leptris 1.9.201.0-arm-linux → 1.9.201.2-arm-linux

data/vendor-src/libleptris/TODO.xslt-full/15-binding-entries.md

@@ -0,0 +1,19 @@
+# 15 — Engine support for binding asks (#683)
+
+Versioned eval family the bindings requested:
+- leptris_xpath_eval_versioned(doc, ctx, expr, LEPTRIS_XPATH_VER)
+  switching 1.0 strict vs 3.x surface (the grammar from 06/07/08
+  is version-gated OFF for 1.0 callers — 438/438 stays green)
+- leptris_xquery_* entries from 11
+- result-type extensions from 07 (mirrors in binding PRs)
+## Status 2026-09-10 — versioned eval shipped
+
+leptris_xpath_eval_versioned(doc, ctx, expr, LEPTRIS_XPATH_10 |
+LEPTRIS_XPATH_31, status) shipped: 1.0 mode rejects 3.x-only
+SYNTAX (arrow =>, bang !, lookup ?, let, inline function,
+string templates) via a literal-aware lexical scan with
+LEPTRIS_ERROR_INVALID_ARG; 3.1 mode = leptris_xpath_eval
+verbatim. Spec: PublicSurface.VersionedXPathEval (violation
+cases per falsifiability). Remaining: the xquery_* entries from
+lane 11 (qt3tests adoption) + binding mirror PRs (user merges).
+Gate: abi spec + mirrors drift check green.

data/vendor-src/libleptris/TODO.xslt-full/16-schematron.md

@@ -0,0 +1,156 @@
+# 16 — Schematron (2025 edition), native in libleptris
+
+Third validation pillar: DTD (grammar) + RELAX NG (structure) +
+Schematron (rules). Opened from the XML Prague 2026 gap map
+(2026-09-09); Siegel's "Schematron 2025 – Technology Update" talk
++ the standing Schematron Users Meetup confirm the ecosystem just
+moved (new edition published Sept 2025) while OSS tooling largely
+hasn't.
+
+## Why INSIDE libleptris (not separate software)
+
+- Schematron evaluation is ~95% XPath evaluation. Our engine
+  (438/438 W3C + libxslt suite 205/205 behind it) is the moat; a
+  separate binary would FFI back into us anyway — circular.
+- Bindings get `Leptris::XML::Schematron` free, mirroring
+  `Leptris::XML::RelaxNG` (leptris-ruby#165). Nokogiri has NO
+  native Schematron today (users shell out or run XSLT pipelines)
+  — this is the binding differentiator after RNG.
+- CLI `leptris validate` completes as a one-stop validator.
+- Performance: isoschematron/lxml is a 2-pass XSLT pipeline on
+  libxslt; a native IR walker holds >=2x trivially given transform
+  5x / predicate 15.6x. schxslt-on-Saxon (JVM) is the wall-clock
+  reference for realistic documents.
+
+## Phases (mirror the RNG arc, #878)
+
+1. **Schema model IR** — parse `sch:` schema/pattern/rule/assert/
+   report/@context/@test/@role/@id, `ns`, `let`, `phase`,
+   `diagnostics`, `properties`, `title`, `param`. queryBinding=xslt
+   (subset mapped to our XPath 1.0+extensions surface; loud-refuse
+   unknown bindings). Errors on leptris_last_error, same contract
+   as RNG.
+2. **Evaluator + SVRL emitter** — per pattern: select context
+   nodes, evaluate asserts in document order, emit
+   `svrl:schematron-output` (active-pattern, fired-rule,
+   failed-assert, successful-report with @location/@test).
+   Validity = zero failed-asserts. Context-node loop reuses the
+   batch-context eval path (#560).
+3. **Abstract patterns + params, let scoping** (schema -> pattern
+   -> rule chains), global variables, `document()` access via the
+   resolver already behind RNG `<include>`.
+4. **Phases, diagnostics, properties** + rule/pattern @role
+   filtering.
+5. **Conformance corpus** — vendor schematron-tests / schxslt
+   corpus, gate EXACT like Jing 38/38 (agreement table +
+   provenance JSON). 2025-edition features land behind the same
+   gate: refuse loud until implemented.
