latexml_core/common/

model.rs

use std::{
  cell::RefCell,
  fs::File,
  io::{BufRead, BufReader},
};

use libxml::tree::Node;
use once_cell::sync::Lazy;
use regex::Regex;
use rustc_hash::FxHashSet as HashSet;

use super::arena::SymHashMap;
use crate::{
  common::{
    arena::{self, SymStr},
    error::*,
    relaxng::Relaxng,
    xml::XML_NS,
  },
  document::Document,
  pin,
  util::pathname,
};

// use common::font::*;

pub const LTX_NAMESPACE: &str = "http://dlmf.nist.gov/LaTeXML";
pub type IndirectModel = SymHashMap<SymHashMap<SymStr>>;

static PREFIXED_LOCALNAME_RE: Lazy<Regex> = Lazy::new(|| Regex::new(r"^([^:]+):(.+)$").unwrap());
static TAG_MODEL_LINE_RE: Lazy<Regex> =
  Lazy::new(|| Regex::new(r"^([^\{]+)\{(.*?)\}\((.*?)\)$").unwrap());
// Mirrors Perl Model.pm L149: `m/^([^:=]+):=\(?([^)]*?)\)?$/` — the
// `\(?…\)?` pair strips the surrounding parens from
// `classname:=(elt1,elt2,...)` so the elements split cleanly.
static CLASS_MODEL_LINE_RE: Lazy<Regex> =
  Lazy::new(|| Regex::new(r"^([^:=]+):=\(?([^)]*?)\)?$").unwrap());
static NAMESPACE_MODEL_LINE_RE: Lazy<Regex> = Lazy::new(|| Regex::new(r"^([^=]+)=(.*?)$").unwrap());

#[derive(Default, Debug)]
pub struct TagFrame {
  model:      HashSet<SymStr>,
  attributes: HashSet<SymStr>,
}

static DEFAULT_TAG_FRAME: Lazy<TagFrame> = Lazy::new(TagFrame::default);

#[derive(Default, Debug)]
pub struct Model {
  pub schema:                      Option<Relaxng>,
  pub schema_data:                 Option<Vec<SymStr>>,
  pub schema_class:                SymHashMap<HashSet<SymStr>>,
  pub code_namespace_prefixes:     SymHashMap<SymStr>,
  pub code_namespaces:             SymHashMap<SymStr>,
  pub document_namespace_prefixes: SymHashMap<SymStr>,
  pub document_namespaces:         SymHashMap<SymStr>,
  // doctype_namespaces: SymHashMap<SymStr>,
  // namespace_errors: usize,
  pub permissive:                  bool,
  pub no_compiled:                 bool,
  pub debug_mode:                  bool,
  pub namespace_errors:            u8,
  pub tagprop:                     SymHashMap<TagFrame>,
}

#[thread_local]
pub static MODEL: Lazy<RefCell<Model>> = Lazy::new(|| RefCell::new(Model::new()));

macro_rules! model {
  () => {
    (*MODEL).borrow()
  };
}
macro_rules! model_mut {
  () => {
    (*MODEL).borrow_mut()
  };
}

pub fn initialize_model() {
  let mut global_model = MODEL.borrow_mut();
  *global_model = Model::new();
}

/// Eagerly initialize this thread's `#[thread_local]` `MODEL` Lazy.
///
/// `Model::new()` interns the `xml` namespace prefix/URI via `arena::pin`,
/// so its `Lazy` initializer reaches into the `ARENA` thread-local. Forcing
/// it at conversion entry — *after* [`arena::force_init`](crate::common::arena::force_init)
/// and before `STATE`/`STOMACH` are built — keeps that init from running
/// re-entrantly from within another root's initialization, the macOS
/// `#[thread_local]` hazard behind issue #217. No behavioral change on
/// Linux (a later `set_model` for a schema-driven model still replaces it).
pub(crate) fn force_init() { Lazy::force(&MODEL); }

impl Model {
  pub fn new() -> Self {
    let mut model = Model::default();
    // model.xpath.register_function("match-font", |x, y| {font::match_font(x,y)})
    model.register_namespace("xml", Some(XML_NS));
    model.register_document_namespace("xml", Some(XML_NS));
    model
  }
  ///**********************************************************************
  /// Namespaces
  ///**********************************************************************
  /// There are TWO namespace mappings!!!
  /// One for coding, one for the document output.
  ///
  /// Coding: this namespace mapping associates prefixes to namespace URIs for
  ///   use in the latexml code, constructors and such.
  ///   This must be a one to one mapping and there are no default namespaces.
  /// Document: this namespace mapping associates prefixes to namespace URIs
  ///   as used in the generated document, and will be the
  ///   set of prefixes used in the generated output.
  ///   This mapping may also use a prefix of "#default" which is for
  ///   the unprefixed form of elements (not used for attributes!)
  pub fn register_namespace(&mut self, codeprefix: &str, namespace_opt: Option<&str>) {
    self.register_namespace_sym(arena::pin(codeprefix), namespace_opt.map(arena::pin))
  }
  pub fn register_namespace_sym(&mut self, codeprefix: SymStr, namespace_opt: Option<SymStr>) {
    // double-check empty strings are None
    let namespace_opt_checked = namespace_opt.filter(|val| *val != pin!(""));
    match namespace_opt_checked {
      Some(namespace) => {
        self
          .code_namespace_prefixes
          .insert_sym(namespace, codeprefix);
        self.code_namespaces.insert_sym(codeprefix, namespace);
      },
      None => {
        if let Some(prev) = self.code_namespaces.get_sym(codeprefix) {
          self.code_namespace_prefixes.remove_sym(*prev);
        };
        self.code_namespaces.remove_sym(codeprefix);
      },
    };
  }

  /// Register a prefix in the DOCUMENT mapping — the second of the two
  /// mappings described on [`Model::register_namespace`] above.
  ///
  /// An empty `docprefix` is the `#default` entry, i.e. the unprefixed form of
  /// elements (never attributes). `None` for the namespace unbinds the prefix.
  pub fn register_document_namespace(&mut self, docprefix: &str, namespace_opt: Option<&str>) {
    let default_sym = pin!("#default");
    let docprefix_sym = if docprefix.is_empty() {
      default_sym
    } else {
      arena::pin(docprefix)
    };

    match namespace_opt {
      Some(namespace) => {
        // Since the default namespace url can still ALSO have a prefix associated,
        // we prepend "DEFAULT#url" when using as a hash key in the prefixes table.
        let ns_sym = arena::pin(namespace);
        let regnamespace = if docprefix_sym == default_sym {
          arena::pin(s!("DEFAULT#{namespace}"))
        } else {
          ns_sym
        };
        self
          .document_namespace_prefixes
          .insert_sym(regnamespace, docprefix_sym);
        self.document_namespaces.insert_sym(docprefix_sym, ns_sym);
      },
      None => {
        if let Some(prev) = self.document_namespaces.get_sym(docprefix_sym) {
          self.document_namespace_prefixes.remove_sym(*prev);
        };
        self.document_namespaces.remove_sym(docprefix_sym);
      },
    };
  }

  pub fn set_relaxng_schema(&mut self, schema: &str) {
    self.schema_data = Some(vec![pin!("RelaxNG"), arena::pin(schema)]);
  }
  /// TODO: This is another component that would fit perfectly as a compiler plugin.
  /// For now, simply reimplementing the runtime loading of
  /// LaTeXML.model as-is from Model.pm
  pub fn load_compiled_schema(&mut self, path: &str) {
    let compiled_fh = File::open(path).unwrap();
    let compiled_reader = BufReader::new(&compiled_fh);
    let content: String = compiled_reader
      .lines()
      .map_while(std::result::Result::ok)
      .collect::<Vec<_>>()
      .join("\n");
    self.load_compiled_schema_str(&content, path);
  }

