leptris 1.9.204.0-arm-linux → 1.9.208.0-arm-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb5f3a3bf37ea84445e3e579f8c5ad069c8b9e99fb1fe8d20ea1ddec5ff019a6
-  data.tar.gz: 160d3c000020619daf7239001822260a074d84e85b85100494c037af840c8670
+  metadata.gz: 12d572113446e18e8af819d5856f43251e0f4680f082fc9f099b1b96b80db06a
+  data.tar.gz: 16624fb18f02d16ef61a96482b2261607639a8c69fe9c3cf14b5e965577d572b
 SHA512:
-  metadata.gz: 469eace319772662c7768f955db743b04848100b281f9c078db1403639e3714ca25b649e0187c664baf30571edc19e27767d82afb04ea6b1ecdfd540f2194b22
-  data.tar.gz: c0480bd8577181a8bb133f82317ada4bdd75d2fdfffa7cd11f1320d8c75be392c514be9b5c242a7bcfacc7f51fa33d02bec56b12e1fbdd252e95497e52388364
+  metadata.gz: 5e06f82afefb6eef0699a0dd8f791fb4c66b348a9c5bafe1ae76243e86222e45c72dbce74ffc968d63b9d8eb5a4832c4605a994f7e3566f5a484793f6c3938c8
+  data.tar.gz: e8a3d151f5a01df2c13904aff5dd29cd25a6d37e5107057f114423f431ce8c851569ffe65cf9445d6d90837d99d7f1af382f2ed3868805b9eeadb1c2824f686d

data/CHANGELOG.md

@@ -54,25 +54,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Not fixed despite upstream closes
 
 - **Iterparse attribute reads: all-nil runs on ubuntu-latest Ruby
-  3.4 CI legs** — filed upstream as leptris/leptris#1242
-  (leptris-ruby#279 tracks the investigation). Six strikes; the
-  last three were consecutive reruns of one job, suggesting
-  per-machine determinism. Unreproducible across ~75k local reads
-  on darwin/arm64 (native + FFI, GC.stress) and x86_64 linux
-  (qemu; native + FFI; threaded and not). The leg sets
-  `LEPTRIS_SKIP_1242=1` to quarantine exactly that one spec on
-  that one leg until the engine ships the fix; every other leg
-  keeps the full guard.
-
-- **#1220 reopened with the 1.9.203 repro**: HTML-document
-  mutations are still lost on serialization (the exact original
-  repro stands; node reads back mutated, serializer sees the old
-  tree). Tracking continues upstream.
-- **#1197 reopened with fresh 1.9.203 evidence**: the s390x qemu
-  leg failed 442/742 with the identical `malformed input`
-  signature at ASCII offsets; the reopen quotes the close
-  comment's own terms. (1.9.204's notes carry no BE fix; the leg
-  stays experimental until the engine ships one.)
+## [1.9.207.0] - 2026-09-19
+
+### Fixed — engine sync: big-endian close-tag parse (#1197 upstream)
+
+- Vendored libleptris 1.9.207: the close-tag fast-path compare
+  masked the wrong end of its 8-byte name load on big-endian hosts,
+  rejecting ordinary paired-tag documents with "malformed input"
+  (434/727 binding-suite failures under qemu s390x). The mask now
+  follows memory order per byte dialect; the s390x-linux-musl
+  platform gem becomes viable with this release.
+
+### Added — FFI mirror adopts the 1.9.202–1.9.207 engine surface
+
+- audit:symbols lockstep attachments: recover diagnostics
+  (leptris_document_parse_diag[_count]), the standalone DTD family
+  (leptris_dtd_*), declaration/doctype removal, engine-heap buffer
+  allocation, and one-shot SAX. leptris_set_error stays internal —
+  the engine now hides it on ELF too (leptris#1243), so the export
+  surface agrees across Linux/macOS/Windows.
 
