yeptris 0.6.31.2-arm-linux-eabihf → 0.6.33.1-arm-linux-eabihf

data/vendor/libyeptris/src/yeptris/emit/writer.c

@@ -18,6 +18,8 @@
 
 #include "writer.h"
 
+#include "../scan/scan.h"
+
 #include <string.h>
 
 #include "style.h"
@@ -168,6 +170,40 @@ static void emit_dq(yep_writer* w, const char* p, uint32_t n) {
             i += 2;
             continue;
         }
+        /* C1 controls (U+0080..U+009F, the UTF-8 pairs c2 80..c2 9f)
+         * are NON-PRINTABLE: raw, the re-parse's printability gate
+         * rejects the very document we just wrote (the nightly's
+         * "\x999" catch — \x99 decodes to U+0099 and the raw pair
+         * c2 99 cannot ride). Psych escapes the whole C1 range; the
+         * \xNN escape re-enters the doc the same way it left. */
+        if (c == 0xc2 && i + 1 < n && (unsigned char)p[i + 1] >= 0x80 &&
+            (unsigned char)p[i + 1] <= 0x9f) {
+            static const char hd[] = "0123456789ABCDEF";
+            if (run) {
+                wr_put(w, p + i - run, run);
+                run = 0;
+            }
+            wr_byte(w, '\\');
+            wr_byte(w, 'x');
+            wr_byte(w, hd[(unsigned char)p[i + 1] >> 4]);
+            wr_byte(w, hd[(unsigned char)p[i + 1] & 0xf]);
+            i++;
+            continue;
+        }
+        /* U+FFFE/U+FFFF are noncharacters: the printable validator
+         * rejects them raw, so emitting them raw makes the document
+         * un-re-parseable (the nightly's "["\\uFFFE"]" catch). Their
+         * escapes re-enter the doc the same way they left. */
+        if (c == 0xef && i + 2 < n && (unsigned char)p[i + 1] == 0xbf &&
+            ((unsigned char)p[i + 2] == 0xbe || (unsigned char)p[i + 2] == 0xbf)) {
+            if (run) {
+                wr_put(w, p + i - run, run);
+                run = 0;
+            }
+            wr_put(w, (unsigned char)p[i + 2] == 0xbe ? "\\uFFFE" : "\\uFFFF", 6);
+            i += 2;
+            continue;
+        }
         /* U+FEFF must never ride raw: at the buffer head it IS the
          * BOM and re-parse would strip it (the nightly's UTF-32LE
          * catch); Psych escapes it everywhere ("") */
@@ -364,39 +400,79 @@ static void emit_canonical_scalar(yep_writer* w, const yep_dnode* n) {
 /* The fidelity-mode emission route for one scalar (#352): the dry
  * pass derives it exactly once; the wet pass consumes the recorded
  * byte and skips the multiline/blockable/safety analysis entirely. */
-enum { YEP_SC_NOTHING = 0, YEP_SC_PLAIN, YEP_SC_SQ, YEP_SC_DQ, YEP_SC_LITERAL };
+enum { YEP_SC_NOTHING = 0, YEP_SC_PLAIN, YEP_SC_SQ, YEP_SC_DQ, YEP_SC_LITERAL, YEP_SC_TILDE };
 #define YEP_SC_MEMO_MIN 32u /* bytes; derive-below, memoize-above */
 
-static uint8_t sc_route(yep_writer* w, const char* p, uint32_t len, int as_key, uint8_t sty_in,
-                        int has_tag) {
-    /* U+0085 is a break (only its \\N escape is byte-stable) and U+FEFF
-     * raw is the BOM (re-parse would strip it): both force the
-     * double-quoted route BEFORE the plain fast path can take them
-     * (the nightly's fuzz_roundtrip crashers). The NEL scan matches
-     * the UTF-8 PAIR only — a lone 0x85 is a continuation byte
-     * (U+315B = E3 85 9B). */
-    int has_nel = 0;
-    int has_bom = 0;
+/* U+0085 is a break (only its \\N escape is byte-stable), U+FEFF raw is
+ * the BOM (re-parse would strip it), and U+2028/29 plus the
+ * noncharacters are their twins: content carrying any of these forces
+ * the double-quoted route BEFORE the plain fast path can take it (the
+ * nightly's fuzz_roundtrip crashers). The NEL scan matches the UTF-8
+ * PAIR only — a lone 0x85 is a continuation byte (U+315B = E3 85 9B).
