fix(core): stop SSR instantiating a component named inside a comment

.agents/skills/webjs/references/client-router-and-streaming.md

@@ -78,7 +78,7 @@ document.addEventListener('webjs:navigation-fallback', (e) => {
 
 ## Link Prefetch
 
-Same-origin in-app links prefetch speculatively so a click resolves from a warm cache. On by default, no per-link opt-in needed. The default strategy is DEVICE-ADAPTIVE, because one strategy cannot serve both input modalities. On a hover-capable fine pointer the default is `intent` (warm on hover/focus after a ~100ms dwell). On touch the default is `viewport` (warm as links settle on-screen), because touch has no hover. Modality is detected with `matchMedia('(hover: hover) and (pointer: fine)')`, never a UA sniff.
+Same-origin in-app links prefetch speculatively so a click resolves from a warm cache. Router fetches (navigation and prefetch alike) are sent with `cache: 'no-cache'`, so a page cached in the browser with a `max-age` is revalidated rather than replayed: the deploy check reads `x-webjs-build` / `x-webjs-src` off these responses, and a cached response would hand it pre-deploy ids and hide a deploy for the whole freshness window (#1131). With a stable page ETag the revalidation is answered with a cheap 304, so the cost is a conditional round-trip, not a re-download. On by default, no per-link opt-in needed. The default strategy is DEVICE-ADAPTIVE, because one strategy cannot serve both input modalities. On a hover-capable fine pointer the default is `intent` (warm on hover/focus after a ~100ms dwell). On touch the default is `viewport` (warm as links settle on-screen), because touch has no hover. Modality is detected with `matchMedia('(hover: hover) and (pointer: fine)')`, never a UA sniff.
 
 Override per link with the `data-prefetch` attribute.
 

.agents/skills/webjs/references/components.md

@@ -120,6 +120,12 @@ class Panel extends WebComponent({ label: String }) {
 
 The full `<slot>` surface works in light DOM with shadow-DOM parity; migrating modes never requires a template rewrite. A forwarded slot projects its content everywhere (client, SSR, hydration).
 
+**A tag name inside an HTML comment is not instantiated.** `<!-- <my-card> is the wrapper -->` documents the template and renders no component, the same as in a browser. That holds for component tags, `<slot>`, and `<webjs-suspense>`. It extends to attribute values and to every element whose content the HTML parser reads as text rather than markup: `<script>`, `<style>`, `<iframe>`, `<xmp>`, `<noembed>`, `<noframes>`, `<plaintext>`, `<textarea>`, `<title>`. (Before #1128 a commented tag was constructed as a real element and ate the rest of the comment along with the markup after it, so an ordinary explanatory comment could silently delete part of the page.)
+
+Two elements are deliberately excluded, and the second matters more. `<template>` content IS parsed and legitimately carries components, which is what Declarative Shadow DOM and streamed swaps rely on. `<noscript>` content is also parsed, because a browser with scripting disabled reads it as markup, and that is the case a progressive-enhancement framework exists to serve, so components inside `<noscript>` render normally.
+
+Element nesting respects comments too: a comment holding the open or close tag of the element it sits inside (`<my-card>kid<!-- </my-card> --></my-card>`) rides along as content, and the element still ends at its real close tag. Script bodies follow the parser's double-escape rule, so the legacy `<!-- <script>... -->` wrapper pattern stays text to its true end.
+
 ```ts
 class MyCard extends WebComponent {
   render() {

.github/workflows/ci.yml

@@ -126,6 +126,14 @@ jobs:
       # Readable.fromWeb, which hangs on Bun).
       - name: webjs compression on Bun
         run: bun test/bun/compression.mjs
+      # SSR HTML-context handling on Bun (#1128): a tag name inside a comment,
+      # raw text, RCDATA, or an attribute value is text, not an element. The
+      # scanner is offset arithmetic over indexOf / startsWith results and a
+      # per-call RegExp, so a V8-versus-JSC divergence would not throw, it would
+      # shift a range boundary and make a component render on one runtime and
+      # silently vanish on the other. Asserts both directions.
+      - name: SSR comment and raw-text handling on Bun
+        run: bun test/bun/comment-not-an-element.mjs
       # Dev hot reload on Bun (#514): start `webjs dev` under Bun, edit a
       # re-imported route module, and assert the response updates with NO manual
       # restart. The CLI re-execs under `bun --hot` on Bun (vs `node --watch` on

packages/core/src/router-client.js

@@ -1674,7 +1674,16 @@ function prefetch(href) {
   const headers = { 'x-webjs-router': '1', 'x-webjs-prefetch': '1' };
   if (have) headers['x-webjs-have'] = have;
 
-  fetch(href, { method: 'GET', headers, credentials: 'same-origin' })
+  // `no-cache` (revalidate, NOT bypass) is load-bearing (#1131): the deploy
+  // check below reads x-webjs-build / x-webjs-src off this response, and a
+  // page served with a browser max-age would otherwise satisfy the fetch
+  // wholly from the HTTP cache, replaying pre-deploy ids. The check would then
+  // compare two equally stale values and skip the eviction, so a deploy stayed
+  // invisible for the whole freshness window plus one stale-while-revalidate
+  // serving per URL. With stable page ETags a forced revalidation is a
+  // conditional request answered 304, so the cost is a header round-trip, not
+  // a re-download.
+  fetch(href, { method: 'GET', headers, credentials: 'same-origin', cache: 'no-cache' })
     .then(async (resp) => {
       const ctype = resp.headers.get('content-type') || '';
       if (!/^text\/html\b/i.test(ctype)) return;
@@ -2155,7 +2164,10 @@ async function fetchAndApply(href, frameId, recordHistory, optimisticState, meth
     }
 
     /** @type {RequestInit} */
-    const init = { method, headers, credentials: 'same-origin' };
+    // `no-cache` for the same reason as the prefetch fetch (#1131): applySwap
+    // hard-reloads on a build change it can only see if these headers are
+    // live, not replayed from the HTTP cache.
+    const init = { method, headers, credentials: 'same-origin', cache: 'no-cache' };
     if (signal) init.signal = signal;
     if (body != null && method !== 'GET' && method !== 'HEAD') init.body = body;