diff --git a/compilers/openapi/internal/annotation/unknown.go b/compilers/openapi/internal/annotation/unknown.go
new file mode 100644
index 0000000..bab5acc
--- /dev/null
+++ b/compilers/openapi/internal/annotation/unknown.go
@@ -0,0 +1,207 @@
+package annotation
+
+import (
+	"reflect"
+	"slices"
+
+	oas3 "github.com/speakeasy-api/openapi/jsonschema/oas3"
+	yaml "gopkg.in/yaml.v3"
+
+	"github.com/dexpace/morphic/compilers/openapi/internal/diag"
+	"github.com/dexpace/morphic/compilers/openapi/internal/ids"
+	"github.com/dexpace/morphic/ir"
+)
+
+// MaxUnknownKeys bounds how many keys one object contributes to the IR.
+//
+// The key set is the document's to choose the size of, and every collection in
+// this compiler is bounded, so this one is too. It sits far above what a
+// document writes by accident, so an object reaching it is generated or hostile
+// rather than merely sloppy, and what it discards is announced under
+// diag.UnknownKeyBudget rather than dropped in silence.
+const MaxUnknownKeys = 64
+
+// DecidedKeywords are the JSON Schema keywords the library's schema model names
+// no field for and this compiler has already decided about, so the census must
+// not claim them as unread. Each decision is recorded where it was made, and the
+// schema walk's 2020-12 vocabulary test fails if one starts being carried:
+//
+//   - $comment — 2020-12 §8.3 forbids presenting it to end users, so no SDK
+//     emitter may see it. Dropped on purpose.
+//   - $dynamicAnchor — read by the anchor index as a reference target, which is
+//     what lets a $dynamicRef expand; declaring one says nothing about the shape.
+//   - $dynamicRef — carried by the dynamic-reference lowering, which either
+//     expands it into the position's type or keeps it under a reason of its own.
+//     An entry beside an expanded one would tell a consumer the compiler ignored
+//     a reference it had in fact resolved.
+//
+// The other 2020-12 keywords with no field of their own — $vocabulary and
+// dependentRequired — need no entry here. Their readers write to the same map,
+// so the census finds them already recorded and leaves them alone.
+var DecidedKeywords = []string{"$comment", "$dynamicAnchor", "$dynamicRef"}
+
+// UnknownKeywordsIn records on p the keywords s writes that no field of the JSON
+// Schema model names, and announces each.
+//
+// OpenAPI 3.1 schemas are JSON Schema 2020-12, where an unrecognized keyword is
+// legal input: the specification requires an implementation to ignore what it
+// does not recognize and allows such a keyword to carry meaning for other
+// tooling. So this reports a decision rather than a fault, and is graded
+// accordingly — see diag.UnknownSchemaKeyword.
+//
+// It keeps only what no other reader kept, which is why it runs after all of
+// them: `$vocabulary` and `dependentRequired` have no field in the model either
+// and are read straight off the raw node by readers with more to say about them,
+// so the census finds those already recorded and leaves them alone. A keyword no
+// reader leaves a trace of needs naming in DecidedKeywords instead.
+func UnknownKeywordsIn(p *ir.Unmodeled, s *oas3.Schema, pointer string, srcIndex int) []ir.Diagnostic {
+	return census(p, s, srcIndex, pointer, "", keyClass{
+		code:     diag.UnknownSchemaKeyword,
+		severity: ir.SeverityInfo,
+		skip:     DecidedKeywords,
+		message: "keyword %q has no field in the schema model this compiler lowers and no IR " +
+			"position of its own; kept verbatim under Unmodeled",
+	})
+}
+
+// UnknownKeysIn records on p the keys an OpenAPI object writes that the
+// specification neither defines nor admits as an extension, for an object
+// lowering to a node with an Unmodeled map of its own. owner is the object's own
+// source pointer.
+//
+// Unlike its schema neighbour this reports a fault: OpenAPI gives each of its
+// objects a closed key set and requires every extension to be prefixed x-, so a
+// key that is neither is nothing the document is permitted to write — in
+// practice a misspelling of the field beside it. It is kept all the same,
+// because invariant 2 does not bend for invalid input, and a misspelt key is the
+// one a reader most needs to find.
+func UnknownKeysIn(p *ir.Unmodeled, model any, srcIndex int, owner string) []ir.Diagnostic {
+	return UnknownKeysUnder(p, model, srcIndex, owner, "")
+}
+
+// UnknownKeysUnder is UnknownKeysIn with every entry keyed beneath scope, for
+// the objects with no Unmodeled map of their own, whose keys ride on the nearest
+// node that has one — an info object's on the document, a tag's on the document.
+//
+// scope says which object wrote them: the source path from the carrier down to
+// the object. Several objects reach one map, where "openapi:status" from two of
+// them would be a single key and the entry that survived would depend on which
+// lowering ran last.
+func UnknownKeysUnder(p *ir.Unmodeled, model any, srcIndex int, owner, scope string) []ir.Diagnostic {
+	return census(p, model, srcIndex, owner, scope, keyClass{
+		code:     diag.UnknownObjectKey,
+		severity: ir.SeverityWarning,
+		message: "key %q is not defined by the OpenAPI object it is written on and is not an " +
+			"x- extension; kept verbatim under Unmodeled",
+	})
+}
+
+// keyClass is how a key the model does not name is graded: which diagnostic
+// announces it, and at what severity.
+//
+// The reason is not part of it. Both classes carry ReasonOutOfScope, because
+// that is a property of the construct rather than of the document: no IR node is
+// coming for a key the format does not define, nor for one a schema dialect
+// defines and this compiler does not model, so an emitter policy layer is the
+// only consumer either has. Which of the two a key is says something about the
+// source, and the diagnostic channel is where this compiler says that.
+type keyClass struct {
+	code     string
+	severity ir.Severity
+	skip     []string // keywords already decided about; see DecidedKeywords
+	message  string   // one %q, filled with the key
+}
+
+// census records on p every key model's source object wrote that its own model
+// names no field for, each under its own key beneath scope.
+//
+// A key p already holds is left alone and not announced: the census is the
+// complement of everything the compiler read, not only of what the model names,
+// and a reader with a reason of its own for a keyword has already said it
+// better.
+func census(p *ir.Unmodeled, model any, srcIndex int, owner, scope string, cl keyClass) []ir.Diagnostic {
+	keys, root := undeclaredKeys(model)
+	if len(keys) == 0 {
+		return nil
+	}
+	var diags []ir.Diagnostic
+	if len(keys) > MaxUnknownKeys {
+		diags = append(diags, budgetDiag(len(keys), owner, srcIndex))
+		keys = keys[:MaxUnknownKeys]
+	}
+	for _, key := range keys {
+		entry := "openapi:" + scoped(scope, key)
+		if _, recorded := (*p)[entry]; recorded || slices.Contains(cl.skip, key) {
+			continue
+		}
+		at := owner + ids.Ptr(key)
+		kept, keptDiags := PreserveNodeInto(p, entry, RawChildNode(root, key),
+			ir.ReasonOutOfScope, at, srcIndex)
+		diags = append(diags, keptDiags...)
+		if !kept {
+			continue
+		}
+		diags = append(diags, diag.Newf(cl.severity, cl.code,
+			ir.Provenance{Source: srcIndex, Pointer: at}, cl.message, key))
+	}
+	return diags
+}
+
+// scoped spells one entry's key on the carrier holding it.
+func scoped(scope, key string) string {
+	if scope == "" {
+		return key
+	}
+	return scope + "/" + key
+}
+
+// budgetDiag reports the keys past MaxUnknownKeys, which reach the IR in no form.
+func budgetDiag(total int, owner string, srcIndex int) ir.Diagnostic {
+	return diag.Newf(ir.SeverityWarning, diag.UnknownKeyBudget,
+		ir.Provenance{Source: srcIndex, Pointer: owner},
+		"object writes %d keys its model names no field for, past the %d this compiler keeps; "+
+			"the rest are represented in the IR in no form at all", total, MaxUnknownKeys)
+}
+
+// parsedObject is the part of a parsed model the census reads: its core, which
+// holds the census the unmarshaller took, and the mapping node the keys were
+// written on.
+//
+// Declared here rather than taken from the library, so this package depends on
+// the shape it uses rather than on the marshaller package, and so a test can
+// drive the branches below with a model of its own.
+type parsedObject interface {
+	GetCoreAny() any
+	GetRootNode() *yaml.Node
+}
+
+// unknownReporter is a core model's own record of the keys it did not name.
+type unknownReporter interface{ GetUnknownProperties() []string }
+
+// undeclaredKeys returns, sorted, the keys model's source object wrote that its
+// model names no field for, and the mapping node they were written on.
+//
+// Sorted, and on a copy: the library fills that list from a parallel walk of the
+// mapping under a mutex, so its order is neither source order nor stable, and
+// the slice it hands back is the model's own. An unsorted read would order this
+// compiler's diagnostics by something the source does not decide, which
+// invariant 7 forbids.
+//
+// A model reporting no census yields nothing rather than panicking. The receiver
+// may be a typed nil — an absent object is what the getters return for one the
+// document omitted — and a promoted method on one of those dereferences it.
+func undeclaredKeys(model any) ([]string, *yaml.Node) {
+	v := reflect.ValueOf(model)
+	if v.Kind() == reflect.Pointer && v.IsNil() {
+		return nil, nil
+	}
+	obj, ok := model.(parsedObject)
+	if !ok {
+		return nil, nil
+	}
+	core, ok := obj.GetCoreAny().(unknownReporter)
+	if !ok {
+		return nil, nil
+	}
+	return slices.Sorted(slices.Values(core.GetUnknownProperties())), obj.GetRootNode()
+}
