leptris 1.9.314.0 → 1.9.317.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb8126eafe8c4996a94eac86638223b042ad19562d410215d939bd00c9382a74
-  data.tar.gz: e55d86cec4c5607b17b3d7915385a09955f5ad071401b99708612fa95299e249
+  metadata.gz: b745c01d0d7ec0b75d4fe3a0b994fc5f2a95cdd58b7e318eaee8c33ce8a005c6
+  data.tar.gz: 0e17a0313b9d7ff6fd20b4eed9df95398d35592f3f6c92ce49455439610f3ed2
 SHA512:
-  metadata.gz: 35e631bde1b299ab4e5946b3dc3bae97e6dfea4d0a9ffd1bf3147cce8624e0cc252bd3019c32fdeb8900b2df49ef8304a9525de6c4c8f6a08ebe7e774a553665
-  data.tar.gz: 8df2e9db29263f460f693436ac58dcc951870a1915f30046321f8c0a37a66ca602cad09dfecc8e1af6f4f3ef7e2a034b16c04948deebdfe0b2367879e9fe5d49
+  metadata.gz: 28a4c82d4ea33fbfc9844a3c663b269943972da95d9a2339b30aa8c0cd3bc6a40d71748610a4d63c9cb55e8c856e4375c744c40c0065b9d808b8627be5102924
+  data.tar.gz: 7ace6d1ab6118f7fe3308543b42e6ebe60f91b84ad84297aa88dd892d42e8f26ab1f98961bc785393386cd31d45a209a9e27b93b73042bc914fc4f809f0a58f3

data/CHANGELOG.md

@@ -1,3 +1,49 @@
+## [1.9.317.1] - 2026-10-08
+
+### Fixed
+
+- **The published 1.9.317.0 gem predates PR #395**: a parallel
+  release race published 1.9.317.0 from the carrier-folds ride
+  (bd81bdf) before the `:unqualified` ns form merged — this patch
+  release carries the #1560 `ns: :unqualified` DSL (element rows
+  bind the unwritten spelling under both namespace-less and
+  default-xmlns documents; the serialize→re-parse→re-walk
+  round-trip agrees) and the #1565 nested-capture serialization
+  pin to the published artifact line. Main already carried both
+  (PR #395); only the gem lagged.
+
+## [1.9.317.0] - 2026-10-08
+
+### Added — engine sync (libleptris 1.9.315-1.9.317)
+
+- **Unqualified-only ns form for child rows (1.9.317, #1560)**:
+  `ns: :unqualified` matches the UNWRITTEN spelling — an
+  unprefixed child binds under both a namespace-less document and
+  a default-`xmlns` document, and prefixed spellings never bind
+  (the `NS_ANY` superset lutaml-model#932 had to settle for). The
+  form keys on the spelling, not the URI, so
+  serialize→re-parse→re-walk round-trips agree: a default-ns child
+  serializes bare and still re-binds. Element-row only (attributes
+  have no unprefixed namespace by XML rules). `PLAN_NS_UNQUALIFIED
+  = 3` attached; all three shapes + the round-trip spec-pinned.
+
+### Fixed — engine sync (1.9.316)
+
+- **Nested captures emit their own rows (#1565)**: a captured
+  child's rows resolve against the CAPTURING row's
+  `child_plan_index` plan, so a child bound by a nested row (the
+  `w:font`-in-`w:fonts` shape) serializes its own attribute and
+  child rows instead of silently vanishing — pinned through
+  `Descriptor#serialize`.
+
+### Engine sync (1.9.315)
+
+- Carrier-by-pointer node identity for the higher-order argument
+  channel (QT3 fold-left-009/016): element members keep their node
+  pointer, `intersect` dedups by node, single-element results ride
+  the carrier. Engine-internal to the XQuery engine — the binding
+  contract is unchanged (suite carries it).
+
 ## [1.9.314.0] - 2026-10-07
 
