leptris 1.9.309.0-ppc64le-linux → 1.9.311.1-ppc64le-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c4fe15a8a13df3de39519a4a2985c6f3a5f23202a3b6f1f00d0fad934d7a08c
-  data.tar.gz: 1009e7705a3b262341e0411544ca1e55e75f70b72334aaa66f8db695fe3d21d7
+  metadata.gz: b4652fa888a962a651464d12ed97e9a17cc8c19056f55f4694eb97ecd7f8447b
+  data.tar.gz: 3614fc667bddf01d0be1f014b0076988eb0a53f52ed3d9e1a70a14fb270fe85a
 SHA512:
-  metadata.gz: 911f4eb491ac63fcfd89d0d0f1a19871937039b490ae07c1de3bd2a09554d37a51ece8ecfefbb2c0b78f3ab0f256663c54523ac514976ee55162cde8d1c11f24
-  data.tar.gz: 9755c0907775f1b0dc41c78587437259c552d9a3d054a7e86aaf15a7abae703cc5516371ef659531ff14813b809832861d63f90e48f68c1cd3b13fbf367b90f4
+  metadata.gz: 0711c12380bb334b39f888aef74f8045940f4d726a9932e7f69eb93c9a80af6c32d3b4e7359675e0206329d855bad9905e06ffc05e623226b3dc6eedb3770543
+  data.tar.gz: 964a54d1fb7ab8976a52d11fb12b6e799afd21a7e865fa0fa8f382dcf298906214260e567b0459e3f52ca81f1abdbffbf4836a6db034f4205c56bc51dbb46c50

data/CHANGELOG.md

@@ -1,3 +1,52 @@
+## [1.9.311.1] - 2026-10-06
+
+### Fixed
+
+- **Docless children now route through the adoption contract
+  (#376)**: moxml's created nodes arrive as Node wrappers whose
+  #document is nil but whose C node is live in a foreign pool —
+  the splice sites' foreign check required a document, so those
+  children bypassed the namespace lift and, worse, the returned
+  wrapper addressed the ABANDONED source instead of the installed
+  in-tree copy (moxml's flows then mutated a node the tree never
+  saw). `foreign_child?` now treats document-nil as foreign at
+  add_child, prepend_child, add_next_sibling,
+  add_previous_sibling, and append_children, so every splice
+  returns the installed wrapper. Document#root= routes docless
+  roots through the copying ex-face too — the plain set_root of a
+  foreign-pool node linked the pointer WITHOUT adopting it into
+  the destination pool, so destination-side writes landed in the
+  source arena and reads through the root memo missed them.
+  Node-level mutations on docless
+  wrappers no longer crash the version gate (they memoize
+  nothing, so there is no version to advance).
+
+## [1.9.311.0] - 2026-10-06
+
+### Added
+
+- **Document#absorb — move semantics for doomed splice sources
+  (libleptris 1.9.311, engine #1548)**: one call transfers a
+  scratch document's pool ownership into the destination, so
+  subsequent cross-document splices of its nodes move BY REFERENCE
+  — O(1), no deep copy, no live-set doubling (the sectioned-
+  cleanup flow's 7GB cg3 overrun; completes without the copy
+  blow-up). The absorbed document's #free is handle-only (the
+  destination's free performs the real release); splices into any
+  THIRD document still deep-copy; chaining rejects. The splice
+  seams skip source-side removal for absorbed sources (the move
+  already transferred the node — nothing to remove).
+  leptris_document_absorb attached (audit 370/369).
+
+### Fixed — engine sync (1.9.309-1.9.311)
+
+- 1.9.309: XPath signed exponent literals (`1E+1` truncated at
+  the E; the sign is part of the literal now).
+- 1.9.310: a typed cast stored the operator frame's stack buffer
+  in the result's borrowed atomic_type slot (ASAN stack-use-after-
+  return); recursive closures sharing parameter names with an
+  outer frame no longer drop the outer bindings.
+
 ## [1.9.308.0] - 2026-10-05
 
