makiri 0.3.0-aarch64-linux → 0.4.0-aarch64-linux

data/lib/makiri/xml/builder.rb

@@ -0,0 +1,263 @@
+# frozen_string_literal: true
+
+module Makiri
+  module XML
+    # A Nokogiri-compatible DSL for building an XML document (or subtree) from
+    # scratch. It is a thin, pure-Ruby layer over the public construction surface
+    # (+XML::Document.new+, +Document#create_element+ / +#create_text_node+ /
+    # +#create_cdata+ / +#create_comment+, and +Node#add_child+); no C code is
+    # involved.
+    #
+    # @example Block-with-argument form (recommended)
+    #   builder = Makiri::XML::Builder.new do |xml|
+    #     xml.feed("xmlns" => "urn:a") do
+    #       xml.entry do
+    #         xml.title("Hello")
+    #       end
+    #     end
+    #   end
+    #   builder.to_xml
+    #
+    # @example instance_eval form (no block argument)
+    #   builder = Makiri::XML::Builder.new do
+    #     root { child("text") }
+    #   end
+    #
+    # An element is created by calling a method named after the tag. Trailing
+    # arguments follow the Nokogiri convention: a Hash sets attributes (including
+    # +xmlns+ / +xmlns:prefix+ namespace declarations), any other argument becomes
+    # the element's text content, and a block builds nested children.
+    #
+    # Tag names that collide with a Ruby/Kernel method (or with one of this
+    # builder's own helpers below - +text+, +cdata+, +comment+, +doc+, +parent+,
+    # +to_xml+, +to_s+) must be written with a trailing underscore, which is
+    # stripped: +xml.id_("9")+ produces +<id>9</id>+. This matches Nokogiri.
+    #
+    # A namespace prefix is selected for the next element with +[]+:
+    # +xml["dc"].title+ produces +<dc:title>+ (the prefix must be in scope, i.e.
+    # declared via an +"xmlns:dc"+ attribute on an ancestor or on the element
+    # itself, exactly as Makiri resolves prefixes at insertion time).
+    class Builder
+      # The document being built (a {Makiri::XML::Document}).
+      attr_reader :doc
+
+      # The node new children are currently appended to. While a nested block is
+      # running this is that block's element; otherwise it is {#doc}.
+      attr_reader :parent
+
+      # @param options [Hash] accepted for Nokogiri compatibility and ignored - a
+      #   Makiri document has no configurable options (it is always UTF-8).
+      # @param root [Makiri::XML::Node, nil] when given, build into this node:
+      #   top-level calls append to it and its document is used. (This is what
+      #   {.with} passes; mirrors +Nokogiri::XML::Builder.new(options, root)+.)
+      # @yield [self] when the block takes an argument; otherwise the block is
+      #   +instance_eval+'d against the builder.
+      def initialize(options = {}, root = nil, &block)
+        if root
+          @doc = root.document
+          @parent = root
+        else
+          @parent = @doc = Makiri::XML::Document.new
+        end
+        @ns_prefix = nil
+        @arity = nil
+        return unless block
+
+        run(&block)
+        @parent = @doc # like Nokogiri: after a build block, settle back at the document
+      end
+
+      # Build into an existing node: top-level calls append to +node+, using
+      # +node+'s document. Mirrors +Nokogiri::XML::Builder.with+.
+      #
+      # @param node [Makiri::XML::Node]
+      # @return [Builder]
+      def self.with(node, &block)
+        new({}, node, &block)
+      end
+
+      # Append a text node to the current parent.
+      # @return [NodeBuilder]
+      def text(string)
+        insert(@doc.create_text_node(string.to_s))
+      end
+
+      # Append a CDATA section to the current parent.
+      # @return [NodeBuilder]
+      def cdata(string)
+        insert(@doc.create_cdata(string.to_s))
+      end
+
+      # Append a comment node to the current parent.
+      # @return [NodeBuilder]
+      def comment(string)
+        insert(@doc.create_comment(string.to_s))
+      end
+
+      # Parse +string+ as an XML fragment (against the document's in-scope
+      # namespaces) and append its children to the current parent. The Builder
+      # analogue of +Nokogiri::XML::Builder#<<+.
+      # @return [self]
+      def <<(string)
+        @doc.fragment(string).children.to_a.each { |child| insert(child) }
+        self
+      end
+
+      # Select the namespace prefix for the next element (consumed by the next
+      # tag method). Returns self so it reads as +xml["dc"].title+.
+      # @return [self]
+      def [](ns_prefix)
+        @ns_prefix = ns_prefix.to_s
+        self
+      end
+
+      # Serialize the built document. Forwards to {Document#to_xml} (so +pretty:+
+      # works).
+      def to_xml(...)
+        @doc.to_xml(...)
+      end
+      alias_method :to_s, :to_xml
+
+      # Any other method name is a tag: create the element and insert it.
+      def method_missing(name, *args, &block)
+        tag = name.to_s.sub(/[_!]\z/, "")
+        prefix = @ns_prefix
+        if prefix
+          tag = "#{prefix}:#{tag}"
+          @ns_prefix = nil
