moxml 0.5.163 → 0.5.166

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66e9a76f3fb1a9a8e41d39d3f49c6ea97536a1d08a7aaf145169eb2ca8b2e72e
-  data.tar.gz: 5190677a144235ce163990b3cd3f7f6ef2a123ef4e02b1b81626e2467d74bcaf
+  metadata.gz: 932f907222ac657e72e53b9e5ac2e514bb6aa07a51da815caa7ee31c0b0a02fa
+  data.tar.gz: 11c82e15a42a80adb5bb19b4b819e9b4cfa1e7e508c6088d383dfdd793a33956
 SHA512:
-  metadata.gz: 8dae5f5b85c572bf5f31efff0dcd1694854a5fffcf03feb066997136b53a44e2423a8208c08944c2159cd28ecdf83954cfe9856ed8354597d8ae8a664d7c434f
-  data.tar.gz: 0347c21ed0aecc388117e2c69632f9be715f0f1a073b5ac1dfad06fc8a0760cf07d652fc7cb39b0641ff5358b8a0d075f22de71befa72bdd687e24bf9ea1f2b4
+  metadata.gz: 2ef7a9115c29ad09a1b3cb91e3c1c7c8cae297529de98cc772b6939b1e3a893c9820889b85b61f82cfd52c6e9536f688b841551c6f125c09aea0fee61ae12d10
+  data.tar.gz: c2822eb479197ddf8151820c1c28e3ce61f49b2a1b3263d1fa4ffc7bc581e387aa52799faef3fba303fb9113bed5ac51cb5b93b5736ed1f03884b398c5a6df15

data/docs/_pages/model-coverage.adoc

@@ -42,6 +42,8 @@ Generated by `bundle exec rake docs:coverage` from the coverage matrix and the d
 | validation | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
 | validation under-detections | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
 | validation version reporting | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
+| validation regex dismissal | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
+| validation substitution dismissal | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
 | loud capability contracts | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
 |===
 

data/docs/_references/processing-model.adoc

@@ -255,7 +255,7 @@ semantics.
 
 === Validation
 
-Pins:: `spec/moxml/xsd_spec.rb`, `spec/moxml/xsd_underdetection_spec.rb`, `spec/moxml/xsd_version_spec.rb`
+Pins:: `spec/moxml/xsd_regex_spec.rb`, `spec/moxml/xsd_spec.rb`, `spec/moxml/xsd_substitution_spec.rb`, `spec/moxml/xsd_underdetection_spec.rb`, `spec/moxml/xsd_version_spec.rb`
 
 XSD validation through engines that ship a validator (libxml2;
 leptris tier-1: recognized roots, one-level content descent, lexical
@@ -267,7 +267,24 @@ scope validate laxly, except that strict `xs:any` /
 negative wildcards (`notQName` / `notNamespace` — an item excluded
 by them has no particle and the content model cannot accept it) are
 re-checked from the schema source on every adapter — the re-check
-can only under-report, never false-report. A compiled schema reports the
+can only under-report, never false-report. Engine lexical findings
+that the source's own `pattern` facets refute are dismissed: an
+engine that cannot evaluate a dialect construct (e.g. the
+`\p{Is...}` block escapes) rejects every occurrence of the facet,
+so the facade re-checks the value against the facet translated to
+the host regex dialect — only whitelisted constructs translate
+(block escapes with Unicode-rename aliases, general categories,
+single-character escapes; subtraction, `\i`, `\c` do not), an
+engine finding is dropped only when every same-named instance
+matches the facet, and anything untranslatable keeps the engine's
+answer, so a dismissal can only remove false rejections, never
+create false acceptances. Engine content-model findings that reject
+a substitution-group member are dismissed likewise: the parent's
+model must be a pure sequence, the child sequence must match it
+position-for-position with every particle exactly-once, and a
+registered member must realize a position — any choice/all,
+cardinality violation, or unknown name keeps the engine's answer.
+A compiled schema reports the
 version its source declares: root `vc:minVersion="1.1"` scopes the
 document to 1.1, anything else is 1.0 (consumers scope 1.0-only
 checks with it; applying 1.1 semantics is the engine-side program).