diff --git a/compilers/openapi/internal/annotation/unknown_internal_test.go b/compilers/openapi/internal/annotation/unknown_internal_test.go
new file mode 100644
index 0000000..764a402
--- /dev/null
+++ b/compilers/openapi/internal/annotation/unknown_internal_test.go
@@ -0,0 +1,212 @@
+package annotation
+
+import (
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	yaml "gopkg.in/yaml.v3"
+
+	"github.com/dexpace/morphic/ir"
+)
+
+// TestUnknownKeywordsIn_KeepsWhatTheModelDoesNotName is the census at its own
+// subject: a keyword with no field in the schema model reaches the IR under its
+// own key, located at itself, and is announced at info.
+func TestUnknownKeywordsIn_KeepsWhatTheModelDoesNotName(t *testing.T) {
+	t.Parallel()
+	s := schemaFromYAML(t, "type: string\nx-ray: kept\nnotAKeyword: 7\n")
+
+	var got ir.Unmodeled
+	diags := UnknownKeywordsIn(&got, s, "/components/schemas/A", 3)
+
+	require.Len(t, got, 1, "the x-* is the extension reader's, not the census's; got %v", got)
+	entry := got["openapi:notAKeyword"]
+	assert.Equal(t, ir.ReasonOutOfScope, entry.Reason)
+	assert.Equal(t, ir.RawValue("7"), entry.Value)
+	assert.Equal(t, ir.Provenance{Source: 3, Pointer: "/components/schemas/A/notAKeyword"}, entry.Provenance)
+
+	require.Len(t, diags, 1)
+	assert.Equal(t, ir.SeverityInfo, diags[0].Severity)
+	assert.Equal(t, "openapi/unknown-schema-keyword", diags[0].Code)
+	assert.Contains(t, diags[0].Message, `"notAKeyword"`)
+}
+
+// TestUnknownKeywordsIn_DecidedKeywordsAreLeftAlone holds the census to the
+// decisions already recorded elsewhere. Each of these has no field in the schema
+// model, so the census would otherwise claim all three and overrule a
+// deliberate drop — or, for an expanded $dynamicRef, say the compiler ignored a
+// reference it resolved.
+func TestUnknownKeywordsIn_DecidedKeywordsAreLeftAlone(t *testing.T) {
+	t.Parallel()
+	assert.Equal(t, []string{"$comment", "$dynamicAnchor", "$dynamicRef"}, DecidedKeywords,
+		"a keyword joining or leaving the exclusion must be decided here too")
+
+	var body strings.Builder
+	body.WriteString("type: string\n")
+	for _, keyword := range DecidedKeywords {
+		body.WriteString(keyword + ": v\n")
+	}
+	s := schemaFromYAML(t, body.String())
+
+	var got ir.Unmodeled
+	diags := UnknownKeywordsIn(&got, s, "/components/schemas/A", 0)
+
+	assert.Empty(t, got, "each is decided about elsewhere, so the census keeps none of them")
+	assert.Empty(t, diags)
+}
+
+// TestUnknownKeywordsIn_AlreadyRecordedKeyIsLeftAlone is why the census runs
+// last. dependentRequired has no field in the model either and is kept by the
+// validation-only reader under a reason that says what it is; a census that
+// overwrote it would replace that with a weaker one and announce the keyword
+// twice.
+func TestUnknownKeywordsIn_AlreadyRecordedKeyIsLeftAlone(t *testing.T) {
+	t.Parallel()
+	s := schemaFromYAML(t, "type: object\ndependentRequired: {a: [b]}\n")
+	already := ir.UnmodeledEntry{
+		Reason:     ir.ReasonValidationOnly,
+		Value:      ir.RawValue(`{"a":["b"]}`),
+		Provenance: ir.Provenance{Pointer: "/A/dependentRequired"},
+	}
+	got := ir.Unmodeled{"openapi:dependentRequired": already}
+
+	diags := UnknownKeywordsIn(&got, s, "/A", 0)
+
+	assert.Equal(t, ir.Unmodeled{"openapi:dependentRequired": already}, got)
+	assert.Empty(t, diags, "a keyword another reader already announced is not announced twice")
+}
+
+// TestUnknownKeywordsIn_UnpreservableValueIsReportedNotKept holds the census to
+// GitHub #144's rule: a value that cannot be rendered as JSON keeps nothing, and
+// says so, rather than announcing a preservation that did not happen.
+func TestUnknownKeywordsIn_UnpreservableValueIsReportedNotKept(t *testing.T) {
+	t.Parallel()
+	s := schemaFromYAML(t, "type: string\nnotAKeyword: .nan\n")
+
+	var got ir.Unmodeled
+	diags := UnknownKeywordsIn(&got, s, "/A", 0)
+
+	assert.Empty(t, got)
+	require.Len(t, diags, 1)
+	assert.Equal(t, ir.SeverityError, diags[0].Severity)
+	assert.Equal(t, "openapi/unpreservable-construct", diags[0].Code)
+}
+
+// TestUnknownKeysUnder_KeysBeneathTheScopeAndSorted pins the OpenAPI-object
+// class: entries key under the path that says which object wrote them, the
+// grading is a warning because the format admits no such key, and both the
+// entries and the findings come out in key order.
+//
+// Sorted matters on its own. The library builds its census from a parallel walk
+// of the mapping, so the order it hands back is neither source order nor stable,
+// and diagnostics ordered by it would make the document non-deterministic
+// (invariant 7).
+func TestUnknownKeysUnder_KeysBeneathTheScopeAndSorted(t *testing.T) {
+	t.Parallel()
+	reported := []string{"zeta", "alpha"}
+	obj := fakeObject{core: &fakeCore{keys: reported}, root: parsedMapping(t, "zeta: 1\nalpha: 2\n")}
+
+	var got ir.Unmodeled
+	diags := UnknownKeysUnder(&got, obj, 1, "/info/contact", "info/contact")
+
+	assert.Equal(t, []string{"zeta", "alpha"}, reported, "the model's own slice is not reordered")
+	require.Len(t, got, 2)
+	assert.Equal(t, ir.RawValue("2"), got["openapi:info/contact/alpha"].Value)
+	assert.Equal(t, ir.Provenance{Source: 1, Pointer: "/info/contact/zeta"},
+		got["openapi:info/contact/zeta"].Provenance)
+
+	require.Len(t, diags, 2)
+	assert.Equal(t, ir.SeverityWarning, diags[0].Severity)
+	assert.Equal(t, "openapi/unknown-object-key", diags[0].Code)
+	assert.Contains(t, diags[0].Message, `"alpha"`, "the findings follow the sorted keys")
+	assert.Contains(t, diags[1].Message, `"zeta"`)
+}
+
+// TestUnknownKeysIn_BudgetBoundsWhatOneObjectContributes exercises the bound. An
+// object writing more undeclared keys than MaxUnknownKeys keeps exactly that
+// many and reports the remainder, which is what stops the discarded tail from
+// being the silent loss this census exists to end.
+func TestUnknownKeysIn_BudgetBoundsWhatOneObjectContributes(t *testing.T) {
+	t.Parallel()
+	const over = MaxUnknownKeys + 3
+	keys := make([]string, 0, over)
+	var body strings.Builder
+	for i := range over {
+		// Zero-padded, so sorting the census is sorting the source order too and the
+		// key that survives the truncation is a predictable one.
+		key := "k" + strconv.Itoa(1000+i)
+		keys = append(keys, key)
+		body.WriteString(key + ": " + strconv.Itoa(i) + "\n")
+	}
+	obj := fakeObject{core: &fakeCore{keys: keys}, root: parsedMapping(t, body.String())}
+
+	var got ir.Unmodeled
+	diags := UnknownKeysIn(&got, obj, 0, "/x")
+
+	assert.Len(t, got, MaxUnknownKeys)
+	assert.NotContains(t, got, "openapi:k"+strconv.Itoa(1000+over-1), "the tail past the bound is dropped")
+	require.NotEmpty(t, diags)
+	assert.Equal(t, "openapi/unknown-key-budget", diags[0].Code)
+	assert.Equal(t, ir.SeverityWarning, diags[0].Severity)
+	assert.Equal(t, ir.Provenance{Pointer: "/x"}, diags[0].Provenance)
+}
+
+// TestUnknownKeysIn_ModelWithNoCensusRecordsNothing covers the shapes the reader
+// must survive rather than panic on. The absent object is the one that occurs:
+// the getters hand back a typed nil for an object the document omitted, and a
+// promoted method on one of those dereferences it.
+func TestUnknownKeysIn_ModelWithNoCensusRecordsNothing(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		name  string
+		model any
+	}{
+		{"an object the document omitted", (*fakeObjectPtr)(nil)},
+		{"an untyped nil", nil},
+		{"a value that is no parsed model", 42},
+		{"a model whose core keeps no census", fakeObject{core: "not a core"}},
+		{"a model with an empty census", fakeObject{core: &fakeCore{}}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			var got ir.Unmodeled
+
+			diags := UnknownKeysIn(&got, tc.model, 0, "/x")
+
+			assert.Nil(t, got)
+			assert.Empty(t, diags)
+		})
+	}
+}
+
+// fakeObject is a parsed model standing in for the library's, so the census can
+// be driven at shapes no real document produces — an unsorted census, one past
+// the bound, and a core that keeps none.
+type fakeObject struct {
+	core any
+	root *yaml.Node
+}
+
+func (f fakeObject) GetCoreAny() any         { return f.core }
+func (f fakeObject) GetRootNode() *yaml.Node { return f.root }
+
+// fakeObjectPtr is fakeObject's pointer-receiver twin, for the typed-nil case:
+// a promoted method on a nil pointer is what the guard exists for, and a
+// value-receiver method on a nil pointer would not reach it.
+type fakeObjectPtr struct{ fakeObject }
+
+// fakeCore is a core model's census, reported exactly as given.
+type fakeCore struct{ keys []string }
+
+func (c *fakeCore) GetUnknownProperties() []string { return c.keys }
+
+// parsedMapping parses body into the mapping node the census reads values from.
+func parsedMapping(t *testing.T, body string) *yaml.Node {
+	t.Helper()
+	var doc yaml.Node
+	require.NoError(t, yaml.Unmarshal([]byte(body), &doc))
+	return &doc
+}
diff --git a/compilers/openapi/internal/auth/auth.go b/compilers/openapi/internal/auth/auth.go
index b04dbe9..b7287f5 100644
--- a/compilers/openapi/internal/auth/auth.go
+++ b/compilers/openapi/internal/auth/auth.go
@@ -134,7 +134,13 @@ func lowerSecurityScheme(c lowering.Ctx, name string, ss *soa.SecurityScheme,
 	diags = preserveUnreadFields(c, &scheme, ss, decl)
 	ext, extDiags := annotation.ExtensionsFrom(ss.GetExtensions(), c.SrcIndex, decl)
 	scheme.Unmodeled = annotation.MergeUnmodeled(scheme.Unmodeled, ext)
-	return scheme, true, append(diags, extDiags...)
+	diags = append(diags, extDiags...)
+	// Distinct from preserveUnreadFields above it: that keeps the fields OpenAPI
+	// defines for a securityScheme which this entry's own mechanism gives no
+	// meaning to, while this keeps the keys OpenAPI defines for no securityScheme
+	// at all.
+	return scheme, true, append(diags,
+		annotation.UnknownKeysIn(&scheme.Unmodeled, ss, c.SrcIndex, decl)...)
 }
 
