK(json::from_cbor(json::to_cbor(object)) == object);
-            CHECK(json::from_msgpack(json::to_msgpack(object)) == object);
-        }
-    }
-
-    // single values, outside an array
-    for (const auto& value : integers)
-    {
-        CAPTURE(value)
-        std::vector<std::uint8_t> expected;
-        reference_cbor_integer(expected, value);
-        CHECK(json::to_cbor(value) == expected);
-        expected.clear();
-        reference_msgpack_integer(expected, value);
-        CHECK(json::to_msgpack(value) == expected);
-    }
-}
-
 // binary_reserve_hint() is documented as a *lower* bound on the serialized size,
 // so that reserving it up front can never leave the returned vector holding
 // capacity beyond what the value actually needs.
@@ -20,8 +20,11 @@
 using nlohmann::json;

 #include <array>
+#include <cstdint>
 #include <sstream>
 #include <iomanip>
+#include <string>
+#include <vector>

 #include "test_utils.hpp"

@@ -923,66 +926,68 @@ TEST_CASE("serialization boundary values for the string buffer")
    // mid-string once fewer than 13 bytes remain (`string_buffer.size() - bytes
    // < 13`), 13 being one more than the most a single code point can ever
    // write at once (a surrogate pair: two back-to-back "\uXXXX" escapes, 12
-    // bytes). Every write into string_buffer that this check protects happens
-    // in steps of 2 (a simple "\\x" escape) or 6 (one "\uXXXX" unit), so
-    // `bytes` only ever takes even values at the point the check runs - the
-    // tightest values actually reachable are therefore 498 (512 - 498 == 14,
-    // one simple escape away from the threshold) and 500 (512 - 500 == 12,
-    // where the flush fires immediately and resets bytes to 0).
+    // bytes). Characters below 0x60 (control characters, '"' and '\\') are
+    // escaped straight into the write buffer and never reach string_buffer, so
+    // under ensure_ascii it fills in steps of 6 (one "\uXXXX" unit for a
+    // character below U+10000) or 12 (a surrogate pair). With 2-byte characters
+    // such as U+00E4, `bytes` takes multiples of 6 at the point the check runs;
+    // the tightest values reachable are therefore 498 (512 - 498 == 14, after
+    // 83 characters) and 504 (512 - 504 == 8, after 84 characters, where the
+    // flush fires immediately and resets bytes to 0).

-    SECTION("a run of 2-byte escapes lands bytes on, and one step past, the flush threshold")
+    SECTION("a run of 6-byte escapes lands bytes on, and one step past, the flush threshold")
    {
        for (const int count :
                {
-                    249, 250, 251
+                    83, 84, 85
                })
        {
            CAPTURE(count)
-            const json j = std::string(static_cast<std::size_t>(count), '\n');
+            std::string umlauts;
            std::string expected = "\"";
            for (int i = 0; i < count; ++i)
            {
-                expected += "\\n";
+                umlauts += "\xC3\xA4";
+                expected += "\\u00e4";
            }
            expected += '"';
-            CHECK(j.dump() == expected);
+            CHECK(json(umlauts).dump(-1, ' ', true) == expected);
        }
    }

-    SECTION("an ASCII prefix leaves the tightest reachable margin before a 12-byte surrogate pair")
+    SECTION("a prefix leaves the tightest reachable margin before a 12-byte surrogate pair")
    {
        // U+1F600 (the "\xF0\x9F\x98\x80" UTF-8 bytes) is dumped under
        // ensure_ascii as the 12-byte surrogate pair "\ud83d\ude00"; that
        // write happens in a single step with no intermediate flush check, so
        // it is the write most exposed by an off-by-one in the "< 13" guard.
-        // A prefix of 249 newlines leaves exactly 14 bytes of headroom
+        // A prefix of 83 U+00E4 characters leaves exactly 14 bytes of headroom
        // (512 - 498), the smallest margin the guard ever actually allows
-        // into a new code point; 250 newlines instead trigger the guard's own
+        // into a new code point; 84 characters instead trigger the guard's own
        // flush first, so the emoji starts from a freshly emptied (512-byte)
-        // buffer, and 251 repeats that with one more escape already past the
+        // buffer, and 85 repeats that with one more escape already past the
        // reset. Together they cover the margin the guard allows landing on,
        // one step before, and one step after - all must still produce the
        // identical, correct escapes.