 ## [1.9.201.3] - 2026-09-19
 

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.204"
+LIBLEPTRIS_VERSION = "1.9.208"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.204.0"
+  VERSION = "1.9.208.0"
 end

data/lib/leptris/xml/ffi.rb

@@ -137,6 +137,7 @@ module Leptris
       typedef :pointer, :leptris_iterparse
       typedef :pointer, :leptris_xpath_var_set
       typedef :pointer, :leptris_sax_parser
+      typedef :pointer, :leptris_dtd
       typedef :int, :leptris_status
 
       class SAXHandler < ::FFI::Struct
@@ -1156,6 +1157,33 @@ attach_function :leptris_parse_string,
         [:leptris_document, :pointer, :pointer], :leptris_status
       attach_function :leptris_status_string, [:leptris_status], :string
       attach_function :leptris_error_message, [:leptris_status], :string
+      # Engine surface adopted with libleptris 1.9.206 (the FFI
+      # mirror audit keeps attachments and exports in lockstep):
+      # recover diagnostics (#1200), the standalone DTD family
+      # (leptris_dtd_*), declaration/doctype removal (#1094), the
+      # engine-heap buffer (#1219), one-shot SAX (#1178), and the
+      # exported error-recorder entry point.
+      attach_function :leptris_alloc_buffer, [:size_t], :pointer
+      attach_function :leptris_document_clear_declaration,
+        [:leptris_document], :leptris_status
+      attach_function :leptris_document_remove_doctype,
+        [:leptris_document], :leptris_status
+      attach_function :leptris_document_parse_diag_count,
+        [:leptris_document], :size_t
+      attach_function :leptris_document_parse_diag,
+        [:leptris_document, :size_t, :pointer, :pointer, :size_t], :int
+      attach_function :leptris_dtd_parse,
+        [:string, :size_t], :leptris_dtd
+      attach_function :leptris_dtd_free, [:leptris_dtd], :void
+      attach_function :leptris_dtd_parse_external_subset,
+        [:leptris_dtd, :string, :size_t], :int
+      attach_function :leptris_dtd_set_pe_loader,
+        [:leptris_dtd, :pointer, :pointer], :void
+      attach_function :leptris_dtd_validate,
+        [:leptris_document, :leptris_dtd, :pointer], :int
+      attach_function :leptris_dtd_error_free, [:pointer], :void
+      attach_function :leptris_sax_parser_set_one_shot,
+        [:leptris_sax_parser, :int], :void
       # Thread-global last-failure position (error.h): companion to
       # leptris_last_error; populated by recover parses (#547).
       attach_function :leptris_last_error_position,

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,81 @@
 ## [Unreleased]
 
+## [1.9.208] - 2026-09-19
+
+### Fixed
+
+- Per-machine process-global corruption (#1242): the TLS (root, doc)
+  last-hit memo in `leptris_element_get_document` trusted the root
+  ADDRESS and was cleared only by document identity — an element-level
+  unregistration left `(freed_address, doc)` behind, and a
+  recycled address resolved the WRONG document (poisoning attribute
+  ownership: whole-run all-NULL `leptris_element_attribute` reads;
+  and tripping set_root's cross-document check). The memo is now
+  cleared whenever the outgoing root address matches, in both the
+  element-level unregister and the document sweep — closing the
+  same recycled-address class #1038 fixed for the root-doc map.
+- `leptris_document_set_root` now sets a fresh thread-local error on
+  every rejection (NULL_ARG + both EINVAL paths) — previously the
+  previous operation's message leaked through (the reported "EINVAL
+  with a stale XPath parse error").
+- New diagnostic: `LEPTRIS_DEBUG_ATTR_MISS=1` dumps attribute-chain
+  state on lookup misses (chain length, per-attr name bytes/hash15)
+  — the discriminator for any residual binding-side corruption
+  report.
+
+
+
+## [1.9.207] - 2026-09-19
+
+### Fixed
+
+- stop leptris_set_error leaking into the ELF dynamic table (build)
+
+
+
+## [1.9.206] - 2026-09-19
+
+### Fixed
+
+- endian-neutral close-tag name compare (#1197) (parse)
+
+### Performance
+
+- memchr finds the text span end (TODO.max-perf/2-3 slice 3) (sax)
+- zero-copy slice emission for one-shot pulls (#1178 tail) (sax)
+
+
+
+## [1.9.205] - 2026-09-19
+
+### Added
+
+- Parse recover diagnostics (#1200): the DOM parse now records
+  duplicate-attribute events on the document — `LeptrisDiagKind`
+  (with the new `LEPTRIS_DIAG_RECOVER` kind) is public in
+  types.h, and the diag list reads through
+  `leptris_document_parse_diag_count` /
+  `leptris_document_parse_diag` (error.h). First definition wins,
+  matching the SAX lane's libxml2-recover surface; the digest
+  gate no longer needs a SAX probe pass.
+- `LEPTRIS_DIGEST_ATTR_ORDER` (#1200 part 1): opt-in digest flag
+  that makes attribute order identity-bearing instead of sorted
+  away.
+
+### Fixed
+
+- MSVC C2027 in `leptris_internal.h`: the `LeptrisDiag` forward
+  declaration moved to file scope (broke the windows-dll-exports
+  leg).
+
+### Performance
+
+- First-char-bucketed tag classifier for the WHATWG HTML path:
+  the tokenizer's name-list strcmp scans become one-load bucket
+  lookups — parse +31-37% on the #1218 bench shapes.
+
+
+
 ## [1.9.204] - 2026-09-19
 
