From c8f015a7426352ac9346e3b57aa46f0bac5d177b Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 18:56:29 +0530
Subject: [PATCH 01/18] fix(core): stop SSR instantiating a component named
 inside a comment

The custom-element walk matched tags with a flat regex over assembled
markup, so a registered tag name written inside an HTML comment was
constructed and rendered as a real element. The damage went well past a
wasted render: the replacement consumed the rest of the comment INCLUDING
its closing `-->`, so the markup after it was swallowed by an
unterminated comment. Whether it happened at all depended on whether the
name in the comment happened to be a registered component, which is what
made it look random rather than reproducible.

Found by writing an ordinary explanatory comment in the website's root
layout that mentioned copy-cmd, which grew a real copy button out of
nowhere.

The walk now computes the comment ranges once and skips any match inside
one. Two details keep it faithful to how a browser reads the same bytes:
an unterminated `<!--` comments out everything to EOF, and raw-text
elements have no comment syntax, so a `<!--` inside a script or style
must not open a region. That second one is the important guard: treating
it as a comment would silently stop every component after that script
from rendering, which would be worse than the bug being fixed.

Raw-text CONTENT is deliberately not skipped for tag matching. Whether a
tag-shaped string inside a script should be instantiated is a separate
question, so the existing behaviour there is left alone.
---
 packages/core/src/render-server.js            | 73 ++++++++++++++++++
 .../ssr-comment-not-an-element.test.js        | 76 +++++++++++++++++++
 2 files changed, 149 insertions(+)
 create mode 100644 packages/core/test/rendering/ssr-comment-not-an-element.test.js

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index edbcbf65c..f206aaf67 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -411,6 +411,76 @@ function defaultSSRErrorTemplate(tag, err, dev) {
   </div>`;
 }
 
+/**
+ * Byte ranges of the HTML comments in `html`, as `[start, end)` pairs in
+ * ascending order (#1128).
+ *
+ * The element scanners below match tags with a flat regex over already-
+ * assembled markup, which has no notion of an HTML context, so a registered
+ * tag name written inside a comment used to be instantiated as a real element.
+ * That is not a cosmetic problem: the replacement consumed the rest of the
+ * comment INCLUDING its closing `-->`, so the remaining markup was swallowed
+ * by an unterminated comment. Whether it happened at all depended on whether
+ * the name in the comment happened to be a registered component, which made it
+ * look random.
+ *
+ * Two details that keep this faithful to how a browser parses the same bytes:
+ *
+ * - An unterminated `<!--` comments out everything to the end of the input,
+ *   so the range runs to EOF rather than being ignored.
+ * - Raw-text elements have no comment syntax: inside `<script>` / `<style>`,
+ *   `<!--` is ordinary text. Skipping over those elements is what stops a
+ *   `<!--` in a script from opening a bogus comment region and suppressing
+ *   every real component after it. (Their CONTENT is deliberately not
+ *   returned as a skip range: whether a tag-shaped string inside a script
+ *   should be instantiated is a separate question from this fix, so the
+ *   existing behaviour there is left alone.)
+ *
+ * @param {string} html
+ * @returns {[number, number][]}
+ */
+function commentRanges(html) {
+  /** @type {[number, number][]} */
+  const ranges = [];
+  let i = 0;
+  while (i < html.length) {
+    const lt = html.indexOf('<', i);
+    if (lt === -1) break;
+    if (html.startsWith('<!--', lt)) {
+      const close = html.indexOf('-->', lt + 4);
+      const end = close === -1 ? html.length : close + 3;
+      ranges.push([lt, end]);
+      i = end;
+      continue;
+    }
+    const raw = /^<(script|style)\b/i.exec(html.slice(lt, lt + 8));
+    if (raw) {
+      const closeTag = new RegExp(`</${raw[1]}\\s*>`, 'i').exec(html.slice(lt));
+      i = closeTag ? lt + closeTag.index + closeTag[0].length : html.length;
+      continue;
+    }
+    i = lt + 1;
+  }
+  return ranges;
+}
+
+/**
+ * Is `index` inside one of `ranges`? Ranges are ascending and non-overlapping,
+ * and callers walk matches left to right, so this stops as soon as a range
+ * starts past the index.
+ *
+ * @param {[number, number][]} ranges
+ * @param {number} index
+ * @returns {boolean}
+ */
+function inRanges(ranges, index) {
+  for (const [start, end] of ranges) {
+    if (start > index) return false;
+    if (index < end) return true;
+  }
+  return false;
+}
+
 /**
  * Scan an HTML string for registered custom elements and inject
  * Declarative Shadow DOM (`<template shadowrootmode="open">`).
@@ -447,10 +517,13 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
   );
   /** @type {{start:number, end:number, text:string}[]} */
   const edits = [];
+  // A tag name inside a comment is comment TEXT, not an element (#1128).
+  const comments = html.indexOf('<!--') === -1 ? [] : commentRanges(html);
   for (const m of html.matchAll(pattern)) {
     const [match, tag, attrs, selfClose] = m;
     const Cls = lookup(tag);
     if (!Cls) continue;
+    if (comments.length && inRanges(comments, m.index)) continue;
     // Track which custom elements actually appeared: used by SSR to emit
     // `<link rel="modulepreload">` hints for their module URLs.
     if (ctx && ctx.usedComponents) ctx.usedComponents.add(tag);
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
new file mode 100644
index 000000000..a01256dc4
--- /dev/null
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -0,0 +1,76 @@
+// A registered tag name written inside an HTML comment is comment TEXT, not an
+// element (#1128).
+//
+// The custom-element walk matches tags with a flat regex over assembled markup,
+// which knew nothing about HTML contexts, so `<!-- see <my-tag> -->` used to
+// construct and render the component. The damage went past a wasted render: the
+// replacement consumed the rest of the comment INCLUDING its closing `-->`, so
+// everything after it was swallowed by an unterminated comment. Whether it
+// happened depended on whether the name in the comment was a registered
+// component, which is what made it look random.
+//
+// Found by writing an ordinary explanatory comment in the website's root layout
+// that mentioned `<copy-cmd>`, which grew a real copy button.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { html, renderToString, WebComponent } from '../../index.js';
+
+class CommentProbe extends WebComponent {
+  render() { return html`<b>RENDERED</b>`; }
+}
+CommentProbe.register('comment-probe');
+
+test('a component tag inside a comment is not instantiated', async () => {
+  const out = await renderToString(html`<div><!-- <comment-probe></comment-probe> --></div>`);
+  assert.equal(out, '<div><!-- <comment-probe></comment-probe> --></div>');
+});
+
+test('markup after a comment mentioning a component survives', async () => {
+  // The regression that actually loses content: the old behaviour ate the
+  // closing `-->` and the trailing markup with it.
+  const out = await renderToString(
+    html`<div><!-- see <comment-probe> for the button --><span>after</span></div>`
+  );
+  assert.ok(out.includes('-->'), 'the comment is still closed');
+  assert.ok(out.includes('<span>after</span>'), 'markup following the comment is not swallowed');
+  assert.ok(!out.includes('RENDERED'), 'the component did not render');
+});
+
+test('an unterminated comment does not instantiate what follows', async () => {
+  // A browser treats everything after an unclosed `<!--` as comment data, so
+  // the scanner has to as well, or the two disagree about the same bytes.
+  const out = await renderToString(html`<div><!-- <comment-probe> </div>`);
+  assert.ok(!out.includes('RENDERED'), 'nothing after an unterminated comment is instantiated');
+});
+
+test('a real component still renders next to a comment', async () => {
+  // The other half of the fix: skipping comments must not skip anything else.
+  const out = await renderToString(
+    html`<div><!-- a note --><comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'a genuine element after a comment still renders');
+  assert.ok(out.includes('<!-- a note -->'), 'the comment is preserved verbatim');
+});
+
+test('a comment marker inside a script does not suppress later components', async () => {
+  // Raw-text elements have no comment syntax: `<!--` inside a script is
+  // ordinary text. If the scanner treated it as opening a comment, every
+  // component after that script would silently stop rendering, which would be
+  // a worse bug than the one being fixed.
+  const out = await renderToString(
+    html`<div><script>var a = "<!--";</script><comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'a component after a script containing "<!--" still renders');
+});
+
+test('the framework own hydration marker does not hide a sibling component', async () => {
+  // injectDSD recurses over output that already contains `<!--webjs-hydrate-->`
+  // and the client router's `<!--wj:children:...-->` boundary pairs. Those are
+  // well-formed comments, so they must not start a region that swallows the
+  // components rendered after them.
+  const out = await renderToString(
+    html`<div><comment-probe></comment-probe><comment-probe></comment-probe></div>`
+  );
+  assert.equal(out.match(/RENDERED/g)?.length, 2, 'both siblings render past the first hydrate marker');
+});

From 76d0afefcca7aa6ad5d4410b777b72d143cf0c43 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 19:11:00 +0530
Subject: [PATCH 02/18] fix(core): tokenize contexts instead of searching for
 comment markers

My first pass searched for `<!--` and skipped what followed. Review found
that introduces failures worse than the bug: an `<!--` inside an attribute
value, inside a textarea or title, or the spec's `--!>` and `<!-->` forms
each opened or failed to close a region, and every component after it
silently stopped rendering. A component named `script-probe` was also
mistaken for a `<script>` (a hyphen is a non-word character, so the word
boundary matched), which aborted scanning to EOF and left the original bug
live for the rest of the document. All five reproduced.

Deciding whether a `<` is markup requires knowing the context, which means
tokenizing, so `inertRanges` now walks the input once tracking comments
(including the short and abrupt-closing forms), markup declarations, tags
with their quoted attribute values, raw text, and RCDATA. Tags inside any
of those are text and are skipped.

That also covers raw-text CONTENT, which the first pass deliberately left
alone as "a separate question". It is not separate: a component tag inside
a style comment destroyed the rest of the document through the identical
path, so leaving it out left half the bug shipping.

Two more scanners had the same blind spot and are fixed here rather than
left for later, because both lose content:

- processSuspenseElements runs BEFORE the element walk and hands a
  boundary's children to a fresh injectDSD as a standalone string, so a
  commented-out boundary still ran its children. Under streaming it also
  consumed an id and emitted a swap script targeting an element that only
  exists inside a comment, so it could never resolve.
- substituteSlotsInRender substituted a `<slot>` written in a comment.
  A commented slot has no `</slot>`, so the fallback scan swallowed the
  rest of the template, the real slot was never substituted, and the
  authored children vanished from the page entirely.

The client router's keyed boundary comment pairs are now covered by a test
that asserts components between them still render and both markers survive
verbatim, replacing an earlier test whose input contained no comment at all
and so asserted nothing about comment handling.
---
 packages/core/src/render-server.js            | 144 ++++++++++++++----
 .../ssr-comment-not-an-element.test.js        | 110 ++++++++++++-
 2 files changed, 215 insertions(+), 39 deletions(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index f206aaf67..7bd446126 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -412,54 +412,96 @@ function defaultSSRErrorTemplate(tag, err, dev) {
 }
 
 /**
- * Byte ranges of the HTML comments in `html`, as `[start, end)` pairs in
- * ascending order (#1128).
+ * Byte ranges of `html` where a tag-shaped match is NOT an element (#1128).
  *
  * The element scanners below match tags with a flat regex over already-
- * assembled markup, which has no notion of an HTML context, so a registered
- * tag name written inside a comment used to be instantiated as a real element.
- * That is not a cosmetic problem: the replacement consumed the rest of the
- * comment INCLUDING its closing `-->`, so the remaining markup was swallowed
- * by an unterminated comment. Whether it happened at all depended on whether
- * the name in the comment happened to be a registered component, which made it
- * look random.
+ * assembled markup, which has no notion of an HTML context. So a registered tag
+ * name written inside a comment used to be constructed and rendered as a real
+ * element, and the replacement consumed the rest of the comment INCLUDING its
+ * closing `-->`, leaving an unterminated comment that swallowed every following
+ * byte. Whether it happened depended on whether the name in the comment was a
+ * registered component, which is what made it look random.
  *
- * Two details that keep this faithful to how a browser parses the same bytes:
+ * This is a single left-to-right pass rather than a search for `<!--`, because
+ * the naive version introduces failures worse than the bug: an `<!--` inside an
+ * attribute value (`title="use <!-- here"`) or inside RCDATA would open a region
+ * that never closes, and every component after it would silently stop rendering.
+ * Deciding that requires knowing the context, which means tokenizing, so the
+ * pass tracks the same states the HTML parser does for these purposes:
  *
- * - An unterminated `<!--` comments out everything to the end of the input,
- *   so the range runs to EOF rather than being ignored.
- * - Raw-text elements have no comment syntax: inside `<script>` / `<style>`,
- *   `<!--` is ordinary text. Skipping over those elements is what stops a
- *   `<!--` in a script from opening a bogus comment region and suppressing
- *   every real component after it. (Their CONTENT is deliberately not
- *   returned as a skip range: whether a tag-shaped string inside a script
- *   should be instantiated is a separate question from this fix, so the
- *   existing behaviour there is left alone.)
+ * - **Comments**, including the spec's short forms. `<!-->` and `<!--->` close
+ *   immediately, `--!>` closes as well as `-->`, and an unterminated comment
+ *   runs to EOF, exactly as a browser would treat the same bytes.
+ * - **Markup declarations and bogus comments** (`<!doctype …>`, `<![CDATA[…]]>`),
+ *   which end at the next `>`.
+ * - **Tags**, consumed with their quoted attribute values, so `<` and `<!--`
+ *   inside an attribute are inert rather than context-changing.
+ * - **Raw text** (`script`, `style`) and **RCDATA** (`textarea`, `title`), whose
+ *   content is text and ends only at the matching close tag. Their content is
+ *   returned as a skip range too: a component tag inside a `<style>` comment hit
+ *   the identical markup-destroying path, so excluding it would leave half the
+ *   bug live. `<template>` is deliberately NOT in this list; its content is
+ *   parsed normally and legitimately carries components (Declarative Shadow DOM
+ *   and the streaming swap templates both depend on that).
  *
  * @param {string} html
- * @returns {[number, number][]}
+ * @returns {[number, number][]} ascending, non-overlapping `[start, end)` pairs
  */
-function commentRanges(html) {
+function inertRanges(html) {
   /** @type {[number, number][]} */
   const ranges = [];
+  const n = html.length;
   let i = 0;
-  while (i < html.length) {
+  while (i < n) {
     const lt = html.indexOf('<', i);
     if (lt === -1) break;
     if (html.startsWith('<!--', lt)) {
-      const close = html.indexOf('-->', lt + 4);
-      const end = close === -1 ? html.length : close + 3;
+      let p = lt + 4;
+      // `<!-->` and `<!--->` are comments whose data is empty (spec short forms).
+      if (html[p] === '>') p += 1;
+      else if (html.startsWith('->', p)) p += 2;
+      else {
+        while (p < n) {
+          if (html.startsWith('-->', p)) { p += 3; break; }
+          if (html.startsWith('--!>', p)) { p += 4; break; }
+          p += 1;
+        }
+      }
+      ranges.push([lt, Math.min(p, n)]);
+      i = Math.min(p, n);
+      continue;
+    }
+    if (html.startsWith('<!', lt) || html.startsWith('<?', lt)) {
+      // Doctype / bogus comment / processing instruction: ends at the next `>`.
+      const close = html.indexOf('>', lt);
+      const end = close === -1 ? n : close + 1;
       ranges.push([lt, end]);
       i = end;
       continue;
     }
-    const raw = /^<(script|style)\b/i.exec(html.slice(lt, lt + 8));
-    if (raw) {
-      const closeTag = new RegExp(`</${raw[1]}\\s*>`, 'i').exec(html.slice(lt));
-      i = closeTag ? lt + closeTag.index + closeTag[0].length : html.length;
-      continue;
+    const name = /^<\/?([a-zA-Z][^\s/>]*)/.exec(html.slice(lt, lt + 64));
+    if (!name) { i = lt + 1; continue; }
+    // Consume the tag, honouring quoted attribute values so a `<` or `<!--`
+    // inside one cannot be mistaken for markup.
+    let p = lt + 1;
+    let quote = '';
+    while (p < n) {
+      const c = html[p];
+      if (quote) { if (c === quote) quote = ''; }
+      else if (c === '"' || c === "'") quote = c;
+      else if (c === '>') { p += 1; break; }
+      p += 1;
+    }
+    i = p;
+    const tag = name[1].toLowerCase();
+    const isClose = html[lt + 1] === '/';
+    if (!isClose && (isRawtextTag(tag) || isRcdataTag(tag))) {
+      // Everything up to the matching close tag is text, not markup.
+      const close = new RegExp(`</${tag}(?=[\\s/>])`, 'i').exec(html.slice(p));
+      const contentEnd = close ? p + close.index : n;
+      if (contentEnd > p) ranges.push([p, contentEnd]);
+      i = contentEnd;
     }
-    i = lt + 1;
   }
   return ranges;
 }
@@ -517,8 +559,9 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
   );
   /** @type {{start:number, end:number, text:string}[]} */
   const edits = [];
-  // A tag name inside a comment is comment TEXT, not an element (#1128).
-  const comments = html.indexOf('<!--') === -1 ? [] : commentRanges(html);
+  // A tag name inside a comment, a script, a style, or RCDATA is text, not an
+  // element (#1128).
+  const comments = inertRanges(html);
   for (const m of html.matchAll(pattern)) {
     const [match, tag, attrs, selfClose] = m;
     const Cls = lookup(tag);
@@ -826,6 +869,16 @@ function isVoidElement(tag) {
 async function processSuspenseElements(html, ctx, ancestors = [], dev) {
   if (html.indexOf('<webjs-suspense') === -1) return html;
   const OPEN = /<webjs-suspense((?:"[^"]*"|'[^']*'|[^>])*?)>/i;
+  // A commented-out boundary is text, not an element (#1128). This scanner is
+  // the reason the comment fix cannot live in injectDSD alone: it runs FIRST
+  // and hands the boundary's children to a fresh injectDSD as a standalone
+  // string, which has no idea those bytes came from inside a comment. Under
+  // streaming it is worse than a stray render, because the children's data
+  // fetches run and the swap script targets an id that only exists inside a
+  // comment, so it can never resolve. Ranges are computed against the FULL
+  // input once, and `consumed` maps the shrinking `rest` back onto it.
+  const inert = inertRanges(html);
+  let consumed = 0;
   let result = '';
   let rest = html;
   // Bounded loop: each iteration consumes at least the opening tag.
@@ -835,6 +888,14 @@ async function processSuspenseElements(html, ctx, ancestors = [], dev) {
       result += rest;
       break;
     }
+    if (inert.length && inRanges(inert, consumed + m.index)) {
+      // Emit through the end of this match and keep scanning after it.
+      const skipTo = m.index + m[0].length;
+      result += rest.slice(0, skipTo);
+      rest = rest.slice(skipTo);
+      consumed += skipTo;
+      continue;
+    }
     const openStart = m.index;
     const openEnd = m.index + m[0].length;
     result += rest.slice(0, openStart);
@@ -865,6 +926,7 @@ async function processSuspenseElements(html, ctx, ancestors = [], dev) {
       const innerProcessed = await injectDSD(inner, ctx, ancestors, dev);
       result += `<webjs-suspense>${innerProcessed}</webjs-suspense>`;
     }
+    consumed += rest.length - afterClose.length;
     rest = afterClose;
   }
   return result;
@@ -1041,8 +1103,15 @@ function substituteSlotsInRender(rendered, partitioned, ownerTag) {
   let result = '';
   let cursor = 0;
   const slotRe = /<slot((?:"[^"]*"|'[^']*'|[^>])*?)(\/?)>/gi;
+  // A `<slot>` written inside a comment is documentation, not a slot (#1128).
+  // Substituting one is worse here than in the element walk: a commented slot
+  // has no `</slot>`, so the fallback scan below swallows the rest of the
+  // template, the component's REAL slot is never substituted, and the authored
+  // children are dropped from the page entirely.
+  const inert = inertRanges(rendered);
   let m;
   while ((m = slotRe.exec(rendered)) !== null) {
+    if (inert.length && inRanges(inert, m.index)) continue;
     result += rendered.slice(cursor, m.index);
     const [fullOpen, attrsRaw, selfCloseSlash] = m;
     const isSelfClose = !!selfCloseSlash;
@@ -1101,6 +1170,17 @@ function isRawtextTag(tag) {
   return tag === 'script' || tag === 'style';
 }
 