+6. **Bindings + CLI** — leptris-ruby `Schematron::Schema`
+   (parse/parse_file/#valid?/#validate -> SVRL or error list),
+   python mirror, `leptris validate --schematron`. Then the
+   migration prompt (standoc/oXygen world) like #878's.
+
+## Bars
+
+- isoschematron/lxml pipeline >=2x (primary).
+- schxslt on Saxon-JVM wall-clock >=2x on realistic rule sets.
+- Corpus gate exact-N (no partial credit), CI leg included.
+
+## Out of scope
+
+XSLT2/3 query binding beyond our engine surface; XProc steps;
+epubcheck-class verticals (application layer, build on top later).
+
+## Related (XML Prague 2026 gap map, not this lane)
+
+XPath/XSLT/XQuery 4.0 ordered maps (Kay); XTH connector (Retter)
+= lanes 11/12 harness; XML diff (Quin et al.) on #869 Merkle
+digest; ixml (Pemberton) — speculative; AI-via-XPath-functions
+(Bina/Nadolu) — needs only an extension-fn callback entry; EPUB
+vertical (EDRLab) after Schematron; XProc 3 / XSL-FO — not now.
+
+
+## Status 2026-09-10 — phases 1+2 shipped (PR #964)
+
+Schema IR + SVRL evaluator + public API (leptris_schematron_*)
+landed; 6 RED-first specs. REMAINING in this lane: phase 3
+(abstract patterns + params, let scoping), phase 4 (phases/
+diagnostics/properties), phase 5 (conformance corpus, exact-N
+gate), phase 6 (bindings + `leptris validate` + migration
+prompt).
+
+## Phase 5 status (2026-09-10, branch feat/16-sch-phase5, WIP)
+
+Corpus vendored: test/sch/conformance-cases/ = 50 cases from
+schematron/schematron-conformance (core 44 + svrl 6; 14 error /
+19 invalid / 17 valid). Runner test/sch/test_schematron_corpus.cpp
+with the exact-N gate (agree == run == 50). Currently 47/50.
+
+Engine/runner work landed on the branch (RED-first via the corpus):
+- let-stack ownership: per-rule OWNED snapshot; base freed once
+  after the rules (was: freed inside the rule loop — SIGABRT on
+  two-rules-under-a-schema-let).
+- pattern semantics: @context is an XSLT pattern — relative
+  patterns prefix `//` (any-depth), `/` = document node (tests
+  evaluate at leptris_document_node so child steps see the root).
+- first-matching-rule-per-node within a pattern (matched set).
+- @defaultPhase honored when no explicit phase; phase-level lets
+  shadow into scope; suite phase selection = the schema's single
+  phase (older corpus format).
+- pattern lets: global visibility for later patterns (new names
+  only); duplicate-in-pattern / duplicate-in-phase / rule-level
+  duplicate / identical-value global redefinition = parse errors.
+- undefined $var rejection after substitution (contexts, tests,
+  value-of/@select, sch:name/@path, pattern/@documents) — literal
+  aware; NCName scan now includes '-' and '.'.
+- let @value is an EXPRESSION (verbatim substitution, bare);
+  element-content lets = quoted string value.
+- rule abstract="true" + <extends rule=> (pattern-scoped;
+  cross-pattern extends is an error); pattern abstract="true"
+  (2016 syntax) alongside is-abstract.
+- runner: verdict = ANY finding (failed-assert OR successful
+  report); transitive <extends href>/<include href> splicing from
+  embedded secondaries; subordinate documents via pattern/
+  @documents evaluated runner-side (multi-doc validate).
+
+## Phase 5 COMPLETE (2026-09-10): 50/50
+
+The last three cases landed without the planned cross-subsystem
+refactor — the registry architecture did the work:
+- **key() bridge**: doc->sch_state (parallel to xslt_state) +
+  a sch key bridge hook in leptris_xpath_build_custom_registry
+  (CRITICAL: the early-exit guard needed !doc->sch_state too —
+  without it the doc falls back to the GLOBAL standard registry
+  and key() stays unknown). sch_fn_key builds lazily from
+  xsl:key decls via PUBLIC eval APIs (match patternized //,
+  use = @use or element text as quoted literal). Result nodesets
+  MUST init value.nodeset_value (xpath_result_new leaves it NULL;
+  count() of a NULL nodeset silently reads 0).