data/lib/moxml/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Moxml
-  VERSION = "0.5.163"
+  VERSION = "0.5.166"
 end

data/lib/moxml/xsd/schema_rules.rb

@@ -105,7 +105,9 @@ module Moxml
             when "##defined" then :defined
             when "##definedSibling" then :sibling
             when /\A([^:]+):(.+)\z/
-              uri = prefix_uri(Regexp.last_match(1), element)
+              uri = ::Moxml::XSD::SchemaRules.prefix_uri(
+                Regexp.last_match(1), element
+              )
               "{#{uri}}#{Regexp.last_match(2)}" unless uri.empty?
             else
               "{}#{token}"
@@ -113,23 +115,6 @@ module Moxml
           end
         end
 
-        # node.namespaces is adapter-divergent (some engines return
-        # in-scope bindings, others own-node declarations only), so
-        # the in-scope map is walked out by hand — per-node
-        # definitions merged along the ancestor axis, deeper
-        # overriding shallower, identically on every adapter.
-        def prefix_uri(prefix, element)
-          bindings = {}
-          node = element
-          while node
-            node.namespaces.each do |namespace|
-              bindings[namespace.prefix] = namespace.uri
-            end
-            node = node.parent&.element? ? node.parent : nil
-          end
-          bindings[prefix].to_s
-        end
-
         def entry_covers?(entry, namespace)
           namespace == case entry
                        when "##targetNamespace" then :tns
@@ -140,15 +125,120 @@ module Moxml
       end
 
       ContentModel = Struct.new(:declared_children, :any,
-                                :declared_attributes, :any_attribute)
+                                :declared_attributes, :any_attribute,
+                                :particles, :pure_sequence)
       SchemaIndex = Struct.new(:target_namespace, :element_default,
                                :attribute_default, :elements,
-                               :attributes, :contents, :version)
+                               :attributes, :contents, :version,
+                               :element_patterns, :attribute_patterns,
+                               :substitution_members)
+
+      # Resolves a QName token against an element's in-scope
+      # bindings. node.namespaces is adapter-divergent (some
+      # engines return in-scope bindings, others own-node
+      # declarations only), so the in-scope map is walked out by
+      # hand — per-node definitions merged along the ancestor
+      # axis, deeper overriding shallower, identically on every
+      # adapter. Unresolvable prefixes yield "".
+      module_function
+
+      def prefix_uri(prefix, element)
+        bindings = {}
+        node = element
+        while node
+          node.namespaces.each do |namespace|
+            bindings[namespace.prefix] = namespace.uri
+          end
+          node = node.parent&.element? ? node.parent : nil
+        end
+        bindings[prefix].to_s
+      end
 
       # The XSD 1.1 version-tagging namespace (Structures §C.3):
       # vc:minVersion / vc:maxVersion gate 1.1 constructs.
       VC_NS = "http://www.w3.org/2001/XMLSchema-versioning"
 
+      # XSD pattern-facet dialect → Ruby regex, bounded to the
+      # subset the facade vouches for (Datatypes Appendix F). Block
+      # escapes \p{Is…}/\P{Is…} map to Ruby's In-prefixed blocks
+      # (a few Unicode-renamed blocks carry an alias); general
+      # categories and the single-character escapes pass through;
+      # \i, \c and class subtraction are NOT translated. Anything
+      # unrecognized — or a translation Ruby itself rejects —
+      # returns nil: the engine's answer then stands.
+      module XsdRegex
+        BLOCK_ALIASES = {
+          "Greek" => "GreekandCoptic",
+          "CombiningMarksforSymbols" =>
+            "CombiningDiacriticalMarksforSymbols",
+          "Turkish" => "Latin-1Supplement",
+        }.freeze
+
+        PASS_THROUGH_ESCAPES = %w[
+          n r t \\ . | ? * + ( ) [ ] { } ^ $ -
+        ].freeze
+
+        module_function
+
+        def translate(pattern)
+          translated = scan(pattern.to_s)
+          return nil unless translated
+
+          Regexp.new("\\A(?:#{translated})\\z")
+        rescue RegexpError
+          nil
+        end
+
+        def scan(pattern)
+          out = +""
+          index = 0
+          while index < pattern.length
+            char = pattern[index]
+            if char == "\\"
+              consumed = escape(pattern, index, out)
+              return nil unless consumed
+
+              index += consumed
+            else
+              return nil if char == "-" && pattern[index + 1] == "["
+
+              out << char
+              index += 1
+            end
+          end
+          out
+        end
+
+        # Appends the translation of the escape at index to out and
+        # returns the chars consumed, or nil when unrecognized.
+        def escape(pattern, index, out)
+          kind = pattern[index + 1]
+          case kind
+          when "p", "P"
+            close = pattern.index("}", index)
+            return nil unless close
+
+            body = pattern[index + 3, close - index - 3]
+            if body&.start_with?("Is")
+              mapped = body.delete_prefix("Is")
+              mapped = BLOCK_ALIASES.fetch(mapped, mapped)
+              begin
+                Regexp.new("\\p{In#{mapped}}")
+              rescue RegexpError
+                return nil
+              end
+              out << "\\#{kind}{In#{mapped}}"
+            else
+              out << pattern[index..close]
+            end
+            close - index + 1
+          when *PASS_THROUGH_ESCAPES
+            out << pattern[index, 2]
+            2
+          end
+        end
+      end
+
       class << self
         # Index one schema document. Returns nil when the source
         # cannot be indexed — the engine's answer then stands alone
@@ -161,7 +251,7 @@ module Moxml
             root["targetNamespace"].to_s,
             root["elementFormDefault"] == "qualified",
             root["attributeFormDefault"] == "qualified",
-            {}, {}, {}, schema_version(root)
+            {}, {}, {}, schema_version(root), {}, {}, {}
           )
           child_elements(root).each do |decl|
             case decl.name
@@ -169,6 +259,7 @@ module Moxml
             when "attribute" then index_global_attribute(decl, index)
             end
           end
+          index_patterns(root, index)
           index
         rescue StandardError
           nil
@@ -188,6 +279,226 @@ module Moxml
           declared.to_s.start_with?("1.1") ? "1.1" : "1.0"
         end
 