+/**
+ * RCDATA elements: their content is text (character references aside), so a
+ * tag-shaped string inside one is not markup. Kept next to `isRawtextTag` so
+ * the two lists stay together rather than drifting apart.
+ * @param {string} tag
+ * @returns {boolean}
+ */
+function isRcdataTag(tag) {
+  return tag === 'textarea' || tag === 'title';
+}
+
 /**
  * Minimal attribute string parser.
  * @param {string} attrStr
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index a01256dc4..1350152f4 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -21,6 +21,22 @@ class CommentProbe extends WebComponent {
 }
 CommentProbe.register('comment-probe');
 
+// Name deliberately starts with "script": a raw-text check that is not
+// anchored on a tag boundary treats this as a <script> and stops scanning.
+class ScriptProbe extends WebComponent {
+  render() { return html`<b>SCRIPTPROBE</b>`; }
+}
+ScriptProbe.register('script-probe');
+
+// A template that documents its own slot in a comment, which is exactly how a
+// developer would annotate one.
+class SlotInComment extends WebComponent {
+  render() {
+    return html`<div><!-- <slot name="head"> is the header --><slot></slot><p>tail</p></div>`;
+  }
+}
+SlotInComment.register('slot-in-comment');
+
 test('a component tag inside a comment is not instantiated', async () => {
   const out = await renderToString(html`<div><!-- <comment-probe></comment-probe> --></div>`);
   assert.equal(out, '<div><!-- <comment-probe></comment-probe> --></div>');
@@ -64,13 +80,93 @@ test('a comment marker inside a script does not suppress later components', asyn
   assert.ok(out.includes('RENDERED'), 'a component after a script containing "<!--" still renders');
 });
 
-test('the framework own hydration marker does not hide a sibling component', async () => {
-  // injectDSD recurses over output that already contains `<!--webjs-hydrate-->`
-  // and the client router's `<!--wj:children:...-->` boundary pairs. Those are
-  // well-formed comments, so they must not start a region that swallows the
-  // components rendered after them.
+// The cases below are the ones a naive `indexOf('<!--')` scanner gets wrong.
+// Every one of them was a real regression in the first version of this fix:
+// the component silently stopped rendering, which is a worse failure than the
+// bug being fixed, because the page loses content with no error anywhere.
+
+test('a comment marker inside an attribute value is inert', async () => {
+  const out = await renderToString(
+    html`<div><a title="use <!-- here"></a><comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'an attribute containing "<!--" does not open a comment');
+});
+
+test('the spec short comment forms close where a browser closes them', async () => {
+  // `--!>` is the "abrupt closing" form and `<!-->` is a comment with empty
+  // data. A scanner that only knows `-->` runs past both and swallows the page.
+  const abrupt = await renderToString(html`<div><!-- note --!><comment-probe></comment-probe></div>`);
+  assert.ok(abrupt.includes('RENDERED'), '--!> closes the comment');
+  const empty = await renderToString(html`<div><!--><comment-probe></comment-probe></div>`);
+  assert.ok(empty.includes('RENDERED'), '<!--> is a complete empty comment');
+});
+
+test('RCDATA content does not open a comment region', async () => {
+  // textarea and title hold text, so `<!--` inside them is not comment syntax.
+  const ta = await renderToString(html`<div><textarea><!-- hi</textarea><comment-probe></comment-probe></div>`);
+  assert.ok(ta.includes('RENDERED'), 'a textarea containing "<!--" does not suppress later components');
+  const ti = await renderToString(html`<div><title><!--</title><comment-probe></comment-probe></div>`);
+  assert.ok(ti.includes('RENDERED'), 'a title containing "<!--" does not suppress later components');
+});
+
+test('a component whose name starts with a raw-text tag name is not mistaken for one', async () => {
+  // `script-probe` starts with "script". Treating it as a <script> would skip
+  // to a `</script>` that never comes, so the rest of the document goes
+  // unscanned and the comment bug stays live after it.
   const out = await renderToString(
-    html`<div><comment-probe></comment-probe><comment-probe></comment-probe></div>`
+    html`<div><script-probe></script-probe><!-- <comment-probe> --><span>after</span></div>`
   );
-  assert.equal(out.match(/RENDERED/g)?.length, 2, 'both siblings render past the first hydrate marker');
+  assert.ok(out.includes('SCRIPTPROBE'), 'the hyphenated component itself renders');
+  assert.ok(!out.includes('RENDERED'), 'the commented component after it is still inert');
+  assert.ok(out.includes('<span>after</span>'), 'markup after it survives');
+});
+
+test('raw-text content is text, so a component inside a style is inert', async () => {
+  // Same markup-destroying path as the comment case: without this the replaced
+  // tag ate the `*/</style>` and everything after it.
+  const out = await renderToString(
+    html`<div><style>/* <comment-probe> */</style><span>ok</span></div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'a component tag inside a style does not render');
+  assert.ok(out.includes('<span>ok</span>'), 'markup after the style survives');
+});
+
+test('a commented-out suspense boundary does not run its children', async () => {
+  // processSuspenseElements runs BEFORE the element walk and hands the
+  // boundary's children to a fresh injectDSD as a standalone string, so the
+  // comment fix has to reach it too. Under streaming this also consumed an id
+  // and emitted a swap script targeting an element that only exists inside a
+  // comment, so it could never resolve.
+  const out = await renderToString(
+    html`<div><!-- <webjs-suspense data-webjs-fallback="x"><comment-probe></comment-probe></webjs-suspense> --><span>after</span></div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'children of a commented boundary do not render');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the comment survives');
+});
+
+test('a slot mentioned in a comment does not consume the authored children', async () => {
+  // The worst of the family: a commented `<slot>` has no `</slot>`, so the
+  // fallback scan swallowed the rest of the template, the real slot was never
+  // substituted, and the authored children vanished from the page.
+  const out = await renderToString(html`<slot-in-comment><b>kid</b></slot-in-comment>`);
+  assert.ok(out.includes('<b>kid</b>'), 'the authored children are still projected');
+  assert.ok(out.includes('<p>tail</p>'), 'the rest of the template survives');
+});
+
+test('the client router boundary comments do not hide the components between them', async () => {
+  // The load-bearing case (#1015, #1114). SSR wraps each layout's children in
+  // KEYED boundary comment PAIRS, and the router's scan is strict: a mispaired
+  // or duplicated boundary degrades navigation to a full page load. Those
+  // comments must be skipped as comments WITHOUT swallowing the real markup
+  // between them, so assert a component inside a pair still renders and both
+  // markers survive verbatim.
+  const out = await renderToString(html`<div>
+    <!--wj:children:root:/-->
+    <comment-probe></comment-probe>
+    <!--/wj:children:root-->
+    <comment-probe></comment-probe>
+  </div>`);
+  assert.equal(out.match(/RENDERED/g)?.length, 2, 'components inside and after the boundary pair both render');
+  assert.ok(out.includes('<!--wj:children:root:/-->'), 'the opening boundary survives verbatim');
+  assert.ok(out.includes('<!--/wj:children:root-->'), 'the closing boundary survives verbatim');
 });

From 232290687c3842b5b88d363f1d73708544962fdd Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 19:18:44 +0530
Subject: [PATCH 03/18] test(bun): prove HTML-context handling matches across
 runtimes

render-server.js is a runtime-sensitive surface, so the parity gate wants
a cross-runtime assertion rather than a Node-only result.

The reason this one is worth having is specific, not categorical. The
scanner leans on indexOf / startsWith offsets, a RegExp with a lookahead
built per call, and matchAll index arithmetic that has to line up exactly
with those offsets. A divergence between V8 and JSC would not throw, it
would shift a range boundary by a character, and the symptom is a
component that renders on one runtime and silently vanishes on the other.
So the script asserts both directions, the inert cases AND the cases that
must still render, plus the content-preservation check.

Green on node 26.1.0 and bun 1.3.14.
---
 test/bun/comment-not-an-element.mjs      | 81 ++++++++++++++++++++++++
 test/bun/comment-not-an-element.test.mjs | 13 ++++
 2 files changed, 94 insertions(+)
 create mode 100644 test/bun/comment-not-an-element.mjs
 create mode 100644 test/bun/comment-not-an-element.test.mjs

diff --git a/test/bun/comment-not-an-element.mjs b/test/bun/comment-not-an-element.mjs
new file mode 100644
index 000000000..14526cc3f
--- /dev/null
+++ b/test/bun/comment-not-an-element.mjs
@@ -0,0 +1,81 @@
+/**
+ * Cross-runtime proof that SSR treats HTML contexts identically under
+ * WHICHEVER runtime executes this file (#1128). Run it under both:
+ *
+ *   node test/bun/comment-not-an-element.mjs
+ *   bun  test/bun/comment-not-an-element.mjs
+ *
+ * A registered tag name inside a comment used to be constructed and rendered as
+ * a real element, and the replacement ate the comment's closing `-->` along
+ * with the markup after it. The fix decides that by tokenizing the assembled
+ * HTML: comments (including the `--!>` and `<!-->` short forms), markup
+ * declarations, tags with their quoted attribute values, raw text, and RCDATA.
+ *
+ * This is runtime-sensitive for a specific reason, not by category. The scanner
+ * leans on `String.prototype.indexOf` / `startsWith` offsets, a `RegExp` with a
+ * lookahead built per call, and `matchAll` index arithmetic that has to line up
+ * exactly with those offsets. Any divergence in regex semantics or index
+ * handling between V8 and JSC would not throw, it would silently shift a range
+ * boundary, and the symptom is a component that renders on one runtime and
+ * silently vanishes on the other. So both the positive and negative cases are
+ * asserted here rather than just "it does not crash".
+ *
+ * A plain assert script (not `*.test.mjs`, so the node:test runner does not
+ * double-run it); it exits non-zero on failure. Run from the repo root so the
+ * bare `@webjsdev/core` specifier resolves to the workspace package.
+ */
+import assert from 'node:assert/strict';
+import { html, WebComponent } from '@webjsdev/core';
+import { renderToString } from '@webjsdev/core/server';
+
+const runtime = process.versions.bun ? `bun ${process.versions.bun}` : `node ${process.versions.node}`;
+
+class BunProbe extends WebComponent {
+  render() { return html`<b>PROBE</b>`; }
+}
+BunProbe.register('bun-probe');
+
+// Starts with "script": a raw-text check not anchored on the tag boundary
+// misreads this as a <script> and stops scanning for the rest of the document.
+class ScriptShaped extends WebComponent {
+  render() { return html`<b>SCRIPTSHAPED</b>`; }
+}
+ScriptShaped.register('script-shaped');
+
+const rendered = async (tpl) => (await renderToString(tpl)).includes('<b>PROBE</b>');
+
+// Inert: the tag is text, not markup.
+assert.equal(await rendered(html`<div><!-- <bun-probe> --></div>`), false,
+  'a component inside a comment must not render');
+assert.equal(await rendered(html`<div><!-- <bun-probe> </div>`), false,
+  'an unterminated comment runs to EOF');
+assert.equal(await rendered(html`<div><style>/* <bun-probe> */</style></div>`), false,
+  'raw-text content is text');
+assert.equal(await rendered(html`<div><script>var a = "<bun-probe>";</script></div>`), false,
+  'script content is text');
+
+// Live: everything else still renders. These are the cases where a subtly
+// wrong range boundary makes a component disappear.
+assert.equal(await rendered(html`<div><bun-probe></bun-probe></div>`), true,
+  'a plain component still renders');
+assert.equal(await rendered(html`<div><!-- note --><bun-probe></bun-probe></div>`), true,
+  'a component after a closed comment still renders');
+assert.equal(await rendered(html`<div><a title="use <!-- here"></a><bun-probe></bun-probe></div>`), true,
+  'an attribute value containing "<!--" does not open a comment');
+assert.equal(await rendered(html`<div><!-- x --!><bun-probe></bun-probe></div>`), true,
+  'the abrupt-closing form --!> closes the comment');
+assert.equal(await rendered(html`<div><!--><bun-probe></bun-probe></div>`), true,
+  '<!--> is a complete empty comment');
+assert.equal(await rendered(html`<div><textarea><!-- hi</textarea><bun-probe></bun-probe></div>`), true,
+  'RCDATA content does not open a comment');
+assert.equal(await rendered(html`<div><script-shaped></script-shaped><bun-probe></bun-probe></div>`), true,
+  'a component whose name starts with a raw-text tag name is not treated as one');
+
+// Content preservation: the damage mode that made this worth fixing.
+const out = await renderToString(
+  html`<div><!-- see <bun-probe> here --><span>after</span></div>`
+);
+assert.ok(out.includes('-->'), 'the comment is still closed');
+assert.ok(out.includes('<span>after</span>'), 'markup after the comment survives');
+
+console.log(`[bun-parity] comment-not-an-element OK on ${runtime}`);
diff --git a/test/bun/comment-not-an-element.test.mjs b/test/bun/comment-not-an-element.test.mjs
new file mode 100644
index 000000000..65381f9c7
--- /dev/null
+++ b/test/bun/comment-not-an-element.test.mjs
@@ -0,0 +1,13 @@
+/**
+ * Run the cross-runtime HTML-context proof (#1128) under WHICHEVER runtime
+ * executes the suite. Picked up by the root `node --test` runner (so `npm test`
+ * exercises the Node path); CI also runs `bun test/bun/comment-not-an-element.mjs`
+ * for the Bun path. The proof is a plain assert script
+ * (`comment-not-an-element.mjs`, not `*.test.mjs`, so the runner does not
+ * double-run it); importing it runs it and throws on any failure.
+ */
+import { test } from 'node:test';
+
+test('SSR treats comments, raw text, and RCDATA as text on this runtime (#1128)', async () => {
+  await import('./comment-not-an-element.mjs');
+});

From 6c0c156b9b1435794975297c681d3c2fa72d1aa9 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 19:19:21 +0530
Subject: [PATCH 04/18] docs: note that a comment in a template is inert, tags
 included

The behaviour is what anyone would already expect from a browser, so it
would not normally be worth a line. It is worth one now because the
opposite used to be true and could silently delete part of a page, and
because the <template> exception is genuinely non-obvious.
---
 .agents/skills/webjs/references/components.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.agents/skills/webjs/references/components.md b/.agents/skills/webjs/references/components.md
index a97226e30..39f914b1a 100644
--- a/.agents/skills/webjs/references/components.md
+++ b/.agents/skills/webjs/references/components.md
@@ -120,6 +120,8 @@ class Panel extends WebComponent({ label: String }) {
 
 The full `<slot>` surface works in light DOM with shadow-DOM parity; migrating modes never requires a template rewrite. A forwarded slot projects its content everywhere (client, SSR, hydration).
 