+- **element-content lets**: content parses standalone, root
+  detaches (root/new_dom_root/doc_children_* nulled), splices
+  onto the instance doc-children tail, pool kept alive via
+  leptris_document_adopt_child (xinclude pattern). The variable
+  value is the PRE-QUOTED text with bare=1 (verbatim insertion).
+- Banked bug: sch_patternize heap copy was freed before the node
+  loop re-read cexpr for the "/" special case — use-after-free
+  regression caught by the subordinate corpus cases; cexpr must
+  outlive the loop.
+
+## Phase 6 status (2026-09-10, branch feat/16-sch-phase6-cli)
+
+- `leptris validate` SHIPPED on the branch: `--rng FILE`,
+  `--schematron FILE` (or `-s`), `--phase ID`, `--svrl` (full SVRL
+  report instead of the summary). Exit 0 valid / 1 invalid /
+  3 I/O-schema error. Summary prints failed-assert location +
+  message lines. Specs: CliValidate.* (Windows-guarded — the
+  run_cli subprocess harness limitation; exit codes decoded from
+  std::system's high byte).
+- Ruby binding PR OPEN: leptris-ruby#170 —
+  Leptris::XML::Schematron (parse/parse_file/parse(phase:),
+  #valid?, #validate -> SVRL document; 6 specs, gem suite 570/570
+  against a shared build). USER MERGES.
+- Python binding PR OPEN: leptris-py#99 — leptris.Schematron
+  (Schematron/from_file/from_phase, is_valid, validate -> SVRL
+  Document; 6 tests, suite 412/412). USER MERGES.
+- REMAINING for the lane: the standoc/oXygen migration prompt
+  (after bindings merge). Lane CLOSES then.

data/vendor-src/libleptris/TODO.xslt-full/17-xml-diff.md

@@ -0,0 +1,52 @@
+# 17 — Native XML diff (canon consumer)
+
+Opened 2026-09-09 (user directive: "implement xml diff, see
+lutaml/canon"). Canon is the semantic-comparison gem that already
+rides libleptris (via moxml) for XML parse + C14N with
+Nokogiri-fallback parity; today its diff layer runs in Ruby over
+fully-materialized trees. A native engine-side diff gives canon
+the same moxml-style speedup C14N got (23x binding-armed).
+
+## Engine design
+
+- **Prefilter**: the #869 Merkle digest already hashes subtrees
+  (element name + sorted attrs + child content digests) — equal
+  digests prune whole subtrees in O(1); only diverging regions
+  descend.
+- **Diff kernel**: Zhang-Shasha-style ordered tree edit distance
+  over the pruned regions (children lists), producing an edit
+  script: insert-node / delete-node / update-text / update-attr /
+  (v2: move). Bounded matrix; docs are small after pruning.
+- **Result model**: ordered op list, each op carrying a path
+  (root-relative index path, stable across edits), the op kind,
+  and before/after payloads (text or attr name+values).
+- **Public surface**: `leptris_diff(docA, docB, options, status)`
+  -> opaque `LeptrisDiff` (op list accessor +
+  `leptris_diff_serialize` unified-text form for the CLI);
+  options: { include-whitespace-text = 0 }. ABI: new opaque type,
+  no existing entries touched (lane-15 gate applies).
+
+## Phases
+
+1. Digest-pruned equivalence fast path + op model (insert/delete/
+   update on text/attrs) — unit specs, RED first; diff(a,a) is
+   empty; single-node edits each kind.
+2. Ordered children alignment (edit distance on child lists,
+   recursion into matched pairs) — reorder + deep-change specs.
+3. Serializer (unified line form) + CLI `leptris diff a.xml b.xml`.
