leptris 1.9.201.0-arm-linux → 1.9.201.2-arm-linux

data/vendor-src/libleptris/TODO.transform/README.md

@@ -0,0 +1,39 @@
+# TODO.transform — XSLT 1.0 engine (flagship)
+
+Design contract (mirrors TODO.bindings/engine discipline):
+- COMPILE ONCE, EXECUTE MANY: stylesheets parse to an instruction
+  tree with function-pointer dispatch (the node_vtable pattern) —
+  adding an instruction/EXSLT element = a new handler + one
+  registration, no engine edits (OCP).
+- The XPath layer is the moat: patterns and selects go through the
+  existing parser/VM/evaluator. XSLT adds: pattern matcher (§5.2),
+  template selection (§5.4/5.5 priority + import precedence),
+  keys, numbering, and a context-function bridge (current(), key(),
+  document(), format-number(), generate-id()) injected through the
+  per-eval registry copy — the same path as custom functions (SSOT).
+- Output is built as a DOM into a result document via the mutation
+  API, serialized by the mixed-content-correct serializer (DRY);
+  result-tree-fragments are scratch documents surfaced as top-level
+  node lists (no fake document node needed).
+
+Phases (one PR per phase group, full specs each):
+- 01-pattern-matcher: XSLT pattern semantics over the XPath AST
+  (ancestor-chain matching, computed default priorities, unions)
+- 02-stylesheet-compiler: stylesheet parse → instruction tree;
+  include/import precedence; strip-space; output settings;
+  attribute-sets; decimal-format
+- 03-template-engine: apply-templates/mode/priority selection,
+  literal result elements, value-of/text/copy/copy-of,
+  if/choose/for-each, variables & params (scope frames),
+  call-template/with-param, element/attribute/comment/PI,
+  message(terminate), xml|text output methods
+- 04-sort-number-keys: xsl:sort (text|number, asc|desc, stable),
+  xsl:number (level single|multiple|any, count/from, format with
+  1/a/A/i/I + grouping-separator/size), xsl:key + key() with lazy
+  per-document indexes, format-number + decimal-format
+- 05-exslt-and-document: document(), exslt:node-set(), regexp
+  (match/replace/test via POSIX ERE), date core, generate-id(),
+  current(), system-property()
+- 06-conformance-suite: in-tree W3C-behavior suite covering §5
+  patterns/priorities, §7 replication, §8 variables, §9 numbering,
+  §11 keys, §12 output, §13 fallback, + EXSLT behaviors

data/vendor-src/libleptris/TODO.validate/README.md

@@ -0,0 +1,32 @@
+# TODO.validate — Relax NG + RNC + Schematron
+
+Design contract:
+- RNG core is a DERIVATIVE matcher: patterns (empty, text, data,
+  value, choice, group, interleave, oneOrMore, list, element,
+  attribute, ref/parentRef, grammar/start/define) derive against
+  the document event stream; null-ability checks termination.
+  One algorithm, no hedge-automaton build step — compiles fast,
+  validates linear, easy to audit.
+- Modular: rng_model.c (model + RNG-XML parser) / rng_deriv.c
+  (the algebra) / rng_validate.c (the walk) / rnc_parse.c (compact
+  front-end targets the SAME model — SSOT) / schematron.c (small
+  interpreter riding XPath 1.0 + our registry functions).
+- Diagnostics: element-path + expected-vs-got messages through the
+  public LeptrisStatus/last_error channel.
+
+Phases:
+- 01-rng-model-parser: pattern model, RNG-in-XML parsing, grammar
+  tables, ref resolution, datatype-library hooks (string-only v1
+  + built-in "string"/"token"; XSD types later behind the hook)
+- 02-rng-derivative: nullable/deriv/textDeriv/attDeriv/listDeriv
+  algebra + attribute-set collection; complexity guards
+- 03-rng-validate: document walk (elements/attrs/text/whitespace
+  policy), error reporting, conformance spec suite (OASIS/Jing
+  behaviors: interleave, oneOrMore, list, data/value, defines,
+  start=choice, combine)
+- 04-rnc-frontend: full compact syntax (decorators, groups,
+  nesting, |, &, ,, *, ?, -, annotations, datatypes, namespaces,
+  . parent, root) → the SAME model; round-trip spec vs RNG
+- 05-schematron: ISO 19757-3 XPath-1 edition — patterns/rules/
+  contexts/assert/report/diagnostics/phases; result document via
+  the DOM mutation API; svrl-style output

