yeptris 0.6.32.1-arm-linux-eabihf → 0.6.33.2-arm-linux-eabihf

data/vendor/libyeptris/src/yeptris/dom/ytape.c

@@ -20,6 +20,7 @@
 #include "dom/dom.h"
 #include "memory/allocator.h"
 #include "memory/pool.h"
+#include "parse/scalars.h"
 #include "resolve/resolver.h"
 #include "scan/json.h"
 #include "scan/scan.h"
@@ -355,6 +356,14 @@ static uint32_t yt_flow_scan(const yeptris_json_tape* s, int* long_key) {
                 return 0xFFFFu; /* deeper than the scratch stack: the
                                  * general kernel's depth path decides */
             }
+            /* the container consumes the parent frame's pending slot
+             * (key or value); after it closes the OTHER slot is next —
+             * a container value left key_next pinned at 1, and every
+             * key after a container value skipped the law (the
+             * nightly's round-108 shape: {"": [...], "giant": x}) */
+            if (d > 0 && st[d].map) {
+                st[d].key_next = (uint8_t)!st[d].key_next;
+            }
             d++;
             if ((uint32_t)d > maxd) {
                 maxd = (uint32_t)d;
@@ -371,7 +380,12 @@ static uint32_t yt_flow_scan(const yeptris_json_tape* s, int* long_key) {
         }
         if (st[d].map && st[d].key_next == 0) {
             uint32_t mlen = (uint32_t)(r >> 8) & 0xFFFFFFu;
-            if (kind == YEP_T_STR && mlen + 2u > 1024u) {
+            if (kind == YEP_T_STR && mlen + 2u > 1024u &&
+                yep_simple_key_chars((const char*)s->_src + (size_t)((uint32_t)(r >> 32)), mlen) +
+                        2 >
+                    1024) {
+                /* the budget counts characters (the round-108 shrink:
+                 * a 2-byte code point at byte delta 1025 is legal) */
                 *long_key = 1;
             }
             st[d].key_next = 1;
@@ -429,7 +443,9 @@ static int yt_flow_classify_record(yep_ytape* t, const char* p, size_t open, siz
         yep_json_walk w;
         yep_json_tok tok;
         yep_json_walk_init(&w, p, len, open, max_depth);
-        w.strict = t->flow_strict;
+        w.strict = 1; /* mirrors the engine pass-1 / dom builder gates:
+                       * reject anything non-JSON so the span falls to
+                       * the general kernel (whole/chunked agreement) */
         int exhausted = 0;
         for (;;) {
             if (w.i - open > 256) {
@@ -1128,8 +1144,11 @@ static size_t yt_flat_run(yep_ytape* t, const char* p, size_t pos, size_t len, u
         }
         unsigned char c = (unsigned char)p[li];
         if (c == '\t' || c == '-' || c == '&' || c == '!' || c == '*' || c == '\'' || c == '"' ||
-            c == '[' || c == '{' || c == '|' || c == '>' || c == '%' || c == '?') {
-            return pos; /* indicators, tab-led: the full arms */
+            c == '[' || c == '{' || c == '|' || c == '>' || c == '%' || c == '?' ||
+            !yep_plain_first_ok(c)) {
+            return pos; /* indicators, tab-led, and the plain-first law
+                           (a ']' key rode the flat-run — the nightly's
+                           marshal crasher "<: .ba\n]ge: 21"): full arms */
         }
         if (!stop_set || p[ls] != ':' || (ls + 1 < le && p[ls + 1] != ' ' && p[ls + 1] != '\t')) {
             return pos; /* not a plain key: value line */
@@ -1192,6 +1211,11 @@ static size_t yt_flat_run(yep_ytape* t, const char* p, size_t pos, size_t len, u
              (vt + 1 >= le || p[vt + 1] == ' ' || p[vt + 1] == '\t' || p[vt + 1] == '#'))) {
             return pos; /* block/flow/anchor values: the full arms */
         }
+        if (!yep_plain_first_ok(vc)) {
+            return pos; /* ']' '}' ',' '@' '`': no plain value can start
+                         * there (the nightly's "k1: --a &p{\n0: ]" marshal
+                         * crasher) — the engine errors cleanly */
+        }
         /* a terminating ':' inside the value is the mapping-values error */
         {
             const char* h = (const char*)memchr(p + vt, ':', le - vt);