 // mechanismRefusalDiag reports a securitySchemes entry that declares a scheme
diff --git a/compilers/openapi/internal/diag/diag.go b/compilers/openapi/internal/diag/diag.go
index 5902708..5a9a12b 100644
--- a/compilers/openapi/internal/diag/diag.go
+++ b/compilers/openapi/internal/diag/diag.go
@@ -191,6 +191,40 @@ const (
 	// DegradedConstruct's constructs survive in a weaker shape, and these survive
 	// in none (GitHub #144).
 	UnpreservableConstruct = "openapi/unpreservable-construct"
+	// UnknownSchemaKeyword reports a JSON Schema keyword no field of the schema
+	// model names, kept verbatim under Unmodeled.
+	//
+	// Info, because the document did nothing wrong: JSON Schema requires an
+	// implementation to ignore a keyword it does not recognize, and says such a
+	// keyword may carry meaning for other tooling, so an unrecognized keyword is
+	// legal input rather than a defect. What is recorded is this compiler's own
+	// decision — that it read no meaning from the keyword and kept the text — which
+	// is the same thing ValidationOnlyKeyword records beside it.
+	UnknownSchemaKeyword = "openapi/unknown-schema-keyword"
+	// UnknownObjectKey reports a key on an OpenAPI object that the specification
+	// neither defines nor admits as an extension, kept verbatim under Unmodeled.
+	//
+	// Warning rather than info, because unlike its schema neighbour this one is a
+	// defect: OpenAPI gives its objects a closed key set and requires every
+	// extension to be prefixed x-, so a key that is neither is a document error —
+	// in practice a misspelling of the field beside it, which is precisely the
+	// class of mistake that survives when the compiler swallows the key in silence.
+	//
+	// Warning rather than error for the reason ReservedHeaderName is one: the
+	// document still lowers, everything the key was written beside is unaffected,
+	// and harness.Check stops at the first error diagnostic, which would hide every
+	// later finding in the same spec and make any fixture carrying a stray key
+	// unable to reach the invariant checks.
+	UnknownObjectKey = "openapi/unknown-object-key"
+	// UnknownKeyBudget reports an object declaring more keys the model does not
+	// name than the compiler keeps, so the ones past the bound reached the IR in no
+	// form at all.
+	//
+	// Every collection here is bounded, and this one is over a key set the document
+	// chooses the size of. The bound is far above what any document writes by
+	// accident, so tripping it is either a generated file or a hostile one; the
+	// diagnostic is what keeps the discarded remainder from being a silent loss.
+	UnknownKeyBudget = "openapi/unknown-key-budget"
 )
 
