This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
In section 3.2.1 upd:mergeUpdates, semantics bullet 2. f. ii. reads: "upd:replaceNode creates one namespace binding on the $target element corresponding to the implied namespace binding of the name of each attribute node in $replacement." I believe here $target should be replaced with parent($target). When $replacement contains attributes, the $target node must also be an attribute. (see section 2.4.3.1, bullets 3/4) This issue also applies to step 1 in upd:applyUpdates.
We believe this is correct - I will fix this in the specification.