leptris 1.9.380.0 → 1.9.380.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ccc2364b66198cffb6a8c5e3d297ec702527af36dd81967fdfaf3e9e06427c7f
-  data.tar.gz: 6949f57cb88a76163807e867dc693a1bb4aa98a8aca21261396cdd1c5cd235e0
+  metadata.gz: 213b5096ca73813ee05e8816632f5f3f0e0cbae5744b477b5cecb7acae15ad2b
+  data.tar.gz: 23ea9d5f3ddb5f067e5bc90b29599e47df1418336bff8caa1b3fb139202079fe
 SHA512:
-  metadata.gz: 92ae7adab3e90040f2966d0229889ee2c5f88a48dfcf12eb7970fd8da442c9c14de1fd0d4006e74cd9994da680eb3027014ee327a8a467e58924383273183db4
-  data.tar.gz: 1671aa48103b3229f27bb4949074f9596d2d260f473587f4c16cd6956c4c70827685f822dd58139f90106a40d7ef539ea722393f95220a6bdfd82072ffb1420a
+  metadata.gz: ca38fd56c66cf502830190aed494c9371571477c2d4609d93dcc942ff98b7c34503ffe34f61dda5148aa63306f1386b4b99c022d587be5cb6b19e79e103ef8f2
+  data.tar.gz: 07ff974cc3fee133d576d76cbf205422235d6cc7656ade52f0d50453c8cc0232f6d648969e6aa2d3778f15e3417f1a30b75b07e93e8124054b75b47a0c876f62

data/CHANGELOG.md

@@ -1,3 +1,22 @@
+## [Unreleased]
+
+### Fixed — engine ride
+
+- **Ride libleptris 1.9.380**: the xsi:type conformance fix
+  (leptris/leptris#1832, lutaml/moxml#433) — an element carrying
+  `xsi:type` is assessed against the NAMED type (XSD 1.0
+  §2.6.2/§3.3.4), so valid xsi:type-derived instances validate
+  instead of being rejected against the declared type's content
+  model. Released 1.9.380.0 with the pin still at 1.9.379 (the
+  vendored dylib missed the fix); this pin bump is the real ride.
+
+### Fixed — engine ride (1.9.380.2)
+
+- **Bulk XPath priming face rides (leptris/leptris-ruby#537)**:
+  `xpath_result_rows_bulk` gains the mx_context/mx_adapter birth-prime
+  parameters and marks all-native results; 1.9.380.1 shipped before
+  the PR merged, so the face rides in 1.9.380.2.
+
 ## [1.9.379.3] - 2026-10-22
 
 ### Fixed

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.379"
+LIBLEPTRIS_VERSION = "1.9.380"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/ext/leptris/native/native.c

@@ -203,6 +203,10 @@ static VALUE binding_klass_for(int kind);
 static VALUE c_iteration_scope;
 static VALUE c_leptris_error;
 static VALUE c_b_document, c_b_freed, c_ffi_pointer;
+/* BulkIdentityRows resolves lazily like the binding classes: the
+ * module lives in native_layer.rb, which optional consumers load. */
+static VALUE c_bulk_rows_mark = Qundef;
+static ID id_bulk_rows_mark;
 static ID id_ptr_new, id_freed_new, id_alive;
 static ID id_iv_c_address, id_iv_document, id_iv_parent;
 static ID id_iv_mx_context, id_iv_mx_adapter, id_iv_mx_native;
@@ -221,8 +225,23 @@ struct native_node {
      * Slot beats the hash memo on repeat reads of one name. */
     VALUE attr_key, attr_val, attr_ver;
     VALUE content_val, content_ver;
+    /* Walk-read memos (leptris-ruby#530): the element name and the
+     * children list, the two reads a tree walk pays per node. The
+     * children memo is what the subtree prime (#527 machinery)
+     * fills; the version stamp retires both on any mutation. The
+     * children list is SHARED with callers until the version moves
+     * (the mutation that would invalidate it also retires the
+     * memo) — treat it as read-only, like an interned String. */
+    VALUE name_val, name_ver;
+    VALUE children_val, children_ver;
 };
 
