yeptris 0.6.31.2-arm-linux-eabihf → 0.6.33.1-arm-linux-eabihf

data/vendor/libyeptris/src/yeptris/parse/engine.c

@@ -20,6 +20,7 @@
 #include "common/chartype.h"
 #include "common/nametab.h"
 #include "common/simd_text.h"
+#include "encoding/encoding.h"
 #include "engine.h"
 #include "memory/allocator.h"
 #include "memory/pool.h"
@@ -75,8 +76,19 @@ struct yep_engine {
     yep_frame frames[YEP_MAX_DEPTH];
     int depth;
 
+    int front_done;         /* the encoding front-end ran on this engine:
+                             * parse/values pre-strip and set it; later
+                             * chunked runs never re-sniff (mid-stream
+                             * U+FEFF is content, not a mark) */
     yep_nametab anchors;    /* name interning: O(1) define/lookup at any scale */
     uint32_t anchor_serial; /* 1-based ordinals; the value IS the id */
+    uint8_t* anchor_placed; /* per-ordinal: the anchor's NODE has been
+                             * placed in the output (an alias to an
+                             * unplaced anchor would precede its
+                             * definition and the re-parse would reject
+                             * the document — the nightly's run
+                             * 38541356075) */
+    uint32_t anchor_placed_cap;
     /* repeat-alias memo (TODO.restructure/71): offset/len/ordinal of
      * the last alias resolved — hit by memcmp, not by the table */
     uint32_t alias_memo_at;
@@ -94,9 +106,23 @@ struct yep_engine {
     yep_view pend_anchor, pend_tag;
     uint32_t pend_anchor_id; /* the pend anchor's ordinal */
 
-    int doc_content;     /* any node emitted for the current document */
-    int q_key_pending;   /* an explicit '?' key awaits its ':' value line */
-    int q_map_depth;     /* frame depth of the '?' mapping (flush guard) */
+    int doc_content;       /* any node emitted for the current document */
+    int parsing_final;     /* engine_run_impl's emit_end: the buffer is the
+                            * complete input (pre-scan errors are real) vs a
+                            * partial step feed (an unclosed flow is
+                            * incomplete, not malformed) */
+    int q_key_pending;     /* an explicit '?' key awaits its ':' value line */
+    uint32_t cv_line;      /* the line whose colon-value is being parsed: a
+                            * key indicator on it sits where a value belongs
+                            * (": ?") — libyaml rejects */
+    int qmd_stack[16];     /* the '?' pending pairs' map depths — a STACK:
+                            * nested '? ?' pairs stack two pendings and a
+                            * scalar slot let the inner clobber the
+                            * outer's level (the nightly's run 38387614146) */
+    uint32_t qmd_line[16]; /* each pending's open line: a LATER-line '?'
+                            * at the same level completes the previous
+                            * pair (libyaml's same-indent KEY rule) */
+    int qmd_n;
     int q_value_pending; /* an explicit key was emitted; its value is null
                             until a ':' line supplies one */
     /* %TAG handle map for the current document (engine = tag SSOT) */
@@ -115,27 +141,30 @@ struct yep_engine {
      * the key's events, but ':' is only seen after them). */
     yep_event* ev_buf;
     uint32_t ev_buf_n, ev_buf_cap;
-    uint32_t ev_scopes;                  /* active entry-buffer scopes */
-    char* norm_buf;                      /* owned input copy with exotic breaks normalized */
-    const struct yep_resolver* resolver; /* implicit-typing schema (10) */
-    int max_depth;                       /* runtime nesting limit (options) */
-    uint16_t rec;                        /* e_node<->e_parse_value call depth:
-                                            the props/value-line chain opens NO
-                                            container frame, so e->depth cannot
-                                            bound it (the nightly's stack
-                                            overflow crasher) */
-    int last_root_flow;                  /* a root-level flow node just completed */
-    int tag_undef;                       /* an unresolved !handle! was seen (QLJ7) */
-    int doc_inline;                      /* content node opened on the --- line */
-    uint16_t flow_floor;                 /* parent column of the current block-level flow */
-    int flow_enforce;                    /* flow continuation lines must out-indent it */
-    int compat_grammar;                  /* 11-COMPAT: libyaml/psych grammar parity —
-                                          * the flow indent floor (9C9N/VJP3) is a
-                                          * yaml-test-suite rule libyaml never
-                                          * enforced, and real-world locale files
-                                          * close multi-line flows at the parent's
-                                          * column; the floor stays on for the
-                                          * strict 1.2 engine the suite runs */
+    uint32_t ev_scopes; /* active entry-buffer scopes */
+    char* norm_buf;
+    unsigned char* enc_buf;
+    /* owned UTF-16/32 transcode scratch (run-owned) */ /* owned input copy with exotic breaks
+                                                           normalized */
+    const struct yep_resolver* resolver;                /* implicit-typing schema (10) */
+    int max_depth;                                      /* runtime nesting limit (options) */
+    uint16_t rec;                                       /* e_node<->e_parse_value call depth:
+                                                           the props/value-line chain opens NO
+                                                           container frame, so e->depth cannot
+                                                           bound it (the nightly's stack
+                                                           overflow crasher) */
+    int last_root_flow;                                 /* a root-level flow node just completed */
+    int tag_undef;                                      /* an unresolved !handle! was seen (QLJ7) */
+    int doc_inline;                                     /* content node opened on the --- line */
+    uint16_t flow_floor; /* parent column of the current block-level flow */
+    int flow_enforce;    /* flow continuation lines must out-indent it */
+    int compat_grammar;  /* 11-COMPAT: libyaml/psych grammar parity —
+                          * the flow indent floor (9C9N/VJP3) is a
+                          * yaml-test-suite rule libyaml never
+                          * enforced, and real-world locale files
+                          * close multi-line flows at the parent's
+                          * column; the floor stays on for the
+                          * strict 1.2 engine the suite runs */
 };
 
 /* ------------------------------------------------------------ forwards */
@@ -167,7 +196,7 @@ static void e_pos_mark(const yep_engine* e, size_t at, uint32_t* line, uint32_t*
          * walk below it, or ls never decreases (the infinite-loop bug
          * the Stepping.Directive hang found) */
         size_t q = ls - 1;
-        while (q > 0 && e->p[q - 1] != '\n') {
+        while (q > 0 && e->p[q - 1] != '\n' && e->p[q - 1] != '\r') {
             q--;
         }
         ls = q; /* line_start(l-1) */
@@ -197,7 +226,10 @@ static void e_event_init(yep_event* ev, yep_event_type t) {
     ev->type = t;
 }
 
+static void e_anchor_mark(yep_engine* e, uint32_t id);
+
 static int emit_now(yep_engine* e, const yep_event* ev) {
+    e_anchor_mark(e, ev->anchor_id);
     if (ev->type == YEP_EV_SCALAR) {
         /* Resolution happens exactly here: every scalar path flows
          * through this choke point (the resolver is the typing SSOT) */
@@ -382,11 +414,37 @@ static uint32_t anchor_id_of(yep_engine* e, yep_view name) {
     return id;
 }
 
+/* The anchor's node has been PLACED (an event emitted, or the node
+ * handed to a fused sink callback): aliases to it may parse. */
+static void e_anchor_mark(yep_engine* e, uint32_t id) {
+    if (id != 0 && id <= e->anchor_serial && e->anchor_placed != NULL) {
+        e->anchor_placed[id - 1] = 1;
+    }
+}
+
 static uint32_t anchor_define(yep_engine* e, yep_view name) {
     /* Last definition wins (libyaml parity); OOM leaves the anchor
      * undefined so its alias errors. The VALUE is the anchor's 1-based
      * ordinal — sinks key on it and skip the name hash entirely. */
     uint32_t id = ++e->anchor_serial;
+    if (id > e->anchor_placed_cap) {
+        uint32_t cap = e->anchor_placed_cap ? e->anchor_placed_cap : 64;
+        while (cap < id) {
+            cap *= 2;
+        }
+        uint8_t* nb = yep_alloc(e->sys, cap);
+        if (nb == NULL) {
+            e->anchor_serial--;
+            return 0; /* OOM: the anchor stays undefined, its alias errors */
+        }
+        if (e->anchor_placed != NULL) {
+            memcpy(nb, e->anchor_placed, e->anchor_placed_cap);
+            yep_free(e->sys, e->anchor_placed);
+        }
+        memset(nb + e->anchor_placed_cap, 0, cap - e->anchor_placed_cap);
+        e->anchor_placed = nb;
+        e->anchor_placed_cap = cap;
+    }
     yep_nametab_set(&e->anchors, name, id);
     return id;
 }
@@ -465,13 +523,18 @@ static int e_open_map(yep_engine* e, uint16_t col, uint32_t line, uint32_t coln,
 
 /* Emits the null value for an explicit key that never got its ':' line. */
 static int e_flush_q_value(yep_engine* e) {
-    if (!e->q_value_pending) {
+    if (!e->q_value_pending || e->qmd_n == 0) {
         return 0;
     }
-    if (e->depth > e->q_map_depth) {
-        return 0; /* the key's own structure is still open */
+    int top = e->qmd_stack[e->qmd_n - 1];
+    if (e->depth != top) {
+        return 0; /* the pending pair's map is not the current level */
     }
-    e->q_value_pending = 0;
+    e->qmd_n--;
+    /* nested '?' pairs stack one pending per level — the flag stays up
+     * while the stack still holds one, so the outer null flushes at its
+     * own level (the nightly's run 38387614146: `? ? k : a` lost it) */
+    e->q_value_pending = (e->qmd_n > 0);
     yep_event ev;
     e_event_init(&ev, YEP_EV_SCALAR);
     ev.style = YEP_STYLE_PLAIN;
@@ -479,6 +542,20 @@ static int e_flush_q_value(yep_engine* e) {
     return emit_now(e, &ev) == 0 ? 0 : -2;
 }
 
