makiri 0.14.0 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: baaa765e2bd6208137962299994628a55a36ab68e29f9de9921e686679c69bf2
-  data.tar.gz: cd74ab123b1f8384d7aa14c448f1f12ee78371335061b60728c06424ccc5973b
+  metadata.gz: 80c74b7d335f5f5f93f8476a8f99a8918560df8cf75f43a5a71d9b132e892873
+  data.tar.gz: d6593459917f22ceb301093d17b981a597d8be7d975d1fab1e4142f6cf17fcbc
 SHA512:
-  metadata.gz: 9ce8aa721e0e6848e2f7015f924f510599064f309c590181abef990e9b81121a1675aade8917515fdc35577bb65bb5edcf0d72ce4582df686eb0156d461d5e7b
-  data.tar.gz: 692a2a400e1be9ecc12fcd67cf317f5d7e51eef38c2846f25ab3bc23dd6626acdf02d860309e4444bf1b2b646461e8a32934804ebc8d1cc3f9a8593d729a79d8
+  metadata.gz: efa98c3ca322d6a3ee141428c1f5e9c3e5b46fba9dde4d7ac75d7dcfdf27d4dd083ef46eed5fb8db21685396d86caeb58e1755f9dd5014d396674cc149378df9
+  data.tar.gz: 836d97359577dfcd4bd60a8de0dfcf355c596b95fa7fffd5e56a0a355bb4267f3141bf8786f4f905596d79bef44721eeb3bfe4f25fa97e489c5aa3319c9f7655

data/.github/workflows/ci.yml

@@ -5,6 +5,13 @@ on:
     branches: [main, master]
   pull_request:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}

data/.github/workflows/conformance.yml

@@ -15,6 +15,13 @@ on:
     - cron: "37 5 * * *" # nightly, offset from the other workflows
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # PR + push: HTML5 parsing conformance, plus the XPath and CSS differentials
   # over the curated corpus and a moderate batch of generated XPath expressions.

data/.github/workflows/css-match.yml

@@ -37,6 +37,13 @@ on:
     - cron: "41 4 * * *"
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   # Short on a push or PR, long on the nightly schedule.
   LONG: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
@@ -139,8 +146,12 @@ jobs:
       # also starts from the other's corpus (read-only: new units go to the
       # first directory). The cache prefix is libfuzzer.yml's, so the corpus
       # accumulated there carries over.
+      # Restored here, saved after the minimization below - and not on a pull
+      # request: a cache a PR saves is scoped to that PR's ref, so main and the
+      # nightly never read it, and minimizing it (~5 min) only bought a cache
+      # nobody restores.
       - name: Restore the corpus
-        uses: actions/cache@v6
+        uses: actions/cache/restore@v6
         with:
           path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
           key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
@@ -171,6 +182,32 @@ jobs:
             -dict=css.dict \
             -print_final_stats=1
 
+      # The corpus is saved after every main/nightly run, so without this it
+      # only grows: every nightly hour adds units and nothing ever drops one.
+      # It reached ~58k files (with the sibling, ~107k units replayed before
+      # the first mutation) of which libFuzzer kept ~2.8k, and a short run
+      # spent its whole 180 s replaying - 0 new units, no fuzzing at all.
+      # Minimizing before the save keeps only what adds coverage. The first
+      # run after a long gap pays one replay of the backlog; later ones a
+      # few thousand units.
+      - name: Minimize the corpus before it is cached
+        if: github.event_name != 'pull_request'
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          before=$(ls corpus/${{ matrix.target }} | wc -l)
+          cargo fuzz cmin ${{ matrix.target }} corpus/${{ matrix.target }} -- \
+            -max_len=4096 \
+            -timeout=30
+          after=$(ls corpus/${{ matrix.target }} | wc -l)
+          echo "corpus/${{ matrix.target }}: $before -> $after files"
+
+      - name: Save the corpus
+        if: github.event_name != 'pull_request'
+        uses: actions/cache/save@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
+          key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
+
       - name: Upload reproducers
         if: failure()
         uses: actions/upload-artifact@v4

data/.github/workflows/security.yml

@@ -8,6 +8,13 @@ on:
     - cron: "17 19 * * *"
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # A "C safety lint" job stood here (`rake security:clint`, over
   # script/check_c_safety.rb). It enforced rules about C that no longer exists -

