yeptris 0.6.59.1-arm-linux-eabihf → 0.6.61.1-arm-linux-eabihf

data/vendor/libyeptris/src/include/yeptris/values.h

@@ -52,7 +52,11 @@ typedef struct {
     uint8_t tag_id; /* the resolver's verdict for this scalar */
     uint8_t is_key; /* the entry lands in the inner map's key slot */
     uint8_t b;      /* BOOL payload; implicit-plain flag otherwise */
-    uint32_t off;   /* STR/TIMESTAMP/ALIAS/anchor bytes */
+    uint32_t off;   /* STR/TIMESTAMP/ALIAS/anchor bytes; SEQ/MAP OPEN:
+                     * the collection's EXPLICIT tag text ("tag:yaml.
+                     * org,2002:set") when it carries one — off/len stay
+                     * 0 for untagged containers, so hosts re-tag
+                     * containers without a second drain */
     uint32_t len;
     uint64_t p; /* INT or FLOAT payload, by kind */
 } YeptrisValue;
@@ -80,7 +84,9 @@ typedef struct {
     size_t count;
     size_t arena_len;
     int64_t* payloads; /* INT or FLOAT bits, by kind */
-    uint32_t* offs;    /* STR/TIMESTAMP/ALIAS/ANCHOR bytes */
+    uint32_t* offs;    /* STR/TIMESTAMP/ALIAS/ANCHOR bytes; SEQ/MAP OPEN:
+                          the explicit tag text when tagged (see
+                          YeptrisValue.off) */
     uint32_t* lens;
     uint8_t* kinds; /* YeptrisValueKind */
     uint8_t* tags;  /* resolver verdict per scalar */

data/vendor/libyeptris/src/yeptris/cbor/cbor.h

@@ -11,6 +11,16 @@
 extern "C" {
 #endif
 
+/* The semantic-tag chain law: decode renders the chain into a stack
+ * buffer; encode splits that text back into tag heads. ONE pair of
+ * constants governs both ends — the nightly's 23-nested-tags artifact
+ * (23 links decoded fine, encode-side tags[16] refused) was the two
+ * ends disagreeing. 64 links is already pathological (RFC 8949's
+ * registry is <20); a link renders up to 20 digits + separator, so
+ * the buffer holds a full 64-link chain. */
+#define YEP_CBOR_TAGBUF 1408
+#define YEP_CBOR_TAG_MAX_LINKS 64
+
 /* one data item: bytes -> the shared DOM (the plan's item 01) */
 /* One data item. consumed (may be NULL): when given, returns the
  * item's byte extent and TRAILING BYTES ARE NOT an error (the

data/vendor/libyeptris/src/yeptris/cbor/decode.c

@@ -50,11 +50,6 @@ typedef struct {
     uint8_t is_map;
 } yep_cframe;
 
-#define YEP_CBOR_TAGBUF                                                                            \
-    512 /* a semantic-tag chain over ~23 links is                                                  \
-         * pathological; the arena form had no cap,                                                \
-         * the stack form does (documented) */
-
 typedef struct {
     yep_dom* d; /* the DOM sink's ctx (NULL for pure sinks) */
     const unsigned char* p;
@@ -66,6 +61,7 @@ typedef struct {
      * first — the next item's writer consumes it) */
     char tagbuf[YEP_CBOR_TAGBUF];
     uint32_t taglen;
+    uint32_t taglinks; /* the chain's link count (the shared cap) */
     /* indefinite-string accumulation (chunk framing is the grammar's;
      * the finished span goes to one str/bytes callback) */
     unsigned char* ibuf;
@@ -190,6 +186,7 @@ static const char* cbor_take_tag(yep_cdec* c, uint32_t* len) {
     }
     *len = c->taglen;
     c->taglen = 0;
+    c->taglinks = 0;
     return c->tagbuf;
 }
 
