leptris 1.9.292.0-ppc64le-linux → 1.9.304.0-ppc64le-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: deba2902336772763d8daf6c1bf66cf6381a1c1536b83a7ea604f27fd6dd8e2f
-  data.tar.gz: 52c284c22ac8ebc747410589daf061afbb8dcfd9e900ce3fec0f45110d190d97
+  metadata.gz: 785d9b7e66ab4d337f9002a5d4bc39d67c681a74e1dc04967990279e866e034c
+  data.tar.gz: e804fd26e2b9ab2d42cbdcd1e0af3972f5d1fc8dda4c6c690c0308bb9b0030ae
 SHA512:
-  metadata.gz: 7eaa86daa077f9c4ef1adcf01e78340d744ba6c9f73a5bb30fdd16de4efc3cb5dfb75fee50912c348f332ac545aba7422497b1fa92e47d6c685d8b4c6fd44c11
-  data.tar.gz: 6ae7b5c085e442ce31d94391da70fb4db563b38af1b91275cc0bb5087bdb1d5ee840965c9dcc8501f1fec7e31067dd23e63bfa0a804d32968edd4e2cb883da75
+  metadata.gz: 36067b9300f15de58055ce88d04ba035410585c79134270ce26fb54ff177f6366e904e248554548c23c7670666f6e90045cf6f756c51a037e5ccddb334770de4
+  data.tar.gz: 37873702eb98d9aa34dddbd8b876e650a0b1a9abb6a84798922161007a548953df1c3565bf624476862540bd76ff9716b6374ee73a424005182cf71ef79512eb

data/CHANGELOG.md

@@ -1,3 +1,47 @@
+## [1.9.304.0] - 2026-10-05
+
+### Fixed
+
+- **Cross-document appends adopt by copy — the xpath.rb:39 crash
+  class (engine #1528, libleptris 1.9.304)**: the engine's four
+  splice seams (append/prepend/insert_before/insert_after) no
+  longer splice foreign-document pointers raw — a scratch-doc
+  node appended into a live tree then freed with its document
+  dangled every adopted node and detonated the next compiled-XPath
+  eval (the metanorma sectioned-cleanup crash). The binding now
+  completes the contract: cross-document appends return the
+  INSTALLED in-tree wrapper (add_child, append_children, children=,
+  prepend_child, add_previous_sibling, add_next_sibling, wrap),
+  the #178 namespace lift runs before the splice, and the source
+  original is removed after (the historical move semantics —
+  source loses the node). Same-document appends stay
+  pointer-identical on the native fast path. The wrap face moves
+  self into the INSTALLED wrapper. Adoption specs include the
+  scratch-free + compiled-XPath crash shape.
+
+## [1.9.302.0] - 2026-10-05
+
+### Engine sync (libleptris 1.9.293-1.9.302)
+
+Ten upstream releases ride in this pin — internal fixes and
+performance with NO binding-surface changes (zero header deltas
+292..302; the audit gate confirms 363/362 unchanged). Highlights:
+
+- **XQuery correctness**: a false() bound anywhere read as truthy;
+  fn:not uses the effective boolean value; fn:abs(()) is empty;
+  string lt/gt are codepoint comparisons; fn:avg edge shapes;
+  aggregates atomize array arguments; `instance of xs:integer`
+  demands integrality; xs:byte/unsignedByte/unsignedInt
+  constructors; fn:sum#2's zero argument.
+- **Collation**: UCA over the vendored DUCET table (slices 1-4) —
+  fn:normalize-unicode F&O conformance, collation-aware string
+  functions, 71+1078 QT3 cases adopted, implicit weights and
+  alternate=blanked.
+- **Performance**: per-thread recycle of mutation blocks (DOM
+  create/build/free).
+- **Rust bindings**: first tokenless crates.io release (leptris
+  v1.4.1) from CI.