 ### Added

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.204
+    VERSION 1.9.208
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/TODO.max-perf/00-INDEX.md

@@ -5,12 +5,12 @@ RED bench first where perf claims are made.
 
 | # | Lever | Type | Effort | Status |
 |---|-------|------|--------|--------|
-| 3 | iterparse fixed-cost (6.9µs) + error channel (#563) | perf | bench landed #1195; remaining = zero-copy one-shot emission (design with lever 2) | half done |
+| 3 | iterparse fixed-cost (6.9µs) + error channel (#563) | perf | bench #1195; zero-copy emission landed #1236 (295->52us full-doc); remaining = iterparse per-event DOM construction (0.45->0.15us/event stretch) | mostly done |
 | 1 | SIMD/memchr HTML tokenizer scans | perf | memchr ×2 (#1176/#1190) + LUT (#1199, +30%/+51%) | DONE v1.9.199 |
 | 7 | leptris validate CLI + bindings | feature | engine half merged #1198 (--dtd + DTD engine fixes); bindings remain | half done |
-| 8 | native XML diff consumer surface | feature | small | next |
+| 8 | native XML diff consumer surface | feature | CLI diff text/JSON/--summary + engine API shipped | DONE (#1184 closed) |
 | 4 | compact-node micro-opts (non-layout) | perf | audited: TODOs 172/195/Lane18-P3 already in; residual = node-creation cost (node-layout fork, owner call) | parked on fork |
-| 2 | compiled-dispatch tokenizer | perf | medium; design together with lever 3's zero-copy emission | queued |
+| 2 | compiled-dispatch tokenizer | perf | slices 1+3 landed #1236; slice 2's class LUT + dense switch pre-existed; residual = iterparse consumer (row 3) | mostly done |
 | 5 | XSLT 2x per-bench profile rounds (#682) | perf | medium, ongoing | in progress |
 | 6 | language tails (QT3/dates/fn-items/lane 15) | correctness | medium-large | queued |
 | 9 | prebuilt-gem 12-platform matrix | release | small, BLOCKED on owner go | blocked |

data/vendor-src/libleptris/TODO.max-perf/2-3-oneshot-tokenizer-design.md

@@ -1,6 +1,12 @@
 # Levers 2+3 — compiled-dispatch + zero-copy one-shot emission (design)
 
-Status: DESIGNED (2026-09-19). Implementation slices below.
+Status: LANDED (2026-09-19, PR #1236). Slices 1+3 implemented;
+slice 2's class LUT (`sxs_chartype`) + dense state switch already
+existed. Measured: bench_iterparse full-doc 295->52-63us wall,
+15.9->74-91 MB/s, 2.54->0.45-0.55us/event. Residual to the 0.15
+stretch = iterparse per-event DOM construction (element create +
+namespace resolution through the public element API), a consumer
+lever, not string copies.
 Owners: engine repo. Bench: `benchmarks/sax/bench_iterparse.c` (#1195).
 