 // Newf builds an ir.Diagnostic with a formatted message. It is the single
diff --git a/compilers/openapi/internal/diag/diag_test.go b/compilers/openapi/internal/diag/diag_test.go
index 26e351a..8b17208 100644
--- a/compilers/openapi/internal/diag/diag_test.go
+++ b/compilers/openapi/internal/diag/diag_test.go
@@ -138,6 +138,7 @@ func codes() []string {
 		diag.AliasAmplification, diag.UnattachableRequired, diag.InternalInvariant,
 		diag.DuplicateOperationID, diag.IncompleteSecurityScheme,
 		diag.ReservedHeaderName, diag.UnpreservableConstruct,
+		diag.UnknownSchemaKeyword, diag.UnknownObjectKey, diag.UnknownKeyBudget,
 	}
 }
 
diff --git a/compilers/openapi/internal/operation/content.go b/compilers/openapi/internal/operation/content.go
index c202731..94bb76f 100644
--- a/compilers/openapi/internal/operation/content.go
+++ b/compilers/openapi/internal/operation/content.go
@@ -88,7 +88,8 @@ func lowerContent(c lowering.Ctx, ts *compile.Types, anchors *schema.AnchorIndex
 	if len(ext) > 0 {
 		content.Unmodeled = annotation.MergeUnmodeled(content.Unmodeled, ext)
 	}
-	return content, diags
+	return content, append(diags,
+		annotation.UnknownKeysIn(&content.Unmodeled, media, c.SrcIndex, mediaPtr)...)
 }
 
 // fillSequential lowers 3.2 sequential-media fields: itemSchema becomes the
@@ -512,7 +513,7 @@ func applyHeaderAnnotations(c lowering.Ctx, p *ir.Property, h *soa.Header, hdecl
 	hExt, extDiags := schema.ExtensionsOf(c, h.GetExtensions(), hdecl)
 	diags = append(diags, extDiags...)
 	p.Unmodeled = annotation.MergeUnmodeled(p.Unmodeled, hExt)
-	return diags
+	return append(diags, annotation.UnknownKeysIn(&p.Unmodeled, h, c.SrcIndex, hdecl)...)
 }
 
 // exampleList lowers a single example node and a plural example map into value
@@ -604,6 +605,11 @@ func lowerRequestBody(c lowering.Ctx, ts *compile.Types, anchors *schema.AnchorI
 		diags = append(diags, c.DiagAt(ir.SeverityInfo, diag.DegradedConstruct, bodyPtr,
 			"request body is not required; optionality kept under Unmodeled"))
 	}
+	// After the payload guard, because ir.Payload is the body's only carrier: a
+	// request body declaring no content lowers to nothing to hang them on, and
+	// OpenAPI makes content REQUIRED there, so such a body is a defect in the
+	// document rather than a shape this compiler has to place.
+	diags = append(diags, annotation.UnknownKeysIn(&payload.Unmodeled, rb, c.SrcIndex, bodyPtr)...)
 	op.Request = payload
 	hb.RequestContentTypes = contentTypeKeys(rb.GetContent())
 	return diags
diff --git a/compilers/openapi/internal/operation/operations.go b/compilers/openapi/internal/operation/operations.go
index 351fb05..0c3bf09 100644
--- a/compilers/openapi/internal/operation/operations.go
+++ b/compilers/openapi/internal/operation/operations.go
@@ -293,6 +293,7 @@ func lowerOperation(c lowering.Ctx, ts *compile.Types, anchors *schema.AnchorInd
 		op.Unmodeled = ext
 	}
 	// After the extensions assignment, which would otherwise overwrite the map.
+	diags = append(diags, annotation.UnknownKeysIn(&op.Unmodeled, src, c.SrcIndex, decl)...)
 	diags = append(diags, applyOperationServers(c, &op, src, decl)...)
 	return op, extra, append(diags, checkOperationIDUnique(c, operationIDs, op, mount)...)
 }
@@ -465,7 +466,20 @@ func lowerResponse(c lowering.Ctx, ts *compile.Types, anchors *schema.AnchorInde
 	resp.Docs.Description = r.GetDescription()
 	_, linkDiags := schema.PreserveNode(c, &resp.Unmodeled, "openapi:links",
 		annotation.RawChildNode(r.GetRootNode(), "links"), ir.ReasonNoIRHome, rptr+ids.Ptr("links"))
-	return resp, append(diags, linkDiags...)
+	diags = append(diags, linkDiags...)
+	return resp, append(diags, preserveResponseUnknownKeys(c, &resp.Unmodeled, r, rptr)...)
+}
+
+// preserveResponseUnknownKeys keeps the keys a Response Object writes that the
+// specification does not define.
+//
+// One helper for both branches on purpose. ir.Response and ir.ErrorCase are two
+// lowerings of the same source object, and a construct kept on only one of them
+// makes a declaration survive or vanish on nothing but its status code — which
+// is how a response's links came to be kept on a 2xx and dropped on a 4xx
+// (GitHub #275).
+func preserveResponseUnknownKeys(c lowering.Ctx, p *ir.Unmodeled, r *soa.Response, rptr string) []ir.Diagnostic {
+	return annotation.UnknownKeysIn(p, r, c.SrcIndex, rptr)
 }
 
 // responseName builds a success response's neutral naming. OpenAPI names no
@@ -497,7 +511,8 @@ func lowerErrorCase(c lowering.Ctx, ts *compile.Types, anchors *schema.AnchorInd
 	}
 	ec.Docs.Description = r.GetDescription()
 	diags := fillErrorType(c, ts, anchors, &ec, r, rptr)
-	return ec, append(diags, preserveErrorHeaders(c, &ec, r, rptr)...)
+	diags = append(diags, preserveErrorHeaders(c, &ec, r, rptr)...)
+	return ec, append(diags, preserveResponseUnknownKeys(c, &ec.Unmodeled, r, rptr)...)
 }
 
 // preserveErrorHeaders keeps an error response's headers from being dropped:
diff --git a/compilers/openapi/internal/operation/params.go b/compilers/openapi/internal/operation/params.go
index e0875ee..c7bcc3a 100644
--- a/compilers/openapi/internal/operation/params.go
+++ b/compilers/openapi/internal/operation/params.go
@@ -201,7 +201,10 @@ func fillParamSchemaAnnotations(c lowering.Ctx, ts *compile.Types, param *ir.Par
 		diags = append(diags, preserveParamXML(c, param, s, pointer)...)
 	}
 	param.Unmodeled = annotation.MergeUnmodeled(param.Unmodeled, a.Unmodeled)
-	return diags
+	// Last, per schema.PreserveUnknownKeywords: it keeps only the keywords no
+	// reader above it kept, and everything annotation.Read recorded is already on
+	// the parameter by this line.
+	return append(diags, schema.PreserveUnknownKeywords(c, &param.Unmodeled, s, pointer)...)
 }
 