+        # Index the pattern facets the dismissal may vouch with
+        # (#464): named simpleTypes resolve through one type-ref
+        # hop, inline simpleTypes directly; keys are local names.
+        # A name declared twice with different pattern sets is
+        # ambiguous for name-based matching and is removed — an
+        # ambiguous vouch could mask a real violation.
+        def index_patterns(root, index)
+          named = {}
+          collect_named_patterns(root, named)
+          collect_decl_patterns(root, index, named)
+        end
+
+        def collect_named_patterns(node, named)
+          child_elements(node).each do |child|
+            if child.name == "simpleType" && child["name"] &&
+                (patterns = restriction_patterns(child))
+              named[child["name"]] = patterns
+            else
+              collect_named_patterns(child, named)
+            end
+          end
+        end
+
+        def collect_decl_patterns(node, index, named)
+          child_elements(node).each do |child|
+            case child.name
+            when "element"
+              register_pattern(index.element_patterns, child["name"],
+                               decl_patterns(child, named))
+            when "attribute"
+              register_pattern(index.attribute_patterns, child["name"],
+                               decl_patterns(child, named))
+            end
+            collect_decl_patterns(child, index, named)
+          end
+        end
+
+        def decl_patterns(decl, named)
+          inline = child_elements(decl).find do |child|
+            child.name == "simpleType"
+          end
+          if inline
+            restriction_patterns(inline)
+          elsif decl["type"]
+            named[decl["type"].split(":").last]
+          end
+        end
+
+        def restriction_patterns(simple_type)
+          restriction = child_elements(simple_type).find do |child|
+            child.name == "restriction"
+          end
+          return nil unless restriction
+
+          patterns = child_elements(restriction)
+            .select { |facet| facet.name == "pattern" }
+            .map { |facet| XsdRegex.translate(facet["value"].to_s) }
+          return nil if patterns.any?(&:nil?)
+
+          patterns
+        end
+
+        def register_pattern(sink, name, patterns)
+          return unless name && patterns && !patterns.empty?
+
+          sink[name] = sink.key?(name) ? nil : patterns
+        end
+
+        # Dismisses engine findings the schema source refutes:
+        #
+        # * lexical findings pattern facets accept (#464) — dropped
+        #   only when every same-named instance matches the facet;
+        # * content-model findings that reject a substitution-group
+        #   member (#466 class 1) — dropped only when the parent's
+        #   content model is a pure sequence, the child sequence
+        #   matches it position-for-position with every particle
+        #   exactly-once, and a substitution member resolves a
+        #   position. One non-vouching instance — or any real
+        #   mismatch — keeps the engine's answer, so a dismissal
+        #   can only remove false rejections, never create false
+        #   acceptances.
+        def dismiss(engine_errors, doc, index)
+          return engine_errors unless index
+
+          vouched = vouch_table(doc, index)
+          engine_errors.reject do |error|
+            if (subject = lexical_subject(error.message))
+              vouched[subject]
+            elsif (sequence = content_model_subject(error.message))
+              sequence_vouched?(doc, index, *sequence)
+            end
+          end
+        end
+
+        LEXICAL_MESSAGE = /\A(?:element|attribute) '([^']+)' @\d+:\d+: (element|attribute) '([^']+)': lexical value does not match its type\z/
+        CONTENT_MODEL_MESSAGE = /\Aelement '([^']+)' @\d+:\d+: element '([^']+)': children do not match the content model \(at '([^']+)'\)\z/
+
+        private_constant :LEXICAL_MESSAGE, :CONTENT_MODEL_MESSAGE
+
+        def lexical_subject(message)
+          match = LEXICAL_MESSAGE.match(message.to_s)
+          return unless match
+
+          [match[2], match[3]]
+        end
+
+        def content_model_subject(message)
+          match = CONTENT_MODEL_MESSAGE.match(message.to_s)
+          return unless match
+
+          [match[2], match[3]]
+        end
+
+        # Every same-named element in the document must vouch: a
+        # sequence the finding names could be valid while another
+        # same-named one is not. The root is included — the