data/vendor-src/libleptris/TODO.xpath2/README.md

@@ -0,0 +1,91 @@
+# TODO.xpath2 — XSLT 2.0/3.0, XPath 3.1, and XQuery (from Saxon-HE)
+
+The engine for the 1.x line is XSLT 1.0 (TODO.transform) on the
+XPath 1.0 layer. This board plans the 2.0/3.0-generation surface
+by PORTING (not inventing) the semantics from Saxon-HE, the
+canonical open-source reference implementation:
+
+    Source of truth:  git@github.com:Saxonica/Saxon-HE.git
+    Local mirror:     ~/src/external/Saxon-HE/13/source/saxon13-0source.zip
+                      (Java sources under net/sf/saxon/)
+
+Porting discipline (same as TODO.transform):
+- READ the Java source for semantics; implement in C99 against the
+  existing leptris architecture (pool allocator, compile-once
+  instruction forests, function-pointer dispatch).
+- No Java runtime. No GC assumptions. Every data structure maps to
+  an existing leptris primitive (StringView, pool-owned nodes,
+  nodeset arrays) or a new one with an explicit lifecycle.
+- Conformance specs come from the W3C test suites (XSLT 2.0, XPath
+  2.0/3.1, XQuery 3.1) — ported as falsifiable per-feature cases.
+
+## Sequencing (each phase = one PR, full specs)
+
+### 01-xpath31-type-system
+- Sequences (item()+ semantics) as first-class results — replace
+  the 1.0 nodeset/number/string/boolean four-type result model
+  with a sequence-of-items model that degrades cleanly to 1.0.
+- Atomic types: xs:integer, decimal, double, float, string,
+  boolean, date/time family, duration, QName, anyURI, untyped.
+- Static typing pass (optional diagnostics; dynamic evaluation is
+  normative).
+- Reference: net/sf/saxon/type/, net/sf/saxon/value/.
+
+### 02-xpath31-expressions
+- `for`/`let` expressions, inline functions, arrow (`=>`) and
+  `!` operators, `if/then/else`, quantified expressions.
+- Higher-order function calls, dynamic function references.
+- Maps, arrays, lookup (`?key`, `?index`).
+- String templates, `parse-ietf-date`, `format-integer/number/date`.
+- Regex: XPath 3.1 functions (`matches`, `replace`, ` tokenize`,
+  `analyze-string`) — replaces the POSIX ERE subset.
+- Reference: net/sf/saxon/expr/, net/sf/saxon/functions/.
+
+### 03-schema-aware-lite
+- `validate` expressions need XSD. Porting full XSD 1.1 is its own
+  board; the interim step is PSVI-lite: typed element/attribute
+  annotations driven by a simple schema loader. (Full XSD tracked
+  separately in TODO.validate.)
+
+### 04-xslt20-30
+- Backwards-compatible + 2.0 modes; xsl:function, xsl:sequence,
+  tunnel parameters, temporary trees, grouping (xsl:for-each-group
+  — 4 grouping kinds), regex grouping, xsl:analyze-string,
+  xsl:try/catch, xsl:evaluate, xsl:iterate, xsl:next-iteration,
+  xsl:accumulator, xsl:mode declarations, package (3.0) semantics.
+- Reference: net/sf/saxon/style/, net/sf/saxon/expr/instruct/.
+
+### 05-xquery31
+- Query prolog (declare variable/function/namespace/collation),
+  FLWOR (for/let/where/order by/group by/return/window),
+  modules and imports, update-free XQuery 3.1 + Update Facility 1.0
+  as a later phase.
+- Reference: net/sf/saxon/query/.
+
+### 06-conformance-suites
+- The Saxon/W3C XSLT 3.0 test suite is now local:
+  ~/src/external/saxon-xslt30tests (Saxonica/xslt30-test, 470 MB,
+  8,486 stylesheets). Layout: root catalog.xml → test-set files
+  (tests/*/*/_name-test-set.xml) → test-case elements carrying the
+  scenario (stylesheet, initial context, result assertions).
+  XSLT 2.0 semantics are covered by the version="2.0" stylesheets
+  plus the shared core cases.
+- Harness: a catalog-driven runner in the libxslt-suite style
+  (fork-isolated, open-worklist skips) but assertion-aware — the
+  W3C cases assert structurally (assert-xml, assert-result-document,
+  error codes), not by byte comparison.
+- Port the W3C XSLT/XPath/XQuery 3.1 test-suite runner cases as
+  in-tree specs (same layout as test/xpath/test_xpath_conformance).
+
+## Explicit non-goals (tracked elsewhere)
+
+- Streaming (XSLT 3.0 streaming transformations) — separate board
+  after 04 (TODO.stream).
+- Schema-aware processing requiring full XSD 1.1 — TODO.validate.
+
+## Pre-conditions
+
+- TODO.transform fully closed (XSLT 1.0 bar cleared; §12 bridge
+  install landed) — this board builds on that engine, not around it.
+- The XPath 1.0 evaluator keeps its 438/438 conformance; 3.1 modes
+  activate per-expression-version, never globally.