 // preserveParamXML keeps a parameter schema's xml hints instead of dropping
@@ -274,6 +277,7 @@ func fillParamDetail(c lowering.Ctx, param *ir.Parameter, p *soa.Parameter, pptr
 	pExt, extDiags := schema.ExtensionsOf(c, p.GetExtensions(), pptr)
 	diags = append(diags, extDiags...)
 	param.Unmodeled = annotation.MergeUnmodeled(param.Unmodeled, pExt)
+	diags = append(diags, annotation.UnknownKeysIn(&param.Unmodeled, p, c.SrcIndex, pptr)...)
 	return append(diags, preserveAllowEmptyValue(c, param, p, pptr)...)
 }
 
diff --git a/compilers/openapi/internal/schema/accumulate.go b/compilers/openapi/internal/schema/accumulate.go
index bf2a5fa..836687c 100644
--- a/compilers/openapi/internal/schema/accumulate.go
+++ b/compilers/openapi/internal/schema/accumulate.go
@@ -73,6 +73,20 @@ func PreserveSchemaKeyword(c lowering.Ctx, p *ir.Unmodeled, s *oas3.Schema, keyw
 	return PreserveNode(c, p, "openapi:"+keyword, annotation.RawPropertyNode(s, keyword), reason, pointer)
 }
 
+// PreserveUnknownKeywords records every keyword s writes that no field of the
+// schema model names and no reader above it already kept (GitHub #297).
+//
+// It is the last thing an attachment does, which is the contract
+// annotation.UnknownKeywordsIn states and the reason it is called here rather
+// than from inside annotation.Read with the other readers: $dynamicRef has no
+// field in the schema model either and is decided by recordUnexpandedDynamicRef,
+// which runs after Read and deliberately keeps nothing once the reference has
+// expanded. A census running before it could not tell that from an unread
+// keyword.
+func PreserveUnknownKeywords(c lowering.Ctx, p *ir.Unmodeled, s *oas3.Schema, pointer string) []ir.Diagnostic {
+	return annotation.UnknownKeywordsIn(p, s, pointer, c.SrcIndex)
+}
+
 // preserveKeyword records a validation-only keyword's raw payload under key in
 // p and returns the one info diagnostic naming it at declPtr, the schema that
 // wrote it. An absent or unconvertible payload records nothing and returns
diff --git a/compilers/openapi/internal/schema/schema.go b/compilers/openapi/internal/schema/schema.go
index d06d1eb..b5cc509 100644
--- a/compilers/openapi/internal/schema/schema.go
+++ b/compilers/openapi/internal/schema/schema.go
@@ -894,7 +894,8 @@ func fillPropertyAnnotations(c lowering.Ctx, ts *compile.Types, anchors *AnchorI
 	// nil node: this arm runs only when the schema lowered to no node of its own,
 	// so nothing here can be carrying an Encoding.
 	diags = append(diags, recordUnplacedContent(c, &p.Unmodeled, ref, nil, pointer)...)
-	return append(diags, recordUnexpandedDynamicRef(c, anchors, &p.Unmodeled, ref, pointer)...)
+	diags = append(diags, recordUnexpandedDynamicRef(c, anchors, &p.Unmodeled, ref, pointer)...)
+	return append(diags, PreserveUnknownKeywords(c, &p.Unmodeled, ref, pointer)...)
 }
 
 // LoweredToOwnNode reports whether the declaration at pointer lowered to a type
@@ -978,7 +979,8 @@ func attachDeclaredAnnotations(c lowering.Ctx, ts *compile.Types, anchors *Ancho
 		common.Examples = a.Examples
 	}
 	diags = append(diags, recordUnplacedContent(c, &common.Unmodeled, s, td, pointer)...)
-	return append(diags, recordUnexpandedDynamicRef(c, anchors, &common.Unmodeled, s, pointer)...)
+	diags = append(diags, recordUnexpandedDynamicRef(c, anchors, &common.Unmodeled, s, pointer)...)
+	return append(diags, PreserveUnknownKeywords(c, &common.Unmodeled, s, pointer)...)
 }
 
 // fillAdditional lowers additionalProperties, patternProperties, and
diff --git a/compilers/openapi/meta.go b/compilers/openapi/meta.go
index 23191d2..b46de47 100644
--- a/compilers/openapi/meta.go
+++ b/compilers/openapi/meta.go
@@ -1,10 +1,13 @@
 package openapi
 
 import (
+	"strconv"
+
 	soa "github.com/speakeasy-api/openapi/openapi"
 
 	"github.com/dexpace/morphic/compilers/compile"
 	"github.com/dexpace/morphic/compilers/openapi/internal/annotation"
+	"github.com/dexpace/morphic/compilers/openapi/internal/ids"
 	"github.com/dexpace/morphic/compilers/openapi/internal/lowering"
 	"github.com/dexpace/morphic/ir"
 )
@@ -38,11 +41,74 @@ type docMeta struct {
 // service graph: info, servers, and top-level extensions (ir-design §10, §12).
 func lowerMeta(c lowering.Ctx) (docMeta, []ir.Diagnostic) {
 	m := lowerInfo(c)
-	m.Servers = lowerServers(c)
+
+	servers, serverDiags := lowerServers(c)
+	m.Servers = servers
 
 	ext, diags := annotation.ExtensionsFrom(c.Doc.GetExtensions(), c.SrcIndex, "")
 	m.Unmodeled = ext
-	return m, diags
+	diags = append(diags, serverDiags...)
+	return m, append(diags, documentUnknownKeys(c, &m.Unmodeled)...)
+}
+
+// documentUnknownKeys collects the keys the OpenAPI model names no field for
+// from every object around the document metadata that lowers to no node of its
+// own: the document root, the info block and the contact and license inside it,
+// the root externalDocs, and each declared tag.
+//
+// ir.Document is the nearest node with an Unmodeled map for all of them, so each
+// object's keys are scoped by the source path they were written at. One unscoped
+// "openapi:status" would be a single key for six objects, and the entry that
+// survived would be whichever site ran last.
+func documentUnknownKeys(c lowering.Ctx, p *ir.Unmodeled) []ir.Diagnostic {
+	sites := append(rootUnknownSites(c), tagUnknownSites(c)...)
+	diags := make([]ir.Diagnostic, 0, len(sites))
+	for _, site := range sites {
+		diags = append(diags,
+			annotation.UnknownKeysUnder(p, site.model, c.SrcIndex, site.owner, site.scope)...)
+	}
+	return diags
+}
+
+// unknownSite is one object's census: what it keys under on the carrier holding
+// it, the object's own source pointer, and the parsed object itself.
+type unknownSite struct {
+	scope string
+	owner string
+	model any
+}
+
+// rootUnknownSites returns the census sites a document has exactly one of. The
+// root's keys take no scope, since ir.Document stands for the OpenAPI Object
+// itself; the rest are keyed by the path from it down to the object that wrote
+// them.
+func rootUnknownSites(c lowering.Ctx) []unknownSite {
+	info := c.Doc.GetInfo()
+	infoPtr := ids.Ptr("info")
+	return []unknownSite{
+		{"", "", c.Doc},
+		{"info", infoPtr, info},
+		{"info/contact", infoPtr + ids.Ptr("contact"), info.GetContact()},
+		{"info/license", infoPtr + ids.Ptr("license"), info.GetLicense()},
+		{"externalDocs", ids.Ptr("externalDocs"), c.Doc.GetExternalDocs()},
+	}
+}
+
+// tagUnknownSites returns one census site per declared tag, since ir.TagDef
+// holds no Unmodeled map for a tag's own keys to land on.
+//
+// Scoped by index rather than name, which is the pointer a tag is written at. A
+// name would read better, but OpenAPI's requirement that tag names be unique is
+// the document's to keep and not this compiler's to rely on: two tags spelled
+// alike would silently leave one entry.
+func tagUnknownSites(c lowering.Ctx) []unknownSite {
+	tags := c.Doc.GetTags()
+	out := make([]unknownSite, 0, len(tags))
+	for i, t := range tags {
+		index := strconv.Itoa(i)
+		out = append(out, unknownSite{"tags/" + index, ids.Ptr("tags", index), t})
+	}
+	return out
 }
 