+        # engine's finding can name it.
+        def sequence_vouched?(doc, index, name, offender)
+          root = doc.root
+          return false unless root
+
+          witnesses = []
+          yield_self = root.name == name
+          witnesses << sequence_valid?(root, index, offender) if yield_self
+          each_named_element(root, name) do |element|
+            witnesses << sequence_valid?(element, index, offender)
+          end
+          !witnesses.empty? && witnesses.all?
+        end
+
+        def each_named_element(node, name, &block)
+          child_elements(node).each do |child|
+            yield child if child.name == name
+            each_named_element(child, name, &block)
+          end
+        end
+
+        # The airtight witness: child count equals particle count,
+        # every position resolves to its particle's name or a
+        # registered member of it, every particle occurs exactly
+        # once, and the reported offender is a substitution member
+        # realized at some position. Anything else leaves the
+        # engine's answer standing.
+        def sequence_valid?(element, index, offender)
+          model = index.contents[qname(element)]
+          return false unless model&.pure_sequence
+
+          particles = model.particles
+          children = child_elements(element)
+          return false if children.empty? || children.size != particles.size
+
+          resolved = false
+          children.each_with_index do |child, position|
+            particle_name, min, max = particles[position]
+            child_qname = qname(child)
+            return false unless exactly_once?(min, max)
+
+            if child_qname == particle_name
+              next
+            elsif index.substitution_members.fetch(particle_name, [])
+                .include?(child_qname)
+              resolved = true
+            else
+              return false
+            end
+          end
+          resolved && offender_realized?(children, offender, index)
+        end
+
+        def exactly_once?(min, max)
+          min <= 1 && (max == :unbounded || max >= 1)
+        end
+
+        def offender_realized?(children, offender, index)
+          members = index.substitution_members.values.flatten
+          children.any? do |child|
+            child.name == offender &&
+              members.include?(qname(child))
+          end
+        end
+
+        def vouch_table(doc, index)
+          root = doc.root
+          return {} unless root
+
+          elements = Hash.new { |hash, key| hash[key] = [] }
+          attributes = Hash.new { |hash, key| hash[key] = [] }
+          collect_witnesses(root, index, elements, attributes)
+          vouched = {}
+          elements.each do |name, matches|
+            vouched[["element", name]] = !matches.empty? && matches.all?
+          end
+          attributes.each do |name, matches|
+            vouched[["attribute", name]] = !matches.empty? && matches.all?
+          end
+          vouched
+        end
+
+        def collect_witnesses(node, index, elements, attributes)
+          child_elements(node).each do |child|
+            if (patterns = index.element_patterns[child.name])
+              elements[child.name] << (text_only?(child) &&
+                patterns.any? { |regex| regex.match?(child.text.to_s) })
+            end
+            child.attributes.each do |attribute|
+              next if attribute.namespace&.uri == XSI_NS
+
+              if (patterns = index.attribute_patterns[attribute.name])
+                attributes[attribute.name] <<
+                  patterns.any? { |regex| regex.match?(attribute.value.to_s) }
+              end
+            end
+            collect_witnesses(child, index, elements, attributes)
+          end
+        end
+
+        def text_only?(element)
+          child_elements(element).empty?
+        end
+
         # Post-validation findings for one instance document.
         def findings(doc, index)
           return [] unless index
@@ -215,6 +526,9 @@ module Moxml
           name = decl["name"] or return
           qname = "{#{index.target_namespace}}#{name}"
           index.elements[qname] = { nillable: decl["nillable"] == "true" }
+          if (head = decl["substitutionGroup"])
+            register_substitution(head, decl, qname, index)
+          end
           type_attr = decl.attribute("type")
           model = if type_attr.nil? || type_attr.value.empty?
                     inline_model(decl, index)
@@ -224,6 +538,23 @@ module Moxml
           index.contents[qname] = model if model
         end
 