data/.github/workflows/valgrind.yml

@@ -23,6 +23,13 @@ on:
     - cron: "0 2 * * *"
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # Valgrind memcheck on the full spec suite.  Complements ASan by catching
   # layout-independent errors ASan misses: use of uninitialised values, and
@@ -111,8 +118,8 @@ jobs:
   # (parse/drop cycles) scale their iteration count down under stress
   # (`gc_churn_iters` / `GC_COMPACT_ITERS`) because each stressed iteration is
   # orders of magnitude heavier; `GC_COMPACT_ITERS` below tunes the total runtime
-  # (~6-9 min on CI at 200).  An earlier version forced GC.stress onto the
-  # *entire* suite (~800 examples): it ran 1h40m+ and never finished, while
+  # (~14.5 min on CI at 200 in one job, hence the three shards below).  An
+  # earlier version forced GC.stress onto the *entire* suite (~800 examples): it ran 1h40m+ and never finished, while
   # testing borrowed-pointer discipline on hundreds of examples that have none.
   # The rest of the suite still runs in ci.yml.
   #
@@ -123,7 +130,7 @@ jobs:
     # Pull requests, nightly and on demand - not on push (the valgrind job is the
     # post-merge gate). See the note under `on:` for why pull requests.
     if: github.event_name != 'push'
-    name: GC.auto_compact + GC.stress (Ruby ${{ matrix.ruby }})
+    name: GC.auto_compact + GC.stress (Ruby ${{ matrix.ruby }}, ${{ matrix.shard.name }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
@@ -137,6 +144,17 @@ jobs:
       fail-fast: false
       matrix:
         ruby: ["3.4"]
+        # Split by spec file into three ~equal parts (measured per file: the
+        # handler spec alone is a third, attribute + source_location another).
+        # The last shard is everything ELSE, so a newly tagged file lands
+        # there rather than in no shard; rebalance if it grows past the others.
+        shard:
+          - name: xpath_handler
+            args: spec/xpath_handler_spec.rb
+          - name: attribute
+            args: spec/attribute_spec.rb spec/source_location_spec.rb
+          - name: rest
+            args: --exclude-pattern "spec/{xpath_handler,attribute,source_location}_spec.rb" spec
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)
@@ -166,4 +184,4 @@ jobs:
       # auto_compact globally and wrap each example in GC.stress; --tag gc_compact
       # limits the run to the borrowed-pointer examples.
       - name: Run GC-sensitive examples under GC.auto_compact + GC.stress
-        run: bundle exec rspec --tag gc_compact spec
+        run: bundle exec rspec --tag gc_compact ${{ matrix.shard.args }}

data/.github/workflows/verify.yml

@@ -1,11 +1,37 @@
 name: Verify
 
 on:
+  # Ten minutes of proofs, over the Ruby-free engine only - so they run when
+  # that engine (or how it is built) changes, not on every push.
   push:
     branches: [main, master]
+    paths: &kani-paths
+      # The proofs build `--no-default-features`, so the Ruby/Lexbor layers
+      # below are compiled out of them; a change confined to those cannot
+      # change a proof's outcome. Everything else under src/ stays in, since
+      # the harnesses reach the engine's shared modules (limits, text, ...).
+      - "ext/makiri/rust/src/**"
+      - "!ext/makiri/rust/src/bridge/**"
+      - "!ext/makiri/rust/src/glue/**"
+      - "!ext/makiri/rust/src/lexbor/**"
+      - "!ext/makiri/rust/src/css/**"
+      - "!ext/makiri/rust/src/init.rs"
+      - "ext/makiri/rust/build.rs"
+      - "ext/makiri/rust/Cargo.toml"
+      - "ext/makiri/rust/Cargo.lock"
+      - "Rakefile"
+      - ".github/workflows/verify.yml"
   pull_request:
+    paths: *kani-paths
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # A CBMC job stood here and proved ext/makiri/{core,xml,xpath}/*.c. Those
   # files are gone, and `rake verify` with them: every one of its fifteen