+ * The block map's explicit-key promotion consults the same predicate:
+ * a key whose content demotes to DQ re-parses as a QUOTED key and must
+ * ride simple, or round two's render differs (the nightly's round 118). */
+static int sc_dq_forced(const char* p, uint32_t len) {
     for (uint32_t k = 0; k + 1 < len; k++) {
         if ((unsigned char)p[k] == 0xc2 && (unsigned char)p[k + 1] == 0x85) {
-            has_nel = 1;
-            break;
+            return 1;
         }
         /* LS/PS are breaks like NEL: only their escapes are stable */
         if ((unsigned char)p[k] == 0xe2 && k + 2 < len && (unsigned char)p[k + 1] == 0x80 &&
             ((unsigned char)p[k + 2] == 0xa8 || (unsigned char)p[k + 2] == 0xa9)) {
-            has_nel = 1;
-            break;
+            return 1;
         }
         if ((unsigned char)p[k] == 0xef && k + 2 < len && (unsigned char)p[k + 1] == 0xbb &&
             (unsigned char)p[k + 2] == 0xbf) {
-            has_bom = 1;
-            break;
+            return 1;
+        }
+        if ((unsigned char)p[k] == 0xef && k + 2 < len && (unsigned char)p[k + 1] == 0xbf &&
+            ((unsigned char)p[k + 2] == 0xbe || (unsigned char)p[k + 2] == 0xbf)) {
+            return 1; /* noncharacter: only its escape re-parses */
         }
     }
-    if (has_nel || has_bom) {
+    return 0;
+}
+
+static uint8_t sc_route(yep_writer* w, const char* p, uint32_t len, int as_key, uint8_t sty_in,
+                        int has_tag) {
+    if (sc_dq_forced(p, len)) {
         return YEP_SC_DQ;
     }
+    if (w->in_flow && len > 0) {
+        /* flow context: the indicators TERMINATE a plain scalar — a
+         * raw ']' inside "{}" re-parses as a stray close (the
+         * nightly's "555555ta]" explicit-key crasher) */
+        for (uint32_t k = 0; k < len; k++) {
+            switch (p[k]) {
+            case ',':
+            case '[':
+            case ']':
+            case '{':
+            case '}':
+            case '"':  /* flips the flow scanner into quoted mode */
+            case '\\': /* opens an escape sequence there */
+            case '\'': /* opens flow single-quote mode */
+            case '!':  /* a tag indicator everywhere — "a!%!!a" rode
+                        * plain inside a flow-rendered explicit key and
+                        * the re-parse died in tag scanning (the
+                        * nightly's run 38139449828) */
+            case '&':  /* an anchor indicator — "&)J" inside a
+                        * flow-rendered explicit key opened an anchor
+                        * scan on ')' and the re-parse died ("did not
+                        * find expected alphabetic or numeric
+                        * character"; the nightly's run 38250474732) */
+            case '*':  /* the alias twin of '&' */
+            case ':':  /* a separating ':' — "{a: b : c}" died at the
+                        * second ':' (the completed-pair law, catch 60);
+                        * the nightly's run 38255134508 */
+            case '?':  /* the explicit-key twin of ':' */
+                return YEP_SC_DQ;
+            default:
+                break;
+            }
+        }
+    }
     if ((sty_in == 1) && len > 0 &&
         (as_key ? yep_style_plain_key_safe(p, len) : yep_style_plain_safe(p, len))) {
         return YEP_SC_PLAIN; /* plain-safe implies no breaks: memchr skipped */
@@ -418,6 +494,15 @@ static uint8_t sc_route(yep_writer* w, const char* p, uint32_t len, int as_key,
     }
     uint8_t sty = sty_in;
     if (sty == 4 || sty == 5) {
+        /* BLOCK SCALARS ARE ILLEGAL IN FLOW: a flow-rendered explicit
+         * key's subtree wrote `yaml: |` + literal content lines and
+         * the emission could never re-parse (the nightly's run
+         * 38154662070, "? !\n- name: ..." — the forced-flow key
+         * subtree carried literal members). In flow, literal/folded
+         * values ride DQ. */
+        if (w->in_flow) {
+            return YEP_SC_DQ;
+        }
         if (multiline && as_key) {
             return YEP_SC_DQ;
         }
@@ -493,6 +578,13 @@ static void emit_scalar(yep_writer* w, const yep_dnode* n, int parent_col, int a
     }
     switch (route) {
     case YEP_SC_NOTHING:
+        if (w->flow_item) {
+            /* a null flow-SEQ item must stay re-parseable: nothing
+             * after '[' reads as a leading comma ("[, x]", rejected by
+             * libyaml and Psych alike) — libyaml renders it '~' */
+            wr_put(w, "~", 1);
+            break;
+        }
         break; /* an empty plain value emits as nothing (libyaml's null
                   rendering, issue #290) */
     case YEP_SC_PLAIN:
@@ -515,6 +607,42 @@ static void emit_scalar(yep_writer* w, const yep_dnode* n, int parent_col, int a
  * flow context raw, and renaming preserves the binding semantics.
