leptris 1.9.394.0-ppc64le-linux → 1.9.396.0-ppc64le-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e3208fdd19dc20eb05cdeaff72a587f053ec9e9b338b863afcc18065f12ba50
-  data.tar.gz: cbb3a90c5c594faee31b9fd845b127edb7dadf2d3952f9e6f02cc1c8718de675
+  metadata.gz: 948d64de60780abbd35c5eb75ecbb69609396b681b219047ef0ac7775b9383c3
+  data.tar.gz: 69236732f06743bd08714bbf46697cadd63febc486e324ffeee46798c5182fce
 SHA512:
-  metadata.gz: f4d47ec0dd4ca188ffd7e04048b7c4efbdc708d60ce2a93a546a6eeba020c28f9fe8a22ca0cc7821729200357d0fece1c1ab4667fa95c4ad8ede11aeb5ce161b
-  data.tar.gz: c3f0b734f40bcda5aa98df85fd2b0a0c93239f986c23d4035b58ec205183082b07594bf5b3baff1dc9655a7649fbf6ebb19e9d9facdc1014a378b03a83e309f7
+  metadata.gz: d3a2ee8d49e508f8d27bbf36610c2d9cd1975c5ec8fdf6f8f752d81c1154f22c630fc5883ab2fd5af5afcafa920eebb8342a7e8777af3dd82fef88d6acf7957b
+  data.tar.gz: 955dccf5c781bd9e1906bade2ae4182fa50d28c15dc899950f0edb340cb77c8deacc307a9132f9e7ba23348398ddd71e911d1082105c07940576f8fb9600956c

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.394"
+LIBLEPTRIS_VERSION = "1.9.396"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the
@@ -401,8 +401,14 @@ namespace :audit do
       .map { |n| n.sub(/\A_/, "") }
       .select { |n| n.start_with?("leptris_") }
       .map { |n| n.sub(/\Aleptris_/, "") }.sort
-    attached = File.read("lib/leptris/xml/ffi.rb")
-      .scan(/attach_function :leptris_([a-z_0-9]+)/).flatten.sort
+    attached = (
+      File.read("lib/leptris/xml/ffi.rb")
+        .scan(/attach_function :leptris_([a-z_0-9]+)/).flatten +
+      # The native shim's C->C dlsym dispatches (#572: struct-value
+      # returns libffi can't carry) are bound surface too.
+      File.read("ext/leptris/native/native.c")
+        .scan(/lib_sym\((?:h|handle), "leptris_([a-z_0-9]+)"\)/).flatten
+    ).sort
     # Version-gated faces: soft-attached because engines BEFORE the
     # named release lack the symbol (the load must survive them).
     # They join the audit only when the engine pin reaches that

data/ext/leptris/native/native.c

@@ -278,6 +278,14 @@ static void *lib_open(const char *path) { return dlopen(path, RTLD_NOW); }
 static void *lib_sym(void *h, const char *name) { return dlsym(h, name); }
 #endif
 
+/* leptris-ruby#572: the engine's capability descriptor (1.9.392+). */
+typedef struct {
+    unsigned long long caps;
+    unsigned descriptor_version;
+} rb_caps_t;
+typedef rb_caps_t (*capabilities_fn)(void);
+static capabilities_fn f_capabilities;
+
 static void resolve_symbols(const char *lib_path)
 {
     void *h = lib_open(lib_path);
@@ -314,6 +322,7 @@ static void resolve_symbols(const char *lib_path)
     /* Single-crossing element construction (libleptris 1.9.237,
      * #1344): NULL in older engine pins; the create path falls
      * back to create + per-pair sets. */
+    f_capabilities = (capabilities_fn)lib_sym(h, "leptris_capabilities");
     f_elem_new_with_attrs =
         (elem_new_attrs_fn)lib_sym(h, "leptris_element_new_with_attributes");
     f_text_create = (text_create_fn)lib_sym(h, "leptris_text_node_create");
@@ -3965,6 +3974,25 @@ static VALUE nf_sax_parser_free(VALUE self, VALUE obj)
     return Qnil;
 }
 