@@ -239,9 +236,9 @@ static int cbor_open(yep_cdec* c, int is_map, uint64_t cap) {
 }
 
 static int cbor_note_tag(yep_cdec* c, uint64_t tag) {
-    if (c->taglen + 1 + 20 > sizeof c->tagbuf) {
+    if (c->taglinks >= YEP_CBOR_TAG_MAX_LINKS || c->taglen + 1 + 20 > sizeof c->tagbuf) {
         yep_error_set(yep_error_tls(), YEP_ERR_UNEXPECTED, 0, 0, c->i,
-                      "semantic-tag chain exceeds %u bytes at byte %zu", (unsigned)sizeof c->tagbuf,
+                      "semantic-tag chain exceeds %u links at byte %zu", YEP_CBOR_TAG_MAX_LINKS,
                       c->i);
         c->status = YEPTRIS_ERROR_PARSE;
         return 0;
@@ -250,6 +247,7 @@ static int cbor_note_tag(yep_cdec* c, uint64_t tag) {
         c->tagbuf[c->taglen++] = ' '; /* separator between chain links */
     }
     c->taglen += cbor_u64dec(tag, c->tagbuf + c->taglen);
+    c->taglinks++;
     return 1;
 }
 

data/vendor/libyeptris/src/yeptris/cbor/encode.c

@@ -326,14 +326,14 @@ typedef struct {
 /* Encodes one KEY item (tags + scalar) into exactly-sized scratch. */
 static uint8_t* cbor_encode_key(const yep_dom* d, const yep_dnode* key, size_t* out_len) {
     yep_view v = yep_dom_view(d, key->value);
-    size_t cap = 16 * 9 + 9 + v.len; /* tags + head + text */
+    size_t cap = (size_t)YEP_CBOR_TAG_MAX_LINKS * 9 + 9 + v.len; /* tags + head + text */
     uint8_t* buf = malloc(cap);
     if (buf == NULL) {
         return NULL;
     }
     size_t pos = 0;
-    uint64_t tags[16];
-    int ntags = cbor_tag_chain(d, key, tags, 16);
+    uint64_t tags[YEP_CBOR_TAG_MAX_LINKS];
+    int ntags = cbor_tag_chain(d, key, tags, YEP_CBOR_TAG_MAX_LINKS);
     if (ntags < 0) {
         goto bad;
     }
@@ -491,8 +491,8 @@ static size_t cbor_size_item(cenc* e, uint32_t id);
 static size_t cbor_size_scalar(cenc* e, const yep_dnode* n) {
     const yep_dom* d = e->d;
     size_t sz = 0;
-    uint64_t tags[16];
-    int ntags = cbor_tag_chain(d, n, tags, 16);
+    uint64_t tags[YEP_CBOR_TAG_MAX_LINKS];
+    int ntags = cbor_tag_chain(d, n, tags, YEP_CBOR_TAG_MAX_LINKS);
     if (ntags < 0) {
         e->failed = 1;
         e->status = YEPTRIS_ERROR_UNSUPPORTED;
@@ -534,8 +534,8 @@ static size_t cbor_size_item(cenc* e, uint32_t id) {
         return cbor_size_scalar(e, n); /* includes the node's own tags */
     }
     size_t sz = 0;
-    uint64_t tags[16];
-    int ntags = cbor_tag_chain(d, n, tags, 16);
+    uint64_t tags[YEP_CBOR_TAG_MAX_LINKS];
+    int ntags = cbor_tag_chain(d, n, tags, YEP_CBOR_TAG_MAX_LINKS);
     if (ntags < 0) {
         e->failed = 1;
         e->status = YEPTRIS_ERROR_UNSUPPORTED;
@@ -653,8 +653,8 @@ static void cbor_write_scalar(cenc* e, const yep_dnode* n, uint8_t* out, size_t*
 static void cbor_write_item(cenc* e, uint32_t id, uint8_t* out, size_t* pos) {
     const yep_dom* d = e->d;
     const yep_dnode* n = &d->nodes[id];
-    uint64_t tags[16];
-    int ntags = cbor_tag_chain(d, n, tags, 16);
+    uint64_t tags[YEP_CBOR_TAG_MAX_LINKS];
+    int ntags = cbor_tag_chain(d, n, tags, YEP_CBOR_TAG_MAX_LINKS);
     for (int t = 0; t < ntags; t++) {
         yep_cbor_put_head(out, pos, 6, tags[t]);
     }