data/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## [0.16.0] - 2026-10-10
+
+### Added
+
+* `Makiri::NATIVE_VERSION` and `Makiri::NATIVE_RUBY_API_VERSION`: the gem
+  version and Ruby `MAJOR.MINOR` the native extension was built as.
+  `require "makiri"` raises `LoadError` for an extension built for another
+  Ruby (refused by the extension itself, before it defines anything) or as
+  another makiri version (e.g. a stale `lib/makiri/makiri.bundle` in a
+  checkout).
+* `Node#child_count`, `#child_at(i)`, `#element_child_count` and
+  `#element_child_at(i)` (HTML and XML): count and index a child list without
+  building `#children`. A loop over the indexes in order costs O(1) a step,
+  also while other lists are read in between. Any child-list edit in the
+  document resets that, so a loop that edits as it indexes walks from the
+  nearer end after each edit. `child_at` returns nil for a negative index or
+  one past the end.
+* `Node#first_child` (an alias of `#child`) and `#last_child`.
+* `Node#root_node`, DOM `getRootNode()`: the Document, a DocumentFragment, or
+  the top of a detached subtree. An Attr is its own root.
+
+### Changed
+
+* `#local_name`, `#prefix`, `#namespace_uri` and `#tag_name` return frozen,
+  interned Strings: every read of one name returns the same object. `#name`
+  still returns a new, mutable String.
+
+## [0.15.0] - 2026-10-09
+
+### Added
+
+* `Makiri::HTML::Document#create_loose_dom_element(qualified_name, prefix,
+  local_name, namespace_uri)`, like the XML Document's: the local name is
+  taken as given (`"Foo:Bar"` keeps its colon and case). Names the DOM
+  refuses raise `ArgumentError`.
+* `Makiri::XML::Document#quirks_mode?` (always `false`) and `#compat_mode`
+  (always `"CSS1Compat"`), as on the HTML Document.
+
+### Changed
+
+* `:lexbor-contains()` is no longer supported. `#css` / `#at_css` /
+  `#matches?` raise `Makiri::CSS::SyntaxError` for it (HTML and XML), and
+  `parse_stylesheet` reports its rule as `:bad_style`. Use XPath `contains()`
+  instead.
+* HTML `#css` / `#at_css` / `#matches?` raise `Makiri::Error` ("could not be
+  run") for `:current(S)` instead of matching nothing.
+
+### Fixed
+
+* `parse_stylesheet` keeps escapes in a selector's `:text`: `.md\:block` came
+  back as `.md:block`. `:current(S)` keeps its argument, and a rule
+  with `[|a]` is no longer reported as `:bad_style`.
+* `parse_stylesheet` trims only CSS whitespace and never an escaped one:
+  `screen\ ` came back as `screen\`. A `:bad_style`'s `selector_text` no
+  longer keeps the whitespace before its `{`.
+* HTML `:has()` with a descendant combinator is no longer slow on deep
+  documents: `:has(* * x)` exceeded the work budget at 200 levels.
+
 ## [0.14.0] - 2026-10-04
 
 ### Added
@@ -964,14 +1022,3 @@ Tooling
   benchmark harness (`rake bench`); conformance harnesses (html5lib-tests, WPT
   domxpath, CSS differential vs `Nokogiri::HTML5`). GitHub Actions CI across
   Ruby 3.2–4.0 × Ubuntu/macOS plus a sanitizer job.
-
-[0.9.0]: https://github.com/takahashim/makiri/compare/v0.8.0...v0.9.0
-[0.8.0]: https://github.com/takahashim/makiri/compare/v0.7.0...v0.8.0
-[0.7.0]: https://github.com/takahashim/makiri/compare/v0.6.0...v0.7.0
-[0.6.0]: https://github.com/takahashim/makiri/compare/v0.5.1...v0.6.0
-[0.5.1]: https://github.com/takahashim/makiri/compare/v0.5.0...v0.5.1
-[0.5.0]: https://github.com/takahashim/makiri/compare/v0.4.0...v0.5.0
-[0.4.0]: https://github.com/takahashim/makiri/compare/v0.3.0...v0.4.0
-[0.3.0]: https://github.com/takahashim/makiri/compare/v0.2.0...v0.3.0
-[0.2.0]: https://github.com/takahashim/makiri/compare/v0.1.0...v0.2.0
-[0.1.0]: https://github.com/takahashim/makiri/releases/tag/v0.1.0