+/* leptris-ruby#572: the engine's capability descriptor as a plain
+ * hash — libffi's small-struct value return proved unreliable across
+ * ABIs, so the shim reads the C struct and returns the two fields
+ * (raw bitset + descriptor version; bits append per #1905). */
+static VALUE nf_capabilities(VALUE module) {
+    VALUE hash = rb_hash_new();
+    if (!f_capabilities) {
+        rb_hash_aset(hash, ID2SYM(rb_intern("caps")), Qnil);
+        rb_hash_aset(hash, ID2SYM(rb_intern("descriptor_version")), Qnil);
+        return hash;
+    }
+    rb_caps_t c = f_capabilities();
+    rb_hash_aset(hash, ID2SYM(rb_intern("caps")),
+                 ULL2NUM(c.caps));
+    rb_hash_aset(hash, ID2SYM(rb_intern("descriptor_version")),
+                 UINT2NUM(c.descriptor_version));
+    return hash;
+}
+
 LEPTRIS_INIT_EXPORT void Init_native(void)
 {
     VALUE m_leptris, m_xml, m_native;
@@ -4084,6 +4112,8 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
     c_sax_parser = rb_define_class_under(m_native, "SaxParser",
                                          c_object);
     rb_define_module_function(m_native, "sax_parse", nf_sax_parse, 3);
+    rb_define_module_function(m_native, "capabilities",
+                              nf_capabilities, 0);
     rb_define_module_function(m_native, "sax_parser_create",
                               nf_sax_parser_create, 2);
     rb_define_module_function(m_native, "sax_parser_feed",

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.394.0"
+  VERSION = "1.9.396.0"
 end

data/lib/leptris/xml/ffi.rb

@@ -566,6 +566,11 @@ module Leptris
         [:string, :size_t, :leptris_plan, :pointer],
         :leptris_plan_result
 
+      # leptris-ruby#572: the engine's capability descriptor is read
+      # through the native shim's Native.capabilities (libffi's
+      # small-struct value return proved ABI-unreliable); the shim
+      # exposes the raw bitset + descriptor version and re-encodes
+      # nothing (bits append per contract).
       attach_function :leptris_version, [], UTF8_STRING
       attach_function :leptris_version_components, [:pointer, :pointer, :pointer], :void
 

data/lib/leptris/xml.rb

@@ -43,6 +43,31 @@ module Leptris
 
     # Nokogiri-style top-level entry points (Nokogiri::XML(...) /
     # Nokogiri::XML.parse). Delegates to Document.parse.
+    # leptris-ruby#572: the engine's capability descriptor — the
+    # raw bitset plus descriptor version (leptris/leptris#1905).
+    # Frozen and memoized: the engine's answers are fixed per binary.
+    # Consumers (moxml#504) OR this with wrapper knowledge; bits
+    # append per the engine's contract — never reorder.
+    def self.capabilities
+      @capabilities ||=
+        begin
+          raw =
+            begin
+              Native.capabilities
+            rescue NameError
+              # the native layer loads with `require "leptris"`;
+              # a direct `require "leptris/xml"` has not loaded it
+              # yet — the explicit entry is the parallel-API door.
+              require "leptris"
+              Native.capabilities
+            end
+          {
+            caps: raw[:caps],
+            descriptor_version: raw[:descriptor_version]
+          }.freeze
+        end
+    end
+
     def self.parse(xml_or_io, options: nil, readonly: false,
                    recover: true, strict: false)
       recover = false if strict

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.394
+- libleptris v1.9.396
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,74 @@
 ## [Unreleased]
 