+static VALUE columnar_node_for(VALUE document, VALUE owner_klass,
+                               void *ptr, int kind);
+static VALUE doc_klass_for_kind(VALUE document, int kind);
+static VALUE nn_prime_children_of(VALUE document, VALUE owner_klass,
+                                  void *node, VALUE ver);
+
 static void nn_mark(void *p)
 {
     struct native_node *n = p;
@@ -234,6 +253,10 @@ static void nn_mark(void *p)
         rb_gc_mark(n->attr_val);
     if (n->content_val != Qnil)
         rb_gc_mark(n->content_val);
+    if (n->name_val != Qnil)
+        rb_gc_mark(n->name_val);
+    if (n->children_val != Qnil)
+        rb_gc_mark(n->children_val);
 }
 
 static size_t nn_size(const void *p) { (void)p; return sizeof(struct native_node); }
@@ -367,7 +390,19 @@ static VALUE nn_name(VALUE self)
 {
     struct native_node *n;
     const char *s;
+    VALUE doc, ver;
+
     TypedData_Get_Struct(self, struct native_node, &nn_type, n);
+    /* Walk-memo hit (leptris-ruby#530): a repeat name read is two
+     * struct reads and a Fixnum compare — the subtree prime fills
+     * this slot ahead of the walk, so walked names never recompute
+     * (or re-intern) until the next mutation. */
+    doc = n->document;
+    if (doc != Qnil) {
+        ver = rb_ivar_get(doc, id_iv_version);
+        if (n->name_ver == ver)
+            return n->name_val;
+    }
     s = f_elem_name(n->ptr);
     /* Interned (shared, frozen) fstring: element names repeat
      * massively across a document — one RString per distinct name
@@ -375,7 +410,13 @@ static VALUE nn_name(VALUE self)
      * ~18% of consumer materialize allocations were fresh name
      * strings). Names are identifiers; nothing downstream mutates
      * them in place (renames mint new strings). */
-    return s ? rb_enc_interned_str(s, strlen(s), rb_utf8_encoding()) : Qnil;
+    VALUE name = s ? rb_enc_interned_str(s, strlen(s), rb_utf8_encoding())
+                   : Qnil;
+    if (doc != Qnil) {
+        n->name_val = name;
+        n->name_ver = ver;
+    }
+    return name;
 }
 
 static VALUE nn_content(VALUE self)
@@ -563,14 +604,43 @@ static VALUE nn_children(VALUE self)
     void **buf;
     int *kinds;
     int count, i;
-    VALUE cache, out, owner_klass;
+    VALUE cache, out, owner_klass, doc, ver;
 
     TypedData_Get_Struct(self, struct native_node, &nn_type, n);
+    /* Walk-memo hit (leptris-ruby#530): the subtree prime (or an
+     * earlier read) filled this node's list against the current
+     * mutation version — serve it, engine walk skipped. */
+    doc = n->document;
+    if (doc != Qnil) {
+        ver = rb_ivar_get(doc, id_iv_version);
+        if (n->children_ver == ver)
+            return n->children_val;
+        /* Registered-consumer documents (#340 doc-klass map = the
+         * moxml mint registration) walk whole subtrees top-down:
+         * the FIRST cold children_read trades itself for ONE
+         * subtree crossing that fills every node's name + children
+         * memo (walk_columnar machinery, native-cache identity —
+         * the primed wrappers ARE the answers later reads give).
+         * Unregistered documents keep the per-node fetch; both
+         * paths memo-store below. */
+        if (!NIL_P(doc_klass_for_kind(doc, NT_ELEMENT))) {
+            out = nn_prime_children_of(doc, rb_obj_class(self), n->ptr,
+                                       ver);
+            n->children_val = out;
+            n->children_ver = ver;
+            return out;
+        }
+    }
     count = fetch_children_two_call(n->ptr, &buf, &kinds);
     if (count <= 0) {
         ruby_xfree(buf);
         ruby_xfree(kinds);
-        return rb_ary_new2(0);
+        out = rb_ary_new2(0);
+        if (doc != Qnil) {
+            n->children_val = out;
+            n->children_ver = ver;
+        }
+        return out;
     }
 
     cache = native_cache_of(n->document);
@@ -592,6 +662,10 @@ static VALUE nn_children(VALUE self)
     }
     ruby_xfree(buf);
     ruby_xfree(kinds);
+    if (doc != Qnil) {
+        n->children_val = out;
+        n->children_ver = ver;
+    }
     return out;
 }
 