+/* The pair-value completion: every `key: value` arm funnels its value
+ * parse through here. Under an AFTER_Q parse (a nested '?' pair whose
+ * value arrived inline) the innermost '?' pending resolves — without
+ * this pop the stack keeps a stale entry and the outer pair's null
+ * flushes inside the wrong map (the nightly's run 38387614146). */
+static int e_pair_value_done(yep_engine* e, yep_ctx ctx, uint16_t key_col) {
+    int rc = e_parse_value(e, YEP_CTX_AFTER_COLON, key_col);
+    if (rc >= 0 && ctx == YEP_CTX_AFTER_Q && e->qmd_n > 0 &&
+        e->depth == e->qmd_stack[e->qmd_n - 1]) {
+        e->qmd_n--; /* the inline value resolved the innermost '?' pending */
+    }
+    return rc;
+}
+
 static int e_close_to(yep_engine* e, int to_depth) {
     while (e->depth > to_depth) {
         /* the pending '?' value flushes once the key's structure closed */
@@ -486,7 +563,7 @@ static int e_close_to(yep_engine* e, int to_depth) {
         if (rc != 0) {
             return rc;
         }
-        if (e->q_value_pending && e->depth == e->q_map_depth) {
+        if (e->q_value_pending && e->qmd_n > 0 && e->depth == e->qmd_stack[e->qmd_n - 1]) {
             continue; /* flushed the null; this frame closes next round */
         }
         e->depth--;
@@ -629,6 +706,18 @@ static int e_quoted_floor(yep_engine* e, yep_event* ev, uint16_t min_indent, int
                     return e_fail(e, YEP_ERR_INVALID_ESCAPE, i); /* lone low */
                 }
             }
+            if (esc == 'U') {
+                /* 8 hex digits reach far past U+10FFFF — the nightly's
+                 * "\UA66DA66D" crasher: parse accepted an unencodable
+                 * code point and the emitted bytes never re-parsed */
+                uint32_t cp = 0;
+                for (size_t k = 1; k <= 8; k++) {
+                    cp = (cp << 4) | (uint32_t)hexval((unsigned char)e->p[i + 1 + k]);
+                }
+                if (cp > 0x10FFFF) {
+                    return e_fail(e, YEP_ERR_INVALID_ESCAPE, i);
+                }
+            }
             i += 1 + need; /* the digits are not escapes themselves */
             continue;
         }
@@ -709,9 +798,12 @@ static int e_block_scalar(yep_engine* e, yep_event* ev, int parent_col) {
     e->pos++;
     int chomp = 0;
     int explicit_indent = 0;
+    int saw_digit = 0;
+    int saw_blank = 0;
     while (e->pos < e->len && e->p[e->pos] != '\n' && e->p[e->pos] != '\r') {
         char c = e->p[e->pos];
         if (c == ' ' || c == '\t') {
+            saw_blank = 1;
             e->pos++;
             continue;
         }
@@ -719,12 +811,22 @@ static int e_block_scalar(yep_engine* e, yep_event* ev, int parent_col) {
             e_skip_to_eol(e);
             break;
         }
+        if (saw_blank || (c == '-' && chomp != 0) || (c == '+' && chomp != 0) ||
+            (c >= '1' && c <= '9' && saw_digit)) {
+            /* libyaml: the params ride the indicator DIRECTLY (a
+             * spaced "| 2" is trailing content, not a param — "did
+             * not find expected comment or line break"), one
+             * indentation digit and one chomp sign at most (the
+             * nightly's run 38119775008 family) */
+            return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+        }
         if (c == '-') {
             chomp = 1;
         } else if (c == '+') {
             chomp = 2;
         } else if (c >= '1' && c <= '9') {
             explicit_indent = c - '0';
+            saw_digit = 1;
         } else {
             return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
         }
@@ -748,9 +850,21 @@ static int e_block_scalar(yep_engine* e, yep_event* ev, int parent_col) {
             e->pos == e->line_start ? e_line_info_here(e) : yep_scan_line(e->p, e->len, e->pos);
         int blank = (li.flags & YEP_LF_BLANK) != 0;
         if (!blank) {
-            if (saw_content && parent_col < 0 &&
-                (li.flags & (YEP_LF_DOC_START | YEP_LF_DOC_END | YEP_LF_DIRECTIVE))) {
-                break; /* root block ends at ---/.../% even at the content column */
+            if (parent_col < 0 && (li.flags & (YEP_LF_DOC_START | YEP_LF_DOC_END))) {
+                /* col-0 ---/... are document boundaries ALWAYS — even
+                 * with no content yet: libyaml scans the marker as a
+                 * document token regardless, so '>\n--- ' is an EMPTY
+                 * block scalar plus a second (empty) document, not a
+                 * block whose content is the marker line (the nightly's
+                 * run 38544774709: whole saw one doc, the chunked cut
+                 * at the marker saw two) */
+                break;
+            }
+            if (saw_content && parent_col < 0 && (li.flags & YEP_LF_DIRECTIVE)) {
+                /* a %-line after content ends the root block; as the
+                 * FIRST line it is content (M7A3/W4TN: the block's
+                 * value is '%!PS-Adobe-2.0 ...') */
+                break;
             }
             if (content_indent < 0) {
                 content_indent = li.indent;
@@ -867,6 +981,14 @@ static int e_block_scalar(yep_engine* e, yep_event* ev, int parent_col) {
         }
     }
     trailing_breaks += pending_breaks;
+    if (!saw_content && trailing_breaks > 0 && e->pos == e->len && e->len > 0 &&
+        e->p[e->len - 1] != '\n' && e->p[e->len - 1] != '\r') {
+        /* keep-chomping counts COMPLETE blank lines only: the final
+         * blank line carries no break at EOF, so there is nothing to
+         * keep ("|+\n " is "" where the pre-fix kept "\n"; two
+         * complete blanks stay "\n\n" -- libyaml/psych oracle) */
+        trailing_breaks--;
+    }
     if (saw_content ? (max_blank_indent > content_indent) : blank_tab) {
         /* a leading blank line out-indents the first content line; a
          * tab-only line before any content is an error (5LLU/Y79Y) */
@@ -938,6 +1060,15 @@ static int e_plain_multiline(yep_engine* e, yep_span s0, uint32_t block_floor, y
         while (cs < e->len && (e->p[cs] == ' ' || e->p[cs] == '\t')) {
             cs++; /* continuation leading white space is stripped */
         }
+        if (cs < e->len && e->p[cs] == '#') {
+            /* a '#' opening a continuation line is a comment: the
+             * plain ends here and nothing folds -- the scan below
+             * returned an empty piece that still took a fold slot,
+             * adding a trailing fold-space ("a\n#" parsed as "a ",
+             * libyaml "a": the nightly's combined-build round) */
+            e_skip_to_eol(e);
+            break;
+        }
         yep_span s = yep_scan_plain(e->p, e->len, cs, 0);
         if (s.term == YEP_TERM_COLON) {
             return e_fail(e, YEP_ERR_UNEXPECTED, s.end);
@@ -994,6 +1125,17 @@ static int e_hex_val(unsigned char c) {
 /* Tags carry URI escapes (%XX) in every form (verbatim, !!, %TAG). */
 static yep_view e_tag_uri_decode(yep_engine* e, yep_view v) {
     const char* p = v.p;
+    /* every '%' must be followed by two hex digits — libyaml rejects
+     * the family ("did not find URI escaped octet"); a stray '%' left
+     * raw would decode differently on re-parse of the re-encoded form
+     * (the nightly's tag-escape byte-instability) */
+    for (uint32_t i = 0; i < v.len; i++) {
+        if (p[i] == '%' && (i + 2 >= v.len || e_hex_val((unsigned char)p[i + 1]) < 0 ||
+                            e_hex_val((unsigned char)p[i + 2]) < 0)) {
+            e->tag_undef = 1; /* e_props reports it */
+            return v;
+        }
+    }
     for (uint32_t i = 0; i + 2 < v.len; i++) {
         if (p[i] == '%' && e_hex_val((unsigned char)p[i + 1]) >= 0 &&
             e_hex_val((unsigned char)p[i + 2]) >= 0) {
@@ -1103,6 +1245,17 @@ static void e_props(yep_engine* e, yep_view* anchor, yep_view* tag) {
                 e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
                 return;
             }
+            if (e->pos < e->len && e->p[e->pos] == '#') {
+                /* the name ends at a blank or flow indicator; a glued
+                 * '#' is junk on the name (libyaml: "did not find
+                 * expected alphabetic or numeric character") — the
+                 * nightly's run 38121449804, "&f#o": this scan kept
+                 * the anchor and DROPPED the bytes after '#',
+                 * mangling the node while the runner kept a different
+                 * shape */
+                e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+                return;
+            }
         } else if (c == '!') {
             size_t start = e->pos;
             e->pos++;
@@ -1122,10 +1275,22 @@ static void e_props(yep_engine* e, yep_view* anchor, yep_view* tag) {
                 }
                 e->pos = gt + 1;
             } else {
-                while (e->pos < e->len && yep_scan_prop_char((unsigned char)e->p[e->pos])) {
+                /* libyaml scans URI chars only: bytes like '>' or '|'
+                 * end the suffix and surface as the follower, which
+                 * the check below rejects */
+                while (e->pos < e->len && yep_scan_tag_char((unsigned char)e->p[e->pos])) {
                     e->pos++;
                 }
             }
+            if (e->pos < e->len) {
+                unsigned char after = (unsigned char)e->p[e->pos];
+                if (!(after == ' ' || after == '\t' || after == '\n' || after == '\r' ||
+                      after == ',' || after == '[' || after == ']' || after == '{' ||
+                      after == '}')) {
+                    e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+                    return;
+                }
+            }
             yep_view raw = {e->p + start, (uint32_t)(e->pos - start)};
             *tag = e_resolve_tag(e, raw);
             if (e->tag_undef) {
@@ -1162,10 +1327,31 @@ static int e_alias(yep_engine* e, yep_event* ev) {
         return e_fail(e, YEP_ERR_UNEXPECTED, star);
     }
     uint32_t target = anchor_id_of(e, name);
-    if (target == 0) {
+    if (target == 0 || (target <= e->anchor_serial && e->anchor_placed != NULL &&
+                        e->anchor_placed[target - 1] == 0)) {
+        /* undefined, or defined-but-not-yet-placed: the props scan
+         * registers the name before the anchor's node reaches the
+         * output, so an alias here would precede its definition and
+         * the re-parse would reject the document (libyaml: "found
+         * undefined alias") */
         e->pos = star;
         return e_fail(e, YEP_ERR_UNDEFINED_ALIAS, star);
     }
+    if (e->pos < e->len && e->p[e->pos] == '#') {
+        /* the name ends at a blank or flow indicator; a glued '#' is
+         * junk (the anchor-name follower law, catch 43's family) */
+        return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+    }
+    e_skip_inline_space(e);
+    if (e->pos < e->len && (e->p[e->pos] == '&' || e->p[e->pos] == '!' || e->p[e->pos] == '*')) {
+        /* an alias node is COMPLETE — it carries no props and nothing
+         * can follow it on the line but a separator: "<<: *base &bar"
+         * (the nightly's run 38124486657 family) errored in libyaml
+         * ("did not find expected key") while the DOM route absorbed
+         * the stray props and the value drain rejected — the routes
+         * split */
+        return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+    }
     ev->type = YEP_EV_ALIAS;
     ev->value = name;
     ev->borrowed = 1; /* the name is an input view (TODO.restructure/73):
@@ -1173,7 +1359,6 @@ static int e_alias(yep_engine* e, yep_event* ev) {
                          arena copy per alias */
     ev->anchor_id = target;
     e_pos_mark(e, e->pos, &ev->end_line, &ev->end_col);
-    e_skip_inline_space(e);
     return 0;
 }
 