+## [1.9.396] - 2026-10-31
+
+### Fixed
+
+- **The AVX2 UTF-8 validator rejected valid multi-byte input
+  (leptris#1842 A5 follow-up).** Three defects shipped with the
+  1.9.395 SIMD gate, all invisible on arm64: the ascii lane's
+  polarity was inverted (`cmplt(cur, zero)` is the NOT-ascii half,
+  so every ASCII byte tripped the error term), both
+  continuation-range bounds compared in the wrong direction
+  (`cont_ok` was unsatisfiable — NEON's direct `vcge/vcle` pair
+  became a swapped saturating-subtraction idiom), and the tail
+  anchor walked back only over continuation runs, letting an
+  opener in the final block lane escape validation (both cores).
+  The leptris-py UTF-16 BOM lane caught it (`malformed input` on
+  `café`); x86 CI failed 25+ tests. Now verified by a 400k-case
+  lane-math simulation against the scalar oracle plus boundary
+  shapes seeded into the randomized cross-check.
+
+- **`leptris_parse_string_inplace` no longer writes past the
+  buffer.** The NUL sentinel at `buf[len]` exceeded the documented
+  contract (terminators INSIDE the buffer); an exactly-sized
+  caller tripped ASAN. The scanner takes `len` and never read it.
+
+- **`xs:redefine` bodies were dropped (leptris#1926).** A
+  `redefine`d complexType whose body declared new particles (or
+  attributes) lost them: the extension derived from the base type
+  captured its model against the BASE body, and the redefinition was
+  never folded in. Bodies are now captured after the base resolves —
+  the same mechanism `xs:override` already uses (PR #1913) — so the
+  ladder resolves head-first through the redefinition and the
+  extension folds against the redefined content. `xs:group`/attr
+  refs inside redefine bodies are collected like override bodies.
+
+
+
+## [1.9.395] - 2026-10-31
+
+### Added
+
+- **Boundary-vector UTF-8 validation (leptris#1842 A5, PRs #1922/#1924).**
+  `leptris_utf8_valid` — AVX2/NEON cores over the existing dispatch
+  layer, the scalar DFA as the fallback and oracle — pinned by an
+  adversarial matrix plus a 4000-case randomized cross-check. The
+  parser's UTF-8 gate now routes through it: **parse of UTF-8-dense
+  documents is +32%** (3.70ms -> 2.81ms on a 2.2MB catalog; the
+  validator alone ~3.7 GB/s on NEON). Unblocked line-level profiling
+  first: the no-LTO `-g` build resolves file:line through
+  dsymutil/atos (ThinLTO bitcode was the blocker).
+
+### Fixed
+
+- **PI data-scan bounds (fuzzer class).** Consuming the PI target's
+  separator could leave `p.pos` one past `p.end`; `p.end - p.pos`
+  underflowed to SIZE_MAX and the data `memchr` walked off the
+  allocation (the nightly-fuzz witness segfaulted under the no-LTO
+  build — allocator luck hid it on LTO).
+- **ctE019 regression (leptris#1923, PR #1927).** A chameleon-included
+  attribute referenced through a restriction base was false-rejected
+  as "not declared (strict)" — the 1.9.391 pending-ref fix made the
+  forward-referenced rows visible, surfacing that only the derived
+  type's rows were consulted. The oracle (xmllint) validates ctE019:
+  both derivation spellings now record the restriction base and the
+  strict-attribute admission walks the chain (admission only;
+  required/fixed/type checks stay derived-only).
+- drop the const-path pristine carve (leptris#1842 A3) (parse)
+
+
+
 ## [1.9.394] - 2026-10-30
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.394
+    VERSION 1.9.396
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/src/CMakeLists.txt

@@ -300,16 +300,23 @@ target_compile_definitions(leptris_objects PUBLIC _POSIX_C_SOURCE=200809L)
 # them all into the same library, dispatch at runtime via cpu.c. The
 # scalar TU (simd_text.c) is always built; these add accelerated paths.
 if(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|AMD64|i[3-6]86)")
-    check_c_compiler_flag("-mavx2" LEPTRIS_HAVE_AVX2_FLAG)
+    # MSVC has no -mavx2; /arch:AVX2 enables the whole AVX set for the
+    # TU (the windows lane shipped scalar-only and the capability bit
+    # disagreed with test_capabilities — 2026-10-31).
+    if(MSVC)
+        set(LEPTRIS_AVX2_FLAG "/arch:AVX2")
+    else()
+        set(LEPTRIS_AVX2_FLAG "-mavx2")
+    endif()
+    check_c_compiler_flag("${LEPTRIS_AVX2_FLAG}" LEPTRIS_HAVE_AVX2_FLAG)
     if(LEPTRIS_HAVE_AVX2_FLAG)
         target_sources(leptris_objects PRIVATE leptris/common/simd_text_avx2.c)
         set_source_files_properties(leptris/common/simd_text_avx2.c
-            PROPERTIES COMPILE_FLAGS "-mavx2")
+            PROPERTIES COMPILE_FLAGS "${LEPTRIS_AVX2_FLAG}")
         # Consumers (simd_text.c dispatch) reference the AVX2 symbol only
-        # when this define is present — MSVC rejects -mavx2 (uses /arch:),
-        # so the TU is skipped there and the dispatch falls back to scalar.
+        # when this define is present.
         target_compile_definitions(leptris_objects PRIVATE LEPTRIS_HAS_AVX2_BUILD=1)
-        message(STATUS "AOT SIMD: AVX2 text scan ENABLED")
+        message(STATUS "AOT SIMD: AVX2 text scan ENABLED (${LEPTRIS_AVX2_FLAG})")
     else()
         message(STATUS "AOT SIMD: AVX2 unavailable (flag rejected)")
     endif()

data/vendor-src/libleptris/src/leptris/common/simd_text.c

@@ -49,6 +49,54 @@ static ptrdiff_t find3_scalar(const char* s, size_t len,
     return -1;
 }
 