 ### Engine sync (libleptris 1.9.308)

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.309"
+LIBLEPTRIS_VERSION = "1.9.311"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.309.0"
+  VERSION = "1.9.311.1"
 end

data/lib/leptris/xml/document.rb

@@ -388,7 +388,12 @@ class Leptris::XML::Document
     # the foreign subtree into this document's pool and reports the
     # installed element — a fresh handle distinct from the source
     # pointer. Same-document installs keep the native fast path.
-    cross = element.document && !element.document.equal?(self)
+    # Docless roots count as foreign (#376): a plain set_root of a
+    # foreign-pool node links the pointer WITHOUT adopting it into
+    # this pool — writes through this document land in the source
+    # arena and reads through the root memo miss them. The ex-face
+    # copies properly.
+    cross = Leptris::XML::Element.foreign_to?(element, self)
     installed_ptr = nil
     if cross
       out = ::FFI::MemoryPointer.new(:pointer)
@@ -561,10 +566,51 @@ class Leptris::XML::Document
   end
   alias_method :c14n, :canonicalize
 
+  # Move semantics for doomed splice sources (1.9.311, engine
+  # #1548): transfer +other+'s pool ownership into this document
+  # in one call. Every subsequent cross-document splice of other's
+  # nodes into THIS document moves by reference — O(1), no deep
+  # copy, no live-set doubling (the sectioned-cleanup flow's 7GB
+  # cg3 overrun). other's handle becomes handle-only: its #free
+  # releases just the wrapper; this document's free performs the
+  # real release. Chaining rejects (an absorbed document cannot
+  # absorb or be absorbed again). Returns self.
+  def absorb(other)
+    raise Leptris::XML::UseAfterFreeError if @freed.state == :freed
+    unless other.is_a?(Leptris::XML::Document)
+      raise ArgumentError, "absorb expects a Leptris::XML::Document"
+    end
+
+    Leptris::XML::FFI.check_status(
+      Leptris::XML::FFI.leptris_document_absorb(c_ptr, other.c_ptr))
+    other.mark_absorbed_into(self)
+    self
+  end
+
+  # Absorption bookkeeping (private seam — never set ivars across
+  # objects by hand): the absorbed document's #free skips the
+  # engine release, and splice seams skip source-side removals
+  # because absorbed splices MOVE the node (nothing to remove).
+  def mark_absorbed_into(destination)
+    @absorbed_into = destination
+  end
+
+  def absorbed_into?(destination)
+    @absorbed_into&.equal?(destination)
+  end
+
+  def absorbed?
+    !@absorbed_into.nil?
+  end
+  private :absorbed?
   def free
     return if @freed.state == :freed
     @freed.state = :freed
-    Leptris::XML::FFI.leptris_document_free(c_ptr) unless c_ptr.nil?
+    # An absorbed source's pool is owned by its destination — this
+    # free is handle-only; the destination's free releases memory.
+    unless absorbed? || c_ptr.nil?
+      Leptris::XML::FFI.leptris_document_free(c_ptr)
+    end
     @c_ptr = nil
     @c_address = nil
     @wrapper_cache&.clear

data/lib/leptris/xml/element.rb

@@ -389,6 +389,15 @@ class Leptris::XML::Element < Leptris::XML::Node
     !Leptris::XML::Native.ns_lift_needed?(node.c_ptr.address)
   end
 
