lutaml-model 0.8.96 → 0.8.97

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b4bd8b10dc92c3a53f615bb3e13c907d1cc4976eb547a5a2da41aa2837bef17
-  data.tar.gz: e1e5eacb6d80dc8108d65a5264d5e9d872d4259103672f6a88e0d912b437002f
+  metadata.gz: 2dcefe56e003b241812971d37fc9d76d6b6945cb5a138a9fa15f9ce2aa4fbd7d
+  data.tar.gz: 835dfecf768169c9fbc6ab772c2e11dbe593f3f5e9deb7016b09c8088706117c
 SHA512:
-  metadata.gz: efa1a2368c6f2f0352dd928eb33c4c45c9580a431ca3847fe709fcb1026f29deaf2f55e7ec52eafaebdac537ef0c5d55588b22d37d6f6bb27d332165ad9a795a
-  data.tar.gz: 5380981def9666c4ec1fa0f4cb7f977dcba141a5278003a96486d814e7c812d2083339baa3d9d8079c3029d7aef0e84226be40eb188315bd5270c974baed1dda
+  metadata.gz: 7efe4b0bc24f20b9d48e37c33b5e23cf23af7397900a7d788912275a4b396318d916c721b21bc6373de53e99f3f4f0dc29e459c94bba2e2baaf8c4da67232c14
+  data.tar.gz: 59d5412393469b1904c4c6e29bc0ff58b0c6333b5e3710e531d9e7a8ae465e7762993288f04e6147a12a204a8fb581059a24491d9dc90d7f309e78b1bb39b97a

data/lib/lutaml/model/serialize/format_conversion.rb

@@ -95,7 +95,12 @@ module Lutaml
             options.key?(:mappings) || options.key?(:adapter) ||
             options.key?(:_adapter_override) ||
             options.key?(:indent) || options.key?(:xml_declaration) ||
-            options.key?(:declaration) || options.key?(:doctype)
+            options.key?(:declaration) || options.key?(:doctype) ||
+            # prefix requests ride the interpretive writer's use_prefix
+            # option (planner Tier-1) — the plan emission has no
+            # option-aware spelling. The instance-level option prep
+            # rewrites :prefix to :use_prefix before this gate.
+            options.key?(:prefix) || options.key?(:use_prefix)
 
           adapter_name = Lutaml::Model::Config.adapter_for(:xml)
           adapter_name &&= adapter_name.name
@@ -133,6 +138,7 @@ module Lutaml
           register = Lutaml::Model::Config.default_register
           plan = Lutaml::Xml::Leptris::PlanCompiler.compile(self, register)
           return nil unless plan
+          return nil unless Lutaml::Xml::Leptris::PlanCompiler.engine_walk_safe?(plan)
 
           root = ::Leptris::XML.parse(data.to_s).root
           return nil if root.nil?

data/lib/lutaml/model/serialize/initialization.rb

@@ -172,12 +172,30 @@ module Lutaml
         #
         # @param register [Symbol, nil] The register context
         def ensure_imports!(register = nil)
-          ensure_model_imports!(register)
-          ensure_choice_imports!(register)
-          ensure_restrict_attributes!(register)
-          # Hook for format-specific mapping import resolution.
-          # XML overrides this to call mappings[:xml]&.ensure_mappings_imported!(register)
-          ensure_format_mapping_imports!(register)
+          # Bounded re-entry for the resolution chain. Each leg's
+          # record_import_attempt tail calls attributes(), which calls
+          # back into ensure_imports!; nested passes converge imports
+          # whose targets only become resolvable after an earlier leg
+          # (so they must not be dropped), but with a permanently
+          # pending import the tail re-entered unboundedly and crashed
+          # with SystemStackError (#938). Two levels allow one nested
+          # convergence pass; deeper re-entry is suppressed per
+          # register and the counter unwinds on error.
+          register_id = extract_register_id(register)
+          (@ensure_imports_depth ||= {})[register_id] ||= 0
+          return if @ensure_imports_depth[register_id] >= 2
+
+          @ensure_imports_depth[register_id] += 1
+          begin
+            ensure_model_imports!(register)
+            ensure_choice_imports!(register)
+            ensure_restrict_attributes!(register)
+            # Hook for format-specific mapping import resolution.
+            # XML overrides this to call mappings[:xml]&.ensure_mappings_imported!(register)
+            ensure_format_mapping_imports!(register)
+          ensure
+            @ensure_imports_depth[register_id] -= 1
+          end
         end
 