+**An HTML comment in a template is inert, including tag names inside it.** `<!-- <my-card> is the wrapper -->` documents the template and renders nothing, the same as in a browser. This holds for component tags, `<slot>`, and `<webjs-suspense>`, and it extends to `<script>`, `<style>`, `<textarea>`, and `<title>` content, whose text is never treated as markup. `<template>` is the deliberate exception: its content IS parsed, which is what Declarative Shadow DOM and streamed swaps rely on. (Before #1128 a commented tag was constructed as a real element and ate the rest of the comment along with the markup after it, so an ordinary explanatory comment could silently delete part of the page.)
+
 ```ts
 class MyCard extends WebComponent {
   render() {

From 1c5783704a5b5510c6db1c05bcb29d6357a3cf19 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 19:31:35 +0530
Subject: [PATCH 05/18] fix(core): recover from an unbalanced quote, and skip
 tag interiors

Two more from review, one of them mine.

An odd quote inside any tag made the scanner consume to EOF, so it
returned a truncated range list and silently re-enabled this whole bug for
the rest of the document. It fails open, which is exactly what the last
commit claimed to be avoiding. It is reachable from ordinary app code:
escapeAttr does not escape `'`, so an interpolated apostrophe inside a
single-quoted attribute emits three unbalanced quotes. A quote now only
opens a value when it directly follows `=`, which is how a browser
recovers at the `>`.

The docstring also claimed a `<` inside an attribute was inert, and only
half of that was true. A component tag written literally in an attribute
value (`title="renders a <my-card> element"`) was still instantiated in
place, destroying the rest of the document through the identical path.
The tag interior is now recorded as inert, starting one byte in so the
tag's own opening `<` still matches. Pre-existing rather than a regression
from this branch, but it is the same bug in a context the scanner already
knows the boundaries of, so fixing it here rather than leaving an
arbitrary line through the family.
---
 packages/core/src/render-server.js            | 19 ++++++++++-
 .../ssr-comment-not-an-element.test.js        | 34 +++++++++++++++++++
 2 files changed, 52 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index 7bd446126..677ba1938 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -483,15 +483,32 @@ function inertRanges(html) {
     if (!name) { i = lt + 1; continue; }
     // Consume the tag, honouring quoted attribute values so a `<` or `<!--`
     // inside one cannot be mistaken for markup.
+    //
+    // A quote only OPENS a value when it directly follows `=`. That condition
+    // is load-bearing rather than pedantic: `escapeAttr` does not escape `'`,
+    // so an interpolated apostrophe in a single-quoted attribute emits three
+    // unbalanced quotes (`title='don't'`). Treating every quote as a delimiter
+    // left the scanner stuck inside a value to EOF, which returned a truncated
+    // range list and silently re-enabled this whole bug for the rest of the
+    // page. A browser recovers at the `>`, and so does this: after the value
+    // closes, the stray `'` is just an attribute-name character.
     let p = lt + 1;
     let quote = '';
+    let prev = '';
     while (p < n) {
       const c = html[p];
       if (quote) { if (c === quote) quote = ''; }
-      else if (c === '"' || c === "'") quote = c;
+      else if ((c === '"' || c === "'") && prev === '=') quote = c;
       else if (c === '>') { p += 1; break; }
+      if (!/\s/.test(c)) prev = c;
       p += 1;
     }
+    // The tag's interior is not markup either. A component tag written inside
+    // an attribute value (`title="renders a <my-card> element"`) was otherwise
+    // instantiated in place, destroying the rest of the document exactly like
+    // the comment case. Start at lt+1 so the tag's OWN opening `<` still
+    // matches; only what is nested inside it is inert.
+    if (p > lt + 1) ranges.push([lt + 1, p]);
     i = p;
     const tag = name[1].toLowerCase();
     const isClose = html[lt + 1] === '/';
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index 1350152f4..b5c047092 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -131,6 +131,40 @@ test('raw-text content is text, so a component inside a style is inert', async (
   assert.ok(out.includes('<span>ok</span>'), 'markup after the style survives');
 });
 
+test('an unbalanced quote in a tag does not disable the scan for the rest of the page', async () => {
+  // escapeAttr does not escape `'`, so an interpolated apostrophe inside a
+  // single-quoted attribute emits three unbalanced quotes. A scanner that
+  // treats every quote as a delimiter gets stuck inside the value to EOF and
+  // returns a truncated range list, which silently re-enables this entire bug
+  // for everything after that tag. A browser recovers at the `>`.
+  const apos = "don't";
+  const out = await renderToString(
+    html`<div title='${apos}'></div><!-- <comment-probe> --><span>after</span></div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'the commented component after the tag is still inert');
+  assert.ok(out.includes('<span>after</span>'), 'markup after it survives');
+});
+
+test('a component tag inside an attribute value is not instantiated', async () => {
+  // The same destroy-the-document path as the comment case, in a context the
+  // scanner already knows the boundaries of. Naming a component in a title or
+  // placeholder is the same authoring act that produced the original bug.
+  const out = await renderToString(
+    html`<button title="renders a <comment-probe> element">go</button><span>after</span>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'the tag in the attribute value does not render');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the tag survives');
+  assert.ok(out.includes('</button>'), 'the carrying element is still closed');
+});
+
+test('an attribute value containing > does not truncate the tag', async () => {
+  // The counterpart to the case above: the interior skip must end at the tag's
+  // real `>`, not at one inside a quoted value, or the element after it is
+  // wrongly treated as still inside the tag and never renders.
+  const out = await renderToString(html`<div title="a > b"></div><comment-probe></comment-probe>`);
+  assert.ok(out.includes('RENDERED'), 'the component after the tag still renders');
+});
+
 test('a commented-out suspense boundary does not run its children', async () => {
   // processSuspenseElements runs BEFORE the element walk and hands the
   // boundary's children to a fresh injectDSD as a standalone string, so the

From 19386c3b52e93c761f721399839c84fe524616a2 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 19:51:01 +0530
Subject: [PATCH 06/18] test(core): pin the quote and attribute-interior
 guards, correct the docs

Review found three of the new tests passed with their guard reverted, so
they were describing the fix rather than holding it.

The unbalanced-quote test used a COMMENTED probe, which stays inert either
way: consuming to EOF produces one giant inert range, so the assertion
passed for the wrong reason. It now asserts a REAL component after the bad
tag still renders, which is the thing that actually breaks. Same for the
attribute test, which needed a component named INSIDE the value rather
than a value containing only a `>`.

Its comment also had the mechanism backwards: an early `>` makes the
interior range shorter, so it can only under-cover, and the failure is an
element inside the value wrongly rendering, not one after it vanishing.

The docs line I added claimed more than ships. Nesting depth is still
counted without regard for comments, so a comment holding the open or
close tag of the element it sits inside still mis-detects where that
element ends. #1133 covers it; the line now says so instead of promising
it works.

Also names the Bun script in CI explicitly rather than relying on the
node:test wrapper for a runtime the docstring claimed was covered
directly, and renames the call-site binding now that the ranges are more
than comments.
---
 .agents/skills/webjs/references/components.md |  4 ++-
 .github/workflows/ci.yml                      |  8 +++++
 packages/core/src/render-server.js            |  8 ++---
 .../ssr-comment-not-an-element.test.js        | 30 +++++++++++++++----
 4 files changed, 39 insertions(+), 11 deletions(-)

diff --git a/.agents/skills/webjs/references/components.md b/.agents/skills/webjs/references/components.md
index 39f914b1a..fbde5389e 100644
--- a/.agents/skills/webjs/references/components.md
+++ b/.agents/skills/webjs/references/components.md
@@ -120,7 +120,9 @@ class Panel extends WebComponent({ label: String }) {
 
 The full `<slot>` surface works in light DOM with shadow-DOM parity; migrating modes never requires a template rewrite. A forwarded slot projects its content everywhere (client, SSR, hydration).
 
-**An HTML comment in a template is inert, including tag names inside it.** `<!-- <my-card> is the wrapper -->` documents the template and renders nothing, the same as in a browser. This holds for component tags, `<slot>`, and `<webjs-suspense>`, and it extends to `<script>`, `<style>`, `<textarea>`, and `<title>` content, whose text is never treated as markup. `<template>` is the deliberate exception: its content IS parsed, which is what Declarative Shadow DOM and streamed swaps rely on. (Before #1128 a commented tag was constructed as a real element and ate the rest of the comment along with the markup after it, so an ordinary explanatory comment could silently delete part of the page.)
+**A tag name inside an HTML comment is not instantiated.** `<!-- <my-card> is the wrapper -->` documents the template and renders no component, the same as in a browser. That holds for component tags, `<slot>`, and `<webjs-suspense>`, and it extends to `<script>`, `<style>`, `<textarea>`, `<title>` content and attribute values, whose text is never treated as markup. `<template>` is the deliberate exception: its content IS parsed, which is what Declarative Shadow DOM and streamed swaps rely on. (Before #1128 a commented tag was constructed as a real element and ate the rest of the comment along with the markup after it, so an ordinary explanatory comment could silently delete part of the page.)
+
+One gap remains, tracked in #1133: element NESTING is still counted without regard for comments, so a comment that contains an opening or closing tag of the element it sits inside (`<my-card>kid<!-- <my-card> --></my-card>`) still mis-detects where that element ends and shuffles the surrounding markup. Until that lands, avoid writing a component's own tag, open or close, in a comment inside that component.
 
 ```ts
 class MyCard extends WebComponent {
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f3364c71..09d5f07f8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -126,6 +126,14 @@ jobs:
       # Readable.fromWeb, which hangs on Bun).
       - name: webjs compression on Bun
         run: bun test/bun/compression.mjs
+      # SSR HTML-context handling on Bun (#1128): a tag name inside a comment,
+      # raw text, RCDATA, or an attribute value is text, not an element. The
+      # scanner is offset arithmetic over indexOf / startsWith results and a
+      # per-call RegExp, so a V8-versus-JSC divergence would not throw, it would
+      # shift a range boundary and make a component render on one runtime and
+      # silently vanish on the other. Asserts both directions.
+      - name: SSR comment and raw-text handling on Bun
+        run: bun test/bun/comment-not-an-element.mjs
       # Dev hot reload on Bun (#514): start `webjs dev` under Bun, edit a
       # re-imported route module, and assert the response updates with NO manual
       # restart. The CLI re-execs under `bun --hot` on Bun (vs `node --watch` on
diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index 677ba1938..b30a6edaf 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -576,14 +576,14 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
   );
   /** @type {{start:number, end:number, text:string}[]} */
   const edits = [];
-  // A tag name inside a comment, a script, a style, or RCDATA is text, not an
-  // element (#1128).
-  const comments = inertRanges(html);
+  // A tag name inside a comment, a script, a style, RCDATA, or another tag's
+  // attribute value is text, not an element (#1128).
+  const inert = inertRanges(html);
   for (const m of html.matchAll(pattern)) {
     const [match, tag, attrs, selfClose] = m;
     const Cls = lookup(tag);
     if (!Cls) continue;
-    if (comments.length && inRanges(comments, m.index)) continue;
+    if (inert.length && inRanges(inert, m.index)) continue;
     // Track which custom elements actually appeared: used by SSR to emit
     // `<link rel="modulepreload">` hints for their module URLs.
     if (ctx && ctx.usedComponents) ctx.usedComponents.add(tag);
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index b5c047092..5365b60a2 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -138,6 +138,15 @@ test('an unbalanced quote in a tag does not disable the scan for the rest of the
   // returns a truncated range list, which silently re-enables this entire bug
   // for everything after that tag. A browser recovers at the `>`.
   const apos = "don't";
+  // The discriminating assertion is a REAL component after the bad tag. If the
+  // scan runs to EOF it produces one giant inert range, which keeps a commented
+  // probe inert for the wrong reason and would pass either way; only a genuine
+  // element reveals that everything after the tag stopped being scanned.
+  const live = await renderToString(
+    html`<div title='${apos}'></div><comment-probe></comment-probe>`
+  );
+  assert.ok(live.includes('RENDERED'), 'a real component after the unbalanced quote still renders');
+
   const out = await renderToString(
     html`<div title='${apos}'></div><!-- <comment-probe> --><span>after</span></div>`
   );
@@ -157,12 +166,21 @@ test('a component tag inside an attribute value is not instantiated', async () =
   assert.ok(out.includes('</button>'), 'the carrying element is still closed');
 });
 
-test('an attribute value containing > does not truncate the tag', async () => {
-  // The counterpart to the case above: the interior skip must end at the tag's
-  // real `>`, not at one inside a quoted value, or the element after it is
-  // wrongly treated as still inside the tag and never renders.
-  const out = await renderToString(html`<div title="a > b"></div><comment-probe></comment-probe>`);
-  assert.ok(out.includes('RENDERED'), 'the component after the tag still renders');
+test('an attribute value containing > does not end the tag early', async () => {
+  // A `>` inside a quoted value must not close the tag, or the interior range
+  // stops short and a component tag written LATER in that same value escapes
+  // the skip and is instantiated, destroying the rest of the document. The
+  // tag-with-a-component-in-it is what discriminates: a value containing only
+  // `>` passes whether or not quotes are tracked at all.
+  const out = await renderToString(
+    html`<div title="a > b <comment-probe> c"></div><span>after</span>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'a component named later in the value is still inert');
+  assert.ok(out.includes('</div>'), 'the carrying element is still closed');
+  assert.ok(out.includes('<span>after</span>'), 'markup after it survives');
+
+  const live = await renderToString(html`<div title="a > b"></div><comment-probe></comment-probe>`);
+  assert.ok(live.includes('RENDERED'), 'a real component after such a tag still renders');
 });
 
 test('a commented-out suspense boundary does not run its children', async () => {

From e2a21c0c2cefdee9901a5a0b90a4561bcb382aa1 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 20:30:01 +0530
Subject: [PATCH 07/18] fix(core): close the </ bogus-comment gap and cut the
 scan cost

Fourth review round, four things.

A differential fuzz against parse5 found one remaining context gap: `</`
followed by a non-letter (`</1`, `</<`, `</ `) is the third bogus-comment
form and also runs to the next `>`. Without that branch the bytes after it
were scanned as markup and a tag inside was instantiated, which is the
original bug in a shape nobody had tried.

partitionAuthoredBySlot was a fourth scanner deciding where a comment ends,
with a bare indexOf('-->') that disagreed with inertRanges on exactly the
short forms it was taught. The disagreement silently routed a slot="head"
child into the default slot. Both now call one shared endOfComment.

The perf claim in the body was wrong, measured 2.5x rather than the 8 to 10
percent I repeated from an earlier round. Two causes, both fixed: a
per-character RegExp test that ran over every byte of every tag (worst on a
Tailwind page, where most bytes are long class attributes) is now a char
compare, and the membership test now carries a cursor instead of restarting
at range zero on every match, which was an O(tags x components) term.
inRanges became inertAt; its old doc claimed the left-to-right optimisation
it never actually did.

The headline comment guard also turned out to be unpinned: disabling the
entire `<!--` branch left 15 of 16 tests green, because `<!--` then fell
through to the markup-declaration path that stops at the first `>`, and
every fixture had its tag before that `>`. A comment containing a `>` ahead
of the tag is the discriminator, and disabling the branch now reds three.
---
 packages/core/src/render-server.js            | 119 ++++++++++++------
 .../ssr-comment-not-an-element.test.js        |  31 +++++
 2 files changed, 114 insertions(+), 36 deletions(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index b30a6edaf..cbcc7900e 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -447,6 +447,29 @@ function defaultSSRErrorTemplate(tag, err, dev) {
  * @param {string} html
  * @returns {[number, number][]} ascending, non-overlapping `[start, end)` pairs
  */
+/**
+ * Index just past the end of the comment starting at `start`, or -1 if it is
+ * unterminated. Shared so every scanner that has to decide where a comment
+ * stops agrees, including on the spec short forms.
+ *
+ * @param {string} html
+ * @param {number} start  index of the `<` of `<!--`
+ * @returns {number}
+ */
+function endOfComment(html, start) {
+  let p = start + 4;
+  // `<!-->` and `<!--->` are comments whose data is empty (spec short forms).
+  if (html[p] === '>') return p + 1;
+  if (html.startsWith('->', p)) return p + 2;
+  while (p < html.length) {
+    // `--!>` is the spec's "abrupt closing" form and closes just like `-->`.
+    if (html.startsWith('-->', p)) return p + 3;
+    if (html.startsWith('--!>', p)) return p + 4;
+    p += 1;
+  }
+  return -1;
+}
+
 function inertRanges(html) {
   /** @type {[number, number][]} */
   const ranges = [];
@@ -456,19 +479,10 @@ function inertRanges(html) {
     const lt = html.indexOf('<', i);
     if (lt === -1) break;
     if (html.startsWith('<!--', lt)) {
-      let p = lt + 4;
-      // `<!-->` and `<!--->` are comments whose data is empty (spec short forms).
-      if (html[p] === '>') p += 1;
-      else if (html.startsWith('->', p)) p += 2;
-      else {
-        while (p < n) {
-          if (html.startsWith('-->', p)) { p += 3; break; }
-          if (html.startsWith('--!>', p)) { p += 4; break; }
-          p += 1;
-        }
-      }
-      ranges.push([lt, Math.min(p, n)]);
-      i = Math.min(p, n);
+      const end = endOfComment(html, lt);
+      const stop = end === -1 ? n : end;
+      ranges.push([lt, stop]);
+      i = stop;
       continue;
     }
     if (html.startsWith('<!', lt) || html.startsWith('<?', lt)) {
@@ -480,7 +494,21 @@ function inertRanges(html) {
       continue;
     }
     const name = /^<\/?([a-zA-Z][^\s/>]*)/.exec(html.slice(lt, lt + 64));
-    if (!name) { i = lt + 1; continue; }
+    if (!name) {
+      // `</` followed by anything that is not an ASCII letter is the third
+      // bogus-comment form (`</1`, `</<`, `</ `), which the spec also runs to
+      // the next `>`. Without this branch the bytes after it are scanned as
+      // markup and a tag inside gets instantiated, which is the original bug.
+      if (html.startsWith('</', lt)) {
+        const close = html.indexOf('>', lt);
+        const end = close === -1 ? n : close + 1;
+        ranges.push([lt, end]);
+        i = end;
+        continue;
+      }
+      i = lt + 1;
+      continue;
+    }
     // Consume the tag, honouring quoted attribute values so a `<` or `<!--`
     // inside one cannot be mistaken for markup.
     //
@@ -500,7 +528,10 @@ function inertRanges(html) {
       if (quote) { if (c === quote) quote = ''; }
       else if ((c === '"' || c === "'") && prev === '=') quote = c;
       else if (c === '>') { p += 1; break; }
-      if (!/\s/.test(c)) prev = c;
+      // Char compare rather than a regex: this runs per byte of every tag, and
+      // on a Tailwind-default page most bytes ARE tag interior (long class
+      // attributes), so a per-character `RegExp` test dominated the scan cost.
+      if (c !== ' ' && c !== '\t' && c !== '\n' && c !== '\r' && c !== '\f') prev = c;
       p += 1;
     }
     // The tag's interior is not markup either. A component tag written inside
@@ -524,20 +555,30 @@ function inertRanges(html) {
 }
 