@@ -1233,6 +1257,15 @@ static int yt_f_run(yt_fused* F) {
     st[0].started = 1; /* the root's start event defers to its first pair */
     int root_open = 0;
     int root_evented = 0;
+    uint32_t root_pair_col = 0; /* the root map's first pair line's column
+                                 * (0 = none seen): the second-root dedent
+                                 * law reads this, NOT content_col — the
+                                 * pending arm never set content_col (" k:
+                                 * &a", the nightly's run 39064966578,
+                                 * issue #630) and arming content_col here
+                                 * instead broke the " k: \n j: w" siblings
+                                 * (the next nightly's crash-753ce4c1: the
+                                 * map dissolved into four root scalars) */
     (void)yt_put(t, ((uint64_t)YTP_EV_COMPACT << 56) | 1u);
     (void)yt_put(t, ((uint64_t)YTP_EV_COMPACT << 56) | 3u);
     size_t pos = 0;
@@ -1362,6 +1395,28 @@ static int yt_f_run(yt_fused* F) {
                 } else {
                     uint8_t of = yt_f_open_form(&st[depth - 1], depth == 1, st[depth].indent);
                     yt_f_open(F, &st[depth], of);
+                    if (depth == 1 && st[0].content_col == 0) {
+                        /* the root bookkeeping the anchored branch carries:
+                         * without it a dedent past the root map's column
+                         * pops to a content_col-0 st[0] and the pair arm
+                         * read "root pairs at column 0" — the nightly's
+                         * run 38128905644, " american:\n  - Boston...\n
+                         * national:" split into PHANTOM DOCUMENTS
+                         * ("---\nb\n---\nv") while the engine rejected */
+                        st[0].content_col = st[depth].indent + 1;
+                    }
+                    if (st[depth].content_col == 0) {
+                        /* the opened map's pairs live at the KEY's
+                         * column (the anchored branch tracks this;
+                         * without it the off-column guard never fires
+                         * and a key line BETWEEN the resolved seq's
+                         * column and the parent's fell through to a
+                         * SILENTLY TRUNCATED document — the nightly's
+                         * run 38118641722, "ue:\n  - one\n woc:\n
+                         *  - one\n wt o-  : thrt" dropped lines 3-5
+                         * while the engine rejected at 3:2) */
+                        st[depth].content_col = st[depth].indent + 1;
+                    }
                     root_open = 1;
                     st[depth].pending = 0;
                 }
@@ -1380,6 +1435,22 @@ static int yt_f_run(yt_fused* F) {
                 while (depth > 0 && (st[depth].kind == 1 ? (col < st[depth].indent ||
                                                             (col <= st[depth].indent && !dash))
                                                          : col < st[depth].indent)) {
+                    if (st[depth].kind == 1 && col == st[depth].indent && !dash &&
+                        !(depth > 1 && st[depth - 1].kind == 0 &&
+                          st[depth - 1].indent == st[depth].indent)) {
+                        return 1; /* a non-dash line at an INDENTED seq's
+                                   * column: the seq owns its column, the
+                                   * pair cannot join it and cannot close
+                                   * it (libyaml: "did not find expected
+                                   * '-' indicator"; the nightly's run
+                                   * 38117287882, "amer:\n  - j\n  n:\n
+                                   *  - Bksl,} -- }" — the runner popped
+                                   * the seq and SILENTLY DROPPED the
+                                   * lines while the engine rejected).