@@ -1220,16 +1405,51 @@ static int e_skip_flow(yep_engine* e) {
     int n = 0;
     stk[n++] = (e->p[e->pos] == '[') ? 0 : 1;
     e->pos++;
+    /* quotes open only at a TOKEN start: a quote byte inside a tag
+     * suffix ("[!'str b]") or a plain ("[a'b]") is content — libyaml
+     * accepts both; the pre-scan must not read them as a quoted
+     * scalar (the nightly's run 38171171360) */
+    int tok_start = 1;
     while (e->pos < e->len && n > 0) {
         unsigned char c = (unsigned char)e->p[e->pos];
-        if (c == '"' || c == '\'') {
+        if (tok_start && (c == '!' || c == '&' || c == '*')) {
+            /* props/aliases ride the span: skip them the way the real
+             * scan does — a verbatim tag to its '>', names over the
+             * tag-char run (no quote/bracket bytes in the run) */
+            e->pos++;
+            if (c == '!' && e->pos < e->len && e->p[e->pos] == '<') {
+                while (e->pos < e->len && e->p[e->pos] != '>' && e->p[e->pos] != '\n' &&
+                       e->p[e->pos] != '\r' && e->p[e->pos] != ' ' && e->p[e->pos] != '\t') {
+                    e->pos++;
+                }
+                if (e->pos < e->len && e->p[e->pos] == '>') {
+                    e->pos++;
+                }
+                tok_start = 0;
+                continue;
+            }
+            while (e->pos < e->len && yep_scan_tag_char((unsigned char)e->p[e->pos])) {
+                e->pos++;
+            }
+            tok_start = 0;
+            continue;
+        }
+        if (tok_start && (c == '"' || c == '\'')) {
             int esc2 = 0;
             const yep_text_kernels* k = yep_text_active();
             ptrdiff_t r = k->quote_scan(e->p + e->pos + 1, e->len - e->pos - 1, (char)c, &esc2);
             if (r < 0) {
-                return e_fail(e, YEP_ERR_UNTERMINATED_QUOTE, e->pos);
+                /* an unterminated quote inside the span: NOT-A-KEY — the
+                 * real parse (e_flow) owns the error AFTER it has streamed
+                 * the flow's open events. The pre-scan's own error here
+                 * fired BEFORE those events, so the whole buffer's stream
+                 * lost them while the chunked feed had already emitted
+                 * theirs (the nightly's round 106); the unbalanced-span
+                 * deferral below defers the same way. */
+                return 0;
             }
             e->pos += 1 + (size_t)r + 1;
+            tok_start = 0;
             continue;
         }
         if (c == '#' && e_comment_at(e)) {
@@ -1238,8 +1458,24 @@ static int e_skip_flow(yep_engine* e) {
         }
         if (c == '\n' || c == '\r') {
             e_line_done(e, e->pos);
+            tok_start = 1;
             continue;
         }
+        if (c == ' ' || c == '\t' || c == '[' || c == '{' || c == ',') {
+            tok_start = 1;
+        } else if (c == ':' && e->pos + 1 < e->len &&
+                   (e->p[e->pos + 1] == ' ' || e->p[e->pos + 1] == '\t' ||
+                    e->p[e->pos + 1] == '\n' || e->p[e->pos + 1] == '\r' ||
+                    e->p[e->pos + 1] == '"' || e->p[e->pos + 1] == '\'' ||
+                    yep_ct_is((unsigned char)e->p[e->pos + 1], YEP_CT_FLOW_IND))) {
+            /* a separating ':' only — including directly before a
+             * quoted value: "{\"k\"\t:\"[\"}" is JSON- and YAML-flow-
+             * valid, and treating ':' as mid-token left the value's
+             * quotes unscanned, so its CLOSE read as an unterminated
+             * opener (the nightly's round 103) */
+        } else {
+            tok_start = 0;
+        }
         if (c == '[') {
             if (n >= e->max_depth) {
                 return e_fail(e, YEP_ERR_DEPTH, e->pos);
@@ -1251,20 +1487,32 @@ static int e_skip_flow(yep_engine* e) {
             }
             stk[n++] = 1;
         } else if (c == ']') {
-            if (stk[n - 1] != 0) {
-                return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+            if (n == 0 || stk[n - 1] != 0) {
+                /* a stray close outside any candidate span (or a kind
+                 * mismatch) is NOT a flow shape: defer to the general
+                 * path -- aborting here discarded the pre-scan's whole
+                 * document before a single event emitted, while the
+                 * chunked feed had already committed the prefix runs
+                 * (the nightly's round 113) */
+                return 0;
             }
             n--;
         } else if (c == '}') {
-            if (stk[n - 1] != 1) {
-                return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+            if (n == 0 || stk[n - 1] != 1) {
+                return 0;
             }
             n--;
         }
         e->pos++;
     }
     if (n != 0) {
-        return e_fail(e, YEP_ERR_UNEXPECTED, e->len);
+        /* incomplete: the real parse (e_flow) owns the deferral in BOTH
+         * modes. The pre-emptive final error (removed here) fired
+         * BEFORE the flow's first events, while the chunked feed had
+         * already streamed MAP_START + the first entry — the two routes'
+         * event streams diverged at the error boundary (the nightly's
+         * round 104). e_flow errors on the unclosed span either way. */
+        return 0;
     }
     return 0;
 }
@@ -1306,6 +1554,14 @@ static int e_flow_node(yep_engine* e, yep_event* ev, int keyish) {
     if (e->err.code != YEP_ERR_NONE) {
         return -1; /* e_props failed (empty anchor name, unresolved tag) */
     }
+    if (!yep_view_is_empty(anchor) &&
+        (memchr(anchor.p, '"', anchor.len) != NULL || memchr(anchor.p, '\'', anchor.len) != NULL)) {
+        /* anchors have no quoting: a quote byte in a FLOW anchor name
+         * has no safe spelling (Psych: "did not find expected
+         * alphabetic or numeric character"). Block names ride quotes
+         * (the suite's W5VH) — this law is flow-scoped. */
+        return (int)e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+    }
     ev->anchor = anchor;
     ev->tag = tag;
     if (!yep_view_is_empty(anchor)) {
@@ -1333,7 +1589,15 @@ static int e_flow_node(yep_engine* e, yep_event* ev, int keyish) {
         return e_quoted_floor(e, ev, 0, 0) == 0 ? 1 : -1;
     }
     if (c == '*') {
-        return e_alias(e, ev) == 0 ? 1 : -1;
+        if (e_alias(e, ev) != 0) {
+            return -1;
+        }
+        if (ev->value.len > 0 && (memchr(ev->value.p, '"', ev->value.len) != NULL ||
+                                  memchr(ev->value.p, '\'', ev->value.len) != NULL)) {
+            /* the alias twin of the flow anchor-name law above */
+            return (int)e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+        }
+        return 1;
     }
     if (c == '[' || c == '{') {
         return 2;
@@ -1355,6 +1619,7 @@ static int e_flow_node(yep_engine* e, yep_event* ev, int keyish) {
     }
     e->fold_n = 0;
     int crossed_break = 0;
+    uint32_t flow_breaks = 1; /* the break count before the next piece */
     for (;;) {
         yep_span s = yep_scan_plain(e->p, e->len, e->pos, 1);
         if (s.end == s.start && e->fold_n == 0) {
@@ -1366,7 +1631,7 @@ static int e_flow_node(yep_engine* e, yep_event* ev, int keyish) {
         if (s.end > s.start) {
             e->fold[e->fold_n].content.p = e->p + s.start;
             e->fold[e->fold_n].content.len = s.end - s.start;
-            e->fold[e->fold_n].breaks_before = (e->fold_n == 0) ? 0 : 1;
+            e->fold[e->fold_n].breaks_before = (e->fold_n == 0) ? 0 : flow_breaks;
             e->fold_n++;
         }
         if (s.term == YEP_TERM_EOL || s.term == YEP_TERM_COMMENT) {
@@ -1375,21 +1640,58 @@ static int e_flow_node(yep_engine* e, yep_event* ev, int keyish) {
                 e_skip_to_eol(e);
                 break; /* a comment ends the scalar: the next token is new */
             }
-            e_line_done(e, e->pos);
             crossed_break = 1;
-            {
+            /* Count EVERY break up to the next piece: 1 folds to a
+             * space, n>1 folds to n-1 newlines (the plain law —
+             * "[0\r\r)]" is "0\n)", the nightly's run 39070140324).
+             * The seed is 0 because the loop below consumes the
+             * piece-terminating break itself. Trailing spaces of the
+             * piece's own line are skipped first — yep_scan_plain can
+             * stop before them, and "br == 0 at a space" must never
+             * be read as content (that spun forever on "[0 \n )]"). */
+            uint32_t nbreaks = 0;
+            int ended = 0;
+            for (;;) {
+                e_skip_inline_space(e);
                 yep_line_info cl = e_line_info_here(e);
                 if (cl.flags & YEP_LF_COMMENT) {
                     e_line_done(e, cl.end);
-                    break; /* a comment line ends the scalar too */
+                    ended = 1; /* a comment line ends the scalar too */
+                    break;
+                }
+                size_t br = yep_scan_break_len(e->p, e->len, e->pos);
+                if (br == 0) {
+                    break; /* content on this line */
+                }
+                nbreaks++;
+                e->pos += br;
+                e->line++;
+                e->line_start = e->pos;
+                e->li_cache_line = 0;
+                e->shape_cache_line = 0;
+                e->facts_cache_line = 0;
+                if (e->pos >= e->len) {
+                    ended = 1;
+                    break;
                 }
             }
-            if (e_flow_ws(e) != 0) {
-                return -1;
+            flow_breaks = nbreaks;
+            if (ended) {
+                break;
             }
             if (e->pos < e->len && e->p[e->pos] != ']' && e->p[e->pos] != '}' &&
-                e->p[e->pos] != ',' && !e_comment_at(e) && e->p[e->pos] != '\n' &&
-                e->p[e->pos] != '\r') {
+                e->p[e->pos] != ',' && !e_comment_at(e)) {
+                /* a document marker line ends the scalar (and with it
+                 * the unclosed flow) — folding across "---" absorbed
+                 * the marker and the whole route's scalar grew past the
+                 * chunked route's deferral boundary (the nightly's
+                 * round 104) */
+                yep_line_info ml = e_line_info_here(e);
+                if (ml.flags & (YEP_LF_DOC_START | YEP_LF_DOC_END)) {
+                    break; /* real document markers end the scalar; a
+                            * directive-LIKE '%' line stays content
+                            * mid-flow (XLQ9, the UT92 spec example) */
+                }
                 continue; /* continuation on a following line */
             }
             break; /* at a boundary; pos is on the separator/close */
@@ -1439,6 +1741,16 @@ static int e_flow_node(yep_engine* e, yep_event* ev, int keyish) {
 static void jx_advance_line(yep_engine* e, size_t* from, size_t to, uint32_t* line,
                             size_t* line_start) {
     yep_scan_advance_line(e->p, from, to, line, line_start);
+    /* a lone \r sitting at the walk boundary (to - 1) ends the line
+     * AT to, but the scan's walk cannot peek at p[to] (it does not
+     * know the buffer end) — correct it here with the engine's own
+     * length: the fast path's marks after a \r-containing span sat
+     * one line low while the general kernel marked correctly (the
+     * nightly's runs 38549939326 + 38563005475) */
+    if (to > 0 && to <= e->len && e->p[to - 1] == '\r' && (to == e->len || e->p[to] != '\n')) {
+        (*line)++;
+        *line_start = to;
+    }
 }
 
 /* A flow node followed by ':' on the same line is a KEY: the caller
@@ -1446,7 +1758,11 @@ static void jx_advance_line(yep_engine* e, size_t* from, size_t to, uint32_t* li
  * is_key logic runs. Shared by both fast paths (grammar fact). */
 static int e_flow_key_after(const char* p, size_t len, size_t close) {
     size_t j = close + 1;
-    while (j < len && p[j] == ' ') {
+    /* tabs are inline whitespace too: "[]\t\t: |-" defers to the key
+     * machinery like its all-spaces sibling, or the fast path commits
+     * the flow and then errors on the colon it cannot read as a key
+     * separator (the nightly's round 116) */
+    while (j < len && (p[j] == ' ' || p[j] == '\t')) {
         j++;
     }
     return j < len && p[j] == ':' &&
@@ -1455,7 +1771,14 @@ static int e_flow_key_after(const char* p, size_t len, size_t close) {
 }
 
 /* Block-level flow lines must out-indent the parent (9C9N): any line
- * start inside the span at or left of the floor falls back. */
+ * start inside the span at or left of the floor falls back — the
+ * closer's own line included ("a: {\n  x: 1\n}\nb: 3" is a suite
+ * error; only libyaml accepts it). The scan must cover the closer
+ * line: its start sits AT the close offset, outside the loop below,
+ * so it is checked explicitly — the general kernel's per-line check
+ * rejects it, and the fast path must agree (the nightly's run
+ * 38280372447: whole vs chunked split across the fast/slow paths and
+ * produced two different verdicts for the same bytes). */
 static int e_flow_floor_ok(const char* p, size_t open, size_t close, uint16_t floor) {
     size_t j = open;
     while (j < close) {
@@ -1472,6 +1795,20 @@ static int e_flow_floor_ok(const char* p, size_t open, size_t close, uint16_t fl
         }
         j++;
     }
+    if (close < (size_t)-1 && close > open) {
+        size_t ls = close;
+        uint32_t ind = 0;
+        while (ls > 0 && p[ls - 1] != '\n') {
+            ls--;
+        }
+        while (ls < close && p[ls] == ' ') {
+            ind++;
+            ls++;
+        }
+        if (ind <= floor) {
+            return 0;
+        }
+    }
     return 1;
 }
 
@@ -1490,6 +1827,7 @@ static int e_flow_json(yep_engine* e, yep_view anchor, yep_view tag, uint32_t an
      * builder's close, then commit or roll back. ---- */
     if (e->ev_scopes == 0 && e->sink != NULL && e->sink->on_flow_build != NULL) {
         size_t bclose = 0;
+        uint32_t serial_at_open = e->anchor_serial;
         int rc = e->sink->on_flow_build(e->sink->ctx, p, open_pos, len, e->line, e->line_start,
                                         anchor, tag, anchor_id, e->max_depth, &bclose);
         if (rc < 0) {
@@ -1509,6 +1847,14 @@ static int e_flow_json(yep_engine* e, yep_view anchor, yep_view tag, uint32_t an
             if (e->sink->on_flow_commit(e->sink->ctx) != 1) {
                 return -2;
             }
+            /* the commit places the whole subtree at once: every anchor
+             * defined during the flow's parse belongs to it (the builder
+             * placed their nodes; the engine never sees the ids
+             * individually) — mark the range so a later alias may parse */
+            e_anchor_mark(e, anchor_id);
+            for (uint32_t aid = serial_at_open + 1; aid <= e->anchor_serial; aid++) {
+                e_anchor_mark(e, aid);
+            }
             size_t from = open_pos;
             uint32_t ln = e->line;
             size_t ls = e->line_start;
@@ -1530,6 +1876,12 @@ static int e_flow_json(yep_engine* e, yep_view anchor, yep_view tag, uint32_t an
         yep_json_walk w;
         yep_json_tok t;
         yep_json_walk_init(&w, p, len, open_pos, e->max_depth);
+        w.strict = 1; /* the YAML fast path is byte-for-byte JSON only:
+                       * a lenient walk accepted number/literal keys
+                       * ("{9:1}" -> {9->1}) that the general kernel
+                       * reads as the plain scalar "9:1" — whole and
+                       * chunked parses took different paths and
+                       * diverged (the nightly's run 38513849602) */
         for (;;) {
             yep_jw_status st = yep_json_walk_next(&w, &t);
             if (st == YEP_JW_REJECT) {
@@ -1548,7 +1900,13 @@ static int e_flow_json(yep_engine* e, yep_view anchor, yep_view tag, uint32_t an
      * skips the flow_enforce rescan AND the per-event line bookkeeping
      * below; both are no-ops without a newline, and pass 1 already
      * walked these bytes (TODO.restructure/45, Phase B slice). */
-    int single_line = (memchr(p + open_pos, '\n', close - open_pos) == NULL);
+    /* a span carrying ANY \r is multi-line for marking purposes: the
+     * lone-\r walk below counts real breaks, and a single-line span
+     * skips that walk entirely — a '{\r\r\r\r}' span kept its marks
+     * on line 1 while the general kernel (and libyaml) counted four
+     * breaks (the nightly's run 38585830922) */
+    int single_line = (memchr(p + open_pos, '\n', close - open_pos) == NULL) &&
+                      (memchr(p + open_pos, '\r', close - open_pos) == NULL);
 
