webpack 5.111.0 → 5.111.1

package/lib/html/syntax.js

@@ -114,6 +114,7 @@ const {
 	IMPLIED,
 	IMPLIED_THOROUGH,
 	INTEGER_ATTRIBUTES,
+	INVALID_VALUE_DEFAULT_DIFFERS,
 	IN_HEAD_NOSCRIPT_PASSTHROUGH,
 	IN_TABLE_IGNORED_ENDS,
 	JAVASCRIPT_SCRIPT_TYPES,
@@ -314,18 +315,14 @@ const QUOTE_DOUBLE = 1;
 const QUOTE_SINGLE = 2;
 const QUOTE_NONE = 0;
 
-// Longest WHATWG named entity name *including* the trailing `;` is 32 chars
-// (`CounterClockwiseContourIntegral;`); without the trailing `;` it's 31.
-// Used to cap both the tokenizer's named-character-reference run length and
-// the decoder's longest-prefix backtrack so pathological inputs (e.g. `&`
-// followed by thousands of alphanumerics) stay linear-time.
+// The longest WHATWG named entity is 32 chars with its `;`, 31 without. Capping
+// the tokenizer's reference run and the decoder's longest-prefix backtrack there
+// keeps `&` followed by thousands of alphanumerics linear-time.
 const MAX_ENTITY_NAME_LEN = 32;
 
-// ASCII character-class bit flags packed into one lookup table. The tokenizer
-// runs these predicates per code point (tag names, attribute names, character
-// references, whitespace skipping), so a single table load + mask replaces the
-// per-call comparison chains. Code points >= 0x80 are never in any of these
-// classes, so callers short-circuit on `cc < 0x80` before indexing.
+// ASCII character-class bit flags in one table: a load and a mask in place of
+// the comparison chain these per-code-point predicates would otherwise run. No
+// code point >= 0x80 is in any class, so callers short-circuit on `cc < 0x80`.
 const CCLS_SPACE = 1;
 const CCLS_DIGIT = 2;
 const CCLS_UPPER = 4;
@@ -581,10 +578,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 	let attributeValueStart = -1;
 	let attrQuoteType = QUOTE_NONE;
 	let commentStart = pos;
-	// Data range of the comment being scanned. The comment states append
-	// characters that are not the ones just consumed (the `--` a `-->` inside a
-	// comment turns into, the `--!` of a comment-end-bang), so the range is
-	// tracked here rather than re-derived by trimming delimiters off the token.
+	// Data range of the comment being scanned, tracked rather than re-derived by
+	// trimming delimiters: the comment states append characters that were never
+	// consumed, such as the `--` an inner `-->` turns into.
 	let commentDataStart = pos;
 	let commentDataEnd = pos;
 	// Sub-ranges of the DOCTYPE token being scanned (-1 = the spec's
@@ -601,10 +597,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 	// derived from these lazily (only for special-content tags).
 	let lastOpenTagStart = -1;
 	let lastOpenTagEnd = -1;
-	// Counter used by SCRIPT_DATA_DOUBLE_ESCAPE_{START,END} to detect whether
-	// the ASCII-alpha run after `<` / `</` spells exactly `"script"`. Values
-	// 0..6 = number of chars matched so far; 7 = no longer matches (sentinel).
-	// Avoids growing a buffer for pathological inputs with long alpha runs.
+	// How much of `"script"` the ASCII-alpha run after `<` / `</` has matched,
+	// for SCRIPT_DATA_DOUBLE_ESCAPE_{START,END}: 0..6 chars, or 7 for no longer
+	// matching. A counter rather than a buffer, which a long run would grow.
 	let scriptMatch = 0;
 	let namedEntityConsumed = 0;
 	// Offset of the opening `&` and the running numeric value (clamped past the
@@ -614,10 +609,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 	// Tracks whether the current tag has parsed any attributes — used to
 	// fire the `end-tag-with-attributes` parse error when an end tag emits.
 	let tagHasAttributes = false;
-	// Memoized next occurrence of `<` / `&` / NUL for the text-run
-	// fast-forwards: native `indexOf` beats a per-char JS loop, and `pos` only
-	// moves forward, so each memo is refreshed at most once per occurrence
-	// (`len` = no further occurrence).
+	// Memoized next `<` / `&` / NUL for the text-run fast-forwards, where native
+	// `indexOf` beats a per-char loop. `pos` only moves forward, so each memo is
+	// refreshed at most once per occurrence; `len` means no further one.
 	let nextLt = -1;
 	let nextAmp = -1;
 	let nextNul = -1;
@@ -688,12 +682,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 		}
 	};
 
