fix: Address code review for combinator validation

- Corrected misleading comment in validateOneOf (was "count misses",
  now "branch did not match; continue")
- Added empty-options regression tests for allOf, anyOf, and oneOf
  to pin JSON Schema vacuous-truth / immediate-failure behaviour
- Added null-value tests for not(NullSchema) and anyOf-with-NullSchema
  to document combinator null-passthrough behaviour
- Replaced verbose fully-qualified org.assertj.core.api.Assertions.assertThat
  calls with static import in DefaultValidatorDispatchTest

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: thced

src/main/java/com/retailsvc/http/validate/DefaultValidator.java

@@ -314,7 +314,7 @@ private void validateOneOf(Object value, List<Schema> options, String pointer) {
         validate(value, o, pointer);
         matched++;
       } catch (ValidationException ignored) {
-        // count misses
+        // branch did not match; continue
       }
     }
     if (matched != 1) {

src/test/java/com/retailsvc/http/validate/DefaultValidatorDispatchTest.java

@@ -1,5 +1,6 @@
 package com.retailsvc.http.validate;
 
+import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 import com.retailsvc.http.ValidationException;
@@ -96,8 +97,8 @@ void oneOfFailsWhenZeroBranchesMatch() {
         .satisfies(
             t -> {
               var err = ((ValidationException) t).error();
-              org.assertj.core.api.Assertions.assertThat(err.keyword()).isEqualTo("oneOf");
-              org.assertj.core.api.Assertions.assertThat(err.message()).contains("matched 0 of 2");
+              assertThat(err.keyword()).isEqualTo("oneOf");
+              assertThat(err.message()).contains("matched 0 of 2");
             });
   }
 
@@ -110,8 +111,8 @@ void oneOfFailsWhenTwoBranchesMatch() {
         .satisfies(
             t -> {
               var err = ((ValidationException) t).error();
-              org.assertj.core.api.Assertions.assertThat(err.keyword()).isEqualTo("oneOf");
-              org.assertj.core.api.Assertions.assertThat(err.message()).contains("matched 2 of 2");
+              assertThat(err.keyword()).isEqualTo("oneOf");
+              assertThat(err.message()).contains("matched 2 of 2");
             });
   }
 
@@ -129,4 +130,46 @@ void notFailsWhenInnerPasses() {
         .extracting(t -> ((ValidationException) t).error().keyword())
         .isEqualTo("not");
   }
+
+  @Test
+  void allOfWithEmptyPartsAlwaysPasses() {
+    // Empty allOf is vacuously true per JSON Schema 2020-12.
+    v.validate("anything", new AllOfSchema(List.of()), "/v");
+  }
+
+  @Test
+  void anyOfWithEmptyOptionsAlwaysFails() {
+    assertThatThrownBy(() -> v.validate("anything", new AnyOfSchema(List.of()), "/v"))
+        .isInstanceOf(ValidationException.class)
+        .extracting(t -> ((ValidationException) t).error().keyword())
+        .isEqualTo("anyOf");
+  }
+
+  @Test
+  void oneOfWithEmptyOptionsAlwaysFails() {
+    assertThatThrownBy(() -> v.validate("anything", new OneOfSchema(List.of()), "/v"))
+        .isInstanceOf(ValidationException.class)
+        .satisfies(
+            t -> {
+              var err = ((ValidationException) t).error();
+              assertThat(err.keyword()).isEqualTo("oneOf");
+              assertThat(err.message()).contains("matched 0 of 0");
+            });
+  }
+
+  @Test
+  void notWithNullSchemaRejectsNull() {
+    // not(NullSchema) — inner accepts null, outer must reject.
+    assertThatThrownBy(() -> v.validate(null, new NotSchema(new NullSchema()), "/v"))
+        .isInstanceOf(ValidationException.class)
+        .extracting(t -> ((ValidationException) t).error().keyword())
+        .isEqualTo("not");
+  }
+
+  @Test
+  void anyOfMatchesNullViaNullSchema() {
+    // anyOf containing a NullSchema branch must pass for a null value.
+    var schema = new AnyOfSchema(List.of(stringSchema(1, null), new NullSchema()));
+    v.validate(null, schema, "/v");
+  }
 }