+        end
+        node = create_element(tag, args)
+        check_prefix_defined!(node, prefix) if prefix
+        insert(node, &block)
+      end
+
+      # Tag methods are open-ended, so report respond_to? truthfully for them
+      # (anything that is not already a real method is a candidate tag).
+      def respond_to_missing?(_name, _include_private = false)
+        true
+      end
+
+      private
+
+      # Translate the Nokogiri-style trailing arguments (a Hash is attributes,
+      # anything else is text content) into a {Document#create_element} call.
+      def create_element(tag, args)
+        text = nil
+        attributes = nil
+        args.each do |arg|
+          if arg.is_a?(Hash)
+            attributes = attributes ? attributes.merge(arg) : arg
+          else
+            text = arg
+          end
+        end
+        cargs = []
+        cargs << text.to_s unless text.nil?
+        cargs << attributes unless attributes.nil?
+        @doc.create_element(tag, *cargs)
+      end
+
+      # Raise like Nokogiri when a prefix selected via +[]+ resolves nowhere: not
+      # in scope at the insertion point (+@parent+ and its ancestors) and not
+      # self-declared on +node+ itself (e.g. +xml["foo"].root("xmlns:foo" => ...)+).
+      def check_prefix_defined!(node, prefix)
+        return if @parent.respond_to?(:namespaces) && @parent.namespaces.key?("xmlns:#{prefix}")
+        return if node.namespace_definitions.any? { |ns| ns.prefix == prefix }
+
+        raise ArgumentError, "Namespace #{prefix} has not been defined"
+      end
+
+      # Append +node+ to the current parent, then, if a block is given, descend
+      # into the inserted node for the duration of that block. Returns a
+      # {NodeBuilder} over the inserted node (which may be an imported copy, e.g.
+      # from a fragment), so the Nokogiri attribute-shortcut chain works.
+      def insert(node, &block)
+        node = @parent.add_child(node)
+        descend(node, &block) if block
+        NodeBuilder.new(node, self)
+      end
+
+      # Run +block+ with +node+ as the current parent, restoring the previous
+      # parent afterward (even if the block raises) and returning the block's
+      # value. The single place the parent is pushed/popped - shared by #insert and
+      # NodeBuilder's nested-block chain, so neither manipulates the parent state
+      # directly.
+      def descend(node, &block)
+        previous = @parent
+        @parent = node
+        begin
+          run(&block)
+        ensure
+          @parent = previous
+        end
+      end
+
+      # Run a DSL block, choosing instance_eval vs yield once (from the first
+      # block seen), the same way Nokogiri does, so the form is consistent
+      # throughout a build.
+      def run(&block)
+        @arity = block.arity if @arity.nil?
+        if @arity <= 0
+          instance_eval(&block)
+        else
+          block.call(self)
+        end
+      end
+
+      # The value returned by each element call, wrapping the just-inserted node
+      # so attributes can be added with the Nokogiri terse-chain syntax:
+      #
+      #   xml.object.classy.thing!   # => <object class="classy" id="thing"/>
+      #
+      # A plain method name appends to the +class+ attribute, +name!+ sets +id+
+      # (and content if given), +name=+ sets that attribute, a trailing Hash adds
+      # each key as an attribute, and a block descends into the node. +[]+ / +[]=+
+      # read and write attributes directly. Semantics mirror
+      # +Nokogiri::XML::Builder::NodeBuilder+.
+      class NodeBuilder
+        def initialize(node, doc_builder)
+          @node = node
+          @doc_builder = doc_builder
+        end
+
+        # Read an attribute of the wrapped node.
+        def [](key)
+          @node[key]
+        end
+
+        # Write an attribute of the wrapped node.
+        def []=(key, value)
+          @node[key] = value
+        end
+
+        def method_missing(method, *args, &block)
+          opts = args.last.is_a?(Hash) ? args.pop : {}
+          case method.to_s
+          when /\A(.*)!\z/
+            @node["id"] = Regexp.last_match(1)
+            @node.content = args.first if args.first
+          when /\A(.*)=\z/
+            @node[Regexp.last_match(1)] = args.first
+          else
+            @node["class"] = ((@node["class"] || "").split(/\s/) + [method.to_s]).join(" ")
+            @node.content = args.first if args.first
+          end
+
+          opts.each do |key, value|
+            @node[key.to_s] = ((@node[key.to_s] || "").split(/\s/) + [value]).join(" ")
+          end
+
+          # Descend into this node for a nested block via the builder's own parent
+          # stack (with its ensure-based restore), rather than re-rooting it by hand.
+          return @doc_builder.send(:descend, @node, &block) if block
+
+          self
+        end
+
+        def respond_to_missing?(_name, _include_private = false)
+          true
+        end
+      end
+    end
+  end
+end