        for (const int prefix_count :
                {
-                    249, 250, 251
+                    83, 84, 85
                })
        {
            CAPTURE(prefix_count)
-            const std::string prefix(static_cast<std::size_t>(prefix_count), '\n');
-            const std::string emoji = "\xF0\x9F\x98\x80";
-            const json j = prefix + emoji;
-
+            std::string prefix;
            std::string expected_prefix;
            for (int i = 0; i < prefix_count; ++i)
            {
-                expected_prefix += "\\n";
+                prefix += "\xC3\xA4";
+                expected_prefix += "\\u00e4";
            }
+            const std::string emoji = "\xF0\x9F\x98\x80";
+            const json j = prefix + emoji;

-            // newline escaping does not depend on ensure_ascii: only the
-            // emoji differs (raw UTF-8 bytes vs. a \u-escaped surrogate pair)
+            // without ensure_ascii, the whole string is copied unchanged
            std::string expected_raw = "\"";
-            expected_raw += expected_prefix;
+            expected_raw += prefix;
            expected_raw += emoji;
            expected_raw += '"';
            std::string expected_ascii = "\"";
@@ -1027,3 +1032,524 @@ TEST_CASE("serialization boundary values for the string buffer")
        }
    }
 }
+
+namespace
+{
+// appends the escaped form of the ASCII character c to out; written
+// independently of the table in serializer::ascii_escapes()
+void append_escaped_ascii(std::string& out, const char c, const bool ensure_ascii)
+{
+    const auto byte = static_cast<unsigned char>(c);
+    switch (byte)
+    {
+        case '\b':
+            out += "\\b";
+            break;
+        case '\t':
+            out += "\\t";
+            break;
+        case '\n':
+            out += "\\n";
+            break;
+        case '\f':
+            out += "\\f";
+            break;
+        case '\r':
+            out += "\\r";
+            break;
+        case '"':
+            out += "\\\"";
+            break;
+        case '\\':
+            out += "\\\\";
+            break;
+        default:
+            if (byte < 0x20 || (ensure_ascii && byte == 0x7F))
+            {
+                // byte < 0x80, so the first two hex digits are 0
+                const char* const hex = "0123456789abcdef";
+                out += "\\u00";
+                out += hex[byte >> 4U];
+                out += hex[byte & 0x0FU];
+            }
+            else
+            {
+                out += c;
+            }
+            break;
+    }
+}
+
+// reference escaper for ASCII strings
+std::string reference_escape_ascii(const std::string& s, const bool ensure_ascii)
+{
+    std::string result = "\"";
+    for (const char c : s)
+    {
+        append_escaped_ascii(result, c, ensure_ascii);
+    }
+    result += '"';
+    return result;
+}
+} // namespace
+
+TEST_CASE("characters below 0x60 are escaped from a table straight into the write buffer")
+{
+    SECTION("every ASCII character at every position")
+    {
+        // lengths up to 17 cover the 8-byte strides of the bulk scanner on
+        // both sides of the character, so the scanner stops at it from every
+        // offset
+        for (std::size_t length = 1; length <= 17; ++length)
+        {
+            for (std::size_t pos = 0; pos < length; ++pos)
+            {
+                for (unsigned int c = 0; c < 0x80; ++c)
+                {
+                    std::string s(length, 'a');
+                    s[pos] = static_cast<char>(c);
+                    CAPTURE(length)
+                    CAPTURE(pos)
+                    CAPTURE(c)
+                    const json j = s;
+                    CHECK(j.dump(-1, ' ', false) == reference_escape_ascii(s, false));
+                    CHECK(j.dump(-1, ' ', true) == reference_escape_ascii(s, true));
+                }
+            }
+        }
+    }
+
+    SECTION("runs of escaped characters")
+    {
+        std::string s;
+        for (unsigned int c = 0; c < 0x20; ++c)
+        {
+            s += static_cast<char>(c);
+        }
+        s += R"("\"\)";
+        CHECK(json(s).dump() == reference_escape_ascii(s, false));
+        CHECK(json(s).dump(-1, ' ', true) == reference_escape_ascii(s, true));
+    }
+