data/NOKOGIRI_DIFFERENCES.md

@@ -245,18 +245,12 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
     text-containment extension. Use XPath (`xpath("//p[contains(., 'x')]")`) or
     Enumerable (`css('li')[1]`) for the rest.
     Standard Level-4 selectors (`:is` / `:where` / `:has`) are supported; some of which Nokogiri rejects.
-  * `:lexbor-contains("text")` - Lexbor's spelling of the jQuery `:contains()`
-    substring filter, matching an element whose text contains the string;
-    append ` i` (`:lexbor-contains("text" i)`) for an ASCII case-insensitive
-    match. (Nokogiri's name `:contains` is not an alias.) **XML only**: it
-    lowers to XPath `child::text()[contains(., "text")]`, testing the
-    element's immediate child text nodes, not the deep string-value. HTML no
-    longer supports it - `lexbor::css_match`, the safe-Rust port that
-    replaced Lexbor's own matcher for HTML, deliberately does not reimplement
-    it, so a well-formed `:lexbor-contains()` now raises `Makiri::Error`
-    ("could not be run") on HTML rather than ever matching (it still PARSES,
-    and an actually malformed one still raises `Makiri::CSS::SyntaxError`, as
-    before).
+  * There is no text-containment pseudo-class. Nokogiri's `:contains()` is
+    not supported, and neither is Lexbor's `:lexbor-contains()`: it raises
+    `Makiri::CSS::SyntaxError` on HTML and XML alike, like any unknown
+    pseudo-class (Lexbor's parser for it had memory-safety bugs, so Makiri
+    never lets it run). Use XPath instead:
+    `xpath('//p[contains(., "text")]')`.
 * Untyped `:*-of-type` (`:first-of-type`, `:nth-of-type(an+b)`, ... with no type
   selector) is supported and correct on both HTML and XML - the "type" is the
   element's own expanded name.

data/Rakefile

@@ -94,10 +94,12 @@ end
 # the report down to errors whose stack touches our extension, so we no longer
 # have to fetch ruby.supp from ruby/ruby (that path was removed upstream).
 #
-# We keep this job's historical contract: catch *use of uninitialised values*
-# and *invalid reads/writes* (incl. intra-arena overflows) - NOT leaks (leak
-# detection stays with `rake leaks`). So we override ruby_memcheck's defaults,
-# which disable undef-value errors and turn on full leak-check.
+# The job catches *use of uninitialised values* and *invalid reads/writes*
+# (incl. intra-arena overflows), and also any "definitely lost" block whose
+# stack touches our extension - the one leak gate with no frequency threshold
+# (`rake leaks`, macOS, flags only stacks repeated >= 30x). It once meant to
+# leave leaks out and could not: see `--leak-check` below. ruby_memcheck's
+# defaults disable undef-value errors, so we override them.
 #
 # `filter_all_errors: true` is essential: by default ruby_memcheck only applies
 # its "stack must touch the makiri binary" filter to *leak*-kind errors
@@ -146,7 +148,19 @@ begin
       # post-merge push gate turns it off (VALGRIND_TRACK_ORIGINS=no) to run in
       # ~half the time, while the nightly / manual runs keep it on for the backtrace.
       "--track-origins=#{ENV.fetch('VALGRIND_TRACK_ORIGINS', 'yes')}",
-      "--leak-check=no",        # leaks are `rake leaks`' job, not this one
+      # Leaks ARE checked here, whatever this says: ruby_memcheck always runs
+      # valgrind with --xml=yes, and in XML mode memcheck writes its leak
+      # records even under --leak-check=no (a "definitely lost" in a spec's
+      # child process failed run 37864917248 that way). So say what happens,
+      # and keep ruby_memcheck's own leak kinds - these options REPLACE its
+      # defaults rather than adding to them, and without the line below
+      # valgrind's default (definite,possible) fails the job on a "possibly
+      # lost" too. A spec that runs Ruby in a child must leave
+      # RUBY_FREE_AT_EXIT set there (it is inherited): without it the child's
+      # live strings at exit are reported as definitely lost through our
+      # frames (PR #55).
+      "--leak-check=full",
+      "--show-leak-kinds=definite",
     ],
   )
 

data/ext/makiri/rust/build.rs

@@ -41,6 +41,10 @@ fn main() {
     println!("cargo:rerun-if-changed=build.rs");
     println!("cargo:rerun-if-env-changed=MAKIRI_LEXBOR_INCLUDE");
 