+4. Bindings (leptris-ruby Diff class; PRs only) + canon
+   integration PR (native fast path, Ruby fallback kept, parity
+   spec-gated like its C14N path).
+
+## Bars
+
+- diff(a,a) O(n) via digest (no descent).
+- Realistic edit fixtures >= 2x canon's Ruby layer (engine side
+  measured on the C API; binding via moxml-style FFI).
+- No false ops: diff output applied to A must yield B (round-trip
+  spec).
+
+## Out of scope (v1)
+
+Moves/renames across parents; JSON/YAML (canon handles those
+outside libleptris); three-way merge.

data/vendor-src/libleptris/TODO.xslt-full/18-compact-nodes.md

@@ -0,0 +1,278 @@
+# 18 — Compact nodes: the pugixml DOM race (user directive 2026-09-12)
+
+User: "pugixml is the zero-copy C++ DOM champion — fix it! why are
+we not zero-copy?" (asked 3x). Zero-copy is ALREADY true (parse is
+in-place NUL-termination over one buffer copy — pugixml
+load_buffer's own strategy; attr bookkeeping fixed in v1.9.147:
+4.9x -> 1.96x). What remains is NODE SIZE + per-op bookkeeping.
+
+## The measured floor (bench_matrix + /tmp/appendprof split)
+
+| row | leptris | pugixml | state |
+|---|---|---|---|
+| parse attr-heavy-5k | 769us | 393us | 1.96x behind (was 4.9x) |
+| parse text-heavy-2MB | 192 | 622 | 3.2x AHEAD — holds |
+| mutation append 10k | 401 | 116 | 3.5x behind |
+| mutation set-attr 2k | 475 | 204 | 2.3x behind |
+
+appendprof split (10k ops): create-only 20.6ns, append-only
+18.9ns vs pugi append_child 11.6ns TOTAL (44-byte nodes). Our
+element is 64B struct + ns_cache side-allocs; per-create = pool
+carve + memset + name pool-copy + FNV hash + split walk; per-append
+= call chain + double parent decode + type-dispatch sibling setter
++ ~8 stores. Root-doc map registers ROOTS ONLY (3 call sites) —
+NOT a per-create cost (verified; do not chase again).
+
+## Phases (each gated: full suite + ABI + bench matrix)
+
+P1 — namebp restructure (PREREQUISITE, unblocks P2/P3): the
+name[-1] doc-backpointer must survive in-place QName splits and
+cover unattached elements, so register-on-create/reachability can
+be reworked. HAZARDS (banked incidents): #905 register-elision =
+crash class on detached paths (v1.9.102 revert); split_qname must
+clear/relocate the flag (v1.9.98). Gate spec: the v1.9.98 latent
+tripwire + detached-construction suite.
+
+P2 — element slimming 64B -> ~48B: lazy name_hash (attr pattern
+already proves it — 2 bytes today), pack name_len/flags, evaluate
+cp16 for first_child when blocks are contiguous, move attr_count
+semantics fully to the chain (uint8_t wraps >255 — the chunk spec
+showed the chain is the truth). ABI: struct is internal (opaque
+handles) — no public ABI break; watch element-size spec (~96B
+memory footprint target in validate.sh).
+
+P3 — fast paths: create with no redundant zeroing (carve knows
+which fields matter), append single-decode (validate mut_tail once,
+direct element-typed sibling store), set-attr walk-first already
+shipped (XSLT lane) — re-measure.
+
+TARGETS: append row <= 116us (parity), attr-heavy <= 393us (with
+the ns_cache carve re-attempt — root cause map in TODO 13's
+measured-and-reverted entry: lazy get_namespace_uri -> declarations
+walk -> slot cache-back; set_prefix creates the cache initing only
+3 of 7 fields).
+
+## Rules of engagement
+
+- One phase per PR, full-suite + ASAN Linux legs green, bench
+  matrix before/after in the PR body (fresh dirs, identical
+  CMAKE_BUILD_TYPE — benchmark-discipline memory).
+- NEVER re-apply the ns_cache carve without first fixing the
+  prefix->URI mechanism (52/205 libxslt failures was the symptom).