data/lib/makiri/xml/node_methods.rb

@@ -32,6 +32,53 @@ module Makiri
       end
 
       alias_method :has_attribute?, :key? unless method_defined?(:has_attribute?)
+
+      # CSS selector queries over XML, lowered to the native XPath engine (so
+      # matching is case-sensitive and namespace-aware, unlike a Lexbor HTML
+      # matcher). Nokogiri-compatible namespaces: the document's in-scope
+      # declarations are collected automatically (a bare type selector binds to
+      # the default namespace), and an optional +ns+ hash of {prefix => uri}
+      # supplements/overrides them.
+      #
+      #   doc.css("entry")               # default-namespace bound (Atom/RSS just work)
+      #   doc.css("a|entry", "a" => uri) # explicit prefix
+      #
+      # @return [Makiri::NodeSet]
+      def css(selector, ns = nil)
+        _css(selector.to_s, _css_namespaces(ns))
+      end
+
+      # First descendant matching +selector+, or nil. @return [Makiri::Node, nil]
+      def at_css(selector, ns = nil)
+        _at_css(selector.to_s, _css_namespaces(ns))
+      end
+
+      # Whether this node matches +selector+ (full selector, combinators included).
+      # @return [Boolean]
+      def matches?(selector, ns = nil)
+        _css_matches(selector.to_s, _css_namespaces(ns))
+      end
+
+      private
+
+      # Build the {prefix => uri} hash the C primitives register. Matching
+      # Nokogiri: with NO explicit namespaces the document's own declarations are
+      # collected (the default namespace under the synthetic prefix "xmlns", so a
+      # bare type selector binds to it - the RSS/Atom common case); but once the
+      # caller passes a namespaces hash, ONLY those prefixes are used and a bare
+      # selector resolves to no namespace (Nokogiri disables the default binding
+      # the moment an explicit map is given). Reading only the root's
+      # declarations is O(root attributes), not the whole-document walk.
+      def _css_namespaces(user)
+        return user.transform_keys(&:to_s).transform_values(&:to_s) if user && !user.empty?
+
+        reg = {}
+        root = document&.root
+        root&.namespace_definitions&.each do |ns|
+          reg[ns.prefix.nil? ? "xmlns" : ns.prefix] = ns.href
+        end
+        reg
+      end
     end
   end
 end