  /// Same as [`Self::load_compiled_schema`] but consumes an already-
  /// loaded `.model` body. `source` is used purely for diagnostic
  /// messages (the `note_begin`/`note_end` envelope and the
  /// malformed-line panic). Avoids the disk read when the model is
  /// served from the binary's own embedded RelaxNG table.
  pub fn load_compiled_schema_str(&mut self, content: &str, source: &str) {
    note_begin(&s!("Loading compiled schema {}\n", source));
    for line in content.lines() {
      if let Some(caps) = TAG_MODEL_LINE_RE.captures(line) {
        let tag = caps.get(1).map_or("", |m| m.as_str());
        let attr = caps.get(2).map_or("", |m| m.as_str());
        let children = caps.get(3).map_or("", |m| m.as_str());
        self.add_tag_attribute(tag, attr.split(',').collect());
        self.add_tag_content(tag, children.split(',').collect());
      } else if let Some(caps) = CLASS_MODEL_LINE_RE.captures(line) {
        let classname = caps.get(1).map_or("", |m| m.as_str());
        let elements = caps.get(2).map_or("", |m| m.as_str());
        let mut class_set = HashSet::default();
        for set_element in elements.split(',') {
          class_set.insert(arena::pin(set_element));
        }
        self.set_schema_class(classname, class_set);
      } else if let Some(caps) = NAMESPACE_MODEL_LINE_RE.captures(line) {
        let prefix = caps.get(1).map_or("", |m| m.as_str());
        let namespace = caps.get(2).map_or("", |m| m.as_str());
        self.register_document_namespace(prefix, Some(namespace));
      } else {
        panic!("Fatal:internal:{source} Compiled model '{source}' is malformatted at \"{line}\"");
      }
    }
    note_end(&s!("Loading compiled schema {source}\n"));
  }
  pub fn add_tag_content(&mut self, tag: &str, elements: Vec<&str>) {
    let frame = self.tagprop.entry(tag).or_default();

    for element in elements {
      frame.model.insert(arena::pin(element));
    }
  }

  // pub fn get_tag_attributes(&self, tag: &str) -> Vec<&str> {
  //   match self.tagprop.get(&arena::pin(tag)) {
  //     Some(h) => {
  //       let mut keys: Vec<&str> = h.attributes.iter().map(|s| arena::resolve(*s)).collect();
  //       keys.sort_unstable();
  //       keys
  //     },
  //     None => Vec::new(),
  //   }
  // }

  pub fn add_tag_attribute(&mut self, tag: &str, attributes: Vec<&str>) {
    let frame = self.tagprop.entry(tag).or_default();

    for attribute in attributes {
      frame.attributes.insert(arena::pin(attribute));
    }
  }

  pub fn set_schema_class(&mut self, classname: &str, content: HashSet<SymStr>) {
    self.schema_class.insert(classname, content);
  }

  /// Serialise the loaded schema into the `.model` plain-text format
  /// emitted by Perl `LaTeXML::Common::Model::compileSchema`
  /// (Model.pm L121-136). Three kinds of lines, all newline-separated:
  ///
  /// * `prefix=namespace` for every entry in `document_namespaces` (sorted by prefix).
  /// * `classname:=(elt1,elt2,...)` for every entry in `schema_class` (sorted by classname; each
  ///   element list sorted).
  /// * `tag{attr1,attr2}(child1,child2)` for every entry in `tagprop` (sorted by tag; attrs and
  ///   children sorted; tags whose name starts with `!` are skipped — they are content-model-only
  ///   negations).
  ///
  /// Output is identical to the Perl tool so a downstream
  /// `tools/compileschema.sh` can diff Rust vs. Perl-generated
  /// `LaTeXML.model` files byte-for-byte (modulo schema content).
  pub fn dump_compiled_schema(&self) -> String {
    fn sym_to_string(sym: SymStr) -> String { arena::with(sym, |s| s.to_string()) }
    fn syms_sorted(set: impl IntoIterator<Item = SymStr>) -> Vec<String> {
      let mut v: Vec<String> = set.into_iter().map(sym_to_string).collect();
      v.sort();
      v
    }
    let mut out = String::new();
    let prefixes = syms_sorted(self.document_namespaces.keys().copied());
    for prefix in &prefixes {
      let ns_opt = self
        .document_namespaces
        .get_sym(arena::pin(prefix.as_str()));
      let ns = match ns_opt {
        Some(v) => sym_to_string(*v),
        None => continue,
      };
      out.push_str(prefix);
      out.push('=');
      out.push_str(&ns);
      out.push('\n');
    }
    let classnames = syms_sorted(self.schema_class.keys().copied());
    for classname in &classnames {
      let elements = match self.schema_class.get_sym(arena::pin(classname.as_str())) {
        Some(set) => set,
        None => continue,
      };
      let elt_names = syms_sorted(elements.iter().copied());
      out.push_str(classname);
      out.push_str(":=(");
      out.push_str(&elt_names.join(","));
      out.push_str(")\n");
    }
    let tags = syms_sorted(self.tagprop.keys().copied());
    for tag in &tags {
      if tag.starts_with('!') {
        continue;
      }
      let frame = match self.tagprop.get_sym(arena::pin(tag.as_str())) {
        Some(f) => f,
        None => continue,
      };
      let attrs = syms_sorted(frame.attributes.iter().copied());
      let children = syms_sorted(frame.model.iter().copied());
      out.push_str(tag);
      out.push('{');
      out.push_str(&attrs.join(","));
      out.push_str("}(");
      out.push_str(&children.join(","));
      out.push_str(")\n");
    }
    out
  }
  pub fn describe_model(&self) {}
  fn load_internal_extensions(&mut self) {
    if !self.tagprop.contains_key("ltx:_CaptureBlock_") {
      // Synthesize ltx:_CaptureBlock_ to act like the union of ltx:block,
      // ltx:logical-block, ltx:sectional-block, Caption, FrontMatter,
      // BackMatter (Perl Common/Model.pm loadInternalExtensions L96-97).
      // FrontMatter/BackMatter were missing here, so a captured box that
      // legitimately holds frontmatter/backmatter content was modelled
      // more narrowly than Perl.
      self.synthesize_element("ltx:_CaptureBlock_", &[
        "ltx:block",
        "ltx:logical-block",
        "ltx:sectional-block",
        "Caption",
        "FrontMatter",
        "BackMatter",
      ]);
      let cb_entry = self.tagprop.entry("ltx:_CaptureBlock_").or_default();
      cb_entry.model.insert(pin!("svg:g"));
      cb_entry.model.insert(pin!("svg:foreignObject"));
    }
  }

  /// Clone the tagprop's (allowed content & attributes) of @other to $tag
  fn synthesize_element(&mut self, tag: &str, others: &[&str]) {
    let mut to_add_in_model = Vec::new();
    let mut to_add_in_attrs = Vec::new();
    for other in others {
      if let Some(content) = self.schema_class.get(other) {
        for child in content {
          to_add_in_model.push(*child);
        }
      } else if let Some(entry) = self.tagprop.get(other) {
        for child in &entry.model {
          to_add_in_model.push(*child);
        }
        for attr in &entry.attributes {
          to_add_in_attrs.push(*attr);
        }
      }
    }
    let capture = self.tagprop.entry(tag).or_default();
    for child in to_add_in_model {
      capture.model.insert(child);
    }
    for attr in to_add_in_attrs {
      capture.attributes.insert(attr);
    }
  }
}

pub fn set_relaxng_schema(schema: &str) { model_mut!().set_relaxng_schema(schema) }
pub fn add_schema_declaration(document: &mut Document) {
  if let Some(ref schema) = model!().schema {
    schema.add_schema_declaration(document);
  }
}

pub fn load_schema(search_paths: &[&str]) -> Result<()> {
  // Only load once
  let mut model = model_mut!();
  if model.schema.is_some() {
    return Ok(());
  }
  let mut name = String::new();
  if model.schema_data.is_none() {
    // TODO: Return this code path to normal once we properly load schemas
    Warn!("expected", "<model>", "TODO");
    // Warn('expected', '<model>', undef, "No Schema Model has been declared; assuming LaTeXML");
    // // article ??? or what ? undef gives problems!