 /**
- * Is `index` inside one of `ranges`? Ranges are ascending and non-overlapping,
- * and callers walk matches left to right, so this stops as soon as a range
- * starts past the index.
+ * A left-to-right membership test over ascending, non-overlapping ranges.
+ *
+ * Returns a function that answers "is this index inert?" and REMEMBERS how far
+ * it has walked, so a caller scanning matches in increasing order pays O(ranges)
+ * across the whole scan instead of O(ranges) per match. Restarting each time is
+ * an O(tags x components) term, which is measurable on a large page: holding a
+ * document at 40k tags and raising the component count adds hundreds of
+ * milliseconds that the cursor removes.
+ *
+ * The cursor only ever moves forward, so callers MUST query in non-decreasing
+ * index order. All three call sites do (`matchAll`, and the two loops that
+ * consume their input left to right). A caller that needs random access should
+ * scan `ranges` directly rather than reusing this.
  *
  * @param {[number, number][]} ranges
- * @param {number} index
- * @returns {boolean}
+ * @returns {(index: number) => boolean}
  */
-function inRanges(ranges, index) {
-  for (const [start, end] of ranges) {
-    if (start > index) return false;
-    if (index < end) return true;
-  }
-  return false;
+function inertAt(ranges) {
+  let cursor = 0;
+  return (index) => {
+    while (cursor < ranges.length && ranges[cursor][1] <= index) cursor += 1;
+    if (cursor >= ranges.length) return false;
+    return index >= ranges[cursor][0];
+  };
 }
 
 /**
@@ -578,12 +619,12 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
   const edits = [];
   // A tag name inside a comment, a script, a style, RCDATA, or another tag's
   // attribute value is text, not an element (#1128).
-  const inert = inertRanges(html);
+  const isInert = inertAt(inertRanges(html));
   for (const m of html.matchAll(pattern)) {
     const [match, tag, attrs, selfClose] = m;
     const Cls = lookup(tag);
     if (!Cls) continue;
-    if (inert.length && inRanges(inert, m.index)) continue;
+    if (isInert(m.index)) continue;
     // Track which custom elements actually appeared: used by SSR to emit
     // `<link rel="modulepreload">` hints for their module URLs.
     if (ctx && ctx.usedComponents) ctx.usedComponents.add(tag);
@@ -894,7 +935,7 @@ async function processSuspenseElements(html, ctx, ancestors = [], dev) {
   // fetches run and the swap script targets an id that only exists inside a
   // comment, so it can never resolve. Ranges are computed against the FULL
   // input once, and `consumed` maps the shrinking `rest` back onto it.
-  const inert = inertRanges(html);
+  const isInert = inertAt(inertRanges(html));
   let consumed = 0;
   let result = '';
   let rest = html;
@@ -905,7 +946,7 @@ async function processSuspenseElements(html, ctx, ancestors = [], dev) {
       result += rest;
       break;
     }
-    if (inert.length && inRanges(inert, consumed + m.index)) {
+    if (isInert(consumed + m.index)) {
       // Emit through the end of this match and keep scanning after it.
       const skipTo = m.index + m[0].length;
       result += rest.slice(0, skipTo);
@@ -1027,14 +1068,20 @@ function partitionAuthoredBySlot(html) {
     if (lt > cursor) defaultBuf += html.slice(cursor, lt);
     const rest = html.slice(lt);
     if (rest.startsWith('<!--')) {
-      const end = html.indexOf('-->', lt + 4);
-      if (end === -1) {
+      // Find the comment's end the same way inertRanges does, rather than with
+      // a bare `indexOf('-->')`. The two helpers both decide where a comment
+      // stops, so a bare search makes them DISAGREE on the spec short forms
+      // (`--!>`, `<!-->`, `<!--->`): this one would run past the real end and
+      // swallow the slotted children that follow, silently routing a
+      // `slot="head"` child into the default slot.
+      const commentEnd = endOfComment(html, lt);
+      if (commentEnd === -1) {
         defaultBuf += rest;
         cursor = html.length;
         break;
       }
-      defaultBuf += html.slice(lt, end + 3);
-      cursor = end + 3;
+      defaultBuf += html.slice(lt, commentEnd);
+      cursor = commentEnd;
       continue;
     }
     if (rest.startsWith('<!') || rest.startsWith('</')) {
@@ -1125,10 +1172,10 @@ function substituteSlotsInRender(rendered, partitioned, ownerTag) {
   // has no `</slot>`, so the fallback scan below swallows the rest of the
   // template, the component's REAL slot is never substituted, and the authored
   // children are dropped from the page entirely.
-  const inert = inertRanges(rendered);
+  const isInert = inertAt(inertRanges(rendered));
   let m;
   while ((m = slotRe.exec(rendered)) !== null) {
-    if (inert.length && inRanges(inert, m.index)) continue;
+    if (isInert(m.index)) continue;
     result += rendered.slice(cursor, m.index);
     const [fullOpen, attrsRaw, selfCloseSlash] = m;
     const isSelfClose = !!selfCloseSlash;
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index 5365b60a2..9d1558f18 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -42,6 +42,37 @@ test('a component tag inside a comment is not instantiated', async () => {
   assert.equal(out, '<div><!-- <comment-probe></comment-probe> --></div>');
 });
 
+test('a comment containing a > still runs to its real end', async () => {
+  // This is what actually pins the comment branch. Without it, `<!--` falls
+  // through to the markup-declaration path, which stops at the FIRST `>`, and
+  // every fixture whose tag sits before that `>` stays inert for the wrong
+  // reason. A `>` INSIDE the comment, ahead of the tag, is the discriminator.
+  const out = await renderToString(
+    html`<div><!-- a > b <comment-probe> --><span>after</span></div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'the component after the > is still inert');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the comment survives');
+});
+
+test('every component in a multi-tag comment stays inert', async () => {
+  const out = await renderToString(
+    html`<div><!-- <comment-probe> and <comment-probe> --><span>after</span></div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'neither component renders');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the comment survives');
+});
+
+test('a bogus comment opened by </ does not expose what follows', async () => {
+  // `</` followed by a non-letter is the third bogus-comment form and also runs
+  // to the next `>`. Without that branch the bytes after it are scanned as
+  // markup and the tag inside is instantiated.
+  const out = await renderToString(
+    html`<div>a </< b <comment-probe> c</div><span>after</span>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'the tag inside the bogus comment does not render');
+  assert.ok(out.includes('<span>after</span>'), 'markup after it survives');
+});
+
 test('markup after a comment mentioning a component survives', async () => {
   // The regression that actually loses content: the old behaviour ate the
   // closing `-->` and the trailing markup with it.

From fc17db1dfd3c0a5c2f961e4cd8e6fcd537162c0b Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 20:44:00 +0530
Subject: [PATCH 08/18] fix(core): treat every text-only element as text, and
 pin the rest

Fifth round.

Raw text is not just script and style. iframe, xmp, noembed, noframes and
plaintext are all elements whose content the tokenizer never reads as
markup, and an <iframe> with fallback markup destroyed the document
exactly like the comment case. Widened through a predicate scoped to this
scanner rather than isRawtextTag, which is shared with the template
tokenizer where it decides hole escaping. noscript is deliberately left
out: its content IS parsed when scripting is disabled, which for a
progressive-enhancement framework is the case that matters, so components
inside it must keep rendering.

Three guards were load-bearing with no test at all, each verified by
reverting it alone: the markup-declaration branch (a tag inside <![CDATA[
was instantiated without it), the consumed offset arithmetic in the
suspense scanner (a comment following a REAL boundary was mis-mapped and
its contents ran, which the existing test could not reach because it had
no preceding boundary), and the partition scanner sharing endOfComment (a
short-form comment ran past its end and routed a slot="head" child into
the default slot).

Extracting endOfComment last round also orphaned the inertRanges doc block
onto it, leaving two stacked comments on one function and the real one
undocumented.
---
 packages/core/src/render-server.js            | 96 ++++++++++++-------
 .../ssr-comment-not-an-element.test.js        | 51 ++++++++++
 2 files changed, 115 insertions(+), 32 deletions(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index cbcc7900e..4bb42f99c 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -411,6 +411,29 @@ function defaultSSRErrorTemplate(tag, err, dev) {
   </div>`;
 }
 
+/**
+ * Index just past the end of the comment starting at `start`, or -1 if it is
+ * unterminated. Shared so every scanner that has to decide where a comment
+ * stops agrees, including on the spec short forms.
+ *
+ * @param {string} html
+ * @param {number} start  index of the `<` of `<!--`
+ * @returns {number}
+ */
+function endOfComment(html, start) {
+  let p = start + 4;
+  // `<!-->` and `<!--->` are comments whose data is empty (spec short forms).
+  if (html[p] === '>') return p + 1;
+  if (html.startsWith('->', p)) return p + 2;
+  while (p < html.length) {
+    // `--!>` is the spec's "abrupt closing" form and closes just like `-->`.
+    if (html.startsWith('-->', p)) return p + 3;
+    if (html.startsWith('--!>', p)) return p + 4;
+    p += 1;
+  }
+  return -1;
+}
+
 /**
  * Byte ranges of `html` where a tag-shaped match is NOT an element (#1128).
  *
@@ -436,40 +459,22 @@ function defaultSSRErrorTemplate(tag, err, dev) {
  *   which end at the next `>`.
  * - **Tags**, consumed with their quoted attribute values, so `<` and `<!--`
  *   inside an attribute are inert rather than context-changing.
- * - **Raw text** (`script`, `style`) and **RCDATA** (`textarea`, `title`), whose
- *   content is text and ends only at the matching close tag. Their content is
- *   returned as a skip range too: a component tag inside a `<style>` comment hit
- *   the identical markup-destroying path, so excluding it would leave half the
- *   bug live. `<template>` is deliberately NOT in this list; its content is
- *   parsed normally and legitimately carries components (Declarative Shadow DOM
- *   and the streaming swap templates both depend on that).
+ * - **Text-only elements**, whose content the HTML tokenizer never reads as
+ *   markup: raw text (`script`, `style`, `iframe`, `xmp`, `noembed`,
+ *   `noframes`, `plaintext`) and RCDATA (`textarea`, `title`). Their content is
+ *   returned as a skip range too, because a component tag inside a `<style>`
+ *   comment or an `<iframe>` fallback hit the identical markup-destroying path,
+ *   so excluding them would leave half the bug live.
  *
- * @param {string} html
- * @returns {[number, number][]} ascending, non-overlapping `[start, end)` pairs
- */
-/**
- * Index just past the end of the comment starting at `start`, or -1 if it is
- * unterminated. Shared so every scanner that has to decide where a comment
- * stops agrees, including on the spec short forms.
+ *   Two deliberate exclusions. `<template>` content IS parsed and legitimately
+ *   carries components (Declarative Shadow DOM and the streamed swap templates
+ *   both depend on that). `<noscript>` content is parsed as markup when
+ *   scripting is disabled, which for a progressive-enhancement framework is the
+ *   case that matters, so components inside it must keep rendering.
  *
  * @param {string} html
- * @param {number} start  index of the `<` of `<!--`
- * @returns {number}
+ * @returns {[number, number][]} ascending, non-overlapping `[start, end)` pairs
  */
-function endOfComment(html, start) {
-  let p = start + 4;
-  // `<!-->` and `<!--->` are comments whose data is empty (spec short forms).
-  if (html[p] === '>') return p + 1;
-  if (html.startsWith('->', p)) return p + 2;
-  while (p < html.length) {
-    // `--!>` is the spec's "abrupt closing" form and closes just like `-->`.
-    if (html.startsWith('-->', p)) return p + 3;
-    if (html.startsWith('--!>', p)) return p + 4;
-    p += 1;
-  }
-  return -1;
-}
-
 function inertRanges(html) {
   /** @type {[number, number][]} */
   const ranges = [];
@@ -543,9 +548,12 @@ function inertRanges(html) {
     i = p;
     const tag = name[1].toLowerCase();
     const isClose = html[lt + 1] === '/';
-    if (!isClose && (isRawtextTag(tag) || isRcdataTag(tag))) {
+    if (!isClose && isTextOnlyTag(tag)) {
       // Everything up to the matching close tag is text, not markup.
-      const close = new RegExp(`</${tag}(?=[\\s/>])`, 'i').exec(html.slice(p));
+      // `<plaintext>` has no end tag at all: the rest of the document is text.
+      const close = tag === 'plaintext'
+        ? null
+        : new RegExp(`</${tag}(?=[\\s/>])`, 'i').exec(html.slice(p));
       const contentEnd = close ? p + close.index : n;
       if (contentEnd > p) ranges.push([p, contentEnd]);
       i = contentEnd;
@@ -1245,6 +1253,30 @@ function isRcdataTag(tag) {
   return tag === 'textarea' || tag === 'title';
 }
 
+/**
+ * Elements whose content the HTML tokenizer never reads as markup, for the
+ * purposes of `inertRanges` only (#1128).
+ *
+ * Deliberately NOT `isRawtextTag`, even though it overlaps: that predicate is
+ * shared with the template tokenizer, where widening it would change how holes
+ * inside those elements are escaped. This one answers a narrower question,
+ * "can a tag-shaped string in here be a real element", and the answer is no for
+ * every raw-text and RCDATA element, not just the two the template path cares
+ * about. `<iframe>` with fallback markup is the realistic trigger.
+ *
+ * `<noscript>` is excluded on purpose: its content IS parsed as markup when
+ * scripting is disabled, which for a progressive-enhancement framework is the
+ * case that matters, so components inside it must keep rendering.
+ *
+ * @param {string} tag
+ * @returns {boolean}
+ */
+function isTextOnlyTag(tag) {
+  return isRawtextTag(tag) || isRcdataTag(tag)
+    || tag === 'iframe' || tag === 'xmp' || tag === 'noembed'
+    || tag === 'noframes' || tag === 'plaintext';
+}
+
 /**
  * Minimal attribute string parser.
  * @param {string} attrStr
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index 9d1558f18..f0d7b7c4f 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -37,6 +37,15 @@ class SlotInComment extends WebComponent {
 }
 SlotInComment.register('slot-in-comment');
 
+// A named slot with a distinguishable fallback, so a child routed into the
+// WRONG slot is visible in the output rather than merely missing.
+class SlotShell extends WebComponent {
+  render() {
+    return html`<div><slot name="head">NO-HEAD</slot><slot></slot></div>`;
+  }
+}
+SlotShell.register('slot-shell');
+
 test('a component tag inside a comment is not instantiated', async () => {
   const out = await renderToString(html`<div><!-- <comment-probe></comment-probe> --></div>`);
   assert.equal(out, '<div><!-- <comment-probe></comment-probe> --></div>');
@@ -236,6 +245,48 @@ test('a slot mentioned in a comment does not consume the authored children', asy
   assert.ok(out.includes('<p>tail</p>'), 'the rest of the template survives');
 });
 
+test('iframe fallback content is text, not markup', async () => {
+  // Raw text is not just script and style. An <iframe> with fallback markup is
+  // the realistic one, and it hit the identical document-destroying path.
+  const out = await renderToString(
+    html`<div><iframe>see <comment-probe> here</iframe><span>after</span></div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'a component tag inside an iframe does not render');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the iframe survives');
+});
+
+test('a markup declaration does not expose the markup after it', async () => {
+  // `<![CDATA[ ... ]]>` and `<!x ...>` are bogus comments that run to the next
+  // `>`. Without that branch the bytes inside are scanned as markup.
+  const cdata = await renderToString(
+    html`<div><![CDATA[ <comment-probe> ]]><span>after</span></div>`
+  );
+  assert.ok(!cdata.includes('RENDERED'), 'a tag inside CDATA does not render');
+  assert.ok(cdata.includes('<span>after</span>'), 'markup after it survives');
+});
+
+test('a comment AFTER a real suspense boundary is still mapped correctly', async () => {
+  // Pins the `consumed` offset arithmetic. The suspense scanner computes its
+  // ranges against the full input but walks a shrinking string, so a boundary
+  // consumed earlier has to advance the offset or every later comment is
+  // mis-mapped and its contents run. A commented boundary with no real one
+  // before it only exercises the offset-zero path.
+  const out = await renderToString(html`<div><webjs-suspense>a</webjs-suspense><!-- <webjs-suspense><comment-probe></comment-probe></webjs-suspense> --><span>after</span></div>`);
+  assert.ok(!out.includes('RENDERED'), 'the commented boundary after a real one stays inert');
+  assert.ok(out.includes('<span>after</span>'), 'markup after it survives');
+});
+
+test('a short-form comment does not swallow the slotted children after it', async () => {
+  // Pins the partition scanner sharing endOfComment. With a bare indexOf('-->')
+  // it runs past a `<!-->` or `--!>` and eats the children, so a slot="head"
+  // child is silently routed into the default slot.
+  const out = await renderToString(
+    html`<slot-shell><!--><b slot="head">HEAD</b><i>BODY</i></slot-shell>`
+  );
+  assert.ok(out.includes('HEAD'), 'the named-slot child is still projected');
+  assert.ok(!out.includes('NO-HEAD'), 'the named slot did not fall back');
+});
+
 test('the client router boundary comments do not hide the components between them', async () => {
   // The load-bearing case (#1015, #1114). SSR wraps each layout's children in
   // KEYED boundary comment PAIRS, and the router's scan is strict: a mispaired

From 5275008d196f602fceeb588de74e7c220bc97bc4 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 20:58:56 +0530
Subject: [PATCH 09/18] test(core): pin the text-only set and both exclusions,
 sync the docs

The widening from last round was itself unpinned: dropping xmp, noembed,
noframes and plaintext left every test green, and so did wrongly ADDING
noscript, which would have stopped components rendering for exactly the
reader server-rendered output exists for. Each is now a counterfactual.

components.md still described the old two-element list and named template
as the only exception, so an agent reading it would conclude an iframe
fallback still instantiates components and would never learn noscript is
the exception that matters. It now lists the real set and both exclusions.