         # Hook for format-specific mapping import resolution.
@@ -357,7 +375,7 @@ module Lutaml
           # chain's frames per level pushed that recursion past the
           # stack limit — models without pending deferred imports skip
           # it entirely.
-          ensure_imports!(register_id) if finalized? && deferred_imports_pending?
+          ensure_imports!(register_id) if finalized? && deferred_imports_pending?(register_id)
           instance = allocate
           instance.finalize_deserialization(register_id)
           instance

data/lib/lutaml/model/serialize/model_import.rb

@@ -162,11 +162,39 @@ module Lutaml
         # @param register_id [Symbol, nil] The register context
         # Whether deferred (symbol-form) imports are still pending —
         # gates the allocation-time ensure chain (#933).
-        def deferred_imports_pending?
-          importable_models.any? { |_method, models| models.any? } ||
-            importable_choices.any? do |_choice, imports|
-              imports.any? { |_method, models| models.any? }
+        # The attribute-set fingerprint at the moment an import
+        # resolution attempt ran — deferred_imports_pending? compares
+        # against it to skip re-resolution on stable sets.
+        def record_import_attempt(register_id)
+          # Raw stores only — the lazy attributes() re-enters
+          # ensure_imports! and, when @models_imported was just set to
+          # false (unresolved imports), cycles through this very
+          # method forever (the uniword register_in SystemStackError).
+          register_attrs = (@register_records ||= {})[register_id]
+          (@import_attempt_fingerprints ||= {})[register_id] =
+            @attributes.size + @choice_attributes.to_a.size +
+            (register_attrs ? register_attrs[:attributes].to_a.size : 0)
+        end
+
+        def deferred_imports_pending?(register_id = nil)
+          register_id ||= Lutaml::Model::Config.default_register
+          has_importables = importable_models.any? { |_m, models| models.any? } ||
+            importable_choices.any? do |_c, imports|
+              imports.any? { |_m, models| models.any? }
             end || restrict_attributes.any?
+          return false unless has_importables
+
+          # Unresolvable imports stay pending forever; re-running the
+          # ensure chain (and its state-defaults invalidation) on every
+          # allocation thrashed import-heavy models quadratically.
+          # Resolution re-arms only when the attribute set CHANGED
+          # since the last attempt — a late declaration after a failed
+          # resolution re-attempts; a stable set skips.
+          attempted = (@import_attempt_fingerprints ||= {})[register_id]
+          return true if attempted.nil?
+
+          current = attributes(register_id).size + @choice_attributes.to_a.size
+          current != attempted
         end
 
         def ensure_model_imports!(register_id = nil)
@@ -200,6 +228,7 @@ module Lutaml
           end
 
           @models_imported[register_id] = all_resolved
+          record_import_attempt(register_id)
         end
 
         # Ensure all choice imports are resolved for a specific register
@@ -239,6 +268,7 @@ module Lutaml
           end
 
           @choices_imported[register_id] = true if all_resolved
+          record_import_attempt(register_id)
           # Choice imports can add attributes without passing through
           # define_attribute_methods — recompile state defaults so the
           # seeding and raw readers cover them (#933). Only when an

data/lib/lutaml/model/version.rb

@@ -2,6 +2,6 @@
 
 module Lutaml
   module Model
-    VERSION = "0.8.96"
+    VERSION = "0.8.97"
   end
 end