    model.register_document_namespace("ltx", Some(LTX_NAMESPACE));
    model.set_relaxng_schema("LaTeXML");
    model.register_namespace("ltx", Some(LTX_NAMESPACE));
    model.register_namespace("svg", Some("http://www.w3.org/2000/svg"));
    model.register_namespace("xlink", Some("http://www.w3.org/1999/xlink")); // Needed for SVG
    model.register_namespace("m", Some("http://www.w3.org/1998/Math/MathML"));
    model.register_namespace("xhtml", Some("http://www.w3.org/1999/xhtml"));
    model.permissive = true;
  } // Actually, they could have declared all sorts of Tags....
  // Only RelaxNG schemas are supported (DTD support removed from Rust port)
  if let Some(ref data) = model.schema_data {
    if data[0] == pin!("RelaxNG") {
      name = arena::to_string(data[1]);
      model.schema = Some(Relaxng {
        name: name.clone(),
        ..Relaxng::default()
      });
    } else {
      let message = arena::with(data[0], |schema_type_str| {
        s!("Can't load a schema of type {schema_type_str:?}")
      });
      Error!("unknown", "schematype", message)
    }
  }

  if !model.no_compiled && model.schema.is_some() {
    let paths: Option<Vec<String>> = if search_paths.is_empty() {
      None
    } else {
      Some(search_paths.iter().map(ToString::to_string).collect())
    };
    let pathname_opt = pathname::find(&name, pathname::PathnameFindOptions {
      paths,
      extensions: Some(vec![s!("model")]),
      installation_subdir: Some(s!("resources/RelaxNG")),
    });

    match pathname_opt {
      Some(compiled_path) => model.load_compiled_schema(&compiled_path),
      None => {
        // No `.model` on the searchpath. Try the embedded RelaxNG
        // table for a same-named compiled schema first (the
        // distribution path — binary running outside the source
        // tree); fall through to raw `.rng` parsing if that misses
        // too.
        let embed_key = format!("{}.model", name);
        if let Some(content) = crate::common::relaxng::embedded::lookup(&embed_key) {
          model.load_compiled_schema_str(content, &format!("<embedded>/{embed_key}"));
        } else {
          let paths: Vec<&std::path::Path> =
            search_paths.iter().map(std::path::Path::new).collect();
          // Seed the scanner with the model's registered code-namespace prefixes
          // (e.g. `ltx` → dlmf from `base_schema`), so a schema whose target
          // namespace appears only as a default `ns=` — with no `xmlns:` prefix,
          // exactly how `LaTeXML.rng` is written — resolves to that conventional
          // prefix instead of a synthetic `namespaceN` the runtime never matches
          // (Perl: the scanner delegates `encodeQName` to the model; #652).
          // Collect first: the immutable borrow ends before `schema.as_mut()`.
          let code_prefix_seed: Vec<(String, String)> = model
            .code_namespace_prefixes
            .iter()
            .map(|(uri, prefix)| {
              (
                arena::with(*uri, |s| s.to_string()),
                arena::with(*prefix, |s| s.to_string()),
              )
            })
            .collect();
          let schema = model.schema.as_mut().unwrap();
          schema.code_namespace_prefixes = code_prefix_seed.into_iter().collect();
          let schema_name = schema.name.clone();
          match schema.load_schema(&schema_name, &paths) {
            Err(err) => {
              let msg = format!("load_schema failed for {}: {}", schema_name, err);
              Warn!("expected", "RelaxNG", msg);
            },
            // A raw `.rng` was scanned but the tag/attribute/namespace/class
            // tables the runtime consults are NOT baked into it (unlike a
            // compiled `.model`). Distil them now — else `tagprop` stays empty
            // and every element is rejected (#652). `compute_model_data` owns its
            // result, so the immutable `model.schema` borrow ends before the
            // `add_*`/`register_*`/`set_*` mutations below.
            Ok(()) => {
              let data = model.schema.as_ref().unwrap().compute_model_data();
              for (tag, children) in &data.tag_contents {
                model.add_tag_content(tag, children.iter().map(String::as_str).collect());
              }
              for (tag, attrs) in &data.tag_attributes {
                model.add_tag_attribute(tag, attrs.iter().map(String::as_str).collect());
              }
              for (name, members) in &data.schema_classes {
                model.set_schema_class(name, members.iter().map(arena::pin).collect());
              }
              for (prefix, uri) in &data.namespaces {
                model.register_document_namespace(prefix, Some(uri));
              }
              // Perl RelaxNG.pm L78: register the schema's primary namespace as
              // the DEFAULT document namespace, so the output serializes it with
              // no prefix (the schema's unprefixed default-`ns=` elements).
              // Generalized from Perl's hardcoded dlmf to the schema's ACTUAL
              // primary namespace, so a schema with a different default namespace
              // gets ITS namespace as the output default — full namespace
              // expressivity, user-directed (#652). For a LaTeXML-namespace
              // schema this is identical to Perl. (`""` prefix → `#default`.)
              let primary = model.schema.as_ref().unwrap().primary_namespace.clone();
              if let Some(primary) = primary {
                model.register_document_namespace("", Some(&primary));
              }
            },
          }
        }
      },
    };
  }
  model.load_internal_extensions();
  if model.debug_mode {
    model.describe_model()
  }

  Ok(())
}

pub fn get_document_namespace_prefix(
  namespace: &str,
  forattribute: bool,
  probe: bool,
) -> Option<SymStr> {
  // Get the prefix associated with the namespace url, noting that for elements, it might by
  // "#default", but for attributes would never be.
  // log!("Searching for {:?} in {:?}", namespace, self.document_namespace_prefixes);
  let mut docprefix = if !forattribute {
    model!()
      .document_namespace_prefixes
      .get(&s!("DEFAULT#{namespace}"))
      .copied()
  } else {
    None
  };
  let ns_sym = arena::pin(namespace);
  if docprefix.is_none() {
    docprefix = model!()
      .document_namespace_prefixes
      .get_sym(ns_sym)
      .copied();
  }

  // Perl Model.pm `getDocumentNamespacePrefix` L242: for a non-LaTeXML
  // namespace with no explicit document prefix, fall back to the registered
  // CODE prefix. This is what lets FOREIGN namespaces — built-in (`svg`, `m`,
  // `xlink`, `xhtml`) or supplied by a third-party / runtime `.rhai` binding via
  // `RegisterNamespace` — serialize under their conventional prefix instead of a
  // synthetic `namespaceN` + "no prefix registered" warning (#652). The LaTeXML
  // namespace is excluded: it is the default document namespace (registered from
  // the schema's primary `ns=`) and serializes with no prefix.
  if docprefix.is_none() && namespace != LTX_NAMESPACE {
    docprefix = model!().code_namespace_prefixes.get_sym(ns_sym).copied();
  }

  if docprefix.is_none() && !probe {
    {
      model_mut!().namespace_errors += 1;
    }
    let ns_err = s!("namespace{}", &model!().namespace_errors.to_string());
    docprefix = Some(arena::pin(&ns_err));
    {
      model_mut!().register_document_namespace(&ns_err, Some(namespace));
    }
    let message2 = if let Some(dp) = docprefix {
      arena::with(dp, |dp_str| s!("Using '{dp_str}' instead"))
    } else {
      String::from("No prefix to fall back on.")
    };
    Warn!(
      "malformed",
      namespace,
      "No prefix has been registered for namespace (in document)",
      message2
    );
  }
  let default_sym = pin!("#default");
  docprefix.filter(|p| p != &default_sym)
}

pub fn get_document_namespace(docprefix: &str, probe: bool) -> Option<String> {
  let h_default_sym = pin!("#default");
  let docprefix_sym = if docprefix.is_empty() {
    h_default_sym
  } else {
    arena::pin(docprefix)
  };
  let ns_str = match model!().document_namespaces.get_sym(docprefix_sym) {
    None => String::new(),
    Some(sym) => arena::with(*sym, |s| {
      if s.starts_with("DEFAULT#") {
        s.replacen("DEFAULT#", "", 1)
      } else {
        s.to_string()
      }
    }),
  };

  if docprefix_sym != h_default_sym && ns_str.is_empty() && !probe {
    {
      model_mut!().namespace_errors += 1;
    }
    let ns_error = s!(
      "http://example.com/namespace{}",
      &model!().namespace_errors.to_string()
    );
    {
      model_mut!().register_document_namespace(docprefix, Some(&ns_error));
    }
    let msg1 = arena::with(docprefix_sym, |dp_str| {
      s!("No namespace has been registered for prefix '{dp_str}' (in document)")
    });
    let msg2 = s!("Using '{ns_str}' instead");
    let err = || {
      Error!("malformed", docprefix, msg1, msg2);
      Ok(())
    };
    err().ok();
  }
  if ns_str.is_empty() {
    None
  } else {
    Some(ns_str)
  }
}

