dommy 0.14.0 → 0.16.0

data/lib/dommy/document.rb

@@ -1,13 +1,14 @@
 # frozen_string_literal: true
 
 require "uri"
+require "time"
 
 require_relative "internal/node_wrapper_cache"
 require_relative "internal/directionality"
 require_relative "internal/node_factory"
 require_relative "internal/mutation_coordinator"
 require_relative "internal/shadow_root_registry"
-require_relative "internal/cookie_jar"
+require_relative "cookie_jar"
 require_relative "internal/node_traversal"
 require_relative "internal/node_adopter"
 require_relative "internal/observer_manager"
@@ -35,9 +36,8 @@ module Dommy
     # insert steps, neither of which the old doctype-specific path did.
     include Internal::ChildNode
 
-    # Mixed into a node-backed doctype only, so a synthetic one does NOT respond
-    # to `__dommy_backend_node__` — leaving the Node mixin's guards (which key off
-    # `respond_to?(:__dommy_backend_node__)`) to treat it as disconnected.
+    # Mixed into a node-backed doctype only, so a synthetic one keeps Node's nil
+    # `__dommy_backend_node__` and is treated as disconnected.
     module NodeBacked
       def __dommy_backend_node__ = @__node__
     end
@@ -178,6 +178,14 @@ module Dommy
         nil
       when "isConnected"
         is_connected?
+      when "textContent", "nodeValue"
+        nil
+      when "baseURI"
+        @owner_document&.base_uri
+      else
+        # A doctype is a Node and a ChildNode only: Element's and ParentNode's
+        # getters (tagName, children, ...) are not its members.
+        Bridge::ABSENT
       end
     end
 
@@ -322,7 +330,18 @@ module Dommy
     # with, in tree order, the doctype (when given) then a document element
     # (namespace, qualifiedName) when qualifiedName is non-empty.
     def create_document(namespace, qualified_name, doctype = nil)
+      # WebIDL converts the interface argument before running the DOM steps
+      # (including qualified-name validation).
+      unless doctype.nil? || doctype.equal?(Bridge::UNDEFINED) || doctype.is_a?(DocumentType)
+        raise Bridge::TypeError, "doctype must be a DocumentType"
+      end
+
       doc = Document.new(nil, backend_doc: Backend.empty_xml_document)
+      # The result is an XMLDocument (DOM's createDocument), unlike a DOMParser
+      # result of the same content type — so the interface is pinned here.
+      doc.__internal_xml_document__ = true
+      # Its origin is the associated document's (DOM createDocument step 7).
+      doc.__internal_set_creator__(@document)
       # createDocument's content type is keyed off the namespace. None is
       # "text/html", so tagName keeps its case; xhtml+xml still routes
       # createElement to the HTML namespace (so an XHTML document isEqualNode
@@ -336,39 +355,24 @@ module Dommy
       qn = qualified_name.to_s
       unless qn.empty?
         el = doc.send(:create_element_ns, namespace, qualified_name)
-        Backend.set_document_root(doc.backend_doc, el.__dommy_backend_node__)
+        doc.backend_doc.add_child(el.__dommy_backend_node__)
       end
       adopt_doctype_into(doc, doctype)
       doc
     end
 
-    private
-
-    # Place `doctype` (a DocumentType passed to createDocument) as `doc`'s first
-    # child. createDocument appends the doctype node itself (step 5, before
-    # step 6 appends the element), so it goes through the ordinary insert: the
-    # adoption re-binds the caller's wrapper, and `xmlDoc.firstChild ===
-    # doctype`, its parentNode and ownerDocument all follow.
-    #
-    # No-op for nil/undefined or a non-DocumentType. A doctype the XML backend
-    # cannot hold is left unplaced rather than thrown: createDocument itself
-    # validates none of it — only an XML serialization would.
-    def adopt_doctype_into(doc, doctype)
-      return if doctype.nil? || doctype.equal?(Bridge::UNDEFINED)
-      return unless doctype.is_a?(DocumentType)
-
-      doc.insert_before(doctype, doc.document_element)
-    rescue DOMException::NotSupportedError
-      nil
-    end
-
-    public
-
     # createHTMLDocument(title?) — a fresh HTML document (doctype + html > head,
-    # body), with an optional <title>.
+    # body), with an optional <title>. A given title is a title element in the
+    # head holding one Text node of exactly that data, "" included — which
+    # the title setter's string-replace-all would leave empty.
     def create_html_document(title = nil)
       doc = Document.new(nil, backend_doc: Backend.parse("<!DOCTYPE html><html><head></head><body></body></html>"))
-      doc.title = title.to_s unless title.nil? || title.equal?(Bridge::UNDEFINED)
+      # Its origin is the associated document's (DOM createHTMLDocument step 8).
+      doc.__internal_set_creator__(@document)
+      unless title.nil? || title.equal?(Bridge::UNDEFINED)
+        element = doc.head.append_child(doc.create_element("title"))
+        element.append_child(doc.create_text_node(title.to_s))
+      end
       doc
     end
 
@@ -381,6 +385,10 @@ module Dommy
       when "createDocumentType"
         create_document_type(args[0], args[1], args[2])
       when "createDocument"
+        # namespace and qualifiedName are required (either may be null, but
+        # must be present); doctype is optional.
+        raise Bridge::TypeError, "createDocument requires 2 arguments." if args.length < 2
+
         create_document(args[0], args[1], args[2])
       when "createHTMLDocument"
         # title is an OPTIONAL DOMString: a missing or undefined argument leaves
@@ -394,6 +402,27 @@ module Dommy
         has_feature
       end
     end
+
+    private
+
+    # Place `doctype` (a DocumentType passed to createDocument) as `doc`'s first
+    # child. createDocument appends the doctype node itself (step 5, before
+    # step 6 appends the element), so it goes through the ordinary insert: the
+    # adoption re-binds the caller's wrapper, and `xmlDoc.firstChild ===
+    # doctype`, its parentNode and ownerDocument all follow.
+    #
+    # No-op for nil/undefined. Any other non-DocumentType is a TypeError: the
+    # IDL converts `doctype` to `DocumentType?`, so `createDocument(ns, name,
+    # false)` throws rather than ignoring the value. A doctype the XML backend
+    # cannot hold is left unplaced rather than thrown: only an XML
+    # serialization would validate its contents.
+    def adopt_doctype_into(doc, doctype)
+      return if doctype.nil? || doctype.equal?(Bridge::UNDEFINED)
+
+      doc.insert_before(doctype, doc.document_element)
+    rescue DOMException::NotSupportedError
+      nil
+    end
   end
 
   # `document` — the entry point for DOM construction and querying.
@@ -409,6 +438,7 @@ module Dommy
     include Internal::DocumentLiveRanges
     include Internal::DocumentInteractionState
     include EventTarget
+    extend Internal::EventHandlers::AnswersIdlAttributes
     include Node
 
     attr_reader :backend_doc
@@ -435,7 +465,7 @@ module Dommy
     # edit only when it's inside a <style> or flips emptiness while a sheet
     # uses `:empty`. The coordinator reports mutations through the
     # `__internal_note_*` seams below, which decide what to bump.
-    attr_accessor :__css_style_cache__
+    attr_accessor :__internal_css_style_cache__
 
 
 
@@ -463,11 +493,12 @@ module Dommy
 
 
 
-    # A by-id/class/tag index of the backend element tree, memoized per DOM
-    # generation, for SelectorMatcher's document-scoped fast path (or nil to tell
-    # the caller to walk). Rebuilt lazily only after a mutation bumps
-    # dom_generation, so it costs one tree walk per generation and pays off when
-    # several queries run before the next mutation.
+    # A by-id/class/tag index of the backend element tree, memoized per
+    # #__internal_selector_index_generation__, for SelectorMatcher's
+    # document-scoped fast path (or nil to tell the caller to walk). Rebuilt
+    # lazily only after a mutation that can change it (the tree, or an `id` /
+    # `class`), so it costs one tree walk per such mutation and pays off when
+    # several queries run before the next one.
     #
     # Adaptive bypass: if the index keeps getting invalidated after serving only a
     # handful of queries (a mutation-between-every-query workload, where building
@@ -479,7 +510,7 @@ module Dommy
     SELECTOR_INDEX_RETEST_GAP = 64 # generations to wait before re-testing a bypass
 
     def __internal_selector_index__
-      gen = dom_generation
+      gen = __internal_selector_index_generation__
       if @__sel_idx_gen != gen
         if @__sel_idx
           if @__sel_idx_served.to_i < SELECTOR_INDEX_MIN_REUSE
@@ -500,7 +531,7 @@ module Dommy
       end
       return nil if @__sel_idx_bypass
 
-      @__sel_idx ||= Internal::SelectorIndex.build(@backend_doc)
+      @__sel_idx ||= Internal::SelectorIndex.build(@backend_doc, quirks: quirks_mode?)
       @__sel_idx_served += 1
       @__sel_idx
     end
@@ -536,7 +567,20 @@ module Dommy
     end
     # content_type defaults to "text/html"; settable so an integration layer
     # can reflect the response Content-Type. Read-only over the JS bridge.
-    attr_accessor :content_type
+    attr_reader :content_type
+
+    # Whether the document is an HTML one rides on its type, and with it its
+    # mode — only an HTML document can be in quirks mode — and how selectors
+    # fold id and class case. A layer that sets the type after the parse
+    # (dommy-rack does) has the mode worked out again and the selector
+    # results retired.
+    def content_type=(value)
+      return if value == @content_type
+
+      @content_type = value
+      @quirks_mode = nil
+      __internal_note_selector_state_change__
+    end
     # A `->(source_text) {}` set by the JS layer to execute a classic <script>'s
     # body when it's connected (Dommy has no JS engine of its own). nil = inert
     # scripts (the default for a standalone DOM).
@@ -558,6 +602,25 @@ module Dommy
       nil
     end
 
+    # A `->(element, name, body, window_handler) {}` set by the JS layer that
+    # compiles an event handler content attribute's body into a function (the
+    # element, its form owner and the document in its scope; none for a
+    # Window's handler, whose `onerror` takes five arguments), raising the
+    # SyntaxError of a body that does not parse. nil = no engine, nothing runs.
+    attr_accessor :event_handler_compiler
+
+    # Activate the event handler content attributes of every element the
+    # parser built (it runs no attribute change steps), as though each had
+    # just been set. Run at boot, before any script, and safe to repeat.
+    def __internal_activate_parsed_event_handlers__
+      selector = (Internal::EventHandlers::GLOBAL | Internal::EventHandlers::WINDOW).map { |name| "[#{name}]" }.join(",")
+      parsed_css(selector).each do |node|
+        element = wrap_node(node)
+        element.__internal_wire_inline_handler__(nil) if element.respond_to?(:__internal_wire_inline_handler__)
+      end
+      nil
+    end
+
     def initialize(host = nil, backend_doc: nil, default_view: nil)
       @host = host
       @default_view = default_view
@@ -565,7 +628,6 @@ module Dommy
       @node_factory = Internal::NodeFactory.new(self, @node_wrapper_cache)
       @observer_manager = Internal::ObserverManager.new
       @shadow_registry = Internal::ShadowRootRegistry.new
-      @cookie_jar = Internal::CookieJar.new
       @template_content_registry = Internal::TemplateContentRegistry.new(self)
       @mutation_coordinator = Internal::MutationCoordinator.new(self, @observer_manager)
       # Weak, like @live_ranges: a NodeIterator is consulted by every removal for
@@ -585,30 +647,50 @@ module Dommy
       @__current_script__ = nil
     end
 