data/lib/lutaml/xml/leptris/plan_compiler.rb

@@ -86,8 +86,49 @@ module Lutaml
             end
           end
 
+          # Two engine walk defects gate walk-side consumers here; both
+          # bail models to the interpretive matcher, whose exact-first-
+          # then-any-qualification precedence binds what the walk drops.
+          # The serialize side (PlanSerializer) reads the Ruby tree and
+          # stays on the fast path. leptris 1.9.320.0 (#1587) fixes
+          # both defects — the scan is skipped there and every model
+          # rides the walk again.
+          #
+          # leptris#1585: exact-URI CHILD-row ns_uri strings are not
+          # retained engine-side — once the build anchors are GC'd (a
+          # warm walk plus one GC suffices), those rows stop matching
+          # and hydration silently answers nil.
+          #
+          # leptris#1586: plain attribute rows do not leniently match
+          # namespace-qualified wire attributes (uniword fontTable:
+          # every w:name/w:val against a plain attr row hydrates nil).
+          # A plan level carrying plain attr rows under a namespaced
+          # chain therefore cannot be trusted on the walk; attribute
+          # rows with an exact URI (or :any) and plans without any
+          # namespace form are unaffected.
+          def engine_walk_safe?(plan)
+            return true if Leptris.walk_ns_safety_compatible?
+
+            tree_safe?(plan[:tree], false)
+          end
+
           private
 
+          def tree_safe?(tree, ancestor_ns)
+            namespaced = ancestor_ns || tree[:ns].is_a?(Hash)
+            attrs = tree[:attributes] || []
+            return false if namespaced &&
+              attrs.any? { |a| !a[:ns].is_a?(Hash) && a[:ns] != :any }
+
+            (tree[:children] || []).all? do |row|
+              return false if row[:ns].is_a?(Hash)
+
+              next true unless row[:kind] == :nested && row[:plan]
+
+              tree_safe?(row[:plan], namespaced)
+            end
+          end
+
           def build(model_class, register)
             return nil unless model_class.is_a?(Class) &&
               model_class.include?(::Lutaml::Model::Serialize)
@@ -162,7 +203,7 @@ module Lutaml
               return opt_out!(:fragment_with_ns) if fragment_needed && model_ns
 
               if rule.attribute?
-                opt = compile_attribute_row(rule, attr, register,
+                opt = compile_attribute_row(rule, attr, register, mapping,
                                             attr_rows, plan_attrs,
                                             ns_attr_names, attr_local_claims)
                 return opt_out!(opt) if opt
@@ -225,7 +266,22 @@ module Lutaml
                   return opt_out!(:non_scalar) unless scalar_type?(attr, register)
 
                   row = { name: rule.name.to_s }
-                  row[:ns] = child_ns(rule, model_ns) if rule.namespace_set?
+                  if rule.namespace_set?
+                    row[:ns] = child_ns(rule, model_ns)
+                  else
+                    # The interpretive writer qualifies an element row
+                    # by its attribute's type namespace when the rule
+                    # declares none (resolve step 4). Rows without the
+                    # type form inherit the tree namespace and land
+                    # under the wrong default xmlns (uniword
+                    # CoreProperties: <dc:title> spelled <title>).
+                    type_ns_form = element_type_ns_form(rule, attr,
+                                                        register, model_ns)
+                    return opt_out!(:elem_type_ns_symbol) if type_ns_form == :bail_symbol
+                    return opt_out!(:elem_type_ns_aliases) if type_ns_form == :bail_aliases
+
+                    row[:ns] = type_ns_form if type_ns_form
+                  end
                   # lutaml-model#88: same-name rows partitioned by the
                   # rule's discriminator ride the engine's exclusive
                   # predicate match (leptris 1.9.221+, #1272).
@@ -337,8 +393,8 @@ module Lutaml
           # non-sole-claimant alias families have no plan-side
           # resolution order); :blank / :inherit arrive as Symbols —
           # no URI to express in a row.
-          def compile_attribute_row(rule, attr, register, attr_rows,
-                                    plan_attrs, ns_attr_names,
+          def compile_attribute_row(rule, attr, register, mapping,
+                                    attr_rows, plan_attrs, ns_attr_names,
                                     attr_local_claims)
             return :non_scalar unless scalar_type?(attr, register)
 