data/lib/makiri.rb

@@ -21,6 +21,7 @@ require_relative "makiri/html/document"
 require_relative "makiri/xml"
 require_relative "makiri/xml/node_methods"
 require_relative "makiri/xml/document"
+require_relative "makiri/xml/builder"
 require_relative "makiri/element"
 require_relative "makiri/attr"
 require_relative "makiri/text"

data/script/check_alloc_failures.rb

@@ -0,0 +1,266 @@
+# frozen_string_literal: true
+
+# Allocation-failure injection sweep for the C extension (run via `rake oom`).
+#
+# The sanitizers and the leak gate prove the happy path is memory-safe; neither
+# proves the OOM branches are CORRECT. Makiri's contract is fail-closed: when a
+# core C allocation fails, a call must either raise a clean Makiri::Error /
+# NoMemoryError or complete with the exact same result as the unfailed run -
+# never a truncated/partial result (the property the XPath node-set caps and
+# the "build OOM -> walk fallback" designs exist for). This gate machine-checks
+# that contract: with the ext built under MAKIRI_ALLOC_INJECT=1, every core
+# allocation site routes through a hook that can be armed to fail the nth
+# attempt once. For each representative workload we record a failure-free
+# BASELINE result and the total number of allocation attempts, then re-run the
+# workload once per allocation site with exactly that site failing, and verify
+# each run either raised cleanly or returned a baseline-identical value.
+#
+# A segfault/abort kills this process; the caller (rake/CI) sees the nonzero
+# exit, which is the verdict too.
+#
+#   bundle exec rake oom                                    # rebuild + sweep
+#   bundle exec ruby -Ilib script/check_alloc_failures.rb   # sweep current build
+
+require "makiri"
+
+unless Makiri.send(:__alloc_inject?)
+  abort "check_alloc_failures: extension built without the injection hook - " \
+        "rebuild with MAKIRI_ALLOC_INJECT=1 (`rake oom` does this)"
+end
+
+# Each scenario runs one workload END-TO-END and returns a canonical String, so
+# an injected run's result can be compared (==) against the baseline. Fixtures
+# are built INSIDE the lambda (unless reuse is the point) so the sweep covers
+# their parse/build allocations too.
+SCENARIOS = {
+  # XML parse covering the syntax surface: declaration, DOCTYPE (SYSTEM id +
+  # internal subset), default + prefixed namespaces, prefixed attributes,
+  # references, comment, CDATA, PI, nesting, CRLF normalization in an attr.
+  "xml_parse" => lambda do
+    src = <<~XML
+      <?xml version="1.0" encoding="UTF-8"?>
+      <!DOCTYPE root SYSTEM "urn:example:dtd" [<!ENTITY local "subset">]>
+      <root xmlns="urn:d" xmlns:p="urn:p" p:pa="pv" mixed="A&amp;&#x41; x\r\ny">
+        <!-- a comment -->
+        <p:branch><leaf depth="2">text &amp; &#x41; refs</leaf></p:branch>
+        <![CDATA[raw < cdata & bytes]]>
+        <?pi-target some data?>
+        <empty/>
+      </root>
+    XML
+    Makiri::XML::Document.parse(src).to_xml
+  end,
+
+  # Fragment parse + serialize + splice into a host document.
+  "xml_fragment" => lambda do
+    doc  = Makiri::XML::Document.parse("<r xmlns='urn:d'><keep>k</keep></r>")
+    frag = doc.fragment("<a xmlns:p='u'><p:b>t</p:b></a>text")
+    out  = frag.to_xml
+    doc.root.add_child(frag)
+    out + doc.to_xml
+  end,
+
+  # XPath battery: predicates, functions, a union, axes, plus an XPathContext
+  # evaluation with a registered namespace and variable.