+  # A node is foreign to +document+ when it belongs to another one
+  # — or to NONE (#376): moxml's created nodes are live C nodes
+  # wrapped without a document, and they splice by copy exactly
+  # like attached-foreign ones. One definition of "foreign" for
+  # the element splices and Document#root=.
+  def self.foreign_to?(node, document)
+    node.document.nil? || !node.document.equal?(document)
+  end
+
   def self.lift_namespaces_for_adoption(node, target_scope)
     return unless node.is_a?(Leptris::XML::Element)
     # Declarations the node already carries (its own definitions —
@@ -419,11 +428,11 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
-    # Cross-document nodes skip the fast path entirely (1.9.304,
-    # #1528): the engine deep-copies them at the splice, so the
-    # full path's lift must run FIRST and the source original is
-    # removed after (move semantics).
-    if node.document && !node.document.equal?(@document)
+    # Cross-document and docless nodes skip the fast path entirely
+    # (1.9.304, #1528; #376): the engine deep-copies them at the
+    # splice, so the full path's lift must run FIRST and the source
+    # original is removed after (move semantics).
+    if Leptris::XML::Element.foreign_to?(node, @document)
       ensure_writable!
       unless Leptris::XML::Element.skip_adoption_lift?(node)
         Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
@@ -455,10 +464,10 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
-    # Cross-document: full path first (lift + engine copy), then
-    # the source original is removed; returns the installed copy
-    # (self's new next sibling).
-    if node.document && !node.document.equal?(@document)
+    # Cross-document and docless (#376): full path first (lift +
+    # engine copy), then the source original is removed; returns
+    # the installed copy (self's new next sibling).
+    if Leptris::XML::Element.foreign_to?(node, @document)
       ensure_writable!
       unless Leptris::XML::Element.skip_adoption_lift?(node)
         Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
@@ -490,10 +499,10 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
-    # Cross-document: full path first (lift + engine copy), then
-    # the source original is removed; returns the installed copy
-    # (self's new previous sibling).
-    if node.document && !node.document.equal?(@document)
+    # Cross-document and docless (#376): full path first (lift +
+    # engine copy), then the source original is removed; returns
+    # the installed copy (self's new previous sibling).
+    if Leptris::XML::Element.foreign_to?(node, @document)
       ensure_writable!
       unless Leptris::XML::Element.skip_adoption_lift?(node)
         Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
@@ -551,9 +560,7 @@ class Leptris::XML::Element < Leptris::XML::Node
       nodes.each { |n| add_child(n) }
       return
     end
-    cross = nodes.any? do |n|
-      n.document && !n.document.equal?(@document)
-    end
+    cross = nodes.any? { |n| Leptris::XML::Element.foreign_to?(n, @document) }
     if native_fast_children?
       addrs = nodes.map { |n| n.c_ptr.address }
       done = Leptris::XML::Native.append_binding_children(
@@ -668,13 +675,13 @@ class Leptris::XML::Element < Leptris::XML::Node
     ensure_writable!
     case node_or_markup
     when Leptris::XML::Node
-      # Cross-document adoption (1.9.304, #1528): the engine
+      # Foreign-child adoption (1.9.304, #1528): the engine
       # deep-copies foreign nodes at the splice — the returned
       # wrapper must be the INSTALLED copy, not the detached
-      # source. Route those through the re-resolving path.
-      cross = node_or_markup.document &&
-              !node_or_markup.document.equal?(@document)
-      return append_installed(node_or_markup) if cross
+      # source. Docless wrappers count as foreign (#376): moxml's
+      # created nodes carry live C pointers with no owning
+      # document, and their callers expect the in-tree handle.
+      return append_installed(node_or_markup) if Leptris::XML::Element.foreign_to?(node_or_markup, @document)
       # C-bound append (TODO.perf/08-09): one dispatch runs the
       # readonly/liveness gates, the provable no-op lift
       # predicate, the version bump, and the engine append. Qnil
@@ -752,6 +759,11 @@ class Leptris::XML::Element < Leptris::XML::Node
   # source parent and remove through a wrapped handle.
   def remove_from_source_original(node)
     return unless node.document && !node.document.equal?(@document)
+    # An ABSORBED source's splices move by reference (engine
+    # #1548): the node is already owned by this document — there is
+    # no source-side original to remove, and the engine parent is
+    # this tree's own parent.
+    return if node.document.absorbed_into?(@document)
 
     srcp = Leptris::XML::FFI.leptris_node_parent(node.c_ptr)
     return if srcp.nil? || srcp.null?