+    SECTION("escapes straddle the end of the write buffer")
+    {
+        // the 8-byte store of a table entry needs room for all 8 bytes, even
+        // when the escape itself is shorter; a prefix of k plain characters
+        // shifts the 6-byte escapes across every offset of the 1024-byte
+        // write buffer
+        for (std::size_t k = 0; k < 8; ++k)
+        {
+            CAPTURE(k)
+            const std::string s = std::string(k, 'a') + std::string(400, '\x01');
+            CHECK(json(s).dump() == reference_escape_ascii(s, false));
+            CHECK(json::array({s, s}).dump() == "[" + reference_escape_ascii(s, false) + "," + reference_escape_ascii(s, false) + "]");
+        }
+    }
+
+    SECTION("pending \\u escapes of non-ASCII characters are written first")
+    {
+        // under ensure_ascii, U+00E4 is \u-escaped into the string buffer;
+        // a following escape from the table must not overtake it
+        const json j = "\xC3\xA4\n\xC3\xA4\"\xF0\x9F\x98\x80\\";
+        CHECK(j.dump(-1, ' ', true) == "\"\\u00e4\\n\\u00e4\\\"\\ud83d\\ude00\\\\\"");
+        CHECK(j.dump(-1, ' ', false) == "\"\xC3\xA4\\n\xC3\xA4\\\"\xF0\x9F\x98\x80\\\\\"");
+    }
+
+    SECTION("escapes after invalid UTF-8 for every error handler")
+    {
+        const json j = "a\xFF\n\xC3\"";
+        CHECK_THROWS_WITH_AS(utils::ignore_return_value(j.dump()), "[json.exception.type_error.316] invalid UTF-8 byte at index 1: 0xFF", json::type_error&);
+        CHECK(j.dump(-1, ' ', false, json::error_handler_t::ignore) == "\"a\\n\\\"\"");
+        CHECK(j.dump(-1, ' ', true, json::error_handler_t::ignore) == "\"a\\n\\\"\"");
+        CHECK(j.dump(-1, ' ', false, json::error_handler_t::replace) == "\"a\xEF\xBF\xBD\\n\xEF\xBF\xBD\\\"\"");
+        CHECK(j.dump(-1, ' ', true, json::error_handler_t::replace) == "\"a\\ufffd\\n\\ufffd\\\"\"");
+        CHECK(j.dump(-1, ' ', false, json::error_handler_t::keep) == "\"a\xFF\\n\xC3\\\"\"");
+        CHECK(j.dump(-1, ' ', true, json::error_handler_t::keep) == "\"a\xFF\\n\xC3\\\"\"");
+    }
+}
+
+namespace
+{
+// expected result of dumping a string: the output, or (with
+// error_handler_t::strict) the message of the type_error.316 exception
+struct expected_dump
+{
+    bool throws = false;
+    std::string text{}; // NOLINT(readability-redundant-member-init)
+};
+
+std::string upper_hex_byte(const unsigned char byte)
+{
+    const char* const hex = "0123456789ABCDEF";
+    return std::string(1, hex[byte >> 4U]) + hex[byte & 0x0FU];
+}
+
+void append_u_escape(std::string& out, const std::uint32_t code_unit)
+{
+    const char* const hex = "0123456789abcdef";
+    out += "\\u";
+    for (int shift = 12; shift >= 0; shift -= 4)
+    {
+        out += hex[(code_unit >> static_cast<unsigned int>(shift)) & 0x0FU];
+    }
+}
+
+void append_replacement_character(std::string& out, const bool ensure_ascii)
+{
+    out += ensure_ascii ? "\\ufffd" : "\xEF\xBF\xBD";
+}
+
+// reference serializer for arbitrary byte strings, written from the documented
+// behavior of dump() and independently of serializer::dump_escaped(): UTF-8 is
+// decoded strictly (well-formed sequences as in Table 3-7 of the Unicode
+// Standard), and each ill-formed sequence is handled as the error handler says
+expected_dump reference_dump_string(const std::string& s, const bool ensure_ascii, const json::error_handler_t error_handler)
+{
+    expected_dump result;
+    std::string& out = result.text;
+    out = "\"";
+
+    // handle the ill-formed bytes s[begin, end), of which s[index] is the byte
+    // that could not be decoded; returns false if an exception is expected
+    const auto ill_formed = [&](const std::size_t begin, const std::size_t end, const std::size_t index)
+    {
+        switch (error_handler)
+        {
+            case json::error_handler_t::strict:
+                result.throws = true;
+                out = "[json.exception.type_error.316] invalid UTF-8 byte at index " + std::to_string(index) + ": 0x" + upper_hex_byte(static_cast<unsigned char>(s[index]));
+                return false;
+            case json::error_handler_t::ignore:
+                break;
+            case json::error_handler_t::replace:
+                append_replacement_character(out, ensure_ascii);
+                break;
+            case json::error_handler_t::keep:
+            default:
+                // kept as is, even with ensure_ascii
+                out.append(s, begin, end - begin);
+                break;
+        }
+        return true;
+    };
+
+    std::size_t i = 0;
+    while (i < s.size())
+    {
+        const auto lead = static_cast<unsigned char>(s[i]);
+        if (lead < 0x80)
+        {
+            append_escaped_ascii(out, s[i], ensure_ascii);
+            ++i;
+            continue;
+        }
+
+        // number of bytes of the sequence and the range of its second byte
+        std::size_t length = 0;
+        std::uint32_t code_point = 0;
+        unsigned char lower = 0x80;
+        unsigned char upper = 0xBF;
+        if (lead >= 0xC2 && lead <= 0xDF)
+        {
+            length = 2;
+            code_point = lead & 0x1FU;
+        }
+        else if (lead >= 0xE0 && lead <= 0xEF)
+        {
+            length = 3;
+            code_point = lead & 0x0FU;
+            lower = (lead == 0xE0) ? 0xA0 : 0x80; // no overlong encodings
+            upper = (lead == 0xED) ? 0x9F : 0xBF; // no surrogates
+        }
+        else if (lead >= 0xF0 && lead <= 0xF4)
+        {
+            length = 4;
+            code_point = lead & 0x07U;
+            lower = (lead == 0xF0) ? 0x90 : 0x80; // no overlong encodings
+            upper = (lead == 0xF4) ? 0x8F : 0xBF; // nothing above U+10FFFF
+        }
+        else
+        {
+            // a byte that cannot start a sequence is consumed
+            if (!ill_formed(i, i + 1, i))
+            {
+                return result;
+            }
+            ++i;
+            continue;
+        }
+
+        std::size_t j = i + 1;
+        for (; j < i + length; ++j)
+        {
+            if (j == s.size())
+            {
+                // the string ends in the middle of the sequence
+                switch (error_handler)
+                {
+                    case json::error_handler_t::strict:
+                        result.throws = true;
+                        out = "[json.exception.type_error.316] incomplete UTF-8 string; last byte: 0x" + upper_hex_byte(static_cast<unsigned char>(s.back()));
+                        return result;
+                    case json::error_handler_t::ignore:
+                        break;
+                    case json::error_handler_t::replace:
+                        append_replacement_character(out, ensure_ascii);
+                        break;
+                    case json::error_handler_t::keep:
+                    default:
+                        out.append(s, i, s.size() - i);
+                        break;
+                }
+                out += '"';
+                return result;
+            }
+
+            const auto byte = static_cast<unsigned char>(s[j]);
+            if (byte < lower || byte > upper)
+            {
+                break;
+            }
+            code_point = (code_point << 6U) | (byte & 0x3FU);
+            lower = 0x80;
+            upper = 0xBF;
+        }
+
+        if (j < i + length)
+        {
+            // the sequence was abandoned at s[j]; that byte is read again as
+            // the start of a new character
+            if (!ill_formed(i, j, j))
+            {
+                return result;
+            }
+            i = j;
+            continue;
+        }
+
+        if (!ensure_ascii)
+        {
+            out.append(s, i, length);
+        }
+        else if (code_point <= 0xFFFF)
+        {
+            append_u_escape(out, code_point);
+        }
+        else
+        {
+            append_u_escape(out, 0xD800U + ((code_point - 0x10000U) >> 10U));
+            append_u_escape(out, 0xDC00U + ((code_point - 0x10000U) & 0x3FFU));
+        }
+        i = j;
+    }
+
+    out += '"';
+    return result;
+}
+
+std::string hex_dump(const std::string& s)
+{
+    std::string result;
+    for (const char c : s)
+    {
+        result += upper_hex_byte(static_cast<unsigned char>(c));
+        result += ' ';
+    }
+    return result;
+}
+
+// compares dump() of s with the reference for every error handler, with
+// ensure_ascii on and off; CHECKs only on a mismatch to keep the sweep fast;
+// error_handler_t::strict can be skipped where the position of the string
+// buffer does not matter, as throwing is slow on some platforms