+    if std::env::var_os("CARGO_FEATURE_RUBY").is_some() {
+        gem_version();
+    }
+
     // Only a build that reads Lexbor's layout pays for this. Kani builds with
     // `--no-default-features` and has no Lexbor headers to point at, which is
     // the whole reason `rake kani` needs no `rake compile` first.
@@ -292,7 +296,6 @@ fn main() {
         .allowlist_function("lxb_css_stylesheet_destroy")
         .allowlist_function("lxb_css_property_serialize")
         .allowlist_function("lxb_css_property_serialize_name")
-        .allowlist_function("lxb_css_selector_serialize_chain")
         // One node's own markup, plain and pretty: Makiri drives the walk
         // itself (`adapter::html::serialize`), so a <template> writes its
         // contents and not its own children, as the HTML Standard says, and
@@ -473,3 +476,36 @@ fn definition(text: &str, name: &str) -> Option<(String, String)> {
     }
     None
 }
+
+/// Embed the gem's version (`lib/makiri/version.rb`, the one place it is
+/// written) as `MAKIRI_GEM_VERSION`, which `init` publishes as
+/// `Makiri::NATIVE_VERSION` for `lib/makiri.rb` to check the loaded binary
+/// against. Read from the source rather than passed in by extconf, so every
+/// cargo build of the extension carries it and none can carry a stale one.
+fn gem_version() {
+    let manifest = std::path::PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    let path = manifest.join("../../../lib/makiri/version.rb");
+    println!("cargo:rerun-if-changed={}", path.display());
+    let source = std::fs::read_to_string(&path)
+        .unwrap_or_else(|e| panic!("cannot read {}: {e}", path.display()));
+    /* `VERSION = "x"` or `VERSION = 'x'`, a trailing `.freeze` or comment
+     * allowed: the literal is what is between the first quote and its match. */
+    let version = source
+        .lines()
+        .find_map(|line| {
+            let rest = line.trim().strip_prefix("VERSION")?.trim_start();
+            let rest = rest.strip_prefix('=')?.trim_start();
+            let quote = rest.chars().next().filter(|c| *c == '"' || *c == '\'')?;
+            let body = &rest[1..];
+            body.find(quote).map(|end| &body[..end])
+        })
+        .filter(|v| !v.is_empty())
+        .unwrap_or_else(|| {
+            panic!(
+                "build.rs reads the gem version from a `VERSION = \"x.y.z\"` line in {}, \
+                 and found none",
+                path.display()
+            )
+        });
+    println!("cargo:rustc-env=MAKIRI_GEM_VERSION={version}");
+}

data/ext/makiri/rust/fuzz/fuzz_targets/html_css_diff.rs

@@ -22,7 +22,9 @@
 //! (`:checked` / `:disabled` / `:enabled`, and `:read-only` / `:read-write`,
 //! which ask the same `is_disabled`), `of S`, `An+B` past 2^53, a
 //! compound that starts with a list pseudo-class where it has several
-//! candidates (Lexbor tries only the first - found by this target), and,
+//! candidates (Lexbor tries only the first - found by this target), a
+//! compound holding one after `+` in a `:has()` argument (Lexbor stops after
+//! the first pair it fails), and,
 //! on a document with foreign elements, the HTML Standard's case-sensitivity
 //! and qualified-name rules for type and attribute selectors. A selector either engine refuses is not compared either.
 //!
@@ -173,6 +175,8 @@ impl Shape {
                 // Whether the compound being walked starts with a list
                 // pseudo-class (`:is()`, `:where()`, `:not()`, `:has()`).
                 let mut leads_with_list = false;
+                // How the compound being walked attaches to the one before.
+                let mut attached = Combinator::Descendant;
                 let mut first = true;
                 let mut sel: Option<Selector<'_>> = list.first();
                 while let Some(s) = sel {
@@ -182,6 +186,7 @@ impl Shape {
                     }
                     let combinator = s.combinator();
                     if first || combinator != Combinator::Close {
+                        attached = combinator;
                         // The compound before this one is searched over every
                         // ancestor / preceding sibling when this one attaches
                         // by a descendant or `~` combinator.
@@ -199,6 +204,18 @@ impl Shape {
                             shape.departs = true;
                         }
                     }
+                    // In a `:has()` argument, a compound attached by `+` that
+                    // holds `:is()` / `:not()` / `:where()` / `:has()`: Lexbor
+                    // stops after the first pair that fails it.
+                    if in_has
+                        && attached == Combinator::NextSibling
+                        && matches!(
+                            s.simple(),
+                            Simple::PseudoClassFunction(FunctionArg::Selectors { .. })
+                        )
+                    {
+                        shape.departs = true;
+                    }
                     first = false;
                     shape.simple(s, in_has, &mut work);
                     sel = s.next();
@@ -211,7 +228,7 @@ impl Shape {
     fn simple<'p>(&mut self, s: Selector<'p>, in_has: bool, work: &mut Vec<(Lists<'p>, bool)>) {
         match s.combinator() {
             Combinator::Descendant | Combinator::SubsequentSibling => self.backtracks += 1,
-            Combinator::Other => self.departs = true,
+            Combinator::Column | Combinator::Other => self.departs = true,
             _ => {}
         }
         let upper = s.name().iter().any(u8::is_ascii_uppercase);
@@ -245,7 +262,8 @@ impl Shape {
                     }
                     work.push((lists, in_has || has));
                 }
-                FunctionArg::Contains(_) => self.departs = true,
+                // Both raised by the port and matched by Lexbor.
+                FunctionArg::Contains | FunctionArg::Current(_) => self.departs = true,
                 FunctionArg::Other => {}
             },
             _ => {}