+        # substitutionGroup is a QName resolved against the global
+        # declaration's in-scope bindings (#466 class 1); the
+        # member's own qname is target-namespace-qualified — global
+        # declarations always are.
+        def register_substitution(head, decl, member_qname, index)
+          if head.include?(":")
+            prefix, _, local = head.partition(":")
+            uri = prefix_uri(prefix, decl)
+            return if uri.empty?
+
+            head_qname = "{#{uri}}#{local}"
+          else
+            head_qname = "{}#{head}"
+          end
+          (index.substitution_members[head_qname] ||= []) << member_qname
+        end
+
         def index_global_attribute(decl, index)
           name = decl["name"] or return
           index.attributes["{#{index.target_namespace}}#{name}"] = true
@@ -249,7 +580,7 @@ module Moxml
         end
 
         def content_model(type_node, index)
-          model = ContentModel.new([], nil, [], nil)
+          model = ContentModel.new([], nil, [], nil, [], true)
           collect_model(type_node, index, model)
           model
         end
@@ -258,36 +589,58 @@ module Moxml
         # choice / all / complexContent wrappers flattened): we only
         # ADD findings for strict-wildcard matches, so flattening
         # can only under-report, never over-report. Cardinality and
-        # order stay the engine's job.
+        # order stay the engine's job — EXCEPT for the substitution
+        # dismissal (#466 class 1), which vouches only for pure
+        # sequences: any choice/all marks the model impure and the
+        # flattened order is then not a validity witness.
         def collect_model(node, index, model)
           child_elements(node).each do |child|
             case child.name
             when "element"
-              add_particle(child, index, model,
-                           model.declared_children)
+              if (qname = particle_qname(child, index))
+                model.declared_children << qname
+                model.particles << [
+                  qname,
+                  occur_value(child, "minOccurs", 1),
+                  occur_value(child, "maxOccurs", 1),
+                ]
+              end
             when "attribute"
-              add_particle(child, index, model,
-                           model.declared_attributes)
+              if (qname = particle_qname(child, index))
+                model.declared_attributes << qname
+              end
             when "any"
               model.any ||= wildcard_from(child)
             when "anyAttribute"
               model.any_attribute ||= wildcard_from(child)
+            when "choice", "all"
+              model.pure_sequence = false
+              collect_model(child, index, model)
             else
               collect_model(child, index, model)
             end
           end
         end
 
-        def add_particle(particle, index, _model, sink)
+        def particle_qname(particle, index)
           ref = particle["ref"]
           name = ref&.split(":")&.last || particle["name"]
           return unless name
 
-          sink << if ref
-                    "{#{index.target_namespace}}#{name}"
-                  else
-                    "{#{form_namespace(particle, index)}}#{name}"
-                  end
+          if ref
+            "{#{index.target_namespace}}#{name}"
+          else
+            "{#{form_namespace(particle, index)}}#{name}"
+          end
+        end
+
+        def occur_value(particle, attribute, default)
+          value = particle[attribute]
+          return :unbounded if value == "unbounded"
+
+          Integer(value || default)
+        rescue ArgumentError
+          default
         end
 
         # Particles declare with form="qualified"/"unqualified",

data/lib/moxml/xsd.rb

@@ -157,9 +157,11 @@ module Moxml
         return engine_errors unless @rules_index
 