-    # Whether this is an "HTML document" in the DOM sense (created by the HTML
-    # parser / `text/html`), as opposed to an XML document. It drives the
-    # case-folding rules: `createElement` lowercases names and `Element#tagName`
-    # uppercases HTML-namespace names only in an HTML document. An XML or XHTML
-    # document (e.g. an `application/xhtml+xml` / `text/xml` resource) preserves
-    # case.
+    # Whether this is an "HTML document" in the DOM sense (DOM's type "html"),
+    # as opposed to an XML document. It drives the case-folding rules:
+    # `createElement` lowercases names and `Element#tagName` uppercases
+    # HTML-namespace names only in an HTML document. An XML or XHTML document
+    # (e.g. an `application/xhtml+xml` / `text/xml` resource) preserves case.
+    #
+    # The type is not the content type: a text document (a text/plain or
+    # text/css response shown in a <pre>) is an HTML document too. Every way of
+    # making an XML document gives it an XML MIME type, so that is what decides.
     def html_document?
-      @content_type == "text/html"
+      !Internal::MimeType.xml?(@content_type)
+    end
+
+    # Whether this document is DOM's XMLDocument — the interface
+    # `implementation.createDocument` returns (and a clone of one keeps). A
+    # DOMParser result is the base Document even when parsed from XML, so this
+    # rides on the instance rather than the content type. Together with
+    # #html_document? it decides the document's most-derived interface.
+    def xml_document? = @xml_document == true
+
+    def __internal_xml_document__=(value)
+      @xml_document = value
     end
 
-    # `document.compatMode` — "CSS1Compat" in no-quirks mode, "BackCompat" in
-    # quirks mode. A missing doctype is quirks; a bare `<!DOCTYPE html>` (no
-    # public/system identifier) is no-quirks. (The full quirks algorithm keys off
-    # specific legacy public ids; this covers the common cases.)
+    # `document.compatMode` — "BackCompat" in quirks mode, "CSS1Compat" in
+    # no-quirks and limited-quirks mode alike.
     def compat_mode
-      # Only HTML documents can be in quirks mode; an XML document
-      # (createDocument / DOMParser XML) is always no-quirks.
-      return "CSS1Compat" unless html_document?
+      quirks_mode? ? "BackCompat" : "CSS1Compat"
+    end
 
-      dt = @backend_doc.internal_subset
-      return "BackCompat" unless dt
-      return "CSS1Compat" if dt.name.to_s.downcase == "html" && dt.external_id.nil?
+    # Whether the document is in quirks mode (DOM's "mode"). Only the HTML
+    # parser puts a document in it, from the doctype it read — a missing one,
+    # or one of HTML's legacy public identifiers (§13.2.6.4.1); the backend's
+    # parser has already run that algorithm. Every other document is in
+    # no-quirks mode, and a clone takes its original's mode. The mode is fixed
+    # once known: changing the doctype later does not change it.
+    def quirks_mode?
+      return @quirks_mode unless @quirks_mode.nil?
+
+      @quirks_mode = html_document? && Backend.quirks_mode?(@backend_doc)
+    end
 
-      "BackCompat"
+    def __internal_quirks_mode__=(value)
+      @quirks_mode = value
     end
 
     # The document's character encoding, as an Encoding Standard name. Dommy
@@ -634,9 +716,35 @@ module Dommy
     end
 
     def dir=(value)
-      html_element&.set_attribute("dir", value.to_s)
+      html_element&.__internal_set_attribute_value__("dir", value.to_s)
+    end
+
+    # HTML §16 (obsolete features), the partial Document interface: fgColor,
+    # linkColor, vlinkColor, alinkColor and bgColor reflect the body element's
+    # text, link, vlink, alink and bgcolor content attributes — "if the body
+    # element is a body element (as opposed to a frameset element). When there
+    # is no body element or if it is a frameset element, the attributes must
+    # instead return the empty string on getting and do nothing on setting."
+    # The setters are [LegacyNullToEmptyString] (null writes "").
+    LEGACY_BODY_COLORS = {
+      fg_color: "text", link_color: "link", vlink_color: "vlink", alink_color: "alink", bg_color: "bgcolor"
+    }.freeze
+
+    LEGACY_BODY_COLORS.each do |name, attr|
+      define_method(name) do
+        element = body
+        element.is_a?(HTMLBodyElement) ? element.__internal_attribute_value__(attr).to_s : ""
+      end
+
+      define_method(:"#{name}=") do |value|
+        element = body
+        element.__internal_set_attribute_value__(attr, value.to_s) if element.is_a?(HTMLBodyElement)
+      end
     end
 
+    # Whether designMode is "on", which makes the whole document editable.
+    def __internal_design_mode__? = @design_mode == "on"
+
     def title=(value)
       write_title(value.to_s)
     end
@@ -654,33 +762,49 @@ module Dommy
       # answers null: the backend's `root` falls back to the doctype once the
       # element is gone (`document.removeChild(documentElement)`, or a
       # replaceChild that swaps it for a comment), and head / body / title
-      # resolve through this.
-      root = @backend_doc.root
-      return nil unless root&.element?
-
-      wrap_node(root)
+      # resolve through this (#backend_document_element).
+      root = backend_document_element
+      root && wrap_node(root)
     end
 
+    # HTML's "the head element": the first `head` child, in the HTML
+    # namespace, of the html element (readonly — assignment is a no-op, see
+    # __js_set__).
+    #
+    # Spec: https://html.spec.whatwg.org/multipage/dom.html#the-head-element-2
     def head
-      # The first `head` element child of the document element in the HTML
-      # namespace (readonly — assignment is a no-op, see __js_set__). Not just
-      # `at_css("head")`, which searches the whole tree and ignores namespace.
-      root = document_element
-      return nil unless root
-
-      root.child_nodes.to_a.find do |c|
-        c.respond_to?(:local_name) && c.local_name == "head" &&
-          c.respond_to?(:namespace_uri) && c.namespace_uri == Internal::Namespaces::HTML
-      end
+      wrap_node(html_element_child(%w[head]))
     end
 
-    # Resolve `body` fresh from the tree (not memoized) so it tracks a swapped
-    # `<body>` — e.g. Turbo's page render does
-    # `documentElement.replaceChild(newBody, body)`, after which a stale cached
-    # wrapper would keep returning the detached old body. wrap_node caches by
-    # node, so identity (`document.body === document.body`) still holds.
+    # HTML's "the body element": the first child of the html element — the
+    # document element, if it is the HTML namespace's `html` — that is a
+    # `body` or a `frameset` in the HTML namespace; nil without one. Resolved
+    # fresh from the tree (not memoized) so it tracks a swapped `<body>` — e.g.
+    # Turbo's page render does `documentElement.replaceChild(newBody, body)`.
+    # wrap_node caches by node, so `document.body === document.body` holds.
+    #
+    # Spec: https://html.spec.whatwg.org/multipage/dom.html#the-body-element-2
     def body
-      wrap_node(@backend_doc.at_css("body"))
+      wrap_node(html_element_child(%w[body frameset]))
+    end
+
+    # The body setter: the new value must be a `body` or a `frameset` in the
+    # HTML namespace. It replaces the body element there is, or else is
+    # appended to the document element; without either, there is nowhere to
+    # put it.
+    #
+    # Spec: https://html.spec.whatwg.org/multipage/dom.html#dom-document-body
+    def body=(element)
+      raise DOMException::HierarchyRequestError, "body must be a body or frameset element" unless body_or_frameset?(element)
+
+      current = body
+      return if element.equal?(current)
+      return current.parent_node.replace_child(element, current) if current
+
+      root = document_element
+      raise DOMException::HierarchyRequestError, "the document has no document element" unless root
+
+      root.append_child(element)
     end
 
     # The document's accessibility tree (built from <body>; the document itself
@@ -716,7 +840,18 @@ module Dommy
     # "about:blank", not the empty string.
     def url
       view = @default_view
-      view&.location ? view.location.href : "about:blank"
+      return view.location.href if view&.location
+
+      @creator_url || "about:blank"
+    end
+
+    # A document made by a parsing or creation API (DOMParser,
+    # DOMImplementation) takes its origin from `document` — the relevant
+    # global object's associated Document — and, for DOMParser, its URL too.
+    def __internal_set_creator__(document, url: nil)
+      @origin_document = document
+      @creator_url = url
+      nil
     end
 
     alias document_uri url
@@ -730,7 +865,7 @@ module Dommy
       base_el = @backend_doc.at_css("base[href]")
       return doc_url unless base_el
 
-      href = base_el["href"].to_s
+      href = Backend.no_namespace_attribute_value(base_el, "href").to_s
       return doc_url if href.empty?
 
       # HTML "document base URL": the frozen base URL is the href parsed
@@ -749,32 +884,88 @@ module Dommy
       nil
     end
 
-    private def creator_base_url
-      @creator_base_url if @creator_base_url && FALLBACK_BASE_URLS.include?(url)
+    # `document.domain` — the effective domain of the document's origin
+    # serialized: the domain a `document.domain =` set, or else the origin's
+    # host; "" for an opaque origin.
+    def domain
+      return @domain_override if @domain_override
+
+      host = Internal::Origin.host_of(origin)
+      host.nil? ? "" : host.to_s
     end
 
-    # `document.domain` — host portion of the URL. Real browsers
-    # restrict cross-origin reads of this; we just return the bare host.
-    def domain
+    # The `document.domain` setter. It needs a browsing context and a tuple
+    # origin, and accepts only the current effective domain or a registrable
+    # suffix of it (everything else is a SecurityError). The agent cluster is
+    # site-keyed (no Origin-Agent-Cluster header), so the domain is then set.
+    #
+    # Without a public suffix list, a single label (a bare TLD such as "com")
+    # stands in for the public suffix.
+    def domain=(value)
       view = @default_view
-      return "" unless view&.location
+      raise DOMException::SecurityError, "The document has no browsing context" unless view&.navigable?
+
+      current = Internal::Origin.host_of(origin)
+      raise DOMException::SecurityError, "The document's origin is opaque" if current.nil?
+
+      candidate = value.to_s
+      unless registrable_domain_suffix_or_equal?(candidate, current.to_s)
+        raise DOMException::SecurityError, "'#{candidate}' is not a suffix of '#{current}'"
+      end
 
-      view.location.__js_get__("hostname").to_s
+      @domain_override = Internal::UrlParser.parse("http://#{candidate}/").host.to_s
     end
 
-    # `document.origin` — serialized origin of the document URL, mirroring
-    # `window.location.origin`. Empty when there is no associated window.
+    # `document.origin` — this document's origin, serialized (the same answer as
+    # `self.origin`). Empty when there is no associated window.
     def origin
       view = @default_view
-      return "" unless view&.location
+      return @origin_document&.origin.to_s unless view&.location
 
       view.origin
     end
 
-    # `document.referrer` — Dommy never has a referring page, so this
-    # is always empty.
+    # `document.lastModified` — the source's last modification (the response's
+    # Last-Modified header, when the embedder passed one on), else the current
+    # time, in local time as "MM/DD/YYYY hh:mm:ss".
+    #
+    # Spec: https://html.spec.whatwg.org/#dom-document-lastmodified
+    def last_modified
+      (@last_modified_time || Time.now).getlocal.strftime("%m/%d/%Y %H:%M:%S")
+    end
+
+    # Record the document's source last-modified time: a Time, or an HTTP date
+    # string (a Last-Modified header value). One that does not parse leaves it
+    # unknown.
+    def __internal_set_last_modified__(value)
+      @last_modified_time =
+        case value
+        when Time then value
+        when nil then nil
+        else
+          begin
+            Time.httpdate(value.to_s.strip)
+          rescue ArgumentError
+            nil
+          end
+        end
+      nil
+    end
+
+    # `document.referrer` — the URL of the document that navigated here, as the
+    # embedder reports it (`__internal_referrer__=`); empty when there was none.
     def referrer
-      ""
+      @referrer.to_s
+    end
+
+    def __internal_referrer__=(url)
+      @referrer = url
+    end
+
+    # Whether the document has completely finished loading: its `load` event
+    # has been fired. A document whose lifecycle no one replays is born loaded.
+    def __internal_completely_loaded__?
+      !@loading_lifecycle
     end
 
     # Live HTMLCollection helpers — each call re-queries the
@@ -817,7 +1008,7 @@ module Dommy
     # in practice the `<html>` root).
     def children
       @live_children ||= HTMLCollection.new do
-        root = @backend_doc.root
+        root = backend_document_element
         root ? [wrap_node(root)].compact : []
       end
     end
@@ -835,13 +1026,10 @@ module Dommy
       children.size
     end
 
-    def first_element_child
-      wrap_node(@backend_doc.root)
-    end
+    # A document has at most one element child, the document element.
+    def first_element_child = document_element
 