 ## Problem

data/vendor-src/libleptris/src/include/leptris/error.h

@@ -96,6 +96,62 @@ LEPTRIS_API void leptris_last_error_position(int* line, int* column);
  */
 LEPTRIS_API const char* leptris_document_last_error(LeptrisDocument doc);
 
+/* ============================================================================
+ * Parse diagnostics (#1200): recover-class events recorded on the
+ * DOM parse (duplicate attributes today) — the SAX lane's recover
+ * error list, unified engine-side so both lanes report the same
+ * surface. Documents stay usable; the diagnostics are advisory.
+ * ============================================================================ */
+
+#ifndef LEPTRIS_API
+#  ifdef _WIN32
+#    ifdef LEPTRIS_BUILD_SHARED
+#      define LEPTRIS_API __declspec(dllexport)
+#    elif defined(LEPTRIS_BUILDING_DLL)
+#      define LEPTRIS_API __declspec(dllexport)
+#    elif defined(LEPTRIS_USE_SHARED)
+#      define LEPTRIS_API __declspec(dllimport)
+#    else
+#      define LEPTRIS_API
+#    endif
+#  else
+#    if defined(__GNUC__) && !defined(__clang__)
+#      define LEPTRIS_API __attribute__((visibility("default"), used, \
+                                            externally_visible))
+#    else
+#      define LEPTRIS_API __attribute__((visibility("default"), used))
+#    endif
+#  endif
+#endif
+
+/**
+ * Number of recover-class diagnostics recorded during the
+ * document's parse.
+ *
+ * @param doc Document handle
+ * @return Diagnostic count (0 for NULL doc or a clean parse)
+ */
+LEPTRIS_API size_t leptris_document_parse_diag_count(LeptrisDocument doc);
+
+/**
+ * Read one parse diagnostic by index.
+ *
+ * @param doc Document handle
+ * @param index Diagnostic index (< leptris_document_parse_diag_count)
+ * @param kind Out: diagnostic kind (may be NULL)
+ * @param message Out: NUL-terminated message buffer (may be NULL)
+ * @param message_cap Capacity of message (ignored when message NULL)
+ * @return 1 on success; 0 for NULL doc or out-of-range index
+ *
+ * Memory: Message is copied into the caller's buffer; diagnostics
+ *         are owned by the document until leptris_document_free.
+ */
+LEPTRIS_API int leptris_document_parse_diag(LeptrisDocument doc,
+                                            size_t index,
+                                            LeptrisDiagKind* kind,
+                                            char* message,
+                                            size_t message_cap);
+
 #ifdef __cplusplus
 }
 #endif

data/vendor-src/libleptris/src/include/leptris/types.h

@@ -246,6 +246,28 @@ typedef enum {
     LEPTRIS_DIFF_IGNORE_WS_TEXT = 1u
 } LeptrisDiffFlags;
 
+/* Unified narration record kinds (#1126). One structured record
+ * per validation/recover event, shared by every validator (RNG
+ * today; XSD/Schematron follow) and the DOM parse's recover
+ * channel (#1200). The kind selects the reporting convention;
+ * append-only. */
+typedef enum {
+    LEPTRIS_DIAG_INVALID = 0,
+    LEPTRIS_DIAG_NOT_ALLOWED_ANYWHERE,   /* name never valid in model */
+    LEPTRIS_DIAG_NOT_ALLOWED_HERE,       /* valid name, wrong position */
+    LEPTRIS_DIAG_NOT_ALLOWED_YET,        /* later; missing required first */
+    LEPTRIS_DIAG_INCOMPLETE,             /* content ends before required */
+    LEPTRIS_DIAG_MISSING_REQUIRED_ATTR,
+    LEPTRIS_DIAG_ATTR_NOT_ALLOWED,
+    LEPTRIS_DIAG_ATTR_VALUE_INVALID,
+    LEPTRIS_DIAG_CHAR_CONTENT_INVALID,   /* data/value/list mismatch */
+    /* Recover-class parse event: the document is usable, the input
+     * was not conformant (duplicate attribute, ...). Not a model
+     * error; SAX-lane "recover" parity (#1200). */
+    LEPTRIS_DIAG_RECOVER,
+    LEPTRIS_DIAG_COUNT_
+} LeptrisDiagKind;
+
 /* Subtree digest flags (issue #869). The digest is content-defined
  * (no pointers/addresses — stable across processes); equality
  * implies subtree equivalence under the flag semantics. */
@@ -253,7 +275,13 @@ typedef enum {
     LEPTRIS_DIGEST_DEFAULT     = 0,
     /* Skip whitespace-only text nodes entirely (comparator's
      * strip-profile default). */
-    LEPTRIS_DIGEST_DROP_WS_TEXT = 1u
+    LEPTRIS_DIGEST_DROP_WS_TEXT = 1u,
+    /* Hash attributes in DOCUMENT order instead of the sorted
+     * canonical order — documents differing only in attribute
+     * order digest DIFFERENT under this flag (canon's verbose
+     * diff gate, #1200). Equality under this flag additionally
+     * implies attribute-order identity. */
+    LEPTRIS_DIGEST_ATTR_ORDER  = 2u
 } LeptrisDigestFlags;
 