Also documents #1134, the one residual divergence a differential fuzz
against parse5 found across ~221k fixtures: a script body that contains
`<!--` followed by `<script` enters the parser's double-escaped state,
where the next `</script>` does not close the element, and this scanner
ends the content there anyway. Narrow enough to file rather than fix here,
loud enough that it should not sit undocumented while the docs claim
script content is handled.
---
 .agents/skills/webjs/references/components.md |  6 ++-
 .../ssr-comment-not-an-element.test.js        | 43 +++++++++++++++++++
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/.agents/skills/webjs/references/components.md b/.agents/skills/webjs/references/components.md
index fbde5389e..adbab5595 100644
--- a/.agents/skills/webjs/references/components.md
+++ b/.agents/skills/webjs/references/components.md
@@ -120,9 +120,11 @@ class Panel extends WebComponent({ label: String }) {
 
 The full `<slot>` surface works in light DOM with shadow-DOM parity; migrating modes never requires a template rewrite. A forwarded slot projects its content everywhere (client, SSR, hydration).
 
-**A tag name inside an HTML comment is not instantiated.** `<!-- <my-card> is the wrapper -->` documents the template and renders no component, the same as in a browser. That holds for component tags, `<slot>`, and `<webjs-suspense>`, and it extends to `<script>`, `<style>`, `<textarea>`, `<title>` content and attribute values, whose text is never treated as markup. `<template>` is the deliberate exception: its content IS parsed, which is what Declarative Shadow DOM and streamed swaps rely on. (Before #1128 a commented tag was constructed as a real element and ate the rest of the comment along with the markup after it, so an ordinary explanatory comment could silently delete part of the page.)
+**A tag name inside an HTML comment is not instantiated.** `<!-- <my-card> is the wrapper -->` documents the template and renders no component, the same as in a browser. That holds for component tags, `<slot>`, and `<webjs-suspense>`. It extends to attribute values and to every element whose content the HTML parser reads as text rather than markup: `<script>`, `<style>`, `<iframe>`, `<xmp>`, `<noembed>`, `<noframes>`, `<plaintext>`, `<textarea>`, `<title>`. (Before #1128 a commented tag was constructed as a real element and ate the rest of the comment along with the markup after it, so an ordinary explanatory comment could silently delete part of the page.)
 
-One gap remains, tracked in #1133: element NESTING is still counted without regard for comments, so a comment that contains an opening or closing tag of the element it sits inside (`<my-card>kid<!-- <my-card> --></my-card>`) still mis-detects where that element ends and shuffles the surrounding markup. Until that lands, avoid writing a component's own tag, open or close, in a comment inside that component.
+Two elements are deliberately excluded, and the second matters more. `<template>` content IS parsed and legitimately carries components, which is what Declarative Shadow DOM and streamed swaps rely on. `<noscript>` content is also parsed, because a browser with scripting disabled reads it as markup, and that is the case a progressive-enhancement framework exists to serve, so components inside `<noscript>` render normally.
+
+Two gaps remain. Tracked in #1133: element NESTING is still counted without regard for comments, so a comment that contains an opening or closing tag of the element it sits inside (`<my-card>kid<!-- <my-card> --></my-card>`) still mis-detects where that element ends and shuffles the surrounding markup. Until that lands, avoid writing a component's own tag, open or close, in a comment inside that component. Tracked in #1134: a `<script>` body that contains `<!--` followed by `<script` enters the parser's double-escaped state, where the next `</script>` does not close the element, and WebJs ends the script content there anyway. It needs the legacy comment-wrapped inline script pattern to trigger.
 
 ```ts
 class MyCard extends WebComponent {
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index f0d7b7c4f..04d4b703e 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -15,6 +15,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 
 import { html, renderToString, WebComponent } from '../../index.js';
+import { unsafeHTML } from '../../src/directives.js';
 
 class CommentProbe extends WebComponent {
   render() { return html`<b>RENDERED</b>`; }
@@ -255,6 +256,48 @@ test('iframe fallback content is text, not markup', async () => {
   assert.ok(out.includes('<span>after</span>'), 'markup after the iframe survives');
 });
 
+test('a component inside noscript still renders', async () => {
+  // The exclusion that matters most, and the one a future widening of the
+  // text-only list would silently break. A browser with scripting disabled
+  // parses noscript content as markup, and that reader is exactly who
+  // server-rendered output exists for, so components inside it must render.
+  const out = await renderToString(
+    html`<div><noscript><comment-probe></comment-probe></noscript></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'noscript content is markup, not text');
+});
+
+test('a component inside a template still renders', async () => {
+  // The other exclusion: template content is parsed, and Declarative Shadow DOM
+  // and the streamed swap templates both depend on components inside it.
+  const out = await renderToString(
+    html`<div><template><comment-probe></comment-probe></template></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'template content is parsed as markup');
+});
+
+test('the other text-only elements are text too', async () => {
+  // iframe is covered separately as the realistic case; these pin the rest of
+  // the set so a future trim of the predicate reds a test instead of silently
+  // reintroducing the document-destroying path.
+  for (const tag of ['xmp', 'noembed', 'noframes']) {
+    const out = await renderToString(
+      html`<div>${unsafeHTML(`<${tag}>see <comment-probe> here</${tag}>`)}<span>after</span></div>`
+    );
+    assert.ok(!out.includes('RENDERED'), `a component tag inside <${tag}> does not render`);
+    assert.ok(out.includes('<span>after</span>'), `markup after <${tag}> survives`);
+  }
+});
+
+test('plaintext runs to the end of the document', async () => {
+  // plaintext has no end tag at all: everything after it is text, so nothing
+  // following can be a component.
+  const out = await renderToString(
+    html`<div><plaintext>see <comment-probe> here</div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'nothing after plaintext is instantiated');
+});
+
 test('a markup declaration does not expose the markup after it', async () => {
   // `<![CDATA[ ... ]]>` and `<!x ...>` are bogus comments that run to the next
   // `>`. Without that branch the bytes inside are scanned as markup.

From f5554ca8fd6560e90a33a1157ebf77933cc8cfec Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 21:10:54 +0530
Subject: [PATCH 10/18] test(core): pin where each text-only skip ENDS, and the
 streaming path

The end boundary of every text-only skip was unpinned, and its failure
mode is the one this whole change exists to avoid. Making the range never
end left all 27 tests green, yet under that patch a single <style> in a
root layout takes out every component on every page.

The existing assertions could not catch it: an inert range never deletes
text, so "markup after it survives" is true wherever the range stops. It
was redundant with the negative assertion rather than a second check. Only
a real component AFTER the element proves scanning resumed, which is what
the script and RCDATA tests already had and these five did not. Reverting
the boundary now reds five tests. Same gap in the cross-runtime script,
which claimed to guard exactly this kind of boundary divergence.

The commented-suspense test also only ever ran the blocking branch, since
plain renderToString passes no suspense context, so the serious half went
unasserted: under streaming a commented boundary would consume an id,
queue a chunk, and emit a swap script targeting an element that exists
only inside a comment, leaving the fallback stuck forever. Now asserted
against a real context.
---
 .../ssr-comment-not-an-element.test.js        | 35 +++++++++++++++++++
 test/bun/comment-not-an-element.mjs           | 11 ++++++
 2 files changed, 46 insertions(+)

diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index 04d4b703e..d9b64bf9a 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -170,6 +170,15 @@ test('raw-text content is text, so a component inside a style is inert', async (
   );
   assert.ok(!out.includes('RENDERED'), 'a component tag inside a style does not render');
   assert.ok(out.includes('<span>ok</span>'), 'markup after the style survives');
+  // The END of the skip needs its own assertion. An inert range never deletes
+  // text, so the span above is true wherever the range stops; only a real
+  // component after the element proves scanning RESUMED. If it did not, a
+  // single <style> in a root layout would silently kill every component on
+  // every page, which is worse than the bug this all started from.
+  const after = await renderToString(
+    html`<div><style>.a{color:red}</style><comment-probe></comment-probe></div>`
+  );
+  assert.ok(after.includes('RENDERED'), 'scanning resumes after the style closes');
 });
 
 test('an unbalanced quote in a tag does not disable the scan for the rest of the page', async () => {
@@ -254,6 +263,10 @@ test('iframe fallback content is text, not markup', async () => {
   );
   assert.ok(!out.includes('RENDERED'), 'a component tag inside an iframe does not render');
   assert.ok(out.includes('<span>after</span>'), 'markup after the iframe survives');
+  const after = await renderToString(
+    html`<div><iframe>fallback</iframe><comment-probe></comment-probe></div>`
+  );
+  assert.ok(after.includes('RENDERED'), 'scanning resumes after the iframe closes');
 });
 
 test('a component inside noscript still renders', async () => {
@@ -286,6 +299,10 @@ test('the other text-only elements are text too', async () => {
     );
     assert.ok(!out.includes('RENDERED'), `a component tag inside <${tag}> does not render`);
     assert.ok(out.includes('<span>after</span>'), `markup after <${tag}> survives`);
+    const after = await renderToString(
+      html`<div>${unsafeHTML(`<${tag}>text</${tag}>`)}<comment-probe></comment-probe></div>`
+    );
+    assert.ok(after.includes('RENDERED'), `scanning resumes after <${tag}> closes`);
   }
 });
 
@@ -319,6 +336,24 @@ test('a comment AFTER a real suspense boundary is still mapped correctly', async
   assert.ok(out.includes('<span>after</span>'), 'markup after it survives');
 });
 
+test('a commented-out boundary consumes nothing from the streaming context', async () => {
+  // The blocking path is what plain renderToString exercises, so the serious
+  // half went untested: under streaming a commented boundary would consume an
+  // id, queue a pending chunk, and emit a swap script targeting an element that
+  // exists only inside a comment, so it could never resolve and the fallback
+  // would sit there forever. Assert the context is untouched.
+  const ctx = { pending: [], nextId: 1, usedComponents: new Set() };
+  const out = await renderToString(
+    html`<div><!-- <webjs-suspense data-webjs-fallback="x"><comment-probe></comment-probe></webjs-suspense> --><span>after</span></div>`,
+    { ssr: true, suspenseCtx: ctx },
+  );
+  assert.equal(ctx.nextId, 1, 'no boundary id was consumed');
+  assert.equal(ctx.pending.length, 0, 'nothing was queued to stream');
+  assert.equal(ctx.usedComponents.size, 0, 'no component module was marked used');
+  assert.ok(!out.includes('data-webjs-resolve'), 'no swap template was emitted');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the comment survives');
+});
+
 test('a short-form comment does not swallow the slotted children after it', async () => {
   // Pins the partition scanner sharing endOfComment. With a bare indexOf('-->')
   // it runs past a `<!-->` or `--!>` and eats the children, so a slot="head"
diff --git a/test/bun/comment-not-an-element.mjs b/test/bun/comment-not-an-element.mjs
index 14526cc3f..14b9c765d 100644
--- a/test/bun/comment-not-an-element.mjs
+++ b/test/bun/comment-not-an-element.mjs
@@ -70,6 +70,17 @@ assert.equal(await rendered(html`<div><textarea><!-- hi</textarea><bun-probe></b
   'RCDATA content does not open a comment');
 assert.equal(await rendered(html`<div><script-shaped></script-shaped><bun-probe></bun-probe></div>`), true,
   'a component whose name starts with a raw-text tag name is not treated as one');
+// The END of each text-only skip, which is the boundary a range-arithmetic
+// divergence would move. An inert range never deletes text, so only a real
+// component AFTER the element proves scanning resumed on this runtime.
+assert.equal(await rendered(html`<div><style>.a{color:red}</style><bun-probe></bun-probe></div>`), true,
+  'scanning resumes after a style closes');
+assert.equal(await rendered(html`<div><script>var a=1;</script><bun-probe></bun-probe></div>`), true,
+  'scanning resumes after a script closes');
+assert.equal(await rendered(html`<div><iframe>fallback</iframe><bun-probe></bun-probe></div>`), true,
+  'scanning resumes after an iframe closes');
+assert.equal(await rendered(html`<div><noscript><bun-probe></bun-probe></noscript></div>`), true,
+  'noscript content is markup, not text');
 
 // Content preservation: the damage mode that made this worth fixing.
 const out = await renderToString(

From a46a6bd6e688f77774d9be99c90818a1655e4c6e Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 21:25:13 +0530
Subject: [PATCH 11/18] fix(core): follow the spec on = and self-closing, pin
 six more guards

Two new divergences, both the silent-vanish class.

A doubled `=` (`<a title==">`) re-opened the unbalanced-quote hole from a
different door. Per spec the character after `=` is reconsumed in
attribute-value-unquoted state, so that quote is an ordinary value
character and the tag ends at the first `>`. Keying off "previous
character was `=`" opened a value there instead, leaving an odd quote
count that ran the scan to EOF. Now a flag set by `=` and cleared by the
first non-space character after it, which is what the spec describes.
Not reachable through interpolation, since the renderer quotes holes and
escapes `"`, but reachable through unsafeHTML or third-party markup.

Self-closing text-only tags were not handled at all, and this one is a
failure this branch introduced rather than inherited. In SVG and MathML
foreign content `<title/>` genuinely closes, so there is no `</title` to
find, the range ran to EOF, and every component in the rest of the
document went inert. Honouring `/>` costs only malformed HTML (`<style/>`,
already broken authoring) and errs toward components rendering.

Six guards also had tests that could not fail on them. The partition one
is the instructive case: its fixture used `<!-->`, which CONTAINS `-->`,
so a bare indexOf found the identical end. `--!>` is the discriminating
form. Same for the `<!--->` branch, the close-tag boundary lookahead, and
the plaintext special case, none of which any fixture reached. All six now
red when reverted alone.
---
 packages/core/src/render-server.js            | 32 +++++++++---
 .../ssr-comment-not-an-element.test.js        | 51 ++++++++++++++++++-
 2 files changed, 74 insertions(+), 9 deletions(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index 4bb42f99c..a9d938ebf 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -527,16 +527,25 @@ function inertRanges(html) {
     // closes, the stray `'` is just an attribute-name character.
     let p = lt + 1;
     let quote = '';
-    let prev = '';
+    // `expectValue` is set by `=` and cleared by the first non-whitespace
+    // character after it. Only THAT character can open a quoted value, which is
+    // what the spec does: before-attribute-value reconsumes anything else in
+    // attribute-value-unquoted state. Keying off "the previous character was
+    // `=`" instead re-opens the hole on `<a title==">`, where the `"` is an
+    // ordinary value character; an odd quote count then ran the scan to EOF and
+    // returned one giant inert range, silently disabling this whole fix for the
+    // rest of the page.
+    let expectValue = false;
+    let selfClosing = false;
     while (p < n) {
       const c = html[p];
+      const isSpace = c === ' ' || c === '\t' || c === '\n' || c === '\r' || c === '\f';
       if (quote) { if (c === quote) quote = ''; }
-      else if ((c === '"' || c === "'") && prev === '=') quote = c;
-      else if (c === '>') { p += 1; break; }
-      // Char compare rather than a regex: this runs per byte of every tag, and
-      // on a Tailwind-default page most bytes ARE tag interior (long class
-      // attributes), so a per-character `RegExp` test dominated the scan cost.
-      if (c !== ' ' && c !== '\t' && c !== '\n' && c !== '\r' && c !== '\f') prev = c;
+      else if (expectValue && !isSpace) {
+        if (c === '"' || c === "'") quote = c;
+        expectValue = false;
+      } else if (c === '>') { selfClosing = html[p - 1] === '/'; p += 1; break; }
+      else if (c === '=') expectValue = true;
       p += 1;
     }
     // The tag's interior is not markup either. A component tag written inside
@@ -548,7 +557,14 @@ function inertRanges(html) {
     i = p;
     const tag = name[1].toLowerCase();
     const isClose = html[lt + 1] === '/';
-    if (!isClose && isTextOnlyTag(tag)) {
+    // A self-closing start tag has no content to skip. In HTML the `/` is
+    // ignored, but in SVG and MathML foreign content it genuinely closes the
+    // element, and `<svg><title/></svg>` otherwise finds no `</title`, runs the
+    // range to EOF, and makes every component in the rest of the document
+    // inert. Honouring `/>` costs only the malformed-HTML case (`<style/>`,
+    // already broken authoring) and fails in the direction where components
+    // keep rendering rather than silently vanishing.
+    if (!isClose && !selfClosing && isTextOnlyTag(tag)) {
       // Everything up to the matching close tag is text, not markup.
       // `<plaintext>` has no end tag at all: the rest of the document is text.
       const close = tag === 'plaintext'
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index d9b64bf9a..405d8d0e8 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -315,6 +315,53 @@ test('plaintext runs to the end of the document', async () => {
   assert.ok(!out.includes('RENDERED'), 'nothing after plaintext is instantiated');
 });
 
+test('the <!---> short form closes like a browser closes it', async () => {
+  // comment-start-dash + `>`. Distinct from `<!-->` and separately unpinned:
+  // without its branch the comment never ends and the component vanishes.
+  const out = await renderToString(html`<div><!---><comment-probe></comment-probe></div>`);
+  assert.ok(out.includes('RENDERED'), '<!---> is a complete empty comment');
+});
+
+test('a doubled = does not open a quoted value', async () => {
+  // Per spec the character after `=` is reconsumed in attribute-value-unquoted
+  // state, so in `title==">` the quote is an ordinary value character and the
+  // tag ends at the first `>`. Treating it as a delimiter leaves an odd quote
+  // count, runs the scan to EOF, and silently disables the fix for the rest of
+  // the page. Reachable through unsafeHTML or third-party markup.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<a title==">go</a>')}<comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'the component after the doubled = still renders');
+});
+
+test('a self-closed text-only tag does not swallow the document', async () => {
+  // In SVG and MathML foreign content a self-closing tag genuinely closes, so
+  // `<svg><title/></svg>` has no `</title` to find. Running the range to EOF
+  // there makes every component in the rest of the document inert.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<svg><title/></svg>')}<comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'a component after a self-closed title still renders');
+});
+
+test('a close tag is matched on a tag boundary, not a prefix', async () => {
+  // `</styleguide>` is not `</style>`. Without the lookahead the style content
+  // ends early and the component inside it is instantiated.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<style>/* see </styleguide> */ <comment-probe></comment-probe></style>')}<span>after</span></div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'a prefix close tag does not end the style');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the style survives');
+});
+
+test('a literal </plaintext> does not resume scanning', async () => {
+  // plaintext has no end tag: a browser reads `</plaintext>` as more text.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<plaintext>x</plaintext><comment-probe></comment-probe>')}</div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'nothing after plaintext is instantiated, close tag or not');
+});
+
 test('a markup declaration does not expose the markup after it', async () => {
   // `<![CDATA[ ... ]]>` and `<!x ...>` are bogus comments that run to the next
   // `>`. Without that branch the bytes inside are scanned as markup.
@@ -359,7 +406,9 @@ test('a short-form comment does not swallow the slotted children after it', asyn
   // it runs past a `<!-->` or `--!>` and eats the children, so a slot="head"
   // child is silently routed into the default slot.
   const out = await renderToString(
-    html`<slot-shell><!--><b slot="head">HEAD</b><i>BODY</i></slot-shell>`
+    // `--!>` is the discriminating form: `<!-->` happens to contain `-->`, so a
+    // bare indexOf finds the same end and the test could not fail.
+    html`<slot-shell><!-- note --!><b slot="head">HEAD</b><i>BODY</i></slot-shell>`
   );
   assert.ok(out.includes('HEAD'), 'the named-slot child is still projected');
   assert.ok(!out.includes('NO-HEAD'), 'the named slot did not fall back');

From 223f78ce0a07938e29936c86ada238780e42a9f8 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 21:36:06 +0530
Subject: [PATCH 12/18] fix(core): give unquoted attribute values their own
 state

Two regressions from the previous commit, both found by review, both the
destructive direction.

`<a href=>` is a missing-value parse error and the `>` still ends the tag.
My expectValue branch sat above the `>` check, so it ate the tag end and
the scan ran to the NEXT `>`. Effects: the component after it stopped
rendering, and a following <style> never armed its skip, so a tag inside
the style was instantiated and swallowed the rest of the document. The
`>` check now comes first, which is also where the spec puts it.

`selfClosing = html[p - 1] === '/'` misread a `/` that ends an UNQUOTED
value, so `<iframe src=/embed/x/>` looked self-closing, the text-only skip
was suppressed, and the tag inside the iframe was instantiated. Per spec
`/` is an ordinary character there. The comment I wrote justified a false
NEGATIVE on `<style/>`; this was a false POSITIVE on markup that is
perfectly normal, which is not the same trade at all.

Both come from the same missing piece: unquoted values had no state of
their own. They have one now, and it is what makes both `>` and `/`
behave correctly from inside a value.

Also pins the whitespace skip between `=` and a quoted value, which no
fixture reached: without it `title= "a > b <probe> c"` ends the tag at the
`>` inside the value and resumes scanning mid-attribute.
---
 packages/core/src/render-server.js            | 33 ++++++++++++---
 .../ssr-comment-not-an-element.test.js        | 40 +++++++++++++++++++
 2 files changed, 67 insertions(+), 6 deletions(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index a9d938ebf..f09fcf0e1 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -536,16 +536,37 @@ function inertRanges(html) {
     // returned one giant inert range, silently disabling this whole fix for the
     // rest of the page.
     let expectValue = false;
+    // Unquoted values need their own state for two reasons the spec spells out
+    // and a simpler scan gets wrong: `>` ends the tag from here (so `attr=>` is
+    // a missing value, not a value of `>`), and `/` is an ordinary value
+    // character, so an unquoted URL ending in `/` is NOT a self-closing solidus.
+    let inUnquoted = false;
     let selfClosing = false;
     while (p < n) {
       const c = html[p];
       const isSpace = c === ' ' || c === '\t' || c === '\n' || c === '\r' || c === '\f';
-      if (quote) { if (c === quote) quote = ''; }
-      else if (expectValue && !isSpace) {
-        if (c === '"' || c === "'") quote = c;
-        expectValue = false;
-      } else if (c === '>') { selfClosing = html[p - 1] === '/'; p += 1; break; }
-      else if (c === '=') expectValue = true;
+      if (quote) {
+        if (c === quote) quote = '';
+      } else if (c === '>') {
+        // Checked before the value branches: a `>` arriving where a value was
+        // expected terminates the tag (`<a href=>`). Consuming it as a value
+        // character ran the scan on to the NEXT `>`, which swallowed the real
+        // tag end and re-armed the original bug for what followed.
+        selfClosing = !inUnquoted && html[p - 1] === '/';
+        p += 1;
+        break;
+      } else if (expectValue) {
+        // The first non-whitespace character after `=` decides the value form.
+        if (!isSpace) {
+          if (c === '"' || c === "'") quote = c;
+          else inUnquoted = true;
+          expectValue = false;
+        }
+      } else if (inUnquoted) {
+        if (isSpace) inUnquoted = false;
+      } else if (c === '=') {
+        expectValue = true;
+      }
       p += 1;
     }
     // The tag's interior is not markup either. A component tag written inside
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index 405d8d0e8..ff8bbcaab 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -334,6 +334,46 @@ test('a doubled = does not open a quoted value', async () => {
   assert.ok(out.includes('RENDERED'), 'the component after the doubled = still renders');
 });
 
+test('a missing attribute value does not swallow the tag end', async () => {
+  // `<a href=>` is a missing-value parse error and the `>` still ends the tag.
+  // Consuming it as a value character runs the scan to the NEXT `>`, which eats
+  // the real tag end: the component after it stops rendering, and a following
+  // <style> never arms its skip, so a tag inside the style is instantiated.
+  const live = await renderToString(
+    html`<div>${unsafeHTML('<a href=></a>')}<comment-probe></comment-probe></div>`
+  );
+  assert.ok(live.includes('RENDERED'), 'the component after a valueless attribute renders');
+
+  const styled = await renderToString(
+    html`<div>${unsafeHTML('<a href=></a><style>/* <comment-probe> */</style><span>after</span>')}</div>`
+  );
+  assert.ok(!styled.includes('RENDERED'), 'the following style still skips its content');
+  assert.ok(styled.includes('<span>after</span>'), 'markup after the style survives');
+});
+
+test('a slash ending an unquoted value is not a self-closing solidus', async () => {
+  // Per spec `/` is an ordinary character inside an unquoted value, so
+  // `<iframe src=/embed/x/>` is NOT self-closing. Reading it as one suppresses
+  // the text-only skip and instantiates whatever is inside, which is the
+  // destructive direction. `src=https://host/embed/` is a realistic literal.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<iframe src=/embed/x/>see <comment-probe> here</iframe><span>after</span>')}</div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'the iframe still holds text, not markup');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the iframe survives');
+});
+
+test('whitespace between = and a quoted value still opens the value', async () => {
+  // `title= "..."` is ordinary. If the space is not skipped while waiting for
+  // the value, the quote never opens, the tag ends at the first `>` INSIDE the
+  // value, and scanning resumes in the middle of an attribute.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<div title= "a > b <comment-probe> c"></div>')}<span>after</span></div>`
+  );
+  assert.ok(!out.includes('RENDERED'), 'the component named inside the value stays inert');
+  assert.ok(out.includes('<span>after</span>'), 'markup after it survives');
+});
+
 test('a self-closed text-only tag does not swallow the document', async () => {
   // In SVG and MathML foreign content a self-closing tag genuinely closes, so
   // `<svg><title/></svg>` has no `</title` to find. Running the range to EOF

From 66d64bcf65abca41c271df8125a5cf076833097b Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 22:12:44 +0530
Subject: [PATCH 13/18] fix(core): respect comments in element nesting and
 script double-escape

Closes out the two deferred halves of the family in this same PR rather
than leaving them as follow-ups.

findClosingTagInString kept a nesting ledger that counted every same-name
tag, so a commented open tag inflated the depth forever and a commented
close tag ended the element at the comment, truncating the authored
children mid-comment and leaving an unterminated `<!--` that commented
out the real close tags in the browser. It now consults the same inert
ranges as the element walk, so a tag inside a comment, raw text, RCDATA,
or an attribute value counts for neither side. Callers that already
computed the ranges for the exact string pass them; the two that operate
on shifted or private strings compute internally.

Script data gets the double-escape rule: `<!--` followed by `<script`
means the next `</script>` is text and the element ends at the one after,
which is what the legacy comment-wrapped inline script produces. A lone
`<!--` with no inner script tag still closes at the first `</script>`,
same as a browser.

Both counterfactualled: dropping the range consult reds the boundary
tests, and disabling the double-escape state reds the script test while
the ordinary-script tests hold. Bun parity script covers both on node
26.1.0 and bun 1.3.14. The partial-swap e2e fails in this worktree
identically with main's render-server (environmental, spawn-based); CI's
E2E job is the check of record and runs on this push.
---
 .agents/skills/webjs/references/components.md |  2 +-
 .../ssr-comment-not-an-element.test.js        | 48 +++++++++++++++++++
 test/bun/comment-not-an-element.mjs           | 11 +++++
 3 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/.agents/skills/webjs/references/components.md b/.agents/skills/webjs/references/components.md
index adbab5595..f7b4d5e6e 100644
--- a/.agents/skills/webjs/references/components.md
+++ b/.agents/skills/webjs/references/components.md
@@ -124,7 +124,7 @@ The full `<slot>` surface works in light DOM with shadow-DOM parity; migrating m
 
 Two elements are deliberately excluded, and the second matters more. `<template>` content IS parsed and legitimately carries components, which is what Declarative Shadow DOM and streamed swaps rely on. `<noscript>` content is also parsed, because a browser with scripting disabled reads it as markup, and that is the case a progressive-enhancement framework exists to serve, so components inside `<noscript>` render normally.
 
-Two gaps remain. Tracked in #1133: element NESTING is still counted without regard for comments, so a comment that contains an opening or closing tag of the element it sits inside (`<my-card>kid<!-- <my-card> --></my-card>`) still mis-detects where that element ends and shuffles the surrounding markup. Until that lands, avoid writing a component's own tag, open or close, in a comment inside that component. Tracked in #1134: a `<script>` body that contains `<!--` followed by `<script` enters the parser's double-escaped state, where the next `</script>` does not close the element, and WebJs ends the script content there anyway. It needs the legacy comment-wrapped inline script pattern to trigger.
+Element nesting respects comments too: a comment holding the open or close tag of the element it sits inside (`<my-card>kid<!-- </my-card> --></my-card>`) rides along as content, and the element still ends at its real close tag. Script bodies follow the parser's double-escape rule, so the legacy `<!-- <script>... -->` wrapper pattern stays text to its true end.
 