+
 ## [1.9.292.0] - 2026-10-03
 
 ### Fixed

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.292"
+LIBLEPTRIS_VERSION = "1.9.304"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.292.0"
+  VERSION = "1.9.304.0"
 end

data/lib/leptris/xml/element.rb

@@ -419,6 +419,21 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
+    # Cross-document nodes skip the fast path entirely (1.9.304,
+    # #1528): the engine deep-copies them at the splice, so the
+    # full path's lift must run FIRST and the source original is
+    # removed after (move semantics).
+    if node.document && !node.document.equal?(@document)
+      ensure_writable!
+      unless Leptris::XML::Element.skip_adoption_lift?(node)
+        Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
+      end
+      Leptris::XML::FFI.check_status(
+        Leptris::XML::FFI.leptris_element_prepend_child(c_ptr, node.c_ptr))
+      Leptris::XML::Node.invalidate_cross_document!(node, @document)
+      node.parent&.remove_child(node)
+      return children.to_a.first
+    end
     if native_fast_children?
       unless Leptris::XML::Native.insert_binding_child(
         @document, @c_address, node.c_ptr.address, 1).nil?
@@ -440,6 +455,20 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
+    # Cross-document: full path first (lift + engine copy), then
+    # the source original is removed; returns the installed copy
+    # (self's new next sibling).
+    if node.document && !node.document.equal?(@document)
+      ensure_writable!
+      unless Leptris::XML::Element.skip_adoption_lift?(node)
+        Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
+      end
+      Leptris::XML::FFI.check_status(
+        Leptris::XML::FFI.leptris_element_insert_after(c_ptr, node.c_ptr))
+      Leptris::XML::Node.invalidate_cross_document!(node, @document)
+      node.parent&.remove_child(node)
+      return self.next_sibling
+    end
     if native_fast_children?
       unless Leptris::XML::Native.insert_binding_child(
         @document, @c_address, node.c_ptr.address, 2).nil?
@@ -461,6 +490,20 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
+    # Cross-document: full path first (lift + engine copy), then
+    # the source original is removed; returns the installed copy
+    # (self's new previous sibling).
+    if node.document && !node.document.equal?(@document)
+      ensure_writable!
+      unless Leptris::XML::Element.skip_adoption_lift?(node)
+        Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
+      end
+      Leptris::XML::FFI.check_status(
+        Leptris::XML::FFI.leptris_element_insert_before(c_ptr, node.c_ptr))
+      Leptris::XML::Node.invalidate_cross_document!(node, @document)
+      node.parent&.remove_child(node)
+      return self.previous_sibling
+    end
     if native_fast_children?
       unless Leptris::XML::Native.insert_binding_child(
         @document, @c_address, node.c_ptr.address, 3).nil?
@@ -508,6 +551,9 @@ class Leptris::XML::Element < Leptris::XML::Node
       nodes.each { |n| add_child(n) }
       return
     end
+    cross = nodes.any? do |n|
+      n.document && !n.document.equal?(@document)
+    end
     if native_fast_children?
       addrs = nodes.map { |n| n.c_ptr.address }
       done = Leptris::XML::Native.append_binding_children(
@@ -516,14 +562,25 @@ class Leptris::XML::Element < Leptris::XML::Node
       if done >= nodes.size
         nodes.each do |n|
           Leptris::XML::Node.invalidate_cross_document!(n, @document)
+          remove_from_source_original(n) if cross
         end
-        return nodes
+        # 1.9.304 (#1528): foreign children were adopted by COPY —
+        # hand back the installed in-tree wrappers.