-    def last_element_child
-      wrap_node(@backend_doc.root)
-    end
+    def last_element_child = document_element
 
 
     # `document.contains(node)` — true if `node` is the document itself or any
@@ -849,14 +1037,13 @@ module Dommy
     # document expose). Per spec, false for null / a non-Node.
     def contains?(other)
       return true if other.equal?(self)
-      return false unless other.respond_to?(:__dommy_backend_node__)
+      return false unless other.is_a?(Node)
 
-      # Walk parents up to the backend document node. (The backend's #ancestors
+      # Whose root the backend document node is. (The backend's #ancestors
       # stops below the document, so it can't test document membership; the
       # doctype in particular reports an empty ancestor list.)
       node = other.__dommy_backend_node__
-      node = node.parent while node && !node.equal?(@backend_doc)
-      !node.nil?
+      !node.nil? && Internal::NodeTraversal.root_of(node).equal?(@backend_doc)
     end
 
 
@@ -915,39 +1102,47 @@ module Dommy
       # it here with the same qualified name, namespace, prefix and value, owned
       # by no element (importNode never attaches the copy to anything).
       return import_attribute(node) if node.is_a?(Attr)
-      return nil unless node.respond_to?(:__dommy_backend_node__)
+      return nil unless node.is_a?(Node) && node.__dommy_backend_node__
+
+      # `(boolean or ImportNodeOptions) options = false`: missing or undefined
+      # is the default, false. Null and an object convert to the dictionary,
+      # whose `selfOnly` negates `deep` (so null clones deep) and whose
+      # `customElementRegistry` (a scoped one, or this document's) is the
+      # registry the copies fall back to. Anything else is a boolean, read
+      # with ToBoolean.
+      registry = nil
+      deep = false if deep.equal?(Bridge::UNDEFINED)
+      if deep.nil? || deep.is_a?(Hash)
+        options = deep || {}
+        deep = !Internal::WebIDL.boolean(options["selfOnly"])
+        given = options.fetch("customElementRegistry", Bridge::UNDEFINED)
+        unless given.equal?(Bridge::UNDEFINED)
+          raise Bridge::TypeError, "customElementRegistry is not a CustomElementRegistry" unless given.is_a?(CustomElementRegistry)
+          if !given.scoped? && !given.equal?(__internal_custom_element_registry__)
+            raise DOMException::NotSupportedError, "a global registry other than the document's"
+          end
 
-      # WebIDL `optional boolean deep = false`: a missing / undefined argument
-      # is the default (false / shallow), not a truthy sentinel.
-      deep = false if deep.nil? || deep.equal?(Bridge::UNDEFINED)
+          registry = given
+        end
+      else
+        deep = Internal::WebIDL.boolean(deep)
+      end
+      # "Clone a single node": the node's own registry — a global one standing
+      # for this document's — and the fallback only for a node without one.
+      fallback = registry || __internal_custom_element_registry__
+      source = node.is_a?(Element) ? node.__internal_ce_registry__ : fallback
+      registry = if source.nil? then fallback
+                 elsif source.scoped? then source
+                 else __internal_custom_element_registry__
+                 end
       source_document = node.respond_to?(:document) ? node.document : self
       copy = clone_into_doc(node.__dommy_backend_node__, deep, source_document)
       apply_imported_cloning_steps(node.__dommy_backend_node__, copy, deep, source_document)
+      __internal_enqueue_created_upgrades__(copy, registry) if copy.respond_to?(:element?)
+      __internal_clone_shadow_roots__(node.__dommy_backend_node__, copy, deep, source_document) if copy.respond_to?(:element?)
       wrap_node(copy)
     end
 
-    # importNode is a clone, so the HTML cloning steps run for it as they do
-    # for cloneNode (#__internal_apply_cloning_steps__): the live state Dommy
-    # keeps on a wrapper — an input's dirty value, a script's "already
-    # started" — is copied onto the new node. The originals' wrappers belong
-    # to the source document, so they are looked up there.
-    def apply_imported_cloning_steps(src_root, copy_root, deep, source_document)
-      return unless source_document.respond_to?(:__internal_peek_wrapper__)
-
-      src_nodes = deep ? Internal::NodeTraversal.subtree_nodes(src_root) : [src_root]
-      copy_nodes = deep ? Internal::NodeTraversal.subtree_nodes(copy_root) : [copy_root]
-      return unless src_nodes.length == copy_nodes.length
-
-      src_nodes.zip(copy_nodes).each do |orig, copy|
-        state = source_document.__internal_peek_wrapper__(orig)&.then { |w| w.respond_to?(:__cloning_state__) && w.__cloning_state__ }
-        next unless state
-
-        wrapper = wrap_node(copy)
-        wrapper.__apply_cloning_state__(state) if wrapper.respond_to?(:__apply_cloning_state__)
-      end
-    end
-    private :apply_imported_cloning_steps
-
     def import_attribute(attr)
       Attr.new(
         attr.name,
@@ -984,11 +1179,6 @@ module Dommy
       node_adopter.adopt_backend_node(node, source_document)
     end
 
-    def node_adopter
-      @node_adopter ||= Internal::NodeAdopter.new(self)
-    end
-    private :node_adopter
-
     # HTML "cloning steps": a cloned node copies interface-specific live state
     # that the content attributes don't capture — an input's dirty value and
     # checkedness, a textarea's dirty value, etc. Dommy keeps that state on the
@@ -1009,15 +1199,69 @@ module Dommy
         clone_template_content(orig, copy) if deep && @template_content_registry.detached?(orig)
 
         wrapper = @node_wrapper_cache.peek(orig)
-        next unless wrapper.respond_to?(:__cloning_state__)
+        next unless wrapper.respond_to?(:__internal_cloning_state__)
 
-        state = wrapper.__cloning_state__
+        state = wrapper.__internal_cloning_state__
         next if state.nil?
 
-        @node_wrapper_cache.wrap(copy).__apply_cloning_state__(state)
+        @node_wrapper_cache.wrap(copy).__internal_apply_cloning_state__(state)
       end
     end
 
+    # DOM "clone a node" step 6, for `copy_root` — a clone made in this
+    # document of `src_root` (of `source_document`), with or without its
+    # subtree — and, when `deep`, every element of the copy: the clone of a
+    # shadow host whose shadow root is clonable gets a shadow root of its own
+    # with the same mode, delegates focus, serializable, slot assignment,
+    # declarative and keep-custom-element-registry-null, clonable, holding
+    # clones of the shadow root's children. A shallow clone still does this
+    # for the host itself. The backend copied the subtree (and template
+    # contents) in one go, so the two trees are walked in lockstep.
+    def __internal_clone_shadow_roots__(src_root, copy_root, deep, source_document = self)
+      return unless source_document.__internal_any_shadow_roots__?
+
+      clone_shadow_roots_walk(src_root, copy_root, deep, source_document)
+    end
+
+    def clone_shadow_roots_walk(src, copy, deep, source_document)
+      return unless src.element? || src.is_a?(Backend.document_fragment_class)
+
+      if src.element?
+        shadow = source_document.__internal_shadow_root_for_host__(src)
+        clone_shadow_root(shadow, copy, source_document) if shadow&.clonable
+      end
+      return unless deep
+
+      src_children = src.children.to_a
+      copy_children = copy.children.to_a
+      return unless src_children.length == copy_children.length
+
+      src_children.zip(copy_children).each { |s, c| clone_shadow_roots_walk(s, c, true, source_document) }
+      return unless src.element? && @template_content_registry.template_node?(src)
+
+      src_contents = source_document.__internal_template_registry__.existing_contents(src)
+      copy_contents = @template_content_registry.existing_contents(copy)
+      clone_shadow_roots_walk(src_contents, copy_contents, true, source_document) if src_contents && copy_contents
+    end
+
+    def clone_shadow_root(shadow, copy, source_document)
+      host = wrap_node(copy)
+      # The shadow root's registry; a global one stands for this document's.
+      registry = shadow.__internal_registry_set__? ? shadow.__internal_custom_element_registry__ : :document
+      registry = :document if registry && registry != :document && !registry.scoped?
+      root = host.__internal_attach_shadow_root__(
+        mode: shadow.mode, delegates_focus: shadow.delegates_focus, serializable: shadow.serializable,
+        slot_assignment: shadow.slot_assignment, clonable: true, registry: registry
+      )
+      root.__internal_declarative__ = shadow.__internal_declarative__?
+      root.__internal_keep_registry_null__ = shadow.__internal_keep_registry_null__?
+      shadow.child_nodes.to_a.each do |child|
+        child_copy = source_document.equal?(self) ? child.clone_node(true) : import_node(child, true)
+        root.append_child(child_copy)
+      end
+    end
+    private :clone_shadow_roots_walk, :clone_shadow_root
+
     # Legacy `document.createEvent("EventName")` factory. The DOM Standard
     # matches the type ASCII case-insensitively against a fixed alias table, and
     # throws NotSupportedError for anything else — including the plural forms it
@@ -1062,8 +1306,22 @@ module Dommy
     # don't apply to a layout-less DOM. They exist so callers don't
     # hit NoMethodError; semantics are documented as no-op.
 
+    # `document.hasFocus()` — HTML's "has focus steps", with the top-level
+    # page always holding system focus: a document with no browsing context
+    # has no focus, a top-level one has it, and a nested one has it when its
+    # frame is the focused element of a parent document that has it.
+    #
+    # Spec: https://html.spec.whatwg.org/#has-focus-steps
     def has_focus?
-      true
+      view = @default_view
+      return false unless view
+
+      frame = view.frame_element
+      return true unless frame
+      return false unless frame.is_connected?
+
+      parent = frame.owner_document
+      parent.has_focus? && parent.__internal_focused_element__.equal?(frame)
     end
 
     alias has_focus has_focus?
@@ -1080,6 +1338,12 @@ module Dommy
       Range.new(self)
     end
 
+    # The showing popovers and the state that orders their showing and
+    # hiding (Internal::PopoverStack).
+    def __internal_popover_stack__
+      @popover_stack ||= Internal::PopoverStack.new
+    end
+
     # Fullscreen API — no actual fullscreen mode, just track which
     # element claimed it. `element.requestFullscreen()` sets it; this
     # is the read side.
@@ -1090,6 +1354,8 @@ module Dommy
       @fullscreen_element = element
       return if previous == element
 
+      # :fullscreen and :modal match the fullscreen element.
+      __internal_note_selector_state_change__
       dispatch_event(Event.new("fullscreenchange"))
     end
 
@@ -1097,6 +1363,7 @@ module Dommy
       return PromiseValue.resolve(@default_view, nil) if @fullscreen_element.nil?
 