data/vendor/libyeptris/src/yeptris/cbor/from_marshal.c

@@ -1,7 +1,7 @@
 /* from_marshal.c — Ruby Marshal.dump bytes to ONE CBOR data item
  * (yeptris-ruby#322's CBOR half: the binding's dump face).
  *
- * The twin of emit/writer.c's marshal READER (yeptris_json_from_marshal):
+ * The twin of marshal/to_json.c's JSON reader (yeptris_json_from_marshal):
  * the Marshal stream is walked once, in C, and the CBOR item is
  * appended straight to the output — no per-node Ruby crossings, no
  * Document, no YAMLTree. The format facts mirror marshal.c's emission

data/vendor/libyeptris/src/yeptris/common/error.h

@@ -25,6 +25,7 @@ extern "C" {
 #define YEP_ERROR_X(X)                                                                             \
     X(YEP_ERR_NONE, "no error")                                                                    \
     X(YEP_ERR_UNEXPECTED, "unexpected parser state")                                               \
+    X(YEP_ERR_DOC_BOUNDARY, "invalid content at a document boundary")                              \
     X(YEP_ERR_MEMORY, "out of memory")                                                             \
     X(YEP_ERR_DEPTH, "nesting depth exceeds the limit")                                            \
     X(YEP_ERR_ENCODING, "ill-formed or unsupported character encoding")                            \
@@ -33,6 +34,7 @@ extern "C" {
     X(YEP_ERR_BAD_INDENT, "inconsistent indentation")                                              \
     X(YEP_ERR_KEY_TOO_LONG, "simple key exceeds 1024 characters")                                  \
     X(YEP_ERR_UNDEFINED_ALIAS, "alias references an undefined anchor")                             \
+    X(YEP_ERR_ABORTED, "parse aborted by the event callback")                                      \
     X(YEP_ERR_INVALID_ESCAPE, "invalid escape sequence in double-quoted scalar")                   \
     X(YEP_ERR_BAD_DIRECTIVE, "invalid or unsupported directive")                                   \
     X(YEP_ERR_INTERNAL, "internal invariant violation")                                            \

data/vendor/libyeptris/src/yeptris/doc.h

@@ -11,6 +11,9 @@
 #include "dom/dom.h"
 #include "memory/allocator.h"
 
+#include <yeptris/error.h>
+#include <yeptris/resolve.h> /* YeptrisSchema */
+
 typedef struct yeptris_document {
     yep_dom* dom;
     const yep_allocator* sys;
@@ -59,8 +62,25 @@ extern "C" {
 yep_dom* yep_doc_dom(yeptris_document* doc);
 yeptris_node* yep_handle_new(yeptris_document* doc, uint32_t id);
 
+/* parse.c's sink-entry seam (#902): the DOM route's exact front-end and
+ * engine run into a caller sink — no DOM, no tape. Statuses are the
+ * parse route's (OK, or PARSE / DEPTH / ENCODING / MEMORY; the sink's
+ * own failure rides MEMORY like the DOM builder's). on_input (may be
+ * NULL) receives the run's input view — the DOM route's input_base law
+ * (the transcoded copy, or the caller's bytes) and its post-BOM length
+ * — immediately before the engine runs, because the events' borrowed
+ * views subtract from it. The bytes live only for the run. */
+typedef void (*yep_input_fn)(void* ctx, const char* base, size_t len);
+YeptrisStatus yep_parse_events(const char* buf, size_t len, YeptrisSchema schema,
+                               const yep_sink* sink, yep_input_fn on_input, void* on_ctx);
+
 #ifdef __cplusplus
 }
 #endif
 