+void check_dump_against_reference(const std::string& s, const bool with_strict = true)
+{
+    const json j = s;
+    const std::array<json::error_handler_t, 4> error_handlers =
+    {
+        {
+            json::error_handler_t::strict, json::error_handler_t::ignore,
+            json::error_handler_t::replace, json::error_handler_t::keep
+        }
+    };
+    for (const auto error_handler : error_handlers)
+    {
+        if (!with_strict && error_handler == json::error_handler_t::strict)
+        {
+            continue;
+        }
+        for (const bool ensure_ascii :
+                {
+                    false, true
+                })
+        {
+            const expected_dump expected = reference_dump_string(s, ensure_ascii, error_handler);
+            expected_dump actual;
+            int id = 0;
+            try
+            {
+                actual.text = j.dump(-1, ' ', ensure_ascii, error_handler);
+            }
+            catch (const json::exception& e)
+            {
+                actual.throws = true;
+                actual.text = e.what();
+                id = e.id;
+            }
+            if (actual.throws != expected.throws || actual.text != expected.text || (actual.throws && id != 316))
+            {
+                const std::string input = hex_dump(s);
+                CAPTURE(input)
+                CAPTURE(ensure_ascii)
+                CAPTURE(static_cast<int>(error_handler))
+                CHECK(actual.throws == expected.throws);
+                CHECK(actual.text == expected.text);
+                CHECK((!actual.throws || id == 316));
+            }
+        }
+    }
+}
+} // namespace
+
+TEST_CASE("invalid UTF-8 at every position is handled like the reference")
+{
+    // ill-formed byte sequences; those that end in a truncated sequence are
+    // also cut short by the filler that follows, or by the end of the string
+    const std::vector<std::string> patterns =
+    {
+        // stray continuation bytes
+        "\x80", "\xBF",
+        // bytes that cannot start a sequence
+        "\xC0", "\xC1", "\xF5", "\xF6", "\xF7", "\xF8", "\xF9", "\xFA", "\xFB", "\xFC", "\xFD", "\xFE", "\xFF",
+        // overlong encodings
+        "\xC0\xAF", "\xE0\x80\x80", "\xF0\x80\x80\x80",
+        // UTF-16 surrogates
+        "\xED\xA0\x80", "\xED\xBF\xBF",
+        // a code point above U+10FFFF
+        "\xF4\x90\x80\x80",
+        // sequences cut short by ASCII, a control character, a quote, a
+        // backslash, DEL, or the lead byte of a well-formed character
+        "\xC3" "a", "\xE2\x82" "\n", "\xE2\x82\"", "\xF0\x9F\x98\\", "\xC3\x7F", "\xC3\xC3\xA4", "\xE2\xF0\x9F\x98\x80",
+        // truncated sequences
+        "\xC3", "\xE2\x82", "\xF0\x9F\x98"
+    };
+
+    // well-formed characters of 1, 2, 3, and 4 bytes
+    const std::vector<std::string> fillers = {"a", "\xC3\xA4", "\xE2\x82\xAC", "\xF0\x9F\x98\x80"};
+
+    const auto make_string = [](const std::string & filler, const std::size_t before, const std::string & pattern, const std::size_t after)
+    {
+        std::string s;
+        for (std::size_t k = 0; k < before; ++k)
+        {
+            s += filler;
+        }
+        s += pattern;
+        for (std::size_t k = 0; k < after; ++k)
+        {
+            s += filler;
+        }
+        return s;
+    };
+
+    SECTION("the reference")
+    {
+        // the reference itself, against hand-written results
+        const std::string s = "a\xFF\n\xC3\"\xE0\x80\xF0\x9F\x98\x80\xE2\x82";
+        CHECK(reference_dump_string(s, false, json::error_handler_t::strict).text == "[json.exception.type_error.316] invalid UTF-8 byte at index 1: 0xFF");
+        CHECK(reference_dump_string(s.substr(2), false, json::error_handler_t::strict).text == "[json.exception.type_error.316] invalid UTF-8 byte at index 2: 0x22");
+        CHECK(reference_dump_string("\xF0\x9F\x98\x80\xE2\x82", true, json::error_handler_t::strict).text == "[json.exception.type_error.316] incomplete UTF-8 string; last byte: 0x82");
+        CHECK(reference_dump_string(s, false, json::error_handler_t::ignore).text == "\"a\\n\\\"\xF0\x9F\x98\x80\"");
+        CHECK(reference_dump_string(s, true, json::error_handler_t::ignore).text == "\"a\\n\\\"\\ud83d\\ude00\"");