       @fullscreen_element = nil
+      __internal_note_selector_state_change__
       dispatch_event(Event.new("fullscreenchange"))
       PromiseValue.resolve(@default_view, nil)
     end
@@ -1215,10 +1482,18 @@ module Dommy
         end
       end
 
+      # Pre-insert refuses an element before a doctype `child` or one that
+      # follows it; replace (`exclude` is the child replaced) only one that
+      # follows it, since the doctype being replaced goes.
+      doctype_in_the_way =
+        if exclude
+          doctype_after_child?(existing, child_bn, inclusive: false)
+        else
+          (child_bn && child_bn.node_type == 10) || doctype_after_child?(existing, child_bn)
+        end
       if elements > 1
         raise DOMException::HierarchyRequestError, "Only one element may be a child of a document."
-      elsif elements == 1 &&
-            (has_element || (child_bn && child_bn.node_type == 10) || doctype_after_child?(existing, child_bn))
+      elsif elements == 1 && (has_element || doctype_in_the_way)
         raise DOMException::HierarchyRequestError, "An element cannot be inserted here."
       end
 
@@ -1233,7 +1508,7 @@ module Dommy
     # createDocument, which the DOM never lets throw here, catches this and
     # leaves the doctype out.
     def ensure_doctypes_have_nodes!(args)
-      return unless args.any? { |a| a.is_a?(Dommy::DocumentType) && !a.respond_to?(:__dommy_backend_node__) }
+      return unless args.any? { |a| a.is_a?(Dommy::DocumentType) && a.__dommy_backend_node__.nil? }
 
       raise DOMException::NotSupportedError, "This doctype cannot be inserted: the backend could not create it."
     end
@@ -1271,19 +1546,20 @@ module Dommy
       existing[0...idx].any? { |c| c.node_type == 1 }
     end
 
-    # Whether any doctype child follows `child_bn` in the document's child list.
-    def doctype_after_child?(existing, child_bn)
+    # Whether a doctype child is at `child_bn` (when `inclusive`) or follows
+    # it in the document's child list.
+    def doctype_after_child?(existing, child_bn, inclusive: true)
       idx = child_bn && existing.index { |c| c == child_bn }
       return false unless idx
 
-      existing[idx..].any? { |c| c.node_type == 10 }
+      existing[(inclusive ? idx : idx + 1)..].any? { |c| c.node_type == 10 }
     end
 
     # Append a node as a child of the document itself (e.g. a comment alongside
     # the document element). Adopts the node into this document.
     def append_child(node)
       ensure_document_insertion_validity!([node], nil)
-      return node unless node.respond_to?(:__dommy_backend_node__)
+      return node unless node.is_a?(Node) && node.__dommy_backend_node__
 
       # An append has a null reference child, so insert step 5 shifts nothing.
       nodes = document_insertion_nodes([node])
@@ -1299,6 +1575,8 @@ module Dommy
     # a doctype only ahead of the document element), so each forwards to the
     # `document_*` implementation that carries them.
     def insert_before(node, reference)
+      Internal::WebIDL.node!(node)
+      Internal::WebIDL.nullable_node!(reference)
       document_insert_before(node, reference)
     end
 
@@ -1343,7 +1621,7 @@ module Dommy
       detach_node(bn, moving: true)                               # steps 10-11, 14
       ref_bn = nil if ref_bn && ref_bn.parent != @backend_doc
       __internal_ranges_will_insert__(@backend_doc, ref_bn, 1)    # step 16
-      new_previous = ref_bn ? ref_bn.previous_sibling : @backend_doc.children.to_a.last
+      new_previous = ref_bn ? ref_bn.previous_sibling : @backend_doc.last_child
       ref_bn ? ref_bn.add_previous_sibling(bn) : @backend_doc.add_child(bn) # step 18
       if old_parent
         notify_child_list_mutation(
@@ -1358,22 +1636,20 @@ module Dommy
       nil
     end
 
-    # The backend node an argument to `moveBefore` stands for. A Dommy::Document
-    # has no `__dommy_backend_node__` of its own, but it is a node the algorithm
-    # has to see (step 2 rejects it, step 3 measures its parentage).
+    # The backend node an argument to `moveBefore` stands for. A
+    # Dommy::Document's `__dommy_backend_node__` is nil, but it is a node the
+    # algorithm has to see (step 2 rejects it, step 3 measures its parentage).
     def move_backend_node(value)
       return value.backend_doc if value.is_a?(Dommy::Document)
-      return nil unless value.respond_to?(:__dommy_backend_node__)
 
-      value.__dommy_backend_node__
+      value.__dommy_backend_node__ if value.is_a?(Node)
     end
 
     # "Move" steps 1-6 with a document new parent.
     def ensure_document_move_validity!(node, bn, ref_bn)
       # Step 1 — the same root. A document is its own root, so this says the
       # node must already be somewhere in this document.
-      root = bn
-      root = root.parent while root.respond_to?(:parent) && root.parent
+      root = bn && Internal::NodeTraversal.root_of(bn)
       # `==` and not `equal?`: a backend may hand back a fresh Ruby object for
       # the same underlying node on every `parent` call.
       unless bn && root == @backend_doc
@@ -1416,11 +1692,12 @@ module Dommy
     # ParentNode / Node mutation on the document's direct children (the doctype
     # and the document element).
     def document_insert(args, prepend:)
-      ref_bn = prepend ? @backend_doc.children.first : nil
+      args = Internal::InsertionPoint.convert_nodes_into_a_node(self, args)
+      ref_bn = prepend ? @backend_doc.first_child : nil
       ensure_document_insertion_validity!(args, ref_bn)
       __internal_ranges_will_insert__(@backend_doc, ref_bn, document_insertion_count(args))
       nodes = document_insertion_nodes(args)
-      if prepend && (first = @backend_doc.children.first)
+      if prepend && (first = @backend_doc.first_child)
         nodes.reverse_each { |n| first.add_previous_sibling(n) }
       else
         nodes.each { |n| @backend_doc.add_child(n) }
@@ -1430,6 +1707,7 @@ module Dommy
     end
 
     def document_replace_children(args)
+      args = Internal::InsertionPoint.convert_nodes_into_a_node(self, args)
       # replaceChildren removes the current children first, so the validity
       # checks ignore them (whatwg/dom#1045).
       ensure_document_insertion_validity!(args, nil, ignore_existing: true)
@@ -1442,7 +1720,13 @@ module Dommy
     end
 
     def document_remove_child(node)
-      return __internal_remove_doctype__(node) if node.is_a?(DocumentType)
+      if node.is_a?(DocumentType)
+        bn = backend_node(node)
+        raise DOMException::NotFoundError, "node is not a child of this document" if bn && bn.parent != @backend_doc
+
+        __internal_remove_doctype__(node)
+        return node
+      end
 
       bn = backend_node(node)
       raise DOMException::NotFoundError, "node is not a child of this document" unless bn && bn.parent == @backend_doc
@@ -1500,8 +1784,7 @@ module Dommy
       # read before the adopt below removes anything.
       record_previous = old_bn.previous && wrap_node(old_bn.previous)
       record_next = ref && wrap_node(ref)
-      cross_document = !Backend.moves_nodes_across_documents? &&
-        new_child.respond_to?(:document) && !new_child.document.equal?(self)
+      cross_document = new_child.respond_to?(:document) && !new_child.document.equal?(self)
       fragment = new_child.is_a?(Dommy::Fragment)
 
       # Same document: WHATWG replace adopts the incoming node — which removes
@@ -1557,7 +1840,7 @@ module Dommy
     # (at the document start) or after it (just before the document element).
     def __internal_insert_at_doctype__(nodes, after:)
       bns = nodes.filter_map { |n| backend_node(n) }
-      anchor = after ? @backend_doc.root : @backend_doc.children.first
+      anchor = after ? backend_document_element : @backend_doc.first_child
       __internal_ranges_will_insert__(@backend_doc, anchor, bns.size)
       if after
         anchor ? bns.each { |n| anchor.add_previous_sibling(n) } : bns.each { |n| @backend_doc.add_child(n) }
@@ -1572,9 +1855,13 @@ module Dommy
     # deep clone then copies the original's children into it — so nothing
     # sprouts an html/head/body of its own, and a document with no children
     # clones to one with no children.
-    def clone_node(deep)
+    def clone_node(deep = false)
+      deep = Internal::WebIDL.boolean(deep)
       copy = Document.new(nil, backend_doc: Backend.empty_document_like(@backend_doc))
       copy.content_type = @content_type
+      copy.__internal_xml_document__ = @xml_document
+      copy.__internal_quirks_mode__ = quirks_mode?
+      copy.__internal_allow_declarative_shadow_roots__ = __internal_allow_declarative_shadow_roots__?
       return copy unless deep
 
       child_nodes.each { |child| copy.append_child(copy.import_node(child, true)) }
@@ -1582,7 +1869,7 @@ module Dommy
     end
 
     def backend_node(node)
-      node.respond_to?(:__dommy_backend_node__) ? node.__dommy_backend_node__ : nil
+      node.__dommy_backend_node__ if node.is_a?(Node)
     end
 
     # Like `backend_node`, but first adopts a node that belongs to another
@@ -1624,9 +1911,9 @@ module Dommy
     def document_insertion_count(args) = Internal::InsertionPoint.count(args)
 
     def adopted_backend_node(node)
-      return nil unless node.respond_to?(:__dommy_backend_node__)
+      return nil unless node.is_a?(Node) && node.__dommy_backend_node__
 
-      if !Backend.moves_nodes_across_documents? && node.respond_to?(:document) && !node.document.equal?(self)
+      if node.respond_to?(:document) && !node.document.equal?(self)
         return adopt_node(node)&.__dommy_backend_node__
       end
 
@@ -1635,19 +1922,42 @@ module Dommy
       bn
     end
 
-    # Delegate to CookieJar
-
+    # `document.cookie` (HTML §3.1.5): the cookie-string of the window's
+    # cookie jar for this document's URL, as a "non-HTTP" API sees it (no
+    # HttpOnly cookies). A cookie-averse document — no browsing context, or a
+    # URL that is not http(s) — reads "" and ignores writes; one with an
+    # opaque origin throws SecurityError.
     def cookie
-      @cookie_jar.to_cookie_string
+      return "" if __internal_cookie_averse__?
+
+      raise_if_opaque_for_cookies!
+      @default_view.cookie_jar.cookie_string(url, http: false)
     end
 
     def cookie=(value)
-      @cookie_jar.set_cookie(value)
+      return nil if __internal_cookie_averse__?
+
+      raise_if_opaque_for_cookies!
+      @default_view.cookie_jar.store(value.to_s, url, http: false)
       nil
     end
 
-    def create_element_ns(namespace_uri, qualified_name)
-      @node_factory.create_element_ns(namespace_uri, qualified_name)
+    # HTML "cookie-averse Document object".
+    def __internal_cookie_averse__?
+      return true unless @default_view.respond_to?(:cookie_jar)
+
+      !url.to_s.match?(/\Ahttps?:/i)
+    end
+
+    def raise_if_opaque_for_cookies!
+      return unless @default_view.origin == "null"
+
+      raise DOMException::SecurityError, "the document's origin is opaque"
+    end
+    private :raise_if_opaque_for_cookies!
+
+    def create_element_ns(namespace_uri, qualified_name, options = nil)
+      @node_factory.create_element_ns(namespace_uri, qualified_name, options)
     end
 
     def get_elements_by_tag_name(name)
@@ -1662,27 +1972,68 @@ module Dommy
       HTMLCollection.elements_by_tag_name_ns(@backend_doc, self, namespace, local_name)
     end
 
-    # `document.write(html)` — legacy API. Appends parsed nodes to the
-    # body. Real browsers only re-stream the DOM during initial parse;
-    # this stub is enough for tests that fire write() during teardown.
+    # ----- Dynamic markup insertion (document.open / write / close) -----
+    #
+    # Dommy has no incremental parser, so this models the spec's input stream
+    # without one:
+    #
+    # - While the page's own scripts boot (readyState "loading" and a script
+    #   running) the parser counts as active with a script nesting level above
+    #   0: `open()` is a no-op that returns the document, and `write()` inserts
+    #   the parsed markup right after the running script (where the insertion
+    #   point would be), or at the end of the body when that script is not in
+    #   the body.
+    # - Otherwise `write()` with no script-created parser runs the document open
+    #   steps first (the page is gone), and every write re-parses the whole
+    #   input written since `open()` as a fresh document, whose children replace
+    #   the document's. Earlier writes' nodes are therefore not the same objects
+    #   after a later write, and scripts in written markup do not run.
+    #
+    # Spec: https://html.spec.whatwg.org/#dynamic-markup-insertion
+
+    # `document.write(...text)` — the document write steps with lineFeed false.
     def write(*args)
-      html = args.join
-      fragment = Parser.fragment(html, owner_doc: @backend_doc)
-      removed = []
-      added = fragment.children.to_a
-      body_node = body.__dommy_backend_node__
-      added.each { |node| body_node.add_child(node) }
-      notify_child_list_mutation(target_node: body_node, added_nodes: added, removed_nodes: removed)
-      nil
+      document_write(args, line_feed: false)
     end
 
-    # No-ops — real browsers reset the DOM on `open()` and flush
-    # pending writes on `close()`. We don't model the parse pipeline.
-    def open
-      nil
+    # `document.writeln(...text)` — the document write steps with lineFeed true.
+    def writeln(*args)
+      document_write(args, line_feed: true)
     end
 