 // lowerInfo maps info onto the document identity, docs, contact, and license.
@@ -79,31 +145,37 @@ func infoDocs(c lowering.Ctx, info *soa.Info) ir.Docs {
 // template, description, and templated variables (ir-design §10). It returns nil
 // rather than an empty slice when every entry was skipped, so a document
 // declaring no usable server leaves the field unset.
-func lowerServers(c lowering.Ctx) []ir.Server {
+func lowerServers(c lowering.Ctx) ([]ir.Server, []ir.Diagnostic) {
 	// GetServers never returns an empty slice — it injects a default "/" server
 	// when none are declared — so the loop always runs at least once.
 	servers := c.Doc.GetServers()
 	out := make([]ir.Server, 0, len(servers))
-	for _, s := range servers {
+	var diags []ir.Diagnostic
+	for i, s := range servers {
 		if s == nil {
 			continue
 		}
-		out = append(out, lowerServer(s))
+		one, serverDiags := lowerServer(c, s, ids.Ptr("servers", strconv.Itoa(i)))
+		diags = append(diags, serverDiags...)
+		out = append(out, one)
 	}
 	if len(out) == 0 {
-		return nil
+		return nil, diags
 	}
-	return out
+	return out, diags
 }
 
-// lowerServer lowers one server, named by serverName.
-func lowerServer(s *soa.Server) ir.Server {
-	return ir.Server{
+// lowerServer lowers one server, named by serverName; sptr is the server's own
+// pointer in the servers list.
+func lowerServer(c lowering.Ctx, s *soa.Server, sptr string) (ir.Server, []ir.Diagnostic) {
+	vars, diags := serverVariables(c, s, sptr)
+	out := ir.Server{
 		Name:        serverName(s),
 		URLTemplate: s.GetURL(),
 		Description: ir.Docs{Description: s.GetDescription()},
-		Variables:   serverVariables(s),
+		Variables:   vars,
 	}
+	return out, append(diags, annotation.UnknownKeysIn(&out.Unmodeled, s, c.SrcIndex, sptr)...)
 }
 
 // serverName builds a server's neutral naming: the declared name when the source
@@ -134,22 +206,26 @@ func serverName(s *soa.Server) ir.Naming {
 
 // serverVariables lowers a server's URL template variables in source order, or
 // nil when it declares none.
-func serverVariables(s *soa.Server) []ir.ServerVariable {
+func serverVariables(c lowering.Ctx, s *soa.Server, sptr string) ([]ir.ServerVariable, []ir.Diagnostic) {
 	vars := s.GetVariables()
 	if vars == nil || vars.Len() == 0 {
-		return nil
+		return nil, nil
 	}
 	out := make([]ir.ServerVariable, 0, vars.Len())
+	var diags []ir.Diagnostic
 	for name, v := range vars.All() {
 		if v == nil {
 			continue
 		}
-		out = append(out, ir.ServerVariable{
+		one := ir.ServerVariable{
 			Name:    name,
 			Default: v.GetDefault(),
 			Enum:    v.GetEnum(),
 			Docs:    ir.Docs{Description: v.GetDescription()},
-		})
+		}
+		diags = append(diags, annotation.UnknownKeysIn(&one.Unmodeled, v, c.SrcIndex,
+			sptr+ids.Ptr("variables", name))...)
+		out = append(out, one)
 	}
-	return out
+	return out, diags
 }
diff --git a/compilers/openapi/meta_test.go b/compilers/openapi/meta_test.go
index 528f624..212936e 100644
--- a/compilers/openapi/meta_test.go
+++ b/compilers/openapi/meta_test.go
@@ -103,7 +103,7 @@ func TestServerName_DerivedFromURLWhenUnnamed(t *testing.T) {
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			assert.Equal(t, tc.want, lowerServer(&soa.Server{URL: tc.url}).Name)
+			assert.Equal(t, tc.want, serverName(&soa.Server{URL: tc.url}))
 		})
 	}
 }
@@ -114,9 +114,9 @@ func TestServerName_DerivedFromURLWhenUnnamed(t *testing.T) {
 // both servers the same.
 func TestServerName_DistinguishesServersDifferingOnlyInPath(t *testing.T) {
 	t.Parallel()
-	v1 := lowerServer(&soa.Server{URL: "https://api.example.com/v1"})
-	v2 := lowerServer(&soa.Server{URL: "https://api.example.com/v2"})
-	assert.NotEqual(t, v1.Name.Hint, v2.Name.Hint, "two distinct servers get two distinct hints")
+	v1 := serverName(&soa.Server{URL: "https://api.example.com/v1"})
+	v2 := serverName(&soa.Server{URL: "https://api.example.com/v2"})
+	assert.NotEqual(t, v1.Hint, v2.Hint, "two distinct servers get two distinct hints")
 }
 
 // TestServerName_CollidesOnPunctuationAlone bounds that claim, which must not be
@@ -126,17 +126,18 @@ func TestServerName_DistinguishesServersDifferingOnlyInPath(t *testing.T) {
 // known bound rather than a later discovery.
 func TestServerName_CollidesOnPunctuationAlone(t *testing.T) {
 	t.Parallel()
-	dotted := lowerServer(&soa.Server{URL: "https://api.example.com/v1"})
-	dashed := lowerServer(&soa.Server{URL: "https://api.example.com/v-1"})
-	assert.Equal(t, dotted.Name.Hint, dashed.Name.Hint,
+	dotted := serverName(&soa.Server{URL: "https://api.example.com/v1"})
+	dashed := serverName(&soa.Server{URL: "https://api.example.com/v-1"})
+	assert.Equal(t, dotted.Hint, dashed.Hint,
 		"neutral words carry no punctuation, so these two collide")
 }
 
 func TestLowerServers_NilEntrySkipped(t *testing.T) {
 	t.Parallel()
 	doc := &soa.OpenAPI{Servers: []*soa.Server{nil, {URL: "https://x.example.com"}}}
-	got := lowerServers(lowering.Ctx{Doc: doc})
+	got, diags := lowerServers(lowering.Ctx{Doc: doc})
 
+	assert.Empty(t, diags)
 	require.Len(t, got, 1, "nil server entry skipped, valid one lowered")
 	assert.Equal(t, "https://x.example.com", got[0].URLTemplate)
 }
@@ -147,7 +148,8 @@ func TestServerVariables_NilEntrySkipped(t *testing.T) {
 		sequencedmap.NewElem("skip", (*soa.ServerVariable)(nil)),
 		sequencedmap.NewElem("keep", &soa.ServerVariable{}),
 	)
-	srv := lowerServer(&soa.Server{URL: "https://x", Variables: vars})
+	srv, diags := lowerServer(lowering.Ctx{}, &soa.Server{URL: "https://x", Variables: vars}, "/servers/0")
+	assert.Empty(t, diags)
 	require.Len(t, srv.Variables, 1, "nil variable entry skipped")
 	assert.Equal(t, "keep", srv.Variables[0].Name)
 }
@@ -159,5 +161,7 @@ func TestLowerServers_EveryEntrySkippedIsNil(t *testing.T) {
 	t.Parallel()
 	doc := &soa.OpenAPI{Servers: []*soa.Server{nil, nil}}
 