 typedef struct {

data/vendor-src/libleptris/src/leptris/dom/diag.h

@@ -17,20 +17,9 @@
 extern "C" {
 #endif
 
-typedef enum {
-    LEPTRIS_DIAG_INVALID = 0,
-    LEPTRIS_DIAG_NOT_ALLOWED_ANYWHERE,   /* name never valid in model */
-    LEPTRIS_DIAG_NOT_ALLOWED_HERE,       /* valid name, wrong position */
-    LEPTRIS_DIAG_NOT_ALLOWED_YET,        /* later; missing required first */
-    LEPTRIS_DIAG_INCOMPLETE,             /* content ends before required */
-    LEPTRIS_DIAG_MISSING_REQUIRED_ATTR,
-    LEPTRIS_DIAG_ATTR_NOT_ALLOWED,
-    LEPTRIS_DIAG_ATTR_VALUE_INVALID,
-    LEPTRIS_DIAG_CHAR_CONTENT_INVALID,   /* data/value/list mismatch */
-    LEPTRIS_DIAG_COUNT_
-} LeptrisDiagKind;
+/* LeptrisDiagKind lives in leptris/types.h (public, #1200). */
 
-typedef struct {
+typedef struct LeptrisDiag {
     LeptrisDiagKind kind;
     char* offender_name;          /* captured at emit time (strdup'd);
                                    * NULL when the diag has no offender.

data/vendor-src/libleptris/src/leptris/dom/digest.c

@@ -181,7 +181,11 @@ static uint64_t digest_element(LeptrisElement e, LeptrisDigestFlags flags) {
                 attrs[n].value_len = leptris_attr_value_sv(a).length;
                 n++;
             }
-            qsort(attrs, n, sizeof(DigestAttr), digest_attr_cmp);
+            /* ATTR_ORDER (#1200): document order is canonical — the
+             * walk above already collected in document order, so
+             * skip the sort and attribute order feeds the hash. */
+            if (!(flags & LEPTRIS_DIGEST_ATTR_ORDER))
+                qsort(attrs, n, sizeof(DigestAttr), digest_attr_cmp);
         }
         h = digest_mix_u64(h, n);
         for (size_t i = 0; i < n; i++) {