+        return cross ? children.to_a.last(nodes.size) : nodes
       end
       nodes[0, done].each do |n|
         Leptris::XML::Node.invalidate_cross_document!(n, @document)
+        remove_from_source_original(n) if cross
       end
       nodes = nodes[done..]
     end
+    if cross
+      nodes.each do |n|
+        append_installed(n)
+        remove_from_source_original(n)
+      end
+      return children.to_a.last(nodes.size)
+    end
     nodes.each { |n| add_child(n) }
     nodes
   end
@@ -565,9 +622,12 @@ class Leptris::XML::Element < Leptris::XML::Node
     # add_child moves self (unlinks from old parent first), so no explicit
     # remove_child needed — and trying to remove after the move corrupts
     # the C tree (libleptris silently handles non-child args badly).
-    add_next_sibling(wrapper)
-    wrapper.add_child(self)
-    self
+    # The wrapper may be cross-document (parsed into a scratch doc,
+    # 1.9.304 #1528) — add_next_sibling returns the INSTALLED copy;
+    # move self into THAT.
+    installed = add_next_sibling(wrapper)
+    installed.add_child(self)
+    installed
   end
 
   # Deep copy in a NEW document via Document.copy_of (the single
@@ -608,6 +668,13 @@ class Leptris::XML::Element < Leptris::XML::Node
     ensure_writable!
     case node_or_markup
     when Leptris::XML::Node
+      # Cross-document adoption (1.9.304, #1528): the engine
+      # deep-copies foreign nodes at the splice — the returned
+      # wrapper must be the INSTALLED copy, not the detached
+      # source. Route those through the re-resolving path.
+      cross = node_or_markup.document &&
+              !node_or_markup.document.equal?(@document)
+      return append_installed(node_or_markup) if cross
       # C-bound append (TODO.perf/08-09): one dispatch runs the
       # readonly/liveness gates, the provable no-op lift
       # predicate, the version bump, and the engine append. Qnil
@@ -659,6 +726,47 @@ class Leptris::XML::Element < Leptris::XML::Node
       raise ArgumentError, "add_child expects a Node or String, got #{node_or_markup.class}"
     end
   end
+  # Cross-document append (1.9.304, #1528): the engine deep-copies
+  # the foreign node at the splice, so the installed node is this
+  # element's LAST child — re-wrap it and return that. The binding
+  # keeps its historical MOVE semantics on top: namespaces are
+  # lifted BEFORE the copy (declarations survive), and the source
+  # original is removed after (the source loses the node, as
+  # every pre-304 caller observed).
+  def append_installed(node)
+    unless Leptris::XML::Element.skip_adoption_lift?(node)
+      Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
+    end
+    Leptris::XML::FFI.check_status(
+      Leptris::XML::FFI.leptris_element_append_child(c_ptr, node.c_ptr))
+    Leptris::XML::Node.invalidate_cross_document!(node, @document)
+    remove_from_source_original(node)
+    last_installed
+  end
+  private :append_installed
+
+  # 1.9.304 (#1528): a foreign child appended to this document was
+  # adopted by COPY — remove the ORIGINAL from its source document
+  # (the binding's move semantics). The wrapper's @parent may be
+  # unset for lazily minted wrappers, so ask the ENGINE for the
+  # source parent and remove through a wrapped handle.
+  def remove_from_source_original(node)
+    return unless node.document && !node.document.equal?(@document)
+
+    srcp = Leptris::XML::FFI.leptris_node_parent(node.c_ptr)
+    return if srcp.nil? || srcp.null?
+
+    Leptris::XML::Node.wrap(srcp, node.document).remove_child(node)
+  end
+  private :remove_from_source_original
+
+  # The last child, wrapped fresh through the document's identity
+  # cache (bypasses any stale self-side wrapper of the same node).