         # The #452 post-validation rules only ever add findings for
-        # documents the engine accepted; exact duplicates are
-        # dropped for engines that already detect them.
-        (engine_errors +
+        # documents the engine accepted; the #464 dismissal removes
+        # only engine lexical findings the source's own pattern
+        # facets refute. Exact duplicates are dropped for engines
+        # that already detect them.
+        (SchemaRules.dismiss(engine_errors, doc, @rules_index) +
           SchemaRules.findings(doc, @rules_index)).uniq
       end
 

data/spec/moxml/xsd_regex_spec.rb

@@ -0,0 +1,188 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Processing model §Validation (normative): pinned here.
+# #464: an engine that cannot evaluate an XSD pattern-facet
+# dialect construct (e.g. the \p{Is...} block escapes) rejects
+# every occurrence of the facet — including values the facet
+# accepts — false-positiving valid documents. The Ruby-side
+# SchemaRules dismissal removes such engine findings only when the
+# schema source's own pattern facets vouch for every same-named
+# instance: one non-matching value keeps the engine's answer, so
+# a dismissal can only remove false rejections, never create
+# false acceptances. Constructs outside the translated dialect
+# subset keep the engine's answer.
+RSpec.describe "Moxml::XSD pattern-facet dismissal (#464)" do
+  describe "bounded dialect translator" do
+    let(:translator) { Moxml::XSD::SchemaRules::XsdRegex }
+
+    it "translates block escapes and categories" do
+      expect(translator.translate('\p{IsBasicLatin}+').source)
+        .to eq("\\A(?:\\p{InBasicLatin}+)\\z")
+      expect(translator.translate('\P{IsLatin-1Supplement}').source)
+        .to eq("\\A(?:\\P{InLatin-1Supplement})\\z")
+      expect(translator.translate('\p{IsGreek}').source)
+        .to eq("\\A(?:\\p{InGreekandCoptic})\\z")
+      expect(translator.translate('\p{L}').source)
+        .to eq("\\A(?:\\p{L})\\z")
+    end
+
+    it "refuses constructs outside the translated subset" do
+      expect(translator.translate('\i\c*')).to be_nil
+      expect(translator.translate('[\p{IsBasicLatin}-[abc]]+'))
+        .to be_nil
+      expect(translator.translate('\p{IsNoSuchBlock}')).to be_nil
+    end
+  end
+
+  %i[nokogiri leptris].each do |adapter_name|
+    describe "on #{adapter_name}" do
+      let(:ctx) { Moxml.new(adapter_name) }
+
+      before do
+        skip "#{adapter_name} requires an XSD-capable engine" unless
+          Moxml::XSD.supported?(ctx)
+      end
+
+      describe "block-escape pattern on an element" do
+        let(:schema) do
+          ctx.xsd(<<~'XSD')
+            <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
+              <xs:element name="doc">
+                <xs:complexType>
+                  <xs:sequence>
+                    <xs:element name="elem" type="regex"
+                                minOccurs="1" maxOccurs="unbounded"/>
+                  </xs:sequence>
+                </xs:complexType>
+              </xs:element>
+              <xs:simpleType name="regex">
+                <xs:restriction base="xs:string">
+                  <xs:pattern value="\p{IsBasicLatin}+"/>
+                </xs:restriction>
+              </xs:simpleType>
+            </xs:schema>
+          XSD
+        end
+
+        it "accepts the value the facet accepts" do
+          doc = ctx.parse(
+            "<doc><elem>&#x9;&#xA;&#xD;&#x20;&#x7F;</elem></doc>",
+          )
+          expect(schema.valid?(doc)).to be(true)
+        end
+
+        it "rejects the value the facet rejects" do
+          doc = ctx.parse(
+            "<doc><elem>abc</elem><elem>ab&#233;c</elem></doc>",
+          )
+          expect(schema.valid?(doc)).to be(false)
+        end
+      end
+
+      describe "negated block escape" do
+        let(:schema) do
+          ctx.xsd(<<~'XSD')
+            <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
+              <xs:element name="doc">
+                <xs:complexType>
+                  <xs:sequence>
+                    <xs:element name="elem" type="nonbasic"
+                                minOccurs="1"/>
+                  </xs:sequence>
+                </xs:complexType>
+              </xs:element>
+              <xs:simpleType name="nonbasic">
+                <xs:restriction base="xs:string">
+                  <xs:pattern value="\P{IsBasicLatin}"/>
+                </xs:restriction>
+              </xs:simpleType>
+            </xs:schema>
+          XSD
+        end
+
+        it "accepts a value outside the negated block" do
+          doc = ctx.parse("<doc><elem>&#233;</elem></doc>")
+          expect(schema.valid?(doc)).to be(true)
+        end
+      end
+
+      describe "block-escape pattern on an attribute" do
+        let(:schema) do
+          ctx.xsd(<<~'XSD')
+            <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
+              <xs:element name="doc">
+                <xs:complexType>
+                  <xs:sequence>
+                    <xs:element name="elem" minOccurs="1"
+                                maxOccurs="unbounded">
+                      <xs:complexType>
+                        <xs:simpleContent>
+                          <xs:extension base="xs:string">
+                            <xs:attribute name="code">
+                              <xs:simpleType>
+                                <xs:restriction base="xs:string">
+                                  <xs:pattern
+                                      value="\p{IsBasicLatin}{2}"/>
+                                </xs:restriction>
+                              </xs:simpleType>
+                            </xs:attribute>
+                          </xs:extension>
+                        </xs:simpleContent>
+                      </xs:complexType>
+                    </xs:element>
+                  </xs:sequence>
+                </xs:complexType>
+              </xs:element>
+            </xs:schema>
+          XSD
+        end
+
+        it "accepts when every instance matches the facet" do
+          doc = ctx.parse(
+            '<doc><elem code="ab">x</elem><elem code="z9">y</elem></doc>',
+          )
+          expect(schema.valid?(doc)).to be(true)
+        end
+
+        it "rejects when one instance mismatches" do
+          doc = ctx.parse(
+            '<doc><elem code="ab">x</elem><elem code="1">y</elem></doc>',
+          )
+          expect(schema.valid?(doc)).to be(false)
+        end
+      end
+
+      describe "class subtraction rides the engine unchanged" do
+        let(:schema) do
+          ctx.xsd(<<~'XSD')
+            <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
+              <xs:element name="doc">
+                <xs:complexType>
+                  <xs:sequence>
+                    <xs:element name="elem" type="latinish"
+                                minOccurs="1"/>
+                  </xs:sequence>
+                </xs:complexType>
+              </xs:element>
+              <xs:simpleType name="latinish">
+                <xs:restriction base="xs:string">
+                  <xs:pattern value="[\p{IsBasicLatin}-[abc]]+"/>
+                </xs:restriction>
+              </xs:simpleType>
+            </xs:schema>
+          XSD
+        end
+
+        it "keeps the engine's answer" do
+          # The translation refuses subtraction, so the dismissal
+          # never fires: both engines answer per their own
+          # dialect coverage, unmodified by the facade.
+          doc = ctx.parse("<doc><elem>xyz</elem></doc>")
+          expect(schema.valid?(doc)).to be(true)
+        end
+      end
+    end
+  end
+end