data/vendor-src/libleptris/TODO.xslt-full/01-xpath-fn-sequences.md

@@ -0,0 +1,27 @@
+# 01 — XPath fn: catalog: sequence functions (#691-A)
+
+Adds the sequence-ops slice of #691 over the existing item/nodeset
+model. Each function TDD-first against Saxon-HE (probe batch), then
+registered in the core registry (functions.c) — no new types.
+
+- exists(S), empty(S), head(S), tail(S)
+- reverse(S), unordered(S) (identity)
+- index-of(S, v), distinct-values(S)
+- remove(S, i), insert-before(S, i, S2), subsequence(S, s[, l])
+- zero-or-one, one-or-more, exactly-one (cardinality checks ->
+  dynamic error on violation)
+- avg(S), min(S), max(S) (numeric + string forms)
+- count/sum/position/last already exist — SSOT guard only
+- deep-equal(A, B) (document order, string values; whitespace
+  trim option second pass)
+
+Gate: Xslt30.FnSequences spec (Saxon-probed) + full suite green.
+
+
+## Status 2026-09-04 — sequence node tail shipped
+
+innermost/outermost (ancestor/descendant-in-set filters),
+has-children (explicit + zero-arg context form; text children
+count), path (root-anchored /a/b[2] positional form), nilled
+(xsi:nil read). fn:snapshot still open — needs detached-copy result
+trees (copy_subtree_detached is the building block).

data/vendor-src/libleptris/TODO.xslt-full/02-xpath-fn-regex.md

@@ -0,0 +1,13 @@
+# 02 — XPath fn: catalog: regex trio (#691-B)
+
+matches(input, pattern[, flags]), replace(input, pattern, replacement[, flags]),
+tokenize(input, pattern[, flags]) — XPath 2.0+ semantics over the
+existing POSIX ERE engine (REG_EXTENDED | REG_ICASE per flags; 'x'
+flag = strip whitespace from pattern first; 'm' via REG_NEWLINE).
+Replacement uses '$1'..'$9' capture references (translate to
+POSIX-free manual splice: split replacement on \$N and stitch from
+regmatch captures).
+Windows: matches the portable-regex caveat (#686 family) — POSIX-
+gated with loud errors, engine swap tracked in 02b.
+
+Gate: Xslt30.FnRegex spec (Saxon-probed) + suite green.

data/vendor-src/libleptris/TODO.xslt-full/03-xpath-fn-math.md

@@ -0,0 +1,10 @@
+# 03 — XPath fn: catalog: math: namespace (#691-C)
+
+math:sqrt, math:pow, math:exp, math:exp10, math:log, math:log10,
+math:sin/cos/tan/asin/acos/atan, math:atan2, math:pi, plus core
+fn:abs, fn:ceiling/floor/round/round-half-to-even (round-half-to-
+even with precision arg is new). All trivial over libm; registered
+under the math: prefix with bare-name aliases where Saxon accepts
+them.
+
+Gate: Xslt30.FnMath spec (Saxon-probed) + suite green.