+  def last_installed    kids = children.to_a
+    kids.last
+  end
+  private :last_installed
+
   # The markup-append face appends in fragment order; the added
   # nodes are this element's last +count+ children.
   def last_added(count)

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.292
+- libleptris v1.9.304
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,403 @@
 ## [Unreleased]
 
+## [1.9.304] - 2026-10-05
+
+### Fixed
+
+- **DOM: nodes from a different document are adopted by copy, never
+  spliced raw (#1528)** — `leptris_element_append_child`,
+  `prepend_child`, `insert_before` and `insert_after` accepted a
+  pointer from ANY document and spliced it in as-is. A node parsed
+  into a scratch document (the cleanup pipelines' replacement
+  markup) left the live tree holding nodes and text content from
+  the scratch pool; freeing that scratch document dangled every
+  adopted node, and the next native walk crashed — the
+  `leptris_xpath_compiled_eval` segfault in the metanorma
+  sectioned-cleanup path, same family as #358/#362/#371. The four
+  seams now adopt foreign nodes through `leptris_element_copy`
+  (the `set_root` adoption contract since #371). Same-document
+  moves stay pointer-identical and zero-copy; detached chains keep
+  their link-only contract; the mutation hot path reuses its
+  existing document resolution. RED spec under ASAN
+  (`CrossDocumentAdoption` in the mutation suite: splice a parsed
+  scratch root, free the scratch document, then compiled-XPath and
+  serialize the live tree).
+
+
+
+## [1.9.303] - 2026-10-05
+
+### Added
+
+- **XQuery: `fn:min`/`fn:max` coerce NaN** — any numeric NaN in the
+  input forces the NaN result; the comparison operators never select
+  it (`d > best` is false for NaN), so it is tracked explicitly
+  (K-SeqMAXFunc-16/27/28/31 and the MIN twins).
+- **XQuery: duration comparisons in `fn:min`/`fn:max`/`fn:sum`/
+  `fn:avg`** — `xs:yearMonthDuration` items compare by months,
+  `xs:dayTimeDuration` by seconds, through the shared duration
+  formatters (`max(1 to 10 months)` = `P10M`, `cbcl-max-015` =
+  `P1Y1M`). Duration results of the four aggregates carry their
+  atomic type, so `instance of xs:*Duration` now holds
+  (fn-sum-1/3/4/6, fn-max/min-4/6/7, K-SeqSUMFunc-30, fn-avg-3/5).
+- **XQuery: `fn:min`/`fn:max` over `xs:boolean`** — false < true,
+  and the result is a boolean, not a string (a string "false" would
+  read truthy at every assert-false site; cbcl-max-001, cbcl-min-002).
+
+### Fixed
+
+- **XQuery: `fn:sum#2` zero semantics** — the zero is the
+  EMPTY-sequence answer only, never an addend:
+  `sum((1 to 3), 17)` is 6 (was 23, fn-sum-12); an empty zero
+  leaves the empty result empty (`sum((), ())`, K-SeqSUMFunc-5);
+  a non-integer numeric zero adds back only for the empty sequence.
+  The libxslt suite (221/221) pins the XPath 1.0 side unchanged.
+- **instance of the duration types** — the `'d'`-marked member check
+  recovers the flavor from the lexical shape (months-only is
+  yearMonth; dayTime never spells months) and the scalar check
+  requires the matching atomic type; both branches sit ahead of the
+  `is_num_ty` catch-all that would otherwise swallow every
+  non-string/boolean/node base name.
+- **fn:sum atomization leak** — the duration prescan freed the
+  flattened array-carrier members' container but not the member
+  strings (Linux ASAN caught it: 10 bytes per `sum([1,2,3,4,5])`).
+- QT3 re-pins from one verified run: fn/avg 173→175, fn/max
+  167→176, fn/min 167→175, fn/sum 204→209 (+24 adopted cases;
+  total pins 1148 → 1172; 61/61 suites green).
+
+
+
+## [1.9.302] - 2026-10-04
+
+### Added
+
+- **XQuery: aggregates atomize array arguments** — `fn:avg`,
+  `fn:sum`, `fn:min` and `fn:max` take `xs:anyAtomicType*`, so a
+  dense array argument now contributes its members instead of
+  leaking the internal carrier: `avg([1,2,3,4,5])` = 3,
+  `sum([1,2,3,4,5])` = 15 (fn-avg-10, fn-sum-11, fn-min-19,
+  fn-max-19). A new shared decoder turns carriers keyed exactly
+  1..n into positional members, recursing into nested arrays
+  (`[[1,2],[3]]` → 1,2,3); maps and sparse carriers stay single
+  items, and `item()`-typed functions such as `fn:count` still see
+  an array as one item, per XDM. `fn:sum`'s per-item accumulation
+  moved into a helper so atomized members feed the existing
+  int64-exact and xs:float channels unchanged.