@@ -1940,18 +2014,28 @@ static VALUE nf_at_xpath_first(VALUE self, VALUE document,
  * Nodesets free the handle here (TODO.perf/22 eager discipline);
  * non-nodeset results return Qnil UNFREED — the caller keeps the
  * scalar path, whose wrap owns the free. */
-static VALUE nf_xpath_result_rows_bulk(VALUE self, VALUE document,
-                                       VALUE result_addr)
+static VALUE nf_xpath_result_rows_bulk(int argc, VALUE *argv, VALUE self)
 {
-    void *result = (void *)(uintptr_t)NUM2ULL(result_addr);
+    VALUE document, result_addr, mx_context, mx_adapter;
+    void *result;
     void **buf;
     int *kinds;
     size_t scount;
     long i, n;
     VALUE cache, out;
+    int all_native;
 
     (void)self;
     resolve_binding_classes();
+    /* Optional (context, adapter): when the consumer passes its
+     * contract state, every registered-klass row is born primed
+     * (@native is the node itself, @context/@adapter written here)
+     * and an all-native result extends with BulkIdentityRows —
+     * the consumer's per-row wrap prime disappears from the
+     * iterate-every-result lane (same triple as nn_create_element). */
+    rb_scan_args(argc, argv, "22", &document, &result_addr,
+                 &mx_context, &mx_adapter);
+    result = (void *)(uintptr_t)NUM2ULL(result_addr);
     if (f_xp_type(result) != 0) /* XPATH_NODESET only */
         return Qnil;
 
@@ -1969,6 +2053,7 @@ static VALUE nf_xpath_result_rows_bulk(VALUE self, VALUE document,
     n = (long)scount;
     out = rb_ary_new_capa(n);
     cache = binding_cache_of(document);
+    all_native = !NIL_P(mx_context);
     for (i = 0; i < n; i++) {
         void *ptr = buf[i];
         int tag;
@@ -1988,10 +2073,17 @@ static VALUE nf_xpath_result_rows_bulk(VALUE self, VALUE document,
                 node = rb_hash_aref(native_cache_of(document), key);
                 if (NIL_P(node))
                     node = mint_consumer_node(mk, document, ptr);
+                if (all_native &&
+                    !rb_ivar_defined(node, id_iv_mx_context)) {
+                    rb_ivar_set(node, id_iv_mx_native, node);
+                    rb_ivar_set(node, id_iv_mx_context, mx_context);
+                    rb_ivar_set(node, id_iv_mx_adapter, mx_adapter);
+                }
                 rb_ary_push(out, node);
                 continue;
             }
         }
+        all_native = 0;
         node = materialize_xp_entry(document, cache, result, ptr,
                                     kinds[i], (int)i);
         if (node == m_native_sentinel) {
@@ -2005,6 +2097,22 @@ static VALUE nf_xpath_result_rows_bulk(VALUE self, VALUE document,
     ruby_xfree(buf);
     ruby_xfree(kinds);
     f_xp_free(result);
+    if (all_native) {
+        /* Certificate for the consumer's fast row loop: every row
+         * is a born-primed, registered-klass identity native. The
+         * module lives in the Ruby layer (native_layer.rb) and may
+         * not be loaded on faces used without it — an unresolved
+         * mark degrades to the unmarked Array, never an error. */
+        if (c_bulk_rows_mark == Qundef) {
+            VALUE m_xml = rb_path2class("Leptris::XML");
+            c_bulk_rows_mark =
+                rb_const_defined_at(m_xml, id_bulk_rows_mark)
+                    ? rb_const_get_at(m_xml, id_bulk_rows_mark)
+                    : Qnil;
+        }
+        if (c_bulk_rows_mark != Qnil)
+            rb_extend_object(out, c_bulk_rows_mark);
+    }
     return out;
 }
 
@@ -2599,6 +2707,58 @@ static void walk_columnar_impl(VALUE document, VALUE owner_klass,
     }
 }
 