+/* The typing SSOT's one switch (parse.c owns it; the stream iterator
+ * and any future bytes->document route select through it too). */
+struct yep_resolver; /* resolve/resolver.h's fwd — doc.h stays leaf */
+const struct yep_resolver* resolver_for_schema(YeptrisSchema schema);
+
 #endif /* YEP_DOC_H */

data/vendor/libyeptris/src/yeptris/dom/dom.c

@@ -158,7 +158,18 @@ static yep_sview dom_str_in(yep_dom* d, const yep_view* v, int borrowed) {
         yep_sview sv = {0, 0};
         return sv;
     }
-    if (borrowed && v->p != NULL && d->input_base != NULL && (const char*)v->p >= d->input_base) {
+    /* The zero-copy law: borrow ONLY a view demonstrably inside the
+     * recorded input window. The old heap-order probe (v->p >=
+     * input_base) misfiled every engine-owned buffer that happened to
+     * sit above the caller's input — the r171 normalizer copy path
+     * (norm_buf) hands exactly such views to the pair/event builders —
+     * and the resulting input-relative offset was then layout luck per
+     * platform/build (the ubuntu-gcc / MSVC-arm / TSan / UBSan CI
+     * divergences of PR #1042). The upper bound makes the decision a
+     * pure function of the view's location class: both engines of a
+     * differential run now store identically on every platform. */
+    if (borrowed && v->p != NULL && d->input_base != NULL &&
+        (size_t)((const char*)v->p - d->input_base) + v->len <= d->input_len) {
         return yep_sv_input(d, *v);
     }
     return yep_dom_str_put(d, (const char*)v->p, v->len);

data/vendor/libyeptris/src/yeptris/dom/ytape.c

@@ -1640,15 +1640,64 @@ static int yt_f_run(yt_fused* F) {
                         col + 1 != st[depth].content_col && st[depth].phantom) {
                         yt_f_close(F, st[depth].kind);
                         st[depth].phantom = 0;
+                        st[depth].content_col =
+                            0; /* the content map is gone:
+                                * its column must not greet later pairs (the
+                                * stale-frame law, run 38179552341) — after the
+                                * chained-pending arm resumes here, a stale
+                                * column rode yt_f_open_form's sibling test and
+                                * misfiled the next pending's container as a
+                                * key-SCALAR ("b:\n c: d\nq:\n b:\n  c: d\n"
+                                * lost q's map; the nightly's run 42488986434) */
                     }
                     if (depth > 0 && st[depth].pending) {
-                        /* chained same-column pending ("a:\na:"): resolving
-                         * the first via yt_f_open corrupts the frame mapping
-                         * when the second's container carries valued pairs —
-                         * the OPEN'd map swallows the second key as the
-                         * first pair's value (the nightly's run 38110714729
-                         * tree corruption). The engine owns the shape */
-                        return 1;
+                        /* a chained pending ("a:\na:", the deep-nesting
+                         * "k:\n  k:\n    k:" ladder): resolve the outer
+                         * one before the sibling's frame takes the slot.
+                         * A same-column sibling key (col == the pending's
+                         * own column) gives the pending a NULL value —
+                         * the null pair MUST land now, or the OPEN'd
+                         * container swallows the sibling key as its
+                         * first pair's value (the nightly's run
+                         * 38110714729 tree corruption: {a: a, ?{b: c}:
+                         * h} instead of {a: null, a: {b: c}, h: v}).
+                         * When the OPEN form fired, the null pairs
+                         * INSIDE the opened container (parent → {k:
+                         * null}); under the key-SCALAR form it completes
+                         * the key's pair in the parent's map. A deeper
+                         * line (col > indent) opens the pending's
+                         * container and the chain nests. Anchored
+                         * pendings keep the engine: their anchor rides
+                         * the event path (yt_f_open drops the name) */
+                        if (st[depth].aid != 0) {
+                            return 1;
+                        }
+                        uint8_t of = yt_f_open_form(&st[depth - 1], depth == 1, st[depth].indent);
+                        if (aid != 0 && of == 0) {
+                            /* the outer pending resolved as a SIBLING
+                             * key-SCALAR: its value container is "the pair's",
+                             * materialized by the next OPEN-class record — but
+                             * the anchored pending resolves through the event
+                             * path, which emits its KEY SCALAR *before* the
+                             * anchored MAP_START. That key pairs with the
+                             * stranded outer key (the pair's value slot) and
+                             * the anchored map strands as a sibling key of the
+                             * parent: "2: e\n4:\n  5: &5\n    5: e\n7: s"
+                             * built {2:e, 4:"5", {5:e}&5:"7", s:null} instead
+                             * of {2:e, 4:{5:{5:e}&5}, 7:s} (the nightly's
+                             * crash-d8e3b3f392c37a62257576ce20d5a19b351f66ad,
+                             * round 213 — the first shape where a completed
+                             * pair arms root_pair_col BEFORE the chain). The
+                             * engine resolves the composition. */
+                            return 1;
+                        }
+                        yt_f_open(F, &st[depth], of);
+                        root_open = 1;
+                        if (col == st[depth].indent) {
+                            (void)yt_put(t, yt_props(YTP_SCALAR, 0, 0x0904u));
+                            yt_f_empty_span(F);
+                        }
+                        st[depth].pending = 0;
                     }
                     /* a spent key-SCALAR frame (resolved, phantom closed,
                      * no map of its own) gives its slot to the sibling —