+                                   * Only the INDENTLESS seq — parent map
+                                   * keys at the same column — closes on
+                                   * a key line there ("k:\n- j\nn: v") */
+                    }
                     if (st[depth].pending) {
                         return 1; /* empty "key:" mid-doc: the engine owns it */
                     }
@@ -1457,6 +1528,40 @@ static int yt_f_run(yt_fused* F) {
                        !(c == '&' || c == '!' || c == '*' || c == '\'' || c == '"' || c == '[' ||
                          c == '{' || c == '|' || c == '>' || c == '%' || c == '?' || c == '-') &&
                        yep_plain_first_ok((unsigned char)c)) {
+                if (depth == 0) {
+                    if (root_pair_col != 0 && col < root_pair_col) {
+                        /* a dedent below the root map's own pair column:
+                         * a SECOND root without "---" (issue #630, " k:
+                         * &a\n  - r\na: b" — the pending-value root arm
+                         * never arms content_col, so the off-column
+                         * guard below cannot see this; the engine and
+                         * libyaml reject with "did not find expected
+                         * <document start>") */
+                        return 1;
+                    }
+                    if (root_pair_col == 0) {
+                        root_pair_col = col; /* the first root pair owns its column */
+                    }
+                }
+                if (st[depth].kind == 0 &&
+                    ((st[depth].content_col != 0 && col + 1 != st[depth].content_col &&
+                      (col != st[depth].indent || (depth == 0 && st[0].content_col > 1))) ||
+                     (st[depth].content_col == 0 && depth > 0 && !st[depth].pending &&
+                      col != st[depth].indent))) {
+                    /* an OFF-COLUMN pair. No pending key awaits it, so a
+                     * more-indented line cannot open a child and a
+                     * dedented one is a second root (the catch-39 law;
+                     * libyaml: "mapping values are not allowed in this
+                     * context"). Two states: a frame with its own content
+                     * column rejects every other column; a frame whose
+                     * content map already closed (the phantom close above)
+                     * only accepts pairs at its own key column. The pop
+                     * loop pops on col < indent alone — without these
+                     * checks "a:\n  b: 1\nc: 2\n  d: 3" rode the stale
+                     * frame as a phantom sibling (the nightly's run
+                     * 38179552341) */
+                    return 1;
+                }
                 uint32_t kend = line_stop;
                 while (kend > t0 && (p[kend - 1] == ' ' || p[kend - 1] == '\t')) {
                     kend--;
@@ -1488,6 +1593,12 @@ static int yt_f_run(yt_fused* F) {
                         return 1; /* an anchor needs a name (libyaml):
                                      the engine owns the error */
                     }
+                    if (ne < line_end && p[ne] == '#') {
+                        return 1; /* a glued '#' is junk on the name
+                                     (libyaml: "did not find expected
+                                     alphabetic or numeric character") —
+                                     the engine owns it */
+                    }
                     F->anchor_seq++;
                     aid = F->anchor_seq;
                     if (!yt_anchor_table(F)) {
@@ -1504,8 +1615,24 @@ static int yt_f_run(yt_fused* F) {
                      * (aid rides it: an anchored container resolves through
                      * the S2900 + anchored-start form, not on_block_open) */
                     if (st[depth].kind == 0 && st[depth].content_col != 0 &&
-                        col + 1 != st[depth].content_col && col != st[depth].indent) {
-                        return 1; /* off-column: a continuation line — the multiline arm */
+                        col + 1 != st[depth].content_col &&
+                        (col != st[depth].indent || (depth == 0 && st[0].content_col > 1))) {
+                        return 1; /* off-column: a continuation line — the multiline arm;
+                                   * at the ROOT the indent exemption dies once pairs
+                                   * live above column 0: a col-0 line under a col-1
+                                   * root is a DEDENT — a second root without "---",
+                                   * the engine's error (libyaml: "did not find
+                                   * expected <document start>") */
+                    }
+                    if (st[depth].kind != 0) {
+                        return 1; /* a pending "key:" over a SEQ frame: the
+                                   * key cannot join the sequence (libyaml
+                                   * "mapping values are not allowed in
+                                   * this context"; the nightly's run
+                                   * 38127584324, "k:\n- 42\n bar:\n
+                                   *  - 45 e." — the pending pushed UNDER
+                                   * the seq and materialized as an ITEM
+                                   * while the engine rejected) */
                     }
                     if (st[depth].kind == 0 && st[depth].content_col != 0 &&