@@ -346,6 +402,24 @@ module Lutaml
             type_ns = attr.type_namespace_class(register)
             claim = attr_local_claims[rule.name.to_s]
             if type_ns.nil?
+              # attribute_form_default :qualified on the model's
+              # namespace qualifies locally-declared attributes under
+              # the parent URI — the interpretive
+              # resolve_attribute_namespace contract (WML: updateFields
+              # w:val under xmlns="..."). The W3C default is
+              # :unqualified, so == :qualified means explicitly set.
+              # Rules with an explicit :blank stay unprefixed.
+              ns_class = mapping.namespace_class
+              if rule.namespace_param != :blank && ns_class &&
+                  ns_class.attribute_form_default == :qualified
+                claim[:ns] += 1
+                plan_attrs << { name: rule.name.to_s,
+                                ns: { exact: ns_class.uri.to_s,
+                                      prefix: ns_class.prefix_default&.to_s } }
+                ns_attr_names << rule.name.to_s
+                return nil
+              end
+
               claim[:plain] += 1
               plan_attrs << { name: rule.name.to_s }
               return nil
@@ -435,6 +509,29 @@ module Lutaml
             { exact: uri.to_s, prefix: rule.prefix&.to_s }
           end
 
+          # Type-namespace ns form for a scalar element row, mirroring
+          # the interpretive resolve_element_namespace step 4: the
+          # attribute's type namespace qualifies the row when the rule
+          # declares none. Rows inheriting the tree namespace (type ns
+          # nil, :inherit, or equal to the model's own URI) get no form.
+          # :blank and alias families have no row-expressible form —
+          # the model stays interpretive.
+          def element_type_ns_form(rule, attr, register, model_ns)
+            return nil if rule.namespace_set?
+
+            type_ns = attr.type_namespace_class(register)
+            return nil if type_ns.nil? || type_ns == :inherit
+            return :bail_symbol if type_ns.is_a?(Symbol)
+            return :bail_aliases unless Leptris.attr_ns_rows_compatible? &&
+              type_ns.all_uris.size == 1
+
+            form = { exact: type_ns.uri.to_s,
+                     prefix: type_ns.prefix_default&.to_s }
+            return nil if form[:exact] == model_ns&.[](:exact)
+
+            form
+          end
+
           def content_rows(rows)
             rows.count { |r| r[:kind] == :content }
           end

data/lib/lutaml/xml/leptris/plan_serializer.rb

@@ -38,7 +38,7 @@ module Lutaml
             return nil if plan[:ordered] && instance.element_order.nil?
 
             doc = ::Leptris::XML::Document.create
-            ns_ctx = Namespaces.new(plan)
+            ns_ctx = Namespaces.new(instance, plan, register)
             return nil if ns_ctx.unspellable?
 
             root = doc.create_element(
@@ -61,13 +61,51 @@ module Lutaml
           # first-encounter order — the #1558 contract on the DOM
           # path. A nested plan's own tree ns overrides the inherited
           # one; rows without an ns form inherit.
+          # Namespace spelling sourced from the interpretive writer's
+          # own machinery: NamespaceCollector + DeclarationPlanner
+          # decide prefix-vs-default per namespace exactly as the
+          # interpretive path does — no heuristic divergence (the
+          # uniword FontScheme/Image regressions). Option-bearing
+          # calls (prefix: true) never reach here; the serializer's
+          # plain spelling is the interpretive writer's plain
+          # spelling.
           class Namespaces
             attr_reader :unspellable
 