+/* ---- Subtree memo priming (leptris-ruby#530) ---------------------
+ * Registered-consumer documents (the #340 doc-klass map — moxml's
+ * mint registration) walk whole subtrees top-down, so the FIRST
+ * cold children_read fills every ELEMENT's name + children read
+ * memos in ONE crossing, reusing the walk_columnar machinery and
+ * minting through columnar_node_for (native-cache identity — the
+ * primed wrappers ARE the answers later reads hand back). Memos
+ * are version-stamped like the content memo: any mutation bumps
+ * @version and retires them subtree-wide.
+ *
+ * Conservative by construction: only ELEMENT descendants get their
+ * memos filled here (the one kind whose f_first_child chain IS its
+ * children list, the #527 contract); leaf and shell kinds keep the
+ * per-node fetch, which memo-stores the same way. The receiver's
+ * own name memo is left to nn_name (one node, once). */
+static VALUE nn_prime_children_of(VALUE document, VALUE owner_klass,
+                                  void *node, VALUE ver)
+{
+    VALUE out = rb_ary_new();
+    void *c;
+
+    for (c = f_first_child(node); c; c = f_next_sibling(c)) {
+        int kind = f_node_type(c);
+        VALUE wrapper = columnar_node_for(document, owner_klass, c, kind);
+        struct native_node *nn;
+
+        TypedData_Get_Struct(wrapper, struct native_node, &nn_type, nn);
+        if (kind == WS_NODE_ELEMENT) {
+            const char *name = f_elem_name(c);
+            nn->name_val = name ? rb_enc_interned_str(name, strlen(name),
+                                                      rb_utf8_encoding())
+                                : Qnil;
+            nn->name_ver = ver;
+            nn->children_val = nn_prime_children_of(document, owner_klass,
+                                                    c, ver);
+            nn->children_ver = ver;
+        } else if (kind != WS_NODE_DOCTYPE && kind != 9 /* DOCUMENT */) {
+            /* leaf kinds: memo the name exactly as nn_name computes
+             * it (f_elem_name answers "" for nameless kinds); their
+             * (empty) children keep the fetch path, which
+             * memo-stores the same way. */
+            const char *name = f_elem_name(c);
+            nn->name_val = name ? rb_enc_interned_str(name, strlen(name),
+                                                      rb_utf8_encoding())
+                                : Qnil;
+            nn->name_ver = ver;
+        }
+        rb_ary_push(out, wrapper);
+    }
+    return out;
+}
+
 static VALUE nf_walk_columnar(VALUE self, VALUE root)
 {
     struct native_node *n;
@@ -3715,6 +3875,7 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
     id_iv_mx_context = rb_intern("@context");
     id_iv_mx_native = rb_intern("@native");
     id_iv_mx_adapter = rb_intern("@adapter");
+    id_bulk_rows_mark = rb_intern("BulkIdentityRows");
     id_iv_parent = rb_intern("@parent");
     id_iv_structure_memoizable = rb_intern("@structure_memoizable");
     id_iv_native_fast = rb_intern("@native_fast");
@@ -3823,7 +3984,7 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
     rb_define_module_function(m_native, "materialize_xpath",
                               nf_materialize_xpath, 2);
     rb_define_module_function(m_native, "xpath_result_rows_bulk",
-                              nf_xpath_result_rows_bulk, 2);
+                              nf_xpath_result_rows_bulk, -1);
     rb_define_module_function(m_native, "set_binding_name",
                               nf_set_binding_name, 3);
     rb_define_module_function(m_native, "set_binding_text",

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.380.0"
+  VERSION = "1.9.380.2"
 end

data/lib/leptris/xml/native_layer.rb

@@ -59,6 +59,19 @@ rescue LoadError => e
   MSG
 end
 
+# Certificate module for the bulk XPath rows face: an Array extended
+# with this carries ONLY born-primed registered-klass identity natives
+# (xpath_result_rows_bulk answered with a consumer context+adapter, so
+# @native is the node itself and @context/@adapter are already set).
+# Consumers with a per-row wrap in their result loop can key a fast
+# path on it (moxml's NodeSet#each); one object per native address
+# remains the binding's native-cache contract (#529) either way.
+module Leptris::XML::BulkIdentityRows
+  def bulk_identity_rows?
+    true
+  end
+end
+
 module Leptris::XML::Native
   # FFI.libleptris_candidates is the single source of truth — the
   # native layer MUST dlsym the exact image the FFI layer loaded,
@@ -118,10 +131,15 @@ class Leptris::XML::Document
   # (nodesets free the handle in C); a non-nodeset result answers
   # nil and leaves the pointer with the caller — route it through
   # Searchable.wrap_xpath_result for the scalar faces.
-  def xpath_result_rows_bulk(result_ptr)
+  # Optional (context, adapter): when the consumer passes its
+  # contract state, every registered-klass row is born primed and an
+  # all-native result extends with BulkIdentityRows — the consumer's
+  # per-row wrap prime disappears from the iterate-every-result lane.
+  def xpath_result_rows_bulk(result_ptr, mx_context = nil, mx_adapter = nil)
     Leptris::XML::Native.xpath_result_rows_bulk(
       self, result_ptr.respond_to?(:address) ? result_ptr.address
-                                             : result_ptr)
+                                             : result_ptr,
+      mx_context, mx_adapter)
   end
 