+  "xml_xpath" => lambda do
+    doc = Makiri::XML::Document.parse(<<~XML)
+      <root xmlns:p="urn:p">
+        <a v="1">alpha</a>
+        <a v="2">beta</a>
+        <b n="3"> gamma  delta </b>
+        <p:c><a v="9">nested</a></p:c>
+      </root>
+    XML
+    canon = lambda do |r|
+      r.is_a?(Makiri::NodeSet) ? r.map(&:to_xml).join("|") : r.inspect
+    end
+    exprs = [
+      "//a[@v='2']",
+      "//a[position()=2]",
+      "//a[last()]",
+      "count(//a)",
+      "sum(//b/@n)",
+      "concat(string(//a[1]), '-', substring('abcdef', 2, 3))",
+      "translate('abc', 'abc', 'xyz')",
+      "normalize-space(//b)",
+      "contains(//a[1], 'alp')",
+      "starts-with(//b, ' g')",
+      "//a | //b",
+      "//a[1]/ancestor::root",
+      "//a[1]/following-sibling::b",
+      "//root/descendant-or-self::a",
+    ]
+    parts = exprs.map { |e| canon.call(doc.xpath(e)) }
+    ctx = Makiri::XPathContext.new(doc)
+    ctx.register_namespace("p", "urn:p")
+    ctx.register_variable("want", "9")
+    parts << canon.call(ctx.evaluate("//p:c/a[@v=$want]"))
+    parts.join("\n")
+  end,
+
+  # Same battery shape over an HTML5-parsed document.
+  "html_xpath" => lambda do
+    doc = Makiri::HTML::Document.parse(<<~HTML)
+      <html><body>
+        <div id="top"><p class="x">one</p><p class="y">two</p></div>
+        <ul><li data-n="1">a</li><li data-n="2"> b  c </li></ul>
+      </body></html>
+    HTML
+    canon = lambda do |r|
+      r.is_a?(Makiri::NodeSet) ? r.map(&:to_html).join("|") : r.inspect
+    end
+    exprs = [
+      "//p[@class='y']",
+      "//li[position()=2]",
+      "//li[last()]",
+      "count(//p)",
+      "sum(//li/@data-n)",
+      "concat(string(//p[1]), '+', substring(//p[2], 1, 2))",
+      "translate('one', 'one', 'uno')",
+      "normalize-space(//li[2])",
+      "contains(//p[1], 'on')",
+      "starts-with(//p[2], 'tw')",
+      "//p | //li",
+      "//p[1]/ancestor::div",
+      "//p[1]/following-sibling::p",
+      "//div/descendant-or-self::p",
+    ]
+    parts = exprs.map { |e| canon.call(doc.xpath(e)) }
+    ctx = Makiri::XPathContext.new(doc)
+    ctx.register_variable("cls", "x")
+    parts << canon.call(ctx.evaluate("//p[@class=$cls]"))
+    parts.join("\n")
+  end,
+
+  # The mutation surface: create_*, insertion on every side, rename, content,
+  # attributes, replace, remove, and a fragment splice.
+  "xml_mutate" => lambda do
+    doc = Makiri::XML::Document.parse("<root><old>x</old><gone/></root>")
+    el = doc.create_element("made")
+    el.add_child(doc.create_text_node("inner"))
+    el["k"] = "v"
+    doc.root.add_child(el)
+    el.name = "renamed"
+    el.content = "rewritten"
+    el.add_previous_sibling(doc.create_element("before"))
+    el.add_next_sibling(doc.create_element("after"))
+    doc.root.at_xpath("old").replace(doc.create_element("new"))
+    doc.root.at_xpath("gone").remove
+    doc.root.add_child(doc.fragment("<f1/>tail<f2 a='b'/>"))
+    doc.to_xml
+  end,
+
+  # Serialization over a non-trivial tree (~200 elements built inside the
+  # lambda, so the parse is swept too), both tree and deep serializers.
+  "html_serialize" => lambda do
+    body = (1..50).map { |i|
+      "<div id='d#{i}' class='row'><p>cell #{i}</p><span>tail &amp; #{i}</span></div>"
+    }.join
+    doc = Makiri::HTML::Document.parse("<html><body>#{body}</body></html>")
+    doc.to_html + doc.at_css("body").inner_html
+  end,
+