     if (e_flow_key_after(p, len, close)) {
         return 0;
@@ -1569,9 +1927,15 @@ static int e_flow_json(yep_engine* e, yep_view anchor, yep_view tag, uint32_t an
         ev.anchor_id = anchor_id;
         ev.tag = tag;
         ev.line = cur_line;
-        ev.col = (uint32_t)(open_pos + 1 - cur_ls) + 1;
+        /* the general kernel's opener marks, mirrored exactly: col =
+         * the indicator's 1-based column, end one past it. The old +1
+         * made every fused open sit one column right of the same
+         * span's general-kernel parse — a <24-byte span cut at a
+         * chunk boundary routes general while the whole parse routes
+         * fused (the nightly's run 38173499680) */
+        ev.col = (uint32_t)(open_pos - cur_ls) + 1;
         ev.end_line = cur_line; /* flow opens end after the indicator */
-        ev.end_col = (uint32_t)(open_pos + 2 - cur_ls) + 1;
+        ev.end_col = (uint32_t)(open_pos - cur_ls) + 2;
         if (emit_now(e, &ev) != 0) {
             return -2;
         }
@@ -1618,9 +1982,16 @@ static int e_flow_json(yep_engine* e, yep_view anchor, yep_view tag, uint32_t an
             if (!single_line)
                 jx_advance_line(e, &cur_scan, i, &cur_line, &cur_ls);
             ev.line = cur_line;
-            ev.col = (uint32_t)(i + 1 - cur_ls) + 1;
+            /* the opener's own column, like site 1 and the general
+             * kernel: the fused walk's nested open rode the OLD +1
+             * (one past the indicator) while the outer opener was
+             * already fixed -- whole parses >=24 bytes route fused,
+             * the <24-byte chunked prefix routes general, and the
+             * nested start sat one column right (the nightly's round
+             * 122, "[[]": whole 1:3 vs chunk 1:2) */
+            ev.col = (uint32_t)(i - cur_ls) + 1;
             ev.end_line = cur_line; /* flow opens end after the indicator */
-            ev.end_col = (uint32_t)(i + 2 - cur_ls) + 1;
+            ev.end_col = (uint32_t)(i + 1 - cur_ls) + 1;
             if (emit_now(e, &ev) != 0) {
                 return -2;
             }
@@ -1686,14 +2057,6 @@ static int e_flow_json(yep_engine* e, yep_view anchor, yep_view tag, uint32_t an
             ev.style = YEP_STYLE_PLAIN;
             ev.implicit = 1;
         }
-        /* a map's first scalar of a pair is a KEY: the 1024-character
-         * simple-key limit applies (raw span, quotes included) */
-        if (stk[sd - 1] && kpending[sd - 1] == 0) {
-            size_t kspan = raw_end - vstart;
-            if (kspan > YEP_MAX_SIMPLE_KEY) {
-                return e_fail(e, YEP_ERR_KEY_TOO_LONG, vstart);
-            }
-        }
         if (raw_end == vstart) {
             raw_end = i; /* numbers/literals advance i, not raw_end */
         }
@@ -1703,6 +2066,15 @@ static int e_flow_json(yep_engine* e, yep_view anchor, yep_view tag, uint32_t an
             return -2;
         }
         if (stk[sd - 1] && p[i] == ':' && kpending[sd - 1] == 0) {
+            /* the simple-key law rides the colon: libyaml keeps a flow
+             * key possible while (colon - key start) <= 1024 in
+             * characters -- the quotes count against quoted keys and a
+             * multibyte code point counts once (the nightly's round 108
+             * shrink carries a 2-byte char at byte delta 1025) */
+            if (i - vstart > YEP_MAX_SIMPLE_KEY &&
+                yep_simple_key_chars(p + vstart, i - vstart) > YEP_MAX_SIMPLE_KEY) {
+                return e_fail(e, YEP_ERR_KEY_TOO_LONG, vstart);
+            }
             kpending[sd - 1] = 2; /* key seen; the next scalar/collection is the value */
         }
     }
@@ -1727,6 +2099,8 @@ static void e_flow_frame_init(void* stv, int idx, int kind, int pending_key) {
         uint8_t pair_open;
         uint8_t pair_value;
         uint8_t pair_wrap;
+        uint8_t q_coll;   /* seq: an explicit '?' key collection awaits completion */
+        uint8_t key_coll; /* map: the nested collection opened in key position */
         int32_t buf_from;
         uint32_t entry_line;
         uint32_t entries;
@@ -1736,9 +2110,11 @@ static void e_flow_frame_init(void* stv, int idx, int kind, int pending_key) {
     st[idx].pending_key = (uint8_t)pending_key;
     st[idx].sep = 0;
     st[idx].just_closed = 0;
+    st[idx].key_coll = 0;
     st[idx].pair_open = 0;
     st[idx].pair_value = 0;
     st[idx].pair_wrap = 0;
+    st[idx].q_coll = 0;
     st[idx].buf_from = -1;
     st[idx].entry_line = 0;
     st[idx].entries = 0;
@@ -1753,6 +2129,8 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
         uint8_t pair_open;   /* seq: a buffered single-pair awaits its MAP_END */
         uint8_t pair_value;  /* seq: the open pair already has its value */
         uint8_t pair_wrap;   /* map frame pushed as a seq single-pair */
+        uint8_t q_coll;      /* seq: an explicit '?' key collection awaits completion */
+        uint8_t key_coll;    /* map: a nested collection opened in key position */
         int32_t buf_from;    /* seq: entry events buffered from this index */
         uint32_t entry_line; /* seq: line where the buffered entry ended */
         uint32_t entries;    /* completed entries (for trailing-comma detection) */
@@ -1863,7 +2241,24 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
             if (n >= e->max_depth) {
                 return e_fail(e, YEP_ERR_DEPTH, e->pos);
             }
-            st[n - 1].pair_value = 1;
+            if (q_key) {
+                /* the EXPLICIT key is the collection: mark its frame so
+                 * the pair completes with a null value when no ':' line
+                 * follows ("? [a]" / "? {b: 1}") — without the marker the
+                 * key leaked as a plain seq entry and a map-entry key
+                 * vanished outright (the nightly's round 101) */
+                if (st[n - 1].kind == 1) {
+                    st[n - 1].pending_key = 2;
+                } else {
+                    st[n - 1].q_coll = 1;
+                }
+            }
+            if (!q_key) {
+                /* a VALUE collection completes the pending pair; a KEY
+                 * collection must not (its pair completes at ':' or the
+                 * boundary with a null value) */
+                st[n - 1].pair_value = 1;
+            }
             unsigned char oc = (unsigned char)e->p[e->pos];
             e->pos++;
             yep_view pa = ev.anchor, pt = ev.tag; /* props before the opener */
@@ -1883,9 +2278,11 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
             st[n - 1].just_closed = 0;
             /* the nested collection is an entry of the parent frame; when
              * it appears in a map's value position it completes the pair */
+            int coll_key = (st[n - 1].kind == 1 && st[n - 1].pending_key == 0 && !q_key);
             if (st[n - 1].kind == 1 && st[n - 1].pending_key == 1) {
                 st[n - 1].pending_key = 0;
             }
+            st[n - 1].key_coll = (uint8_t)coll_key;
             st[n - 1].sep = 0;
             st[n - 1].entries++;
             e_flow_frame_init(st, n, (oc == '[') ? 0 : 1, 0);
@@ -1906,6 +2303,8 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
              * may precede it: "unquoted : value", "\"foo\"\n: bar").
              * After a QUOTED node the colon separates JSON-style. */
             size_t save_pos = e->pos;
+            uint32_t save_line = e->line;
+            size_t save_ls = e->line_start;
             if (e_flow_ws(e) != 0) {
                 return -1;
             } /* crosses newlines; restored below when no colon */
@@ -1926,13 +2325,19 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
                           e->p[e->pos + 1] == '\n' || e->p[e->pos + 1] == '\r' ||
                           yep_ct_is((unsigned char)e->p[e->pos + 1], YEP_CT_FLOW_IND)));
             if (!colon) {
-                e->pos = save_pos; /* not a key; the caller re-reads */
+                /* not a key; the caller re-reads — the line state goes
+                 * back with the cursor (the ws lookahead crossed the
+                 * newline; a stale e->line marked everything after the
+                 * flow node one line low) */
+                e->pos = save_pos;
+                e->line = save_line;
+                e->line_start = save_ls;
             }
             if (colon && st[n - 1].kind == 1 && st[n - 1].pending_key == 0) {
-                if (!q_key && quoted && ev.value.len + 2 > YEP_MAX_SIMPLE_KEY) {
-                    return e_fail(e, YEP_ERR_KEY_TOO_LONG, e->pos);
-                }
-                if (!q_key && !quoted && ev.value.len > YEP_MAX_SIMPLE_KEY) {
+                if (!q_key && ((quoted && yep_simple_key_chars(ev.value.p, ev.value.len) + 2 >
+                                              YEP_MAX_SIMPLE_KEY) ||
+                               (!quoted && yep_simple_key_chars(ev.value.p, ev.value.len) >
+                                               YEP_MAX_SIMPLE_KEY))) {
                     return e_fail(e, YEP_ERR_KEY_TOO_LONG, e->pos);
                 }
                 e->pos++;
@@ -1944,10 +2349,18 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
                 continue;
             }
             if (colon && st[n - 1].kind == 0) {
-                if (!q_key && quoted && ev.value.len + 2 > YEP_MAX_SIMPLE_KEY) {
-                    return e_fail(e, YEP_ERR_KEY_TOO_LONG, e->pos);
+                if (st[n - 1].pair_open && st[n - 1].pair_value) {
+                    /* "[s: 2:]" — the open pair already has its value;
+                     * a second single-pair would nest inside the value
+                     * slot and unbalance the event stream (the nightly's
+                     * run 38168927841). libyaml rejects the ':' mid-
+                     * scalar; so does the suite's flow grammar. */
+                    return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
                 }
-                if (!q_key && !quoted && ev.value.len > YEP_MAX_SIMPLE_KEY) {
+                if (!q_key && ((quoted && yep_simple_key_chars(ev.value.p, ev.value.len) + 2 >
+                                              YEP_MAX_SIMPLE_KEY) ||
+                               (!quoted && yep_simple_key_chars(ev.value.p, ev.value.len) >
+                                               YEP_MAX_SIMPLE_KEY))) {
                     return e_fail(e, YEP_ERR_KEY_TOO_LONG, e->pos);
                 }
                 if (st[n - 1].buf_from >= 0 && !quoted && !q_key &&
@@ -2013,11 +2426,11 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
                             return brc;
                         }
                     }
-                    yep_event nv;
-                    e_event_init(&nv, YEP_EV_SCALAR);
-                    nv.implicit = 1;
-                    nv.style = YEP_STYLE_PLAIN;
-                    if (emit_now(e, &nv) != 0) {
+                    /* the parsed key rides the slot the empty stand-in
+                     * occupied — dropping it lost the key's content AND
+                     * its anchor (an alias to it then failed the
+                     * placed-anchor check: the nightly's round 101) */
+                    if (emit_now(e, &ev) != 0) {
                         return -2;
                     }
                     continue;
@@ -2054,6 +2467,22 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
         unsigned char c = (unsigned char)e->p[e->pos];
         if (c == ',') {
             e->pos++;
+            if (st[n - 1].q_coll && st[n - 1].buf_from >= 0) {
+                int32_t bf0 = st[n - 1].buf_from;
+                st[n - 1].buf_from = -1;
+                e->ev_scopes--;
+                if (e_buf_wrap(e, (uint32_t)bf0) != 0) {
+                    return -2;
+                }
+                if (e->ev_scopes == 0 && e->ev_buf_n > 0) {
+                    int brc = e_buf_send(e, 0);
+                    if (brc != 0) {
+                        return brc;
+                    }
+                }
+                st[n - 1].q_coll = 0;
+                st[n - 1].pair_open = 1;
+            }
             if (st[n - 1].pair_open) {
                 if (!st[n - 1].pair_value) {
                     yep_event nv;
@@ -2099,11 +2528,39 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
                 }
                 st[n - 1].pending_key = 0;
             }
+            if (st[n - 1].kind == 1 && st[n - 1].key_coll && st[n - 1].pending_key == 0) {
+                /* "{[a], z: 1}" — a closed collection with no ':' is a
+                 * bare key: libyaml emits the implicit null value */
+                yep_event nv;
+                e_event_init(&nv, YEP_EV_SCALAR);
+                nv.implicit = 1;
+                nv.style = YEP_STYLE_PLAIN;
+                if (emit_now(e, &nv) != 0) {
+                    return -2;
+                }
+                st[n - 1].key_coll = 0;
+            }
             st[n - 1].sep = 1;
             st[n - 1].just_closed = 0;
             continue;
         }
         if (c == ']' || c == '}') {
+            if (st[n - 1].q_coll && st[n - 1].buf_from >= 0) {
+                int32_t bf0 = st[n - 1].buf_from;
+                st[n - 1].buf_from = -1;
+                e->ev_scopes--;
+                if (e_buf_wrap(e, (uint32_t)bf0) != 0) {
+                    return -2;
+                }
+                if (e->ev_scopes == 0 && e->ev_buf_n > 0) {
+                    int brc = e_buf_send(e, 0);
+                    if (brc != 0) {
+                        return brc;
+                    }
+                }
+                st[n - 1].q_coll = 0;
+                st[n - 1].pair_open = 1;
+            }
             while (st[n - 1].pair_wrap) {
                 /* a single-pair wrapper inside a sequence closes on any
                  * bracket ("[ : v ]", CFD4) */
@@ -2146,6 +2603,19 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
                 }
                 st[n - 1].pending_key = 0;
             }
+            if (st[n - 1].kind == 1 && st[n - 1].key_coll && st[n - 1].pending_key == 0) {
+                /* "{{}}" / "{[a]}" — the closed collection is a bare
+                 * key: libyaml emits the implicit null value before
+                 * the frame's own MAP_END */
+                yep_event nv;
+                e_event_init(&nv, YEP_EV_SCALAR);
+                nv.implicit = 1;
+                nv.style = YEP_STYLE_PLAIN;
+                if (emit_now(e, &nv) != 0) {
+                    return -2;
+                }
+                st[n - 1].key_coll = 0;
+            }
             if (st[n - 1].pair_open) {
                 if (!st[n - 1].pair_value) {
                     yep_event nv;
@@ -2217,6 +2687,7 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
             if (st[n - 1].kind == 1 && st[n - 1].just_closed) {
                 /* '[a, b]: v' inside a map — the closed collection is the key */
                 st[n - 1].just_closed = 0;
+                st[n - 1].key_coll = 0;
                 st[n - 1].pending_key = 1;
                 continue;
             }
@@ -2234,11 +2705,18 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
                 continue;
             }
             if (st[n - 1].kind == 0 && st[n - 1].buf_from >= 0) {
+                if (st[n - 1].pair_open && st[n - 1].pair_value) {
+                    /* "[s: 2\n:]" — the loop-top twin of the inline
+                     * colon guard: a buffered value cannot wrap as
+                     * another pair once the open pair is complete */
+                    return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+                }
                 if (st[n - 1].entry_line != e->line) {
                     /* the key ended on an earlier line */
                     return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
                 }
                 /* '[ [a, b]: v' — the buffered collection is the pair key */
+                st[n - 1].q_coll = 0;
                 int32_t bf0 = st[n - 1].buf_from;
                 int was_empty = ((uint32_t)bf0 == e->ev_buf_n);
                 st[n - 1].buf_from = -1;
@@ -2264,6 +2742,12 @@ static int e_flow(yep_engine* e, yep_view anchor, yep_view tag, uint32_t anchor_
                 continue; /* value next */
             }
             if (st[n - 1].kind == 0 && n >= 1) {
+                if (st[n - 1].pair_open) {
+                    /* "[s: : v]" — ':' in the open pair's value slot
+                     * is not node content (libyaml: "did not find
+                     * expected node content") */
+                    return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+                }
                 /* '[ : v' — single-pair mapping with an empty key */
                 if (n >= e->max_depth) {
                     return e_fail(e, YEP_ERR_DEPTH, e->pos);
@@ -2568,6 +3052,12 @@ static int e_classified(yep_engine* e, uint16_t floor_col) {
     if (prepared) {
         if (e->sink != NULL && e->sink->on_block_pair != NULL) {
             yep_view key = {e->p + sh->key_start, sh->key_end - sh->key_start};
+            /* the fused placement places the value node: its anchor
+             * rides v — mark it so a later alias may parse (the
+             * placement sites are the alias check's ground truth; the
+             * classified KEY is always plain — anchored keys ride the
+             * general chain) */
+            e_anchor_mark(e, v.anchor_id);
             int built =
                 e->sink->on_block_pair(e->sink->ctx, &key, &v, pair_line, key_col, pair_val_col);
             if (built < 0) {
@@ -2691,6 +3181,33 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
 