 ```ts
 class MyCard extends WebComponent {
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index ff8bbcaab..462742008 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -454,6 +454,54 @@ test('a short-form comment does not swallow the slotted children after it', asyn
   assert.ok(!out.includes('NO-HEAD'), 'the named slot did not fall back');
 });
 
+// #1133: element boundaries. The depth ledger in findClosingTagInString must
+// not count a tag inside a comment for EITHER side, or the element's end is
+// mis-detected and the surrounding markup shuffles.
+
+test('a commented close tag is not the element end', async () => {
+  const out = await renderToString(html`<slot-shell>kid<!-- </slot-shell> --></slot-shell><span>ok</span>`);
+  // The whole comment stays inside the projected children, the real close tag
+  // still closes, and the trailing span stays OUTSIDE the component.
+  assert.ok(out.includes('kid<!-- </slot-shell> -->'), 'the comment rides the children intact');
+  assert.ok(/<\/slot-shell><span>ok<\/span>/.test(out), 'the span lands after the real close');
+});
+
+test('a commented open tag does not inflate the nesting depth', async () => {
+  const out = await renderToString(html`<slot-shell>kid<!-- <slot-shell> --></slot-shell><span>ok</span>`);
+  assert.ok(/<\/slot-shell><span>ok<\/span>/.test(out), 'depth returns to zero at the real close');
+});
+
+test('a commented slot close tag does not truncate the fallback', async () => {
+  const out = await renderToString(html`<slot-in-comment><b>kid</b></slot-in-comment>`);
+  assert.ok(out.includes('<b>kid</b>'), 'children still project');
+  // And a fallback that documents its own close tag in a comment:
+  const out2 = await renderToString(html`<slot-shell></slot-shell>`);
+  assert.ok(out2.includes('NO-HEAD'), 'the named fallback renders when nothing is slotted');
+});
+
+// #1134: script data is not plain raw text. `<!--` + `<script` enters the
+// double-escaped state, where `</script>` is TEXT and the element ends at the
+// NEXT one. The legacy comment-wrapped inline script produces exactly this.
+
+test('a double-escaped script body stays text to its real end', async () => {
+  const out = await renderToString(html`<div><script type="text/plain"><!-- <script> </script> <comment-probe></comment-probe> --></script><span>after</span></div>`);
+  assert.ok(!out.includes('RENDERED'), 'the tag inside the double-escaped body is text');
+  assert.ok(out.includes('<span>after</span>'), 'markup after the script survives');
+});
+
+test('an ordinary script still ends at its first close tag', async () => {
+  const out = await renderToString(
+    html`<div><script>var a = 1;</script><comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'scanning resumes at the first </script> when not escaped');
+  // And an escaped-but-not-double-escaped body (just a <!--, no inner <script)
+  // also ends at its first close tag, which is what a browser does.
+  const esc = await renderToString(
+    html`<div><script>var a = "<!--";</script><comment-probe></comment-probe></div>`
+  );
+  assert.ok(esc.includes('RENDERED'), 'a lone <!-- in a script does not defer the close');
+});
+
 test('the client router boundary comments do not hide the components between them', async () => {
   // The load-bearing case (#1015, #1114). SSR wraps each layout's children in
   // KEYED boundary comment PAIRS, and the router's scan is strict: a mispaired
diff --git a/test/bun/comment-not-an-element.mjs b/test/bun/comment-not-an-element.mjs
index 14b9c765d..5033b5f31 100644
--- a/test/bun/comment-not-an-element.mjs
+++ b/test/bun/comment-not-an-element.mjs
@@ -82,6 +82,17 @@ assert.equal(await rendered(html`<div><iframe>fallback</iframe><bun-probe></bun-
 assert.equal(await rendered(html`<div><noscript><bun-probe></bun-probe></noscript></div>`), true,
   'noscript content is markup, not text');
 
+// Element boundaries (#1133): a commented tag counts for neither side of the
+// nesting ledger, so the element still ends at its REAL close tag.
+{
+  const out = await renderToString(html`<div><!-- </div> --><bun-probe></bun-probe></div>`);
+  assert.ok(out.includes('<b>PROBE</b>'), 'a commented close tag does not end the element early');
+}
+// Script data double-escape (#1134): <!-- + <script defers the close to the
+// NEXT </script>, so the tag between them is text on both runtimes.
+assert.equal(await rendered(html`<div><script type="text/plain"><!-- <script> </script> <bun-probe></bun-probe> --></script></div>`), false,
+  'a double-escaped script body is text to its real end');
+
 // Content preservation: the damage mode that made this worth fixing.
 const out = await renderToString(
   html`<div><!-- see <bun-probe> here --><span>after</span></div>`

From 93a42763560c392ba8ef4613b72af2e1c888d248 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 22:16:34 +0530
Subject: [PATCH 14/18] fix(core): restore the nesting and double-escape source
 dropped by a bad revert