+/* Scalar UTF-8 DFA — the always-available fallback (and the oracle
+ * the SIMD cores are pinned against). Moved from the parser's
+ * dp_utf8_valid (#1842 A5). */
+int leptris_utf8_valid_scalar(const char* s_, size_t len) {
+    const unsigned char* p = (const unsigned char*)s_;
+    size_t i = 0;
+    /* ASCII fast path: 8 bytes per iteration. The DFA below runs
+     * only when a high byte is present; ordinary documents pay one
+     * memory-bandwidth pass. */
+    while (i + 8 <= len) {
+        uint64_t w;
+        memcpy(&w, p + i, 8);
+        if (w & UINT64_C(0x8080808080808080)) break;
+        i += 8;
+    }
+    while (i < len && p[i] < 0x80) i++;
+    while (i < len) {
+        unsigned c = p[i];
+        if (c < 0x80) {
+            i++;
+            continue;
+        }
+        size_t n;
+        unsigned lo = 0x80;
+        unsigned hi = 0xBF;
+        if (c >= 0xC2 && c <= 0xDF) {
+            n = 1;
+        } else if (c >= 0xE0 && c <= 0xEF) {
+            n = 2;
+            if (c == 0xE0) lo = 0xA0;
+            else if (c == 0xED) hi = 0x9F;
+        } else if (c >= 0xF0 && c <= 0xF4) {
+            n = 3;
+            if (c == 0xF0) lo = 0x90;
+            else if (c == 0xF4) hi = 0x8F;
+        } else {
+            return 0;
+        }
+        if (len - i <= n) return 0;
+        if (p[i + 1] < lo || p[i + 1] > hi) return 0;
+        for (size_t k = 2; k <= n; k++) {
+            if (p[i + k] < 0x80 || p[i + k] > 0xBF) return 0;
+        }
+        i += n + 1;
+    }
+    return 1;
+}
+
 /* ---- Dispatch ---------------------------------------------------------- */
 
 /* Resolved pointer — initialized on first use (thread-safe enough:
@@ -63,6 +111,7 @@ static void (*g_count3_high_fn)(const char*, size_t, char, char, char,
                                 int*) = NULL;
 static void (*g_copy3_fn)(char*, const char*, size_t, char, char, char,
                           size_t*, size_t*, size_t*) = NULL;
+static int (*g_utf8_fn)(const char*, size_t) = NULL;
 static ptrdiff_t (*g_scan_run_fn)(const char*, size_t, char, char, char,
                                   int*, int*) = NULL;
 
@@ -105,6 +154,9 @@ static size_t count_scalar(const char* s, size_t len, char c) {
  * dispatch_init()" pattern raced when two threads hit the same
  * entry point on first call. */
 static void dispatch_init(void);
+int leptris_utf8_valid_scalar(const char* s, size_t len);
+int leptris_utf8_valid_avx2(const char* s, size_t len);
+int leptris_utf8_valid_neon(const char* s, size_t len);
 static void count3_high_scalar(const char* s, size_t len,
                                char c0, char c1, char c2,
                                size_t* n0, size_t* n1, size_t* n2,
@@ -132,6 +184,7 @@ static void dispatch_init(void) {
         g_count_fn = leptris_text_count_char_avx2;
         g_count3_high_fn = count3_high_scalar;
         g_scan_run_fn = leptris_text_scan_run_avx2;
+        g_utf8_fn = leptris_utf8_valid_avx2;
         return;
     }
 #endif
@@ -144,6 +197,7 @@ static void dispatch_init(void) {
         g_count3_high_fn = leptris_text_count3_high_neon;
         g_copy3_fn = leptris_copy_count3_neon;
         g_scan_run_fn = leptris_text_scan_run_neon;
+        g_utf8_fn = leptris_utf8_valid_neon;
         return;
     }
 #endif
@@ -153,6 +207,7 @@ static void dispatch_init(void) {
     g_count_fn = count_scalar;
     g_count3_high_fn = count3_high_scalar;
     g_scan_run_fn = scan_run_scalar;
+    g_utf8_fn = leptris_utf8_valid_scalar;
 }
 