-            def initialize(plan)
+            def initialize(instance, plan, register)
               @forms = {}
+              @hoisted = {}
               @declared = {}
               @unspellable = false
+              mapping = plan[:mapping]
+              # The interpretive writer plans from the BUILT element
+              # tree: absent attributes (nil values) and absent
+              # children contribute no namespace needs, so an element
+              # whose own namespace would otherwise be prefix-hoisted
+              # (W3C: prefixed attributes need a prefix declaration)
+              # falls back to default-ns format. Collecting from the
+              # instance reproduces that — collecting from nil (type
+              # analysis) hoists every declared need and diverges
+              # (`<w:b xmlns:w>` vs the interpretive `<b xmlns>` when
+              # val=true omits the only prefixed attribute).
+              ns_prefix = if instance.is_a?(::Lutaml::Model::Serialize)
+                            instance.xml_namespace_prefix
+                          end
+              collect_options = { mapper_class: instance.class }
+              if ns_prefix && !ns_prefix.empty?
+                collect_options[:__xml_namespace_prefix] = ns_prefix
+              end
+              needs = Lutaml::Xml::NamespaceCollector.new(register).collect(
+                instance, mapping, **collect_options
+              )
+              planner = Lutaml::Xml::DeclarationPlanner.new(register)
+              declared_plan = planner.plan(
+                instance.class, mapping, needs, options: {}
+              )
+              declared_plan.root_node&.hoisted_declarations&.each do |prefix, uri|
+                @hoisted[uri] = prefix
+                @forms[uri] = { prefix: prefix, uri: uri }
+              end
               collect(plan[:tree])
             end
 
@@ -76,42 +114,55 @@ module Lutaml
             end
 
             def collect(tree)
-              register(tree[:ns])
-              (tree[:attributes] || []).each { |attr| register(attr[:ns]) }
+              check(tree[:ns])
+              (tree[:attributes] || []).each { |a| check(a[:ns]) }
               (tree[:children] || []).each do |row|
-                register(row[:ns]) if row[:ns].is_a?(Hash)
+                check(row[:ns]) if row[:ns].is_a?(Hash)
                 collect(row[:plan]) if row[:kind] == :nested && row[:plan]
               end
             end
 
-            def register(ns_form)
+            # An exact form the planner did not declare cannot be
+            # spelled — the serializer falls back interpretively.
+            def check(ns_form)
               return if ns_form.nil? || ns_form == :none || ns_form == :any
 
-              form = { prefix: ns_form[:prefix], uri: ns_form[:exact] }
-              @forms[ns_form[:exact]] ||= form
-              @unspellable = true if ns_form[:exact] && !ns_form.key?(:prefix)
+              uri = ns_form[:exact]
+              @unspellable = true if uri && !@forms.key?(uri)
             end
 
-            # The wire spelling for a local name under this form.
+            # The planner's hoisted prefix for a URI (nil when hoisted
+            # as the default namespace).
+            def prefix_for(uri)
+              @hoisted[uri]
+            end
+
+            # The wire spelling for a local name under this form: the
+            # planner's hoisted prefix for the URI, or unprefixed when
+            # hoisted as the default namespace.
             def spell(local, ns_form = nil)
-              form = ns_form.is_a?(Hash) ? ns_form : @forms[ns_form]
-              prefix = form && form[:prefix]
+              uri = if ns_form.is_a?(Hash)
+                      ns_form[:exact]
+                    else
+                      @forms.key?(ns_form) ? @forms[ns_form][:uri] : nil
+                    end
+              prefix = uri ? @hoisted[uri] : nil
               prefix ? "#{prefix}:#{local}" : local
             end
 
             def form_for(ns_form)
               return nil if ns_form.nil? || ns_form == :none
 
-              ns_form.is_a?(Hash) ? ns_form : @forms[ns_form]
+              ns_form.is_a?(Hash) ? { prefix: @hoisted[ns_form[:exact]], uri: ns_form[:exact] } : @forms[ns_form]
             end
 
-            def declare_on(root)
-              @forms.each_value do |form|
-                key = form[:uri]
+            def declare_on(root, _attr_form_prefix = nil)
+              @hoisted.each do |uri, prefix|
+                key = uri
                 next if key.nil? || @declared[key]
 