+- The XSLT dispatch rows (#682) stay out of this lane — separate
+  scope call.
+
+## Status 2026-09-13 morning (PR #1025): P0 shipped, two finds
+
+- P0 SHIPPED: root-doc map entries chunk-carved (128-entry TLS
+  chunks). The register malloc'd PER CREATED ELEMENT when the
+  free-list was empty — 71ns, 78% of the public create path
+  (10k-create harness 916 -> 192us). The matrix's rounds recycle
+  via teardown, so ITS delta is small (append 401->390); the
+  create-without-teardown shape is the beneficiary.
+- Find 2 SHIPPED: elem->attr_count is uint8_t and WRAPS at 255 —
+  the walk-vs-index threshold keyed on it oscillated, dropping
+  high-attr elements back onto the O(N) walk (set-attr row 459 ->
+  327us, 1.60x behind). Latching header bit 5
+  (LEPTRIS_ATTR_INDEXED_FLAG); spec pins >255 dedup.
+- REFINED MATH for "beat in all shapes": create 19.2 + append 18.9
+  ~= 38ns vs pugi 11.6 TOTAL. P2 slimming (64->48B) floors create
+  ~12-14ns; P3 append fast path ~8-10ns => 20-24ns, still ~2x.
+  FULL parity needs P1 (register elision via namebp for known-doc
+  elements — the #905 hazard restructure) + possibly dropping
+  per-create hash/split to lazy. P1 IS the decisive slice; do it
+  in a fresh window with the detached-construction suite as the
+  gate.
+
+## Ceiling verdict 2026-09-13 (post-P0-P3, definitive A/B)
+
+- The mutation-wrapper invalidation calls are FREE (invalidate_
+  child_cache is a literal no-op; index_invalidate = version++).
+  An apparent 56ns delta was thermal/load pollution — two-binary
+  A/B with order control: 246/247/251us identical. LESSON: never
+  getenv-gate a hot loop; thermal drift between sequential runs
+  fabricates 2-4x deltas. (Same class as the 928us "regression"
+  that dissolved on the clean rerun.)
+- Post-P1+P3 shape: create 6.6ns + append ~18ns = ~246us/10k vs
+  pugi 11.6ns TOTAL (116us). Remaining append cost = 2 cross-TU
+  call frames + get_document memo + validation ladder + parent
+  decode + mut_tail validate + 6 stores + COW version++.
+- CEILING: flattening the frames (~3ns) and shaving checks (~2ns)
+  floors at ~19-20ns total ~= 1.7x pugi. OUTRIGHT wins on this
+  microbench require removing semantics pugi does not carry:
+  node-type validation, COW versioning, doc resolution, compact-
+  encode safety, per-element child_count. That is a design
+  decision (which guarantees to drop or make conditional), not an
+  optimization — SAME CLASS as the #682 call. Options:
+  (a) accept mixed frontier (every USER-VISIBLE row already ahead
+      or at parity-closing distance),
+  (b) a leptris_element_create_child(parent, name) fused API that
+      skips the public-contract checks internally (keeps all
+      semantics, one call, likely lands ~14-16ns ≈ 1.3x),
+  (c) conditional fast-path via a doc flag (opt-out of COW/
+      validation for trusted builders). USER CALL.
+
+## 2026-09-13: ALL-SHAPES mandate — fresh v1.9.156 board (twins in /tmp/zc.c,zp.cpp,mz.c,mz.cpp; /tmp/pugirace worktree, Release, best-of-400)
+
+| shape | leptris | pugixml | gap |
+|---|---|---|---|
+| attr-heavy-5k parse | 55us | 35us | 1.57x |
+| text-small-1k parse | 26us | 14us | 1.86x (NEW loss shape: tiny PCData favors pugi inlined nodes) |
+| create+append 10k | 247us | 113us | 2.19x |
+| set-attr 10k | 510us | 144us | 3.54x |
+| create per-op | 6.6ns | 11.6ns | AHEAD |
+
+Levers (sized): (S1) set-attr 51->14ns/op: attr linked-list (40B stride, mut_attr_carve) -> per-element
+INLINE attr array; dedupe walk is the hot cost + index invalidation per set. (S2) create+append
+24.7->11.3ns pair: begin_mutation/end_mutation bracket deferring index invalidation + skipping
+ensure_promoted on mut-native docs. (S3) attr-heavy 4ns/attr: batch entity-decode scan + drop
+per-attr name lowering when name is already-lower fast-path check. (S4) text-small 12ns/node:
+inline <=15B PCData into the text node header (single pool alloc -> zero). Order by gap: S1, S2,
+S4, S3. All four must hold the 17-leg suite + corpus/parity floors.