  * Deterministic by definition order -> byte-stable across roundtrips.
  * The emitter's nametab lives in yep_emitter (owner: yep_emit_run). */
+/* An anchor name carrying an indicator byte rides raw fine in block
+ * context (the suite's W5VH/2SXE/8XYN round-trip byte-stably), but in
+ * FLOW context the bytes flip scanners or terminate the entry — and
+ * anchors have no quoting syntax. Such a document has no safe flow
+ * spelling: mark it unserializable; serialize fails rather than
+ * emitting a form that can never re-parse (the nightly's "&\""/bang/
+ * question anchor vein). */
+static void wr_anchor_check(yep_writer* w, const yep_view* name) {
+    if (!w->in_flow) {
+        return;
+    }
+    for (uint32_t i = 0; i < name->len; i++) {
+        switch (name->p[i]) {
+        case '"':
+        case '\'':
+        case '!':
+        case '?':
+        case '&':
+        case '*':
+        case ',':
+        case '[':
+        case ']':
+        case '{':
+        case '}':
+        case '%':
+        case '@':
+        case '`':
+        case '#':
+            w->unserializable = 1;
+            return;
+        default:
+            break;
+        }
+    }
+}
+
 static void emit_anchor_ex(yep_emitter* em, const yep_dnode* n) {
     yep_writer* w = &em->w;
     if (n->anchor.len == 0) {
@@ -532,6 +660,7 @@ static void emit_anchor_ex(yep_emitter* em, const yep_dnode* n) {
         int nl = snprintf(name, sizeof(name), "a%u", idx);
         wr_put(w, name, (uint32_t)nl);
     } else {
+        wr_anchor_check(w, &adec);
         wr_put(w, (const char*)adec.p, adec.len);
     }
     wr_byte(w, ' ');
@@ -540,6 +669,19 @@ static void emit_anchor_ex(yep_emitter* em, const yep_dnode* n) {
 static void emit_alias_ex(yep_emitter* em, const yep_dnode* n) {
     yep_writer* w = &em->w;
     yep_view name_v = wv(w, n->value);
+    if (w->in_flow && !w->canonical) {
+        /* the alias twin of wr_anchor_check: a flow alias is spelled
+         * raw and the re-parse truncates the name -- a trailing ':'
+         * reads as the key/value separator there ("*n:}" names "n",
+         * the block definition "n:" went unmatched: the nightly's
+         * run 39021984786, "alias references an undefined anchor"
+         * 3:15), and quote bytes hit the engine's flow-alias law.