/// Get the (code) prefix associated with $namespace,
/// creating a dummy prefix and signalling an error if none has been registered.
///
/// In the following:
/// $forattribute is 1 if the namespace is for an attribute (in which case, there must be a
/// non-empty prefix) $probe, if non 0, just test for namespace, without creating an entry
/// if missing.
pub fn get_namespace_prefix(namespace: &str, _forattribute: bool, probe: bool) -> Option<SymStr> {
  let mut codeprefix: Option<SymStr> = None;
  let ns_sym = arena::pin(namespace);
  let mut model = model_mut!();
  if !namespace.is_empty() {
    codeprefix = model.code_namespace_prefixes.get_sym(ns_sym).copied();

    if codeprefix.is_some() && !probe {
      {
        let docprefix = model.document_namespace_prefixes.get_sym(ns_sym);
        // if there's a doc prefix and it's NOT already used in code namespace mapping
        if docprefix.is_some() && !model.code_namespaces.contains_key_sym(docprefix.unwrap()) {
          codeprefix = docprefix.copied();
        }
      }
    } else {
      // Else synthesize one
      model.namespace_errors += 1;
      let auto_prefix = arena::pin(s!("namespace{}", &model.namespace_errors.to_string()));
      codeprefix = Some(auto_prefix);
    }
    model.register_namespace_sym(codeprefix.unwrap(), Some(arena::pin(namespace)));
    // Warn!('malformed', $namespace, undef,
    //   "No prefix has been registered for namespace '$namespace' (in code)",
    //   "Using '$codeprefix' instead"); }
  }

  codeprefix
}

pub fn get_namespace(codeprefix: &str, probe: bool) -> Result<Option<SymStr>> {
  let mut model = model_mut!();
  let mut ns: Option<SymStr> = model.code_namespaces.get(codeprefix).copied();
  if ns.is_none() && !probe {
    model.namespace_errors += 1;
    let example_namespace = s!(
      "http://example.com/namespace{}",
      &model.namespace_errors.to_string()
    );
    ns = Some(arena::pin(&example_namespace));
    model.register_namespace(codeprefix, Some(&example_namespace));
    Error!(
      "malformed",
      codeprefix,
      s!("No namespace has been registered for prefix '{codeprefix}' (in code)"),
      s!("Using '{example_namespace}' instead")
    );
  }
  Ok(ns)
}

/// Get the node's qualified name in standard form
/// Ie. using the registered (code) prefix for that namespace.
/// NOTE: Reconsider how _Capture_ & _WildCard_ should be integrated!?!
/// Build a `prefix:local` qname with one exact-capacity allocation, avoiding the
/// `format!` machinery (`s!`) that showed up under `get_node_qname` in profiles —
/// this runs on every model check / serialization step.
#[inline]
fn prefixed_qname(prefix: &str, local: &str) -> String {
  let mut q = String::with_capacity(prefix.len() + 1 + local.len());
  q.push_str(prefix);
  q.push(':');
  q.push_str(local);
  q
}

pub fn get_node_qname(node: &Node) -> SymStr {
  use libxml::tree::NodeType::*;
  let node_type = node.get_type();
  if node_type.is_none() {
    return pin!("#BrokenNode");
  }
  // per-node hot path: the literal branches use the call-site-cached `pin!`
  // (branch+load) rather than a per-call `pin_static` arena probe.
  match node_type.unwrap() {
    TextNode => pin!("#PCDATA"),
    DocumentNode => pin!("#Document"),
    CommentNode => pin!("#Comment"),
    PiNode => pin!("#ProcessingInstruction"),
    DTDNode => pin!("#DTD"),
    NamespaceDecl => {
      // match node.declared_uri() {
      //   Some(ns) => match self.get_namespace_prefix(ns, false, true) {
      //     Some(prefix) => s!("xmlns:")+prefix,
      //     None => s!("xmlns")
      //   },
      //   None => s!("xmlns")
      // }
      pin!("xmlns")
    },
    ElementNode | AttributeNode => {
      let name_str = node.get_name();
      // Use the actual namespace prefix from the node when available.
      // For SVG/MathML/etc with explicit prefix, use that prefix directly.
      if let Some(ns) = node.get_namespace() {
        let prefix = ns.get_prefix();
        if prefix.is_empty() {
          // Default namespace — use ltx: prefix. The document we build declares
          // ltx as ITS default namespace, so an empty prefix means ltx here, and
          // this deliberately does NOT read the namespace URI to confirm it:
          // `Namespace::get_href` allocates a String per call, and on this path
          // (~140 call sites, once per node and per attribute) that measured a
          // 3.4% whole-conversion regression. A node whose DEFAULT namespace is
          // something else can only come from a foreign document — see
          // [`get_foreign_node_qname`], which is what reads such a tree.
          arena::pin(prefixed_qname("ltx", &name_str))
        } else {
          // Explicit prefix (e.g., "svg", "m") — use it
          arena::pin(prefixed_qname(&prefix, &name_str))
        }
      } else {
        // No namespace — special cases for non-namespaced elements
        match name_str.as_str() {
          "song" | "verse" => arena::pin(name_str),
          regular => arena::pin(prefixed_qname("ltx", regular)),
        }
      }
    },
    // Need others?
    _ => {
      // Defense-in-depth (issue #217): a node with an unexpected libxml2 type
      // reached qname resolution. Degrade to the same `#BrokenNode` sentinel
      // the `node_type.is_none()` arm above already returns, rather than the
      // original hard `panic!`. LaTeXML never builds such nodes, so on a
      // healthy tree this arm is unreachable; it exists only so a stray
      // corrupt/foreign node can never crash qname resolution.
      pin!("#BrokenNode")
    },
  }
}

/// [`get_node_qname`] for a node read out of a FOREIGN document — a tree parsed
/// by [`crate::common::xml::parse_fragment`] rather than built by us. Used by
/// `Document::append_tree`, the one place such a tree is ever walked.
///
/// The difference is confined to the DEFAULT-namespace case. Perl's single
/// `Model::getNodeQName` always maps a namespace URI to its registered code
/// prefix (`Common/Model.pm` → `getNamespacePrefix`), which is what gives
/// `RegisterNamespace` (`Package.pm:2049`) its effect on absorbed content: an
/// xhtml snippet arrives as `<p xmlns="…/1999/xhtml">`, i.e. an EMPTY libxml
/// prefix over a non-ltx URI, and must be re-created as `xhtml:p`. Mislabelling
/// it `ltx:p` would strip exactly the namespace the XHTML post-processor keys on
/// (`copy-foreign` matches `xhtml:*`), silently dropping the raw HTML.
///
/// Splitting that off from `get_node_qname` is a pure PERFORMANCE factoring with
/// no behavioural difference, because inside our own document an element either
/// sits in the ltx default namespace or carries an explicit code prefix — the
/// re-created `xhtml:p` above included. So only a foreign tree can present the
/// ambiguous shape, and reading the URI on the shared path would cost every
/// other caller a `String` allocation per node (measured: 3.4%).
pub fn get_foreign_node_qname(node: &Node) -> SymStr {
  if let Some(ns) = node.get_namespace()
    && ns.get_prefix().is_empty()
  {
    let href = ns.get_href();
    if !href.is_empty() && href != LTX_NAMESPACE {
      // `.copied()` yields an owned SymStr, so the model guard does not outlive
      // this expression (no borrow held across the arena pins below).
      let registered = model!()
        .code_namespace_prefixes
        .get_sym(arena::pin(href.as_str()))
        .copied();
      // An UNREGISTERED URI keeps the historical ltx fallback, i.e. whatever
      // `get_node_qname` would have said.
      if let Some(code_prefix) = registered {
        let name_str = node.get_name();
        return arena::pin(arena::with(code_prefix, |p| prefixed_qname(p, &name_str)));
      }
    }
  }
  get_node_qname(node)
}