data/vendor-src/libleptris/src/leptris/dom/element_query.c

@@ -178,7 +178,49 @@ LEPTRIS_API const char* leptris_element_attribute(LeptrisElement elem, const cha
         if (!uri) return NULL;                             /* (4) */
         attr = find_attr_expanded(elem, uri, colon + 1);   /* (2) */
     }
-    if (!attr) return NULL;
+    if (!attr) {
+        /* #1242 diagnostic: LEPTRIS_DEBUG_ATTR_MISS=1 dumps the
+         * element's attribute-chain state for the first 5 misses in
+         * the process — distinguishes construction loss
+         * (chain_len=0) from storage corruption (garbage name
+         * bytes) from hash-discipline drift (correct bytes,
+         * mismatching hash15). Off by default; fprintf only on
+         * miss. */
+        static int dumped = 0;
+        if (dumped < 5 && getenv("LEPTRIS_DEBUG_ATTR_MISS")) {
+            dumped++;
+            size_t chain = 0;
+            for (struct leptris_attribute* a =
+                     leptris_element_get_first_attribute(elem);
+                 a; a = leptris_attr_next(a))
+                chain++;
+            fprintf(stderr,
+                    "[leptris-attr-miss] elem=%p needle='%s' "
+                    "chain_len=%zu\n",
+                    (void*)elem, name, chain);
+            size_t i = 0;
+            for (struct leptris_attribute* a =
+                     leptris_element_get_first_attribute(elem);
+                 a && i < 8; a = leptris_attr_next(a), i++) {
+                char nb[17];
+                size_t nl = a->name_view.length < 16
+                                ? a->name_view.length : 16;
+                for (size_t k = 0; k < nl; k++) {
+                    unsigned char c = (unsigned char)a->name_view.data[k];
+                    nb[k] = (c >= 32 && c < 127) ? (char)c : '.';
+                }
+                nb[nl] = '\0';
+                fprintf(stderr,
+                        "  attr[%zu] addr=%p name_ptr=%p len=%zu "
+                        "bytes='%s' hash15=%u entities=%d\n",
+                        i, (void*)a, (void*)a->name_view.data,
+                        a->name_view.length, nb,
+                        (unsigned)(a->name_hash & 0x7FFFu),
+                        (int)((a->name_hash & 0x8000u) != 0));
+            }
+        }
+        return NULL;
+    }
 
     /* Single representation (round 4): entity values expand lazily
      * INTO the view (owned copy); no-entity views are already

data/vendor-src/libleptris/src/leptris/dom/root_doc_map.c

@@ -102,6 +102,15 @@ static size_t bucket_index(LeptrisElement root) {
     return (size_t)(v & (ROOT_DOC_BUCKETS - 1));
 }
 
+/* #682 2x lever (sound): last-hit (root, doc) memo. The climb to
+ * the root is unavoidable without a per-element field, but the TLS
+ * bucket-array walk is not — consecutive queries in a transform
+ * hit the same root, so one pointer compare replaces the hash
+ * bucket chain. One TLS access total (the memo pair), and the
+ * 1M-loop sentinel becomes a plain NULL check. */
+static LEPTRIS_THREAD_LOCAL LeptrisElement g_memo_root;
+static LEPTRIS_THREAD_LOCAL struct leptris_document* g_memo_doc;
+
 void leptris_root_doc_register(LeptrisElement root, struct leptris_document* doc) {
     if (!root || !doc) return;
     size_t idx = bucket_index(root);
@@ -160,6 +169,17 @@ void leptris_root_doc_drain_thread_caches(void) {
 void leptris_root_doc_unregister(LeptrisElement root) {
     if (!root) return;
     if (!rootmap_marked(root)) return;  /* never registered: O(1) out */
+    /* #1242: the (root, doc) memo trusts the root ADDRESS. An
+     * element-level unregister frees that address while the doc
+     * lives — the doc-keyed invalidation never fires, and the
+     * allocator recycling the address into another element's climb
+     * target made get_document return the WRONG document. Same
+     * exposure class #1038 closed for the map; the memo needs it
+     * at element granularity. */
+    if (g_memo_root == root) {
+        g_memo_root = NULL;
+        g_memo_doc = NULL;
+    }
     size_t idx = bucket_index(root);
     RootDocEntry** pp = &g_root_doc_buckets[idx];
     while (*pp) {
@@ -202,6 +222,13 @@ size_t leptris_root_doc_unregister_doc(struct leptris_document* doc) {
     doc->map_entries = NULL;
     while (e) {
         RootDocEntry* next = e->doc_next;
+        /* #1242: a swept root address must not survive in the memo
+         * even when the memo's doc differs (a previously poisoned
+         * pair). */
+        if (g_memo_root == e->root) {
+            g_memo_root = NULL;
+            g_memo_doc = NULL;
+        }
         size_t idx = bucket_index(e->root);
         RootDocEntry** pp = &g_root_doc_buckets[idx];
         while (*pp) {
@@ -234,15 +261,6 @@ struct leptris_document* leptris_root_doc_lookup(LeptrisElement root) {
  * are skipped entirely (get_document was 3.5% of the light bench).
  * Hint is thread-local-scoped by construction (one transform per
  * thread), validated by the root-walk fallback when it misses. */
-/* #682 2x lever (sound): last-hit (root, doc) memo. The climb to
- * the root is unavoidable without a per-element field, but the TLS
- * bucket-array walk is not — consecutive queries in a transform
- * hit the same root, so one pointer compare replaces the hash
- * bucket chain. One TLS access total (the memo pair), and the
- * 1M-loop sentinel becomes a plain NULL check. */
-static LEPTRIS_THREAD_LOCAL LeptrisElement g_memo_root;
-static LEPTRIS_THREAD_LOCAL struct leptris_document* g_memo_doc;
-
 /* #904: prime the TLS last-root memo from a driver that already
  * knows the (root, doc) pair — the iterparse yield path hands out
  * a subtree that is released before the next, so the memo misses
@@ -263,6 +281,10 @@ void leptris_root_doc_memo_invalidate(const struct leptris_document* doc) {
     }
 }
 