+
+## S1 implementation plan (set-attr 510 -> <144us; profiled 2026-09-13: 2-3 get_document
+climbs per overwrite + pool_alloc per value + hash on walk path; pool_alloc only ~6%)
+1. element.h:66 leptris_attribute: value_view (16B StringView) -> union {heap{ptr,len|FLAG};
+   char inline[16]}; inline when len<=15 (len high bit = flag). Accessors
+   leptris_attr_value_sv() + attr_value_set(attr,pool,s,len).
+2. Convert ~96 value_view readers (element.c 35, element_modify.c 26, element_query.c 15,
+   xpath vm 5, evaluator_axes 4, c14n 4, leptris.c 4, serialize.c 3) to the accessor.
+3. set_attribute: hoist ONE doc resolution (get_pool re-resolves internally — use doc->pool),
+   lazy hash (index path only), update path attr_value_set (inline = zero alloc).
+4. Gates: /tmp twins row (<144us), all four rows held or improved, full ctest, xslt 205,
+   html5lib 1206, parity 784, 17 legs. Twins now in benchmarks/twins/ (survive /tmp wipes).
+
+
+## S4 OUTCOME (PR #1051): dp_edge inline; three dead ends; block already existed
+
+CORRECTION to the design below: the text-node bump block ALREADY SHIPPED
+as "round 8" (dp_text_create in direct_parse.c, with the #815 dirty-page
+fix). Text-small was never missing a carve. Instrumented phase timing of
+the twins text-heavy-1k shape (1101 elems + 1000 texts, 17.4 KB):
+
+- copy_count3 0 us best-of-5000 (memcpy speed) — the fused NEON pass is
+  NOT a lever; the 16% xctrace attribution was a distorted-build artifact
+- alloc (arena+blocks+memset 212KB) 1.7 us; halving the reservation
+  (est_elems = lt/2 experiment) measured NO delta — macOS malloc +
+  streaming memset too cheap; the '</' pair-count kernel idea is dead
+- carve-time element zeroing (replacing the bulk memset) measured 1-2 us
+  SLOWER — interleaved in-loop stores lose to one streaming pass; reverted
+- loop = 91% of parse. The ONE out-of-line per-node call was
+  leptris_compact_int32_encode (compact.c, cross-TU, 2x per node) — now
+  dp_edge: inlined pointer subtraction with the shared encoder kept as
+  the >2 GiB fallback (#450 guarantees in-range).
+
+Interleaved twins: text-heavy-1k 25 -> 21 us (-14%), attr-heavy neutral.
+Remaining text-row gap (21 vs ~14) = the 96 B element footprint — P2
+slimming is the next (design-level) slice; it moves every row
+(append 2.1x, set-attr 2.0x, attr-heavy 1.6x, text 1.5x).
+
+
+## S5 (PR #1051 commit 2): no-&p escapes — attr-heavy 59-60 -> 53-55us
+
+DParser is 4KB (two 256-entry stacks): ANY &p escape (even one cold
+NOINLINE call, dp_parse_doctype) kept ALL hot fields stack-resident
+every iteration (assembly: loop head `ldr w8,[sp,#4408]` before the
+depth compare). dp_wire_child also compiled to a real bl (3 sites).
+Fixed: doctype takes state pieces via caller-local sync; wire/doc_child
+ALWAYS_INLINE; dp_scan_name delegates to dp_scan_name_p(char**).