/// Borrow a node's qualified name (`ltx:section`, `#PCDATA`, …) as a `&str`
/// for the duration of `caller`.
///
/// The closure form is the point: qnames are interned, and lending the arena's
/// copy lets a caller compare or match on the name without the `String` that
/// [`get_node_qname`] + `to_string` would allocate on every node of a walk.
pub fn with_node_qname<R, FnR>(node: &Node, caller: FnR) -> R
where FnR: FnOnce(&str) -> R {
  let qsym = get_node_qname(node);
  arena::with(qsym, |qname_str| caller(qname_str))
}

/// Same as get_node_qname, but using the Document namespace prefixes
pub fn get_node_document_qname(node: &Node) -> SymStr {
  use libxml::tree::NodeType::*;
  let node_type = node.get_type();
  if node_type.is_none() {
    return pin!("#BrokenNode");
  }

  match node_type.unwrap() {
    TextNode => pin!("#PCDATA"),
    DocumentNode => pin!("#Document"),
    CommentNode => pin!("#Comment"),
    PiNode => pin!("#ProcessingInstruction"),
    DTDNode => pin!("#DTD"),

    // TODO
    // elsif ($type == XML_NAMESPACE_DECL) {
    //   my $ns = $node->declaredURI;
    //   my $prefix = $ns && $self->getDocumentNamespacePrefix($ns, 0, 1);
    //   return ($prefix ? 'xmlns:' . $prefix : 'xmlns'); }
    NamespaceDecl => pin!("xmlns"),

    ElementNode | AttributeNode => {
      let empty_sym = pin!("");
      let mut prefix = empty_sym;
      if let Some(ns) = node.get_namespace() {
        let href = ns.get_href();
        if !href.is_empty() {
          prefix = get_document_namespace_prefix(&href, false, true).unwrap_or(empty_sym);
        }
      }
      if prefix == empty_sym {
        arena::pin(node.get_name())
      } else {
        arena::pin(arena::with(prefix, |prefix_str| {
          s!("{}:{}", prefix_str, node.get_name())
        }))
      }
    },
    // Need others?
    t => {
      panic!("Fatal:misdefined:<caller> should not ask for qualified name for node of type {t:?}")
    },
  }
}

/// Read a possibly-PREFIXED attribute off a node, resolving the prefix the same
/// way `Document::set_attribute` does on the write side (via [`decode_qname`]).
///
/// libxml stores `xml:id` as local name `id` in the built-in xml namespace, and
/// `xmlGetProp` matches on the plain name — so `get_attribute("xml:id")` finds
/// NOTHING. That asymmetry is invisible in Rust bindings (which read ids through
/// `get_attribute_ns`) but bites any caller that writes an attribute by qualified
/// name and then tries to read it back by the same name, which is exactly what a
/// script does after `generateID`.
pub fn get_node_attribute(node: &Node, key: &str) -> Option<String> {
  if let Some(ns_uri) = attribute_namespace(key) {
    let local = key.split_once(':').map_or(key, |(_, l)| l);
    if let Some(value) = node.get_attribute_ns(local, &ns_uri) {
      return Some(value);
    }
  }
  node.get_attribute(key)
}

/// Remove a possibly-PREFIXED attribute — the counterpart of
/// [`get_node_attribute`], with the same namespace resolution.
pub fn remove_node_attribute(node: &mut Node, key: &str) -> std::result::Result<(), String> {
  if let Some(ns_uri) = attribute_namespace(key) {
    let local = key.split_once(':').map_or(key, |(_, l)| l).to_string();
    if node.get_attribute_ns(&local, &ns_uri).is_some() {
      return node
        .remove_attribute_ns(&local, &ns_uri)
        .map_err(|e| e.to_string());
    }
  }
  node.remove_attribute(key).map_err(|e| e.to_string())
}

/// The namespace URI an attribute name resolves to, or `None` when it is
/// unprefixed (or its prefix is not registered). `xml:` is built in — the one
/// prefix [`decode_qname`] deliberately hands back whole for libxml to special-case.
fn attribute_namespace(key: &str) -> Option<String> {
  let (prefix, _) = key.split_once(':')?;
  if prefix == "xml" {
    return Some(XML_NS.to_string());
  }
  match decode_qname(key) {
    Ok((ns_uri, _local)) => ns_uri,
    Err(_) => None,
  }
}

/// Given a Qualified name, possibly prefixed with a namespace prefix,
/// as defined by the code namespace mapping,
/// return the NamespaceURI and localname.
pub fn decode_qname(codetag: &str) -> Result<(Option<String>, String)> {
  match PREFIXED_LOCALNAME_RE.captures(codetag) {
    Some(captures) => {
      let prefix = captures.get(1).map_or("", |m| m.as_str());
      let localname = captures.get(2).map_or("", |m| m.as_str());

      if prefix == "xml" {
        Ok((None, codetag.to_string()))
      } else {
        Ok((
          get_namespace(prefix, false)?.map(arena::to_string),
          localname.to_string(),
        ))
      }
    },
    None => Ok((None, codetag.to_string())),
  }
}

/// TODO: We need a proper data model to deal with the Symbol - String distinction.
/// For now let's allocate strings and release the arena, but this is a CODE SMELL!
pub fn decode_qname_sym(sym: SymStr) -> Result<(Option<String>, String)> {
  let codetag = arena::to_string(sym);
  decode_qname(&codetag)
}

//**********************************************************************
// Document Structure Queries
//**********************************************************************
// NOTE: These are public, but perhaps should be passed
// to submodel, in case it can evolve to more precision?
// However, it would need more context to do that.

/// The single faithful containment check (Perl `Common/Model.pm::canContain`),
/// keyed on interned `SymStr` names — the arena's native currency. This is the
/// canonical implementation; [`can_contain`] is a thin `&str` wrapper over it.
///
/// It is the entry point the serializer's `#PCDATA` indentation test
/// (`Document::serialize_into`) and the digestion auto-open/close logic use, so
/// it stays allocation-lean: the common exact-match branch interns nothing, and
/// the negation/namespace-wildcard probes fire only when the exact child is
/// absent from the content model.
///
/// The `ns:*` namespace-wildcard fallback (below) is why a FOREIGN element whose
/// content model is a wildcard — `ltx:rawhtml`'s `xhtml:*`, `svg:*` — is handled
/// correctly: it has no exact `tagprop` entry, so an exact-match-only check
/// wrongly answered `can_contain(xhtml:b, #PCDATA) == false`, and the serializer
/// then treated mixed HTML content as block and injected indentation whitespace
/// that HTML treats as significant (`<xhtml:b>\n  bold  </xhtml:b>`).
/// arXiv/html_feedback#680 (xworld21).
pub fn can_contain_sym(tag: SymStr, child: SymStr) -> bool {
  // Handle obvious cases explicitly (Perl Common/Model.pm::canContain).
  if tag == pin!("#PCDATA") || tag == pin!("#Comment") || tag == pin!("") {
    return false;
  } else if tag == pin!("_WildCard_") {
    return true;
  }
  // A `_Capture_` tag contains anything; a `_Capture_`/`_CaptureBlock_` child is
  // contained by anything (with or without a namespace prefix).
  if arena::with(tag, |t| t.ends_with("_Capture_"))
    || arena::with(child, |c| {
      c.ends_with("_Capture_") || c.ends_with("_CaptureBlock_")
    })
  {
    return true;
  }
  if child == pin!("_WildCard_")
    || child == pin!("#Comment")
    || child == pin!("#ProcessingInstruction")
    || child == pin!("#DTD")
  {
    return true;
  }

  let model = model!();
  if model.permissive && tag == pin!("#Document") && child != pin!("#PCDATA") {
    return true; // No schema? Punt!
  }

  // Query tag properties, falling back to the `ns:*` wildcard entry when this
  // exact tag has none of its own, then the most-specific-first chain — Perl
  // `Common/Model.pm`. The fallback is what lets a wildcard content model such
  // as `ltx:rawhtml{}(xhtml:*)` accept every concrete `xhtml:p`/`xhtml:b`.
  let frame = model.tagprop.get_sym(tag);
  let wildcard_frame = if frame.is_none() {
    namespace_wildcard_sym(tag).and_then(|w| model.tagprop.get_sym(w))
  } else {
    None
  };
  let content = &frame
    .or(wildcard_frame)
    .unwrap_or(&*DEFAULT_TAG_FRAME)
    .model;
  content.contains(&pin!("ANY")) || set_allows(content, child)
}