+- **XQuery: `instance of` over the integer family demands
+  integrality** — `xs:integer` and its derived types
+  (int/long/short/byte/unsigned*/nonNegative…) now require an
+  integral value on both the sequence-member and scalar paths:
+  `fn:abs(1.1) instance of xs:integer` is false,
+  `fn:abs(-3) instance of xs:integer` is true.
+
+### Fixed
+
+- **XQuery: `fn:avg` edge shapes** — `avg(())` returns the empty
+  sequence under XQuery (XPath 1.0 parity untouched), and averages
+  over `xs:yearMonthDuration` format through the shared months
+  formatter (cbcl-avg-006: `P1Y`). Also freed a nested-array
+  carrier on an allocation-failure path in the atomizing decoder.
+- QT3 re-pins from one verified run: fn/avg 164→173, fn/max
+  165→167, fn/min 165→167, fn/sum 203→204 (+14 adopted cases;
+  total pins 1134 → 1148; 61/61 suites green).
+
+
+
+## [1.9.301] - 2026-10-04
+
+### Fixed
+
+- **XQuery: a false() bound anywhere read as truthy** — values
+  stringified to a marker-less "false" that every effective-boolean-
+  value site saw as a non-empty string, so `let $x := false() return
+  if ($x)...` took the then-branch and fold accumulators ignored a
+  false() zero (fold-left-004). Variable bindings, local:function
+  thunk arguments and the fold accumulators/items now carry the
+  boolean type marker; the EBV read honors it on singleton synthetic
+  members (XML 1.0 forbids raw control characters in text content,
+  so the marker cannot collide with document data); named-reference
+  closure calls spell marked booleans back to literals; both string
+  consumers render them as true/false. (PR #1522)
+
+- **fn:not uses the effective boolean value** — not(false()) is
+  true while fn:empty((false())) stays false; real nodes keep the
+  XPath 1.0 existence rule, so libxml2 parity is unchanged.
+  (PR #1522)
+
+- **fn:abs(()) is the empty sequence** under the XQuery surface;
+  **fn:sum((), $zero) returns a non-numeric zero verbatim**
+  (sum((), xs:dayTimeDuration("PT0S")) = PT0S); **fn:avg over
+  dayTimeDurations** divides the total seconds and formats
+  (fn-avg-4: PT5H30M); and the kept lexical zero in fn:sum is freed
+  on every result path (a Linux ASAN catch — macOS has no leak
+  sanitizer). (PR #1522)
+
+
+
+## [1.9.300] - 2026-10-04
+
+### Added
+
+- **XQuery: the xs:float and int64 typed-atom channels survive the
+  numeric function hop (+49 QT3 agreements; the fifteen-family batch
+  pins rise 1078→1127 and fn:round is fully green at 220/220)**.
+  fn:abs, fn:round, fn:round-half-to-even and the avg/min/max
+  aggregates copy the float tag onto their results (round over
+  xs:float("3.4028235E38") spells 3.4028235E38, not the widened
+  double digits); fn:sum keeps an exact long-long total when every
+  member is an integer lexical (fn:sum#2's zero seeds it); fn:floor,
+  fn:ceiling, fn:round and fn:abs pass int64 atoms through unchanged
+  (floor(xs:integer("999999999999999999")) stays exact, not 1e18).