data/lib/leptris/xml/ffi.rb

@@ -490,6 +490,14 @@ attach_function :leptris_parse_string,
         [:string, :pointer], :pointer
       attach_function :leptris_document_free,
         [:leptris_document], :void
+      # 1.9.311 (#1548): move semantics for doomed splice sources —
+      # one call transfers a source document's pool ownership into
+      # the destination, so subsequent cross-document splices move
+      # nodes by reference (O(1), no deep copy, no live-set
+      # doubling). The caller's src handle becomes handle-only;
+      # dst's free performs the real release. Chaining rejects.
+      attach_function :leptris_document_absorb,
+        [:leptris_document, :leptris_document], :leptris_status
       attach_function :leptris_document_create,
         [], :leptris_document
       attach_function :leptris_document_set_root,

data/lib/leptris/xml/node.rb

@@ -281,14 +281,15 @@ class Leptris::XML::Node
   # passes through this gate, so it is where the document's mutation
   # version advances — the invalidation behind writable-document
   # memoization. Bumping before the C call is conservative: a failed
-  # mutation merely discards memos.
+  # mutation merely discards memos. Docless wrappers (#376) mutate
+  # fine — they memoize nothing, so there is no version to advance.
   def ensure_writable!
     ensure_alive!
     if readonly_document?
       raise Leptris::XML::ReadOnlyError,
         "document is readonly — mutation attempted on #{inspect}"
     end
-    @document.advance_version
+    @document&.advance_version
     nil
   end
 

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.309
+- libleptris v1.9.311
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,74 @@
 ## [Unreleased]
 
+## [1.9.311] - 2026-10-06
+
+### Added
+
+- **`leptris_document_absorb(dst, src)` — move semantics for doomed
+  splice sources (#1548).** The #1528 cross-document adoption gate
+  deep-copies every foreign splice, doubling the live set; the
+  sectioned-semantic cleanup flow (scratch-document splices) pushed
+  the cg3 corpus past a 7GB budget (fatal alloc ~396s; completes at
+  16GB). One call before the splices transfers a doomed source
+  document's lifetime into the destination (riding the existing
+  xi:include ownership chain): the adoption gate then moves nodes by
+  reference — O(1) per seam, no copy, no live-set doubling, and
+  existing splice code is unchanged. The caller's later
+  `leptris_document_free(src)` releases only the handle; the
+  destination's free performs the real release. Splicing an absorbed
+  document's nodes into any OTHER document still deep-copies, and
+  the no-absorb copy contract is unchanged. No chaining: an
+  absorbed document cannot absorb or be absorbed again.
+
+
+
+## [1.9.310] - 2026-10-06
+
+### Fixed
+
+- **Memory safety: a typed cast stored the operator frame's stack
+  buffer in the result's borrowed `atomic_type` slot — read after
+  return by the sequence fold (ASAN stack-use-after-return, caught
+  by Linux CI on this very batch).** Cast targets now assign
+  lifetime-stable family-table labels.
+- **Recursive closures: a nested call sharing parameter names with
+  an outer frame removed the outer frame's bindings on exit —
+  `$a` vanished mid-recursion.** Both dynamic-call sites
+  detach/save the prior nodeset and restore it (fold-left/
+  fold-right-101..104: the spec'd recursive folds over `tail()`).
+
+### Added
+
+- **XQuery closure-call carriers, end-to-end — 19 more QT3
+  adoptions (for-each-010, for-each-pair-024/026/027, fold-left
+  -019/020/021/101..104, fold-right-013/019/020/101..104,
+  K2-SeqReverseFunc-1, cbcl-distinct-values-002).**
+  - `declare function` parameter types skip depth-aware — a
+    function-test type's own commas
+    (`$f as function(item()*, item()) as item()*`) broke the
+    parameter list; inline function literals accept `as TYPE`
+    annotations on params and the return.
+  - Callback arguments and accumulators keep their shape across
+    every hop: sequences ride the member carrier, empty sequences
+    bind zero nodes (`empty($acc)` on a `()` zero is true — the
+    average fold yields 8.625, min folds return 1), booleans stay
+    falsy through variable round-trips (and-folds return false).
+  - `xs:untypedAtomic` rides its own family mark: value-eq casts
+    it to the counterpart (cbcl-002 matches Saxon byte-for-byte)
+    while a plain `xs:string` never merges with typed values.
+  - QName tail: `namespace-uri-from-QName` resolves prefixed
+    lexical QNames in the static namespaces (`xs:int#1` → the
+    XMLSchema namespace); `castable/cast as xs:QName` accept
+    NCName:NCName lexicals; QName eq compares full lexicals.
+  - Range sequences and nodeset growth admit 1,000,000 items —
+    `fold-left(1 to 1000000, 0, ...)` computes the full million
+    (previously truncated at exactly 524288 items).
+  - Remaining QT3 pins are down to three, each documented in the
+    harness: fold-left-009/016 (node-typed accumulators must be
+    real nodes for path/identity shapes) and cbcl-002b (XQ10 vs
+    XQ30 value-eq contradiction).
+
+
 ## [1.9.309] - 2026-10-05
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.309
+    VERSION 1.9.311
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/src/include/leptris.h