 ### Changed — engine sync (libleptris 1.9.314)

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.314"
+LIBLEPTRIS_VERSION = "1.9.317"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.314.0"
+  VERSION = "1.9.317.1"
 end

data/lib/leptris/xml/descriptor.rb

@@ -175,11 +175,15 @@ class Leptris::XML::Descriptor
         case ns
         when nil, :none then [Leptris::XML::FFI::PLAN_NS_NONE, nil]
         when :any then [Leptris::XML::FFI::PLAN_NS_ANY, nil]
+        when :unqualified
+          # libleptris 1.9.317 (#1560): the UNWRITTEN spelling.
+          [Leptris::XML::FFI::PLAN_NS_UNQUALIFIED, nil]
         when Hash
           [Leptris::XML::FFI::PLAN_NS_EXACT,
            anchor_string(anchors, ns.fetch(:exact))]
         else
-          raise ArgumentError, "ns must be :none, :any, or {exact: uri}"
+          raise ArgumentError,
+            "ns must be :none, :any, :unqualified, or {exact: uri}"
         end
       ep[:ns_form] = ns_form
       ep[:ns_uri] = ns_uri
@@ -230,10 +234,14 @@ class Leptris::XML::Descriptor
         # defaults to NONE for backward compatibility. WILDCARD
         # rows (#1552) read an explicit :ns through pad0 (an
         # explicit :none filters no-namespace remainder alone;
-        # unset stays the catch-all ANY default).
+        # unset stays the catch-all ANY default). :unqualified
+        # (libleptris 1.9.317, #1560) matches the unwritten
+        # spelling on element rows — element-row only (attributes
+        # have no unprefixed namespace by XML rules).
         cp[:ns_form] =
           case row[:ns]
           when :any then Leptris::XML::FFI::PLAN_NS_ANY
+          when :unqualified then Leptris::XML::FFI::PLAN_NS_UNQUALIFIED
           when Hash  then Leptris::XML::FFI::PLAN_NS_EXACT
           else         Leptris::XML::FFI::PLAN_NS_NONE
           end

data/lib/leptris/xml/ffi.rb

@@ -380,6 +380,13 @@ module Leptris
       PLAN_NS_NONE = 0
       PLAN_NS_EXACT = 1
       PLAN_NS_ANY = 2
+      # libleptris 1.9.317 (#1560): matches the UNWRITTEN spelling
+      # on element rows — no written prefix, regardless of the
+      # effective namespace URI (binds under both a namespace-less
+      # and a default-xmlns document; prefixed spellings never
+      # bind). Attributes have no unprefixed namespace by XML
+      # rules, so the form is element-row only.
+      PLAN_NS_UNQUALIFIED = 3
 
       PLAN_VALUE_ELEMENT = 0
       PLAN_VALUE_SCALAR = 1

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.314
+- libleptris v1.9.317
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,75 @@
 ## [Unreleased]
 
+## [1.9.317] - 2026-10-07
+
+### Added
+
+- **Descriptor: unqualified-only ns form for child rows (#1560,
+  PR #1574).** `LEPTRIS_PLAN_NS_UNQUALIFIED = 3` matches the WRITTEN
+  spelling — a child row binds children with no written prefix
+  regardless of the effective namespace URI, and refuses prefixed
+  spellings. An unprefixed child binds under both a namespace-less
+  document and a default-`xmlns` document (`NS_NONE` drops the
+  latter); a `p:child` never binds (the `NS_ANY` superset
+  lutaml-model#932 had to settle for). The serialize -> re-parse ->
+  re-walk round-trip agrees on all three shapes because the form
+  keys on the spelling, not the URI: the serializer emits prefix
+  declarations only, so a default-ns child serializes bare and
+  still re-binds. Rust descriptor-ABI mirror shipped in the same
+  wave (leptris-rs#4).
+
+
+
+## [1.9.316] - 2026-10-07
+
+### Fixed
+
+- **Descriptor plan serializer: nested captures emit their own rows
+  (#1565, PR #1573).** A captured child's rows now resolve against the
+  CAPTURING row's `child_plan_index` plan instead of the plan that
+  walked it, so a child bound by a nested row (the `w:font`-in-
+  `w:fonts` shape) serializes its own attribute and child rows —
+  previously they resolved against the parent plan and silently
+  vanished. CONTENT rows inline their text at every nesting level.
+  The new nested-capture spec also exposed a 2 x 16B leak: the inner
+  walk's ns stamp was overwritten without freeing; fixed
+  free-before-overwrite (leaks gate clean).
+
+
+
+## [1.9.315] - 2026-10-07
+
+### Added
+
+- **Carrier-by-pointer node identity — QT3 fold-left-009/016
+  adopted (PR #1571).** Element members riding the higher-order
+  function argument channel keep their NODE POINTER (the \x03P
+  carrier), so node identity survives a string-typed channel:
+  `$foundSoFar intersect $this` dedups by node (fold-left-009's
+  distinct-nodes-stable), and fold results decode to real nodes so
+  `$result/text()` steps (fold-left-016's css-selector interpreter).
+  The fold suite runs 16/16 — both long-pinned cases adopted.
+  Pointers are eval-safe: constructor documents anchor on the
+  source tree (the #691 discipline). Along the way, three language
+  gaps closed: typeswitch arms accept `element(id)` /
+  `element(class)` NAME arguments with case-bound variables binding
+  node operands as nodes; keyword-named constructors parse
+  (`<div/>`, `<mod/>` — HTML tag names colliding with XQuery
+  operators); and single-element results ride the carrier instead
+  of collapsing to their string value.
+
+### Fixed
+
+- **Pointer carriers only for real ELEMENT members.** The item
+  collector handed \x03P carriers to synthetic attribute and
+  namespace nodes too — heap-owned by the carrying nodeset, so the
+  carrier dangled once it was freed (AddressSanitizer
+  heap-use-after-free via fn:subsequence over an attribute step).
+  Real elements stay document-anchored for the evaluation;
+  attributes and namespaces keep the markup snapshot.
+
+
+
 ## [1.9.314] - 2026-10-07
 