     if (e_at_eol(e)) {
         /* properties with the value on following lines */
+        if (e->depth > 0 && e->frames[e->depth - 1].kind == YEP_FRAME_MAP &&
+            e->frames[e->depth - 1].col == e_col(e, node_at) &&
+            (!yep_view_is_empty(anchor) || !yep_view_is_empty(tag))) {
+            /* a props-only line at an ESTABLISHED pair position: the
+             * scanner never finds the simple key's ':' (libyaml:
+             * "could not find expected ':' while scanning a simple
+             * key"; Psych rejects "k: 1\n!!t: &b\n  n: m" and the
+             * anchor-only twins). The old path consumed the line as
+             * node props — the pair's key event vanished, the key's
+             * tag leaked onto the value node, and a long-tag value
+             * then lost its anchor at emit (the nightly's run
+             * 38275208009). The FIRST pair of a fresh map ("a:\n
+             * !!t: &c\n    n: m") has no frame at the column yet and
+             * stays legal. */
+            return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+        }
+        if (!yep_view_is_empty(pend_a) && !yep_view_is_empty(anchor)) {
+            /* a second props line carrying its own ANCHOR displaces the
+             * pend anchor (same-line-wins) — the displaced anchor stays
+             * in the nametab, so a later alias emits a dangling
+             * reference (the nightly's run 38271222289, "&a\n&a1\nF:
+             * *a" and its '? &a' explicit-key twin). libyaml rejects
+             * every nesting variant ("did not find expected <document
+             * start>" / "did not find expected key"); a TAG-only
+             * continuation ("&a\n!!str v") stays legal. */
+            return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+        }
         e->pend_anchor = node_a;
         e->pend_anchor_id = anchor_ordinal;
         e->pend_tag = node_t;
@@ -2730,8 +3247,24 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
 
     if (c == '?' && (e->pos + 1 >= e->len || e->p[e->pos + 1] == ' ' || e->p[e->pos + 1] == '\t' ||
                      e->p[e->pos + 1] == '\n' || e->p[e->pos + 1] == '\r')) {
-        if (ctx == YEP_CTX_AFTER_COLON) {
-            return e_fail(e, YEP_ERR_UNEXPECTED, e->pos); /* "key: ? a" */
+        if (ctx == YEP_CTX_AFTER_COLON || e->cv_line == e->line) {
+            /* "key: ? a" and ": ?" — a key indicator where a value
+             * belongs (libyaml rejects); accepting it produced an
+             * unpairable event stream whose orphaned anchored node
+             * the emit dropped (the nightly's round 102). The
+             * main-dispatch ':' line rides AFTER_DASH, so the
+             * colon's own line marks it. */
+            return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
+        }
+        if (!yep_view_is_empty(anchor) || !yep_view_is_empty(tag)) {
+            /* node properties followed by a second key indicator on
+             * the SAME line: libyaml "mapping keys are not allowed in
+             * this context" (psych rejects "? &a ? b" and "k: &a ? b";
+             * the cross-line twin "? &a\n  ? b" composes and stays
+             * legal). The old path opened the nested key map with the
+             * props dropped — a later alias then emitted a dangling
+             * reference (the nightly's run 38355778230). */
+            return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
         }
         if (e->pos > 0 && e->p[e->pos - 1] == '\t') {
             return e_fail(e, YEP_ERR_UNEXPECTED, e->pos); /* "?\t-" (Y79Y) */
@@ -2741,7 +3274,33 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
         if (rc != 0) {
             return rc;
         }
-        e->q_map_depth = e->depth;
+        if (e->qmd_n >= 16) {
+            return e_fail(e, YEP_ERR_DEPTH, e->pos); /* the depth-guard law */
+        }
+        /* a pending from an EARLIER line at this level completes with a
+         * null value before the new pair opens — without the flush the
+         * two pairs share one wrapper and the merge model leaves the
+         * later value an unpairable orphan (the nightly's round 102) */
+        /* a key indicator at the pending pair's own depth from a LATER
+         * line completes that pair with a null value (libyaml's
+         * same-indent KEY rule). The pending may still be mid-content
+         * (this '?' is being parsed as its content): arm the flag the
+         * flush keys on — the outer branch re-arms only if its slot
+         * survived. Without the flush the outer pair's value never
+         * emits and the DOM drops the unpaired node (the nightly's
+         * round 102). */
+        if (e->qmd_n > 0 && e->qmd_stack[e->qmd_n - 1] == e->depth &&
+            e->qmd_line[e->qmd_n - 1] != e->line) {
+            if (!e->q_value_pending) {
+                e->q_value_pending = 1;
+            }
+            int frc = e_flush_q_value(e);
+            if (frc != 0) {
+                return frc;
+            }
+        }
+        e->qmd_line[e->qmd_n] = e->line;
+        e->qmd_stack[e->qmd_n++] = e->depth;
         e->pos++;
         e_skip_inline_space(e);
         if (e->pos < e->len && e->p[e->pos] == ':' &&
@@ -2762,6 +3321,9 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
                     return -2;
                 }
                 e->pos++;
+                if (e->qmd_n > 0) {
+                    e->qmd_n--; /* the ':' line supplied the innermost value */
+                }
                 return e_parse_value(e, YEP_CTX_AFTER_COLON, col);
             }
             /* '? : x' — the ':' starts a nested pair: the KEY is that map */
@@ -2770,11 +3332,17 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
          * its content may ALIGN with the '?' column */
         e->q_key_pending = 1;
         {
+            int my_qmd = e->qmd_n; /* this pair's stack slot is my_qmd - 1 */
             int qrc = e_parse_value(e, YEP_CTX_AFTER_Q, col);
             if (qrc != 0) {
                 return qrc;
             }
-            e->q_value_pending = 1; /* until a ':' line supplies the value */
+            /* a later-line '?' completed this pair inside the content
+             * parse (the flush popped our slot): the flag must not
+             * re-arm, or the stale pending emits a stray null */
+            if (e->qmd_n >= my_qmd) {
+                e->q_value_pending = 1; /* until a ':' line supplies the value */
+            }
             return 0;
         }
     }
@@ -2804,12 +3372,20 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
         }
         size_t save = e->pos;
         uint32_t line0 = e->line;
+        size_t ls0 = e->line_start;
         if (e_skip_flow(e) != 0) {
             return -1;
         }
         e_skip_inline_space(e);
         int is_key = e_colon_at(e, e->pos) && e->line == line0;
+        /* the pre-scan tracks lines while it crosses them; the re-scan
+         * below re-derives every mark from the open position, so the
+         * line state must go back with the cursor (the nightly's run
+         * 38280372447: a multi-line flow's open event marked at the
+         * pre-scan's far line, diverging from the JSON fast path) */
         e->pos = save;
+        e->line = line0;
+        e->line_start = ls0;
         if (is_key && ctx == YEP_CTX_AFTER_COLON) {
             return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
         }
@@ -2822,12 +3398,15 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
             if (rc != 0) {
                 return rc;
             }
-            rc = e_flow(e, node_a, node_t, node_aid);
+            /* the pend props went to the mapping; the key collection
+             * keeps only same-line props (Psych: "!t\n[a]: v" tags
+             * the map, "!t [a]: v" tags the key) */
+            rc = e_flow(e, anchor, tag, anchor_ordinal);
             if (rc != 0) {
                 return rc;
             }
             e->pos++; /* ':' */
-            return e_parse_value(e, YEP_CTX_AFTER_COLON, key_col);
+            return e_pair_value_done(e, ctx, key_col);
         }
         {
             e->flow_floor = floor_col;
@@ -2863,11 +3442,19 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
             if (rc != 0) {
                 return rc;
             }
+            /* the pend props went to the mapping; the key keeps only
+             * same-line props — ev carries the merged views and would
+             * leak the map's tag onto the key (the nightly's
+             * byte-instability: "!<!>\n\"\":\n" re-parsed with a
+             * tagged first key and never re-stabilized) */
+            ev.anchor = anchor;
+            ev.anchor_id = anchor_ordinal;
+            ev.tag = tag;
             if (emit_now(e, &ev) != 0) {
                 return -2;
             }
             e->pos++; /* ':' */
-            return e_parse_value(e, YEP_CTX_AFTER_COLON, key_col);
+            return e_pair_value_done(e, ctx, key_col);
         }
         if (!e_at_eol(e)) {
             return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
@@ -2898,7 +3485,7 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
                 return -2;
             }
             e->pos++;
-            return e_parse_value(e, YEP_CTX_AFTER_COLON, key_col);
+            return e_pair_value_done(e, ctx, key_col);
         }
         if (!e_at_eol(e)) {
             return e_fail(e, YEP_ERR_UNEXPECTED, e->pos);
@@ -2976,7 +3563,7 @@ static int e_node(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
             e->pos++;
         }
         e->pos++; /* past ':' */
-        return e_parse_value(e, YEP_CTX_AFTER_COLON, key_col);
+        return e_pair_value_done(e, ctx, key_col);
     }
 