+FIRST DRAFT inverted the parsed-DTD guard (if(dtd) not if(parsed)) —
+10 DTD failures in one ctest run; fixed before commit. Also verified:
+element struct is 64B/one cache line (the ~96B docs are stale); the
+unattributed per-element floor (~14ns) after S4/S5 is dispatch/carve/
+scan — next candidates: fused simple-open-tag fast path, attr raw-view
+per-attr cost (S3). Board: text 21-22 vs ~14, attr 53-55 vs 33,
+append 239 vs 113, set-attr 294 vs 144, create AHEAD.
+
+
+## S6 (PR #1051 commit 3): inline int32 codecs everywhere — attr 57-59 -> 54us
+
+compact.h gained encode_inline/decode_inline (NULL/sentinel/out-of-range
+fall back to compact.c — overflow-table semantics identical); all five
+node headers use them; dp_edge deduped into the shared inline. Inter-
+leaved: attr-heavy -7%; MUTATION ROWS NEUTRAL — the append/set-attr
+bottleneck is NOT the codec calls (each ~1ns). Board after S4a+S5+S6:
+create AHEAD; text 21-22 vs ~14; attr 54 vs 33; append ~250 vs 113;
+set-attr ~308 vs 144. Mutation remains redesign-class per the #1031
+verdict (safety ladder + doc resolution + name carves) — next lever
+there needs profiling of element_modify/element.c first, not guessing.
+
+
+## S7 (PR #1051 commit 4): doc-entry chain kills the 256-bucket sweep — guard 1100 -> 650
+
+The macos perf guard failed 1010.5 and 1013.8 vs the 1000 line across
+two pushes; local base-vs-S6 guard replica was IDENTICAL (~1095 both)
+— the code was not the regression, the BASELINE was at the line.
+Throwaway no-sweep build: ratio 1100 -> 620. THE #1038 sweep (256 TLS
+buckets per document_free) was ~42% of small-doc parse+free cost —
+landed in v1.9.156, quietly ate the guard's margin.
+Fix: entries carry doc_next; doc->map_entries chains them; the sweep
+walks THIS doc's entries, unlinking each from its bucket by ENTRY
+IDENTITY (root pointer VALUE only — never dereferenced, adopted-pool
+rule preserved). Single-unregister and cross-doc re-register maintain
+the chain (specs falsify both aliasing hazards; 1470/1470, 0 leaks).
+Guard replica ~650 (35% margin back). Churn workloads (parse->free
+loops, matrix teardown) get the full 42% small-doc win.
+LESSON: a hotfix that adds per-free fixed cost shows up in the RATIO
+guard, not the twins — re-check guard margin after any fixed-cost
+addition.
+
+
+## S8 plan (post-v1.9.159): mutation row profile — create 25 / append 20 of 135 samples
+
+xctrace on the create+append loop (dylib build, v1.9.159): create=20
+top/25 incl, append_internal=18/20, node_parent=9 (out-of-line
+dispatch: tail-cache validation + the always-NULL old_parent check on
+fresh children), get_document=7, strchr=7 (leptris_elem_split_qname
+scans for ':' with a libc call on EVERY create — parser gates it
+behind name_len>=3 and inlines), memmove+strlen=13 (mut_name_carve's
+runtime-length memcpy on 2-byte names). Teardown malloc/free samples
+are outside the twin's timed window.
+
+S8 levers (each ~1-2ns of the 24.8ns/op; summed ~4-6ns -> ~1.6-1.7x;
+PARITY still needs the #1031 design decision — opt-out fast
+builders):
+1. split_qname: gate the colon probe behind name_len>=3, inline the
+   2-4 byte scan (mirror dp_split_hash_name); create already knows
+   name_len.
+2. node_parent: inline the 5-type dispatch via the dp_wire_child
+   offset-table pattern; create_child (fused API) can skip the
+   old_parent check entirely for fresh children.
+3. mut_name_carve: <=8-byte names as two 8-byte stores instead of the
+   runtime-length memmove call.