 /* Scalar kernel: one byte loop counts all three chars and detects
@@ -239,6 +294,12 @@ void leptris_copy_count3(char* dst, const char* src, size_t len,
     leptris_text_count3(src, len, c0, c1, c2, n0, n1, n2);
 }
 
+int leptris_utf8_valid(const char* s, size_t len) {
+    if (!g_utf8_fn) dispatch_init();
+    if (!g_utf8_fn) g_utf8_fn = leptris_utf8_valid_scalar;
+    return g_utf8_fn(s, len);
+}
+
 ptrdiff_t leptris_text_scan_run(const char* s, size_t len, char term,
                                 char f1, char f2,
                                 int* saw_f1, int* saw_f2) {

data/vendor-src/libleptris/src/leptris/common/simd_text.h

@@ -57,6 +57,19 @@ void leptris_text_count3_high(const char* s, size_t len,
                               size_t* n0, size_t* n1, size_t* n2,
                               int* saw_high);
 
+/* Returns 1 when [s, s+len) is valid UTF-8, 0 otherwise. SIMD
+ * boundary-vector validation (the Lemire/Steagall construction) with
+ * the scalar DFA as the fallback; identical verdicts on every input
+ * (pinned by the encoding suite's adversarial matrix + a randomized
+ * cross-check). #1842 A5: the parser's UTF-8 gate ran a per-byte DFA
+ * over the whole document — the hottest line on UTF-8-dense
+ * fixtures (line-level profile, 2026-10-30). */
+int leptris_utf8_valid(const char* s, size_t len);
+
+/* The scalar DFA fallback (and the SIMD verdicts' oracle) — also
+ * the shared tail anchor for the ISA cores. */
+int leptris_utf8_valid_scalar(const char* s, size_t len);
+
 /* Copy [src, src+len) to dst while counting c0/c1/c2 occurrences —
  * one fused memory pass (falls back to memcpy + count3 where no
  * SIMD path is compiled). The parser's owns-copy path gets its

data/vendor-src/libleptris/src/leptris/common/simd_text_avx2.c

@@ -75,6 +75,14 @@ ptrdiff_t leptris_text_find3_avx2(const char* s, size_t len,
     return -1;
 }
 