data/vendor-src/libleptris/TODO.xslt-full/04-xpath-fn-strings-qname-uri.md

@@ -0,0 +1,97 @@
+# 04 — XPath fn: catalog: strings / QNames / URIs (#691-D)
+
+Strings: codepoint-equal, normalize-space (exists), normalize-
+unicode (NFC via utf8proc when built, else identity+doc), upper/
+lower-case (exist), translate (exists), string-join (exists;
+sequence arity), starts-with/ends-with (exist), substring-before/
+after (exist; empty-match 3.1 semantics check vs Saxon),
+concat (exists), iri-to-uri, encode-for-uri, decode-from-uri,
+escape-html-uri, contains-token, format-integer (complete pattern
+set: 9/A/a/I/i/〇 and pattern separators), adjust-string.
+QNames: QName(prefix,local), resolve-QName, QName-from-string,
+local-name-from-QName, prefix-from-QName, namespace-uri-from-QName,
+node-name (element/attribute/PI), expanded-QName-to-string.
+
+Gate: Xslt30.FnStrings spec (Saxon-probed) + suite green.
+
+
+## Status 2026-09-04 — string/QName/URI tail shipped (v1.9.77+)
+
+Shipped in the #691 scalar-tail wave: compare, codepoint-equal,
+normalize-unicode (utf8proc forms; absent when built without
+utf8proc), resolve-QName (prefix against in-scope namespaces via
+the QName TLS channel), environment-variable,
+available-environment-variables, unparsed-text / -lines /
+-available (raw file reads, CWD-relative), uri-collection (empty
+catalog). Remaining in this lane: analyze-string (needs the
+fn:match/fn:non-match element model — XSLT xsl:analyze-string
+exists; the fn form returns nodes), fn:format-number as a plain
+XPath fn (the formatting core lives XSLT-side — layering decision
+needed), fn:snapshot (needs detached-copy result trees).
+
+
+## Status addendum 2026-09-04 (v1.9.79 candidate)
+
+random-number-generator SHIPPED (PR #834): seeded xorshift64*
+deterministic per seed, map carrier with 'number' in [0,1).
+Remaining in this lane:
+- fn:analyze-string — needs the fn:match/fn:non-match element
+  model; build on a fresh anchored document (xq_anchor_owned_doc
+  chain) + POSIX regex iteration; xsl:analyze-string exists
+  XSLT-side as the semantic reference.
+- fn:format-number as plain XPath — move the self-contained core
+  (parse_pattern/PatternInfo/format_value, ~200 lines) from
+  xslt_functions.c into a shared common/ module; XSLT keeps the
+  decimal-format lookup and passes separator chars. Libxslt-suite
+  format-number corners gate the move.
+- fn:snapshot — detached deep copies via copy_subtree_detached,
+  anchored on a fresh document through the owned-docs chain.
+- RNG 'next'/'permute' members — need function-item closure state.
+
+
+## Status addendum 2 (v1.9.80 candidate)
+
+format-number SHIPPED (PR #836): the JDK pattern core is SSOT in
+common/format_number.{h,c}; XSLT keeps the decimal-format lookup
+and maps it into a spec; plain XPath gets the default-format fn.
+
+BANKED INVARIANT (cost a SEGV to learn): the function registry is
+LAST-REGISTRATION-WINS. Overriding layers (XSLT bridge, EXSLT)
+register after the standard library; any handler that resolves its
+closure through the per-function user_data slot MUST register via
+xpath_function_registry_register_ud so the override carries its
+own closure — a plain re-register leaves user_data NULL and the
+handler dereferences garbage. Plain overrides reset user_data
+explicitly. Symptom class: same-named fn silently behaving like
+the base layer inside transforms (multi-byte df separators became
+pattern suffix text).
+
+
+## snapshot design note (2026-09-04, post-v1.9.80 attempt)
+
+The obvious anchoring (fresh leptris_document_create + copies via
+leptris_element_append_copy under a wrapper root + ctx owned_docs)
+is INSUFFICIENT for plain leptris_xpath_eval: xpath_context_cleanup
+frees owned_docs BEFORE the public eval returns (heap-use-after-free
+on the borrowed copies at the first result_string call). The
+owned-doc chain works only inside XSLT/XQuery lifecycles where the
+context outlives result consumption. Correct fix: a document-
+lifetime chain — an anchored-docs array on the SOURCE document
+(leptris_document_free releases them), so snapshot copies live
+exactly as long as the source tree. Field + free-path change +
+specs; analyze-string needs the same chain (its constructed
+fn:match/fn:non-match elements face the identical lifecycle).
+RED spec was written first and reverted with the code.
+
+## Status addendum 2026-09-05 (#846 fixed, PR #854)
+
+analyze-string namespace resolution shipped: the root cause was NOT
+in analyze-string or the resolver at all — constructed elements
+never had their QNames split (full lexical "fn:match" in name,
+prefix NULL), while every resolver compares name against the test's
+LOCAL part. leptris_elem_split_qname at both creation paths gives
+constructed elements the parser shape; one xmlns:fn declaration on
+the result root resolves every descendant. Also in that PR:
+op_element reads the element prefix instead of re-parsing the name,
+and the HTML serializer gates void/raw/break rules to unprefixed
+names (s:img is not the HTML img — bug-117). Lane 04 CLOSED.

data/vendor-src/libleptris/TODO.xslt-full/05-xpath-fn-dates.md

@@ -0,0 +1,30 @@
+# 05 — XPath fn: catalog: dates & durations (#691-E)
+
+xs:date/time/dateTime/duration constructors + components
+(year-from-dateTime, months-from-duration, ...), current-dateTime/
+current-date/current-time, adjust-to-timezone (fixed-offset),
+implicit-timezone, plus arithmetic (add/subtract durations,
+dateTime ± duration) exposed as functions where the 1.0 model
+allows (date-difference via days-... family). Civil-calendar math
+only (no timezone DB beyond fixed offsets — Saxon-HE parity needs
+implicit TZ only).
+
+Gate: Xslt30.FnDates spec (Saxon-probed) + suite green.
+
+
+## Status 2026-09-04 — accessor matrix complete (value-level)
+
+All accessors registered: year/month/day-from-date,
+hours/minutes/seconds-from-dateTime, minutes/seconds-from-duration
+(new), plus the pre-existing set. Duration parsing is now a full
+ISO 8601 walker (P[nY][nM][nD][T[nH][nM][nS]], negatable) — the old
+sscanf only understood P<days>DT<hours>H. xs:dayTimeDuration /
+xs:yearMonthDuration are passthrough constructor aliases. ## CLOSED 2026-09-10 — value-level gaps filled
+
+adjust-{dateTime,date,time}-to-timezone (fixed-offset instant
+math via the civil-days algorithm; empty $tz removes the offset;
+implicit TZ = UTC), format-{dateTime,date,time} (picture subset:
+[Y/M/D/d/H/h/m/s] numeric widths, [MNn]/[DNn] names, [Z] offset;
+unknown markers pass through), current-{dateTime,date,time}
+(UTC, Saxon lexical forms), implicit-timezone() = PT0S. Specs:
+FnAdjustTimezone / FnFormatDate / FnCurrentDateTimeShape.