                 @declared[key] = true
-                root.add_namespace_definition(form[:prefix], form[:uri])
+                root.add_namespace_definition(prefix, uri)
               end
             end
           end
@@ -304,7 +355,16 @@ module Lutaml
             if ns_ctx
               (plan[:tree][:attributes] || []).each do |a|
                 form = a[:ns].is_a?(Hash) ? a[:ns] : nil
-                attr_prefixes[a[:name]] = form && form[:prefix]
+                # Namespaced attributes always spell prefixed (W3C:
+                # attributes cannot use the default namespace) — the
+                # interpretive writer emits the type namespace's own
+                # prefix even when the element hoists the same URI as
+                # the default namespace (updateFields w:val under
+                # xmlns="...").
+                attr_prefixes[a[:name]] =
+                  if form
+                    form[:prefix] || ns_ctx.prefix_for(form[:exact])
+                  end
               end
             end
             if recorded && !recorded.empty?

data/lib/lutaml/xml/leptris/plan_walk.rb

@@ -16,6 +16,7 @@ module Lutaml
             register = Lutaml::Model::Config.default_register
             plan = PlanCompiler.compile(model_class, register)
             return nil unless plan
+            return nil unless PlanCompiler.engine_walk_safe?(plan)
 
             document = ::Leptris::XML.parse(xml)
             root = document.root

data/lib/lutaml/xml/leptris.rb

@@ -33,6 +33,15 @@ module Lutaml
       # map_any_element catch-all. Ships with the 1.9.313 binding.
       MIN_LEPTRIS_WILDCARD_VERSION = "1.9.313.0"
 
+      # Walk-side namespace safety (leptris#1587, closing #1585 and
+      # #1586): child-row exact-URI ns_uri is retained engine-side
+      # (deep-copied at build, freed with the plan) and plain attribute
+      # rows leniently match namespace-qualified wire attributes
+      # (exact-first-then-any, top level and nested). Both shipped in
+      # 1.9.320.0; older engines keep the affected models interpretive
+      # through PlanCompiler.engine_walk_safe?.
+      MIN_LEPTRIS_WALK_NS_SAFETY_VERSION = "1.9.320.0"
+
       def self.plan_path_compatible?
         return false unless defined?(Gem)
 
@@ -61,6 +70,18 @@ module Lutaml
         spec && spec.version >= Gem::Version.new(MIN_LEPTRIS_WILDCARD_VERSION)
       end
 
+      # Memoized: consulted per parse on the walk gate hot path, and
+      # the loaded leptris spec cannot change within a process.
+      @walk_ns_safety = nil
+      def self.walk_ns_safety_compatible?
+        return @walk_ns_safety unless @walk_ns_safety.nil?
+        return (@walk_ns_safety = false) unless defined?(Gem)
+
+        spec = Gem.loaded_specs["leptris"]
+        @walk_ns_safety =
+          !!(spec && spec.version >= Gem::Version.new(MIN_LEPTRIS_WALK_NS_SAFETY_VERSION))
+      end
+
       autoload :PlanCompiler, "lutaml/xml/leptris/plan_compiler"
       autoload :PlanHydrator, "lutaml/xml/leptris/plan_hydrator"
       autoload :PlanOrder, "lutaml/xml/leptris/plan_order"

data/lib/lutaml/xml/model_transform.rb

@@ -384,21 +384,15 @@ module Lutaml
           value = if !rule.attribute? && rule.name.nil? &&
               xml_mapping.any_element_rule.equal?(rule)
                     # map_any_element: every child element no explicit
-                    # element rule claims, in document order. A name-less
-                    # MappingRule is otherwise indistinguishable from a
-                    # content rule (the dispatch consumed it as doc.text);
-                    # name-derived lookup also cannot express this — it
-                    # re-finds by name, losing order and double-picking.
-                    # The pass walks the document children once; the
-                    # normalize/cast pipeline below handles the rest.
-                    claimed = Set.new(
-                      xml_mapping.mappings(effective_register)
-                        .select { |r| !r.attribute? && r.name }
-                        .flat_map { |r| [r.name.to_s] },
+                    # element rule claims, in document order (claimed
+                    # set + scalar text extraction live in
+                    # any_element_members). A name-less MappingRule is
+                    # otherwise indistinguishable from a content rule;
+                    # name-derived lookup re-finds by name, losing
+                    # order and double-picking.
+                    any_element_members(
+                      doc, xml_mapping, attr, effective_register
                     )
-                    doc.element_children.reject do |child|
-                      claimed.include?(child.unprefixed_name)
-                    end
                   elsif rule.raw_mapping?
                     scoped_raw_inner_xml(doc, xml_mapping)
                   elsif rule.content_mapping?
@@ -1590,6 +1584,36 @@ effective_register = lutaml_register)
         end
       end
 