+  (PR #1520)
+
+- **xs:byte, xs:unsignedByte and xs:unsignedInt constructors** —
+  the three integer subtypes were unregistered and errored as
+  unknown functions. (PR #1520)
+
+### Fixed
+
+- **is_int results now also carry the double field** — eq and
+  boolean() comparisons read number_value, which the int64 path
+  left unset (sum((3,4,5)) eq 12 was false). (PR #1520)
+
+- **The float-precision speller snaps into the float domain before
+  spelling** — double arithmetic can leave a non-float-representable
+  value whose shortest float round-trip never terminates, spelling
+  18-digit mantissas. (PR #1520)
+
+
+
+## [1.9.299] - 2026-10-04
+
+### Added
+
+- **XQuery: 1078 QT3 cases adopted across fifteen fn families** —
+  the numeric aggregates and rounding set (abs, avg, ceiling, floor,
+  max, min, round, round-half-to-even, sum) plus the higher-order
+  combiners (apply, filter, for-each, for-each-pair, fold-left,
+  fold-right), vendored verbatim from the upstream QT3 mirror. The
+  named per-suite excludes document the typed-atom lane's remaining
+  levers (xs:float spelling through aggregates, int64-exact
+  multi-argument sums, instance-of results). (PR #1518)
+
+- **fn:sum#2** — the zero argument returns its value for the empty
+  sequence: fn:sum((1,2,3), 10) = 16, fn:sum((), 5) = 5.
+  (PR #1518)
+
+### Fixed
+
+- **Number spelling destroyed integral magnitudes** — the shared
+  trailing-zero trim ran on dot-free integer renderings, so 1e18
+  spelled "1"; it now runs only when a decimal point is present.
+  Negative zero also spells "-0" (fn:round(-0.01) = -0), and
+  fn:round preserves -0 for inputs in (-0.5, 0). (PR #1518)
+
+- **Value carriers overflowed at DBL_MAX** — the ext31 string
+  carrier used the libxml2-parity printer, which renders DBL_MAX
+  with 18 significant digits; strtod read-back of that string
+  overflows to infinity, so fn:avg((1.7976931348623157E308)) was
+  INF. Carriers now use the injective shortest-round-trip spelling.
+  (PR #1518)
+
+- **fn:sum rejected non-nodeset arguments** — single-item sequences
+  (passed as scalars by the XQuery adapter) errored out. (PR #1518)
+
+- **fn:round()/fn:round-half-to-even(()) now return the empty
+  sequence** under the XQuery surface; XPath 1.0 coercion stays NaN
+  (libxml2 parity unchanged). (PR #1518)
+
+- **fn:max/fn:min over non-numeric items** (xs:string, xs:anyURI)
+  compare in codepoint order and return the extreme item instead of
+  coercing to zero. (PR #1518)
+
+- **QT3 runner: the standard `emptydoc`/`empty` environments
+  resolve to the empty context** — cases carrying them were
+  silently skipped (the abs/ceiling/floor/fold-* families adopted
+  zero cases before this). (PR #1518)
+
+
+
+## [1.9.298] - 2026-10-04
+
+### Added
+
+- **XPath/XQuery: the six remaining string functions honor UCA
+  collations (DUCET lane closed)** — starts-with, ends-with,
+  contains, substring-before, substring-after and deep-equal now
+  route `http://www.w3.org/2013/collation/UCA` URIs through the
+  collation module. Matching scans codepoint-aligned windows under
+  the collation compare (every collation-unit boundary falls
+  between codepoints, so the scan is exact across contractions and
+  normalization); substring-before/after slice the leftmost-shortest
+  occurrence. deep-equal threads the collation into plain string
+  atoms and map values, while \x03-marked carriers keep their
+  value-space equality. **QT3 adoption rises by 73 cases**:
+  contains 46→63, starts-with 43→56, ends-with 34→48,
+  substring-before 12→26, substring-after 16→29, deep-equal
+  221→223. (PR #1515)
+
+- **Collation: UCA 7.1.1 implicit weights** — codepoints with no
+  DUCET mapping sort by the two-CE algorithm: the registered
+  @implicitweights ranges (Tangut/Tangut-Supplement base FB00,
+  Khitan FB02, Nushu FB01) order ahead of the unassigned groups
+  (base 0xFB80 + 2*(cp>>15)), each codepoint emitting an
+  even/odd CE pair that orders within its group by codepoint.