data/ext/makiri/rust/src/bridge/html.rs

@@ -17,12 +17,14 @@ use crate::init::{
     CLASS_HTML_PROCESSING_INSTRUCTION, CLASS_HTML_TEXT, CLASS_XML_DOCUMENT,
 };
 use crate::lexbor::adapter::html::{
-    ForeignNode, HtmlNode, HtmlNodeKey, HtmlNodeMut, Insertion, NodeType, Place, RawDoc, RawNode,
+    ForeignNode, HtmlNode, HtmlNodeKey, HtmlNodeMut, HtmlTree, Insertion, NodeType, Place, RawDoc,
+    RawNode,
 };
 use crate::lexbor::fragment::import_with_fixup;
 
 use crate::bridge::string::{RubyData, RubyText};
 use crate::bridge::wrapper::*;
+use crate::child_index::{ChildList, Children, TokenTree};
 use crate::lexbor::adapter::html::{HtmlDoc, HtmlElementMut};
 use crate::lexbor::adapter::AdapterOom;
 
@@ -241,6 +243,50 @@ pub fn wrap_node(node: Option<HtmlNode<'_>>, document: Value) -> Result<Option<V
         .transpose()
 }
 
+/* ------------------------------------------------------------------ *
+ * indexing a child list                                               *
+ * ------------------------------------------------------------------ */
+
+/// The Lexbor tree for [`crate::child_index`]: a node's pointer is its token.
+/// The links are [`HtmlTree`]'s, the raw ones `#children` follows, so the two
+/// agree - a `<template>`'s own (empty) child list included.
+impl<'d> TokenTree for HtmlTree<'d> {
+    fn token(&self, n: HtmlNode<'d>) -> usize {
+        RawNode::from(n).as_ptr() as usize
+    }
+    fn node_of(&self, token: usize) -> Option<HtmlNode<'d>> {
+        let raw = RawNode::from_ptr(token as *mut core::ffi::c_void)?;
+        // SAFETY: `child_index` asks only for a token it recorded for a list
+        // of this document, so by `ChildPositionMemo`'s invariant it names a
+        // node that is still a child there - in the document the receiver
+        // keeps alive for `'d`. Lexbor detaches rather than frees, so it was
+        // never released.
+        Some(unsafe { raw.as_node() })
+    }
+}
+
+/// The tree every HTML receiver lends its child lists, as `&'static`: a
+/// `const` item is what may be borrowed for that long (the type holds
+/// nothing).
+const HTML_TREE: HtmlTree<'static> = HtmlTree::new();
+
+impl ChildListHost for HtmlSelf {
+    type Tree<'a> = HtmlTree<'a>;
+    fn document(&self) -> Value {
+        self.document
+    }
+    fn children(&self, list: ChildList) -> Children<'_, HtmlTree<'_>> {
+        Children {
+            tree: &HTML_TREE,
+            parent: self.node(),
+            list,
+        }
+    }
+    fn wrap_child(&self, n: Option<HtmlNode<'_>>) -> Result<Option<Value>, Error> {
+        wrap_node(n, self.document)
+    }
+}
+
 /* ------------------------------------------------------------------ *
  * resolving a long-lived key                                          *
  * ------------------------------------------------------------------ */

data/ext/makiri/rust/src/bridge/ruby.rs

@@ -20,6 +20,47 @@ pub use rb_sys::{ID, VALUE};
 