data/vendor-src/libleptris/TODO.xslt-full/06-xpath-grammar-3x.md

@@ -0,0 +1,83 @@
+# 06 — XPath 3.x grammar completion (#692-A)
+
+Parser surface (lexer + parser + evaluator, BC_FALLBACK_EVAL in
+the compiler — no VM opcodes yet):
+- switch ($v) { case A return B ... default return D }
+- string constructors `` `...{expr}...` `` (3.1)
+- typeswitch — XQuery-only: REJECT loudly (Saxon XPST0003 parity)
+- xs:* constructor functions (cast forms for the atomic set in 05/
+  04 — string/integer/double/decimal/boolean/anyURI/date family)
+- instance of / castable as / cast as / treat as over the 1.0 type
+  set (node(), item(), xs:atomic set) — value-level only
+- 'otherwise' operator and '||' (exists) — 4.0 previews Saxon 13
+  defaults: probe Saxon-HE 13 behavior first
+
+Gate: Xslt30.Grammar3x spec (Saxon-probed) + suite green.
+
+## Status 2026-09-02 (post v1.9.48) — remaining, in order
+
+1. xs: constructor functions FIRST (pure registrations, no parser
+   work): xs:string/integer/double/decimal/boolean/anyURI in
+   functions_ext31.c via the extension-namespace path (evaluator.c
+   resolves prefixed fns through k_extension_ns_uris — the XSD
+   namespace http://www.w3.org/2001/XMLSchema must be in that list;
+   the date family already registers via fn_passthrough_ctor).
+   Saxon-HE 12.7 ground truth (banked, /tmp/probe9/g6.xsl):
+   xs:integer('42')+1=43 · xs:double('1.5')*2=3 ·
+   xs:boolean('true')=true · xs:string(7)="7".
+2. instance of / castable as / cast as / treat as: parser
+   productions (multi-word operators) + evaluator type tests over
+   node()/item()/xs:atomic set. Ground truth: 'x' instance of
+   xs:string=true · //i instance of node()+=true · '3' castable as
+   xs:integer=true · '42' cast as xs:integer=42 · 1.9 cast as
+   xs:integer=1 (truncate) · 'x' castable as xs:integer=false.
+3. switch expressions + 3.1 string constructors; typeswitch stays
+   a loud XPST0003 rejection (Saxon parity, already specced).
+4. 'otherwise' / '||': probe Saxon 13 defaults first (not 12.7).
+
+Gate: Xslt30.Grammar3x* spec (Saxon-probed) + full suite green +
+1.0 438/438 unchanged. NOTE (from #732): multi-top-level result
+nodes are SUPPORTED (libxslt parity) — never "fix" to Saxon's error.
+
+## Status 2026-09-02 (v1.9.49 + v1.9.50 shipped)
+
+DONE: item 1 (xs: constructors — v1.9.49, PR #737) and item 2
+(instance of / castable as / cast as / treat as — v1.9.50, PR #740;
+lexer gotcha: `node` is TOK_NODE not NCNAME; the four ops are VM
+AST-fallback). REMAINING: item 3 (switch expressions — note
+XPATH_OP_SWITCH already exists in the enum + compiler fallback list;
+verify what's implemented and spec the gaps) and item 4 (3.1 string
+constructors `` `...{expr}...` ``; 'otherwise'/'||' → probe Saxon 13
+first). Then lane 08.
+
+## Status 2026-09-02 (v1.9.50) — LANE CLOSED
+
+Items 3-4 resolved by oracle verdicts (pinned in
+RejectsXQueryOnlySyntaxInExpressions):
+- switch: Saxon-HE 12.7 XPST0003 "switch is not allowed in XPath"
+  (XQuery-only). Our loud rejection = parity. XPATH_OP_SWITCH stays
+  for the XQuery lane (11/12).
+- string constructors + otherwise/||: XPath 4.0 — Saxon 12.7 rejects
+  (XPST0003 4.0 syntax). Deferred to the Saxon-13 probe (item 4's
+  own directive); rejecting now is parity.
+Lane 06 COMPLETE (items 1-2 shipped v1.9.49/v1.9.50). Next: lane 08.
+
+
+## Status 2026-09-03 (post v1.9.76 + PR #825) — grammar surface COMPLETE
+
+Shipped through the wave: xs:* constructors + cast/castable/
+instance of/treat (v1.9.49-50), `||` concat, `=>`, `!`, `let`,
+`for ... return`, if/then/else, function items (`function($x){}`,
+name#arity, partial application `?`), inline HOFs, dynamic calls
+($f(21)), maps/arrays (both constructor forms incl. `array { E }`),
+typeswitch, try/catch expressions with the error-code model,
+quantified some/every, is/<</>>, intersect/except, `()`, deep-
+equal, ends-with, the XQuery 3.0 braceless switch, and
+parse-xml/parse-fragment returning document nodes. The #if 0'd
+braced switch form stays rejected (Saxon XPST0003 parity).
+
+Remaining (tracked, not blocking):
+- string constructors `` `lit{expr}lit` `` (3.1)
+- fn-as-path-step (`X/string()` — XQuery allows PostfixExpr steps)
+- VM opcodes for the fallback-eval'd 3.x ops (perf, lane 13)
+- packaging (xsl:use-package — roadmap v3.1), streaming (non-goal)

