JSON Validator: separate syntax from application rules

“One pass” should mean parse once and carry the typed result forward. First enforce byte, depth and key-count limits; then perform strict syntax parsing, duplicate-key checks, schema validation and business rules. Only successful data should be pretty-printed, and downstream nodes should consume the parsed object instead of reparsing decorative text. The error output needs a stable code and bounded path without reflecting secrets. If canonical JSON is required for hashing or signing, define that separately from human-readable formatting.