 ### Added

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.314
+    VERSION 1.9.317
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/bindings/rust/descriptor/src/lib.rs

@@ -49,6 +49,12 @@ pub type PlanNsForm = u8;
 pub const PLAN_NS_NONE: PlanNsForm = 0;
 pub const PLAN_NS_EXACT: PlanNsForm = 1;
 pub const PLAN_NS_ANY: PlanNsForm = 2;
+/// #1560: matches the UNWRITTEN spelling — no written prefix,
+/// regardless of the effective namespace URI. An unprefixed child
+/// binds under both a namespace-less document and a default-xmlns
+/// document; prefixed spellings never bind. Element rows only
+/// (unprefixed attributes have no namespace by XML rules).
+pub const PLAN_NS_UNQUALIFIED: PlanNsForm = 3;
 
 /// Result node kinds (the value tree a walk returns).
 pub type PlanValueKind = i32;

data/vendor-src/libleptris/bindings/rust/descriptor/tests/layout.rs

@@ -34,6 +34,7 @@ fn kind_and_flag_constants_match_engine_headers() {
     assert_eq!(PLAN_NS_NONE, 0);
     assert_eq!(PLAN_NS_EXACT, 1);
     assert_eq!(PLAN_NS_ANY, 2);
+    assert_eq!(PLAN_NS_UNQUALIFIED, 3);
     assert_eq!(PLAN_VALUE_ELEMENT, 0);
     assert_eq!(PLAN_VALUE_SCALAR, 1);
     assert_eq!(PLAN_VALUE_COLLECTION, 2);

data/vendor-src/libleptris/cli/commands/xquery.c

@@ -119,16 +119,28 @@ static cli_result_t xquery_run(int argc, char** argv) {
         cli_error("XQuery evaluation failed");
         rc = CLI_ERROR_XPATH;
     } else if (leptris_xpath_result_type(r) == LEPTRIS_XPATH_NODESET) {
+        /* carrier-by-pointer (fold-left-009/016): synth members may
+         * carry a node pointer — render its markup. */
+        extern void* xpath_carrier_node_of(const char* s);
         size_t n = leptris_xpath_result_count(r);
         for (size_t k = 0; k < n; k++) {
             if (k) putchar(' ');
+            LeptrisElement el = NULL;
+            if (leptris_xpath_result_node_kind(r, k) ==
+                LEPTRIS_XPATH_NODE_ELEMENT) {
+                el = leptris_xpath_result_get(r, k);
+            } else {
+                const char* raw =
+                    leptris_xpath_result_node_value(r, k);
+                if (raw && (unsigned char)raw[0] == 0x03 &&
+                    raw[1] == 'P')
+                    el = (LeptrisElement)xpath_carrier_node_of(raw);
+            }
             /* Constructed elements (#181) are real nodes now — print
              * their serialized markup, not the string-value (the
              * pre-node ctor spelling printed markup too). */
-            if (leptris_xpath_result_node_kind(r, k) ==
-                LEPTRIS_XPATH_NODE_ELEMENT) {
-                char* m = leptris_element_serialize(
-                    leptris_xpath_result_get(r, k), NULL);
+            if (el) {
+                char* m = leptris_element_serialize(el, NULL);
                 fputs(m ? m : "", stdout);
                 leptris_free_string(m);
             } else {