+         * Block aliases ride raw (2SXE/Y2GN round-trip byte-stably). */
+        wr_anchor_check(w, &name_v);
+        if (name_v.len > 0 && name_v.p[name_v.len - 1] == ':') {
+            w->unserializable = 1;
+        }
+    }
     wr_byte(w, '*');
     if (w->canonical) {
         uint32_t idx = yep_nametab_get(&em->canon_names, name_v);
@@ -556,25 +698,112 @@ static void emit_alias_ex(yep_emitter* em, const yep_dnode* n) {
     }
 }
 
+/* Tag bytes outside ns-tag-char ride %XX (the parse side decodes them
+ * per the URI rule — a decoded newline emitted raw was the nightly's
+ * byte-instability crasher "!%0a"). Uppercase hex, libyaml's form. */
+static void wr_tag_uri(yep_writer* w, const yep_view* v) {
+    static const char hd[] = "0123456789ABCDEF";
+    const unsigned char* p = (const unsigned char*)v->p;
+    for (uint32_t i = 0; i < v->len; i++) {
+        unsigned char c = p[i];
+        if ((c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||
+            c == '-' || c == ';' || c == '/' || c == '?' || c == ':' || c == '@' || c == '&' ||
+            c == '=' || c == '+' || c == '$' || c == ',' || c == '.' || c == '!' || c == '~' ||
+            c == '*' || c == '\'' || c == '(' || c == ')') {
+            wr_byte(w, (char)c);
+        } else {
+            wr_byte(w, '%');
+            wr_byte(w, hd[c >> 4]);
+            wr_byte(w, hd[c & 0xf]);
+        }
+    }
+}
+
 /* Explicit tag, verbatim URI form ("!<tag:…> "). Never skipped: a
  * recorded tag always re-emits (implied-by-style skipping made the
  * roundtrip byte-unstable: plain+!!str and ""+!!str collided). */
-static void emit_tag(yep_writer* w, const yep_dnode* n) {
-    if (n->tag.len == 0) {
-        return;
+/* The tag token without separators: the core namespace rides the
+ * DEFAULT secondary handle (libyaml writes !!str, never
+ * !<tag:yaml.org,2002:str>); a leading-'!' shorthand re-escapes its
+ * interior bangs (a local tag's URI can carry them — re-parsed raw
+ * they read as handles and the meaning flips); everything else is a
+ * verbatim !<URI> wrap. Hosts pass the full core URI — the verbatim
+ * shorthand "!!str" as a node tag collides with a LOCAL tag of the
+ * same bytes (the binding's chevron-key dump regressed there). */
+static void wr_tag_token(yep_writer* w, const yep_view* tdec) {
+    static const char k_core_ns[] = "tag:yaml.org,2002:";
+    if (tdec->len > sizeof(k_core_ns) - 1 &&
+        memcmp(tdec->p, k_core_ns, sizeof(k_core_ns) - 1) == 0) {
+        yep_view suffix = {tdec->p + sizeof(k_core_ns) - 1, tdec->len - (sizeof(k_core_ns) - 1)};
+        int scan_ok = 1;
+        for (uint32_t si = 0; si < suffix.len; si++) {
+            if (!yep_scan_tag_char((unsigned char)suffix.p[si])) {
+                scan_ok = 0;
+                break;
+            }
+        }
+        /* the shorthand only holds if the suffix re-scans: the parse
+         * side's tag charset terminates on ',' (and flow indicators —
+         * our lenience vs libyaml's URI set), so a suffix carrying one
+         * re-parses truncated and the round-trip dies (the nightly's
+         * run 38132505901, the verbatim tag with an interior ',');
+         * the verbatim !<...> wrap carries those */
+        if (scan_ok) {
+            wr_put(w, "!!", 2);
+            wr_tag_uri(w, &suffix);
+            return;
+        }
     }
-    yep_view tdec = wv(w, n->tag);
-    if (tdec.len > 0 && tdec.p[0] == '!') {
-        /* already a shorthand ("!ruby/object:K", "!foo"): verbatim —
-         * the !<...> wrapper is for verbatim URIs only */
-        wr_put(w, (const char*)tdec.p, tdec.len);
-        wr_byte(w, ' ');
-        return;
+    if (tdec->len > 0 && tdec->p[0] == '!') {
+        yep_view rest = {tdec->p + 1, tdec->len - 1};
