leptris 1.9.226.0 → 1.9.229.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91fcb464484e2d21d1636be2ea5a90c9271519f6af65a41a3329c590ca220bb0
-  data.tar.gz: 1b11c8f6ea582bdb6c9be3cdb688f59ff53ad96c35cf782db81c856da3259fea
+  metadata.gz: 7f13ce441b0f9543d4a9f3d12ef01e802eb0883e3a9a3d11fe31bc91ac73509d
+  data.tar.gz: b78b9d374a05196a4f4c33f41b301f7ea1f9b9dec1c540495b3a19b556a25dbc
 SHA512:
-  metadata.gz: b690240b654c96bba424f13372c2009a4106ca2b35889f143853b83056fbb9cf0245ca474d69d1b4cd95c9b6c646dd0f72202b444ba6184124c068046e156764
-  data.tar.gz: c4dab6ff7ba03ebe4a4730af6fe29fb053eca3b9554c4bfb29ed7235fc3a562d9030bed648fdc29228557552a9b32c2242d78f509524b7217565772781f57173
+  metadata.gz: eb8ff7b63f6e9cccd7a3489d3d46a69272df6909f7f807d001f19474a2e9dacfabdf9d70a60cf6feb4c47b39f53b3372233a9d5459e804f771c2f9516ce164f2
+  data.tar.gz: d42e6b9c9332f668b5d0b25909667e3bfa4860d6c88f07cff041ddd7287e980d97b755935210bad6653af251f7e8efd69903d50d9f85ae798fddd5cebeb389c6

data/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to Leptris will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.229.0] - 2026-09-23
+
+### Performance — engine sync (1.9.229)
+
+- Vendored libleptris 1.9.229: the text node struct shrinks
+  40 → 32 bytes on LP64 and ILP32 alike (#1285 slice 4b) — the
+  content pointer became an int32 self-relative offset with
+  doc-tagged overflow stamps (0 = NULL, shared sentinel for the
+  static empty string, byte offset otherwise; >2 GB deltas spill
+  to the overflow table tagged EXPLICIT). No binding-facing
+  surface changes; audit 351/351, suite 781/0.
+
+## [1.9.228.0] - 2026-09-23
+
+### Fixed — Text#content= on created-but-unattached text nodes (#318; engine 1.9.227–228)
+
+- **The #318 regression is fixed at the engine root**: engine
+  1.9.228 (upstream leptris#1320) gives detached text nodes the
+  same #519 owner treatment PI/comment/CDATA already had — an
+  owner backref stamped by `leptris_text_node_create` (compact
+  int32 offset, LP64 layout preserved) — so
+  `leptris_text_node_set_content` works before attach again.
+  The create → fill → attach builder sequence moxml's
+  `Text#content=` depends on is unblocked; verified against the
+  vendored 1.9.228 (the #318 repro passes; suite 778 → 781/0).
+- 1.9.227 rides along (header-hygiene spec zeroing).
+
 ## [1.9.226.0] - 2026-09-23
 
 ### Performance — engine sync (1.9.226)

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.226"
+LIBLEPTRIS_VERSION = "1.9.229"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.226.0"
+  VERSION = "1.9.229.0"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.226
+- libleptris v1.9.229
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,94 @@
 ## [Unreleased]
 