data/vendor-src/libleptris/TODO.xslt-full/07-xpath-function-items.md

@@ -0,0 +1,124 @@
+# 07 — XPath function items + HOF (#692-B)
+
+The public-surface item: XPathResultType/FFI mirrors gain
+XPATH_RESULT_FUNCTION (coordinate ext/ mirrors in leptris-ruby +
+leptris-py — PRs ok, never release). Then:
+- named function references name#arity (function items as values)
+- inline functions function($x){ body } (closure over the varset
+  snapshot; body = compiled expr evaluated on call)
+- partial application f(?, ...) — captures arg placeholders
+- dynamic invocation f(a,b) where f is a function item
+- fn:for-each/filter/fold-left/fold-right/apply/sort/function-
+  lookup/function-name/function-arity/function-arity
+- xsl:function (see 09) reuses this machinery
+
+Gate: Xslt30.FnItems spec (Saxon-probed) + mirrors synced + suite.
+
+## Status 2026-09-03 — first slice attempted, reverted clean; bisect notes
+
+Ground truth banked (Saxon-HE 12.7, /tmp/probe9/fi7.xsl fi7b.xsl):
+  function($x){$x*2} via let → 42; immediate call fn(41) → 42;
+  string-join#1(('a','b')) → 'ab'; 2-param fn → 42.
+
+Design (kept, compiles clean — all parser/lexer/enum wiring was
+reverted with the slice): TOK_HASH token; XPATH_OP_INLINE_FN /
+FN_REF / DYN_CALL (all VM AST-fallback); parser hooks beside the
+`map` branch (function+LPAREN; NCNAME+HASH) and a TOK_LPAREN arm
+in parse_postfix_ops (dynamic call). Closure repr: synthetic node
+"\x03FN\x02" params-'\x01'-joined "\x02" + raw body-AST pointer
+bytes (borrowed, transform-lifetime); FN_REF = "\x03FR"+name#arity;
+DYN_CALL dispatches FR via a stack XPATH_AST_FUNCTION_CALL over
+borrowed arg ASTs, FN binds params (FOR-discipline variable sets).
+
+Bisect point (traces on the gtest surface): `function($x){$x+1}(41)`
+compiles but the transform errors. [dyn] enter fires (twice —
+why twice?), the callee-content branches are reached but the
+body-eval trace NEVER prints → the flow exits between the content
+check and the FN branch: prime suspect = the closure content never
+starts "\x03FN" (check what INLINE_FN actually produced — maybe
+evaluate_expr on the INLINE_FN AST never dispatched to
+evaluate_operator, so the callee is something else), or the
+strchr('\x02') guard rejected. Trace the callee content bytes hex-
+first at DYN_CALL entry.
+
+Remaining after this slice: fn:function-lookup/name/arity, partial
+application, HOF combiners, PUBLIC XPathResultType change + FFI
+mirrors (leptris-ruby/py: PRs only, never release).
+
+## Update later 2026-09-03: slice GREEN locally, Linux-LSan leak
+
+The full slice (inline fns + dynamic calls, multi-param, hex
+closure encoding; both bug fixes below) was GREEN: test_xslt
+188/188, ctest 1203/1203, macOS ASAN clean — but Linux LSan
+flagged 2 leaked 48-byte synth nodes from the DYN_CALL param
+binding (evaluator_operators.c:488 → xpath_synth_text). macOS
+ASAN cannot run LSan (the known CI gap). Suspect: the unbind
+remove-by-name on the exec's cached varset (non-scratch path) —
+trace which of the 4 dyn calls leaks (2 objects) and whether
+xpath_variable_set_remove actually frees the nodeset when the set
+is the XSLT-exec mirror. Branch was reverted; the commit
+(feat/xpath-function-items2, PR #765) has the full implementation
+to re-apply verbatim, plus the two fixed bugs: (1) C hex-escape
+greed "\x03FN" → 0x3F+'N' (F is a hex digit; \x03MAP only worked
+because M isn't); (2) raw pointer bytes carry NULs and the let