+        /* the LOCAL shorthand re-scans too: the parse side's tag
+         * charset terminates on ',' (our lenience vs libyaml's URI
+         * set), so a suffix carrying one re-parses truncated — the
+         * same law the core-namespace arm gained (catch 47); the
+         * verbatim !<...> wrap carries those (the nightly's run
+         * 38165476712, "!<!<<b,,,,,-,,,,ar> :yam" emitted
+         * "!%3C%3Cb,,,,,-,,,,ar" and died at the first comma) */
+        int scan_ok = 1;
+        for (uint32_t si = 0; si < rest.len; si++) {
+            if (!yep_scan_tag_char((unsigned char)rest.p[si])) {
+                scan_ok = 0;
+                break;
+            }
+        }
+        if (scan_ok) {
+            wr_byte(w, '!');
+            uint32_t run = 0;
+            for (uint32_t i = 0; i < rest.len; i++) {
+                if (rest.p[i] == '!') {
+                    if (run > 0) {
+                        yep_view seg = {rest.p + i - run, run};
+                        wr_tag_uri(w, &seg);
+                        run = 0;
+                    }
+                    wr_put(w, "%21", 3);
+                } else {
+                    run++;
+                }
+            }
+            if (run > 0) {
+                yep_view seg = {rest.p + rest.len - run, run};
+                wr_tag_uri(w, &seg);
+            }
+            return;
+        }
     }
     wr_byte(w, '!');
     wr_byte(w, '<');
-    wr_put(w, (const char*)tdec.p, tdec.len);
+    wr_tag_uri(w, tdec);
     wr_byte(w, '>');
+}
+
+static void emit_tag(yep_writer* w, const yep_dnode* n) {
+    if (n->tag.len == 0) {
+        return;
+    }
+    yep_view tdec = wv(w, n->tag);
+    wr_tag_token(w, &tdec);
     wr_byte(w, ' ');
 }
 
@@ -585,14 +814,12 @@ static void emit_props_tail(yep_writer* w, const yep_dnode* n) {
     if (n->tag.len > 0) {
         wr_byte(w, ' ');
         yep_view tdec2 = wv(w, n->tag);
-        wr_byte(w, '!');
-        wr_byte(w, '<');
-        wr_put(w, (const char*)tdec2.p, tdec2.len);
-        wr_byte(w, '>');
+        wr_tag_token(w, &tdec2);
     }
     if (n->anchor.len > 0) {
         wr_byte(w, ' ');
         yep_view adec2 = wv(w, n->anchor);
+        wr_anchor_check(w, &adec2);
         wr_byte(w, '&');
         wr_put(w, (const char*)adec2.p, adec2.len);
     }
@@ -600,8 +827,60 @@ static void emit_props_tail(yep_writer* w, const yep_dnode* n) {
 
 static void emit_node(yep_emitter* em, uint32_t id, int parent_col, int as_key);
 
+/* The simple-key law counts the WRITTEN token. A quoted render
+ * expands escapes (a '"' doubles, controls ride \xNN, non-ASCII may);
+ * raw-length predicates let escape-heavy scalars through (the
+ * nightly's run 38145696566: a ~1000-raw key rendering ~3000
+ * written). Conservative factor-4 estimate for every expandable
+ * byte — overestimating only takes the (always-legal) explicit form. */
+static int key_written_over_limit(yep_writer* w, const yep_dnode* kn) {
+    uint64_t est = 2; /* the quotes */
+    yep_view kv_ = wv(w, kn->value);
+    const unsigned char* q = (const unsigned char*)kv_.p;
+    uint32_t n = kv_.len;
+    /* NO early return on an empty value: the tag arm below must run —
+     * a TAGGED EMPTY key writes ~2300 bytes of escaped tag and the
+     * re-parse's simple-key law rejects it ("the nightly's run
+     * 38200627503") */
+    if (q != NULL) {
+        for (uint32_t i = 0; i < n; i++) {
+            est += (q[i] < 0x20 || q[i] >= 0x7F || q[i] == '"' || q[i] == '\\') ? 4u : 1u;
+        }
+    }
+    if (kn->anchor.len > 0) {
+        /* the key's ANCHOR rides the same written token: the re-parse
+         * counts the '&name' bytes in the simple-key candidate, and
+         * anchor names carry interior colons (Y2GN) — a ~1700-byte
+         * name blew a 2-byte key past the law (the nightly's run