+LeptrisElement leptris_root_doc_memo_root_for_tests(void) {
+    return g_memo_root;
+}
+
 struct leptris_document* leptris_element_get_document(LeptrisElement elem) {
     if (!elem) return NULL;
     LeptrisElement cur = elem;

data/vendor-src/libleptris/src/leptris/dom/root_doc_map.h

@@ -15,6 +15,8 @@ void leptris_root_doc_register(LeptrisElement root, struct leptris_document* doc
 void leptris_root_doc_unregister(LeptrisElement root);
 struct leptris_document* leptris_root_doc_lookup(LeptrisElement root);
 void leptris_root_doc_memo_invalidate(const struct leptris_document* doc);
+/* Test hook (#1242): the memo's current root, or NULL. */
+LeptrisElement leptris_root_doc_memo_root_for_tests(void);
 /* #904: prime the TLS (root, doc) memo from a driver that knows
  * the pair (iterparse yields). Root must be registered. */
 void leptris_root_doc_memo_prime(LeptrisElement root,

data/vendor-src/libleptris/src/leptris/error.c

@@ -7,6 +7,7 @@
 #include "common/port.h"  /* LEPTRIS_THREAD_LOCAL (TODO.concurrency/01) */
 #include <stdio.h>
 #include <string.h>
+#include "dom/diag.h"   /* LeptrisDiag layout (#1200) */
 
 /* Error state — THREAD-LOCAL since TODO.concurrency/01: concurrent
  * parses (one document per thread) no longer race the channel. The
@@ -131,4 +132,25 @@ LEPTRIS_API const char* leptris_status_string(LeptrisStatus status) {
         case LEPTRIS_ERROR_IO:        return "I/O error";
         default:                     return "Unknown error";
     }
+}
+
+/* ---- #1200: recover-class parse diagnostics ------------------- */
+
+LEPTRIS_API size_t leptris_document_parse_diag_count(LeptrisDocument doc) {
+    return doc ? (size_t)doc->parse_diag_count : 0;
+}
+
+LEPTRIS_API int leptris_document_parse_diag(LeptrisDocument doc,
+                                            size_t index,
+                                            LeptrisDiagKind* kind,
+                                            char* message,
+                                            size_t message_cap) {
+    if (!doc || index >= (size_t)doc->parse_diag_count) return 0;
+    struct LeptrisDiag* d = (struct LeptrisDiag*)doc->parse_diags + index;
+    if (kind) *kind = d->kind;
+    if (message && message_cap) {
+        strncpy(message, d->message, message_cap - 1);
+        message[message_cap - 1] = '\0';
+    }
+    return 1;
 }