   # Builder factories that return NativeNodes (#149): one C call

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.379
+- libleptris v1.9.380
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,15 @@
 ## [Unreleased]
 
+## [1.9.380] - 2026-10-22
+
+### Fixed
+
+- assess elements against the instance's xsi:type (moxml#433) (xsd)
+- choice alternatives after a failed parenthesized branch were unreachable (dtd)
+- iterative nested-include processing - no C-stack nesting (xinclude)
+
+
+
 ## [1.9.379] - 2026-10-21
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.379
+    VERSION 1.9.380
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/TODO.SOTA.md

@@ -27,54 +27,62 @@ docs/MISSION-PLAN.md and is updated at every release.
 
 ## Gate A — Conformance: zero reds everywhere
 
-### A1 WHATWG verdict parity: 1394/1555 → 1555/1555
-**Measured 2026-10-21 (main after #1800): 1535/1555 verdict,
-1555/1555 tree, zero false positives; floor pinned at 1535.** The
-remaining 20 verdict misses: adoption-agency (tests2:10, tests19:98,
-tests19:99, tests26:1, tests26:9), menuitem strays (menuitem:10/12),
-table/caption singletons (tests9:16, tests10:15, tests16:197,
-pending-spec-changes:2, tests20:48), tokenizer singletons (tests10:2,
-tests2:18, tests2:58, tests19:41, tests19:82) and two-heads
-(tests3:13). The remaining ~270 code-set divergences are prose-dialect
-labels from older corpus datasets; the verdict gate is presence-only.
-The slices already shipped: initial mode, raw-text EOF, unterminated
-close, frameset, fenced walk, InBody EOF allowed-set, in-select,
-foster-by-kind, unknown-doctype (#1778-#1791), raw-text strays,
-non-html-root, end-tag-too-early, after-body/frameset phases,
-start-tag phases, select/table/foreign, need-space-after-doctype
-(#1794), misplaced/stray-p, after-html codes, image (#1797, #1800).
-Ground every further slice in html5lib's actual source
-(~/src/external/html5lib):
-- [ ] escaped-state EOF codes (`unexpected-eof-in-text-mode`,
-      `eof-in-script-in-script`) — the script-data state machine's
-      EOF classification
-- [ ] the after-body EOF phase rule (tests1:34 class; the exact
-      phaseAtBody.eof semantics)
-- [ ] in-body `unexpected-start-tag` family (body/frameset/form
-      starts; the startTagBody/Forms/Frameset error sites)
-- [ ] `unexpected-end-tag` family (p-in-button-scope synthesis,
-      form pointer, li/dd/dt scope, endTagOther walk)
-- [ ] foster-parenting sites (start-tag/character/character-in-table)
-- [ ] adoption-agency codes (`adoption-agency-1.3` et al.)
-- [ ] in-table voodoo (`*-implies-table-voodoo`, cells, eof-in-table)
-- [ ] unknown-doctype / unexpected-char-in-doctype (doctype
-      tokenization §13.2.5.28+)
-- [ ] non-html-root, select-mode codes, heading/edge shapes
+### A1 WHATWG verdict parity: DONE — 1555/1555
+**Measured 2026-10-21 (PR #1803, tagged v1.9.378): verdict
+1555/1555, ZERO misses; tree 1555/1555; floor pinned at the full
+corpus count.** The gate is presence-only — every corpus document
+now reports a parse error exactly when html5lib does. The final
+tail closed at the html5lib source sites: adoption-agency-1.3
+(7 cases), menuitem endTagOther pair, tokenizer
+expected-dashes-or-doctype / solidus-in-tag / attributes-in-end-tag,
+AfterAfterFrameset trailing chars, BeforeHead
+end-tag-after-implied-root, BeforeHtml unexpected-end-tag-before-html,
+foreign end-tag mismatch, form-in-table both flavors, </form> table
+voodoo, template foster-parenting-character, two-heads. Earlier
+slices: initial mode, raw-text EOF, unterminated close, frameset,
+fenced walk, InBody EOF allowed-set, in-select, foster-by-kind,
+unknown-doctype (#1778-#1791), raw-text strays, non-html-root,
+end-tag-too-early, after-body/frameset phases, start-tag phases,
+select/table/foreign, need-space-after-doctype (#1794),
+misplaced/stray-p, after-html codes, image (#1797, #1800). The
+~270 remaining code-set divergences are prose-dialect labels from
+older corpus datasets — reported, not gated.
 