data/vendor/libyeptris/src/yeptris/emit/emit.c

@@ -11,12 +11,22 @@
 #include "../doc.h"
 #include "writer.h"
 
+/* Every field reads behind ITS OWN offsetof gate — never the whole
+ * struct's sizeof. The #909/#903 append grew sizeof(*opts) to 24, and
+ * a `size >= sizeof(*opts)` gate silently orphaned the ORIGINAL
+ * fields for callers compiled against the 16-byte struct (the Ruby
+ * binding): best_width fell back to 80 and canonical fell off. The
+ * versioning contract is per field: declared-present or default. */
 static int opts_canonical(const yeptris_emit_options* opts) {
-    return opts != NULL && opts->size >= sizeof(*opts) && opts->canonical;
+    return opts != NULL &&
+           opts->size >= (uint32_t)(offsetof(yeptris_emit_options, canonical) + sizeof(int)) &&
+           opts->canonical;
 }
 
 static int opts_width(const yeptris_emit_options* opts) {
-    if (opts == NULL || opts->size < sizeof(*opts) || opts->best_width <= 0) {
+    if (opts == NULL ||
+        opts->size < (uint32_t)(offsetof(yeptris_emit_options, best_width) + sizeof(int)) ||
+        opts->best_width <= 0) {
         return 80; /* libyaml best_width parity */
     }
     return opts->best_width;
@@ -32,6 +42,41 @@ static int opts_doc_marker(const yeptris_emit_options* opts) {
     return opts->explicit_doc_start != 0;
 }
 