The previous commit was supposed to carry these render-server changes and
carried only their tests: a `git checkout HEAD --` used to restore a
baseline ran BEFORE the fixes were committed, so it silently reverted
them, and "3 files changed" on a commit meant to touch four was the tell
I missed. This is the exact counterfactual trap the workflow documents
(commit first, then revert through git), hit from a baseline comparison
instead of a counterfactual. The two new tests going red is what caught
it, which is the system working.
---
 packages/core/src/render-server.js | 106 +++++++++++++++++++++++++----
 1 file changed, 93 insertions(+), 13 deletions(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index f09fcf0e1..9a24741d5 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -475,6 +475,40 @@ function endOfComment(html, start) {
  * @param {string} html
  * @returns {[number, number][]} ascending, non-overlapping `[start, end)` pairs
  */
+/**
+ * Index of the `</script` that really closes a `<script>` whose content starts
+ * at `from`, or -1 when unterminated (#1134).
+ *
+ * Script data is not plain raw text: once the content contains `<!--` followed
+ * by `<script`, the tokenizer is in the script-data-double-escaped state, where
+ * a `</script>` is TEXT (it only steps back to the escaped state) and the
+ * element ends at the NEXT `</script>`. The legacy comment-wrapped inline
+ * script that document.writes a script tag is the pattern that produces this.
+ * Stopping at the first `</script>` there re-opened the original #1128 bug in
+ * the one element the scanner most explicitly claims to handle.
+ *
+ * @param {string} html
+ * @param {number} from  index just past the opening tag's `>`
+ * @returns {number}
+ */
+function endOfScriptContent(html, from) {
+  const re = /<!--|-->|<\/script(?=[\s/>])|<script(?=[\s/>])/gi;
+  re.lastIndex = from;
+  let escaped = false;
+  let dbl = false;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const t = m[0];
+    if (t === '<!--') { if (!escaped) escaped = true; }
+    else if (t === '-->') { escaped = false; dbl = false; }
+    else if (t[1] === '/') {
+      if (dbl) dbl = false;
+      else return m.index;
+    } else if (escaped) dbl = true;
+  }
+  return -1;
+}
+
 function inertRanges(html) {
   /** @type {[number, number][]} */
   const ranges = [];
@@ -588,10 +622,19 @@ function inertRanges(html) {
     if (!isClose && !selfClosing && isTextOnlyTag(tag)) {
       // Everything up to the matching close tag is text, not markup.
       // `<plaintext>` has no end tag at all: the rest of the document is text.
-      const close = tag === 'plaintext'
-        ? null
-        : new RegExp(`</${tag}(?=[\\s/>])`, 'i').exec(html.slice(p));
-      const contentEnd = close ? p + close.index : n;
+      let contentEnd;
+      if (tag === 'plaintext') {
+        // `<plaintext>` has no end tag at all: the rest of the document is text.
+        contentEnd = n;
+      } else if (tag === 'script') {
+        // Script data has the double-escaped state (#1134), so its real end is
+        // not necessarily the first `</script`.
+        const end = endOfScriptContent(html, p);
+        contentEnd = end === -1 ? n : end;
+      } else {
+        const close = new RegExp(`</${tag}(?=[\\s/>])`, 'i').exec(html.slice(p));
+        contentEnd = close ? p + close.index : n;
+      }
       if (contentEnd > p) ranges.push([p, contentEnd]);
       i = contentEnd;
     }
@@ -617,6 +660,24 @@ function inertRanges(html) {
  * @param {[number, number][]} ranges
  * @returns {(index: number) => boolean}
  */
+/**
+ * Random-access membership test over ascending, non-overlapping ranges, for
+ * callers whose queries are NOT monotonic (findClosingTagInString resets its
+ * regex cursors backward while pairing opens with closes). O(ranges) per call;
+ * monotonic callers use `inertAt` below instead.
+ *
+ * @param {[number, number][]} ranges
+ * @param {number} index
+ * @returns {boolean}
+ */
+function inRanges(ranges, index) {
+  for (const [start, end] of ranges) {
+    if (start > index) return false;
+    if (index < end) return true;
+  }
+  return false;
+}
+
 function inertAt(ranges) {
   let cursor = 0;
   return (index) => {
@@ -664,7 +725,8 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
   const edits = [];
   // A tag name inside a comment, a script, a style, RCDATA, or another tag's
   // attribute value is text, not an element (#1128).
-  const isInert = inertAt(inertRanges(html));
+  const inert = inertRanges(html);
+  const isInert = inertAt(inert);
   for (const m of html.matchAll(pattern)) {
     const [match, tag, attrs, selfClose] = m;
     const Cls = lookup(tag);
@@ -715,7 +777,7 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
       let closeEnd = m.index + match.length;
       if (!selfClose) {
         const innerStart = m.index + match.length;
-        const closeIdx = findClosingTagInString(html, innerStart, tag);
+        const closeIdx = findClosingTagInString(html, innerStart, tag, inert);
         if (closeIdx !== -1) {
           authoredInner = html.slice(innerStart, closeIdx);
           const closeRe = new RegExp(`</${escapeRegex(tag)}\\s*>`, 'i');
@@ -863,7 +925,7 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
       let closeEnd = m.index + match.length;
       if (!selfClose) {
         const innerStart = m.index + match.length;
-        const closeIdx = findClosingTagInString(html, innerStart, tag);
+        const closeIdx = findClosingTagInString(html, innerStart, tag, inert);
         if (closeIdx !== -1) {
           const closeRe = new RegExp(`</${escapeRegex(tag)}\\s*>`, 'i');
           const cm = closeRe.exec(html.slice(closeIdx));
@@ -980,7 +1042,8 @@ async function processSuspenseElements(html, ctx, ancestors = [], dev) {
   // fetches run and the swap script targets an id that only exists inside a
   // comment, so it can never resolve. Ranges are computed against the FULL
   // input once, and `consumed` maps the shrinking `rest` back onto it.
-  const isInert = inertAt(inertRanges(html));
+  const inert = inertRanges(html);
+  const isInert = inertAt(inert);
   let consumed = 0;
   let result = '';
   let rest = html;
@@ -1045,18 +1108,34 @@ async function processSuspenseElements(html, ctx, ancestors = [], dev) {
  * @param {string} tagName
  * @returns {number}
  */
-function findClosingTagInString(html, fromIndex, tagName) {
+function findClosingTagInString(html, fromIndex, tagName, inert) {
   const esc = escapeRegex(tagName);
   // Match same-name opening tags. Followed by a name-boundary character
   // so we don't accept <table> as opening <tab>.
   const openRe = new RegExp(`<${esc}(?:[\\s>/])`, 'gi');
   const closeRe = new RegExp(`</${esc}\\s*>`, 'gi');
+  // A tag inside a comment, raw text, RCDATA, or an attribute value is text
+  // and must count for NEITHER side of the depth ledger (#1133). Counting a
+  // commented `<my-card>` as a nested open meant depth never returned to zero,
+  // and matching a commented `</my-card>` as the close truncated the authored
+  // children at the comment, so the projected content ended with an
+  // unterminated `<!--` that a browser read as commenting out the real close
+  // tags. Callers that already computed the ranges for this exact string pass
+  // them; a caller that did not gets them computed here.
+  const ranges = inert === undefined ? inertRanges(html) : inert;
+  const next = (re) => {
+    let m;
+    while ((m = re.exec(html)) !== null) {
+      if (ranges.length === 0 || !inRanges(ranges, m.index)) return m;
+    }
+    return null;
+  };
   openRe.lastIndex = fromIndex;
   closeRe.lastIndex = fromIndex;
   let depth = 1;
   while (depth > 0) {
-    const o = openRe.exec(html);
-    const c = closeRe.exec(html);
+    const o = next(openRe);
+    const c = next(closeRe);
     if (!c) return -1;
     if (o && o.index < c.index) {
       depth++;
@@ -1217,7 +1296,8 @@ function substituteSlotsInRender(rendered, partitioned, ownerTag) {
   // has no `</slot>`, so the fallback scan below swallows the rest of the
   // template, the component's REAL slot is never substituted, and the authored
   // children are dropped from the page entirely.
-  const isInert = inertAt(inertRanges(rendered));
+  const inert = inertRanges(rendered);
+  const isInert = inertAt(inert);
   let m;
   while ((m = slotRe.exec(rendered)) !== null) {
     if (isInert(m.index)) continue;
@@ -1235,7 +1315,7 @@ function substituteSlotsInRender(rendered, partitioned, ownerTag) {
       totalEnd = m.index + fullOpen.length;
     } else {
       const innerStart = m.index + fullOpen.length;
-      const closeIdx = findClosingTagInString(rendered, innerStart, 'slot');
+      const closeIdx = findClosingTagInString(rendered, innerStart, 'slot', inert);
       if (closeIdx === -1) {
         fallback = rendered.slice(innerStart);
         totalEnd = rendered.length;

From 33a48e85a511438b63dc3f3498eb81d110cca9d4 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 22:16:48 +0530
Subject: [PATCH 15/18] fix(core): router fetches revalidate so a cached page
 cannot hide a deploy

The client router reads x-webjs-build / x-webjs-src off its own fetches
to detect a deploy. Both fetch sites used the default HTTP cache mode, so
on a page served with a browser max-age the fetch could be satisfied
wholly from cache, replaying pre-deploy ids; the check then compared two
equally stale values and skipped the snapshot eviction, leaving a deploy
invisible for the freshness window plus one stale-while-revalidate
serving per URL. Observed in production on webjs.dev the day max-age went
from 0 to 60.

Both fetches now send cache: no-cache, which is revalidate, not bypass:
with the stable page ETags shipped alongside that header change, the
forced revalidation is answered with an empty 304, so soft navs stay
cheap while the ids stay live. Document navigations (new tab,
back/forward) still serve straight from disk within the window, which is
where the browser-cache win actually lives.

Browser test captures the exact RequestInit through the real click and
viewport-prefetch paths on Chromium, Firefox and WebKit; dropping either
cache option reds it. The website layout comment that documented this as
an accepted tradeoff now documents the resolution instead.
---
 .../references/client-router-and-streaming.md |   2 +-
 packages/core/src/router-client.js            |  16 ++-
 .../routing/browser/fetch-revalidates.test.js | 101 ++++++++++++++++++
 website/app/layout.ts                         |  12 +--
 4 files changed, 121 insertions(+), 10 deletions(-)
 create mode 100644 packages/core/test/routing/browser/fetch-revalidates.test.js

diff --git a/.agents/skills/webjs/references/client-router-and-streaming.md b/.agents/skills/webjs/references/client-router-and-streaming.md
index b15a5c97c..209adc979 100644
--- a/.agents/skills/webjs/references/client-router-and-streaming.md
+++ b/.agents/skills/webjs/references/client-router-and-streaming.md
@@ -78,7 +78,7 @@ document.addEventListener('webjs:navigation-fallback', (e) => {
 
 ## Link Prefetch
 
-Same-origin in-app links prefetch speculatively so a click resolves from a warm cache. On by default, no per-link opt-in needed. The default strategy is DEVICE-ADAPTIVE, because one strategy cannot serve both input modalities. On a hover-capable fine pointer the default is `intent` (warm on hover/focus after a ~100ms dwell). On touch the default is `viewport` (warm as links settle on-screen), because touch has no hover. Modality is detected with `matchMedia('(hover: hover) and (pointer: fine)')`, never a UA sniff.
+Same-origin in-app links prefetch speculatively so a click resolves from a warm cache. Router fetches (navigation and prefetch alike) are sent with `cache: 'no-cache'`, so a page cached in the browser with a `max-age` is revalidated rather than replayed: the deploy check reads `x-webjs-build` / `x-webjs-src` off these responses, and a cached response would hand it pre-deploy ids and hide a deploy for the whole freshness window (#1131). With a stable page ETag the revalidation is answered with a cheap 304, so the cost is a conditional round-trip, not a re-download. On by default, no per-link opt-in needed. The default strategy is DEVICE-ADAPTIVE, because one strategy cannot serve both input modalities. On a hover-capable fine pointer the default is `intent` (warm on hover/focus after a ~100ms dwell). On touch the default is `viewport` (warm as links settle on-screen), because touch has no hover. Modality is detected with `matchMedia('(hover: hover) and (pointer: fine)')`, never a UA sniff.
 
 Override per link with the `data-prefetch` attribute.
 
diff --git a/packages/core/src/router-client.js b/packages/core/src/router-client.js
index d5a2c94ea..29830cc1f 100644
--- a/packages/core/src/router-client.js
+++ b/packages/core/src/router-client.js
@@ -1674,7 +1674,16 @@ function prefetch(href) {
   const headers = { 'x-webjs-router': '1', 'x-webjs-prefetch': '1' };
   if (have) headers['x-webjs-have'] = have;
 
-  fetch(href, { method: 'GET', headers, credentials: 'same-origin' })
+  // `no-cache` (revalidate, NOT bypass) is load-bearing (#1131): the deploy
+  // check below reads x-webjs-build / x-webjs-src off this response, and a
+  // page served with a browser max-age would otherwise satisfy the fetch
+  // wholly from the HTTP cache, replaying pre-deploy ids. The check would then
+  // compare two equally stale values and skip the eviction, so a deploy stayed
+  // invisible for the whole freshness window plus one stale-while-revalidate
+  // serving per URL. With stable page ETags a forced revalidation is a
+  // conditional request answered 304, so the cost is a header round-trip, not
+  // a re-download.
+  fetch(href, { method: 'GET', headers, credentials: 'same-origin', cache: 'no-cache' })
     .then(async (resp) => {
       const ctype = resp.headers.get('content-type') || '';
       if (!/^text\/html\b/i.test(ctype)) return;
@@ -2155,7 +2164,10 @@ async function fetchAndApply(href, frameId, recordHistory, optimisticState, meth
     }
 
     /** @type {RequestInit} */
-    const init = { method, headers, credentials: 'same-origin' };
+    // `no-cache` for the same reason as the prefetch fetch (#1131): applySwap
+    // hard-reloads on a build change it can only see if these headers are
+    // live, not replayed from the HTTP cache.
+    const init = { method, headers, credentials: 'same-origin', cache: 'no-cache' };
     if (signal) init.signal = signal;
     if (body != null && method !== 'GET' && method !== 'HEAD') init.body = body;
 
diff --git a/packages/core/test/routing/browser/fetch-revalidates.test.js b/packages/core/test/routing/browser/fetch-revalidates.test.js
new file mode 100644
index 000000000..d79b18e05
--- /dev/null
+++ b/packages/core/test/routing/browser/fetch-revalidates.test.js
@@ -0,0 +1,101 @@
+/**
+ * Both router fetches must revalidate rather than trust the HTTP cache (#1131).
+ *
+ * The deploy check reads `x-webjs-build` / `x-webjs-src` off these responses.
+ * On a page served with a browser `max-age`, a default-cache fetch can be
+ * satisfied wholly from the HTTP cache, replaying pre-deploy ids; the check
+ * then compares two equally stale values and skips the snapshot eviction, so
+ * a deploy stays invisible for the freshness window plus one
+ * stale-while-revalidate serving per URL. `cache: 'no-cache'` forces a
+ * conditional request (with stable page ETags, a cheap 304), which keeps the
+ * ids live.
+ *
+ * Runs in a real browser because the assertion is on the exact RequestInit the
+ * router hands to fetch, captured through the real click and prefetch paths.
+ */
+import { enableClientRouter, disableClientRouter } from '../../../src/router-client.js';
+
+import { assert } from '../../../../../test/browser-assert.js';
+const tick = () => new Promise((r) => setTimeout(r, 0));
+async function settle() { for (let i = 0; i < 4; i++) await tick(); }
+
+suite('Client router: fetches revalidate instead of trusting the HTTP cache (#1131)', () => {
+  let container, origFetch, calls;
+
+  function setup() {
+    enableClientRouter();
+    container = document.createElement('div');
+    container.innerHTML =
+      '<header id="outer-chrome">CHROME</header>' +
+      '<!--wj:children:/:/-->' +
+        '<a id="nav-link" href="/somewhere">go</a>' +
+        '<span id="slot-content">ORIGINAL</span>' +
+      '<!--/wj:children:/-->';
+    document.body.appendChild(container);
+    origFetch = window.fetch;
+    calls = [];
+    window.fetch = (url, init) => {
+      calls.push({ url: String(url), init: init || {} });
+      // A JSON body drives the router into its in-place error recovery, so the
+      // test page never full-navigates away under the stub.
+      return Promise.resolve(new Response(JSON.stringify({ nope: true }), {
+        status: 500,
+        headers: { 'content-type': 'application/json', 'x-webjs-build': '' },
+      }));
+    };
+  }
+  function teardown() {
+    window.fetch = origFetch;
+    container.remove();
+    disableClientRouter();
+  }
+
+  test('a navigation fetch is sent with cache: no-cache', async () => {
+    setup();
+    try {
+      document.getElementById('nav-link').click();
+      await settle();
+      const nav = calls.find((c) => c.url.includes('/somewhere'));
+      assert.ok(nav, 'the click produced a router fetch');
+      assert.equal(nav.init.cache, 'no-cache',
+        'the navigation fetch must revalidate so the deploy check sees live build ids');
+    } finally {
+      teardown();
+    }
+  });
+
+  test('a prefetch fetch is sent with cache: no-cache', async () => {
+    const origIO = window.IntersectionObserver;
+    const ioInstances = [];
+    window.IntersectionObserver = class {
+      constructor(cb) { this.cb = cb; ioInstances.push(this); }
+      observe() {}
+      unobserve() {}
+      disconnect() {}
+      emit(el) { this.cb([{ target: el, isIntersecting: true }], this); }
+    };
+    disableClientRouter();
+    enableClientRouter();
+    setup();
+    try {
+      const link = document.createElement('a');
+      link.href = '/prefetched-page';
+      link.setAttribute('data-prefetch', 'viewport');
+      container.appendChild(link);
+      // Surface the link to the router's (stubbed) viewport observer and sit
+      // out the dwell gate.
+      document.dispatchEvent(new Event('DOMContentLoaded'));
+      await settle();
+      for (const io of ioInstances) io.emit(link);
+      await new Promise((r) => setTimeout(r, 400));
+      await settle();
+      const pf = calls.find((c) => c.url.includes('/prefetched-page'));
+      assert.ok(pf, 'the viewport dwell produced a prefetch fetch');
+      assert.equal(pf.init.cache, 'no-cache',
+        'the prefetch fetch must revalidate so the deploy check sees live build ids');
+    } finally {
+      window.IntersectionObserver = origIO;
+      teardown();
+    }
+  });
+});
diff --git a/website/app/layout.ts b/website/app/layout.ts
index 2e6c15340..7294f2e47 100644
--- a/website/app/layout.ts
+++ b/website/app/layout.ts
@@ -52,13 +52,11 @@ export function generateMetadata(ctx: { url: string }) {
     // when nothing had changed. 60s is the smallest value that yields real
     // browser cache hits (back/forward, repeat visits, a second tab) while
     // bounding how long a reader can hold pre-deploy HTML to one minute.
-    // Known tradeoff (#1131): the client router fetches with the default HTTP
-    // cache mode, so within that minute a prefetch or soft nav can be served
-    // wholly from cache, handing the router pre-deploy `x-webjs-build` /
-    // `x-webjs-src` headers. Its deploy check then compares two equally stale
-    // ids and skips the snapshot eviction. `max-age=0` avoided that by forcing
-    // a revalidation every time. Accepted here because the blast radius is one
-    // minute of slightly stale marketing copy, and a hard nav still corrects it.
+    // The client router revalidates its own fetches (#1131), so soft navs and
+    // prefetches always see live `x-webjs-build` ids and deploy detection is
+    // unaffected by this max-age; with stable page ETags the revalidation is a
+    // cheap 304. Document navigations (new tab, back/forward) still serve
+    // straight from disk within the window.
     cacheControl: 'public, max-age=60, s-maxage=600, stale-while-revalidate=86400',
     title: TITLE,
     description: DESCRIPTION,

From 8e50703353d19fe09b1ebd84a52df7432b1c7593 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 22:28:55 +0530
Subject: [PATCH 16/18] fix(core): keep suspense close-search in full-string
 state, script <!--> exit

Review of the absorbed fixes found two real gaps and a doc mess.