 ### A2 QT3 / XQuery 3.1: zero unexplained pins
-- [ ] re-pin fresh (the ~41–99 slice figures are dated)
-- [ ] every remaining pin gets a disposition file or a fix
+- [x] re-pin fresh (2026-10-22: 1723 pins, 62/62 green, zero reds; 106 sets, 72 pins moved)
+- [x] every remaining pin gets a disposition file or a fix
+  (test/xquery/qt3-dispositions/ — 10 files, 1723/1723 dispositioned;
+  fixes: fn:codepoint-equal empty-operand propagation, driver
+  assert-count/assert-empty, role="." context sources, QT3_REPORT
+  inventory channel)
 - [ ] ctor node-yield family: owned_docs transfer completion
 
 ### A3 XSD conformance lane: suite-complete
-- [ ] the lane's own queue (769→795 → its ceiling) to zero
+- [x] the lane's own queue to its dispositioned ceiling — **2026-10-22:
+  903 → 989**/1056 (PR #1825; the board's 795 was stale — five slices
+  had landed). 9 root-caused classes retired:
+  (2026-10-22: 903 → **989**/1056 — 9 root-caused classes retired:
+  xsi-attr exemption, empty content models, unprefixed builtins,
+  no-tns `##other`, xs:attribute 3.2.3 clauses (+55), g-regional
+  timezone, token whitespace, unknown-xs-builtin refs. 67 left,
+  every row dispositioned in test/xsd/xsd-dispositions/README.md:
+  substitution groups in content models, xsi:type, attribute form
+  defaults, identity-constraint checks, derivation-ok attribute
+  clauses; 1 oracle bug (bug322411) not chased)
 
 ### A4 DTD phase 8 (TODO 91)
-- [ ] ENTITY/ENTITIES attribute resolution
-- [ ] parameter entities, choice-model backtracking
+- [x] ENTITY/ENTITIES attribute resolution (undeclared entity, parsed
+      entity without NDATA, undeclared notation, bad ENTITIES token —
+      all falsifiably spec'd; shipped bd21acc6/9d3b3a0e)
+- [x] parameter entities (internal, chained, ATTLIST/ELEMENT bodies,
+      SYSTEM PEs via loader, recursion cap, conditional sections) and
+      choice-model backtracking — group-alternative failure walker
+      fixed so a failed parenthesized alternative still reaches later
+      `|` branches (DtdPhase8.GroupAlternativeFailureStillTriesLaterAlternatives)
 
 ### A5 XInclude completeness (TODO 92)
-- [ ] `parse="xml"` (ownership-transfer splice exists — wire it)
+- [x] `parse="xml"` (ownership-transfer splice + canonical insert face,
+      depth-guard resource-error fallback; verified by specs)
 - [ ] xpointer
 
 ### A6 The universality proof (differential corpus)
@@ -90,15 +98,15 @@ Ground every further slice in html5lib's actual source
 ## Gate B — Performance: every published row ≥1.00x
 
 ### B1 build row: ~2.9x → ≤1.0x (the #242 campaign)
-**Measured 2026-10-21: 1.86-1.92x** (moxml `sota/04-performance`
-branch + leptris 1.9.376.0; harness `wt/460-harness/build_bench.rb`,
-31 interleaved reps: 4.08ms vs Nokogiri 2.20ms for 250 records).
-Was 2.95x at the 1.9.363 era; the add_child alias and same-doc fast
-path landed since. StackProf attribution: `NativeNode.create_element`
-14.6%, GC mark+sweep 19%, `prime_contract` 7.7%, attach path 45% of
-tree; the `invalidate_namespace_cache!` line attribution is a
-sampling artifact (deleting both attach invalidations gains ~5%).
-Harness: wt/460-harness/build_bench.rb. Decomposition on record.
+**Measured 2026-10-22: ~1.47-1.54x median after NINE merged levers**
+(honest baseline 2.72x; guard retirement −22%, namespace gate,
+nil-ivar priming, children-cache guard, mint direct-dispatch +
+native set_attribute −19% (PR #431), prepare_node inline (PR #432)).
+Harness `wt/460-harness/build_bench.rb`; A/B pairs alternate within
+ONE window (drift ±20%). Rejected within noise: fast_attach,
+native-cache deletion, doc_klass memo, identity-probe deletion,
+add_child alias. Residual: wrapper allocation (owner-level node
+layout).
 - [ ] per-element object budget: one Ruby object per created node
       (drop the shell entirely post-create-priming; the mint cache
       insert policy; the context registration)
@@ -113,8 +121,16 @@ scaffolding. Memo law holds (dropping @children memo = 2x GC).
 - [ ] publish the per-face table (the honest much-faster story)
 