@@ -1068,6 +1068,31 @@ LEPTRIS_API void leptris_document_free(LeptrisDocument doc);
 LEPTRIS_API void leptris_document_adopt_child(LeptrisDocument parent,
                                            LeptrisDocument child);
 
+/**
+ * Absorb a DOOMED source document into the destination: the source's
+ * node pool is released with the destination, so cross-document
+ * splices from source to destination move nodes by reference instead
+ * of deep-copying (#1548 — the #1528 adoption copy doubled the live
+ * set on scratch-document splice flows).
+ *
+ * After a successful absorb the caller must treat `src` as consumed:
+ * its tree may be spliced into `dst` (zero-copy), and the caller's
+ * leptris_document_free(src) releases only the handle — the memory
+ * dies with `dst`. Splicing an absorbed document's nodes into any
+ * OTHER document still deep-copies (#1528 semantics).
+ *
+ * @param dst Destination document (survives; owns src's pool)
+ * @param src Doomed source document (handle consumed)
+ * @return LEPTRIS_OK; LEPTRIS_ERROR_NULL_ARG on NULL arguments;
+ *         LEPTRIS_ERROR_INVALID_ARG when src == dst or src is
+ *         already absorbed (chaining is not supported).
+ *
+ * Memory: src's pool ownership transfers to dst. The caller's src
+ * handle becomes handle-only.
+ */
+LEPTRIS_API LeptrisStatus leptris_document_absorb(LeptrisDocument dst,
+                                               LeptrisDocument src);
+
 /**
  * Get root element of document
  *

data/vendor-src/libleptris/src/leptris/dom/element_modify.c

@@ -416,6 +416,10 @@ static LeptrisNode* adopt_for_splice(LeptrisNode* node,
             src = leaf_owner_doc(top);
         }
         if (!src || src == target) return node;
+        /* #1548: the source is a doomed scratch doc absorbed into
+         * the target — its pool dies with the target, so the node
+         * moves by reference. */
+        if (src->absorbed_by == target) return node;
         LeptrisNode* copy = copy_leaf_chain(node, target);
         return copy;
     }
@@ -430,6 +434,10 @@ static LeptrisNode* adopt_for_splice(LeptrisNode* node,
     struct leptris_document* src =
         leptris_element_get_document((LeptrisElement)top);
     if (!src || src == target) return node;
+    /* #1548: the source is a doomed scratch doc absorbed into
+     * the target — its pool dies with the target, so the subtree
+     * moves by reference (O(1), no live-set doubling). */
+    if (src->absorbed_by == target) return node;
     LeptrisElement copy =
         leptris_element_copy((LeptrisElement)node, target);
     return copy ? (LeptrisNode*)copy : NULL;

data/vendor-src/libleptris/src/leptris/leptris.c

@@ -884,6 +884,24 @@ LEPTRIS_API LeptrisDocument leptris_parse_file(const char* filepath, LeptrisStat
 /**
  * Free document and all its contents
  */
+LEPTRIS_API LeptrisStatus leptris_document_absorb(LeptrisDocument dst,
+                                               LeptrisDocument src) {
+    if (!dst || !src) return LEPTRIS_ERROR_NULL_ARG;
+    if (dst == src) return LEPTRIS_ERROR_INVALID_ARG;
+    /* No chains: an absorbed document's lifetime already belongs to
+     * its absorber; re-absorbing would give one pool two owners. */
+    if (src->absorbed_by || dst->absorbed_by)
+        return LEPTRIS_ERROR_INVALID_ARG;
+
+    /* Ride the xi:include child_docs chain (TODO 117): document_free
+     * releases adopted children with the parent, AFTER its own tree
+     * references are gone — exactly the #1548 lifetime. */
+    leptris_document_adopt_child(dst, src);
+    src->absorbed_by = dst;
+    src->absorbed_handle = 1;
+    return LEPTRIS_OK;
+}
+
 LEPTRIS_API void leptris_document_adopt_child(LeptrisDocument parent,
                                            LeptrisDocument child) {
     if (!parent || !child) return;
@@ -913,6 +931,14 @@ LEPTRIS_API void leptris_document_free(struct leptris_document* doc) {
     }
     if (!doc) return;
 