+         * 38206305189) */
+        est += (uint64_t)kn->anchor.len + 2u;
+    }
+    if (kn->tag.len > 0) {
+        /* the key's TAG rides the same written token: wr_tag_uri
+         * escapes every byte outside its URI set as %XX (even '_'),
+         * inflating a ~1000-byte tag past the re-parse's simple-key
+         * law (the nightly's run 38176016091: a ~975-raw tag wrote
+         * ~1030 and the emission never re-parsed) */
+        yep_view tv = wv(w, kn->tag);
+        const unsigned char* t = (const unsigned char*)tv.p;
+        for (uint32_t i = 0; i < tv.len; i++) {
+            unsigned char c = t[i];
+            int plain = (c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') ||
+                        (c >= 'A' && c <= 'Z') || c == '-' || c == ';' || c == '/' || c == '?' ||
+                        c == ':' || c == '@' || c == '&' || c == '=' || c == '+' || c == '$' ||
+                        c == ',' || c == '.' || c == '!' || c == '~' || c == '*' || c == '\'' ||
+                        c == '(' || c == ')';
+            est += plain ? 1u : 3u;
+        }
+        est += 6u; /* the !!/!< > wrapper and the separating space */
+    }
+    return est > 1024u;
+}
+
 static void emit_flow(yep_emitter* em, uint32_t id) {
     yep_writer* w = &em->w;
+    int saved_flow = w->in_flow;
+    w->in_flow = 1;
     const yep_dom* d = em->doc->dom;
     const yep_dnode* n = yep_dom_node(d, id);
     emit_tag(w, n);
@@ -638,6 +917,17 @@ static void emit_flow(yep_emitter* em, uint32_t id) {
         }
         if (map) {
             int explicit_key = cn->anchor.len > 0 || cn->tag.len > 0 || cn->kind != 0;
+            if (!explicit_key && key_written_over_limit(w, cn)) {
+                { /* the quoted render's span vs the simple-key law */
+                    /* the simple-key law: a >1024 key cannot ride as a
+                     * flow simple key (the re-parse rejects it) — the
+                     * explicit "? key : " form carries it. Strict JSON
+                     * accepts keys of any length, so the JSON route
+                     * parses them and the YAML emission must re-parse
+                     * (the nightly's run 38143486175) */
+                    explicit_key = 1;
+                }
+            }
             if (explicit_key) {
                 wr_put(w, "? ", 2);
                 emit_node(em, child, 0, 1);
@@ -656,7 +946,9 @@ static void emit_flow(yep_emitter* em, uint32_t id) {
             child = cn->next_sibling;
             cn = yep_dom_node(d, child);
         } else {
+            w->flow_item = 1; /* a null item must ride '~' */
             emit_node(em, child, 0, 0);
+            w->flow_item = 0;
         }
         idx++;
         child = cn->next_sibling;
@@ -667,6 +959,7 @@ static void emit_flow(yep_emitter* em, uint32_t id) {
         w->pretty_depth--;
     }
     wr_byte(w, map ? '}' : ']');
+    w->in_flow = saved_flow;
 }
 
 /* Block map: first key at the cursor (the caller placed it at
@@ -693,7 +986,8 @@ static void emit_block_map(yep_emitter* em, uint32_t id, int content_col) {
             vn0->count == 0) {
             yep_view kv = wv(w, kn0->value);
             yep_view vv = wv(w, vn0->value);
-            if (kv.len > 0 && yep_style_plain_key_safe((const char*)kv.p, kv.len) &&
+            if (kv.len > 0 && !key_written_over_limit(w, kn0) &&
+                yep_style_plain_key_safe((const char*)kv.p, kv.len) &&
                 (vv.len == 0 || yep_style_plain_safe((const char*)vv.p, vv.len))) {
                 /* fused member write: plain-safe spans carry no breaks,
                  * so the col scan is arithmetic and one reservation
@@ -748,21 +1042,93 @@ static void emit_block_map(yep_emitter* em, uint32_t id, int content_col) {
             wr_indent(w, content_col);