+
+
+## S8+S9 SHIPPED (PR #1054, 2026-09-14): mutation rows 2.18x -> 1.66x, 2.11x -> 1.40x
+
+S8 (create+append 246 -> 188us): split_qname colon gate (name_len>=3 +
+inline scan; both callers set name_len first), dom/edges.h shared
+offset tables + ALWAYS_INLINE node_parent (was an out-of-line switch
+running 2x per append), mut_name_carve 8-byte-word name copy (word
+RESERVED in the carve size — block-bound safety).
+S9 (set-attr 307 -> 203us): profile showed 26% in the find + FOUR
+libc calls/op (strlen name x2 via the public wrapper, strlen value,
+memcmp confirm). leptris_dom_attr_find takes the caller's name length
+(both public get-by-name and set_attribute share it — one strlen);
+leptris_cstr_len16 (inline 16-byte NUL scan, never past the NUL) +
+leptris_memeq_short (inline confirm). Suite 1472/1472 both slices.
+
+REMAINING >1.5x rows and the semantic wall:
+- set-attr 1.40x / append 1.66x: the biggest single remaining piece
+  is leptris_element_get_document (~4ns: TLS memo + parent climb).
+  Mutation-created elements ALL carry the namebp doc backpointer —
+  checking it FIRST would make resolution O(1). NOT DONE: it changes
+  documented semantics ("walk to the root") and the cross-doc-attach
+  case (create in A, append under B — climb says B, namebp says A).
+  Needs a user call, same class as #1031's opt-out fast builders.
+- attr-heavy parse 1.6x: per-attr raw-view entry (#635 channel) +
+  entity routing — S3's territory, needs its own profile.
+
+## S4 design (text-small 24 -> <14us; after v1.9.158): text-node bump block
+Parse already borrows content (text_create_borrowed, zero-copy). Cost = 56B struct
+pool_alloc per node. Lever: per-doc contiguous text block (mut_elem_carve pattern):
+struct leptris_text_block{next,cursor,end,bytes[]}, 1024 nodes/56B stride, doc fields
+text_blocks/text_cursor/text_end, carve fn IN THE PARSER TU (direct_parse.c — NOT
+element_modify.c; v1.9.158 lesson). Fallback to pool on exhaustion. document_free
+frees blocks wholesale (lifetime = doc, same as pool; #1038-safe: nothing outlives).
+Sibling edges int32 already span cross-block gaps (#450). Spec: text-heavy doc all
+content round-trips exactly + 17 legs + twins gate (text row) + parse-ratio guard.

data/vendor-src/libleptris/TODO.xslt-full/README.md

@@ -0,0 +1,26 @@
+# TODO.xslt-full — XSLT 1.0 conformance completion (the v1.10.0 board)
+
+The single release gate for v1.10.0: **libxslt suite 205/205**
+(test/xslt/open_cases.txt must be EMPTY), 45/45 XsltFull, full CI
+green (ASAN/TSAN/Windows/leaks). No release before the gate passes
+(user directive 2026-08-25).
+
+Rules (per repo conventions):
+- One PR per task; the ENTIRE task in that PR (no phase-splitting).
+- Every fix verifies against xsltproc ground truth first.
+- Architecture: OCP for instruction handlers (new handler +
+  registration, no engine edits), SSOT for semantics (the pattern
+  matcher / ns-context / serializer each own exactly one copy),
+  MECE by construct, DRY via shared helpers — never fork a rule.
+- Performance gates: benchmarks must stay ahead of libxml2/xsltproc
+  (benchmarks/xslt/*) — conformance may not cost the lead. A fix
+  that regresses a benchmark by >3% needs an algorithmic answer.
+
+Live census (157 open, by failure signature; refresh with the
+triage script in 00):
+- 84 PI/COMMENT-OUT — fragment-node serialization + content edges
+- 28 EMPTY — root-node `/` semantics, doc() chains, early exits
+- 24 DIFF — number corners, attr-set precedence, sort, AVT edges
+- 10 CRASH — depth accounting, cycle handling (bug-6-, bug-70…)
+-  9 NS-OUT — namespace copies on result trees
+-  2 CHARREF — attribute char escaping corners