+        CHECK(reference_dump_string(s, false, json::error_handler_t::replace).text == "\"a\xEF\xBF\xBD\\n\xEF\xBF\xBD\\\"\xEF\xBF\xBD\xEF\xBF\xBD\xF0\x9F\x98\x80\xEF\xBF\xBD\"");
+        CHECK(reference_dump_string(s, true, json::error_handler_t::replace).text == "\"a\\ufffd\\n\\ufffd\\\"\\ufffd\\ufffd\\ud83d\\ude00\\ufffd\"");
+        CHECK(reference_dump_string(s, false, json::error_handler_t::keep).text == "\"" + std::string("a\xFF\\n\xC3\\\"\xE0\x80\xF0\x9F\x98\x80\xE2\x82") + "\"");
+        CHECK(reference_dump_string(s, true, json::error_handler_t::keep).text == "\"" + std::string("a\xFF\\n\xC3\\\"\xE0\x80\\ud83d\\ude00\xE2\x82") + "\"");
+        check_dump_against_reference(s);
+    }
+
+    SECTION("short strings")
+    {
+        // strings of up to 17 bytes put the pattern at every offset of an
+        // 8-byte stride of the bulk scanners, with whole strides on both
+        // sides; lengths around 24, 32, and 40 bytes cross the 16- and 32-byte
+        // strides; error_handler_t::strict is checked for up to 17 bytes of
+        // ASCII and 8 bytes of other characters only, as throwing is slow on
+        // some platforms
+        for (const auto& filler : fillers)
+        {
+            for (std::size_t length = 0; length * filler.size() <= 40; ++length)
+            {
+                const std::size_t bytes = length * filler.size();
+                if (filler.size() == 1 && bytes > 17 && (bytes + 1) % 8 > 2)
+                {
+                    continue;
+                }
+                for (std::size_t pos = 0; pos <= length; ++pos)
+                {
+                    for (const auto& pattern : patterns)
+                    {
+                        check_dump_against_reference(make_string(filler, pos, pattern, length - pos), bytes <= (filler.size() == 1 ? 17 : 8));
+                    }
+                }
+            }
+        }
+    }
+
+    SECTION("strings crossing the end of the string buffer")
+    {
+        // characters that are not copied in bulk go through a 512-byte string
+        // buffer that is written out once fewer than 13 bytes are left; with
+        // ensure_ascii, each 2-byte character takes 6 bytes of it and each
+        // 4-byte character 12, so the pattern meets the end of the buffer after
+        // about 84 or 42 characters (3-byte characters behave like 2-byte
+        // ones); plain ASCII, copied in bulk, is checked around 512 bytes;
+        // positions further away are sampled; error_handler_t::strict throws
+        // at the first ill-formed byte, regardless of the string buffer, and is
+        // covered above
+        for (const auto& filler : fillers)
+        {
+            if (filler.size() == 3)
+            {
+                continue;
+            }
+            const std::size_t escaped_size = filler.size() == 1 ? 1 : filler.size() * 3;
+            const std::size_t middle = 506 / escaped_size;
+            const std::size_t window = filler.size() == 1 ? 8 : 16;
+            for (std::size_t pos = 0; pos <= middle + window; pos += (pos + window >= middle) ? 1 : 29)
+            {
+                for (const std::size_t after :
+                        {
+                            std::size_t{0}, std::size_t{12}
+                        })
+                {
+                    for (const auto& pattern : patterns)
+                    {
+                        check_dump_against_reference(make_string(filler, pos, pattern, after), false);
+                    }
+                }
+            }
+        }
+    }
+
+    SECTION("repeated invalid sequences at every offset of the string buffer")
+    {
+        // ill-formed sequences that are kept or replaced fill the string
+        // buffer without a bulk copy in between; a prefix of 0 to 12 bytes
+        // 0xFF (kept as 1 byte, replaced by 3 or 6) shifts them across every
+        // offset of the end of the buffer
+        for (const auto& pattern : patterns)
+        {
+            for (std::size_t shift = 0; shift <= 12; ++shift)
+            {
+                std::string s(shift, '\xFF');
+                while (s.size() < 600)
+                {
+                    s += pattern;
+                }
+                check_dump_against_reference(s, shift == 0);
+                check_dump_against_reference(s + "\xF0\x9F\x98\x80", false);
+            }
+        }
+    }
+}