         }
         int complex_key = (kn->kind != 0);
+        /* a literal/folded key cannot ride the simple form: the value
+         * separator would glue onto the block's CONTENT line (colons
+         * are data there) and the re-parse reads a different tree —
+         * the explicit "? key" form carries it. An EMPTY block-styled
+         * key rides simple: it has no content line for the separator
+         * to glue onto, and sc_route demotes it to the quoted form
+         * anyway (the nightly's run 38177622733, ":\n! |-\n r\n:") */
+        if (!complex_key && kn->style >= 4 && kn->style <= 5 && kn->value.len > 0 &&
+            kn->tag.len > 0 && memchr(wv(w, kn->value).p, '\n', wv(w, kn->value).len) == NULL &&
+            !sc_dq_forced(wv(w, kn->value).p, wv(w, kn->value).len)) {
+            /* a TAGGED SINGLE-LINE literal/folded key keeps the block
+             * form in sc_route (the #290 law), so the value separator
+             * would glue onto the block's CONTENT line (colons are
+             * data there) and the re-parse reads a different tree —
+             * the explicit "? key" form carries it, and it keeps the
+             * block form there too, so both renders agree. A MULTILINE
+             * tagged key demotes to quoted even in the explicit path
+             * (as_key), so promoting it would UNSTABILIZE it: round
+             * two parses a quoted style and rides simple. Untagged and
+             * empty block styles demote likewise (the nightly's runs
+             * 38177622733 ":\n! |-\n r\n:" and 38181819580
+             * ":\n! |\n r\n:") — and so does content carrying
+             * NEL/BOM/LS/PS/noncharacters (sc_dq_forced): a BOM in a
+             * key's content demoted the explicit form's key to DQ and
+             * round two rode simple, one render behind (the nightly's
+             * round 118) */
+            complex_key = 1;
+        }
+        if (!complex_key && key_written_over_limit(w, kn)) {
+            /* the simple-key law, block side: a >1024 key cannot ride
+             * as a block simple key either — the explicit "? key" form
+             * carries it (the flow member writer gained the same law;
+             * the nightly's run 38143486175) */
+            complex_key = 1;
+        }
         if (complex_key) {
             w->force_flow = 1; /* collections as flow keys: compact and
                                   free of the block '?' layout edges */
             wr_put(w, "? ", 2);
-            emit_props_tail(w, kn); /* the key's props ride "? " */
-            if (kn->anchor.len > 0 || kn->tag.len > 0) {
-                wr_byte(w, '\n');
-                wr_indent(w, content_col + 2);
+            /* the props emit ONCE: the DQ-promoted path writes its own
+             * (emit_dq is bare), everything else lets emit_node/
+             * emit_flow carry tag+anchor inline — the pre-emit made
+             * every non-DQ explicit key re-emit its props ("? !\n  ! |-
+             " — the catch-56 law, explicit-key side) */
+            int dq_promoted = (kn->kind == 0 && key_written_over_limit(w, kn));
+            if (dq_promoted) {
+                emit_props_tail(w, kn);
+                if (kn->anchor.len > 0 || kn->tag.len > 0) {
+                    wr_byte(w, '\n');
+                    wr_indent(w, content_col + 2);
+                }
+            }
+            if (dq_promoted) {
+                /* the 1024-promoted SCALAR key must ride QUOTED in the
+                 * explicit form: plain, its interior ': ' sequences
+                 * re-parse through the inline simple-key promotion and
+                 * die on the very law that forced the promotion (the
+                 * nightly's run 38145696566, the "? licit k:[...]"