+static int opts_indent(const yeptris_emit_options* opts) {
+    /* size-versioned (#903); out of range rides the default (libyaml
+     * clamps 2..9 the same way) */
+    int ind = 2;
+    if (opts != NULL &&
+        opts->size >= (uint32_t)(offsetof(yeptris_emit_options, best_indent) + sizeof(int))) {
+        ind = opts->best_indent;
+    }
+    if (ind < 2 || ind > 9) {
+        ind = 2;
+    }
+    return ind;
+}
+
+static int opts_block_fold(const yeptris_emit_options* opts) {
+    /* size-versioned (#903): default off — block output stays
+     * width-invariant (byte-identical with the pre-option releases) */
+    if (opts == NULL ||
+        opts->size < (uint32_t)(offsetof(yeptris_emit_options, block_fold) + sizeof(int))) {
+        return 0;
+    }
+    return opts->block_fold != 0;
+}
+
+/* The emitter's SCRATCH rides the document's allocator (#904 item 3):
+ * sc_dec and the streaming window are emitter-internal (never leak
+ * into caller hands), so the fail-injection harness — a counting
+ * allocator passed at the document's build — now reaches them. The
+ * CALLER-RETURNED output buffers stay system-malloc on purpose: their
+ * release contract is free() (emit.h "malloc'd buffer, caller frees"),
+ * and a failing allocator's pointer cannot be freed by the host. */
+static const yep_allocator* emit_sys(const yeptris_document* doc) {
+    return doc->sys != NULL ? doc->sys : yep_system_allocator();
+}
+
 YEPTRIS_API size_t yeptris_serialize_into_ex(YeptrisDocument handle,
                                              const yeptris_emit_options* opts, char* buf,
                                              size_t cap) {
@@ -62,18 +107,22 @@ YEPTRIS_API size_t yeptris_serialize_into_ex(YeptrisDocument handle,
     em.w.json_pretty = 0;
     em.w.pretty_depth = 0;
     em.w.best_width = opts_width(opts);
+    em.w.indent = opts_indent(opts);
+    em.w.block_fold = opts_block_fold(opts);
     em.w.col = 0;
     em.w.sv_input = handle ? ((const yeptris_document*)handle)->dom->input_base : NULL;
     em.w.sv_arena = handle ? ((const yeptris_document*)handle)->dom->str : NULL;
+    em.w.resolver = handle ? ((const yeptris_document*)handle)->dom->resolver : NULL;
     em.w.sink = NULL;
     em.w.watermark = 0;
     em.w.sink_aborted = 0;
     em.w.flushed = 0;
     memset(&em.canon_names, 0, sizeof(em.canon_names));
-    if (em.w.canonical && !yep_nametab_init(&em.canon_names, yep_system_allocator())) {
+    if (em.w.canonical && !yep_nametab_init(&em.canon_names, emit_sys(em.doc))) {
         return 0;
     }
-    em.w.sc_dec = (uint8_t*)malloc(em.doc->dom->ncount > 0 ? em.doc->dom->ncount : 1);
+    em.w.sc_dec =
+        (uint8_t*)yep_alloc(emit_sys(em.doc), em.doc->dom->ncount > 0 ? em.doc->dom->ncount : 1);
     if (em.w.sc_dec == NULL) {
         if (em.canon_names.sys != NULL) {
             yep_nametab_free(&em.canon_names);
@@ -82,7 +131,7 @@ YEPTRIS_API size_t yeptris_serialize_into_ex(YeptrisDocument handle,
     }
     size_t need = yep_emit_run(&em, 1);
     if (buf == NULL || cap < need + 1) {
-        free(em.w.sc_dec);
+        yep_free(emit_sys(em.doc), em.w.sc_dec);
         if (em.canon_names.sys != NULL) {
             yep_nametab_free(&em.canon_names);
         }
@@ -90,7 +139,7 @@ YEPTRIS_API size_t yeptris_serialize_into_ex(YeptrisDocument handle,
     }
     em.w.p = buf;
     size_t wrote = yep_emit_run(&em, 0);
-    free(em.w.sc_dec);
+    yep_free(emit_sys(em.doc), em.w.sc_dec);
     if (em.canon_names.sys != NULL) {
         yep_nametab_free(&em.canon_names);
     }
@@ -128,15 +177,18 @@ YEPTRIS_API size_t yeptris_serialize_into_trusted(YeptrisDocument handle,