+      # map_any_element members: every child element no explicit
+      # element rule claims, in document order; scalar targets take
+      # the captured elements' text — the same normalize step scalar
+      # elements get (the cast pipeline receives strings, not wrappers
+      # whose to_s is their inspect); Serializable targets keep the
+      # wrappers and cast into instances.
+      def any_element_members(doc, mapping, attr, register)
+        claimed = Set.new(
+          mapping.mappings(register)
+            .select { |r| !r.attribute? && r.name }
+            .flat_map { |r| [r.name.to_s] },
+        )
+        unclaimed = doc.element_children.reject do |child|
+          claimed.include?(child.unprefixed_name)
+        end
+        return unclaimed if attr.nil? ||
+          attr_type_is_serializable(attr, register)
+
+        unclaimed.map do |child|
+          child_text = child.nil_element? ? nil : child&.text
+          child_cdata = child&.cdata
+          text = if child_text.is_a?(Array) || child_cdata.is_a?(Array)
+                   nil
+                 else
+                   child_text&.+ child_cdata
+                 end
+          text.nil? ? child : text
+        end
+      end
+
       def attr_type_is_serializable(attr, effective_register)
         attr&.serializable_type?(effective_register) || false
       end

data/spec/lutaml/model/model_import_reentry_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Issue #938: a deferred (symbol-form) import that cannot resolve leaves
+# the import pass with all_resolved = false. record_import_attempt then
+# calls attributes(), which re-enters ensure_imports!; the completion
+# marker stored false before that call, so the re-entrant pass ran the
+# import loop again and recursed to SystemStackError. Consumers with
+# large mutually-referencing type graphs (uniword OOXML sets) hit this
+# on load.
+module ModelImportReentry938
+  class OrphanSource < Lutaml::Model::Serializable
+    attribute :label, :string
+  end
+
+  class PendingImporter < Lutaml::Model::Serializable
+    attribute :name, :string
+    import_model_attributes :NoSuchModelAnywhere938
+  end
+
+  class ResolvableImporter < Lutaml::Model::Serializable
+    attribute :name, :string
+  end
+
+  Lutaml::Model::GlobalRegister
+    .lookup(Lutaml::Model::Config.default_register)
+    .register_model(OrphanSource, id: :ModelImportReentry938OrphanSource)
+  ResolvableImporter
+    .import_model_attributes(:ModelImportReentry938OrphanSource)
+end
+
+RSpec.describe "deferred model import re-entry" do
+  it "does not recurse when a deferred import cannot resolve" do
+    expect { ModelImportReentry938::PendingImporter.attributes(:default) }
+      .not_to raise_error
+  end
+
+  it "resolves a deferred import without recursing on re-access" do
+    importer = ModelImportReentry938::ResolvableImporter
+    3.times { importer.attributes(:default) }
+
+    expect(importer.attributes(:default)).to have_key(:name)
+    expect(importer.attributes(:default)).to have_key(:label)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lutaml-model
 version: !ruby/object:Gem::Version
-  version: 0.8.96
+  version: 0.8.97
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-07 00:00:00.000000000 Z
+date: 2026-10-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -1773,6 +1773,7 @@ files:
 - spec/lutaml/model/mapping_rule_perf_guard_spec.rb
 - spec/lutaml/model/mapping_type_validation_spec.rb
 - spec/lutaml/model/mixed_content_spec.rb
+- spec/lutaml/model/model_import_reentry_spec.rb
 - spec/lutaml/model/model_transformer_spec.rb
 - spec/lutaml/model/multiple_mapping_spec.rb
 - spec/lutaml/model/namespace_versioning_spec.rb