+    # `document.open()` — the document open steps; returns the document. With
+    # three arguments it is `window.open(url, name, features)` instead.
+    #
+    # Spec: https://html.spec.whatwg.org/#dom-document-open
+    def open(*args)
+      return open_window(args) if args.length >= 3
+
+      document_open_steps
+    end
+
+    # `document.close()` — closes the input stream a script-created parser
+    # reads: the parser reaches EOF and "stops parsing", so the document goes
+    # "interactive" (DOMContentLoaded) then "complete" (load at the window,
+    # when there is one). Dispatched synchronously rather than as queued tasks.
+    #
+    # Spec: https://html.spec.whatwg.org/#dom-document-close
     def close
+      raise DOMException::InvalidStateError, "close() is not supported on an XML document" unless html_document?
+      raise_if_markup_insertion_forbidden!("close")
+      return nil if @script_created_input.nil?
+
+      # The parser reaches EOF. With nothing written it has seen no doctype
+      # (quirks mode) and, into an empty document, builds html/head/body.
+      if @script_created_input.empty?
+        if @backend_doc.children.to_a.empty?
+          reparse_script_created_input
+        else
+          @quirks_mode = true
+        end
+      end
+      @script_created_input = nil
+      __internal_set_ready_state__("interactive")
+      __internal_set_ready_state__("complete")
       nil
     end
 
@@ -1722,12 +2073,11 @@ module Dommy
     end
 
     def __js_get__(key)
-      if key.start_with?("on") && key.length > 2
-        # An event handler IDL attribute (GlobalEventHandlers /
-        # DocumentAndElementEventHandlers, plus onreadystatechange and
-        # onvisibilitychange): the registered handler, or null when unset —
-        # matching Element's on* getter.
-        return @on_handlers&.[](event_name_from_on(key))
+      if Internal::EventHandlers.idl_attribute?(self, key)
+        # An event handler IDL attribute Document declares (GlobalEventHandlers,
+        # plus onreadystatechange, onvisibilitychange, onfullscreenchange, …):
+        # the registered handler, or null when unset — matching Element's.
+        return on_handler(event_name_from_on(key))
       end
 
       case key
@@ -1753,10 +2103,17 @@ module Dommy
         read_title
       when "dir"
         dir
+      when "fgColor" then fg_color
+      when "linkColor" then link_color
+      when "vlinkColor" then vlink_color
+      when "alinkColor" then alink_color
+      when "bgColor" then bg_color
       when "cookie"
         cookie
       when "nodeType"
         9
+      when "customElementRegistry"
+        __internal_custom_element_registry__
       when "isConnected"
         # A document is its own shadow-including root, so it is always connected.
         true
@@ -1784,7 +2141,7 @@ module Dommy
       when "designMode"
         @design_mode || "off"
       when "lastModified"
-        @last_modified || "01/01/1970 00:00:00"
+        last_modified
       when "readyState"
         # "complete" by default (the document is fully parsed before scripts
         # run); an embedder can replay "loading" → "interactive" → "complete"
@@ -1854,20 +2211,36 @@ module Dommy
       end
     end
 
+    # The elements of this document tree that can give its Window a named
+    # property (HTML §7.2.2.3 "Named access on the Window object"), in tree
+    # order: navigable containers, elements with an id, and embed / form /
+    # img / object elements with a name. Window#__js_named_props__ applies the
+    # spec's rules to them.
+    def __internal_window_named_candidates__
+      @backend_doc.css("[id], [name], iframe, frame").filter_map { |node| wrap_node(node) }
+    end
+
     # The document's supported property names (for `"name" in document`): for
     # each exposed element in tree order, its id when it is a named element with
     # that name, then its name.
     def __js_named_props__
       names = []
       named_getter_nodes.each do |node|
-        id = node["id"].to_s
+        id = Backend.no_namespace_attribute_value(node, "id").to_s
         names << id if named_element?(node, id)
-        name = node["name"].to_s
+        name = Backend.no_namespace_attribute_value(node, "name").to_s
         names << name if named_element?(node, name)
       end
       names.uniq
     end
 
+    # The named getter on its own, for the bridge to read a supported name
+    # BEFORE the builtins ([LegacyOverrideBuiltIns]: `<form name=body>` makes
+    # `document.body` that form).
+    def __js_named_get__(name)
+      document_named_property(name)
+    end
+
     # Resolve a document named-getter property: nil when unsupported, a single
     # element (a named iframe yields its content window), or an HTMLCollection
     # when several elements share the name.
@@ -1884,39 +2257,8 @@ module Dommy
       el.local_name.to_s.casecmp?("iframe") && el.respond_to?(:content_window) ? (el.content_window || el) : el
     end
 
-    private
-
-    # "The html element": the document element when it is an HTML <html>.
-    def html_element
-      root = document_element
-      root if root.is_a?(HTMLElement) && root.local_name == "html"
-    end
-
-    # An element is a named element with the name `name` when it is one of the
-    # exposed kinds and either carries that `name`, or is an object with that
-    # `id`, or is an img whose id it is and which also has a non-empty name.
-    def named_element?(node, name)
-      return false if name.empty?
-      return false unless %w[embed form iframe img object].include?(node.name.to_s.downcase)
-      return true if node["name"] == name
-      return true if node.name.to_s.casecmp?("object") && node["id"] == name
-
-      node.name.to_s.casecmp?("img") && node["id"] == name && !node["name"].to_s.empty?
-    end
-
-    # Elements the document's named getter exposes, in tree order.
-    def named_getter_nodes
-      @backend_doc.css("embed, form, iframe, img, object")
-    end
-
-    def document_named_property_nodes(name)
-      named_getter_nodes.select { |node| named_element?(node, name) }.map { |node| wrap_node(node) }.compact
-    end
-
-    public
-
     def __js_set__(key, value)
-      if key.start_with?("on") && key.length > 2
+      if Internal::EventHandlers.idl_attribute?(self, key)
         # `document.onXxx = fn` registers fn as a single named handler; nil
         # removes it. Without this the assignment became a plain JS expando and
         # the handler never fired (e.g. `document.onreadystatechange`).
@@ -1931,14 +2273,27 @@ module Dommy
         self.cookie = value.to_s
       when "dir"
         self.dir = value
+      when "fgColor" then self.fg_color = value
+      when "linkColor" then self.link_color = value
+      when "vlinkColor" then self.vlink_color = value
+      when "alinkColor" then self.alink_color = value
+      when "bgColor" then self.bg_color = value
       when "designMode"
         # Enumerated: only "on"/"off" (case-insensitive), else ignored.
         v = value.to_s.downcase
         @design_mode = v if %w[on off].include?(v)
+      when "domain"
+        self.domain = value.to_s
       when "location"
         # `document.location = url` navigates, same as `location.href = url`.
         loc = @default_view&.__js_get__("location")
         loc&.__js_set__("href", value)
+      when "body"
+        # WebIDL `attribute HTMLElement? body`: anything but an HTMLElement or
+        # null fails the conversion before the setter's own checks run.
+        raise Bridge::TypeError, "document.body must be an HTMLElement or null" unless value.nil? || value.is_a?(HTMLElement)
+
+        self.body = value
       when "head", "documentElement"
         # Readonly attributes: assignment is a silent no-op. Handle it here so the
         # bridge doesn't store a JS-side expando that would shadow the getter.
@@ -1998,9 +2353,8 @@ module Dommy
         document_remove_child(args[0])
       when "insertBefore"
         raise Bridge::TypeError, "insertBefore requires 2 arguments." if args.length < 2
-        Internal::WebIDL.nullable_node!(args[1])
 
-        document_insert_before(args[0], args[1])
+        insert_before(args[0], args[1])
       when "replaceChild"
         document_replace_child(args[0], args[1])
       when "moveBefore"
@@ -2013,7 +2367,8 @@ module Dommy
       when "normalize"
         normalize
       when "writeln"
-        write(*(args + ["\n"]))
+        writeln(*args)
+        Bridge::UNDEFINED
       when "exitFullscreen"
         exit_fullscreen
       when "startViewTransition"
@@ -2021,17 +2376,13 @@ module Dommy
         # synchronously; return a ViewTransition with already-resolved
         # `finished` / `ready` / `updateCallbackDone` promises.
         callback = args[0]
-        if callback.respond_to?(:__js_call__)
-          callback.__js_call__("call", [])
-        elsif callback.respond_to?(:call)
-          callback.call
-        end
+        CallableInvoker.invoke(callback)
 
         ViewTransition.new(@default_view)
       when "createElement"
-        create_element(args[0])
+        create_element(args[0], args[1])
       when "createElementNS"
-        create_element_ns(args[0], args[1])
+        create_element_ns(args[0], args[1], args[2])
       when "createTextNode"
         create_text_node(args[0])
       when "createComment"
@@ -2069,7 +2420,8 @@ module Dommy
       when "createEvent"
         create_event(args[0])
       when "importNode"
-        import_node(args[0], args[1])
+        # A missing options argument is undefined (the default), not null.
+        import_node(args[0], args.fetch(1, Bridge::UNDEFINED))
       when "adoptNode"
         adopt_node(args[0])
       when "hasFocus"
@@ -2088,10 +2440,12 @@ module Dommy
         dispatch_event(args[0])
       when "write"
         write(*args)
+        Bridge::UNDEFINED
       when "open"
-        open
+        open(*args)
       when "close"
         close
+        Bridge::UNDEFINED
       else
         nil
       end
@@ -2112,16 +2466,113 @@ module Dommy
       return if @ready_state == state
 
       @ready_state = state
-      dispatch_event(Event.new("readystatechange"))
+      @loading_lifecycle = true if state == "loading"
+      __internal_fire_event__("readystatechange")
       case state
       when "interactive"
-        dispatch_event(Event.new("DOMContentLoaded", "bubbles" => true))
+        __internal_fire_event__("DOMContentLoaded", {"bubbles" => true})
       when "complete"
-        @default_view&.dispatch_event(Event.new("load"))
+        fire_load_and_pageshow
       end
       nil
     end
 
+    # The document's current readiness ("loading" / "interactive" /
+    # "complete").
+    def __internal_ready_state__ = @ready_state
+
+    # HTML "update the current document readiness" alone: readyState becomes
+    # `state` and `readystatechange` fires — without the milestone event
+    # __internal_set_ready_state__ adds. The parser's "the end" fires
+    # DOMContentLoaded and load from tasks of their own (see ScriptBoot).
+    def __internal_update_readiness__(state)
+      state = state.to_s
+      return nil if @ready_state == state
+
+      @ready_state = state
+      @loading_lifecycle = true if state == "loading"
+      __internal_fire_event__("readystatechange")
+      nil
+    end
+
+    # "The end", its DOMContentLoaded task: fire a trusted, bubbling
+    # `DOMContentLoaded` at the document.
+    def __internal_fire_dom_content_loaded__
+      __internal_fire_event__("DOMContentLoaded", {"bubbles" => true})
+      nil
+    end
+
+    # "The end", its load task: readiness becomes "complete", then `load` at
+    # the window and `pageshow`, and the document is completely loaded.
+    def __internal_finish_loading__
+      return nil unless @loading_lifecycle
+
+      __internal_update_readiness__("complete")
+      fire_load_and_pageshow
+      nil
+    end
+
+    # Whether something delays this document's load event: a child navigable
+    # still navigating (HTML "potentially delays the load event", iframe).
+    def __internal_load_delayed__?
+      @backend_doc.css("iframe").any? do |node|
+        frame = wrap_node(node)
+        frame.is_a?(HTMLIFrameElement) && frame.__internal_navigation_pending__?
+      end
+    end
+
+    # The end of loading, from "update the current document readiness to
+    # complete": fire a trusted `load` at the window with the legacy target
+    # override (so `event.target` is this document), then `pageshow` (persisted
+    # false), and mark the document completely loaded — ready for post-load
+    # tasks such as a print() requested while it loaded.
+    def fire_load_and_pageshow
+      view = @default_view
+      if view
+        load = Event.new("load")
+        load.__internal_set_target__(self)
+        view.dispatch_event(load.__internal_mark_trusted__)
+        view.dispatch_event(__internal_page_transition_event__("pageshow"))
+      end
+      @loading_lifecycle = false
+      view.__internal_ready_for_post_load_tasks__ if view.respond_to?(:__internal_ready_for_post_load_tasks__)
+      run_after_load_tasks
+    end
+
+    # Queue `block` as a task once this document has completely loaded (at
+    # once when it already has).
+    def __internal_after_load__(&block)
+      if __internal_completely_loaded__?
+        queue_after_load_task(block)
+      else
+        (@after_load_tasks ||= []) << block
+      end
+      nil
+    end
+
+    def run_after_load_tasks
+      tasks = @after_load_tasks || []
+      @after_load_tasks = nil
+      tasks.each { |task| queue_after_load_task(task) }
+    end
+    private :run_after_load_tasks
+
+    def queue_after_load_task(block)
+      scheduler = __internal_scheduler__
+      scheduler ? scheduler.set_timeout(block, 0) : block.call
+    end
+    private :queue_after_load_task
+    private :fire_load_and_pageshow
+
+    # A trusted page transition event (`pageshow` / `pagehide`) for this
+    # document's window: bubbles, cancelable, `persisted` false (there is no
+    # back/forward cache), targeted at the document (legacy target override).
+    def __internal_page_transition_event__(type, persisted: false)
+      event = PageTransitionEvent.new(type, "persisted" => persisted, "bubbles" => true, "cancelable" => true)
+      event.__internal_set_target__(self)
+      event.__internal_mark_trusted__
+    end
+
     # Set `document.currentScript` to the <script> element being executed (and
     # back to nil afterward). The host (script boot) brackets each classic
     # script run with this so code reading `document.currentScript` sees its own
@@ -2131,15 +2582,26 @@ module Dommy
       nil
     end
 