                         col + 1 != st[depth].content_col && st[depth].phantom) {
@@ -1513,10 +1640,13 @@ static int yt_f_run(yt_fused* F) {
                         st[depth].phantom = 0;
                     }
                     if (depth > 0 && st[depth].pending) {
-                        uint8_t of = yt_f_open_form(&st[depth - 1], depth == 1, st[depth].indent);
-                        yt_f_open(F, &st[depth], of);
-                        root_open = 1;
-                        st[depth].pending = 0;
+                        /* chained same-column pending ("a:\na:"): resolving
+                         * the first via yt_f_open corrupts the frame mapping
+                         * when the second's container carries valued pairs —
+                         * the OPEN'd map swallows the second key as the
+                         * first pair's value (the nightly's run 38110714729
+                         * tree corruption). The engine owns the shape */
+                        return 1;
                     }
                     /* a spent key-SCALAR frame (resolved, phantom closed,
                      * no map of its own) gives its slot to the sibling —
@@ -1540,10 +1670,22 @@ static int yt_f_run(yt_fused* F) {
                     st[depth].anchored_first = (uint8_t)(aid != 0);
                 } else {
                     if (st[depth].kind == 0 && st[depth].content_col != 0 &&
-                        col + 1 != st[depth].content_col && col != st[depth].indent) {
-                        return 1; /* off-column: a continuation line — the multiline arm */
+                        col + 1 != st[depth].content_col &&
+                        (col != st[depth].indent || (depth == 0 && st[0].content_col > 1))) {
+                        return 1; /* off-column: a continuation line — the multiline arm;
+                                   * the root's indent exemption dies once pairs
+                                   * live above column 0 (dedent = second root) */
                     }
                     if (depth > 0 && st[depth].pending && st[depth].aid != 0) {
+                        if (depth > 1) {
+                            /* an anchored pending BELOW the root frame: the
+                             * deferral's records only flush at depth 1 — a
+                             * deeper one drops its pairs at EOF ("4:\n4: r\n
+                             * 5:\n &5\n 5: e" lost the anchored map; the
+                             * nightly's run 38202382251) — the engine
+                             * resolves it */
+                            return 1;
+                        }
                         if (col <= st[depth].indent) {
                             return 1; /* same-column "content": the anchored value is
                                        * null and this line is a sibling — the engine */
@@ -1588,6 +1730,14 @@ static int yt_f_run(yt_fused* F) {
                     } else if (depth > 0 && st[depth].pending) {
                         uint8_t of = yt_f_open_form(&st[depth - 1], depth == 1, st[depth].indent);
                         yt_f_open(F, &st[depth], of);
+                        if (depth == 1 && st[0].content_col == 0) {
+                            /* the pending->MAP resolution needs the same
+                             * root bookkeeping the seq arm gained (run
+                             * 38134498534, "  e:\n   f: g\nh: i" — the
+                             * dedent popped to a content_col-0 root and
+                             * the doc accepted what the engine rejects) */
+                            st[0].content_col = st[depth].indent + 1;
+                        }
                         root_open = 1;
                         st[depth].pending = 0;
                         if (col == st[depth].indent) {
@@ -1611,6 +1761,10 @@ static int yt_f_run(yt_fused* F) {
                         if (st[depth].phantom) {
                             yt_f_close(F, st[depth].kind);
                             st[depth].phantom = 0;
+                            st[depth].content_col = 0; /* the content map is
+                                                        * gone: its column must not
+                                                        * greet later pairs (the
+                                                        * stale frame below) */
                         }
                     } else {
                         yt_f_start(F, &st[depth]);
@@ -1633,6 +1787,29 @@ static int yt_f_run(yt_fused* F) {
                             }
                             ne++;
                         }
+                        if (ne < line_end && p[ne] == '#') {
+                            return 1; /* a glued '#' is junk on the
+                                       * name (the engine errors:
+                                       * "did not find expected
+                                       * alphabetic or numeric
+                                       * character") */
+                        }
+                        {
+                            size_t ae = ne;
+                            while (ae < line_end && (p[ae] == ' ' || p[ae] == '\t')) {
+                                ae++;
+                            }
+                            if (ae < line_end && p[ae] != '#') {
+                                return 1; /* an alias node is COMPLETE —
+                                           * on the line only a blank