/// `&str` wrapper over the canonical [`can_contain_sym`]; interns both names and
/// delegates. Kept for call sites that hold string names rather than `SymStr`.
pub fn can_contain(tag: &str, child: &str) -> bool {
  can_contain_sym(arena::pin(tag), arena::pin(child))
}

/// Perl `Model::canContain`/`canHaveAttribute` fall back to the NAMESPACE
/// WILDCARD entry when a prefixed tag has no `tagprop` entry of its own
/// (`Common/Model.pm`: `if (!$model && ($tag =~ /^(\w*):/)) { $xtag = $1 . ':*' }`).
/// This is how a wildcard schema element such as `xhtml:*` — the content model of
/// `ltx:rawhtml` — governs every concrete `xhtml:p`/`xhtml:b` absorbed into it.
///
/// Two knowingly narrower details than the Perl regex, neither reachable with the
/// schema we compile (checked against `resources/RelaxNG/LaTeXML.model`, whose
/// only `ns:*` entries are `*:*` and `xhtml:*`):
/// * Perl falls back when the tag has no entry OR its entry has no `model` /
///   `attributes` key; a Rust `TagFrame` always has both, possibly empty, so the
///   callers fall back only when the whole frame is missing. Reaching that
///   difference needs a schema with BOTH an empty-set entry and a matching `ns:*`
///   entry — e.g. an `ltx:*`, which no LaTeXML schema declares.
/// * Perl's `\w*` does not match `*`, so it never derives a wildcard from a tag
///   that is already one; `split_once` would, but only for the `*:*` entry, which
///   maps to itself and is looked up only when it has no frame — and it has one.
fn namespace_wildcard_sym(tag: SymStr) -> Option<SymStr> {
  arena::with(tag, |t| t.split_once(':').map(|(ns, _)| s!("{ns}:*"))).map(|w| arena::pin(&w))
}

/// Perl's most-specific-first membership chain over a `tagprop` set — shared by
/// `canContain`'s child test and `canHaveAttribute`'s attribute test
/// (`Common/Model.pm`). Order: exact, `!exact`, then for a PREFIXED key the
/// namespace wildcard `ns:*` / `!ns:*` and finally `*:*` / `!*:*`; for an
/// unprefixed key, `*` / `!*`. A `!`-prefixed entry is an explicit exclusion and
/// always beats the broader wildcard that follows it. The compiled model really
/// does carry these (e.g. `ltx:XMText{!aria:*,!xml:*,*:*,…}`), so an exact-match-only
/// test both over-rejects (ignoring `*:*`) and under-rejects (ignoring `!ns:*`).
///
/// Allocation profile: the exact-match branch interns nothing (the caller's
/// `key` is already a `SymStr`). On an exact miss we probe the broadest ALLOWING
/// wildcard first — a cached `pin!` for `*` / `*:*`, no allocation — and build a
/// `!key` / `ns:*` probe string only when it can still change the answer. So the
/// serializer's hot `can_contain(<block element>, #PCDATA)` query, whose model
/// carries no `*`, returns here having interned nothing. Any owned probe string
/// is built inside `arena::with` and interned only AFTER that borrow is released:
/// the `BufferBackend` interner can realloc on a new intern, which would dangle a
/// resolved `&str` still held from `key`.
fn set_allows(set: &HashSet<SymStr>, key: SymStr) -> bool {
  if set.contains(&key) {
    return true; // exact hit — the common case, interns nothing
  }
  if set.is_empty() {
    return false;
  }
  // Exact miss. The unprefixed hot path (the serializer's `#PCDATA` query) can
  // only be turned `true` by `*`, a cached `pin!` — so a block element's model,
  // which has no `*`, returns here without interning any probe string.
  if !arena::with(key, |k| k.contains(':')) {
    // Unprefixed key — Perl only consults `!*` / `*`, both cached pins.
    if !set.contains(&pin!("*")) || set.contains(&pin!("!*")) {
      return false;
    }
    // `*` allows it unless an explicit `!key` excludes it — build that one probe.
    let negated = arena::with(key, |k| s!("!{k}"));
    return !set.contains(&arena::pin(&negated));
  }
  // Prefixed key (cold path — the serializer never queries one). Perl order:
  // !key, ns:*, !ns:*, !*:*, *:*. Each probe string is built inside `arena::with`
  // and interned only after that borrow drops (BufferBackend may realloc).
  let negated = arena::with(key, |k| s!("!{k}"));
  if set.contains(&arena::pin(&negated)) {
    return false;
  }
  let (ns_star, neg_ns_star) = arena::with(key, |k| {
    let ns = k.split_once(':').map_or("", |(ns, _)| ns);
    (s!("{ns}:*"), s!("!{ns}:*"))
  });
  if set.contains(&arena::pin(&ns_star)) {
    return true;
  }
  if set.contains(&arena::pin(&neg_ns_star)) {
    return false;
  }
  if set.contains(&pin!("!*:*")) {
    return false;
  }
  set.contains(&pin!("*:*"))
}

pub fn can_have_attribute(tag: SymStr, attrib: SymStr) -> bool {
  // Handle obvious cases explicitly.
  if let Some(early_choice) = arena::with(tag, |tag_str| match tag_str {
    "#PCDATA" | "#Comment" | "#Document" | "#ProcessingInstruction" | "#DTD" => Some(false),
    "_WildCard_" => Some(true),
    other if other.ends_with("_Capture_") => Some(true),
    _ => None,
  }) {
    return early_choice;
  };
  // Perl: `return 1 if $attrib =~ /^_/;` — internal bookkeeping attributes are
  // always permitted, whatever the schema says about the element.
  if arena::with(attrib, |a| a.starts_with('_')) {
    return true;
  }
  let model = model!();
  if model.permissive {
    return true;
  }

  // Else query tag properties, falling back to the `ns:*` wildcard entry when
  // this exact tag has none of its own (Perl canHaveAttribute).
  let frame = model.tagprop.get_sym(tag);
  let wildcard_frame = if frame.is_none() {
    namespace_wildcard_sym(tag).and_then(|w| model.tagprop.get_sym(w))
  } else {
    None
  };
  let attributes = &frame
    .or(wildcard_frame)
    .unwrap_or(&*DEFAULT_TAG_FRAME)
    .attributes;
  set_allows(attributes, attrib)
}

pub fn is_node_in_schema_class(class_name: &str, tag: &Node) -> bool {
  let tag = get_node_qname(tag);
  is_in_schema_class(arena::pin(class_name), tag)
}
pub fn is_in_schema_class(class_name: SymStr, tag: SymStr) -> bool {
  match model!().schema_class.get_sym(class_name) {
    Some(class) => class.contains(&tag),
    _ => false,
  }
}

//**********************************************************************
// Accessors
//**********************************************************************

pub fn get_tags() -> Vec<SymStr> { model!().tagprop.keys().copied().collect() }

pub fn get_tag_contents(tag: SymStr) -> Vec<SymStr> {
  match model!().tagprop.get_sym(tag) {
    Some(h) => h.model.iter().copied().collect(),
    None => Vec::new(),
  }
}
pub fn set_model(new_model: Model) {
  let mut model = model_mut!();
  *model = new_model;
}
pub fn is_permissive() -> bool { model!().permissive }

pub fn with_schema_data<FnR, R>(caller: FnR) -> R
where FnR: FnOnce(Option<&Vec<SymStr>>) -> R {
  caller(model!().schema_data.as_ref())
}
pub fn set_schema(schema: Relaxng) {
  let mut model = model_mut!();
  model.schema = Some(schema);
}
pub fn set_schema_class(classname: &str, content: HashSet<SymStr>) {
  model_mut!().set_schema_class(classname, content)
}
pub fn add_tag_content(tag: &str, elements: Vec<&str>) {
  model_mut!().add_tag_content(tag, elements)
}
pub fn add_tag_attribute(tag: &str, attributes: Vec<&str>) {
  model_mut!().add_tag_attribute(tag, attributes)
}

pub(crate) fn compute_indirect_model_aux(
  tag: SymStr,
  start_opt: Option<SymStr>,
  desirability: usize,
  openability: &mut SymHashMap<u32>,
  desc: &mut SymHashMap<SymHashMap<usize>>,
) {
  let start = match start_opt {
    Some(s) => s,
    None => pin!(""),
  };