data/spec/moxml/xsd_substitution_spec.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Processing model §Validation (normative): pinned here.
+# #466 class 1: the engine's content-model matcher matches
+# particles by exact name only, so a valid substitution-group
+# member is rejected with "children do not match the content
+# model". The Ruby-side dismissal drops such a finding only when
+# the parent's content model is a pure sequence, the child
+# sequence matches it position-for-position with every particle
+# exactly-once, and a registered member realizes a position —
+# any choice/all, cardinality violation, or unknown name keeps
+# the engine's answer, so the dismissal can only remove false
+# rejections, never create false acceptances.
+RSpec.describe "Moxml::XSD substitution-group dismissal (#466)" do
+  %i[nokogiri leptris].each do |adapter_name|
+    describe "on #{adapter_name}" do
+      let(:ctx) { Moxml.new(adapter_name) }
+
+      before do
+        skip "#{adapter_name} requires an XSD-capable engine" unless
+          Moxml::XSD.supported?(ctx)
+      end
+
+      describe "member of a referenced head particle" do
+        let(:schema) do
+          ctx.xsd(<<~XSD)
+            <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:x="http://xsdtesting"
+                targetNamespace="http://xsdtesting"
+                elementFormDefault="qualified">
+              <xsd:element name="doc">
+                <xsd:complexType>
+                  <xsd:sequence>
+                    <xsd:element ref="x:elem1"/>
+                  </xsd:sequence>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="elem1" abstract="false"/>
+              <xsd:element name="elem2" substitutionGroup="x:elem1"/>
+            </xsd:schema>
+          XSD
+        end
+
+        it "accepts the member where the head is declared" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting"><x:elem2/></x:doc>',
+          )
+          expect(schema.valid?(doc)).to be(true)
+        end
+
+        it "accepts the head itself" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting"><x:elem1/></x:doc>',
+          )
+          expect(schema.valid?(doc)).to be(true)
+        end
+
+        it "rejects a stray non-member child" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting"><x:unknown/></x:doc>',
+          )
+          expect(schema.valid?(doc)).to be(false)
+        end
+      end
+
+      describe "member inside a nested sequence" do
+        let(:schema) do
+          ctx.xsd(<<~XSD)
+            <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:x="http://xsdtesting"
+                targetNamespace="http://xsdtesting"
+                elementFormDefault="qualified">
+              <xsd:element name="doc">
+                <xsd:complexType>
+                  <xsd:sequence>
+                    <xsd:element ref="x:mid"/>
+                  </xsd:sequence>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="mid">
+                <xsd:complexType>
+                  <xsd:sequence>
+                    <xsd:element ref="x:elem1"/>
+                  </xsd:sequence>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="elem1" abstract="false"/>
+              <xsd:element name="elem2" substitutionGroup="x:elem1"/>
+            </xsd:schema>
+          XSD
+        end
+
+        it "accepts the member at the inner position" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting">' \
+            "<x:mid><x:elem2/></x:mid></x:doc>",
+          )
+          expect(schema.valid?(doc)).to be(true)
+        end
+      end
+
+      describe "models the dismissal refuses" do
+        let(:schema) do
+          ctx.xsd(<<~XSD)
+            <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:x="http://xsdtesting"
+                targetNamespace="http://xsdtesting"
+                elementFormDefault="qualified">
+              <xsd:element name="doc">
+                <xsd:complexType>
+                  <xsd:choice>
+                    <xsd:element ref="x:elem1"/>
+                    <xsd:element name="other"/>
+                  </xsd:choice>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="elem1" abstract="false"/>
+              <xsd:element name="elem2" substitutionGroup="x:elem1"/>
+            </xsd:schema>
+          XSD
+        end
+
+        it "keeps the engine's answer for a two-child choice match" do
+          # A choice takes one item; two children cannot be valid
+          # even though both names resolve — the flattened particle
+          # list is not a validity witness for non-sequences.
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting">' \
+            "<x:elem2/><x:other/></x:doc>",
+          )
+          expect(schema.valid?(doc)).to be(false)
+        end
+      end
+
+      describe "cardinality the dismissal refuses" do
+        let(:schema) do
+          ctx.xsd(<<~XSD)
+            <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:x="http://xsdtesting"
+                targetNamespace="http://xsdtesting"
+                elementFormDefault="qualified">
+              <xsd:element name="doc">
+                <xsd:complexType>
+                  <xsd:sequence>
+                    <xsd:element ref="x:elem1" minOccurs="2" maxOccurs="2"/>
+                  </xsd:sequence>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="elem1" abstract="false"/>
+              <xsd:element name="elem2" substitutionGroup="x:elem1"/>
+            </xsd:schema>
+          XSD
+        end
+
+        it "keeps the engine's answer below minOccurs" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting"><x:elem2/></x:doc>',
+          )
+          expect(schema.valid?(doc)).to be(false)
+        end
+      end
+    end
+  end
+end