+## [1.9.229] - 2026-09-23
+
+### Performance
+
+- **dom: text node 40 → 32 bytes — content pointer became an int32
+  self-relative offset, with doc-tagged overflow stamps (#1285
+  slice 4b).** The struct is base + five int32s on both LP64 and
+  ILP32 (content off, uint32 len, int32 next, int32 parent, int32
+  owner doc). Encoding: 0 = NULL, a shared sentinel = the static
+  empty string (xsl:strip-space writes land there instead of one
+  overflow-table entry per stripped node), any other value a byte
+  offset from the node. **Thread safety:** the rare >2 GB delta
+  spills to the overflow table tagged with the EXPLICIT owning
+  document — the direct-parse lane is overflow-table-free by design
+  (it never sets the TLS current-doc), so a TLS-tagged spill leaked
+  the entry past document teardown, which Linux CI ASAN/LSan
+  surfaced as aborting the two concurrency tests. Every content
+  stamp now carries its document; the untagged setter is deleted
+  from the codebase. Local gates: 1683/1683 both parse lanes; the
+  CI ASAN leg that caught the leak is green.
+
+
+
+## [1.9.228] - 2026-09-23
+
+### Fixed
+
+- **dom: `leptris_text_node_set_content` works again on
+  created-but-unattached text nodes (#1320).** The 1.9.223–1.9.226
+  window returned `LEPTRIS_ERROR_INVALID_ARG` for exactly the
+  create → fill → attach builder sequence bindings use (moxml's
+  `Text#content=` failed 5 shared examples). Root cause: issue #519
+  gave detached PI/comment/CDATA nodes an `owner_doc` field but
+  skipped text — at the time text nodes carried their own pool
+  backref, which #1285 slice 4 then deleted, leaving detached text
+  with no document to allocate from. Text now gets the same #519
+  treatment: an owner backref stamped by the public creator only,
+  stored as a compact int32 offset (the LP64 struct keeps its 40
+  bytes — the field lands in existing padding; ILP32 32), with
+  overflow-table fallback tagged with the EXPLICIT document (the
+  parse-context TLS slot holds the wrong doc or NULL outside parse).
+  Every parse-carve path zero-initializes the field; the
+  attached/parsed parent-walk fast path is untouched. TDD'd
+  red-first against the reported minimal repro;
+  `DetachedNodes.TextSetContentWorksBeforeAttach` pins the
+  unattached, attach-then-set, and parsed paths.
+
+
+
+## [1.9.227] - 2026-09-23
+
+### Fixed
+
+- **test:** the header-hygiene compact-pointer edge specs zero their
+  fake stack-allocated nodes before use. The `last_child` and
+  `last_attribute` getters *walk* the sibling/attribute list, so the
+  uninitialized fake node's next-edge was read as stack garbage —
+  zero on arm64, nonzero on x86_64, where the slice-3b layout shift
+  surfaced the latent UB as a real CI failure. It was always UB.
+
+### Performance
+
+- **dom: binding_wrapper out of the node base — element 48B, text
+  40B, every node type −8B (#1285 slice 3b).** `LeptrisNode` itself
+  drops 24 → 12 bytes; the element struct reaches the lane's stated
+  goal of 48 bytes. The `binding_wrapper` field (#262) was never
+  adopted — zero callers in leptris-ruby and leptris-py (both cache
+  wrappers on their own side), making it pure dead weight at 8 bytes
+  per node per document, and it carried the #421 stale-pointer bug
+  class, which the removal structurally eliminates. The public
+  `leptris_node_get/set_binding_wrapper` API is unchanged and now
+  serves from a lazily-allocated open-addressed map owned by the
+  document: documents that never wrap (all of them today) allocate
+  nothing, and entries cannot outlive their nodes because the map
+  dies with the document.
+- **parse: interleaved lane size floor — small docs defer to classic
+  (#1258).** The two-phase scan+replay lane pays a fixed setup cost
+  that small documents cannot amortize: canon's gate measured ~25%
+  slower on a 24KB readonly shape while large documents run 0.69–0.74×
+  (256KB–3.4MB). `dp_il_try` now defers to the classic parser below a
+  64KB floor (the midpoint between the measured loss and the wins);
+  `LEPTRIS_IL_MIN` overrides it in bytes, with explicit `0` disabling
+  the floor. Coverage is preserved, not narrowed: the parity suite
+  pins `LEPTRIS_IL_MIN=1` in every lane toggle, the lane-forced CI leg
+  sets it to `0` so the full suite still exercises the lane, and a new
+  spec pins the deferral itself.
+
+
+
 ## [1.9.226] - 2026-09-22
 