+deep-copy truncates — closure body pointer is 16-hex-char encoded.
+Also open: name#arity (TOK_HASH + FN_REF) parses but its dispatch
+(f synthesized FUNCTION_CALL over borrowed arg ASTs) fails
+upstream of the call — case d of the spec, trimmed out.
+
+## Update 2026-09-03: FR dispatch + lane 07B SHIPPED (v1.9.59 / PR #768, 07B PR #770)
+
+- **FR dispatch root cause (v1.9.59, PR #768)**: FN_REF nodes carry
+  NO children, so evaluate_operator's opening `child_count < 1`
+  guard rejected them before any op check — the "fails upstream"
+  mystery closed. FR construction now runs BEFORE the guard; the
+  shadowed duplicate block deleted. Plus XPath 3.1 one-arg
+  string-join (separator '') — `string-join#1` lands in it.
+- **Lane 07B (PR #770)**: fn:function-lookup (string name, fn:
+  prefix stripped, registry arity-range validated; returns an FR
+  item or the empty sequence), fn:function-name (fn:name / empty),
+  fn:function-arity (#N / closure param count); fn:for-each,
+  fn:filter, fn:fold-left, fn:fold-right via the new
+  xpath_call_function_item seam (FR = synthesized call over string
+  literal arg nodes; FN = params bound from string args);
+  `?` partial application DESUGARED AT PARSE TIME to an inline fn
+  (`concat('x',?,'z')` → `function($%1){concat('x',$%1,'z')}`).
+  Banked invariant: hole names use `%N` — NCNames exclude '%', and
+  `\x01` inside a hole name COLLIDES with the params separator
+  (first attempt bound param "1" while the body referenced "\x011"
+  — the doubled ifn/dc eval trace was the giveaway).
+- Spec: Xslt30.NamedFunctionReferenceDispatch + 11-case
+  Xslt30.FunctionItemMetadataAndHofs (190 total in test_xslt).
+  Oracle: /tmp/probe9/l07b/{t1,t2}.xsl.
+
+Remaining for lane 07 closure: PUBLIC XPathResultType change +
+FFI mirrors (leptris-ruby/py — PRs only, never release);
+fn:for-each-pair and the map:/array: HOF family if the combiner
+seam makes them cheap; then lane 11/12 (XQuery).
+
+## Update 2026-09-03 (later): LANE 07 CLOSED (v1.9.63 / PR #777)
+
+- Public type: LEPTRIS_XPATH_FUNCTION (appended to
+  LeptrisXPathResultType; ABI numbers hold) — the type accessor
+  classifies the one-member synthetic carrier, GATED on the
+  synthetic-text tag (casting a real single-element nodeset as
+  XPathTextNode segfaulted the CLI predicate spec — caught by the
+  full ctest gate).
+- Combininers through xpath_call_function_item: for-each-pair
+  (zip), apply($f, array) (positional members as the arg list),
+  map:for-each (entry order), array:for-each/filter/fold-left/
+  fold-right. En-route bug class: map_entries_free ZEROES e.n —
+  capture the count before the compaction loop.
+- FFI mirrors shipped as PRs (never release, per the standing
+  rule): leptris-ruby#127 (constant + explicit XPathError wrap
+  branch), leptris-py#71 (same + _leptrisaccel.c finish_result
+  hands rtype 4 to the engine path — a bare NULL there surfaced as
+  SystemError; also un-pinned #744's element() pin).
+- Specs: Xslt30.HofPairsApplyAndArrayCombinators (8),
+  XPathResultTypes.FunctionItemsReportFunctionType; oracle
+  /tmp/probe9/l07b/t5.xsl. ## CLOSED 2026-09-10 — tail filled
+
+fn:sort(seq, key?, collation?) shipped: stable codepoint order,
+optional key function item, collation accepted-and-ignored
+(codepoint). for-each-pair uneven inputs zip to the shorter
+(pinned in FnSortWithKey). Lane 07 fully closed.