+    /* #1548: an absorbed document's MEMORY belongs to its absorber
+     * (it rides the absorber's child_docs chain). A caller free
+     * releases only the outstanding handle. */
+    if (doc->absorbed_by) {
+        doc->absorbed_handle = 0;
+        return;
+    }
+
     /* Decrement reference count */
     if (doc->ref_count > 0) {
         doc->ref_count--;
@@ -995,6 +1021,11 @@ LEPTRIS_API void leptris_document_free(struct leptris_document* doc) {
                                        * doesn't try to walk the
                                        * adopted subtree. */
             ch->root = NULL;
+            /* #1548: the anchor's free is the REAL one — clear the
+             * absorbed state so the early handle-return above does
+             * not swallow it. */
+            ch->absorbed_by = NULL;
+            ch->absorbed_handle = 0;
             leptris_document_free(ch);
             ch = next;
         }

data/vendor-src/libleptris/src/leptris/leptris_internal.h

@@ -179,10 +179,22 @@ struct leptris_document {
      * copies / analyze-string result trees, released with THIS
      * document so borrowed nodes live exactly as long as the
      * source tree (the ctx owned_docs chain dies at public-eval
-     * return and cannot serve plain leptris_xpath_eval results). */
+     * return and cannot serve plain leptris_xpath_eval results).
+     * Absorbed documents (#1548) ride the SAME chain: a doomed
+     * scratch doc's pool is released with the absorbing document,
+     * letting the splice adoption gate move nodes by reference. */
     struct leptris_document** anchored_docs;
     size_t n_anchored_docs;
     size_t cap_anchored_docs;
+    /* #1548 absorb-adoption: set by leptris_document_absorb on the
+     * SOURCE. absorbed_by owns this document's lifetime (it is in
+     * absorbed_by->anchored_docs); cross-document splice adoption
+     * into absorbed_by moves nodes by reference instead of
+     * copying. absorbed_handle counts outstanding CALLER handles:
+     * the caller's leptris_document_free releases only the handle
+     * (the anchor frees the memory later). */
+    struct leptris_document* absorbed_by;
+    int absorbed_handle;
     /* XML Declaration support */
     char* xml_version;              /* "1.0", "1.1", etc. or NULL if not present */
     int standalone;                 /* -1=not set, 0=no, 1=yes */

data/vendor-src/libleptris/src/leptris/xpath/evaluator.c

@@ -650,7 +650,7 @@ void xpath_nodeset_add(XPathNodeSet* nodeset, void* node) {
 
     /* SAFETY: Validate nodeset structure before reallocation
      * Corruption in count/capacity can cause heap corruption during realloc */
-    if (nodeset->count > nodeset->capacity || nodeset->capacity > 1000000) {
+    if (nodeset->count > nodeset->capacity || nodeset->capacity > 4000000) {
         /* Corrupted structure - skip this addition */
         return;
     }
@@ -659,8 +659,11 @@ void xpath_nodeset_add(XPathNodeSet* nodeset, void* node) {
     if (nodeset->count >= nodeset->capacity) {
         size_t new_capacity = nodeset->capacity == 0 ? 4 : nodeset->capacity * 2;
 
-        /* SAFETY: Check for overflow */
-        if (new_capacity > 1000000) {
+        /* SAFETY: Check for overflow. 4M admits the corpus's
+         * million-item range folds (`1 to 1000000` needs a
+         * power-of-two capacity ABOVE 1M — the old 1M bound
+         * truncated the sequence at exactly 524288). */
+        if (new_capacity > 4000000) {
             return;
         }