 ### Performance

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.226
+    VERSION 1.9.229
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/src/leptris/dom/cdata.c

@@ -23,8 +23,7 @@ LeptrisCDATANode* leptris_cdata_create(const char* content,
     node->base.type = LEPTRIS_NODE_TYPE_CDATA;
     node->base.frozen = 0;
     node->base.version = 0;
-      node->base.binding_wrapper = NULL;
-    node->parent_off = 0;
+      node->parent_off = 0;
     node->next_sibling_off = 0;
 
     if (content && content_len > 0) {

data/vendor-src/libleptris/src/leptris/dom/comment.c

@@ -24,7 +24,6 @@ LeptrisCommentNode* leptris_comment_create(const char* content,
     node->base.type = LEPTRIS_NODE_TYPE_COMMENT;
     node->base.frozen = 0;
     node->base.version = 0;
-      node->base.binding_wrapper = NULL;
     node->parent_off = 0;
     node->next_sibling_off = 0;
 

data/vendor-src/libleptris/src/leptris/dom/compact.c

@@ -286,7 +286,9 @@ int32_t leptris_compact_int32_encode(void* base, void* target,
                                      const int32_t* field_addr) {
     if (!target) return 0;
     ptrdiff_t d = (char*)target - (char*)base;
-    if (d < INT32_MIN || d > INT32_MAX) {
+    /* INT32_MAX is the EMPTY sentinel (compact.h) — spill exact
+     * deltas there too so raw offsets never collide with it. */
+    if (d < INT32_MIN || d >= INT32_MAX) {
         LeptrisCompactOverflowTable* table = get_overflow_table();
         struct leptris_document* doc = get_current_document();
         if (table && leptris_compact_overflow_set(table, field_addr,
@@ -298,6 +300,22 @@ int32_t leptris_compact_int32_encode(void* base, void* target,
     return (int32_t)d;
 }
 
+int32_t leptris_compact_int32_encode_doc(void* base, void* target,
+                                         const int32_t* field_addr,
+                                         struct leptris_document* doc) {
+    if (!target) return 0;
+    ptrdiff_t d = (char*)target - (char*)base;
+    if (d < INT32_MIN || d > INT32_MAX) {
+        LeptrisCompactOverflowTable* table = get_overflow_table();
+        if (table && leptris_compact_overflow_set(table, field_addr,
+                                                  target, doc) == 0) {
+            return LEPTRIS_INT32_OVERFLOW_SENTINEL;
+        }
+        return 0;
+    }
+    return (int32_t)d;
+}
+
 void* leptris_compact_int32_decode(void* base, int32_t off,
                                    const int32_t* field_addr) {
     if (off == 0) return NULL;

data/vendor-src/libleptris/src/leptris/dom/compact.h

@@ -109,6 +109,15 @@ int32_t leptris_compact_int32_encode(void* base, void* target,
                                      const int32_t* field_addr);
 void*   leptris_compact_int32_decode(void* base, int32_t off,
                                      const int32_t* field_addr);
+/* #1320: same encoding, but the overflow-table entry is tagged with
+ * the caller's explicit document instead of the thread-local
+ * "current document" — for stamps made OUTSIDE a parse context
+ * (public node creators), where the TLS slot holds the wrong doc or
+ * NULL and a mis-tagged entry would outlive its document. */
+struct leptris_document;
+int32_t leptris_compact_int32_encode_doc(void* base, void* target,
+                                         const int32_t* field_addr,
+                                         struct leptris_document* doc);
 #ifdef __cplusplus
 }
 #endif
@@ -118,6 +127,15 @@ void*   leptris_compact_int32_decode(void* base, int32_t off,
  * value is INT32_MIN). */
 #define LEPTRIS_INT32_OVERFLOW_SENTINEL_H ((int32_t)(-2147483647 - 1))
 