data/vendor-src/libleptris/TODO.xslt-full/08-xpath-maps-arrays.md

@@ -0,0 +1,79 @@
+# 08 — XPath maps + arrays + JSON (#691-F / #692-C)
+
+Internal representation: a map/array is a synthetic document-
+fragment node set (map = element node with entry children; array =
+element with positional children) so values flow through the
+existing NODESET channel without an ABI break; the FFI-level map
+view is a later binding ask (#683).
+- map { k: v, ... } / map constructors via function forms
+- map:get/put/remove/contains/keys/size/merge/for-each/entry
+- array { ... } / [ ... ], array:get/size/put/append/subarray/
+  remove/insert-before/reverse/join/for-each/filter/fold-left/
+  fold-right; lookup '?' on maps/arrays; '[' ']' postfix
+- parse-json / json-to-xml / xml-to-json / fn:serialize json
+  method (JSON escapes via the serializer's json writer)
+
+Gate: Xslt30.FnMaps spec (Saxon-probed) + suite green.
+
+## Status 2026-09-03 — A/B/C/D-core shipped, tail remaining
+
+DONE (v1.9.51–53): map constructor + get/size/keys/contains (A);
+put/remove/merge + xsl:map → 09 closed (B); square array ctor +
+array:size/get/append/put (C); parse-json (D-core). Representation
+authority: MapEntries + xpath_map_value/builder in
+functions_ext31.c; arrays = map with positional keys "1".."n".
+
+REMAINING (08 tail):
+- ?lookup (map?key / array?n chains): needs a '?' lexer token
+  (TOK_QUESTION does not exist) + postfix parse in parse_filter_expr.
+- json-to-xml / xml-to-json / fn:serialize json method (serializer
+  json writer exists per the TODO header — wire it).
+- map:for-each/entry, array:subarray/remove/insert-before/reverse/
+  join/fold-left/fold-right — thin MapEntries loops once HOF
+  machinery (lane 07) exists for the callback forms.
+Then lane 07 → 12 (see 06's status block for the Saxon verdicts).
+
+## json-to-xml / xml-to-json ground truth (2026-09-03, next slice)
+
+Saxon-HE 12.7 (/tmp/probe9/jx8.xsl): json-to-xml('{"b":"beta","n":2}')
+=> <map xmlns="http://www.w3.org/2005/xpath-functions">
+     <string key="b">beta</string><number key="n">2</number></map>
+Canonical fn vocabulary: map/array/string/number/boolean/null,
+@key on members, arrays positional. Implementation note: these
+return a DOCUMENT node through the nodeset channel — the result
+nodeset does not own documents, so build the fragment in a scratch
+doc and LEAK-SAFELY by reusing the capture-content ownership
+discipline (xslt_capture_content pattern) or attaching to the exec.
+xml-to-json is the reverse walk over that vocabulary.
+
+## json-to-xml slice — precise handoff (2026-09-03, reverted clean)
+
+First implementation attempt returned an EMPTY nodeset and its
+internal leptris_parse_string was never reached (lldb: only the
+stylesheet + source parses fire) — so fn_json_to_xml exits early:
+either json_root returns NULL on this exact input (though the same
+root logic passes the parse-json specs — verify the escape/arg
+path: re_str_arg on a &quot;-laden select) or the registration is
+not reached. Bisect from a clean main with a one-line probe:
+printf the re_str_arg result + json_root outcome inside a scratch
+fn. Spec (Saxon ground truth, already written once):
+  copy-of json-to-xml('{"b": "beta", "n": 2}') =>
+  <o><map xmlns="http://www.w3.org/2005/xpath-functions">
+    <string key="b">beta</string><number key="n">2</number></map></o>
+and the xml-to-json round trip map:get(...,'b')='beta'. Design
+kept: build canonical XML TEXT (escape &<>" + classify
+number/boolean/null by lexical form) → parse into a scratch doc →
+return the ROOT ELEMENT in the nodeset; xml-to-json walks the
+fn: vocabulary back into the shared map representation.
+
+## xml-to-json handoff (2026-09-03, reverted clean; v1.9.55 has json-to-xml)
+
+Round-trip spec (written, Saxon-verified expectation):
+  map:get(xml-to-json(json-to-xml('{"b": "beta", "n": 2}')), 'b')
+  => beta, and 'n' => 2. First attempt: walker produced ZERO
+entries — suspect leptris_element_attribute(el, "key") returning
+NULL on the PARSED (namespaced fn: vocabulary) elements, or the
+arg-eval lifetime of the nested json-to-xml nodeset. Bisect with a
+gtest-only probe (NOT standalone .a probes — see v1.9.55 note).
+Walker design kept: map/array elements recurse via the builder;
+scalars add element-text under @key; result = shared map repr.