+                                           * then a comment may follow
+                                           * ("<<: *x &y": the engine
+                                           * errors, libyaml "did not
+                                           * find expected key"; this
+                                           * branch silently dropped the
+                                           * bytes) */
+                            }
+                        }
                         uint32_t taid = 0;
                         if (!yt_anchor_get(F, (uint32_t)(vt + 1), (uint32_t)(ne - vt - 1), &taid)) {
                             return 1; /* undefined alias: the engine errors */
@@ -1695,10 +1872,25 @@ static int yt_f_run(yt_fused* F) {
                     }
                     if (vc == '|' && aid == 0 && !st[depth].anchored_first &&
                         (vt + 1 >= line_end || p[vt + 1] == ' ' || p[vt + 1] == '\t')) {
+                        /* the header tail: only blanks and an optional
+                         * comment may follow the indicator (libyaml:
+                         * "did not find expected comment or line break";
+                         * the nightly's run 38119775008, "ext: | c* " —
+                         * this arm took the literal and SILENTLY DROPPED
+                         * the trailing header bytes while the engine
+                         * rejected) */
+                        size_t ht = vt + 1;
+                        while (ht < line_end && (p[ht] == ' ' || p[ht] == '\t')) {
+                            ht++;
+                        }
+                        if (ht < line_end && p[ht] != '#') {
+                            return 1;
+                        }
                         /* bare literal block, clip chomp: measure the block,
                          * copy it into the finish pool, emit the pool form */
                         size_t scan = next;
                         uint32_t bindent = 0;
+                        uint32_t lead_blank_max = 0;
                         int have_bi = 0, have_content = 0;
                         size_t clen = 0, tb = 0;
                         size_t end_scan = scan;
@@ -1730,6 +1922,9 @@ static int yt_f_run(yt_fused* F) {
                                 /* a blank line: spaces past the block indent are
                                  * CONTENT; only stripped-empty lines clip away */
                                 size_t ind = ie - ls;
+                                if (!have_content && ind > lead_blank_max) {
+                                    lead_blank_max = (uint32_t)ind;
+                                }
                                 size_t res = have_bi && ind > bindent ? ind - bindent : 0;
                                 clen += res + 1;
                                 if (res == 0) {
@@ -1745,6 +1940,22 @@ static int yt_f_run(yt_fused* F) {
                                     if (ind <= col) {
                                         break; /* dedented past the block */
                                     }
+                                    if (ind < lead_blank_max) {
+                                        return 1; /* a LEADING blank line
+                                                   * with MORE indent
+                                                   * floors the block
+                                                   * (libyaml's
+                                                   * auto-detect takes
+                                                   * the blanks' max;
+                                                   * content below the
+                                                   * floor breaks the
+                                                   * map — Psych: "did
+                                                   * not find expected
+                                                   * key"; the nightly's
+                                                   * run 38163867815,
+                                                   * "a: |\n    \n  b"):
+                                                   * the engine's error */
+                                    }
                                     bindent = ind;
                                     have_bi = 1;
                                 } else if (ind < bindent) {
@@ -1768,7 +1979,9 @@ static int yt_f_run(yt_fused* F) {
                                 spilled = 1;
                             }
                             end_scan =
-                                (le < len && p[le] == '\r' && le + 1 < len) ? le + 2 : le + 1;
+                                (le < len && p[le] == '\r' && le + 1 < len && p[le + 1] == '\n')
+                                    ? le + 2
+                                    : le + 1; /* lone CR is a 1-byte break */
                             scan = end_scan;
                         }
                         if (!have_content) {
@@ -1781,7 +1994,14 @@ static int yt_f_run(yt_fused* F) {
                                 return 1;
                             }
                         }
-                        char* dst = (char*)yep_pool_alloc(F->pool, flen, 16);
+                        /* the BLOCK is clen-sized: both copy paths write
+                         * every measured line (the clip lives in the
+                         * SPAN, not the copy) — allocating flen wrote
+                         * tb bytes past the block whenever a literal