+/* int32 sentinel for a non-NULL static "" pointer (#1285 slice 4b).
+ * Text content can be set to the empty string from far-away
+ * read-only storage (xsl:strip-space field writes); encoding that
+ * address would register one overflow-table entry per stripped
+ * node. Decoding returns a shared "" instead. Collision-free: the
+ * encode fast path below spills exact-INT32_MAX deltas to the
+ * overflow table, so no raw offset ever equals this value. */
+#define LEPTRIS_COMPACT_INT32_EMPTY ((int32_t)2147483647)
+
 /* Inline fast paths (lane 18): the shared encode/decode live in
  * compact.c, so every tree-edge store or sibling/parent read paid an
  * out-of-line call — two per node in the parse loop and one per edge
@@ -131,7 +149,10 @@ static inline int32_t leptris_compact_int32_encode_inline(
     void* base, void* target, const int32_t* field_addr) {
     if (!target) return 0;
     ptrdiff_t d = (char*)target - (char*)base;
-    if (d < INT32_MIN || d > INT32_MAX)
+    /* INT32_MAX is the EMPTY sentinel — a real delta of exactly
+     * that size spills to the overflow table (correct, just not
+     * inline). */
+    if (d < INT32_MIN || d >= INT32_MAX)
         return leptris_compact_int32_encode(base, target, field_addr);
     return (int32_t)d;
 }

data/vendor-src/libleptris/src/leptris/dom/element.h

@@ -683,17 +683,16 @@ static inline struct leptris_namespace** leptris_elem_namespaces_ptr(
  * pinned structs hold only pointers and int-sized scalars, so i686
  * and armv7 produce identical layouts. */
 #if SIZE_MAX == UINT64_MAX
-LEPTRIS_STATIC_ASSERT(sizeof(struct leptris_element) == 64,
-    "#1285 slice 3a: ns_cache_off + offsets side table -> 64 bytes");
+LEPTRIS_STATIC_ASSERT(sizeof(struct leptris_element) == 48,
+    "#1285 slice 3b: binding_wrapper out of the base -> 48 bytes");
 
 LEPTRIS_STATIC_ASSERT(sizeof(struct leptris_attribute) == 40,
     "round 19 attr layout: 16+16+4+2+2 = 40");
 #else
-/* ILP32: LeptrisNode 24->16 (binding_wrapper), element name +
- * ns_cache pointers 8->4 each -> 56; attribute name_view 16->8
- * (value union stays 16 via inline_value[16]) -> 32. */
-LEPTRIS_STATIC_ASSERT(sizeof(struct leptris_element) == 48,
-    "#1285 slice 3a ILP32: 48 bytes");
+/* ILP32: LeptrisNode 16->12 (#1285 slice 3b); attribute
+ * name_view 16->8 (value union stays 16 via inline_value[16]). */
+LEPTRIS_STATIC_ASSERT(sizeof(struct leptris_element) == 44,
+    "#1285 slice 3b ILP32: base 12 + 8 + 6*4 + ptr 4 = 44 bytes");
 
 LEPTRIS_STATIC_ASSERT(sizeof(struct leptris_attribute) == 32,
     "leptris_attribute ILP32 layout: 8+16+4+2+2 = 32");