data/vendor-src/libleptris/src/include/leptris/descriptor.h

@@ -96,7 +96,14 @@ typedef enum {
 typedef enum {
     LEPTRIS_PLAN_NS_NONE = 0,  /* only elements with no namespace */
     LEPTRIS_PLAN_NS_EXACT = 1, /* resolved namespace URI equals ns_uri */
-    LEPTRIS_PLAN_NS_ANY = 2
+    LEPTRIS_PLAN_NS_ANY = 2,
+    /* #1560: matches the UNWRITTEN spelling — children with no
+     * prefix, regardless of the effective namespace URI. An
+     * unprefixed child binds under both a namespace-less document
+     * and a default-xmlns document; prefixed spellings never bind.
+     * Unprefixed attributes have no namespace by XML rules, so
+     * this form only applies to element rows. */
+    LEPTRIS_PLAN_NS_UNQUALIFIED = 3
 } LeptrisPlanNsForm;
 
 typedef struct {

data/vendor-src/libleptris/src/leptris/descriptor/plan.c

@@ -562,6 +562,11 @@ static int dp_ns_binds(LeptrisElement elem, uint8_t ns_form,
         case LEPTRIS_PLAN_NS_ANY:
         default:
             return 1;
+        case LEPTRIS_PLAN_NS_UNQUALIFIED:
+            /* #1560: the WRITTEN spelling — no prefix, any
+             * effective URI (default-xmlns elements included);
+             * prefixed spellings never bind. */
+            return prefix == NULL;
     }
 }
 
@@ -852,6 +857,11 @@ static int dp_walk_children(LeptrisElement elem, const dp_plan* plan,
                  * back to the target plan's (NESTED matches with
                  * the target's form, #1115). */
                 if (row->ns_prefix) {
+                    /* The inner walk's own #1551 stamp may already
+                     * hold this pair — free before overwriting or
+                     * the first strdup orphans. */
+                    free(v->ns_prefix);
+                    free(v->ns_uri);
                     v->ns_prefix = dp_strdup(row->ns_prefix);
                     v->ns_uri = dp_strdup(row->ns_uri ? row->ns_uri
                                                       : target->ns_uri);
@@ -1343,7 +1353,8 @@ static int dp_emit_value(const struct leptris_plan_result* v,
 