-	assert.Nil(t, lowerServers(lowering.Ctx{Doc: doc}))
+	got, diags := lowerServers(lowering.Ctx{Doc: doc})
+	assert.Nil(t, got)
+	assert.Empty(t, diags)
 }
diff --git a/compilers/openapi/unknownkeys_test.go b/compilers/openapi/unknownkeys_test.go
new file mode 100644
index 0000000..ba0d55a
--- /dev/null
+++ b/compilers/openapi/unknownkeys_test.go
@@ -0,0 +1,200 @@
+// This file covers one property: a key the OpenAPI model names no field for
+// reaches the IR rather than vanishing between the parser and the lowering. It
+// is separate from annotations_test.go because the subject is the complement of
+// what the model names, not any one annotation.
+package openapi_test // external test package — exercises only the public API
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexpace/morphic/ir"
+)
+
+// unknownKeysSpec reads the census fixture the corpus sweeps also drive, so the
+// assertions below and the six oracles run over the same bytes: putting it under
+// testdata is what gets it compiled in both declaration orders, round-tripped and
+// verified, none of which a spec written inline reaches.
+func unknownKeysSpec(t *testing.T) string {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join("..", "..", "testdata", "openapi", "unknown_keys.yaml"))
+	require.NoError(t, err)
+	return string(data)
+}
+
+// TestUnknownKeys_KeptAtEveryObject holds the whole rule rather than the
+// positions that happened to be noticed. A key the model does not name reached
+// no IR field, no Unmodeled entry and no diagnostic at every one of these
+// objects, so two documents differing only in it compiled to the same IR
+// (GitHub #297).
+//
+// Carriers are derived from the value graph rather than named: each row says
+// which Unmodeled map the entry must land on by the path the walk reaches it at,
+// so an entry written to the wrong carrier fails here rather than passing
+// because the assertion looked only where it expected.
+func TestUnknownKeys_KeptAtEveryObject(t *testing.T) {
+	t.Parallel()
+	doc, diags := compileAnnotationSpec(t, "unknown-keys", unknownKeysSpec(t))
+	requireNoErrorDiagnostics(t, diags)
+	sites := unmodeledSitesOf(doc)
+
+	for _, tc := range []struct {
+		object  string
+		key     string
+		want    string
+		carrier string
+	}{
+		{"openapi root", "openapi:basePath", `"ROOT"`, "doc.Unmodeled"},
+		{"info", "openapi:info/contactEmail", `"INFO"`, "doc.Unmodeled"},
+		{"contact", "openapi:info/contact/slack", `"CONTACT"`, "doc.Unmodeled"},
+		{"license", "openapi:info/license/spdx", `"LICENSE"`, "doc.Unmodeled"},
+		{"externalDocs", "openapi:externalDocs/title", `"EXTERNALDOCS"`, "doc.Unmodeled"},
+		{"server", "openapi:host", `"SERVER"`, "doc.Servers[0].Unmodeled"},
+		{"server variable", "openapi:example", `"SERVERVARIABLE"`, "doc.Servers[0].Variables[0].Unmodeled"},
+		{"tag", "openapi:tags/0/color", `"TAG"`, "doc.Unmodeled"},
+		{"operation", "openapi:operationid", `"OPERATION"`, ".Unmodeled"},
+		{"parameter", "openapi:collectionFormat", `"PARAMETER"`, ".Params[0].Unmodeled"},
+		{"request body", "openapi:schema", `"REQUESTBODY"`, ".Request.Unmodeled"},
+		{"media type", "openapi:format", `"MEDIATYPE"`, ".Contents[0].Unmodeled"},
+		{"response", "openapi:status", `"RESPONSE"`, ".Responses[0].Unmodeled"},
+		{"error response", "openapi:status", `"ERRORRESPONSE"`, ".Errors[0].Unmodeled"},
+		{"header", "openapi:in", `"HEADER"`, ".Headers[0].Unmodeled"},
+		{"security scheme", "openapi:tokenUrl", `"SECURITYSCHEME"`,
+			"doc.Auth[auth/openapi/components/securitySchemes/k].Unmodeled"},
+		{"schema", "openapi:additionalItems", `"SCHEMA"`,
+			"doc.Types[t/openapi/components/schemas/S].Unmodeled"},
+		// The property's schema reduced to a shared primitive, so it owns no node
+		// and its keywords stay on the declaring property — the carrier rule
+		// fillPropertyAnnotations already applies to every other annotation.
+		{"property schema", "openapi:divisibleBy", `"PROPERTYSCHEMA"`,
+			"doc.Types[t/openapi/components/schemas/S].Properties[0].Unmodeled"},
+	} {
+		site, found := findUnmodeledSite(sites, tc.key, tc.want)
+		if !assert.True(t, found, "%s drops %s = %s: it is nowhere in the document",
+			tc.object, tc.key, tc.want) {
+			continue
+		}
+		assert.Contains(t, site.path, tc.carrier, "%s key lands on the wrong carrier", tc.object)
+	}
+}
+
+// TestUnknownKeys_SchemaAndObjectAreGradedApart pins the one distinction the
+// census turns on, at the two keys the fixture picks for it: a draft-07
+// additionalItems in a schema, and an operationId with the case wrong on an
+// operation.
+//
+// JSON Schema states that an implementation must ignore a keyword it does not
+// recognize, so an unrecognized keyword in a schema is legal input and may carry
+// meaning for other tooling; OpenAPI states that an extension key must be
+// prefixed x-, so an undefined key on one of its objects is not an extension but
+// a defect in the document.
+//
+// Both are kept — invariant 2 does not bend for invalid input — and both carry
+// the same reason, because "no IR node is coming" is true of each. What differs
+// is what the document did, which is the diagnostic channel's subject: an
+// unrecognized keyword records a decision at info, and an undefined key reports
+// a fault at warning.
+func TestUnknownKeys_SchemaAndObjectAreGradedApart(t *testing.T) {
+	t.Parallel()
+	doc, diags := compileAnnotationSpec(t, "unknown-keys", unknownKeysSpec(t))
+	requireNoErrorDiagnostics(t, diags)
+
+	schema, ok := doc.Types[ir.TypeID("t/openapi/components/schemas/S")]
+	require.True(t, ok)
+	keyword := unmodeledEntry(t, schema.Common().Unmodeled, "openapi:additionalItems")
+	assert.Equal(t, ir.ReasonOutOfScope, keyword.Reason,
+		"no IR node is coming for a keyword this compiler does not model")
+	assert.Equal(t, "/components/schemas/S/additionalItems", keyword.Provenance.Pointer)
+	assert.Equal(t, []ir.Severity{ir.SeverityInfo},
+		diagsAt(diags, "openapi/unknown-schema-keyword", "/components/schemas/S/additionalItems"))
+
+	op, ok := opByName(doc, "listWidgets")
+	require.True(t, ok)
+	key := unmodeledEntry(t, op.Unmodeled, "openapi:operationid")
+	assert.Equal(t, ir.ReasonOutOfScope, key.Reason,
+		"OpenAPI defines no such key, so no IR node is coming for it either")
+	assert.Equal(t, "/paths/~1widgets/get/operationid", key.Provenance.Pointer)
+	assert.Equal(t, []ir.Severity{ir.SeverityWarning},
+		diagsAt(diags, "openapi/unknown-object-key", "/paths/~1widgets/get/operationid"))
+}
+
+// TestUnknownKeys_WellFormedDocumentRecordsNothing is the control the census
+// needs: a document writing only what the model names keeps no entry and reports
+// no finding, so the rows above are evidence of the keys they name rather than