  // A bit tricky here, we need to release the model_mut!() borrow immediately, which is why we
  // move ownership of the tag strings into the tag_contents vector.
  // That leads to a bunch of .clone()s later one, but stays close to the original algorithm
  let tag_contents: Vec<SymStr> = get_tag_contents(tag);

  for kid in tag_contents {
    // Memoise on (kid, start) to bound recursion in cyclic schemas, but
    // retain the *maximum* desirability observed across paths — the
    // outer loop in compute_indirect_model picks the highest-scoring
    // starting tag, so the score stored here must reflect the best path,
    // not the first one the hashmap iteration happened to surface.
    //
    // The prior "first visit wins" behavior (WISDOM #49) caused paralists
    // test-harness runs to assign `desc[#PCDATA][ltx:text] = 50` when
    // `contents(text)` iterated `ltx:picture` before `#PCDATA`: the
    // sub-recursion `text → picture → #PCDATA` inserted 50 first and the
    // direct `text → #PCDATA` path was skipped, forcing the auto-open
    // path to pick `<ltx:picture>` instead of `<ltx:text>`.
    let prior = desc.entry_sym(kid).or_default().get_sym(start).copied();
    if let Some(prior_d) = prior
      && prior_d >= desirability
    {
      continue;
    }

    if start != pin!("") {
      desc
        .entry_sym(kid)
        .or_default()
        .insert_sym(start, desirability);
    }

    if kid != pin!("#PCDATA")
      && let Some(priority) = openability.get_sym(kid).copied()
    {
      let inner = if start != pin!("") { start } else { kid };
      // Perl Document.pm L220: `$desirability * $x`. We keep integer
      // arithmetic (priorities scaled by 100), so this is a scaled multiply.
      let next_desirability = desirability * (priority as usize) / 100;
      compute_indirect_model_aux(kid, Some(inner), next_desirability, openability, desc);
    }
  }
}
/// Bind an OUTPUT-document prefix to a namespace URI, on the current model.
///
/// The document half of the two mappings described on
/// [`Model::register_namespace`] — these are the prefixes that appear in the
/// generated XML, and the one place `#default` is meaningful (for unprefixed
/// elements; never for attributes). Passing `None` unbinds the prefix.
pub fn register_document_namespace(docprefix: &str, namespace_opt: Option<&str>) {
  model_mut!().register_document_namespace(docprefix, namespace_opt)
}

/// Returns all registered document namespace prefixes and their URIs.
pub fn get_document_namespace_prefixes() -> Vec<(String, String)> {
  model!()
    .document_namespace_prefixes
    .iter()
    .map(|(ns_sym, prefix_sym)| {
      let prefix = arena::with(*prefix_sym, |s| s.to_string());
      let ns = arena::with(*ns_sym, |s| s.to_string());
      (prefix, ns)
    })
    .collect()
}

/// Bind a CODE prefix to a namespace URI, on the current model.
///
/// The coding half of the two mappings described on
/// [`Model::register_namespace`] — the prefixes constructors and bindings write,
/// which must be one-to-one and admit no default namespace. Passing `None`
/// unbinds the prefix.
pub fn register_namespace(codeprefix: &str, namespace_opt: Option<&str>) {
  model_mut!().register_namespace(codeprefix, namespace_opt)
}

pub fn with_code_namespaces<FnR, R>(caller: FnR) -> R
where FnR: FnOnce(&SymHashMap<SymStr>) -> R {
  caller(&model!().code_namespaces)
}

#[cfg(test)]
mod wildcard_resolution_tests {
  //! Direct coverage for the Perl `Common/Model.pm` resolution helpers shared by
  //! `canContain` (child test) and `canHaveAttribute` (attribute test). The
  //! end-to-end script-bindings guard only exercises the plain `*` branch via
  //! `xhtml:*`, so the negation and namespace-wildcard branches are pinned here.
  use super::*;

  fn set_of(keys: &[&str]) -> HashSet<SymStr> { keys.iter().map(|k| arena::pin(*k)).collect() }
  // `&str` shims over the sym-native helpers under test, so the cases read the
  // same as the schema keys they mirror.
  fn allows(set: &HashSet<SymStr>, key: &str) -> bool { set_allows(set, arena::pin(key)) }
  fn wildcard(tag: &str) -> Option<String> {
    namespace_wildcard_sym(arena::pin(tag)).map(|w| arena::with(w, str::to_string))
  }

  #[test]
  fn namespace_wildcard_tag_only_applies_to_prefixed_tags() {
    assert_eq!(wildcard("xhtml:p").as_deref(), Some("xhtml:*"));
    assert_eq!(wildcard("ltx:para").as_deref(), Some("ltx:*"));
    // Unprefixed names have no namespace wildcard to fall back on.
    assert_eq!(wildcard("para"), None);
    assert_eq!(wildcard("#PCDATA"), None);
  }

  #[test]
  fn exact_membership_wins_and_empty_sets_reject() {
    let s = set_of(&["class", "href"]);
    assert!(allows(&s, "class"));
    assert!(!allows(&s, "style"));
    assert!(!allows(&HashSet::default(), "class"));
  }

  #[test]
  fn a_negation_beats_the_wildcard_that_would_otherwise_allow_it() {
    // Perl order: exact, !exact, ns:*, !ns:*, !*:*, *:*  — the `!` entries are
    // explicit exclusions and must beat the broader wildcard that follows them.
    // This is the real shape of a compiled entry, e.g.
    // `ltx:XMText{!aria:*,!xml:*,*:*,about,…}`.
    let s = set_of(&["!aria:*", "!xml:*", "*:*", "about"]);
    assert!(allows(&s, "about"), "exact entry allows");
    assert!(allows(&s, "data:foo"), "*:* allows an unexcluded namespace");
    assert!(!allows(&s, "aria:label"), "!aria:* excludes its namespace");
    assert!(!allows(&s, "xml:lang"), "!xml:* excludes its namespace");

    // An exact exclusion beats a namespace wildcard that would allow it.
    let s2 = set_of(&["!svg:width", "svg:*"]);
    assert!(allows(&s2, "svg:height"));
    assert!(!allows(&s2, "svg:width"));

    // `!*:*` denies every namespaced key that is not exactly listed.
    let s3 = set_of(&["!*:*", "svg:width"]);
    assert!(allows(&s3, "svg:width"));
    assert!(!allows(&s3, "svg:height"));
  }

  #[test]
  fn unprefixed_keys_use_the_bare_star_not_the_namespaced_one() {
    // `*:*` governs PREFIXED keys only; an unprefixed `class` needs `*`.
    let namespaced_only = set_of(&["*:*"]);
    assert!(!allows(&namespaced_only, "class"));
    assert!(allows(&namespaced_only, "svg:width"));

    // This is the entry that lets attributes survive on absorbed xhtml markup:
    // the compiled model carries `xhtml:*{*,*:*}`.
    let html_wildcard = set_of(&["*", "*:*"]);
    assert!(allows(&html_wildcard, "class"));
    assert!(allows(&html_wildcard, "xlink:href"));

    // …and `!*` denies the unprefixed ones.
    let denied = set_of(&["!*", "*:*"]);
    assert!(!allows(&denied, "class"));
    assert!(allows(&denied, "svg:width"));

    // An explicit `!key` exclusion denies the key even when a bare `*` would
    // otherwise allow it (the `*`-present branch of the unprefixed fast path).
    let star_but_excluded = set_of(&["*", "!class"]);
    assert!(
      !allows(&star_but_excluded, "class"),
      "!class excludes despite *"
    );
    assert!(
      allows(&star_but_excluded, "id"),
      "* still allows an unexcluded name"
    );
  }
}

#[cfg(test)]
mod schema_load_tests {
  //! #652: a raw `.rng` selected via `RelaxNGSchema()` (no compiled `.model`)
  //! must populate the runtime tag/attribute tables through `load_schema`, so
  //! the document validates instead of every element being rejected.
  use super::*;