+/* MSVC has no __builtin_popcount; __popcnt32 maps to the POPCNT
+ * instruction the /arch:AVX2 target guarantees. */
+#if defined(_MSC_VER)
+#  define LEPTRIS_POPCOUNT32(x) __popcnt(x)
+#else
+#  define LEPTRIS_POPCOUNT32(x) __builtin_popcount(x)
+#endif
+
 /* Byte-population count: cmpeq → movemask → popcount per 32-byte
  * chunk, 16-byte SSE step, scalar tail. Never reads past s+len. */
 size_t leptris_text_count_char_avx2(const char* s, size_t len, char c) {
@@ -86,13 +94,13 @@ size_t leptris_text_count_char_avx2(const char* s, size_t len, char c) {
     while (end - p >= 32) {
         __m256i v = _mm256_loadu_si256((const __m256i*)p);
         __m256i eq = _mm256_cmpeq_epi8(v, needle);
-        n += (size_t)__builtin_popcount((unsigned)_mm256_movemask_epi8(eq));
+        n += (size_t)LEPTRIS_POPCOUNT32((unsigned)_mm256_movemask_epi8(eq));
         p += 32;
     }
     if (end - p >= 16) {
         __m128i v = _mm_loadu_si128((const __m128i*)p);
         __m128i eq = _mm_cmpeq_epi8(v, _mm256_castsi256_si128(needle));
-        n += (size_t)__builtin_popcount((unsigned)_mm_movemask_epi8(eq));
+        n += (size_t)LEPTRIS_POPCOUNT32((unsigned)_mm_movemask_epi8(eq));
         p += 16;
     }
     while (p < end) {
@@ -153,3 +161,149 @@ ptrdiff_t leptris_text_scan_run_avx2(const char* s, size_t len, char term,
         return (p < end) ? (ptrdiff_t)(p - s) : -1;
     }
 }
+
+/* ---- UTF-8 validation (leptris#1842 A5) -------------------------------
+ *
+ * Per-16-byte block, per-byte required ranges derived from the three
+ * preceding bytes (carried across blocks via palignr):
+ *   must_cont(j) = start2(j-1) | start3(j-1) | start4(j-1)
+ *                | start3(j-2) | start4(j-2) | start4(j-3)
+ * where startN(v) = v in [C2..DF | E0..EF | F0..F4] by length class.
+ * A must-cont byte must land in its opener's continuation range
+ * (E0 -> A0..BF, ED -> 80..9F, F0 -> 90..BF, F4 -> 80..8F, else
+ * 80..BF); a non-cont byte must be ASCII or a legal start. The tail
+ * (<16 bytes) runs the scalar DFA anchored at a character boundary
+ * (walk back at most 3 bytes). Verdicts identical to
+ * leptris_utf8_valid_scalar — pinned by the encoding suite.
+ */
+int leptris_utf8_valid_avx2(const char* src, size_t len) {
+    const unsigned char* p = (const unsigned char*)src;
+    if (len < 16) return leptris_utf8_valid_scalar(src, len);
+
+    const __m128i zero = _mm_setzero_si128();
+    const __m128i b80 = _mm_set1_epi8((char)0x80);
+    const __m128i bBF = _mm_set1_epi8((char)0xBF);
+    __m128i prev = zero; /* the previous block's 16 bytes */
+
+    size_t i = 0;
+    while (i + 16 <= len) {
+        __m128i cur = _mm_loadu_si128((const __m128i*)(p + i));
+        /* result[j] = byte(j-1): concat(a:b) shifted right leaves the
+         * PREVIOUS block's last lanes at the head — imm 15/14/13. */
+        __m128i b1 = _mm_alignr_epi8(cur, prev, 15);
+        __m128i b2 = _mm_alignr_epi8(cur, prev, 14);
+        __m128i b3 = _mm_alignr_epi8(cur, prev, 13);
+
+        /* start classes — the saturating idiom's operand order is the
+         * whole game: subs(v, lo)==0 tests v<=lo (saturate on
+         * underflow AND equality), so the LOWER bound must be
+         * subs(lo, v)==0 (0 iff lo<=v). subs(v, hi)==0 ⇔ v<=hi is
+         * already the right direction for the upper bound. */
+#define IN_RANGE(v, lo, hi)                                            \
+        (_mm_and_si128(                                                \
+            _mm_cmpeq_epi8(_mm_subs_epu8(_mm_set1_epi8(lo), (v)), zero), \
+            _mm_cmpeq_epi8(_mm_subs_epu8((v), _mm_set1_epi8(hi)), zero)))
+        __m128i st2c = IN_RANGE(cur, (char)0xC2, (char)0xDF);
+        __m128i st3c = IN_RANGE(cur, (char)0xE0, (char)0xEF);
+        __m128i st4c = IN_RANGE(cur, (char)0xF0, (char)0xF4);
+        __m128i is_ascii =
+            _mm_cmpeq_epi8(_mm_and_si128(cur, b80), zero);
+        __m128i legal_start = _mm_or_si128(
+            st2c, _mm_or_si128(st3c, st4c));
+
+        __m128i st2b1 = IN_RANGE(b1, (char)0xC2, (char)0xDF);
+        __m128i st3b1 = IN_RANGE(b1, (char)0xE0, (char)0xEF);
+        __m128i st4b1 = IN_RANGE(b1, (char)0xF0, (char)0xF4);
+        __m128i st3b2 = IN_RANGE(b2, (char)0xE0, (char)0xEF);