+// of a sweep that fires on everything.
+func TestUnknownKeys_WellFormedDocumentRecordsNothing(t *testing.T) {
+	t.Parallel()
+	doc, diags := compileAnnotationSpec(t, "clean", `openapi: 3.1.0
+info: {title: T, version: "1"}
+paths:
+  /widgets:
+    get:
+      operationId: listWidgets
+      responses: {"200": {description: ok}}
+components:
+  schemas:
+    S: {type: object, properties: {a: {type: string}}}
+`)
+	requireNoErrorDiagnostics(t, diags)
+
+	assert.Empty(t, unmodeledSitesOf(doc), "nothing undeclared, so nothing kept")
+	for _, d := range diags {
+		assert.NotContains(t, d.Code, "unknown-", "a well-formed document reports no unknown key: %+v", d)
+	}
+}
+
+// unmodeledSite is one Unmodeled entry paired with the walk path of the map
+// holding it.
+type unmodeledSite struct {
+	key   string
+	path  string
+	entry ir.UnmodeledEntry
+}
+
+// unmodeledSitesOf returns every Unmodeled entry the document holds, found by
+// walking the value graph rather than by naming the carriers a test expects.
+func unmodeledSitesOf(doc *ir.Document) []unmodeledSite {
+	unmodeledType := reflect.TypeOf(ir.Unmodeled(nil))
+	var out []unmodeledSite
+	ir.WalkValues(doc, ir.DocumentPath, func(v reflect.Value, path string) bool {
+		if v.Type() != unmodeledType || !v.CanInterface() {
+			return true
+		}
+		u, ok := v.Interface().(ir.Unmodeled)
+		if !ok {
+			return true
+		}
+		for key, entry := range u {
+			out = append(out, unmodeledSite{key: key, path: path, entry: entry})
+		}
+		return true
+	})
+	return out
+}
+
+// findUnmodeledSite returns the site holding key with the given JSON value. The
+// value is part of the match because one key spelling occurs at several
+// carriers — "openapi:status" is written on two responses in this fixture — so
+// matching on the key alone would find another object's entry and call it a
+// pass.
+func findUnmodeledSite(sites []unmodeledSite, key, wantJSON string) (unmodeledSite, bool) {
+	for _, site := range sites {
+		if site.key == key && string(site.entry.Value) == wantJSON {
+			return site, true
+		}
+	}
+	return unmodeledSite{}, false
+}
+
+// requireNoErrorDiagnostics fails the test on the first error-severity
+// diagnostic, naming it.
+func requireNoErrorDiagnostics(t *testing.T, diags []ir.Diagnostic) {
+	t.Helper()
+	d, ok := ir.FirstError(diags)
+	require.False(t, ok, "unexpected error diagnostic: %+v", d)
+}
diff --git a/testdata/conformance/openapi/allof-oneof-cooccurrence.golden.json b/testdata/conformance/openapi/allof-oneof-cooccurrence.golden.json
index c43e993..3218cb4 100644
--- a/testdata/conformance/openapi/allof-oneof-cooccurrence.golden.json
+++ b/testdata/conformance/openapi/allof-oneof-cooccurrence.golden.json
@@ -44,7 +44,7 @@
       },
       "anonymous": true,
       "docs": {
-        "description": "named by position"
+        "description": "named by position, not by target"
       },
       "sensitive": false,
       "provenance": {
@@ -366,7 +366,7 @@
           "eventPayload": false,
           "secret": false,
           "docs": {
-            "description": "named by position"
+            "description": "named by position, not by target"
           },
           "provenance": {
             "source": 0,
@@ -548,7 +548,7 @@
     {
       "format": "openapi@3.1",
       "path": "allof-oneof-cooccurrence.yaml",
-      "hash": "cb7fb6bc613222b0211fc363b9028e7739b44a1d14b04f74cf709b8d603655f2"
+      "hash": "580c2ffd45b8b24e175b4c5b7f1af6c237a920de7d1942d84b10a00ad2dc1e33"
     }
   ]
 }
diff --git a/testdata/conformance/openapi/allof-oneof-cooccurrence.yaml b/testdata/conformance/openapi/allof-oneof-cooccurrence.yaml
index f085da9..042727d 100644
--- a/testdata/conformance/openapi/allof-oneof-cooccurrence.yaml
+++ b/testdata/conformance/openapi/allof-oneof-cooccurrence.yaml
@@ -56,5 +56,5 @@ components:
         branch: {$ref: '#/components/schemas/InlineHost/oneOf/0'}
     InlineHost:
       oneOf:
-        - {type: integer, description: named by position, not by target}
+        - {type: integer, description: 'named by position, not by target'}
         - {type: string}
diff --git a/testdata/conformance/openapi/unwitnessed.golden.txt b/testdata/conformance/openapi/unwitnessed.golden.txt
index 0ef3569..ca1e200 100644
--- a/testdata/conformance/openapi/unwitnessed.golden.txt
+++ b/testdata/conformance/openapi/unwitnessed.golden.txt
@@ -195,8 +195,6 @@ Server.Bindings
 Server.Protocol
 Server.ProtocolVersion
 Server.Tags
-Server.Unmodeled
-ServerVariable.Unmodeled
 Service.CommonErrors
 Service.Extends
 Service.Namespace
diff --git a/testdata/openapi/unknown_keys.yaml b/testdata/openapi/unknown_keys.yaml
new file mode 100644
index 0000000..7a49ac0
--- /dev/null
+++ b/testdata/openapi/unknown_keys.yaml
@@ -0,0 +1,59 @@
+# One key the OpenAPI model names no field for at every object the compiler takes
+# a census from, each valued with the object it was written on so an entry found
+# at the wrong carrier cannot pass for the right one.
+#
+# Every key here is one real documents carry rather than invented nonsense: a
+# Swagger 2.0 field with no OpenAPI 3 equivalent (basePath, host, a body
+# parameter's schema), a keyword from an older JSON Schema draft (additionalItems,
+# divisibleBy), a field belonging to a neighbouring object (a flow's tokenUrl on
+# the scheme, a parameter's `in` on a header), or operationId with the case wrong.
+# None of them reached an IR field, an Unmodeled entry or a diagnostic.
+openapi: 3.1.0
+basePath: ROOT
+info:
+  title: T
+  version: "1"
+  contactEmail: INFO
+  contact: {name: n, slack: CONTACT}
+  license: {name: MIT, spdx: LICENSE}
+externalDocs: {url: 'https://d.example', title: EXTERNALDOCS}
+servers:
+  - url: 'https://a.example/{region}'
+    host: SERVER
+    variables:
+      region: {default: us, example: SERVERVARIABLE}
+tags:
+  - {name: t1, color: TAG}
+paths:
+  /widgets:
+    get:
+      operationId: listWidgets
+      tags: [t1]
+      operationid: OPERATION
+      parameters:
+        - {name: shape, in: query, schema: {type: string}, collectionFormat: PARAMETER}
+      requestBody:
+        required: true
+        schema: REQUESTBODY
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/S'}
+            format: MEDIATYPE
+      responses:
+        "200":
+          description: ok
+          status: RESPONSE
+          headers:
+            X-Trace: {schema: {type: string}, in: HEADER}
+        "404":
+          description: gone
+          status: ERRORRESPONSE
+components:
+  securitySchemes:
+    k: {type: apiKey, in: header, name: X-Key, tokenUrl: SECURITYSCHEME}
+  schemas:
+    S:
+      type: object
+      additionalItems: SCHEMA
+      properties:
+        a: {type: string, divisibleBy: PROPERTYSCHEMA}