+  # Full-document text extraction (exercises the text-index build, and its
+  # fail-closed OOM -> walk fallback).
+  "html_text" => lambda do
+    body = (1..80).map { |i| "<p>para #{i} <em>em#{i}</em> tail</p>" }.join
+    doc = Makiri::HTML::Document.parse("<html><body>#{body}</body></html>")
+    doc.text
+  end,
+
+  # CSS: a comma list with combinators through the reused engine, plus the
+  # at_css first-match path.
+  "css" => lambda do
+    doc = Makiri::HTML::Document.parse(<<~HTML)
+      <html><body>
+        <p class="c">one</p><p>skip</p><p class="c">two</p>
+        <div><span>in</span></div><span>out</span>
+        <section id="x">target</section>
+      </body></html>
+    HTML
+    doc.css("p.c, div > span").map { |n| n.name }.join(",") +
+      doc.at_css("#x")&.name.to_s
+  end,
+
+  # The Builder DSL (pure Ruby over create_*/add_child, so this sweeps the
+  # construction factories).
+  "xml_builder" => lambda do
+    Makiri::XML::Builder.new do |xml|
+      xml.feed("xmlns" => "urn:a", "xmlns:dc" => "urn:dc") do
+        xml.entry do
+          xml.title("Hello")
+          xml["dc"].id_("42")
+          xml.cdata("a < b")
+          xml.comment(" note ")
+        end
+      end
+    end.to_xml
+  end,
+}.freeze
+
+ALLOWED = [Makiri::Error, NoMemoryError].freeze
+TRUNCATE = 120
+
+def disarm = Makiri.send(:__alloc_inject, 0)
+
+failures_total = 0
+
+SCENARIOS.each do |name, work|
+  # Warm twice with injection off: process-global engines (CSS) and lazy
+  # builds settle, so the counted run below is representative and stable.
+  disarm
+  2.times { work.call }
+
+  # Counted baseline run: __alloc_inject(0) also resets the counter, so the
+  # calls reading right after is exactly this run's allocation-attempt total.
+  disarm
+  baseline = work.call
+  total = Makiri.send(:__alloc_inject_calls)
+
+  ok_raised = 0
+  ok_identical = 0
+  failures = []
+
+  (1..total).each do |n|
+    Makiri.send(:__alloc_inject, n)
+    begin
+      result = work.call
+      if result == baseline
+        ok_identical += 1
+      else
+        failures << [n, "truncated/wrong result",
+                     "baseline=#{baseline.to_s[0, TRUNCATE].inspect} " \
+                     "got=#{result.to_s[0, TRUNCATE].inspect}"]
+      end
+    rescue *ALLOWED
+      ok_raised += 1
+    rescue Exception => e # rubocop:disable Lint/RescueException -- the wrong class IS the finding
+      failures << [n, "wrong exception class",
+                   "#{e.class}: #{e.message.to_s[0, TRUNCATE]}"]
+    ensure
+      disarm
+    end
+  end
+
+  failures_total += failures.size
+  puts format("%-16s allocations=%-5d raised=%-5d identical=%-5d failed=%d",
+              name, total, ok_raised, ok_identical, failures.size)
+  failures.each do |n, kind, detail|
+    puts "    n=#{n} #{kind}: #{detail}"
+  end
+  if total.zero?
+    # A scenario that never reaches a core allocation sweeps nothing - that is
+    # a broken scenario, not a pass.
+    failures_total += 1
+    puts "    scenario performed ZERO core allocations - workload not reaching the C core"
+  end
+end
+
+if failures_total.zero?
+  puts "check_alloc_failures: OK - every injected allocation failure failed closed " \
+       "(clean raise or baseline-identical result)"
+else
+  puts "check_alloc_failures: FAILED - #{failures_total} injected failure(s) " \
+       "produced a wrong exception or a non-baseline result"
+  exit 1
+end