+                 * emission) */
+                emit_dq(w, (const char*)wv(w, kn->value).p, (uint32_t)wv(w, kn->value).len);
+            } else {
+                emit_node(em, child, content_col, 1);
             }
-            emit_node(em, child, content_col, 1);
             wr_byte(w, '\n');
             wr_indent(w, content_col);
             wr_put(w, ": ", 2);
             w->force_flow = 0;
-            emit_node(em, kn->next_sibling, content_col, 0);
+            {
+                /* the value's props ride the ':' line and a nested
+                 * block collection takes the fresh-line form, exactly
+                 * like the simple arm's path: the explicit twin
+                 * skipped both, so an anchored map value lost its
+                 * anchor (or glued it to the first key) and a later
+                 * alias emitted a dangling reference (the nightly's
+                 * run 38371134997, "? &d!se: &base\n   name: Esame"
+                 * with a complex key forcing the explicit form) */
+                if (!(vn->kind == 0 || vn->kind == 3 || vn->flow || vn->count == 0)) {
+                    int seq_val = (vn->kind == 1 && !vn->flow);
+                    int val_col = seq_val ? content_col : content_col + 2;
+                    emit_props_tail(w, vn);
+                    wr_byte(w, '\n');
+                    wr_indent(w, val_col);
+                    emit_node(em, kn->next_sibling, val_col - 2, 0);
+                } else {
+                    emit_node(em, kn->next_sibling, content_col, 0);
+                }
+            }
         } else {
             emit_tag(w, kn);
             emit_anchor_ex(em, kn);
@@ -823,17 +1189,24 @@ static void emit_block_seq(yep_emitter* em, uint32_t id, int content_col) {
             child = cn->next_sibling;
             continue;
         }
-        wr_put(w, "- ", 2);
-        if (cn->kind != 0 && cn->kind != 3 && !cn->flow &&
+        if (cn->kind != 0 && cn->kind != 3 && !cn->flow && cn->count > 0 &&
             (cn->anchor.len > 0 || cn->tag.len > 0)) {
             /* props may not precede a dash: they ride the dash line and
-             * the collection starts on the next line (SY6V) */
+             * the collection starts on the next line (SY6V). The dash
+             * carries NO trailing space — emit_props_tail adds its own
+             * separator, and "- " + " &a" doubled it (the nightly's run
+             * 38161738783). An EMPTY propertied collection takes the
+             * compact arm: emit_node's empty-form writes the props
+             * itself ("- &a {}"), and the next-line form re-emitted
+             * them ("- &a\n  &a {}") — every round grew/duplicated */
+            wr_byte(w, '-');
             emit_props_tail(w, cn);
             wr_byte(w, '\n');
             wr_indent(w, content_col + 2);
             emit_node(em, child, content_col, 0);
         } else {
             /* compact: a block collection starts right after "- " */
+            wr_put(w, "- ", 2);
             emit_node(em, child, content_col, 0);
         }
         idx++;
@@ -852,9 +1225,14 @@ static void emit_node(yep_emitter* em, uint32_t id, int parent_col, int as_key)
         emit_alias_ex(em, n);
         return;
     }
-    if ((n->kind == 1 || n->kind == 2) && (n->flow || w->canonical || w->json || w->force_flow)) {
+    if ((n->kind == 1 || n->kind == 2) &&
+        (n->flow || w->in_flow || w->canonical || w->json || w->force_flow)) {
         /* force_flow holds through the subtree: a complex key's nested
-         * collections all render flow (scalars are never collections) */
+         * collections all render flow (scalars are never collections).
+         * in_flow is the catch-55 law's collection arm: a block-styled
+         * node nested inside a flow member renders FLOW — its block
+         * dashes are not node content there (the nightly's run
+         * 38168927841) */
         emit_flow(em, id);
         return;
     }
@@ -923,17 +1301,22 @@ size_t yep_emit_run(yep_emitter* em, int dry) {
                    4);
         }
         if (root != NULL && (root->kind == 1 || root->kind == 2) && !root->flow && !w->canonical &&
-            (root->tag.len > 0 || root->anchor.len > 0)) {
+            root->count > 0 && (root->tag.len > 0 || root->anchor.len > 0)) {
+            /* count > 0: an EMPTY propertied collection takes
+             * emit_node's inline empty-form ("! &a {}") — the leading
+             * props line DUPLICATED it ("! &a\n! &a {}") and every
+             * round shed a line (the nightly's run 38167237445; the
+             * catch-56 law, root side) */
             /* root block-collection props ride their own leading line;
              * scalars and flow collections carry them inline */
             if (root->tag.len > 0) {
                 yep_view tdec3 = wv(w, root->tag);
-                wr_byte(w, '!');
-                wr_byte(w, '<');
-                wr_put(w, (const char*)tdec3.p, tdec3.len);
-                wr_byte(w, '>');
+                wr_tag_token(w, &tdec3);
             }
             if (root->anchor.len > 0) {
+                if (root->tag.len > 0) {
+                    wr_byte(w, ' '); /* props need the separator */
+                }
                 yep_view adec3 = wv(w, root->anchor);
                 wr_byte(w, '&');
                 wr_put(w, (const char*)adec3.p, adec3.len);