     em.w.json_pretty = 0;
     em.w.pretty_depth = 0;
     em.w.best_width = opts_width(opts);
+    em.w.indent = opts_indent(opts);
+    em.w.block_fold = opts_block_fold(opts);
     em.w.col = 0;
     em.w.sv_input = ((const yeptris_document*)handle)->dom->input_base;
     em.w.sv_arena = ((const yeptris_document*)handle)->dom->str;
+    em.w.resolver = ((const yeptris_document*)handle)->dom->resolver;
     em.w.sink = NULL;
     em.w.watermark = 0;
     em.w.sink_aborted = 0;
     em.w.flushed = 0;
     memset(&em.canon_names, 0, sizeof(em.canon_names));
-    if (em.w.canonical && !yep_nametab_init(&em.canon_names, yep_system_allocator())) {
+    if (em.w.canonical && !yep_nametab_init(&em.canon_names, emit_sys(em.doc))) {
         return 0;
     }
     /* #352: ONE bounded wet pass — no memo, no dry run (the emit-split
@@ -194,15 +246,18 @@ YEPTRIS_API char* yeptris_serialize_ex(YeptrisDocument handle, const yeptris_emi
     em.w.json_pretty = 0;
     em.w.pretty_depth = 0;
     em.w.best_width = opts_width(opts);
+    em.w.indent = opts_indent(opts);
+    em.w.block_fold = opts_block_fold(opts);
     em.w.col = 0;
     em.w.sv_input = handle ? ((const yeptris_document*)handle)->dom->input_base : NULL;
     em.w.sv_arena = handle ? ((const yeptris_document*)handle)->dom->str : NULL;
+    em.w.resolver = handle ? ((const yeptris_document*)handle)->dom->resolver : NULL;
     em.w.sink = NULL;
     em.w.watermark = 0;
     em.w.sink_aborted = 0;
     em.w.flushed = 0;
     memset(&em.canon_names, 0, sizeof(em.canon_names));
-    if (em.w.canonical && !yep_nametab_init(&em.canon_names, yep_system_allocator())) {
+    if (em.w.canonical && !yep_nametab_init(&em.canon_names, emit_sys(em.doc))) {
         return NULL;
     }
     /* #352 slice 2: ONE wet pass into a growable buffer — the dry
@@ -211,6 +266,9 @@ YEPTRIS_API char* yeptris_serialize_ex(YeptrisDocument handle, const yeptris_emi
      * starts at the input size (+64) and doubles on demand; a final
      * shrink-to-fit keeps the returned allocation tight. No dry pass,
      * so no decisions table. */
+    /* raw malloc ON PURPOSE (#904 item 3): this buffer is RETURNED —
+     * the release contract is the host's free() (emit.h), so it must
+     * come from the system allocator, not the document's */
     size_t est = em.doc->dom->input_len + 64;
     if (est < 256) {
         est = 256;
@@ -260,6 +318,8 @@ YEPTRIS_API char* yeptris_serialize_ex(YeptrisDocument handle, const yeptris_emi
  * (+64) and doubles on demand; shrink-to-fit at the end. Owns the
  * emitter's canon_names cleanup. */
 static char* yep_json_run_growable(yep_emitter* em, size_t* len) {
+    /* raw malloc ON PURPOSE (#904 item 3): the buffer is RETURNED —
+     * the host's free() owns it (emit.h), system allocator only */
     size_t est = em->doc->dom->input_len + 64;
     if (est < 256) {
         est = 256;
@@ -328,9 +388,12 @@ YEPTRIS_API char* yeptris_serialize_json(YeptrisDocument handle, size_t* len) {
     em.w.json_pretty = 0;
     em.w.pretty_depth = 0;
     em.w.best_width = 0; /* JSON: no folding (single-line output) */
+    em.w.indent = 2;
+    em.w.block_fold = 0;
     em.w.col = 0;
     em.w.sv_input = handle ? ((const yeptris_document*)handle)->dom->input_base : NULL;
     em.w.sv_arena = handle ? ((const yeptris_document*)handle)->dom->str : NULL;
+    em.w.resolver = handle ? ((const yeptris_document*)handle)->dom->resolver : NULL;
     em.w.sink = NULL;
     em.w.watermark = 0;
     em.w.sink_aborted = 0;
@@ -370,9 +433,12 @@ YEPTRIS_API char* yeptris_serialize_json_ex(YeptrisDocument handle, size_t* len,
     em.w.json_pretty = 0;
     em.w.pretty_depth = 0;