 /* The two conveniences every bridge and glue module shares. */
 
+/// The `MAJOR.MINOR` of the Ruby whose headers this extension was compiled
+/// against - its ABI, since a teeny release keeps it. Published as
+/// `Makiri::NATIVE_RUBY_API_VERSION`.
+pub fn ruby_api_version() -> String {
+    format!(
+        "{}.{}",
+        rb_sys::RUBY_API_VERSION_MAJOR,
+        rb_sys::RUBY_API_VERSION_MINOR
+    )
+}
+
+/// `Err(LoadError)` when the running Ruby's API `MAJOR.MINOR` is not the one
+/// this extension was compiled for.
+///
+/// The FIRST thing `Init_makiri` does. A release Ruby does not check
+/// `ruby_abi_version` itself, and under macOS's `-undefined dynamic_lookup`
+/// a binary built for another Ruby loads and then misreads the interpreter's
+/// structs - defining one class could already corrupt it, so the check
+/// cannot wait for `lib/makiri.rb`. It reads the running Ruby's exported
+/// `ruby_api_version` (three ints, whose layout no Ruby changes) and nothing
+/// else; only a mismatch goes on to build the exception.
+pub fn check_running_ruby_api(ruby: &Ruby) -> Result<(), Error> {
+    // SAFETY: an immutable `const int[3]` libruby exports, read by value.
+    let running = unsafe { (rb_sys::ruby_api_version[0], rb_sys::ruby_api_version[1]) };
+    let built = (
+        rb_sys::RUBY_API_VERSION_MAJOR as core::ffi::c_int,
+        rb_sys::RUBY_API_VERSION_MINOR as core::ffi::c_int,
+    );
+    if running == built {
+        return Ok(());
+    }
+    Err(Error::new(
+        ruby.exception_load_error(),
+        format!(
+            "makiri's native extension was built for Ruby {}.{}, but this is Ruby {}.{}; \
+             rebuild it (`bundle exec rake clean compile` in a checkout, or reinstall the gem)",
+            built.0, built.1, running.0, running.1
+        ),
+    ))
+}
+
 /// `Makiri::Error` - the one definition; the modules that each kept a private
 /// copy of this now import it.
 pub fn error_class() -> magnus::ExceptionClass {

data/ext/makiri/rust/src/bridge/string.rs

@@ -411,6 +411,30 @@ pub unsafe fn ruby_str_from_utf8(bytes: &[u8]) -> VALUE {
     rb_sys::rb_utf8_str_new(bytes.as_ptr() as *const c_char, bytes.len() as c_long)
 }
 
+/// A DOM name as a Ruby String: frozen and deduplicated, tagged UTF-8 -
+/// Ruby's own `-"div"`, so every read of one name answers the same object and
+/// allocates nothing once Ruby has it.
+///
+/// THE contract for the name readers of both representations: `local_name`,
+/// `prefix`, `namespace_uri` and `tag_name` answer through this, and only
+/// `#name` (Nokogiri's, which callers may edit) answers a fresh String.
+/// Character data - text, attribute values - is never interned.
+///
+/// Safe to call with any bytes: `rb_enc_interned_str` copies them, and bytes
+/// that were not UTF-8 would make a wrong String, never a memory error. Every
+/// caller passes a document's name, which is UTF-8 by the text-input contract.
+pub fn dom_name_str(bytes: &[u8]) -> Value {
+    // SAFETY: a slice's pointer and length, read for the call; the encoding
+    // is Ruby's static UTF-8 one. The result is a live String.
+    unsafe {
+        crate::bridge::ruby::value(rb_sys::rb_enc_interned_str(
+            bytes.as_ptr() as *const c_char,
+            bytes.len() as c_long,
+            rb_sys::rb_utf8_encoding(),
+        ))
+    }
+}
+
 /* ---- the strict text contract ---- */
 
 /// Check `bytes` against the strict contract, returning the specific