 static int dp_emit_element(const struct leptris_plan_result* v,
                            const char* name, const LeptrisPlan pool,
-                           dp_sb* b, const dp_decls* decls, int is_root) {
+                           const dp_plan* kids_container, dp_sb* b,
+                           const dp_decls* decls, int is_root) {
     if (!dp_emit_element_open(v, name, b, decls, is_root)) return 0;
     const struct leptris_plan_result** kids = NULL;
     size_t nk = 0, cap = 0;
@@ -1360,11 +1371,14 @@ static int dp_emit_element(const struct leptris_plan_result* v,
         return 0;
     }
     qsort((void*)kids, nk, sizeof(*kids), dp_kid_pos_cmp);
-    const dp_plan* container =
-        &((const struct leptris_plan*)pool)->plans[v->container_plan];
+    /* #1565: kid ROWS live in the plan that WALKED this element —
+     * container_plan is the plan whose row CAPTURED it (the
+     * parent), so a nested member resolved its kids' rows against
+     * the parent's rows and a CONTENT row serialized as an
+     * empty-named wrapper. */
     int ok = 1;
     for (size_t i = 0; i < nk && ok; i++)
-        ok = dp_emit_value(kids[i], container, pool, b, NULL, 0);
+        ok = dp_emit_value(kids[i], kids_container, pool, b, NULL, 0);
     free((void*)kids);
     if (!ok) return 0;
     return dp_sb_puts(b, "</") && dp_sb_puts(b, name) &&
@@ -1377,6 +1391,16 @@ static int dp_emit_value(const struct leptris_plan_result* v,
     if (v->kind == LEPTRIS_PLAN_VALUE_RAW)
         return dp_sb_puts(b, v->str ? v->str : "");
     if (v->kind == LEPTRIS_PLAN_VALUE_ELEMENT) {
+        /* #1565: a walk member captured by a CONTENT row is an
+         * unnamed element — the row lookup must precede the name
+         * resolution, or the empty wire name becomes the wrapper
+         * (<w:item><>text</></w:item>). Content emits inline text
+         * at every nesting level. */
+        if (container && v->row_index != UINT32_MAX &&
+            v->row_index < container->child_count &&
+            container->child_plans[v->row_index].kind ==
+                LEPTRIS_PLAN_KIND_CONTENT)
+            return dp_sb_escape(b, v->str ? v->str : "", 0);
         /* The element's own binding was stamped at walk time; a
          * walk member without one falls back to its plan's. */
         char* name = NULL;
@@ -1397,7 +1421,24 @@ static int dp_emit_value(const struct leptris_plan_result* v,
         else
             name = dp_strdup(local ? local : "");
         if (!name) return 0;
-        int ok = dp_emit_element(v, name, pool, b, decls, is_root);
+        /* Kids resolve their rows against the plan that WALKED this
+         * element: the capturing row's child_plan_index when nested,
+         * else container_plan (the walk root is its own plan). */
+        const struct leptris_plan* poolp =
+            (const struct leptris_plan*)pool;
+        const dp_plan* kids_container =
+            &poolp->plans[v->container_plan];
+        if (container && v->row_index != UINT32_MAX &&
+            v->row_index < container->child_count) {
+            const leptris_child_plan* cap =
+                &container->child_plans[v->row_index];
+            if (cap->child_plan_index >= 0 &&
+                (uint32_t)cap->child_plan_index < poolp->plan_count)
+                kids_container =
+                    &poolp->plans[cap->child_plan_index];
+        }
+        int ok = dp_emit_element(v, name, pool, kids_container, b,
+                                 decls, is_root);
         free(name);
         return ok;
     }

data/vendor-src/libleptris/src/leptris/xpath/evaluator_operators.c

@@ -147,6 +147,8 @@ extern char* get_node_text(void* node);
 /* functions_ext31.c — #691 source-document anchoring (#181 ctor docs). */
 extern int xq_anchor_on_source(XPathContext* ctx,
                                struct leptris_document* anchored);
+/* carrier-by-pointer decode (fold-left-009/016). */
+extern void* xpath_carrier_node_of(const char* s);
 