+        __m128i st4b2 = IN_RANGE(b2, (char)0xF0, (char)0xF4);
+        __m128i st4b3 = IN_RANGE(b3, (char)0xF0, (char)0xF4);
+#undef IN_RANGE
+
+        __m128i must_cont = _mm_or_si128(
+            _mm_or_si128(st2b1, _mm_or_si128(st3b1, st4b1)),
+            _mm_or_si128(_mm_or_si128(st3b2, st4b2), st4b3));
+
+        /* continuation range refinement from the opener (b1) */
+        const __m128i bA0 = _mm_set1_epi8((char)0xA0);
+        const __m128i b90 = _mm_set1_epi8((char)0x90);
+        const __m128i b9F = _mm_set1_epi8((char)0x9F);
+        const __m128i b8F = _mm_set1_epi8((char)0x8F);
+        const __m128i e0 = _mm_cmpeq_epi8(b1, _mm_set1_epi8((char)0xE0));
+        const __m128i ed = _mm_cmpeq_epi8(b1, _mm_set1_epi8((char)0xED));
+        const __m128i f0 = _mm_cmpeq_epi8(b1, _mm_set1_epi8((char)0xF0));
+        const __m128i f4 = _mm_cmpeq_epi8(b1, _mm_set1_epi8((char)0xF4));
+        __m128i lo = _mm_blendv_epi8(b80, bA0, e0);
+        lo = _mm_blendv_epi8(lo, b90, f0);
+        __m128i hi = _mm_blendv_epi8(bBF, b9F, ed);
+        hi = _mm_blendv_epi8(hi, b8F, f4);
+
+        /* cont-in-range — NEON's vcge/vcle pair translated to the
+         * saturating-subtraction idiom: subs(lo, cur) saturates to 0
+         * iff lo <= cur, subs(cur, hi) iff cur <= hi (the operand
+         * order is the whole game: subs(cur, lo) tests cur <= lo). */
+        __m128i cge = _mm_subs_epu8(lo, cur);
+        __m128i cle = _mm_subs_epu8(cur, hi);
+        __m128i cont_ok = _mm_and_si128(
+            _mm_cmpeq_epi8(cge, zero), _mm_cmpeq_epi8(cle, zero));
+
+        const __m128i ff = _mm_set1_epi8((char)0xFF);
+        __m128i not_must = _mm_xor_si128(must_cont, ff);
+        __m128i not_ascii = _mm_xor_si128(is_ascii, ff);
+        __m128i not_start = _mm_xor_si128(legal_start, ff);
+        /* error = must_cont & !cont_ok  |  !must_cont & !ascii &
+         * !legal_start (0x80..C1 and F5..FF fall out of the latter). */
+        __m128i block_error = _mm_or_si128(
+            _mm_and_si128(must_cont,
+                          _mm_xor_si128(cont_ok, ff)),
+            _mm_and_si128(not_must,
+                          _mm_and_si128(not_ascii, not_start)));
+        if (_mm_movemask_epi8(
+                _mm_cmpeq_epi8(_mm_and_si128(block_error, b80), b80)) != 0)
+            return 0;
+        prev = cur;
+        i += 16;
+    }
+    if (i >= len) {
+        /* The input ENDS at the block edge: the last sequence must
+         * be complete (the scalar DFA's "len - i <= n" rule). Walk
+         * back over at most 3 continuations; s2 lands ON the last
+         * continuation (or the final non-continuation byte). */
+        size_t s2 = i;
+        size_t conts = 0;
+        while (s2 > 0 && (p[s2 - 1] & 0xC0) == 0x80 && conts < 3) {
+            s2--;
+            conts++;
+        }
+        if (conts > 0) {
+            if (s2 == 0) return 0; /* continuations, no opener anywhere */
+            unsigned op = p[s2 - 1]; /* the opener BEFORE the run */
+            unsigned owed = (op >= 0xF0) ? 3
+                          : (op >= 0xE0) ? 2
+                          : (op >= 0xC2) ? 1
+                                         : 0;
+            if (owed > conts) return 0;
+            return 1;
+        }
+        /* the last byte is not a continuation: it must be ASCII */
+        unsigned op = p[i - 1];
+        unsigned owed = (op >= 0xF0) ? 3
+                      : (op >= 0xE0) ? 2
+                      : (op >= 0xC2) ? 1
+                                     : 0;
+        return owed == 0 ? 1 : 0;
+    }
+    /* Tail: scalar DFA anchored at a character boundary (at most 3
+     * bytes back from the SIMD end; a sequence is at most 4) — the
+     * anchored run also covers a sequence spanning the block edge.
+     * One more step back when the byte before the anchor is a start
+     * byte: an opener in the final block lane reaches into the tail
+     * (400k-case randomized cross-check vs the scalar oracle). */
+    size_t start = i;
+    while (start > 0 && (p[start] & 0xC0) == 0x80 && i - start < 3)
+        start--;
+    if (i - start < 3 && start > 0) {
+        unsigned char b = p[start - 1];
+        if (b >= 0xC2 && b <= 0xF4) start--;
+    }
+    return leptris_utf8_valid_scalar((const char*)(p + start), len - start);
+}