data/vendor-src/libleptris/src/leptris/dom/element_modify.c

@@ -677,7 +677,8 @@ LeptrisStatus leptris_element_set_text(LeptrisElement elem, const char* text) {
     if (text) {
         /* Create new text node (even if empty to match pugixml behavior) */
         LeptrisMemoryPool* pool = leptris_element_get_pool(elem);
-        LeptrisTextNode* text_node = leptris_text_create(text, strlen(text), pool);
+        LeptrisTextNode* text_node = leptris_text_create(text, strlen(text), pool,
+            leptris_element_get_document(elem));
         if (!text_node) {
             return LEPTRIS_ERROR_MEMORY;
         }
@@ -1341,9 +1342,10 @@ LeptrisElement leptris_element_append_copy(LeptrisElement parent, LeptrisElement
             LeptrisTextNode* text = (LeptrisTextNode*)child;
             /* SAFETY: Verify text pointer is valid before accessing content */
             if ((uintptr_t)text > 0x1000) {
-                LeptrisTextNode* text_copy = leptris_text_create(text->content,
+                LeptrisTextNode* text_copy = leptris_text_create(leptris_textnode_content(text),
                     text->content_len,
-                    leptris_element_get_pool(copy));
+                    leptris_element_get_pool(copy),
+                    leptris_element_get_document(copy));
                 if (text_copy) {
                     leptris_element_append_child_internal(copy, (LeptrisNode*)text_copy);
                 }
@@ -1507,9 +1509,10 @@ LeptrisElement leptris_element_prepend_copy(LeptrisElement parent, LeptrisElemen
             leptris_element_append_copy(copy, child);
         } else if (child_node->type == LEPTRIS_NODE_TYPE_TEXT) {
             LeptrisTextNode* text = (LeptrisTextNode*)child;
-            LeptrisTextNode* text_copy = leptris_text_create(text->content,
+            LeptrisTextNode* text_copy = leptris_text_create(leptris_textnode_content(text),
                 text->content_len,
-                leptris_element_get_pool(copy));
+                leptris_element_get_pool(copy),
+                leptris_element_get_document(copy));
             if (text_copy) {
                 leptris_element_append_child_internal(copy, (LeptrisNode*)text_copy);
             }
@@ -1622,9 +1625,10 @@ LeptrisElement leptris_element_insert_copy_after(LeptrisElement sibling, Leptris
             leptris_element_append_copy(copy, child);
         } else if (child_node->type == LEPTRIS_NODE_TYPE_TEXT) {
             LeptrisTextNode* text = (LeptrisTextNode*)child;
-            LeptrisTextNode* text_copy = leptris_text_create(text->content,
+            LeptrisTextNode* text_copy = leptris_text_create(leptris_textnode_content(text),
                 text->content_len,
-                leptris_element_get_pool(copy));
+                leptris_element_get_pool(copy),
+                leptris_element_get_document(copy));
             if (text_copy) {
                 leptris_element_append_child_internal(copy, (LeptrisNode*)text_copy);
             }
@@ -1737,9 +1741,10 @@ LeptrisElement leptris_element_insert_copy_before(LeptrisElement sibling, Leptri
             leptris_element_append_copy(copy, child);
         } else if (child_node->type == LEPTRIS_NODE_TYPE_TEXT) {
             LeptrisTextNode* text = (LeptrisTextNode*)child;
-            LeptrisTextNode* text_copy = leptris_text_create(text->content,
+            LeptrisTextNode* text_copy = leptris_text_create(leptris_textnode_content(text),
                 text->content_len,
-                leptris_element_get_pool(copy));
+                leptris_element_get_pool(copy),
+                leptris_element_get_document(copy));
             if (text_copy) {
                 leptris_element_append_child_internal(copy, (LeptrisNode*)text_copy);
             }
@@ -1925,9 +1930,10 @@ static LeptrisElement leptris_element_copy_subtree_bulk_internal(
         } else if (child_node->type == LEPTRIS_NODE_TYPE_TEXT) {
             /* Copy text node (not bulk-allocated) */
             LeptrisTextNode* text = (LeptrisTextNode*)child;
-            LeptrisTextNode* text_copy = leptris_text_create(text->content,
+            LeptrisTextNode* text_copy = leptris_text_create(leptris_textnode_content(text),
                 text->content_len,
-                leptris_element_get_pool(copy));
+                leptris_element_get_pool(copy),
+                leptris_element_get_document(copy));
             if (text_copy) {
                 /* Link as child using internal function */
                 leptris_element_append_child_internal(copy, (LeptrisNode*)text_copy);
@@ -2066,8 +2072,8 @@ static LeptrisElement copy_subtree_detached(LeptrisElement source,
                                                        copy, pool, doc);
         } else if (ty == LEPTRIS_NODE_TYPE_TEXT) {
             LeptrisTextNode* t = (LeptrisTextNode*)c;
-            cc = (LeptrisNodeRef)leptris_text_create(t->content,
-                                                     t->content_len, pool);
+            cc = (LeptrisNodeRef)leptris_text_create(leptris_textnode_content(t),
+                                                     t->content_len, pool, doc);
             if (cc) leptris_textnode_set_parent((LeptrisTextNode*)cc, copy);
         } else if (ty == LEPTRIS_NODE_TYPE_CDATA) {
             LeptrisCDATANode* cd = (LeptrisCDATANode*)c;