     em.w.best_width = 0; /* JSON: no folding (single-line output) */
+    em.w.indent = 2;
+    em.w.block_fold = 0;
     em.w.col = 0;
     em.w.sv_input = handle ? ((const yeptris_document*)handle)->dom->input_base : NULL;
     em.w.sv_arena = handle ? ((const yeptris_document*)handle)->dom->str : NULL;
+    em.w.resolver = handle ? ((const yeptris_document*)handle)->dom->resolver : NULL;
     em.w.sink = NULL;
     em.w.watermark = 0;
     em.w.sink_aborted = 0;
@@ -414,9 +480,12 @@ char* yep_serialize_json_compact(const yeptris_document* doc, size_t* len) {
     em.w.json_pretty = 0;
     em.w.pretty_depth = 0;
     em.w.best_width = 0;
+    em.w.indent = 2;
+    em.w.block_fold = 0;
     em.w.col = 0;
     em.w.sv_input = doc->dom->input_base;
     em.w.sv_arena = doc->dom->str;
+    em.w.resolver = doc->dom->resolver;
     em.w.sink = NULL;
     em.w.watermark = 0;
     em.w.sink_aborted = 0;
@@ -460,17 +529,22 @@ char* yep_serialize_json_pretty_ex(const yeptris_document* doc, size_t* len, con
     em.w.json_indent = indent;
     em.w.json_indent_len = indent == NULL ? 2 : (int)indent_len;
     em.w.best_width = 0;
+    em.w.indent = 2;
+    em.w.block_fold = 0;
     em.w.col = 0;
     em.w.sv_input = doc->dom->input_base;
     em.w.sv_arena = doc->dom->str;
+    em.w.resolver = doc->dom->resolver;
     em.w.sink = NULL;
     em.w.watermark = 0;
     em.w.sink_aborted = 0;
     em.w.flushed = 0;
     memset(&em.canon_names, 0, sizeof(em.canon_names));
-    if (em.w.canonical && !yep_nametab_init(&em.canon_names, yep_system_allocator())) {
+    if (em.w.canonical && !yep_nametab_init(&em.canon_names, emit_sys(doc))) {
         return NULL;
     }
+    /* raw malloc ON PURPOSE (#904 item 3): the dry-wet pair's exact-
+     * sized output is RETURNED — the host's free() owns it */
     size_t need = yep_emit_run(&em, 1);
     char* out = malloc(need + 1);
     if (out == NULL) {
@@ -532,18 +606,24 @@ YEPTRIS_API size_t yeptris_serialize_stream(YeptrisDocument handle,
     em.w.json_pretty = 0;
     em.w.pretty_depth = 0;
     em.w.best_width = opts_width(opts);
+    em.w.indent = opts_indent(opts);
+    em.w.block_fold = opts_block_fold(opts);
     em.w.col = 0;
     em.w.sv_input = handle ? ((const yeptris_document*)handle)->dom->input_base : NULL;
     em.w.sv_arena = handle ? ((const yeptris_document*)handle)->dom->str : NULL;
+    em.w.resolver = handle ? ((const yeptris_document*)handle)->dom->resolver : NULL;
     em.w.sink = sink;
     em.w.sink_ctx = ctx;
     em.w.watermark = YEP_EMIT_WATERMARK;
     memset(&em.canon_names, 0, sizeof(em.canon_names));
-    if (em.w.canonical && !yep_nametab_init(&em.canon_names, yep_system_allocator())) {
+    if (em.w.canonical && !yep_nametab_init(&em.canon_names, emit_sys(em.doc))) {
         return 0;
     }
-    /* one scratch window; the writer flushes it when it fills */
-    char* window = malloc(YEP_EMIT_WATERMARK * 2);
+    /* one scratch window; the writer flushes it when it fills.
+     * Document allocator (#904 item 3): emitter-internal scratch —
+     * flushed out through the sink, never returned — so the
+     * fail-injection harness reaches it. */
+    char* window = yep_alloc(emit_sys(em.doc), YEP_EMIT_WATERMARK * 2);
     if (window == NULL) {
         if (em.canon_names.sys != NULL) {
             yep_nametab_free(&em.canon_names);
@@ -564,7 +644,7 @@ YEPTRIS_API size_t yeptris_serialize_stream(YeptrisDocument handle,
             /* total already counted by the flush hooks */
         }
     }
-    free(window);
+    yep_free(emit_sys(em.doc), window);
     if (em.canon_names.sys != NULL) {
         yep_nametab_free(&em.canon_names);
     }