+    # HTML "execute the script element", for a classic script: currentScript
+    # is the element while its script runs (null when the element's root is a
+    # shadow root — not "in a document tree", since a script removed before it
+    # runs still points at itself), then goes back to whatever it was before,
+    # so a script inserted and run from inside another script leaves the outer
+    # one current again. A caller reports the script's exception from inside
+    # the block: the report is part of the run, while currentScript is set.
+    def __internal_with_current_script__(element)
+      old = @__current_script__
+      @__current_script__ = element.root_node.is_a?(ShadowRoot) ? nil : element
+      yield
+    ensure
+      @__current_script__ = old
+    end
+
     # Delegate node wrapping to NodeWrapperCache
     def wrap_node(node)
       @node_wrapper_cache.wrap(node)
     end
 
-    def wrap_cloned_element_ns(node, namespace, prefix, local, qualified_name)
-      @node_factory.wrap_cloned_element_ns(node, namespace, prefix, local, qualified_name)
-    end
-
     # The task scheduler this document's own tasks run on: its browsing context's
     # when it has one, otherwise the one handed to it by whatever built it (a
     # DOMParser document has no defaultView but still queues tasks on the window
@@ -2159,25 +2621,59 @@ module Dommy
     # cleared (HTML §4.12.1.1: the HTML/XML parser clears it on every element it
     # inserts, so a plain parsed `<script>` reports `.async === false`).
     def __internal_run_parsed_insertion_steps__
-      return nil unless @backend_doc.respond_to?(:css)
-
       # HTML-namespace only: a `css` query matches on local name, so a
       # `<details>` the parser put inside `<svg>` answers it too, as an
       # SVGElement that has none of these steps.
-      elements = @backend_doc.css("details").filter_map { |node| __internal_html_element_wrapper__(node) }
+      elements = parsed_css("details").filter_map { |node| __internal_html_element_wrapper__(node) }
       HTMLDetailsElement.run_insertion_steps(elements) unless elements.empty?
-      @backend_doc.css("select").each { |node| __internal_html_element_wrapper__(node)&.__internal_settle_selectedness_once__ }
-      @backend_doc.css("script").each { |node| __internal_html_element_wrapper__(node)&.__internal_mark_parser_inserted__ }
+      parsed_css("select").each { |node| __internal_html_element_wrapper__(node)&.__internal_settle_selectedness_once__ }
+      parsed_css("script").each do |node|
+        script = __internal_html_element_wrapper__(node)
+        next unless script
+
+        script.__internal_mark_parser_inserted__
+        script.__internal_mark_parser_document__
+      end
+      parsed_css("meta[http-equiv]").each { |node| __internal_html_element_wrapper__(node)&.__internal_run_pragma__ }
+      # An open dialog the parser inserted runs its dialog setup steps.
+      parsed_css("dialog[open]").each do |node|
+        dialog = __internal_html_element_wrapper__(node)
+        dialog.__internal_dialog_inserted__ if dialog.respond_to?(:__internal_dialog_inserted__)
+      end
+      # Each element the parser inserted with an autofocus attribute is an
+      # autofocus candidate (only in a document with a browsing context).
+      parsed_css("[autofocus]").each do |node|
+        element = wrap_node(node)
+        __internal_autofocus_inserted__(element) if element.respond_to?(:autofocus) && element.is_connected?
+      end
+      nil
+    end
+
+    # Script boot replays the parser's insertion of each `<iframe>` (in tree
+    # order): its post-connection steps create its child navigable and process
+    # its attributes, so a srcless one fires `load` and one with a `src` starts
+    # navigating. Only a document with a browsing context has child navigables.
+    def __internal_process_parsed_iframes__
+      return nil unless @default_view
+
+      parsed_css("iframe").each do |node|
+        frame = __internal_html_element_wrapper__(node)
+        frame.__internal_parser_inserted__ if frame.is_a?(HTMLIFrameElement)
+      end
       nil
     end
 
+    # HTML's pragma-set default language (`<meta http-equiv=content-language
+    # content=…>`): nil until such a pragma has been processed.
+    attr_accessor :__internal_pragma_default_language__
+
     # DOMParser parses with scripting disabled (HTML) or XML scripting support
     # disabled, so every script it makes is "already started": moved or cloned
     # into a document that runs scripts, it still does not run. Found by local
     # name, so an XML document's prefixed `h:script` counts too.
-    def __internal_mark_scripts_already_started__
-      Internal::NodeTraversal.subtree_nodes(@backend_doc).each do |node|
-        next unless node.respond_to?(:element?) && node.element?
+    def __internal_mark_scripts_already_started__(root = @backend_doc)
+      Internal::NodeTraversal.subtree_nodes(root).each do |node|
+        next unless node.element?
         next unless node.local_name == "script"
 
         wrapper = wrap_node(node)
@@ -2217,26 +2713,6 @@ module Dommy
       wrapper
     end
 
-    # The wrapper already cached for a backend node, or nil — never builds one.
-    def __internal_cached_wrapper__(node)
-      @node_wrapper_cache.cached_wrapper(node)
-    end
-
-    # Recorded when an element is created outside the HTML namespace or with a
-    # prefix. Deep cloning only has to carry that metadata across for a document
-    # that has some — which the overwhelming majority never do, so the ordinary
-    # `body.cloneNode(true)` keeps walking nothing.
-    def __internal_note_namespaced_element__(namespace, prefix)
-      return if namespace == Element::HTML_NAMESPACE && prefix.nil?
-
-      @namespaced_elements = true
-      nil
-    end
-
-    def __internal_namespaced_elements__?
-      @namespaced_elements == true
-    end
-
     # Clear the cached wrapper so the next `wrap_node` creates a new
     # one. Used by `customElements.define` to upgrade nodes that were
     # constructed before the registration landed.
@@ -2266,6 +2742,69 @@ module Dommy
       @shadow_registry.find_for_host(host_node)
     end
 
+    # DOM "allow declarative shadow roots": whether the document's own parser
+    # (the page parse, document.write) attaches declarative shadow roots. On
+    # for a browsing context's documents and parseHTMLUnsafe()'s; off for
+    # createHTMLDocument(), DOMParser and `new Document()`; a clone keeps it.
+    attr_writer :__internal_allow_declarative_shadow_roots__
+
+    def __internal_allow_declarative_shadow_roots__? = @__internal_allow_declarative_shadow_roots__ ? true : false
+
+    # The document's parser has built `root_bn`'s subtree: attach its
+    # declarative shadow roots, when the document allows them. The shadow
+    # roots are the document's parsed roots from then on (their scripts run
+    # at boot, their elements get the parser's insertion steps). Returns them.
+    def __internal_attach_declarative_shadow_roots__(root_bn, top_host: nil)
+      return [] unless __internal_allow_declarative_shadow_roots__? && Backend.html_backed?(@backend_doc)
+
+      roots = Internal::DeclarativeShadowRoots.attach(self, root_bn, top_host: top_host)
+      (@parser_shadow_roots ||= []).concat(roots)
+      roots
+    end
+
+    # The roots of what the document's parser built: the document, and the
+    # declarative shadow roots it attached.
+    def __internal_parsed_roots__
+      return [@backend_doc] unless @parser_shadow_roots
+
+      [@backend_doc, *@parser_shadow_roots.map(&:__dommy_backend_node__)]
+    end
+
+    # The document's parser-inserted scripts, in the order the parser met
+    # them: tree order, where a declarative shadow tree's contents come at
+    # the place its template was. With no declarative shadow roots, that is
+    # `document.scripts`.
+    def __internal_parser_scripts__
+      return scripts.to_a unless @parser_shadow_roots
+
+      parsed_shadows = @parser_shadow_roots.to_h { |root| [Backend.identity_key(root.host.__dommy_backend_node__), root] }
+      list = []
+      collect_parser_scripts(@backend_doc, parsed_shadows, list)
+      list
+    end
+
+    # Whether any shadow root was ever attached in this document — the HTML
+    # serializer's fast path asks before looking for shadow hosts.
+    def __internal_any_shadow_roots__? = @shadow_registry.any?
+
+    # Whether an element of this document has an is value it does not carry
+    # as an `is` attribute (createElement's `{is}`, a customized built-in's
+    # constructor, a clone of either) — the serializer's other reason to
+    # leave its fast path. The elements given an is value are held weakly.
+    def __internal_any_is_values__?
+      return false unless @is_value_elements
+
+      @is_value_elements.keys.any? do |element|
+        node = element.__dommy_backend_node__
+        current = @node_wrapper_cache.peek(node) || element
+        current.__internal_is_value__ && !Backend.has_attribute_ns?(node, nil, "is")
+      end
+    end
+
+    def __internal_note_is_value__(element)
+      (@is_value_elements ||= ObjectSpace::WeakMap.new)[element] = true
+    end
+
     # Every element among `root`'s shadow-including inclusive descendants, as
     # backend nodes, in shadow-including tree order: an element, then the shadow
     # tree it hosts, then its children. The whole list, shadow trees included, is
@@ -2277,18 +2816,6 @@ module Dommy
       nil
     end
 
-    def shadow_including_elements(root, list = [])
-      elements = root.respond_to?(:element?) && root.element? ? [root] : []
-      elements.concat(root.css("*").to_a) if root.respond_to?(:css)
-      elements.each do |element|
-        list << element
-        shadow = @shadow_registry.find_for_host(element)
-        shadow_including_elements(shadow.__dommy_backend_node__, list) if shadow
-      end
-      list
-    end
-    private :shadow_including_elements
-
     def __internal_shadow_root_containing__(node)
       @shadow_registry.find_enclosing(node)
     end
@@ -2326,8 +2853,67 @@ module Dommy
       @mutation_coordinator.notify_disconnected_subtree(nk)
     end
 