+  (PR #1515)
+
+- **Collation: `alternate=blanked`** (fn-contains-35..38) — the
+  third W3C UCA variable-weighting value is accepted, and variable
+  collation elements now leave every ordinary level under
+  shifted/blanked weighting (shifted retains its quaternary
+  re-add; blanked drops them wholly — ICU variable semantics).
+  (PR #1515)
+
+- **CLI: `leptris xslt` command** — apply a stylesheet to a
+  document and print the serialized result tree:
+  `leptris xslt -s style.xsl input.xml`. Conventions match
+  xsltproc: INPUT is a file path, `-` or absent reads stdin. The
+  stylesheet compiles via leptris_xslt_parse_file, so
+  xsl:include/xsl:import resolve relative to the sheet. New
+  CLI_ERROR_XSLT exit code (7). (PR #1516)
+
+- **CLI: man pages for every command** — new leptris-xslt.1 plus
+  the missing leptris-xquery.1, leptris-diff.1 and
+  leptris-validate.1, all registered for generation. (PR #1516)
+
+### Fixed
+
+- **CLI: `--help` was missing registered commands** — the usage
+  text hand-maintained its own command list, so the registered
+  `diff` and `xquery` commands were invisible. The help listing
+  now iterates the command registry (the descriptors are the
+  single source of truth), and adding a command can no longer
+  leave help stale. xquery's private stream reader is promoted to
+  shared cli_read_stream/cli_read_file. (PR #1516)
+
+
+
+## [1.9.297] - 2026-10-03
+
+### Fixed
+
+- **XQuery: string lt/gt are codepoint value comparisons** — the
+  shared XPath 1.0 comparison numeric-coerced strings, so two
+  collation-keys that both spell numbers compared as equal numbers.
+  Both comparison sites now codepoint-compare string operands when
+  the evaluation is XQuery-flavored (the evaluator's string branch
+  and the VM twin); XPath 1.0 evaluation is unchanged.
+  (PR #1513)
+
+- **XQuery: fn:codepoints-to-string encodes every item of its
+  sequence argument** — the collector collapsed a parenthesized
+  sequence to one scalar (its space-joined spelling), so
+  (37, 65500, 37) encoded as just the first codepoint. Collation-key
+  adoption rises to 12/56 run-and-agree. (PR #1513)
+
+
+
+## [1.9.296] - 2026-10-03
+
+### Added
+
+- **XPath/XQuery: 71 QT3 collation cases adopted (DUCET slice 4)** —
+  the misc/UCACollation corpus (62 cases: the UCA ordering battery
+  over DUCET weights) and fn/collation-key (9 cases). The collation
+  URI grammar now parses the W3C semicolon-separated parameter form,
+  accepts lang= (DUCET is the root locale), and applies
+  caseFirst=upper|lower by swapping the DUCET case tertiaries.