 /* #181: a materialized ctor node splices its MARKUP into a
  * parent's serialized content — get_node_text would yield only its
@@ -791,6 +793,7 @@ static int op_relational_cmp(XPathOperatorType op, double a, double b) {
  * `instance of` and XQuery typeswitch. */
 int xpath_result_matches_type(struct leptris_xpath_result* v,
                               const char* base) {
+    extern const char* leptris_element_get_name(LeptrisElement e);
     int is_string_ty = strcmp(base, "xs:string") == 0 ||
                        strcmp(base, "xs:anyURI") == 0 ||
                        strncmp(base, "xs:date", 7) == 0 ||
@@ -801,7 +804,9 @@ int xpath_result_matches_type(struct leptris_xpath_result* v,
                     strcmp(base, "node()") != 0 &&
                     strcmp(base, "item()") != 0 &&
                     strcmp(base, "element()") != 0 &&
+                    strncmp(base, "element(", 8) != 0 &&
                     strcmp(base, "attribute()") != 0 &&
+                    strncmp(base, "attribute(", 10) != 0 &&
                     strcmp(base, "text()") != 0 &&
                     strcmp(base, "comment()") != 0 &&
                     strcmp(base, "processing-instruction()") != 0;
@@ -825,6 +830,22 @@ int xpath_result_matches_type(struct leptris_xpath_result* v,
                 if (!(tag >= 0 && tag <= 7)) return 0;
             } else if (strcmp(base, "element()") == 0) {
                 if (tag != (int)LEPTRIS_NODE_ELEMENT) return 0;
+            } else if (strncmp(base, "element(", 8) == 0) {
+                /* ElementTest with a NAME: element(id) matches
+                 * local-name "id" (fold-left-016 selector arms);
+                 * element(*) is any element. */
+                size_t bl = strlen(base);
+                if (tag != (int)LEPTRIS_NODE_ELEMENT || bl < 10 ||
+                    base[bl - 1] != ')')
+                    return 0;
+                if (!(bl == 11 && base[9] == '*')) {
+                    const char* en =
+                        leptris_element_get_name((LeptrisElement)n);
+                    size_t nl = bl - 9;
+                    if (!en || strlen(en) != nl ||
+                        strncmp(en, base + 8, nl) != 0)
+                        return 0;
+                }
             } else if (strcmp(base, "attribute()") == 0) {
                 if (tag != (int)LEPTRIS_NODE_ATTRIBUTE) return 0;
             } else if (strcmp(base, "text()") == 0) {
@@ -1889,9 +1910,18 @@ struct leptris_xpath_result* evaluate_operator(XPathContext* ctx,
                     if (sv && sv[0] == '\x03' && sv[1] == 'M' &&
                         xpath_array_members_of(sv, &mem, &mn) && mn) {
                         for (size_t j = 0; j < mn; j++) {
-                            XPathTextNode* tn = synth_text(
-                                mem[j], strlen(mem[j]));
-                            if (tn) xpath_nodeset_add(one, tn);
+                            /* carrier-by-pointer: element members
+                             * decode to their NODE (identity —
+                             * fold-left-009/016). */
+                            void* cn = xpath_carrier_node_of(mem[j]);
+                            if (cn) {
+                                xpath_nodeset_add(one,
+                                                  (LeptrisNode*)cn);
+                            } else {
+                                XPathTextNode* tn = synth_text(
+                                    mem[j], strlen(mem[j]));
+                                if (tn) xpath_nodeset_add(one, tn);
+                            }
                             free(mem[j]);
                         }
                         free(mem);
@@ -1900,11 +1930,19 @@ struct leptris_xpath_result* evaluate_operator(XPathContext* ctx,
                                sv[1] == 'E') {
                         free(sv);
                     } else {
-                        XPathTextNode* tn =
-                            synth_text(sv ? sv : "",
-                                       sv ? strlen(sv) : 0);
-                        free(sv);
-                        if (tn) xpath_nodeset_add(one, tn);
+                        void* cn =
+                            xpath_carrier_node_of(sv ? sv : "");
+                        if (cn) {
+                            xpath_nodeset_add(one, (LeptrisNode*)cn);
+                        } else {
+                            XPathTextNode* tn =
+                                synth_text(sv ? sv : "",
+                                           sv ? strlen(sv) : 0);
+                            free(sv);
+                            if (tn) xpath_nodeset_add(one, tn);
+                            sv = NULL;
+                        }
+                        if (sv) free(sv);
                     }
                 }
                 XPathVariable* ex = xpath_variable_set_get(
@@ -2045,11 +2083,26 @@ struct leptris_xpath_result* evaluate_operator(XPathContext* ctx,
                     XPathNodeSet* one = xpath_nodeset_new();
                     if (one) {
                         one->owns_synthetic_text = 1;
-                        const char* bindv =
-                            marked ? marked : (vs_ ? vs_ : "");
-                        XPathTextNode* tn = xpath_synth_text(
-                            bindv, strlen(bindv));
-                        if (tn) xpath_nodeset_add(one, tn);
+                        if (v->type == XPATH_RESULT_NODESET &&
+                            v->value.nodeset_value &&
+                            v->value.nodeset_value->count > 0) {
+                            /* Node operands bind AS NODES — the arm
+                             * body steps axes on them
+                             * (fold-left-016: $a/text()); a
+                             * string-value synth has no children. */
+                            for (size_t xi = 0;
+                                 xi < v->value.nodeset_value->count;
+                                 xi++)
+                                xpath_nodeset_add(
+                                    one,
+                                    v->value.nodeset_value->nodes[xi]);
+                        } else {
+                            const char* bindv =
+                                marked ? marked : (vs_ ? vs_ : "");
+                            XPathTextNode* tn = xpath_synth_text(
+                                bindv, strlen(bindv));
+                            if (tn) xpath_nodeset_add(one, tn);
+                        }
                         XPathVariable* var = xpath_variable_set_add(
                             vs, vn, XPATH_VAR_TYPE_NODE_SET);
                         if (var)
@@ -4377,6 +4430,17 @@ struct leptris_xpath_result* xpath_call_function_item(
                          * typed/untyped carrier marks the M members
                          * now carry. */
                         const char* mv = mem[j];
+                        void* cn = xpath_carrier_node_of(mv);
+                        if (cn) {
+                            /* Node members atomize to their string
+                             * value (XDM function conversion). */
+                            const char* sv =
+                                leptris_element_text((LeptrisElement)cn);
+                            kids[j].value =
+                                (char*)(sv ? sv : "");
+                            karr[j] = &kids[j];
+                            continue;
+                        }
                         if (mv && mv[0] == '\x03' && mv[1] &&
                             mv[1] != 'A' && mv[1] != 'M')
                             mv += 2;
@@ -4408,8 +4472,16 @@ struct leptris_xpath_result* xpath_call_function_item(
                 else if (argv[i] && argv[i][0] == '\x03' &&
                          argv[i][1] == 'E')
                     argn[i].value = "";
-                else
-                    argn[i].value = argv[i];
+                else {
+                    void* cn = xpath_carrier_node_of(argv[i]);
+                    if (cn) {
+                        const char* sv = leptris_element_text(
+                            (LeptrisElement)cn);
+                        argn[i].value = (char*)(sv ? sv : "");
+                    } else {
+                        argn[i].value = argv[i];
+                    }
+                }
             }
             child_arr[i] = &argn[i];
         }
@@ -4476,17 +4548,30 @@ struct leptris_xpath_result* xpath_call_function_item(
             if (argv[ai][0] == '\x03' && argv[ai][1] == 'M' &&
                 xpath_array_members_of(argv[ai], &mem, &mn) && mn) {
                 for (size_t j = 0; j < mn; j++) {
-                    XPathTextNode* tn =
-                        synth_text(mem[j], strlen(mem[j]));
-                    if (tn) xpath_nodeset_add(one, tn);
+                    /* carrier-by-pointer: element members decode to
+                     * their NODE (identity — fold-left-009/016);
+                     * borrowed, not synth. */
+                    void* cn = xpath_carrier_node_of(mem[j]);
+                    if (cn) {
+                        xpath_nodeset_add(one, (LeptrisNode*)cn);
+                    } else {
+                        XPathTextNode* tn =
+                            synth_text(mem[j], strlen(mem[j]));
+                        if (tn) xpath_nodeset_add(one, tn);
+                    }
                     free(mem[j]);
                 }
                 free(mem);
             } else if (!(argv[ai][0] == '\x03' &&
                          argv[ai][1] == 'E')) {
-                XPathTextNode* tn =
-                    synth_text(argv[ai], strlen(argv[ai]));
-                if (tn) xpath_nodeset_add(one, tn);
+                void* cn = xpath_carrier_node_of(argv[ai]);
+                if (cn) {
+                    xpath_nodeset_add(one, (LeptrisNode*)cn);
+                } else {
+                    XPathTextNode* tn =
+                        synth_text(argv[ai], strlen(argv[ai]));
+                    if (tn) xpath_nodeset_add(one, tn);
+                }
             }
             /* "\x03E": the empty sequence binds NO nodes, so
              * empty($p) is true (fold zero accumulators). */

