Change the Set field in nodeJSON from arrayJSON to *arrayJSON so that
omitempty distinguishes "no Set" from "empty Set", preventing empty
Cedar sets from marshaling as {} instead of {"Set":[]}.

In Record.UnmarshalJSON, return a zero-value Record when the input
map is empty, so that round-tripping through {"tags":{}} preserves
nil-map equality with entities that had no tags field originally.

Signed-off-by: Phil Hassey <phil@strongdm.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

EntityUID.MarshalCedar() was delegating to String() which uses
strconv.Quote, producing Go-style escapes (\b, \a, \f, \v) that are
not valid in Cedar. Switch to rust.EscapeString which produces
Cedar-compatible escapes (\u{8}, \u{7}, \u{c}, \u{b}).

Leave String() unchanged for Go-idiomatic display/debugging.

Signed-off-by: Phil Hassey <phil@strongdm.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

canMarshalAsIdent("") returned true because the loop over an empty
string iterates zero times. It also accepted reserved keywords like
"true", "false", "if", "in", etc., producing invalid Cedar like
`context.true` instead of `context["true"]`.

Add an early return for empty strings and reserved keywords, using
the existing IsReservedKeyword helper.

Signed-off-by: Phil Hassey <phil@strongdm.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Binary operators were not parenthesizing children correctly based on
associativity:

- Non-associative relation ops (==, !=, <, <=, >, >=, in) and keyword
  ops (has, like, is, is-in) need to parenthesize both operands at the
  same precedence, since (a == b) == c is valid but a == b == c is not.

- Left-associative ops (+, -, *, &&, ||) need to parenthesize their
  right operand at the same precedence, since (a - b) - (c - d) must
  not be flattened to a - b - c - d which changes semantics.

Split marshalInfixBinaryOp to take separate left/right precedence
levels. Left-associative ops pass (p, p+1) and non-associative ops
pass (p+1, p+1).

Signed-off-by: Phil Hassey <phil@strongdm.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Two issues with Record in nodeJSON:

1. Record field was a value type (recordJSON = map[string]nodeJSON)
   with omitempty, so empty records were silently dropped during
   JSON marshal, producing {} instead of {"Record":{}}.
   Fix: change to *recordJSON pointer (same pattern as the Set fix).

2. recordJSON mapped keys to nodeJSON values (not pointers). Since
   nodeJSON.MarshalJSON has a pointer receiver, Go's json.Marshal
   cannot call it on map values (can't take address of map element).
   This caused the default marshaler to be used, which skips the
   ExtensionCall field (tagged json:"-"), silently dropping extension
   calls like duration() and datetime() inside records.
   Fix: change recordJSON to map[string]*nodeJSON so the custom
   MarshalJSON is always invoked.

Signed-off-by: Phil Hassey <phil@strongdm.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace the approximate EscapeString/ShouldEscape implementation with
an exact port of Rust's char::escape_debug() and str::escape_debug():

- Port Rust's is_printable() lookup tables from printable.rs verbatim,
  replacing Go's unicode.IsPrint() which disagrees at boundaries like
  U+00A0, U+00AD, U+FFFC, and U+FFFD.

- Port Rust's Grapheme_Extend property as Mn + Me + Other_Grapheme_Extend,
  replacing the incorrect Mn + Me + Mc check. Mc (spacing combining marks
  like U+0903) are NOT in Grapheme_Extend; Other_Grapheme_Extend chars
  like U+FF9E and U+FF9F now correctly detected.

- Implement str::escape_debug first/continuation distinction: grapheme
  extend chars are escaped as first char (ESCAPE_ALL) but passed through
  raw in continuation positions (CharEscapeDebugContinue).

- Add EscapeCharAll for Pattern marshaling, matching Rust Cedar's
  per-character char::escape_debug() with ESCAPE_ALL on every char.

Signed-off-by: Phil Hassey <phil@strongdm.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Validate escapeRune, EscapeString, EscapeCharAll, isPrintable, and
isGraphemeExtended against exact Rust 1.93 char::escape_debug() and
str::escape_debug() output for 160+ codepoints covering:

- All C0/C1 controls, full Latin-1 supplement boundary (0xA0-0xBF)
- Combining marks (Mn, Me, Mc), format chars, separators, BOM
- Halfwidth katakana, hangul jungseong, tag chars, variation selectors
- SMP and supplementary plane boundaries
- str first-vs-continuation grapheme extend distinction
- Round-trip correctness through Unquote for both escape modes

Signed-off-by: Phil Hassey <phil@strongdm.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Each corpus generation target now uses a private mktemp -d with a
trap for cleanup on failure, eliminating shared /tmp/corpus-tests
collisions and leaked temp files. Quote basename arguments for
safety with special characters. Add extracted corpus directories
to .gitignore.

Signed-off-by: Phil Hassey <phil@strongdm.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>