 ### B3 whole-pipeline rows (new, published)
-- [ ] parse→query→serialize pipeline row vs nokogiri/libxml2
-- [ ] build→transform (XSLT) pipeline row
+**Measured 2026-10-21: parse→query→serialize is GREEN — leptris
+finishes in 0.533-0.573x of Nokogiri's CPU time (~1.8x faster),
+three interleaved-median runs (`wt/460-harness/pipeline_bench.rb`,
+250 records, 31 reps; same document and query both sides).**
+- [x] parse→query→serialize pipeline row vs nokogiri (green, dated)
+- [x] build→transform (XSLT) pipeline row — **GREEN 2026-10-21:
+      build 250 records, XSLT 1.0 transform, serialize — leptris
+      finishes in 0.492-0.515x of Nokogiri's CPU time (~2x faster),
+      three interleaved-median runs
+      (`wt/460-harness/xslt_pipeline_bench.rb`)**
 - [ ] both to serialbench as the public scoreboard
 
 ### B4 durability
@@ -136,19 +152,29 @@ scaffolding. Memo law holds (dropping @children memo = 2x GC).
 - [ ] C3 reproducible builds everywhere: darwin toolchain pin done
       (ruby#512) — extend to linux/windows legs; publish a per-
       release build manifest (engine + binding hashes per platform)
-- [ ] C4 security.md: advisory channel, CVE-response process,
-      dependency-free attestation
+- [x] C4 security.md: advisory channel, CVE-response process,
+      dependency-free attestation — **shipped 2026-10-21 (PR #1804,
+      v1.9.378)**: GitHub Security Advisories channel, 5-business-day
+      acknowledgment target, coordinated disclosure, CVE assignment,
+      scope table, hardening inventory tied to the lanes that actually
+      run
 - [ ] C5 the memory story documented: pool arena model, leak gates,
       the borrowed-slice lifetime contract
 
 ## Gate D — Universality: same semantics everywhere
 
-- [ ] D1 leptris-descriptor published (crates.io; feat/294 branch
-      lands), rides lockstep
+- [x] D1 leptris-descriptor published — **2026-10-22: live on
+      crates.io as leptris-descriptor v1.9.379** (lockstep with the
+      engine; #1827 fixed the workspace publish to target the
+      descriptor package; issue #1829 records the one-time manual
+      establishment — crates.io trusted publishing cannot create new
+      crates — after which versions publish via the OIDC workflow)
 - [ ] D2 system packaging: homebrew, conan, deb (apt repo)
 - [ ] D3 cross-runtime differential CI (= A6, wired)
-- [ ] D4 libxml2→libleptris migration guide (docs/guide/) + the
-      nokogiri-compat surface documented
+- [x] D4 libxml2→libleptris migration guide — **shipped 2026-10-21
+      (PR #1810): docs/guide/migrating-from-libxml2.md** (ownership
+      model, parse/tree/XPath/serialize/SAX/DTD mappings, deliberate
+      differences); nokogiri-compat surface documented in the guide
 
 ## Gate E — 1.0 (the seal)
 

data/vendor-src/libleptris/benchmarks/baseline.json

@@ -0,0 +1 @@
+{}

data/vendor-src/libleptris/bindings/rust/Cargo.lock

@@ -11,4 +11,4 @@ dependencies = [
 
 [[package]]
 name = "leptris-descriptor"
-version = "0.1.0"
+version = "1.9.379"

data/vendor-src/libleptris/bindings/rust/descriptor/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "leptris-descriptor"
-version = "0.1.0"
+version = "1.9.379"
 edition = "2021"
 description = "Shared descriptor-plan ABI for the leptris engine family (leptris, yeptris, teptris) — repr(C) mirrors of the tree-shaped descriptor plan records"
 license = "MIT"