data/vendor-src/libleptris/src/leptris/dom/entity_ref.c

@@ -24,7 +24,6 @@ LeptrisEntityRefNode* leptris_entity_ref_create(const char* name,
     node->base.type = LEPTRIS_NODE_TYPE_ENTITY_REF;
     node->base.frozen = 0;
     node->base.version = 0;
-    node->base.binding_wrapper = NULL;
     node->parent_off = 0;
     node->next_sibling_off = 0;
     node->owner_doc = NULL;

data/vendor-src/libleptris/src/leptris/dom/node.h

@@ -57,11 +57,9 @@ typedef struct leptris_node {
                                         * parse-time bulk strides hold. */
     unsigned int version : 30;         /* COW 2.2: Node version for tracking modifications */
     uint32_t line;                     /* Source line (1-based, 0 = unknown). Issue #223 */
-    void* binding_wrapper;             /* FFI wrapper cache (#262). NULL when no binding
-                                        * is attached. Set by the language binding on
-                                        * first node wrap; subsequent traversals find
-                                        * the cached wrapper without FFI call overhead. */
-    /* NOTE: Parent/sibling pointers stored in compressed form in specific node types */
+    /* NOTE: Parent/sibling pointers stored in compressed form in specific node types.
+     * #1285 slice 3b: binding_wrapper (#262) moved to the document-
+     * owned wrapper map — see leptris_internal.h; base is 12 bytes. */
 } LeptrisNode;
 
 /* ============================================================================

data/vendor-src/libleptris/src/leptris/dom/node_public.c

@@ -296,8 +296,13 @@ static LeptrisDocument node_public_document(LeptrisNodeRef node) {
     LeptrisElement parent = leptris_node_parent(node);
     if (parent) return leptris_element_get_document(parent);
     /* Issue #519: detached non-element nodes carry their owning
-     * document — mutations must work before any attach. */
+     * document — mutations must work before any attach. Text was the
+     * one kind #519 skipped (its pool backref covered it until #1285
+     * slice 4 removed it — the #1320 regression); its stamp is an
+     * int32 offset instead of a field. */
     switch (node->type) {
+        case LEPTRIS_NODE_TYPE_TEXT:
+            return leptris_textnode_owner_doc((const LeptrisTextNode*)node);
         case LEPTRIS_NODE_TYPE_PI:
             return ((LeptrisPINode*)node)->owner_doc;
         case LEPTRIS_NODE_TYPE_COMMENT:
@@ -328,7 +333,14 @@ LEPTRIS_API LeptrisNodeRef leptris_text_node_create(LeptrisDocument doc,
     if (!doc->pool) return NULL;
     if (!content) content = "";
     size_t len = strlen(content);
-    LeptrisTextNode* n = leptris_text_create(content, len, doc->pool);
+    LeptrisTextNode* n = leptris_text_create(content, len, doc->pool, doc);
+    if (n) {
+        /* #1320: stamp the owner so detached mutations can reach the
+         * doc's pool (PI/comment/CDATA do this via owner_doc fields;
+         * explicit-doc encoder — no parse context here). */
+        n->owner_doc_off = leptris_compact_int32_encode_doc(
+            n, doc, &n->owner_doc_off, doc);
+    }
     return n ? (LeptrisNodeRef)n : NULL;
 }
 