data/spec/support/model_coverage.rb

@@ -89,6 +89,14 @@ module ModelCoverage
       section: "Validation",
       pin: "spec/moxml/xsd_version_spec.rb",
     },
+    "validation regex dismissal" => {
+      section: "Validation",
+      pin: "spec/moxml/xsd_regex_spec.rb",
+    },
+    "validation substitution dismissal" => {
+      section: "Validation",
+      pin: "spec/moxml/xsd_substitution_spec.rb",
+    },
     "loud capability contracts" => {
       section: "Errors and loud degradation",
       pin: "spec/consistency/loud_degradation_spec.rb",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: moxml
 version: !ruby/object:Gem::Version
-  version: 0.5.163
+  version: 0.5.166
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-25 00:00:00.000000000 Z
+date: 2026-10-26 00:00:00.000000000 Z
 dependencies: []
 description: |
   Moxml is a unified XML manipulation library that provides a common API
@@ -631,8 +631,10 @@ files:
 - spec/moxml/xpath_spec.rb
 - spec/moxml/xsd_error_contract_spec.rb
 - spec/moxml/xsd_handle_mismatch_spec.rb
+- spec/moxml/xsd_regex_spec.rb
 - spec/moxml/xsd_release_spec.rb
 - spec/moxml/xsd_spec.rb
+- spec/moxml/xsd_substitution_spec.rb
 - spec/moxml/xsd_underdetection_spec.rb
 - spec/moxml/xsd_version_spec.rb
 - spec/moxml/xslt/stylesheet_spec.rb