data/script/check_c_safety.rb

@@ -8,9 +8,26 @@ require "yaml"
 ROOT = Pathname.new(__dir__).join("..").expand_path
 ALLOWLIST_PATH = ROOT.join("script/check_c_safety_allowlist.yml")
 
-Rule = Struct.new(:id, :message, :regex, keyword_init: true)
+# A rule may carry `paths` (an array of path globs): it then applies ONLY to
+# matching files. Used for the parser-TU reader discipline, where the ban is
+# meaningful only in TUs whose input reads must go through mkr_span_t.
+Rule = Struct.new(:id, :message, :regex, :paths, keyword_init: true)
 Finding = Struct.new(:path, :line, :rule, :text, keyword_init: true)
 
+# Byte-scanning parser TUs: every input read goes through the bounded reader
+# (core/mkr_span.h) - see its header comment. The rules below turn that from a
+# convention into a machine-enforced invariant for these files.
+PARSER_TUS = %w[
+  ext/makiri/xml/mkr_xml_tree.c
+  ext/makiri/xml/mkr_xml_chars.c
+  ext/makiri/xml/mkr_xml_node.c
+  ext/makiri/xpath/mkr_xpath_lex.c
+  ext/makiri/xpath/mkr_xpath_funcs_body.h
+  ext/makiri/xpath/mkr_xpath_value_body.h
+  ext/makiri/bridge/ruby_string.c
+  ext/makiri/lexbor_compat/source_loc.c
+].freeze
+
 RULES = [
   Rule.new(
     id: "string_value_cstr",
@@ -60,7 +77,11 @@ RULES = [
   Rule.new(
     id: "verified_text_forge",
     message: "mkr_verified_text_t must be minted only by mkr_verified_text_from_view (the validated boundary)",
-    regex: /\(\s*mkr_verified_text_t\s*\)\s*\{/
+    # Both forge shapes: the compound-literal cast AND the declaration
+    # initializer (`mkr_verified_text_t x = {...}`), which the cast-only regex
+    # used to miss - that gap let a fuzz harness mint over a non-NUL-terminated
+    # buffer unnoticed.
+    regex: /\(\s*mkr_verified_text_t\s*\)\s*\{|\bmkr_verified_text_t\s+\w+\s*=\s*\{/
   ),
   # --- HTML/XML representation boundary (see docs/html_xml_boundary_hardening) ---
   # These symbols assume one DOM representation; using them outside their
@@ -94,6 +115,27 @@ RULES = [
              "to dereference a node use mkr_html_node or mkr_xml_node_unwrap (kind-checked)",
     regex: /\bmkr_node_raw\s*\(/
   ),
+  # --- parser-TU reader discipline (see core/mkr_span.h) ---
+  # In the byte-scanning parser TUs every input read must go through the
+  # bounded reader: a raw libc scan reintroduces the "forgot the bounds check"
+  # class the span made structurally impossible. memcpy stays allowed (an
+  # explicit-length copy, not a scan).
+  Rule.new(
+    id: "raw_scan_call",
+    message: "parser TUs must read input through mkr_span_* / mkr_bytes_eq / mkr_utf8_* " \
+             "(core), not raw libc scanning",
+    regex: /\b(?:memchr|memcmp|strchr|strrchr|strstr|strn?cmp|strcspn|strspn|strpbrk|strtod|strtol|strtoull?|sscanf)\s*\(/,
+    paths: PARSER_TUS
+  ),
+  # The span's own cursor/bound fields are private to core/mkr_span.h: touching
+  # `.p` / `.end` in a parser TU is how a hand-rolled (uncovered) cursor starts.
+  Rule.new(
+    id: "raw_cursor_member",
+    message: "parser TUs must not access a span's .p/.end (or keep a raw cursor struct); " \
+             "use the mkr_span_* helpers (mark/since for slice capture)",
+    regex: /(?:->|\.)\s*(?:p|end)\b/,
+    paths: PARSER_TUS
+  ),
 ].freeze
 
 def load_config
@@ -163,6 +205,7 @@ def scan_findings(ignores)
       next [] unless code_line?(line)
 
       RULES.filter_map do |rule|
+        next if rule.paths && rule.paths.none? { |pat| path_matches?(pat, rel) }
         next unless line.match?(rule.regex)
         next if rule_ignored?(rel, rule.id, ignores)