@@ -404,7 +416,7 @@ LEPTRIS_API LeptrisStatus leptris_text_node_set_content(LeptrisNodeRef node,
     if (!doc || !doc->pool) return LEPTRIS_ERROR_INVALID_ARG;
     char* copy = node_public_pool_strdup(doc->pool, content, len);
     if (!copy) return LEPTRIS_ERROR_MEMORY;
-    t->content = copy;
+    leptris_textnode_set_content_ptr_doc(t, copy, doc);
     t->content_len = (uint32_t)len;
     return LEPTRIS_OK;
 }
@@ -688,12 +700,71 @@ LEPTRIS_API void leptris_node_source_position(LeptrisNodeRef node,
     }
 }
 
+/* #1285 slice 3b: binding_wrapper storage moved out of LeptrisNode
+ * (both bindings have zero callers — they cache wrappers on their
+ * own side — and the in-node field carried the #421 stale-pointer
+ * bug class on recycled arena pages). Open-addressed map keyed by
+ * node pointer, lazily allocated per document, freed with it: map
+ * entries can never outlive their nodes, and documents that never
+ * wrap (all of them today) pay nothing. NULL before any set — the
+ * parse-NULL contract holds by construction. */
+struct leptris_wrapper_entry {
+    LeptrisNodeRef node;   /* 0 = empty slot */
+    void* wrapper;
+};
+
+static size_t wrapper_hash(LeptrisNodeRef n, size_t cap) {
+    uintptr_t k = (uintptr_t)n;
+    return ((size_t)((k * 0x9E3779B97F4A7C15ULL) >> 32)) & (cap - 1);
+}
+
+static int wrapper_grow(struct leptris_document* doc) {
+    size_t ncap = doc->wrapper_cap ? doc->wrapper_cap * 2 : 16;
+    struct leptris_wrapper_entry* nt = (struct leptris_wrapper_entry*)
+        calloc(ncap, sizeof(*nt));
+    if (!nt) return -1;
+    for (size_t i = 0; i < doc->wrapper_cap; i++) {
+        struct leptris_wrapper_entry* e = &doc->wrapper_map[i];
+        if (e->node) {
+            size_t j = wrapper_hash(e->node, ncap);
+            while (nt[j].node) j = (j + 1) & (ncap - 1);
+            nt[j] = *e;
+        }
+    }
+    free(doc->wrapper_map);
+    doc->wrapper_map = nt;
+    doc->wrapper_cap = ncap;
+    return 0;
+}
+
 LEPTRIS_API void* leptris_node_get_binding_wrapper(LeptrisNodeRef node) {
-    return node ? node->binding_wrapper : NULL;
+    if (!node) return NULL;
+    struct leptris_document* doc = node_public_document(node);
+    if (!doc || !doc->wrapper_map) return NULL;
+    size_t i = wrapper_hash(node, doc->wrapper_cap);
+    while (doc->wrapper_map[i].node) {
+        if (doc->wrapper_map[i].node == node)
+            return doc->wrapper_map[i].wrapper;
+        i = (i + 1) & (doc->wrapper_cap - 1);
+    }
+    return NULL;
 }
 
 LEPTRIS_API void leptris_node_set_binding_wrapper(LeptrisNodeRef node, void* wrapper) {
-    if (node) node->binding_wrapper = wrapper;
+    if (!node) return;
+    struct leptris_document* doc = node_public_document(node);
+    if (!doc) return;   /* detached, unregistered node: no carrier */
+    if (doc->wrapper_count * 2 + 2 >= doc->wrapper_cap) {
+        if (wrapper_grow(doc) != 0) return;
+    }
+    size_t i = wrapper_hash(node, doc->wrapper_cap);
+    while (doc->wrapper_map[i].node && doc->wrapper_map[i].node != node)
+        i = (i + 1) & (doc->wrapper_cap - 1);
+    if (!doc->wrapper_map[i].node) {
+        doc->wrapper_map[i].node = node;
+        doc->wrapper_count++;
+    }
+    doc->wrapper_map[i].wrapper = wrapper;
 }
 