     ev.value.p = e->p + s.start;
@@ -3072,25 +3659,39 @@ static int e_parse_value(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
             goto empty_value;
         }
         if (li.indent == floor_col && e->depth > 0 &&
-            (ctx == YEP_CTX_AFTER_COLON || ctx == YEP_CTX_VALUE_LINE) &&
+            (ctx == YEP_CTX_AFTER_COLON || ctx == YEP_CTX_VALUE_LINE || ctx == YEP_CTX_AFTER_Q) &&
             (li.first == '&' || li.first == '!')) {
             /* Only PROPS-ONLY lines are new nodes, not values
-             * ("key: &x\n!!map\na: b"); "&anchor c: 3" is a keyed pair */
+             * ("key: &x\n!!map\na: b"); "&anchor c: 3" is a keyed pair.
+             * UNDER AN EXPLICIT '?' KEY a props-only line is worse: the
+             * key would span lines waiting for a ':' that its own
+             * props absorb — libyaml rejects ("could not find expected
+             * ':' while scanning a simple key"), and absorbing the
+             * props DROPPED the key's anchor so the emission wrote an
+             * alias to an anchor that no longer existed ("? &a\n&F\n:
+             * *a", the nightly's run 38207965687) */
             size_t t = li.offset + li.indent;
             int only_props = 1;
+            char prev = ' '; /* '#' is a comment only after a blank —
+                              * mid-token it is content ("&a ?#:" is a
+                              * keyed pair whose plain carries a '#',
+                              * the nightly's run 38204470906) */
             while (t < li.end) {
                 char pc = e->p[t];
                 if (pc == ' ' || pc == '\t') {
+                    prev = pc;
                     t++;
                     continue;
                 }
+                int pc_comment = (pc == '#' && (prev == ' ' || prev == '\t'));
                 if (pc == '&' || pc == '!' || pc == '<' || pc == ',' || pc == '>' ||
-                    (pc != '\n' && pc != '\r' && pc != '#' &&
+                    (pc != '\n' && pc != '\r' && !pc_comment &&
                      !yep_ct_is((unsigned char)pc, YEP_CT_FLOW_IND) && pc != ':' && pc != ' ')) {
+                    prev = pc;
                     t++;
                     continue;
                 }
-                only_props = (pc == '\n' || pc == '\r' || pc == '#');
+                only_props = (pc == '\n' || pc == '\r' || pc_comment);
                 break;
             }
             if (only_props) {
@@ -3102,6 +3703,53 @@ static int e_parse_value(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
          * at any indent is the value ("&a\n- x"). Explicit-key content
          * may align with the '?' column. Flow nodes and property runs
          * continue the value even at the parent column ("k:\n!!seq\n[a]"). */
+        if (ctx == YEP_CTX_AFTER_Q && li.indent == floor_col && li.first == '-' &&
+            li.offset + 1 < li.end && e->p[li.offset + 1] != ' ' && e->p[li.offset + 1] != '\t' &&
+            e->p[li.offset + 1] != '\n' && e->p[li.offset + 1] != '\r') {
+            /* "-:" and friends: a dash with a non-space follower is a
+             * PLAIN key ("-" => null), never the pending key's content
+             * ("?\n-:" lost the null pair, the nightly's run
+             * 39045959147). A dash+space seq entry keeps the old
+             * content path below (the catch-38154662070 shape). */
+            goto empty_value;
+        }
+        if (ctx == YEP_CTX_AFTER_Q && li.indent == floor_col && li.first != ':' &&
+            li.first != '-' && yep_plain_first_ok(li.first)) {
+            /* a same-column PLAIN-START pair line is a SIBLING, not
+             * the key's content: the buffered "? &a" key would strand
+             * inside it and an alias to the anchor emitted a dangling
+             * reference ("? &a\nt: &b\n*a"; the nightly's run
+             * 38261610465; libyaml: "could not find expected ':'
+             * while scanning a simple key"). Dashes keep the old path
+             * (a block seq is the key's content — the catch-38154662070
+             * pin's shape). Stop: the null value flushes and the main
+             * loop owns the pair. */
+            if (li.first == '?') {
+                /* a '?'-led line at the key's own column is NEVER the
+                 * key's content: an indicator ("? k") or a plain-key
+                 * pair ("?:") alike, libyaml completes the pending key
+                 * (null value) and the main loop re-dispatches the
+                 * line. The old continuation swallowed it as a folded
+                 * piece and the pending pair lost its null value
+                 * ("?\n?:" parsed as one pair, libyaml two: the
+                 * nightly's run 39041682907) */
+                goto empty_value;
+            }
+            size_t sc = li.offset + li.indent;
+            int sibling = 0;
+            while (sc < li.end) {
+                if (e->p[sc] == ':' &&
+                    (sc + 1 >= (size_t)li.end || e->p[sc + 1] == ' ' || e->p[sc + 1] == '\t' ||
+                     e->p[sc + 1] == '\n' || e->p[sc + 1] == '\r')) {
+                    sibling = 1;
+                    break;
+                }
+                sc++;
+            }
+            if (sibling) {
+                goto empty_value;
+            }
+        }
         if (li.indent > floor_col || e->depth == 0 ||
             (ctx == YEP_CTX_AFTER_Q && li.indent == floor_col && li.first != ':') ||
             ((li.first == '[' || li.first == '{') && li.indent == floor_col) ||
@@ -3112,6 +3760,17 @@ static int e_parse_value(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
              * fixture shape) */
             (vctx == YEP_CTX_VALUE_LINE && (li.first == '|' || li.first == '>') &&
              li.indent == floor_col)) {
+            /* an empty-key ':' line cannot be a pending value's
+             * content — libyaml errors ("did not find expected key";
+             * the nightly's "- &a\n :" byte-instability crasher).
+             * The same-line empty-key law lives in the shape arms. */
+            if (li.first == ':') {
+                size_t at2 = e->pos + li.indent + 1;
+                if (at2 >= e->len || e->p[at2] == ' ' || e->p[at2] == '\t' || e->p[at2] == '\n' ||
+                    e->p[at2] == '\r') {
+                    return e_fail(e, YEP_ERR_UNEXPECTED, e->pos + li.indent);
+                }
+            }
             e->pos += li.indent;
             if (++e->rec >= e->max_depth) {
                 e->rec--;
@@ -3155,6 +3814,12 @@ empty_value: {
     { /* libyaml: the implicit null sits just past the key's colon
        * ("k:   " -> col 2, not the line end), zero-span */
         size_t at = e->pos;
+        if (at > e->len) {
+            at = e->len; /* the cursor may stand one past EOF after a
+                          * flow close scan (the nightly's run
+                          * 38147359781, '[&"[?:\n?(\nu\n?"]:...') —
+                          * zero-copy means the mark reads in-bounds */
+        }
         while (at > 0 && (e->p[at - 1] == ' ' || e->p[at - 1] == '\t' || e->p[at - 1] == '\n' ||
                           e->p[at - 1] == '\r')) {
             at--; /* the cursor may sit lines past the deferred key */
@@ -3236,9 +3901,13 @@ yep_engine* yep_engine_create(const yep_allocator* sys) {
 
 /* YAML 1.2 line breaks beyond \n/\r: NEL, LS, PS. When present, the
  * input is copied with each normalized to a single '\n' (libyaml reader
- * behavior); inputs without them keep the zero-copy path. */
-static const char* e_normalize_breaks(yep_engine* e, const char* p, size_t len) {
-    char* out = yep_engine_normalize_breaks(e->sys, p, len, NULL);
+ * behavior); inputs without them keep the zero-copy path. The copied
+ * length is not strlen()'s: the INPUT may carry NUL bytes of its own,
+ * and a strlen() of the copy truncates the run at the first one (the
+ * nightly's run 38524928004: "\0\n---\r<U+2028>" whole-parsed as an
+ * empty stream while the chunked cut skipped the copy). */
+static const char* e_normalize_breaks(yep_engine* e, const char* p, size_t len, size_t* out_len) {
+    char* out = yep_engine_normalize_breaks(e->sys, p, len, out_len);
     if (out == NULL) {
         return p;
     }
@@ -3322,17 +3991,71 @@ typedef struct yep_stepstate {
     size_t scanned;     /* bytes folded into quote/flow/comment state */
     int in_flow;        /* open [ { depth */
     int quote;          /* 0 none, else the opening quote char */
+    int in_verbatim;    /* inside a "!<...>" verbatim tag: cuts would
+                         * split the tag across the chunk boundary */
     int in_comment;     /* inside a # comment (until the line break) */
     int saw_directive;  /* a % line awaits its --- document */
     int started;        /* STREAM_START emitted */
     uint32_t line_base; /* whole-stream lines consumed by earlier runs */
+    int bs_open;        /* a block scalar's content lines are pending: a
+                         * '>' / '|' header was seen and its terminator
+                         * has not */
+    uint32_t bs_indent; /* the header line's indent: the content floor */
+    int tok_start;      /* the next word may begin here: quotes are
+                         * tokens only at a word start (the "A!'- %YAML"
+                         * plain's apostrophe is content, not a quote) */
+    int word_led;       /* the current word began with an indicator */
+    int at_break;       /* the previous position was a line break
+                         * (multibyte breaks leave a non-break byte as
+                         * p[i-1], so the '#' prev-byte test misses them) */
 } yep_stepstate;
 
 static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep_sink* sink,
                            int emit_start, int emit_end);
 