-    def __internal_notify_attribute_changed__(element, name, old_value, new_value)
-      @mutation_coordinator.notify_attribute_changed(element, name, old_value, new_value)
+    # DOM "custom element registry" of the document: the one initialize()
+    # set, else its window's (none without a browsing context).
+    attr_writer :__internal_custom_element_registry__
+
+    def __internal_custom_element_registry__
+      @__internal_custom_element_registry__ || (@default_view.custom_elements if @default_view.respond_to?(:custom_elements))
+    end
+
+    # The element the HTML element constructor makes for `new MyElement()`.
+    def __internal_create_custom_element__(definition)
+      @node_factory.create_custom_element(definition)
+    end
+
+    # HTML "try to upgrade an element": enqueue an upgrade reaction when the
+    # registry `element` looks definitions up in has one for it.
+    def __internal_try_to_upgrade__(element)
+      registry = element.__internal_ce_registry__
+      return unless registry&.any_definitions?
+
+      definition = CustomElementRegistry.lookup(registry, element.namespace_uri, element.local_name,
+                                                element.__internal_is_value__)
+      Internal::CEReactions.enqueue_upgrade(element, definition) if definition
+    end
+
+    # The elements a parser or a clone just created in this document without
+    # the synchronous custom elements flag (DOM "create an element" step 6.3),
+    # with `registry` (the parser's intended parent's, the original's): each
+    # one gets the registry when it is a scoped one, and each one a definition
+    # applies to an upgrade reaction. `nodes` are backend nodes, each walked
+    # in tree order (a template's contents are not its children, and belong
+    # to a document with no registry).
+    def __internal_enqueue_created_upgrades__(nodes, registry = CustomElementRegistry.for_document(self))
+      explicit = !registry.equal?(CustomElementRegistry.effective_global_for(self))
+      return unless explicit || registry&.any_definitions?
+
+      (nodes.is_a?(Array) ? nodes : [nodes]).each do |root|
+        Internal::NodeTraversal.subtree_nodes(root).each do |node|
+          next unless node.element?
+
+          known = __internal_peek_wrapper__(node)
+          if explicit
+            known ||= wrap_node(node)
+            known.__internal_ce_data__.registry = registry
+          end
+          next if registry.nil?
+          next unless Backend.namespace_uri(node) == Element::HTML_NAMESPACE
+
+          # The is value a wrapper was made with (a clone's), else the one
+          # the parser gives it: its `is` attribute.
+          is_value = known ? known.__internal_is_value__ : Backend.get_attribute_ns(node, nil, "is")
+          definition = registry.lookup_definition(node.name, is_value)
+          next unless definition
+
+          element = known || wrap_node(node)
+          Internal::CEReactions.enqueue_upgrade(element, definition) if element
+        end
+      end
+    end
+
+    def __internal_notify_attribute_changed__(element, name, old_value, new_value, namespace = nil)
+      @mutation_coordinator.notify_attribute_changed(element, name, old_value, new_value, namespace)
     end
 
     def register_observer(observer)
@@ -2446,6 +3032,184 @@ module Dommy
       end
     end
 
+    # The document write steps (without Trusted Types).
+    #
+    # Spec: https://html.spec.whatwg.org/#document-write-steps
+    def document_write(args, line_feed:)
+      string = args.map { |a| a.nil? ? "null" : a.to_s }.join
+      string += "\n" if line_feed
+      raise DOMException::InvalidStateError, "write() is not supported on an XML document" unless html_document?
+      raise_if_markup_insertion_forbidden!("write")
+
+      return boot_script_write(string) if @script_created_input.nil? && boot_script_running?
+
+      document_open_steps if @script_created_input.nil?
+      # The open steps return early (no script-created parser) only when the
+      # parser is active, which the branch above already took.
+      return nil if @script_created_input.nil?
+
+      @script_created_input << string
+      reparse_script_created_input
+      nil
+    end
+
+    # Whether a page script is running while the page boots: the closest Dommy
+    # has to "an active parser whose script nesting level is greater than 0".
+    def boot_script_running?
+      @ready_state == "loading" && !@__current_script__.nil?
+    end
+
+    # The document open steps, minus what Dommy does not model (the origin
+    # check against the entry document, unload counters, stopping a
+    # navigation, and the URL and history update steps).
+    #
+    # Spec: https://html.spec.whatwg.org/#document-open-steps
+    def document_open_steps
+      raise DOMException::InvalidStateError, "open() is not supported on an XML document" unless html_document?
+      raise_if_markup_insertion_forbidden!("open")
+      return self if boot_script_running?
+      # A second open() while a script-created parser is open keeps it (the
+      # spec's steps re-run, but the written input so far is already gone with
+      # the children they replace).
+      erase_all_event_listeners_and_handlers
+      document_replace_children([])
+      @quirks_mode = false
+      @script_created_input = +""
+      unless @ready_state == "loading"
+        @ready_state = "loading"
+        __internal_fire_event__("readystatechange")
+      end
+      self
+    end
+
+    # Insert what a boot-time script wrote at the insertion point: right after
+    # the running script when it sits in the body, else at the end of the body
+    # (or of the document element when there is no body).
+    def boot_script_write(string)
+      script_bn = @__current_script__&.__dommy_backend_node__
+      parent_bn = script_bn&.parent
+      in_body = parent_bn && body && parent_bn != @backend_doc &&
+                Internal::NodeTraversal.subtree_nodes(body.__dommy_backend_node__).include?(parent_bn)
+      target_bn = in_body ? parent_bn : (body || document_element)&.__dommy_backend_node__
+      return nil unless target_bn
+
+      context = target_bn.element? ? target_bn : nil
+      fragment = Parser.fragment(string, owner_doc: @backend_doc, context: context)
+      # The document's parser reads the markup: a top-level declarative
+      # template's adjusted current node is the element it is written into.
+      __internal_attach_declarative_shadow_roots__(fragment, top_host: target_bn)
+      added = fragment.children.to_a
+      return nil if added.empty?
+
+      # The document's parser creates a defined element by running its
+      # constructor; Dommy's parsed the markup already, so each one is
+      # upgraded instead, before it is inserted.
+      __internal_enqueue_created_upgrades__(added)
+
+      if in_body
+        reference = script_bn
+        added.each do |node|
+          reference.add_next_sibling(node)
+          reference = node
+        end
+      else
+        added.each { |node| target_bn.add_child(node) }
+      end
+      @__document_writing = true
+      begin
+        notify_child_list_mutation(target_node: target_bn, added_nodes: added, removed_nodes: [])
+      ensure
+        @__document_writing = false
+      end
+      nil
+    end
+
+    # Whether the insertion under way comes from document.write: an external
+    # script it writes is the parser's pending parsing-blocking script, which
+    # runs as soon as the writing script returns — before the parser goes on.
+    def __internal_document_writing__ = @__document_writing == true
+
+    # Re-parse everything written since open() as a whole document and make
+    # its children the document's (see "Dynamic markup insertion" above).
+    # HTML's throw-on-dynamic-markup-insertion counter: while the parser runs
+    # custom element constructors and reactions (see #parser_runs_scripts),
+    # open(), write() and close() are an InvalidStateError.
+    def raise_if_markup_insertion_forbidden!(operation)
+      return unless @throw_on_dynamic_markup_insertion_counter.to_i.positive?
+
+      raise DOMException::InvalidStateError, "#{operation}() is not allowed while the parser constructs a custom element"
+    end
+
+    # The parser's custom element work for markup it inserts: the
+    # constructors ("create an element for a token" with willExecuteScript)
+    # and the reactions they enqueue run before it continues, with the
+    # throw-on-dynamic-markup-insertion counter raised.
+    def parser_runs_scripts
+      @throw_on_dynamic_markup_insertion_counter = @throw_on_dynamic_markup_insertion_counter.to_i + 1
+      Internal::CEReactions.scope { yield }
+    ensure
+      @throw_on_dynamic_markup_insertion_counter -= 1
+    end
+
+    def reparse_script_created_input
+      parser_runs_scripts { reparse_script_created_input_now }
+    end
+
+    def reparse_script_created_input_now
+      parsed = Document.new(nil, backend_doc: Backend.parse(@script_created_input))
+      @quirks_mode = parsed.quirks_mode?
+      parsed.__internal_mark_scripts_already_started__
+      # What the parser builds, not what a script inserts: a doctype and an
+      # element go in together, which replaceChildren's checks would refuse.
+      removed = @backend_doc.children.to_a
+      removed.each { |child| detach_node(child) }
+      added = document_insertion_nodes(parsed.child_nodes.to_a)
+      added.each { |n| @backend_doc.add_child(n) }
+      # The written markup is this document's parser's: its declarative
+      # shadow roots, when the document allows them, replace the last parse's.
+      @parser_shadow_roots = nil
+      __internal_attach_declarative_shadow_roots__(@backend_doc).each do |root|
+        __internal_mark_scripts_already_started__(root.__dommy_backend_node__)
+      end
+      notify_document_child_list(added: added, removed: removed)
+    end
+
+    # "Erase all event listeners and handlers" for the document's
+    # shadow-including inclusive descendants and, for a window's document, the
+    # window. Only nodes that have a wrapper can hold listeners.
+    def erase_all_event_listeners_and_handlers
+      targets = [self]
+      collect_listener_targets(@backend_doc, targets)
+      targets << @default_view if @default_view
+      targets.each { |t| t.__internal_erase_event_listeners_and_handlers__ if t.respond_to?(:__internal_erase_event_listeners_and_handlers__) }
+    end
+
+    def collect_listener_targets(root_bn, targets)
+      Internal::NodeTraversal.subtree_nodes(root_bn).each do |bn|
+        wrapper = @node_wrapper_cache.peek(bn)
+        next unless wrapper
+
+        targets << wrapper unless wrapper.equal?(self)
+        shadow = wrapper.respond_to?(:__internal_shadow_root__) ? wrapper.__internal_shadow_root__ : nil
+        next unless shadow
+
+        targets << shadow
+        collect_listener_targets(shadow.__dommy_backend_node__, targets) if shadow.__dommy_backend_node__
+      end
+    end
+
+    # document.open(url, name, features) is window.open; it needs a fully
+    # active document (one with a window, here).
+    def open_window(args)
+      raise DOMException::InvalidAccessError, "the document is not fully active" unless @default_view
+
+      @default_view.__js_call__("open", args)
+    end
+
+    private :document_write, :boot_script_running?, :document_open_steps, :boot_script_write,
+            :reparse_script_created_input, :erase_all_event_listeners_and_handlers,
+            :collect_listener_targets, :open_window
+
     # Unlink a backend node from its parent and queue a childList removal record
     # capturing the node's position (previous/next sibling) BEFORE the unlink, so
     # the record's previousSibling/nextSibling are correct (the coordinator can't
@@ -2524,7 +3288,7 @@ module Dommy
     # https://github.com/takahashim/dommy/issues/24
     def __internal_normalize__(root)
       text_nodes = []
-      root.traverse { |node| text_nodes << node if node.respond_to?(:text?) && node.text? }
+      root.traverse { |node| text_nodes << node if node.text? }
 
       text_nodes.each do |node|
         next unless node.parent # already removed as part of an earlier run
@@ -2535,7 +3299,7 @@ module Dommy
         end
 
         sib = node.next
-        while sib.respond_to?(:text?) && sib.text?
+        while sib&.text?
           following = sib.next
           data = sib.content.to_s
           # The offset the sibling's data lands at inside the survivor — the
@@ -2600,8 +3364,8 @@ module Dommy
 
     # Delegate factory methods to NodeWrapperCache
 
-    def create_element(name)
-      @node_factory.create_element(name)
+    def create_element(name, options = nil)
+      @node_factory.create_element(name, options)
     end
 