 LEPTRIS_API int leptris_node_compare(LeptrisNodeRef a, LeptrisNodeRef b) {

data/vendor-src/libleptris/src/leptris/dom/pi.c

@@ -46,7 +46,6 @@ LeptrisPINode* leptris_pi_create(const char* target,
     node->base.type = LEPTRIS_NODE_TYPE_PI;
     node->base.frozen = 0;
     node->base.version = 0;
-      node->base.binding_wrapper = NULL;
     node->parent_off = 0;
     node->next_sibling_off = 0;
     node->target = target_storage;

data/vendor-src/libleptris/src/leptris/dom/text.c

@@ -18,7 +18,8 @@
  * CRITICAL: Content is NEVER trimmed — preserved exactly as given. */
 LeptrisTextNode* leptris_text_create(const char* content,
                                     size_t content_len,
-                                    LeptrisMemoryPool* pool) {
+                                    LeptrisMemoryPool* pool,
+                                    struct leptris_document* doc) {
     if (!pool) return NULL;
 
     char* content_storage;
@@ -30,18 +31,18 @@ LeptrisTextNode* leptris_text_create(const char* content,
     node->base.frozen = 0;
     node->base.version = 0;
     node->base.raw = 0;   /* uninitialized: see create_borrowed */
-      /* Explicit: pool memory is not zeroed and the retained arena
-     * recycles dirty pages — a stale binding_wrapper would hand
-     * bindings a dangling pointer. */
-    node->base.binding_wrapper = NULL;
     node->parent_off = 0;
     node->next_sibling_off = 0;
+    node->owner_doc_off = 0;   /* #1320: only the public creator stamps */
 
     if (content && content_len > 0) {
         memcpy(content_storage, content, content_len);
     }
     content_storage[content_len] = '\0';
-    node->content = content_storage;
+    /* Contiguous with the node in the same pool alloc — the offset
+     * is a small positive delta; doc tags the oversized-content
+     * fallback should it ever leave the inline window. */
+    leptris_textnode_set_content_ptr_doc(node, content_storage, doc);
     node->content_len = (uint32_t)content_len;
 
     return node;
@@ -57,7 +58,8 @@ LeptrisTextNode* leptris_text_create(const char* content,
  * the parser's pool. */
 LeptrisTextNode* leptris_text_create_borrowed(const char* content,
                                              size_t content_len,
-                                             LeptrisMemoryPool* pool) {
+                                             LeptrisMemoryPool* pool,
+                                             struct leptris_document* doc) {
     if (!pool) return NULL;
 
     LeptrisTextNode* node = (LeptrisTextNode*)leptris_pool_alloc(pool, sizeof(LeptrisTextNode));
@@ -70,11 +72,15 @@ LeptrisTextNode* leptris_text_create_borrowed(const char* content,
      * uninitialized raw bit silently flips DOE/cdata behavior by
      * build configuration. */
     node->base.raw = 0;
-    node->base.binding_wrapper = NULL;
-    node->content = (char*)content;  /* Non-owning; caller guarantees lifetime + termination. */
+    /* Non-owning view into the doc-owned buffer; caller guarantees
+     * lifetime + termination (#1285 slice 4). The buffer-to-node
+     * distance crosses allocations — the doc-tagged stamp is
+     * MANDATORY here (TLS is unset on parse worker threads). */
+    leptris_textnode_set_content_ptr_doc(node, content, doc);
     node->content_len = (uint32_t)content_len;
     node->parent_off = 0;
     node->next_sibling_off = 0;
+    node->owner_doc_off = 0;   /* #1320: only the public creator stamps */
 
     return node;
 }
@@ -98,5 +104,6 @@ void leptris_text_free(LeptrisTextNode* text) {
  * here. */
 const char* leptris_text_get_content(LeptrisTextNode* text) {
     if (!text) return NULL;
-    return text->content ? text->content : "";
+    const char* c = leptris_textnode_content(text);
+    return c ? c : "";
 }