+  fn:collation-key gains its 1-argument form (the static default
+  collation; codepoint keys are the UTF-8 bytes) and its keys are
+  lowercase hex — injective AND order-preserving, so lt/gt on two
+  keys is byte-wise key order. The QT3 runner now credits an
+  error alternative inside any-of for a failed evaluation, gates the
+  optional simple-uca-fallback feature (this engine raises FOCH0002
+  per the strict F&O reading), and lifts the pre-DUCET
+  collation/UCA exclusion under a DUCET build. (PR #1511)
+
+### Fixed
+
+- the DUCET implicit-weight fallback dropped a mask that broke
+  ordering between high codepoints. (PR #1511)
+
+
+
+## [1.9.295] - 2026-10-03
+
+### Added
+
+- **XPath: collation-aware functions over the vendored DUCET
+  (slices 2-3)** — fn:compare's 3-argument form honors its collation
+  URI (unknown needed collations raise FOCH0002; unknown-but-unneeded
+  ones are ignored per the QT3 any-of expectations);
+  fn:collation-key($key, $collation) is new, returning the UCA sort
+  key as base64 text (the result-type enum is ABI-frozen with no
+  binary kind; base64 is injective, so key equality is byte equality);
+  fn:index-of, fn:distinct-values and fn:sort route plain-string
+  comparisons through the collation while typed atoms keep their
+  value-space equality. DUCET-gated: builds without utf8proc keep the
+  previous behavior. (PRs #1508, #1509)
+
+
+
+## [1.9.294] - 2026-10-03
+
+### Added
+
+- **XPath: UCA collation over the vendored DUCET table (slice 1)** —
+  `http://www.w3.org/2013/collation/UCA` collation URIs parse
+  `strength` and `alternate` parameters per F&O 3.x (defaults:
+  tertiary, non-ignorable) and compare through multi-level sort keys:
+  NFD (utf8proc) → DUCET weights (Unicode 16.0.0, 38,443 single
+  codepoints + 964 contractions, vendored with an offline table
+  generator) → primary/secondary/tertiary levels with 0x00
+  separators; `alternate=shifted` demotes variable primaries to the
+  quaternary level. Codepoint and html-ascii-case-insensitive
+  collations keep their semantics. Unmapped codepoints get a coarse
+  deterministic fallback (the full UCA 7.1.1 implicit-weight
+  algorithm is a later slice). New CMake option
+  `LEPTRIS_ENABLE_DUCET` (default on, requires utf8proc; builds
+  without utf8proc degrade to codepoint collation). Function
+  wiring (fn:compare, fn:collation-key, default collation) and
+  QT3 UCA case adoption are the next slices. (PR #1506)
+
+- **XQuery: fn:normalize-unicode F&O conformance** — the
+  single-argument form normalizes with NFC instead of returning the
+  input unchanged; unknown normalization forms raise FOCH0003
+  instead of silently falling back to NFC; the form argument is
+  case-insensitive with surrounding whitespace tolerated
+  (FULLY-NORMALIZED is gone from F&O 3.x; its satisfied="false"
+  twins run). utf8proc-gated end to end; the 29-run
+  fn/normalize-unicode QT3 family is adopted. (PR #1505)
+
+### Fixed
+
+- DUCET builds without utf8proc (cppcheck leg, Rust lane, ILP32,
+  Windows static) degrade to codepoint collation with a warning
+  instead of failing the configure. (PR #1506)
+
+
+
+## [1.9.293] - 2026-10-03
+
+### Performance
+
+- DOM: per-thread recycle of mutation blocks. Document create/build/free
+  cycles now park their elem (45KB), name (4KB) and attr (5KB) blocks on
+  thread-local free-lists instead of returning them to malloc — the next
+  cycle carves from hot pages instead of re-faulting fresh ones. Byte-capped
+  (8MB elem, 4MB name/attr); POSIX threads drain via a pthread_key
+  destructor at thread exit, and `leptris_explicit_cleanup()` drains
+  synchronously. Mutation doc-cycle row: 19.4 → 15.1 ns/child (−22%), gap
+  to pugixml on that shape narrows 1.66x → 1.29x. Single-document append
+  throughput is unchanged. (PR #1503)
+
+### Rust bindings
+
+- First fully tokenless crates.io release: leptris v1.4.1 published from CI
+  via crates.io Trusted Publishing (`rust-lang/crates-io-auth-action` —
+  cargo itself has no native OIDC support). The Rust release lane now needs
+  no registry token of any kind. (PRs #1497, #1499–#1502)
+
 ## [1.9.292] - 2026-10-02
 
 ### Added