data/vendor-src/libleptris/src/leptris/xpath/functions.c

@@ -1120,6 +1120,26 @@ static size_t de_collect(struct leptris_xpath_result* r, DeItem* out,
                 if (c[0] == '\x03' && c[1] == 'B') {
                     out[i].kind = 3;
                     out[i].num = c[2] == 't' ? 1 : 0;
+                } else if (c[0] == '\x03' && c[1] == 'P') {
+                    /* carrier-by-pointer: decode to the NODE's
+                     * MARKUP so both sides compare as markup
+                     * strings (real elements collect as markup in
+                     * the element branch below); the markup compare
+                     * reparses into de_node_equal. */
+                    extern void* xpath_carrier_node_of(const char*);
+                    extern char* ctor_member_markup(void* node);
+                    void* cn = xpath_carrier_node_of(c);
+                    if (cn) {
+                        out[i].kind = 2;
+                        out[i].str = ctor_member_markup(cn);
+                        if (!out[i].str) {
+                            out[i].kind = 0;
+                            out[i].node = cn;
+                        }
+                    } else {
+                        out[i].kind = 2;
+                        out[i].borrow = c;
+                    }
                 } else if (c[0] == '\x03' && c[1] == 'A') {
                     /* attribute ctor carrier: kind 4 compares
                      * name + value (K2-SeqDeepEqualFunc-25/31/32) */