  #[test]
  fn raw_rng_scan_populates_tagprop_end_to_end() {
    // A minimal self-contained grammar, no `.model` alongside it → forces the
    // runtime raw-`.rng` scan path.
    let dir = std::env::temp_dir().join(format!("lxo652_{}", std::process::id()));
    std::fs::create_dir_all(&dir).expect("mkdir");
    let rng = "<grammar xmlns=\"http://relaxng.org/ns/structure/1.0\">\
       <start><ref name=\"document\"/></start>\
       <define name=\"document\"><element name=\"document\">\
         <zeroOrMore><ref name=\"para\"/></zeroOrMore></element></define>\
       <define name=\"para\"><element name=\"para\">\
         <attribute name=\"class\"/><text/></element></define>\
       </grammar>";
    std::fs::write(dir.join("lxo652schema.rng"), rng).expect("write rng");

    initialize_model();
    model_mut!().set_relaxng_schema("lxo652schema");
    let dir_str = dir.to_str().unwrap();
    load_schema(&[dir_str]).expect("load_schema");

    // Before the fix these were all false (empty tagprop) → the document was
    // rejected and the output emptied.
    assert!(
      can_contain("#Document", "document"),
      "document root must be allowed after a raw .rng scan"
    );
    assert!(can_contain("document", "para"), "document may contain para");
    assert!(
      can_have_attribute(pin!("para"), pin!("class")),
      "para must allow its @class"
    );
    assert!(
      !can_have_attribute(pin!("para"), pin!("bogus")),
      "para must NOT allow an undeclared attribute"
    );

    let _ = std::fs::remove_dir_all(&dir);
  }

  /// #652 (reopened): a schema whose target namespace is a **default `ns=`** (no
  /// `xmlns:` prefix — how real `LaTeXML.rng` is written) must resolve to the
  /// conventional code prefix (`ltx`) that `base_schema` registered, NOT a
  /// synthetic `namespace1`. Perl: the scanner delegates `encodeQName` to the
  /// model, which consults `code_namespace_prefixes`.
  #[test]
  fn default_ns_schema_uses_registered_code_prefix() {
    let dir = std::env::temp_dir().join(format!("lxo652def_{}", std::process::id()));
    std::fs::create_dir_all(&dir).expect("mkdir");
    // dlmf as the DEFAULT namespace; NO xmlns:ltx declaration in the schema.
    let default_ns = "<grammar xmlns=\"http://relaxng.org/ns/structure/1.0\" \
         ns=\"http://dlmf.nist.gov/LaTeXML\">\
       <start><ref name=\"document\"/></start>\
       <define name=\"document\"><element name=\"document\">\
         <zeroOrMore><ref name=\"para\"/></zeroOrMore></element></define>\
       <define name=\"para\"><element name=\"para\">\
         <attribute name=\"class\"/><text/></element></define>\
       </grammar>";
    std::fs::write(dir.join("lxo652def.rng"), default_ns).expect("write rng");

    initialize_model();
    // Mimic base_schema.rs:11 — the engine registers `ltx` for the dlmf namespace
    // on every conversion, before any RelaxNGSchema() runs.
    model_mut!().register_namespace("ltx", Some(LTX_NAMESPACE));
    model_mut!().set_relaxng_schema("lxo652def");
    let dir_str = dir.to_str().unwrap();
    load_schema(&[dir_str]).expect("load_schema");

    // The document root is in the default (dlmf) namespace → it must be reachable
    // under the registered `ltx` prefix, not a synthesized `namespaceN`.
    assert!(
      can_contain("#Document", "ltx:document"),
      "default-ns root must resolve to the registered ltx: prefix (#652)"
    );
    assert!(
      can_contain("ltx:document", "ltx:para"),
      "ltx:document may contain ltx:para"
    );
    assert!(
      !can_contain("#Document", "namespace1:document"),
      "must NOT invent a synthetic namespace1 prefix for a registered namespace (#652)"
    );

    let _ = std::fs::remove_dir_all(&dir);
  }

  /// #652 fallback guard: a namespace the engine did NOT register, but the
  /// schema declares an explicit `xmlns:` prefix for, keeps that declared prefix
  /// (Perl `getNamespacePrefix`: code prefix → document prefix → synthesize).
  #[test]
  fn schema_declared_prefix_survives_when_unregistered_in_code() {
    let dir = std::env::temp_dir().join(format!("lxo652decl_{}", std::process::id()));
    std::fs::create_dir_all(&dir).expect("mkdir");
    // `ex` is declared in the schema (xmlns:ex) but never registered in code.
    let rng = "<grammar xmlns=\"http://relaxng.org/ns/structure/1.0\" \
         ns=\"http://example.com/ex\" xmlns:ex=\"http://example.com/ex\">\
       <start><ref name=\"root\"/></start>\
       <define name=\"root\"><element name=\"root\"><empty/></element></define>\
       </grammar>";
    std::fs::write(dir.join("lxo652decl.rng"), rng).expect("write rng");

    initialize_model();
    model_mut!().set_relaxng_schema("lxo652decl");
    load_schema(&[dir.to_str().unwrap()]).expect("load_schema");

    assert!(
      can_contain("#Document", "ex:root"),
      "schema-declared xmlns:ex prefix must be used when code has none (#652)"
    );
    let _ = std::fs::remove_dir_all(&dir);
  }

  /// #652 output-serialization: the schema's primary (default `ns=`) namespace
  /// becomes the DEFAULT document namespace — serialized with NO prefix — rather
  /// than being forgotten (Perl RelaxNG.pm L78).
  #[test]
  fn schema_primary_ns_becomes_default_document_namespace() {
    let dir = std::env::temp_dir().join(format!("lxo652out_{}", std::process::id()));
    std::fs::create_dir_all(&dir).expect("mkdir");
    let rng = "<grammar xmlns=\"http://relaxng.org/ns/structure/1.0\" \
         ns=\"http://dlmf.nist.gov/LaTeXML\">\
       <start><ref name=\"document\"/></start>\
       <define name=\"document\"><element name=\"document\"><empty/></element></define>\
       </grammar>";
    std::fs::write(dir.join("lxo652out.rng"), rng).expect("write rng");

    initialize_model();
    model_mut!().register_namespace("ltx", Some(LTX_NAMESPACE));
    model_mut!().set_relaxng_schema("lxo652out");
    load_schema(&[dir.to_str().unwrap()]).expect("load_schema");

    // The primary namespace is the output default (`#default` → dlmf) …
    assert_eq!(
      get_document_namespace("", true).as_deref(),
      Some(LTX_NAMESPACE),
      "schema primary ns must be the default document namespace (#652)"
    );
    // … so it serializes with NO prefix (probe → no synthetic namespaceN + warning).
    assert_eq!(
      get_document_namespace_prefix(LTX_NAMESPACE, false, true),
      None,
      "the default document namespace serializes without a prefix (#652)"
    );
  }

  /// #652 foreign prefixes: a namespace registered only in CODE — a built-in
  /// (`svg`) or a third-party / runtime `.rhai` `RegisterNamespace` — serializes
  /// under that code prefix, never a synthetic `namespaceN` + warning (Perl
  /// Model.pm `getDocumentNamespacePrefix` L242 code-prefix fallback).
  #[test]
  fn foreign_and_runtime_namespaces_serialize_under_their_code_prefix() {
    initialize_model();
    // Built-in foreign namespace, as base_schema registers it.
    model_mut!().register_namespace("svg", Some("http://www.w3.org/2000/svg"));
    // A third-party / runtime binding's RegisterNamespace (e.g. a BookML .rhai).
    model_mut!().register_namespace("bk", Some("http://bookml.example/ns"));

    assert_eq!(
      get_document_namespace_prefix("http://www.w3.org/2000/svg", false, true),
      Some(pin!("svg")),
      "built-in foreign svg namespace serializes under its code prefix (#652)"
    );
    assert_eq!(
      get_document_namespace_prefix("http://bookml.example/ns", false, true),
      Some(pin!("bk")),
      "a runtime/third-party registered namespace serializes under its prefix (#652)"
    );
  }
}