The suspense scanner's skip path re-slices its input just past a commented
boundary match, which can land MID-comment. The close-tag search for the
next real boundary then re-tokenized that suffix from a clean state, so a
text-only opener named later in the same comment (a <textarea> in prose)
read as a real unclosed element, everything to EOF went inert, and the
boundary swallowed its own close tag plus the trailing markup. The search
now receives the FULL-input ranges shifted into slice coordinates, so the
mid-comment truth survives the slice.

endOfScriptContent missed that the dash-dash state entered by <!-- exits
straight back to plain script data on >, so a lone "<!-->" in a script
armed the escape and a later "<script>" string deferred the close past
its real end, silently unrendering every component after the script.

The restore commit had also left two JSDoc blocks detached from their
functions and a comment duplicated; reattached.

The suspense test needed its assertions replaced once more: the swallowed
output CONTAINS the literal close-tag-then-span sequence, so the original
regex matched in the broken state too. The discriminators are the close
tag count (the failure synthesizes a duplicate) and the document ending
with </div> rather than the synthesized close. Both fixes red their test
when reverted alone.
---
 packages/core/src/render-server.js            | 131 ++++++++++--------
 .../ssr-comment-not-an-element.test.js        |  30 ++++
 2 files changed, 107 insertions(+), 54 deletions(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index 9a24741d5..838e25a72 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -434,6 +434,51 @@ function endOfComment(html, start) {
   return -1;
 }
 
+/**
+ * Index of the `</script` that really closes a `<script>` whose content starts
+ * at `from`, or -1 when unterminated (#1134).
+ *
+ * Script data is not plain raw text: once the content contains `<!--` followed
+ * by `<script`, the tokenizer is in the script-data-double-escaped state, where
+ * a `</script>` is TEXT (it only steps back to the escaped state) and the
+ * element ends at the NEXT `</script>`. The legacy comment-wrapped inline
+ * script that document.writes a script tag is the pattern that produces this.
+ * Stopping at the first `</script>` there re-opened the original #1128 bug in
+ * the one element the scanner most explicitly claims to handle.
+ *
+ * @param {string} html
+ * @param {number} from  index just past the opening tag's `>`
+ * @returns {number}
+ */
+function endOfScriptContent(html, from) {
+  const re = /<!--|-->|<\/script(?=[\s/>])|<script(?=[\s/>])/gi;
+  re.lastIndex = from;
+  let escaped = false;
+  let dbl = false;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const t = m[0];
+    if (t === '<!--') {
+      if (!escaped) {
+        // The dash-dash state entered by `<!--` exits straight back to plain
+        // script data on `>`, so `<!-->`, `<!--->`, and any run of dashes
+        // followed by `>` cancel the escape before it starts, and the element
+        // still ends at its first `</script>`.
+        let q = m.index + 4;
+        while (html[q] === '-') q += 1;
+        if (html[q] === '>') re.lastIndex = q + 1;
+        else escaped = true;
+      }
+    }
+    else if (t === '-->') { escaped = false; dbl = false; }
+    else if (t[1] === '/') {
+      if (dbl) dbl = false;
+      else return m.index;
+    } else if (escaped) dbl = true;
+  }
+  return -1;
+}
+
 /**
  * Byte ranges of `html` where a tag-shaped match is NOT an element (#1128).
  *
@@ -475,40 +520,6 @@ function endOfComment(html, start) {
  * @param {string} html
  * @returns {[number, number][]} ascending, non-overlapping `[start, end)` pairs
  */
-/**
- * Index of the `</script` that really closes a `<script>` whose content starts
- * at `from`, or -1 when unterminated (#1134).
- *
- * Script data is not plain raw text: once the content contains `<!--` followed
- * by `<script`, the tokenizer is in the script-data-double-escaped state, where
- * a `</script>` is TEXT (it only steps back to the escaped state) and the
- * element ends at the NEXT `</script>`. The legacy comment-wrapped inline
- * script that document.writes a script tag is the pattern that produces this.
- * Stopping at the first `</script>` there re-opened the original #1128 bug in
- * the one element the scanner most explicitly claims to handle.
- *
- * @param {string} html
- * @param {number} from  index just past the opening tag's `>`
- * @returns {number}
- */
-function endOfScriptContent(html, from) {
-  const re = /<!--|-->|<\/script(?=[\s/>])|<script(?=[\s/>])/gi;
-  re.lastIndex = from;
-  let escaped = false;
-  let dbl = false;
-  let m;
-  while ((m = re.exec(html)) !== null) {
-    const t = m[0];
-    if (t === '<!--') { if (!escaped) escaped = true; }
-    else if (t === '-->') { escaped = false; dbl = false; }
-    else if (t[1] === '/') {
-      if (dbl) dbl = false;
-      else return m.index;
-    } else if (escaped) dbl = true;
-  }
-  return -1;
-}
-
 function inertRanges(html) {
   /** @type {[number, number][]} */
   const ranges = [];
@@ -621,7 +632,6 @@ function inertRanges(html) {
     // keep rendering rather than silently vanishing.
     if (!isClose && !selfClosing && isTextOnlyTag(tag)) {
       // Everything up to the matching close tag is text, not markup.
-      // `<plaintext>` has no end tag at all: the rest of the document is text.
       let contentEnd;
       if (tag === 'plaintext') {
         // `<plaintext>` has no end tag at all: the rest of the document is text.
@@ -642,24 +652,6 @@ function inertRanges(html) {
   return ranges;
 }
 
-/**
- * A left-to-right membership test over ascending, non-overlapping ranges.
- *
- * Returns a function that answers "is this index inert?" and REMEMBERS how far
- * it has walked, so a caller scanning matches in increasing order pays O(ranges)
- * across the whole scan instead of O(ranges) per match. Restarting each time is
- * an O(tags x components) term, which is measurable on a large page: holding a
- * document at 40k tags and raising the component count adds hundreds of
- * milliseconds that the cursor removes.
- *
- * The cursor only ever moves forward, so callers MUST query in non-decreasing
- * index order. All three call sites do (`matchAll`, and the two loops that
- * consume their input left to right). A caller that needs random access should
- * scan `ranges` directly rather than reusing this.
- *
- * @param {[number, number][]} ranges
- * @returns {(index: number) => boolean}
- */
 /**
  * Random-access membership test over ascending, non-overlapping ranges, for
  * callers whose queries are NOT monotonic (findClosingTagInString resets its
@@ -678,6 +670,24 @@ function inRanges(ranges, index) {
   return false;
 }
 
+/**
+ * A left-to-right membership test over ascending, non-overlapping ranges.
+ *
+ * Returns a function that answers "is this index inert?" and REMEMBERS how far
+ * it has walked, so a caller scanning matches in increasing order pays O(ranges)
+ * across the whole scan instead of O(ranges) per match. Restarting each time is
+ * an O(tags x components) term, which is measurable on a large page: holding a
+ * document at 40k tags and raising the component count adds hundreds of
+ * milliseconds that the cursor removes.
+ *
+ * The cursor only ever moves forward, so callers MUST query in non-decreasing
+ * index order. All three call sites do (`matchAll`, and the two loops that
+ * consume their input left to right). A caller that needs random access should
+ * scan `ranges` directly rather than reusing this.
+ *
+ * @param {[number, number][]} ranges
+ * @returns {(index: number) => boolean}
+ */
 function inertAt(ranges) {
   let cursor = 0;
   return (index) => {
@@ -1069,7 +1079,20 @@ async function processSuspenseElements(html, ctx, ancestors = [], dev) {
     const fbMatch = /data-webjs-fallback="([^"]*)"/i.exec(attrs);
     const fallbackHtml = fbMatch ? unescapeAttr(fbMatch[1]) : '';
 
-    const closeIdx = findClosingTagInString(rest, openEnd, 'webjs-suspense');
+    // Pass the FULL-input ranges shifted into `rest` coordinates rather than
+    // letting the helper re-tokenize the suffix. `rest` can begin mid-comment
+    // or mid-raw-text after the skip path above, and a tokenizer restarted
+    // there is in the wrong state: a text-only opener named later in that same
+    // comment would read as a real element and mark everything to EOF inert,
+    // so the boundary's real close tag was skipped and the trailing markup
+    // folded into the boundary. The shifted view keeps the full-string truth,
+    // including a first range that starts before `rest` does.
+    const shifted = [];
+    for (const [s, e] of inert) {
+      if (e <= consumed) continue;
+      shifted.push([Math.max(0, s - consumed), e - consumed]);
+    }
+    const closeIdx = findClosingTagInString(rest, openEnd, 'webjs-suspense', shifted);
     let inner;
     let afterClose;
     if (closeIdx === -1) {
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index 462742008..2bc42304e 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -502,6 +502,36 @@ test('an ordinary script still ends at its first close tag', async () => {
   assert.ok(esc.includes('RENDERED'), 'a lone <!-- in a script does not defer the close');
 });
 
+test('a comment naming a boundary and a text-only tag does not derail a real boundary after it', async () => {
+  // The suspense scanner skips a commented boundary and re-slices its input
+  // just past the match, which can land MID-comment. The close-tag search for
+  // the next REAL boundary must therefore use ranges computed on the full
+  // input, not a re-tokenization of the suffix: restarted mid-comment, a
+  // text-only opener named later in that comment (here <textarea>) read as a
+  // real unclosed element, everything to EOF went inert, and the boundary
+  // swallowed its own close tag plus the trailing markup.
+  const out = await renderToString(html`<div><!-- a <webjs-suspense> demo uses <textarea> input --><webjs-suspense><comment-probe></comment-probe></webjs-suspense><span>after</span></div>`);
+  assert.ok(out.includes('RENDERED'), 'the real boundary renders its children');
+  // The discriminators, chosen so a swallowed close tag cannot fake a pass:
+  // the failure emits inner + a SYNTHESIZED close, so the tag count doubles
+  // and the document ends with the synthesized `</webjs-suspense>` instead of
+  // the real `</div>`.
+  assert.equal((out.match(/<\/webjs-suspense>/g) || []).length, 1,
+    'exactly one boundary close tag (no synthesized duplicate)');
+  assert.ok(out.endsWith('</div>'), 'the trailing markup stays outside the boundary');
+});
+
+test('the <!--> short form inside a script cancels the escape', async () => {
+  // The dash-dash state entered by <!-- exits straight back to plain script
+  // data on >, so a lone "<!-->" in a script does NOT arm the double-escape:
+  // even with a "<script>" string later in the body, the element ends at its
+  // first </script>, which is where a browser ends it.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<script>var x = "<!-->"; var y = "<script>";</script>')}<comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'the component after the script still renders');
+});
+
 test('the client router boundary comments do not hide the components between them', async () => {
   // The load-bearing case (#1015, #1114). SSR wraps each layout's children in
   // KEYED boundary comment PAIRS, and the router's scan is strict: a mispaired

From 0a5ac859d8640259056cfd7e78e1f333fb5818e9 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 22:39:03 +0530
Subject: [PATCH 17/18] fix(core): the script dash-dash exit clears the escape
 from every state

The <!--> exit was only honoured when entering fresh. The token's trailing
dashes reach the dash-dash state from the escaped and double-escaped
states too, and dash-dash exits to plain data on >, so inside an
already-escaped body the missed exit let a later "<script" string arm
the double-escape and move the element end past its real close, silently
unrendering every component after the script. Confirmed against parse5;
one unified branch now clears both flags, pinned by a revert-alone
counterfactual.
---
 packages/core/src/render-server.js            | 22 ++++++++++---------
 .../ssr-comment-not-an-element.test.js        | 12 ++++++++++
 2 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index 838e25a72..d4c5e81b5 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -459,16 +459,18 @@ function endOfScriptContent(html, from) {
   while ((m = re.exec(html)) !== null) {
     const t = m[0];
     if (t === '<!--') {
-      if (!escaped) {
-        // The dash-dash state entered by `<!--` exits straight back to plain
-        // script data on `>`, so `<!-->`, `<!--->`, and any run of dashes
-        // followed by `>` cancel the escape before it starts, and the element
-        // still ends at its first `</script>`.
-        let q = m.index + 4;
-        while (html[q] === '-') q += 1;
-        if (html[q] === '>') re.lastIndex = q + 1;
-        else escaped = true;
-      }
+      // The token's own trailing `--` puts the tokenizer in a dash-dash state
+      // REGARDLESS of what state it was in (`<!` are inert bytes in escaped and
+      // double-escaped states too), and every dash-dash state exits straight
+      // back to plain script data on `>`. So `<!-->`, `<!--->`, and any dash
+      // run followed by `>` clear BOTH flags: entering fresh it cancels the
+      // escape before it starts, and inside an escaped or double-escaped body
+      // it is the exit a browser honours, after which the element ends at the
+      // next `</script>`.
+      let q = m.index + 4;
+      while (html[q] === '-') q += 1;
+      if (html[q] === '>') { escaped = false; dbl = false; re.lastIndex = q + 1; }
+      else if (!escaped) escaped = true;
     }
     else if (t === '-->') { escaped = false; dbl = false; }
     else if (t[1] === '/') {
diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index 2bc42304e..bfca1fdf2 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -532,6 +532,18 @@ test('the <!--> short form inside a script cancels the escape', async () => {
   assert.ok(out.includes('RENDERED'), 'the component after the script still renders');
 });
 
+test('a <!--> exit inside an already-escaped script clears both escape flags', async () => {
+  // The token's trailing dashes reach the dash-dash state from EVERY script
+  // state, and dash-dash exits to plain data on `>`. Missing the exit when
+  // already escaped meant a later "<script" string armed the double-escape
+  // and the element end moved past its real close, silently unrendering every
+  // component after the script. A browser renders this probe.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<script>a<!--b<!--><script></script>')}<comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'the component after the script still renders');
+});
+
 test('the client router boundary comments do not hide the components between them', async () => {
   // The load-bearing case (#1015, #1114). SSR wraps each layout's children in
   // KEYED boundary comment PAIRS, and the router's scan is strict: a mispaired

From eb8aad69ad1e1d59f72a37e6bf0b7d905f71b11c Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Mon, 27 Jul 2026 22:48:49 +0530
Subject: [PATCH 18/18] test(core): pin the double-escape half of the dash-dash
 exit

The exit's dbl=false was load-bearing but unpinned: clearing only the
escaped flag survived every test, while a stale double-escape made the
real close tag read as a step-down and ran the element to EOF. The new
case reaches the exit with the double-escape armed and reds that mutant.
Review fuzzed the scanner itself against parse5 across 40k script bodies
with zero divergences, so this closes the last unpinned guard.
---
 .../test/rendering/ssr-comment-not-an-element.test.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/packages/core/test/rendering/ssr-comment-not-an-element.test.js b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
index bfca1fdf2..838d069da 100644
--- a/packages/core/test/rendering/ssr-comment-not-an-element.test.js
+++ b/packages/core/test/rendering/ssr-comment-not-an-element.test.js
@@ -544,6 +544,17 @@ test('a <!--> exit inside an already-escaped script clears both escape flags', a
   assert.ok(out.includes('RENDERED'), 'the component after the script still renders');
 });
 
+test('the dash-dash exit also steps down from the double-escaped state', async () => {
+  // Reaches the exit with the double-escape armed, which the case above never
+  // does: with only the escaped flag cleared, the stale double-escape flag
+  // makes the real </script> read as a step-down instead of the end, the
+  // element runs to EOF, and the component after it silently vanishes.
+  const out = await renderToString(
+    html`<div>${unsafeHTML('<script>a<!--<script>b<!--></script>')}<comment-probe></comment-probe></div>`
+  );
+  assert.ok(out.includes('RENDERED'), 'the component after the script still renders');
+});
+
 test('the client router boundary comments do not hide the components between them', async () => {
   // The load-bearing case (#1015, #1114). SSR wraps each layout's children in
   // KEYED boundary comment PAIRS, and the router's scan is strict: a mispaired