     def create_text_node(text)
@@ -2659,6 +3423,123 @@ module Dommy
 
     private
 
+    # HTML "is a registrable domain suffix of or is equal to" (a single label
+    # stands in for the public suffix; see #domain=).
+    def registrable_domain_suffix_or_equal?(suffix_string, original_host)
+      return false if suffix_string.empty?
+
+      suffix = Internal::UrlParser.parse("http://#{suffix_string}/").host.to_s
+      return true if suffix == original_host
+      return false if ip_host?(suffix) || ip_host?(original_host)
+      return false unless original_host.end_with?(".#{suffix}")
+      # The suffix may not itself be a public suffix.
+      return false unless suffix.include?(".")
+
+      true
+    rescue Internal::UrlParser::Failure
+      false
+    end
+
+    def ip_host?(host)
+      host.start_with?("[") || host.match?(/\A\d+\.\d+\.\d+\.\d+\z/)
+    end
+
+
+    def creator_base_url
+      @creator_base_url if @creator_base_url && FALLBACK_BASE_URLS.include?(url)
+    end
+
+    # importNode is a clone, so the HTML cloning steps run for it as they do
+    # for cloneNode (#__internal_apply_cloning_steps__): the live state Dommy
+    # keeps on a wrapper — an input's dirty value, a script's "already
+    # started" — is copied onto the new node. The originals' wrappers belong
+    # to the source document, so they are looked up there.
+    def apply_imported_cloning_steps(src_root, copy_root, deep, source_document)
+      return unless source_document.respond_to?(:__internal_peek_wrapper__)
+
+      src_nodes = deep ? Internal::NodeTraversal.subtree_nodes(src_root) : [src_root]
+      copy_nodes = deep ? Internal::NodeTraversal.subtree_nodes(copy_root) : [copy_root]
+      return unless src_nodes.length == copy_nodes.length
+
+      src_nodes.zip(copy_nodes).each do |orig, copy|
+        state = source_document.__internal_peek_wrapper__(orig)&.then { |w| w.respond_to?(:__internal_cloning_state__) && w.__internal_cloning_state__ }
+        next unless state
+
+        wrapper = wrap_node(copy)
+        wrapper.__internal_apply_cloning_state__(state) if wrapper.respond_to?(:__internal_apply_cloning_state__)
+      end
+    end
+
+    def node_adopter
+      @node_adopter ||= Internal::NodeAdopter.new(self)
+    end
+
+    def collect_parser_scripts(node, parsed_shadows, list)
+      shadow = node.element? ? parsed_shadows[Backend.identity_key(node)] : nil
+      shadow = nil unless shadow&.host&.__dommy_backend_node__ == node
+      pending = shadow
+      node.children.each do |child|
+        if pending && (before = pending.__internal_parsed_before__) && Backend.identity_key(child) == Backend.identity_key(before)
+          collect_parser_scripts(pending.__dommy_backend_node__, parsed_shadows, list)
+          pending = nil
+        end
+        next unless child.element?
+
+        if child.local_name == "script" && (script = __internal_html_element_wrapper__(child))
+          list << script
+        end
+        collect_parser_scripts(child, parsed_shadows, list)
+      end
+      collect_parser_scripts(pending.__dommy_backend_node__, parsed_shadows, list) if pending
+    end
+
+    # A `css` query over every root the parser built.
+    def parsed_css(selector)
+      roots = __internal_parsed_roots__
+      return @backend_doc.css(selector) if roots.size == 1
+
+      roots.flat_map { |root| root.css(selector).to_a }
+    end
+
+    def shadow_including_elements(root, list = [])
+      elements = root.element? ? [root] : []
+      elements.concat(root.css("*").to_a)
+      elements.each do |element|
+        list << element
+        shadow = @shadow_registry.find_for_host(element)
+        shadow_including_elements(shadow.__dommy_backend_node__, list) if shadow
+      end
+      list
+    end
+
+    # "The html element": the document element when it is an HTML <html>.
+    def html_element
+      root = document_element
+      root if root.is_a?(HTMLElement) && root.local_name == "html"
+    end
+
+    # An element is a named element with the name `name` when it is one of the
+    # exposed kinds and either carries that `name`, or is an object with that
+    # `id`, or is an img whose id it is and which also has a non-empty name.
+    def named_element?(node, name)
+      return false if name.empty?
+      return false unless %w[embed form iframe img object].include?(node.name.to_s.downcase)
+      own_name = Backend.no_namespace_attribute_value(node, "name")
+      return true if own_name == name
+      return true if node.name.to_s.casecmp?("object") && Backend.no_namespace_attribute_value(node, "id") == name
+
+      node.name.to_s.casecmp?("img") && Backend.no_namespace_attribute_value(node, "id") == name && !own_name.to_s.empty?
+    end
+
+    # Elements the document's named getter exposes, in tree order.
+    def named_getter_nodes
+      @backend_doc.css("embed, form, iframe, img, object")
+    end
+
+    def document_named_property_nodes(name)
+      named_getter_nodes.select { |node| named_element?(node, name) }.map { |node| wrap_node(node) }.compact
+    end
+
     # Build a Nokogiri copy of the given node inside our @backend_doc.
     # `deep: true` recurses into children. Used by importNode and
     # adoptNode for cross-document transfer.
@@ -2670,11 +3551,9 @@ module Dommy
       # A <template>'s contents live in a separate content fragment, not its
       # child list, so the pass over `children` misses them. It still runs: an
       # XML document's <template> keeps its children in the child list.
-      clone_template_content(source, copy, source_document) if source.element? && source.name == "template"
-      if source.respond_to?(:children)
-        source.children.each do |child|
-          copy.add_child(clone_into_doc(child, true, source_document))
-        end
+      clone_template_content(source, copy, source_document) if @template_content_registry.template_node?(source)
+      source.children.each do |child|
+        copy.add_child(clone_into_doc(child, true, source_document))
       end
 
       copy
@@ -2682,12 +3561,13 @@ module Dommy
 
     # "Clone a single node" (§4.4): the copy implements the SAME interface as
     # the original — a ProcessingInstruction clones to one, not to the comment
-    # its serialization looks like — and carries the same data. Elements are
-    # cloned by #clone_element_into_doc; children are the caller's business.
+    # its serialization looks like — and carries the same data. An element's
+    # copy keeps its name, namespace, prefix and attributes as the backend
+    # holds them; children are the caller's business.
     def clone_single_node_into_doc(source, source_document)
       if source.element?
-        clone_element_into_doc(source, source_document)
-      elsif (cdata = Backend.cdata_class) && source.is_a?(cdata)
+        Backend.import_element(source, @backend_doc)
+      elsif source.is_a?(Backend.cdata_class)
         # CDATA is a Text subtype in the backend, so ask about it first.
         Backend.create_cdata(source.content, @backend_doc)
       elsif source.text?
@@ -2705,7 +3585,7 @@ module Dommy
         # `document_fragment_class.new`, so it works on backends whose fragment
         # class isn't directly instantiable (Makiri).
         Parser.fragment("", owner_doc: @backend_doc)
-      elsif (doctype = Backend.document_type_class) && source.is_a?(doctype)
+      elsif source.is_a?(Backend.document_type_class)
         wrapper = source_document.wrap_node(source)
         Backend.create_document_type(wrapper.name, wrapper.public_id, wrapper.system_id, @backend_doc)
       else
@@ -2718,36 +3598,6 @@ module Dommy
     # element stays `A:B`, where the DOM's setAttribute would lower-case it).
     # Only a createElementNS name the backend node does not carry lives on the
     # original's wrapper, so the copy's wrapper is given the same metadata.
-    def clone_element_into_doc(source, source_document)
-      wrapper = source_document.wrap_node(source)
-      namespace, prefix, local, qualified = clone_name_parts(wrapper, source)
-      copy = Backend.import_element(source, @backend_doc)
-      note_cloned_element_namespace(copy, namespace, prefix, local, qualified)
-      copy
-    end
-
-    # The four parts of the original's name — namespace, prefix, local name and
-    # qualified name. The wrapper's own metadata has them whenever there is
-    # anything to carry (createElementNS's case and prefix, an XML document's,
-    # the HTML parser's SVG names); otherwise the element is an unprefixed one
-    # whose namespace the backend knows.
-    def clone_name_parts(wrapper, source)
-      meta = wrapper.__internal_namespace_metadata__ if wrapper.respond_to?(:__internal_namespace_metadata__)
-      return meta if meta
-
-      local = wrapper ? wrapper.local_name.to_s : source.name
-      [wrapper&.namespace_uri, nil, local, local]
-    end
-
-    # Give the copy's wrapper the namespace metadata whenever the backend node
-    # alone would report something else (see #clone_element_into_doc).
-    def note_cloned_element_namespace(copy, namespace, prefix, local, qualified)
-      derived = Backend.namespace_uri(copy)
-      return if derived == namespace && prefix.nil? && local == copy.name
-
-      wrap_cloned_element_ns(copy, namespace, prefix, local, qualified)
-    end
-
     # HTML's cloning steps for a <template>: a deep copy of each of the
     # source's contents, appended to the copy's contents.
     def clone_template_content(source, copy, source_document = self)
@@ -2758,29 +3608,91 @@ module Dommy
       content_nodes.each { |n| frag.add_child(clone_into_doc(n, true, source_document)) }
     end
 
+    # The document's element child, as a backend node, or nil. The backend's
+    # `root` is that element in the ordinary case, but once the element it
+    # held is gone it answers the doctype, even when another element has been
+    # appended since — so look past it.
+    def backend_document_element
+      root = @backend_doc.root
+      root&.element? ? root : @backend_doc.children.find(&:element?)
+    end
+
+    # The first child of the html element — the document element, when it is
+    # `html` in the HTML namespace — that is an HTML element named one of
+    # `names`, as a backend node; HTML defines both the head and the body
+    # element this way. Only the match is wrapped.
+    def html_element_child(names)
+      root = backend_document_element
+      return nil unless root && root.local_name == "html" && Backend.namespace_uri(root) == Internal::Namespaces::HTML
+
+      root.element_children.find { |c| names.include?(c.local_name) && Backend.namespace_uri(c) == Internal::Namespaces::HTML }
+    end
+
+    def body_or_frameset?(node)
+      node.is_a?(Element) && %w[body frameset].include?(node.local_name) &&
+        node.namespace_uri == Internal::Namespaces::HTML
+    end
+
+    # document.title's getter (HTML §3.1.3): the child text content of the
+    # SVG `title` child of an SVG `svg` document element, else of the title
+    # element, stripped and collapsed of ASCII whitespace. ASCII whitespace is
+    # exactly tab/LF/FF/CR/space — NOT Ruby's String#strip set, which also
+    # removes U+000B (vertical tab) and must be left intact.
     def read_title
-      # The first title element in tree order (usually the head's), with its
-      # child text content stripped and collapsed of ASCII whitespace per WHATWG.
-      # ASCII whitespace is exactly tab/LF/FF/CR/space — NOT Ruby's String#strip
-      # set, which also removes U+000B (vertical tab) and must be left intact.
-      title = @backend_doc.at_css("title")
+      root = backend_document_element
+      title = svg_root?(root) ? svg_title_child(root) : html_title_element
       return "" unless title
 
-      title.text.gsub(/[\t\n\f\r ]+/, " ").gsub(/\A[\t\n\f\r ]+|[\t\n\f\r ]+\z/, "")
+      Backend.child_text_content(title).gsub(/[\t\n\f\r ]+/, " ").gsub(/\A[\t\n\f\r ]+|[\t\n\f\r ]+\z/, "")
     end
 
+    # document.title's setter: string-replace-all in the SVG title (made the
+    # document element's first child when missing), or in the title element
+    # (appended to the head element when missing, unless there is no head
+    # either). A document element in any other namespace takes no title.
     def write_title(value)
-      head = @backend_doc.at_css("head")
-      return unless head
+      root = backend_document_element
+      if svg_root?(root)
+        title = svg_title_child(root)
+        title = insert_title(root, Internal::Namespaces::SVG, before: root.first_child) unless title
+      elsif root && Backend.namespace_uri(root) == Internal::Namespaces::HTML
+        title = html_title_element
+        unless title
+          head = html_element_child(%w[head])
+          return unless head
+
+          title = insert_title(head, Internal::Namespaces::HTML)
+        end
+      else
+        return
+      end
+      wrap_node(title).text_content = value
+    end
 
-      title = head.at_css("title")
-      unless title
-        title = Backend.create_element("title", @backend_doc)
-        head.add_child(title)
+    # The title element: the first HTML `title` in the document, in tree order.
+    # Matched by namespace and local name: an XML document's `css("title")`
+    # does not find an HTML-namespace title, so there the tree is walked.
+    def html_title_element
+      candidates = html_document? ? @backend_doc.css("title") : Internal::NodeTraversal.subtree_nodes(@backend_doc)
+      candidates.find do |node|
+        node.element? && node.local_name == "title" && Backend.namespace_uri(node) == Internal::Namespaces::HTML
       end
+    end
+
+    def svg_root?(root)
+      root && root.local_name == "svg" && Backend.namespace_uri(root) == Internal::Namespaces::SVG
+    end
+
+    def svg_title_child(root)
+      root.element_children.find { |c| c.local_name == "title" && Backend.namespace_uri(c) == Internal::Namespaces::SVG }
+    end
 
-      title.children.to_a.each { |child| detach_node(child) }
-      title.add_child(Backend.create_text(value, @backend_doc))
+    # A new `title` in `namespace`, inserted into `parent` before `before`
+    # (appended when nil), as a backend node.
+    def insert_title(parent, namespace, before: nil)
+      title = create_element_ns(namespace, "title")
+      wrap_node(parent).insert_before(title, before && wrap_node(before))
+      title.__dommy_backend_node__
     end
 
   end