data/vendor-src/libleptris/src/leptris/flat/direct_parse.c

@@ -437,7 +437,47 @@ static inline int dp_add_attr_inline(DParser* p, LeptrisElement elem,
      * Careful: first_attribute_off == 0 means empty list. We can't decode
      * the pointer and check for NULL — at offset 0 the decoded pointer
      * is `elem` itself, which is non-NULL. Check the offset field. */
+    /* #1200: duplicate-attribute detection. Prefilter on (len,
+     * first byte) — a mismatching pair costs two loads; the memcmp
+     * only runs on genuine candidates. First definition wins
+     * (libxml2 recover semantics, and the digest's first-wins
+     * becomes official); the duplicate never enters the chain, it
+     * costs its already-carved slot. */
     if (elem->first_attribute_off != 0) {
+        int dup = 0;
+        for (struct leptris_attribute* a =
+                 (struct leptris_attribute*)((char*)elem +
+                                             elem->first_attribute_off);
+             a; a = leptris_attr_next(a)) {
+            if (a->name_view.length == attr->name_view.length &&
+                a->name_view.data[0] == attr->name_view.data[0] &&
+                memcmp(a->name_view.data, attr->name_view.data,
+                       attr->name_view.length) == 0) {
+                dup = 1;
+                break;
+            }
+        }
+        if (dup) {
+            if (p->doc) {
+                extern struct LeptrisDiag* leptris_diag_emit(
+                    struct LeptrisDiag**, int*, int*,
+                    LeptrisDiagKind, LeptrisNodeRef,
+                    const char*, ...);
+                char qname[130];
+                size_t ql = attr->name_view.length < 129
+                                ? attr->name_view.length : 129;
+                memcpy(qname, attr->name_view.data, ql);
+                qname[ql] = '\0';
+                leptris_diag_emit(&p->doc->parse_diags,
+                                  &p->doc->parse_diag_count,
+                                  &p->doc->parse_diag_cap,
+                                  LEPTRIS_DIAG_RECOVER, NULL,
+                                  "Attribute %s redefined", qname);
+            }
+            /* 1 = duplicate skipped (keep first): the caller skips
+             * the raw-attr registration so BOTH surfaces agree. */
+            return 1;
+        }
         /* Cache should always be valid mid-parse. Fall back to walk
          * only if cache is NULL (defensive — shouldn't happen). */
         struct leptris_attribute* tail = p->current_elem_last_attr;
@@ -845,13 +885,16 @@ static int dp_parse_attrs(DParser* p, LeptrisElement elem) {
             continue;
         }
 
-        /* Regular attribute — zero-copy name/value, bulk-allocated struct. */
-        if (dp_add_attr_inline(p, elem, name_start, name_len,
-                                val_start, val_len, has_amp, has_ws,
-                                attr_colon) != 0)
+        /* Regular attribute — zero-copy name/value, bulk-allocated
+         * struct. 1 = duplicate skipped: neither surface sees it. */
+        int arc = dp_add_attr_inline(p, elem, name_start, name_len,
+                                     val_start, val_len, has_amp,
+                                     has_ws, attr_colon);
+        if (arc < 0) return -1;
+        if (arc == 0 &&
+            dp_raw_attr(p, elem, name_start, name_len,
+                        val_start, val_len) != 0)
             return -1;
-        if (dp_raw_attr(p, elem, name_start, name_len,
-                        val_start, val_len) != 0) return -1;
     }
     /* for (;;): every exit is a return inside the loop (0 = tag
      * closed, 1 = self-closing, -1 = error) — there is no
@@ -1571,9 +1614,21 @@ static struct leptris_document* direct_parse_internal(char* buf, size_t len,
             if (close_local_len <= 8 &&
                 (p.probe_slack ||
                  close_local + 8 <= p.end + 1)) {
+                /* The mask follows MEMORY order: memcpy fills the low
+                 * bytes on little-endian and the high bytes on
+                 * big-endian, so each dialect must mask the end its
+                 * load populated. The unconditional low-bytes mask
+                 * compared bytes past the name on big-endian and
+                 * failed every close tag (#1197). */
+#if defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+                uint64_t mask = (close_local_len == 8)
+                    ? ~(uint64_t)0
+                    : (~(uint64_t)0 << (64 - close_local_len * 8));
+#else
                 uint64_t mask = (close_local_len == 8)
                     ? ~(uint64_t)0
                     : ((1ull << (close_local_len * 8)) - 1);
+#endif
                 uint64_t a, b;
                 memcpy(&a, open_name, 8);
                 memcpy(&b, close_local, 8);