+void yep_engine_front_done(yep_engine* e) {
+    e->front_done = 1;
+}
+
 int yep_engine_run(yep_engine* e, const char* buf, size_t len, const yep_sink* sink) {
-    return engine_run_impl(e, buf, len, sink, 1, 1);
+    /* the encoding front-end every raw byte-taking entry owns (push,
+     * pull, schema, iterparse's first chunk, the libyaml differential):
+     * BOM sniff + UTF-16/32 transcode. ANY head BOM is a mark -- a lone
+     * one is an empty stream, UTF-8 included (libyaml's reader; the
+     * nightly's round 122 parsed a lone EF BB BF as a U+FEFF scalar
+     * where libyaml ended the stream). The front-end runs ONCE per
+     * engine: parse.c/values.c pre-strip and mark it, and later
+     * chunked runs never re-sniff (a mid-stream U+FEFF is content --
+     * iterparse's chunk heads would otherwise be eaten). */
+    const char* data = buf;
+    size_t data_len = len;
+    if (!e->front_done) {
+        e->front_done = 1;
+        yep_encoding enc = YEP_ENC_UNKNOWN;
+        size_t bom = yep_bom_sniff((const unsigned char*)buf, len, &enc);
+        data = buf + bom;
+        data_len = len - bom;
+        if (enc == YEP_ENC_UTF16LE || enc == YEP_ENC_UTF16BE || enc == YEP_ENC_UTF32LE ||
+            enc == YEP_ENC_UTF32BE) {
+            size_t tlen = 0;
+            size_t terr = 0;
+            int rc = yep_transcode_to_utf8(e->sys, enc, (const unsigned char*)data, data_len,
+                                           &e->enc_buf, &tlen, &terr);
+            if (rc != 0) {
+                yep_error_set(&e->err, YEP_ERR_ENCODING, 1, 1, terr, "ill-formed input encoding");
+                return -1;
+            }
+            size_t pverr = 0;
+            if (!yep_printable_validate(e->enc_buf, tlen, &pverr)) {
+                yep_error_set(&e->err, YEP_ERR_ENCODING, 1, 1, pverr,
+                              "non-printable character at byte %zu", pverr);
+                return -1;
+            }
+            data = (const char*)e->enc_buf;
+            data_len = tlen;
+        }
+    }
+    return engine_run_impl(e, data, data_len, sink, 1, 1);
 }
 