+                         * ended with stripped-empty lines (the nightly's
+                         * run 38137087116 ASan heap-buffer-overflow,
+                         * WRITE at ytape.c's re-walk memcpy) */
+                        char* dst = (char*)yep_pool_alloc(F->pool, clen, 16);
                         if (dst == NULL) {
                             return 1;
                         }
@@ -1828,8 +2048,10 @@ static int yt_f_run(yt_fused* F) {
                                         q += le - (ls + bindent);
                                         *q++ = '\n';
                                     }
-                                    s2 = (le < len && p[le] == '\r' && le + 1 < len) ? le + 2
-                                                                                     : le + 1;
+                                    s2 = (le < len && p[le] == '\r' && le + 1 < len &&
+                                          p[le + 1] == '\n')
+                                             ? le + 2
+                                             : le + 1; /* lone CR is a 1-byte break */
                                 }
                             }
                             if ((size_t)(q - dst) != clen) {

data/vendor/libyeptris/src/yeptris/emit/emit.c

@@ -51,6 +51,9 @@ YEPTRIS_API size_t yeptris_serialize_into_ex(YeptrisDocument handle,
     em.w.p = NULL;
     em.w.last = 0;
     em.w.force_flow = 0;
+    em.w.in_flow = 0;
+    em.w.flow_item = 0;
+    em.w.unserializable = 0;
     em.w.canonical = opts_canonical(opts);
     em.w.explicit_doc_start = opts_doc_marker(opts);
     em.w.json = 0;
@@ -116,6 +119,9 @@ YEPTRIS_API char* yeptris_serialize_ex(YeptrisDocument handle, const yeptris_emi
     em.w.p = NULL;
     em.w.last = 0;
     em.w.force_flow = 0;
+    em.w.in_flow = 0;
+    em.w.flow_item = 0;
+    em.w.unserializable = 0;
     em.w.canonical = opts_canonical(opts);
     em.w.explicit_doc_start = opts_doc_marker(opts);
     em.w.json = 0;
@@ -160,7 +166,7 @@ YEPTRIS_API char* yeptris_serialize_ex(YeptrisDocument handle, const yeptris_emi
      * any growth; every post-run touch goes through the writer's
      * pointer (the first round's abort was exactly this aliasing) */
     out = em.w.p;
-    if (em.w.oom) {
+    if (em.w.oom || em.w.unserializable) {
         free(out);
         if (em.canon_names.sys != NULL) {
             yep_nametab_free(&em.canon_names);
@@ -200,6 +206,9 @@ YEPTRIS_API char* yeptris_serialize_json(YeptrisDocument handle, size_t* len) {
     em.w.p = NULL;
     em.w.last = 0;
     em.w.force_flow = 0;
+    em.w.in_flow = 0;
+    em.w.flow_item = 0;
+    em.w.unserializable = 0;
     em.w.canonical = 0;
     em.w.explicit_doc_start = 0; /* JSON output carries no --- */
     em.w.json = 1;
@@ -258,6 +267,9 @@ YEPTRIS_API char* yeptris_serialize_json_ex(YeptrisDocument handle, size_t* len,
     em.w.p = NULL;
     em.w.last = 0;
     em.w.force_flow = 0;
+    em.w.in_flow = 0;
+    em.w.flow_item = 0;
+    em.w.unserializable = 0;
     em.w.canonical = 0;
     em.w.explicit_doc_start = 0; /* JSON output carries no --- */
     em.w.json = 1;
@@ -310,6 +322,9 @@ char* yep_serialize_json_compact(const yeptris_document* doc, size_t* len) {
     em.w.p = NULL;
     em.w.last = 0;
     em.w.force_flow = 0;
+    em.w.in_flow = 0;
+    em.w.flow_item = 0;
+    em.w.unserializable = 0;
     em.w.canonical = 0;
     em.w.explicit_doc_start = 0; /* JSON output carries no --- */
     em.w.json = 1;
@@ -362,6 +377,9 @@ char* yep_serialize_json_pretty(const yeptris_document* doc, size_t* len) {
     em.w.p = NULL;
     em.w.last = 0;
     em.w.force_flow = 0;
+    em.w.in_flow = 0;
+    em.w.flow_item = 0;
+    em.w.unserializable = 0;
     em.w.canonical = 0;
     em.w.explicit_doc_start = 0; /* JSON output carries no --- */
     em.w.json = 1;
@@ -430,6 +448,9 @@ YEPTRIS_API size_t yeptris_serialize_stream(YeptrisDocument handle,
     em.w.p = NULL;
     em.w.last = 0;
     em.w.force_flow = 0;
+    em.w.in_flow = 0;
+    em.w.flow_item = 0;
+    em.w.unserializable = 0;
     em.w.canonical = opts_canonical(opts);
     em.w.explicit_doc_start = opts_doc_marker(opts);
     em.w.json = 0;

data/vendor/libyeptris/src/yeptris/emit/style.c

@@ -19,6 +19,13 @@ int yep_style_plain_safe(const char* p, uint32_t len) {
     if (is_blank(p[0]) || is_blank(p[len - 1])) {
         return 0;
     }
+    if (len >= 3 && (unsigned char)p[0] == 0xef && (unsigned char)p[1] == 0xbb &&
+        (unsigned char)p[2] == 0xbf) {
+        /* a LEADING U+FEFF re-parses as a document BOM and vanishes —
+         * the emitted form must carry its escape ("\uFEFF", the
+         * nightly's run 38258674337); mid-token BOMs ride plain */
+        return 0;
+    }
     switch (p[0]) {
     case ':':
         /* libyaml (Psych symbol dumps ":name"): a leading colon only
@@ -119,7 +126,12 @@ int yep_style_plain_safe(const char* p, uint32_t len) {
         }
     }
     /* document markers */
-    if ((len == 3 && (memcmp(p, "---", 3) == 0 || memcmp(p, "...", 3) == 0))) {
+    if (len >= 3 && (memcmp(p, "---", 3) == 0 || memcmp(p, "...", 3) == 0) &&
+        (len == 3 || p[3] == ' ' || p[3] == '\t' || p[3] == '\n' || p[3] == '\r')) {
+        /* a PREFIX marker is worse than the bare one: emitted plain at
+         * line start, "--- ..." re-reads as a document marker (the
+         * nightly's "--- --- >" folded-plain crasher) — libyaml quotes
+         * both */
         return 0;
     }
     return 1;