 void yep_engine_destroy(yep_engine* e) {
@@ -3346,7 +4069,9 @@ void yep_engine_destroy(yep_engine* e) {
         e->step = NULL;
     }
     yep_nametab_free(&e->anchors);
+    yep_free(e->sys, e->anchor_placed);
     yep_free(e->sys, e->norm_buf);
+    yep_free(e->sys, e->enc_buf);
     yep_pool_destroy(e->pool);
     yep_free(e->sys, e);
 }
@@ -3370,12 +4095,6 @@ void yep_engine_destroy(yep_engine* e) {
 /* A quote opens a scalar only where a value can begin; anywhere else
  * it is literal plain text (the apostrophe in "don't"). This is exact
  * on valid YAML: a quote at a value position always opens. */
-static int quote_opens(char prev) {
-    return prev == '\n' || prev == ' ' || prev == '\t' || prev == '-' || prev == ':' ||
-           prev == '?' || prev == ',' || prev == '[' || prev == '{' || prev == '&' || prev == '*' ||
-           prev == '!';
-}
-
 /* Advances quote/flow/comment state over buf[scanned, len) and returns
  * the offset of the LAST safe cut (0 = none). When the final bytes'
  * meaning depends on bytes not yet fed (a quote that may be doubled,
@@ -3387,10 +4106,35 @@ static size_t step_scan(yep_stepstate* st) {
     size_t hold = st->len;
     size_t i = st->scanned;
     for (; i < st->len; i++) {
-        char c = p[i];
+        unsigned char c = (unsigned char)p[i];
         if (st->in_comment) {
+            /* the engine normalizes NEL/LS/PS to \n before the parse,
+             * so they end a comment too -- and they are LINE BREAKS:
+             * the line-start state must arm exactly like the main
+             * path's break branches, or the post-break '#' reads as
+             * content (at_break stays 0), a closer inside it closes
+             * the scan's flow while the engine's stays open, and the
+             * next --- cut lands inside that flow ("{\n#\u2029#]\n---
+             * {..." whole 2 / chunked 3, the nightly's run
+             * 39062394941) */
             if (c == '\n') {
                 st->in_comment = 0;
+                st->tok_start = 1;
+                st->word_led = 0;
+                st->at_break = 1;
+            } else if (c == 0xC2 && i + 1 < st->len && (unsigned char)p[i + 1] == 0x85) {
+                i++;
+                st->in_comment = 0;
+                st->tok_start = 1;
+                st->word_led = 0;
+                st->at_break = 1;
+            } else if (c == 0xE2 && i + 2 < st->len && (unsigned char)p[i + 1] == 0x80 &&
+                       ((unsigned char)p[i + 2] & 0xFE) == 0xA8) {
+                i += 2;
+                st->in_comment = 0;
+                st->tok_start = 1;
+                st->word_led = 0;
+                st->at_break = 1;
             }
             continue;
         }
@@ -3422,18 +4166,137 @@ static size_t step_scan(yep_stepstate* st) {
             }
             continue;
         }
+        if (st->in_verbatim) {
+            if (c == '>') {
+                st->in_verbatim = 0;
+            }
+            continue; /* verbatim tag bytes never cut (a truncated tag
+                       * at the buffer end holds the tail whole) */
+        }
         if (c == '#') {
             char prev = i > 0 ? p[i - 1] : '\n';
-            if (prev == '\n' || prev == ' ' || prev == '\t') {
+            if (prev == '\n' || prev == '\r' || prev == ' ' || prev == '\t' || st->at_break) {
                 st->in_comment = 1;
+                st->at_break = 0;
+                continue;
+            }
+        }
+        if (c == '\n' || (c == '\r' && (i + 1 >= st->len || p[i + 1] != '\n'))) {
+            /* a lone \r is a line break too (the engine's break rule);
+             * missing it left the line-start state desynced across the
+             * cut and whole/chunked marked the flow's END differently
+             * (the nightly's run 38549939326) */
+            st->tok_start = 1;
+            st->word_led = 0;
+            st->at_break = 1;
+            continue;
+        }
+        if (c == 0xC2) {
+            /* NEL (C2 85): the engine's normalize maps it to \n before
+             * the parse -- the scan must break on it too, or a comment
+             * after the break goes unseen and the cut lands inside the
+             * still-open flow (the nightly's round 120). C2 leads all
+             * of U+0080-U+00BF: bounds FIRST (the old condition read
+             * p[i+1] past the buffer on a split), hold only a prefix
+             * that may still complete. */
+            if (i + 1 >= st->len) {
+                hold = i;
+                break;
+            }
+            if ((unsigned char)p[i + 1] == 0x85) {
+                i++;
+                st->tok_start = 1;
+                st->word_led = 0;
+                st->at_break = 1;
+                continue;
+            }
+        }
+        if (c == 0xE2) {
+            /* LS/PS (E2 80 A8 / A9): the same normalize law. E2 also
+             * leads U+2000-U+2FFF symbols, so hold only a prefix that
+             * may still complete into a break across the chunk
+             * boundary (byte-by-byte feeding splits it every time). */
+            if (i + 1 >= st->len) {
+                hold = i;
+                break;
+            }
+            if ((unsigned char)p[i + 1] != 0x80) {
+                /* not the LS/PS family: plain content */
+            } else if (i + 2 >= st->len) {
+                hold = i;
+                break;
+            } else if (((unsigned char)p[i + 2] & 0xFE) == 0xA8) {
+                i += 2;
+                st->tok_start = 1;
+                st->word_led = 0;
+                st->at_break = 1;
                 continue;
             }
         }
-        if ((c == '\'' || c == '"') && quote_opens(i > 0 ? p[i - 1] : '\n')) {
-            st->quote = c;
+        if (c == ' ' || c == '\t') {
+            /* in a flow a space always ends the token: the next byte
+             * may begin the VALUE ("{f 'x'}" — the quote after the
+             * plain key is the value's opener, and missing it let the
+             * cut land inside the quoted span, splitting the scalar
+             * across the chunk boundary: whole saw the far close and
+             * ate the '---' marker, chunked errored on the unterminated
+             * prefix — the nightly's run 38534965021) */
+            st->tok_start = (st->in_flow > 0) ? 1 : st->word_led;
             continue;
         }
+        if (st->tok_start) {
+            st->at_break = 0; /* any content byte ends the line-start
+                               * state ("x#": the '#' is content) */
+            if (c == '!') {
+                if (i + 1 >= st->len) {
+                    hold = i; /* a possibly-truncated '!<': the next
+                               * byte decides verbatim vs named */
+                    break;
+                }
+                if (p[i + 1] == '<') {
+                    st->in_verbatim = 1;
+                    i++; /* the '<' rides */
+                    continue;
+                }
+            }
+            st->word_led = (c == '&' || c == '*' || c == '!' || c == '-' || c == '?' || c == ':' ||
+                            c == ',' || c == '[' || c == '{' || c == ']' || c == '}');
+            if (c == '?' && st->in_flow > 0) {
+                /* a flow '?' opens the explicit-key MAP: the engine is
+                 * inside one more collection than the bracket count
+                 * shows, so marker cuts must stay out of it. The map
+                 * closes only at a closer (or never, on garbage), so
+                 * this over-counts on "[? a : b, c]" — the safe
+                 * direction (a missed cut degrades toward whole-parse
+                 * identity; the nightly's crash-c2894d7e, run
+                 * 39091724384, cut at a --- the engine read as flow
+                 * content and the lone '-' at the chunk edge errored
+                 * differently than the whole parse). */
+                st->in_flow++;
+            }
+            if (c == '\'' || c == '"') {
+                st->quote = c; /* a quote at a word start IS a quoted token */
+                st->tok_start = 0;
+                continue;
+            }
+            st->tok_start = 0;
+        }
+        if (c == ',' || c == ':' || c == '[' || c == '{' || c == ']' || c == '}') {
+            st->tok_start = 1; /* flow separators: the next byte may begin a
+                                * token with no space ("{\"a\":...") */
+        }
         if (c == '[' || c == '{') {
+            /* EVERY opener counts -- the scan cannot tell a flow
+             * opener from a block plain's content brace: "k: {", "&b["
+             * and "[\n---" are real opens, "U{" is not, and no local
+             * state separates them (the nightly's rounds 109-112 went
+             * through unconditional counting, tok_start, and
+             * tok_start+word_led). Over-counting only SUPPRESSES cuts
+             * (the marker logic below stays out of flow), and a missed
+             * cut degrades toward whole-parse semantics -- the
+             * identity invariant's safe direction. The directive law
+             * does not depend on this branch: the '%' case is hoisted
+             * below. */
             st->in_flow++;
             continue;
         }
@@ -3443,13 +4306,97 @@ static size_t step_scan(yep_stepstate* st) {
             }
             continue;
         }
+        if (c == '%') {
+            /* hoisted out of the block branch: a directive line must
+             * pair with its --- even when brace over-counting keeps
+             * the scan "in flow" (a content brace never closed) --
+             * the marker cut below lives inside the block branch and
+             * would otherwise land between the directive and its ---
+             * (the nightly's round 109) */
+            st->saw_directive = 1; /* must stay with its --- line */
+            continue;
+        }
         if (st->in_flow == 0) {
             char prev = i > 0 ? p[i - 1] : '\n';
-            if (prev != '\n') {
+            if (prev != '\n' && prev != '\r') {
                 continue;
             }
-            if (c == '%') {
-                st->saw_directive = 1; /* must stay with its --- line */
+            /* Block scalars: once a '>' / '|' header is seen, its
+             * content is literal and the fold reader's extent depends
+             * on bytes this run may not hold (markers, comments and
+             * blank lines all ride along to EOF in the lenient
+             * grammar) — so consume every line without updating the
+             * quote/flow/comment state and WITHOUT cutting: a split
+             * inside the fold changes the scalar's value (the
+             * nightly's run 38291177166, ">\n---\n" and friends).
+             * The fold ends only at the reader's own rule: a dedented
+             * line that is not blank, not a comment, not a marker. */
+            if (st->bs_open) {
+                size_t k = i;
+                uint32_t ind = 0;
+                while (k < st->len && p[k] == ' ') {
+                    ind++;
+                    k++;
+                }
+                if (k >= st->len) {
+                    hold = i; /* an incomplete line */
+                    break;
+                }
+                if (p[k] == '\n' || p[k] == '#') {
+                    size_t e = k;
+                    while (e < st->len && p[e] != '\n') {
+                        e++;
+                    }
+                    if (e >= st->len) {
+                        hold = i;
+                        break;
+                    }
+                    i = e; /* blank or comment content: the loop's i++ crosses the break */
+                    continue;
+                }
+                int marker =
+                    (p[k] == '-' && k + 2 < st->len && p[k + 1] == '-' && p[k + 2] == '-') ||
+                    (p[k] == '.' && k + 2 < st->len && p[k + 1] == '.' && p[k + 2] == '.');
+                if ((p[k] == '-' || p[k] == '.') && k + 2 >= st->len) {
+                    hold = i; /* a marker possibly truncated by the chunk */
+                    break;
+                }
+                if (!marker && st->bs_indent != (uint32_t)-1 && ind <= st->bs_indent) {
+                    st->bs_open = 0; /* the fold ends here: normal processing resumes */
+                } else {
+                    size_t e = k;
+                    while (e < st->len && p[e] != '\n') {
+                        e++;
+                    }
+                    if (e >= st->len) {
+                        hold = i;
+                        break;
+                    }
+                    i = e;
+                    continue;
+                }
+            }
+            if ((c == '>' || c == '|') &&
+                (i + 1 >= st->len || p[i + 1] == ' ' || p[i + 1] == '\t' || p[i + 1] == '\n' ||
+                 p[i + 1] == '\r' || (p[i + 1] >= '0' && p[i + 1] <= '9') || p[i + 1] == '+' ||
+                 p[i + 1] == '-')) {
+                uint32_t ind = 0;
+                size_t k = i;
+                while (k > 0 && p[k - 1] == ' ') {
+                    k--;
+                    ind++;
+                }
+                st->bs_open = 1;
+                st->bs_indent = ind;
+                size_t e = i;
+                while (e < st->len && p[e] != '\n') {
+                    e++;
+                }
+                if (e >= st->len) {
+                    hold = i; /* an incomplete header line */
+                    break;
+                }
+                i = e;
                 continue;
             }
             if (c == '-') {
@@ -3460,7 +4407,26 @@ static size_t step_scan(yep_stepstate* st) {
                 if (p[i + 1] == '-' && p[i + 2] == '-') {
                     char after = p[i + 3];
                     if (after == '\n' || after == ' ' || after == '\t' || after == '\r') {
-                        if (st->saw_directive == 0 && i > 0) {
+                        /* a doc-inline block scalar ("--- |"): the node
+                         * hangs off the DOCUMENT, so its fold follows
+                         * the root rule — only a later marker ends it
+                         * (col-0 lines are content). The line-start
+                         * header check below cannot see it (the '|'
+                         * rides mid-line after the marker), and
+                         * without the state the fold's content
+                         * poisons the quote/flow tracking (the
+                         * nightly's run 38352718743). */
+                        if (!st->bs_open) {
+                            size_t k2 = i + 3;
+                            while (k2 < st->len && (p[k2] == ' ' || p[k2] == '\t')) {
+                                k2++;
+                            }
+                            if (k2 < st->len && (p[k2] == '>' || p[k2] == '|')) {
+                                st->bs_open = 1;
+                                st->bs_indent = (uint32_t)-1; /* root rule: markers only */
+                            }
+                        }
+                        if (st->saw_directive == 0 && i > 0 && !st->bs_open) {
                             last_cut = i; /* interior document boundary */
                         }
                         st->saw_directive = 0; /* this --- owns the directives */
@@ -3484,6 +4450,7 @@ int yep_engine_step(yep_engine* e, const char* chunk, size_t len, int final, con
         }
     }
     yep_stepstate* st = e->step;
+    st->tok_start = 1; /* the buffer starts at a line start */
     if (len > 0) {
         if (st->len + len > st->cap) {
             size_t cap = st->cap ? st->cap : 4096;
@@ -3518,6 +4485,7 @@ int yep_engine_step(yep_engine* e, const char* chunk, size_t len, int final, con
         /* the tail began at a --- line in a clean state */
         st->in_flow = 0;
         st->quote = 0;
+        st->in_verbatim = 0;
         st->in_comment = 0;
         st->saw_directive = 0;
         return 0;
@@ -3539,8 +4507,17 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
     }
     yep_free(e->sys, e->norm_buf);
     e->norm_buf = NULL;
-    e->p = e_normalize_breaks(e, buf, len);
-    e->len = (e->norm_buf != NULL) ? strlen(e->norm_buf) : len;
+    /* enc_buf is NOT reset here: yep_engine_run's front-end may have
+     * transcoded THIS call's input into it microseconds ago -- buf
+     * points into it, and freeing it before the break-normalize scan
+     * was a use-after-free on every UTF-16/32 input (ASan: the 4-byte
+     * artifact "ff fe fe fe", the nightly's combined-build round).
+     * It is run-scoped scratch owned by the front-end; destroy frees
+     * it, and the next transcode replaces it. */
+    e->parsing_final = emit_end;
+    size_t norm_len = len;
+    e->p = e_normalize_breaks(e, buf, len, &norm_len);
+    e->len = norm_len;
     e->pos = 0;
     e->line = 1 + e->line_base;
     e->line_base = 0;
@@ -3550,12 +4527,17 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
     e->facts_cache_line = 0;
     e->depth = 0;
     yep_nametab_clear(&e->anchors);
+    if (e->anchor_placed != NULL) {
+        memset(e->anchor_placed, 0, e->anchor_placed_cap);
+    }
+    e->alias_memo_len = 0;
     e->tagmap_n = 0;
     e->saw_yaml = 0;
     e->doc_begin = (size_t)-1;
     e->doc_content = 0;
     e->q_key_pending = 0;
     e->q_value_pending = 0;
+    e->qmd_n = 0;
     e->sink = sink;
     yep_error_clear(&e->err);
     if (e->resolver == NULL) {
@@ -3603,6 +4585,26 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
                 e_fail(e, YEP_ERR_BAD_DIRECTIVE, e->pos); /* repeated %YAML */
                 goto fail;
             }
+            {
+                /* libyaml: the directive name is [0-9A-Za-z_-]+
+                 * followed by a blank or the line end -- an empty or
+                 * malformed name is an error ("could not find expected
+                 * directive name"). The lenient skip let "%]" ride as a
+                 * legal directive line whose DOCUMENT_START inclusion
+                 * diverged across the step boundary (the nightly's
+                 * round 117) */
+                size_t n0 = li.offset + li.indent + 1;
+                while (n0 < li.end && (yep_ct_is((unsigned char)e->p[n0], YEP_CT_ALPHA) ||
+                                       yep_ct_is((unsigned char)e->p[n0], YEP_CT_DIGIT) ||
+                                       e->p[n0] == '_' || e->p[n0] == '-')) {
+                    n0++;
+                }
+                if (n0 == li.offset + li.indent + 1 ||
+                    (n0 < li.end && e->p[n0] != ' ' && e->p[n0] != '\t')) {
+                    e_fail(e, YEP_ERR_BAD_DIRECTIVE, li.offset + li.indent + 1);
+                    goto fail;
+                }
+            }
             {
                 /* %YAML takes exactly one version argument */
                 size_t chk = li.offset + li.indent + 1;
@@ -3644,16 +4646,31 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
                     h0++;
                 }
                 size_t h1 = h0;
-                while (h1 < li.end && e->p[h1] != ' ') {
+                while (h1 < li.end && e->p[h1] != ' ' && e->p[h1] != '\t') {
                     h1++;
                 }
                 size_t p0 = h1;
-                while (p0 < li.end && e->p[p0] == ' ') {
+                while (p0 < li.end && (e->p[p0] == ' ' || e->p[p0] == '\t')) {
                     p0++;
                 }
-                size_t p1 = li.end;
-                while (p1 > p0 && (e->p[p1 - 1] == ' ' || e->p[p1 - 1] == '\r')) {
-                    p1--;
+                size_t p1 = p0;
+                while (p1 < li.end && e->p[p1] != ' ' && e->p[p1] != '\t' && e->p[p1] != '#') {
+                    p1++;
+                }
+                {
+                    /* libyaml: only blanks and an optional comment may
+                     * follow the prefix ("did not find expected comment
+                     * or line break") — trailing content riding the
+                     * prefix made parseable tags that never re-parsed
+                     * (the nightly's "%TAG !m! !mymy 3 ..." trap) */
+                    size_t r = p1;
+                    while (r < li.end && (e->p[r] == ' ' || e->p[r] == '\t')) {
+                        r++;
+                    }
+                    if (r < li.end && e->p[r] != '#') {
+                        e_fail(e, YEP_ERR_BAD_DIRECTIVE, r);
+                        return -1;
+                    }
                 }
                 if (h1 > h0 && p1 > p0 && e->p[h0] == '!') {
                     e->tagmap[e->tagmap_n].handle.p = e->p + h0;
@@ -3698,8 +4715,16 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
                     return -2;
                 }
                 doc_open = 0;
-                e->tagmap_n = 0;                /* directives are per-document */
-                yep_nametab_clear(&e->anchors); /* so are anchors */
+                e->tagmap_n = 0; /* directives are per-document */
+                yep_nametab_clear(&e->anchors);
+                if (e->anchor_placed != NULL) {
+                    memset(e->anchor_placed, 0, e->anchor_placed_cap);
+                }
+                e->alias_memo_len = 0; /* so are anchors */
+                e->alias_memo_len = 0; /* and the repeat-alias memo: doc 1's
+                                        * "*ORIGIN" memoized the ordinal and doc 2's
+                                        * identical name answered from it ACROSS the
+                                        * boundary (the nightly's run 38266487549) */
             }
             e_event_init(&ev, YEP_EV_DOCUMENT_START);
             ev.style = 1; /* explicit marker */
@@ -3713,6 +4738,14 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
             doc_open = 1;
             e->saw_yaml = 0;
             e->last_root_flow = 0; /* a new document may carry its own directives */
+            /* the '?' / ':' pair state is per-document too: doc 4's flow
+             * set q_key_pending and the boundary left it set, so doc 5's
+             * bare ':' skipped its empty-key event — whole-buffer lost a
+             * record the chunked feed (per-run reset) emitted (the
+             * nightly's run 38287390219) */
+            e->q_key_pending = 0;
+            e->q_value_pending = 0;
+            e->qmd_n = 0;
             e->pos = li.offset + li.indent + 3;
             e_skip_inline_space(e);
             if (!e_at_eol(e)) {
@@ -3732,12 +4765,18 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
         }
         if (li.flags & YEP_LF_DOC_END) {
             {
+                /* the "..." marker's line ends at a break — a lone '\r'
+                 * included: skipping it as whitespace read the NEXT
+                 * line's "---" as trailing junk on the marker's own line
+                 * ("...\r---\n" errored whole-buffer while the chunked
+                 * feed's boundary split the lines correctly — the
+                 * nightly's round 105) */
                 size_t rest = li.offset + li.indent + 3;
-                while (rest < e->len &&
-                       (e->p[rest] == ' ' || e->p[rest] == '\t' || e->p[rest] == '\r')) {
+                while (rest < e->len && (e->p[rest] == ' ' || e->p[rest] == '\t')) {
                     rest++;
                 }
-                if (rest < e->len && e->p[rest] != '\n' && e->p[rest] != '#') {
+                if (rest < e->len && e->p[rest] != '\n' && e->p[rest] != '\r' &&
+                    e->p[rest] != '#') {
                     e_fail(e, YEP_ERR_UNEXPECTED, rest);
                     goto fail;
                 }
@@ -3760,6 +4799,10 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
                 e_pos_mark(e, li.offset + li.indent + 3, &ev.end_line, &ev.end_col);
                 e->tagmap_n = 0; /* directives are per-document */
                 yep_nametab_clear(&e->anchors);
+                if (e->anchor_placed != NULL) {
+                    memset(e->anchor_placed, 0, e->anchor_placed_cap);
+                }
+                e->alias_memo_len = 0;
                 if (emit_now(e, &ev) != 0) {
                     return -2;
                 }
@@ -3862,18 +4905,33 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
                     goto fail;
                 }
             }
-            if (!e->q_key_pending) {
+            /* this ':' line completes the pending explicit pair only at
+             * the pending pair's own map depth — deeper inside the key's
+             * own content it is a plain bare-colon pair, and consuming
+             * the pending there skipped this line's empty-key emit,
+             * leaving an orphaned (anchorable) child the DOM could not
+             * pair and the emit dropped (the nightly's round 102) */
+            int completes_q =
+                e->q_key_pending && e->qmd_n > 0 && e->depth == e->qmd_stack[e->qmd_n - 1];
+            if (!completes_q) {
                 yep_event kv;
                 e_event_init(&kv, YEP_EV_SCALAR);
                 kv.style = YEP_STYLE_PLAIN;
                 kv.implicit = 1;
+                kv.line = e->line;
+                kv.col = (uint32_t)e_col(e, e->pos) + 1;
                 if (emit_now(e, &kv) != 0) {
                     return -2;
                 }
+            } else {
+                e->q_key_pending = 0;
+                e->q_value_pending = 0;
+                if (e->qmd_n > 0) {
+                    e->qmd_n--; /* the ':' line supplied the innermost value */
+                }
             }
-            e->q_key_pending = 0;
-            e->q_value_pending = 0;
             e->pos++;
+            e->cv_line = e->line; /* the value parses on THIS line's colon */
             rc = e_parse_value(e, YEP_CTX_AFTER_DASH, e->frames[e->depth - 1].col);
             if (rc != 0) {
                 if (rc == -2) {
@@ -3959,6 +5017,10 @@ static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep
         }
         e->tagmap_n = 0;
         yep_nametab_clear(&e->anchors);
+        if (e->anchor_placed != NULL) {
+            memset(e->anchor_placed, 0, e->anchor_placed_cap);
+        }
+        e->alias_memo_len = 0;
     }
     if (emit_end) {
         e_event_init(&ev, YEP_EV_STREAM_END);