-	// Content mode for the tag just opened (name at `lastOpenTagStart..End`). In
-	// foreign content (SVG/MathML) the tree builder vetoes RAWTEXT/RCDATA/script
-	// switching via `isForeign`, so e.g. an SVG `<title>`/`<style>` is parsed as
-	// normal markup. `lastOpenTagName` (the lowercased name compared by the
-	// special end-tag states) is materialized only when a special mode is
-	// actually entered — ordinary tags never allocate it.
+	// Content mode for the tag just opened, named at `lastOpenTagStart..End`. In
+	// foreign content `isForeign` vetoes the RAWTEXT/RCDATA/script switch, so an
+	// SVG `<title>` is markup; `lastOpenTagName` is materialized only there.
 	const contentModeAfterOpenTag = () => {
 		const m = getContentModeForRange(input, lastOpenTagStart, lastOpenTagEnd);
 		// Ordinary tags stay in the data state whatever the tree builder did, so
@@ -731,11 +722,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			if (callbacks.text !== undefined) {
 				callbacks.text(input, textStart, endPos);
 			}
-			// Advance `textStart` so a second `flushText` for the same span
-			// (e.g. from the EOF handler after a tag-open transition already
-			// flushed the pending text) is a no-op rather than a duplicate
-			// emit. emitOpenTag / emitCloseTag overwrite `textStart` with
-			// their own `nextPos` anyway, so this doesn't shift their start.
+			// Advancing `textStart` makes a second `flushText` over the same span a
+			// no-op instead of a duplicate emit. `emitOpenTag` / `emitCloseTag`
+			// overwrite it with their own `nextPos`, so their start is unaffected.
 			textStart = endPos;
 		}
 	};
@@ -745,11 +734,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 	 * @returns {number} next position
 	 */
 	const emitAttribute = (endPos) => {
-		// Default `nextPos` advances past the closing quote (if any) so the
-		// state machine can continue when no `attribute` callback is provided.
-		// When a callback IS provided, its return value overrides the default —
-		// the callback is expected to do the same advance based on the
-		// reported `quoteType`.
+		// The default `nextPos` advances past the closing quote, if any, so the
+		// machine continues without an `attribute` callback. A callback's return
+		// value overrides it, and owes the same advance from its `quoteType`.
 		let nextPos = attrQuoteType === QUOTE_NONE ? endPos : endPos + 1;
 		if (callbacks.attribute !== undefined && attributeNameStart !== -1) {
 			nextPos = callbacks.attribute(
@@ -822,10 +809,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 	while (pos < len) {
 		const cc = input.charCodeAt(pos);
 
-		// All WHATWG tokenizer states handled. Deliberately omitted parse errors
-		// (need state this offset scanner lacks): duplicate-attribute,
-		// cdata-in-html-content, `*-in-input-stream`. Reference substitution is
-		// left to `decodeEntities`.
+		// Every WHATWG tokenizer state is handled. Omitted: the parse errors
+		// needing state an offset scanner lacks (duplicate-attribute,
+		// cdata-in-html-content, `*-in-input-stream`) and reference substitution.
 		switch (state) {
 			// https://html.spec.whatwg.org/multipage/parsing.html#data-state
 			case STATE_DATA:
@@ -849,10 +835,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over the run of ordinary text without re-entering
-					// the per-state switch — batches only the data state's "Anything
-					// else — emit the current input character" arc; the stops are
-					// exactly the code points with their own arcs (`<`, `&`, NUL).
+					// Fast-forward over ordinary text without re-entering the switch.
+					// Only the data state's "anything else" arc is batched: the stops
+					// are exactly the code points with arcs of their own.
 					pos++;
 					if (nextLt < pos) {
 						nextLt = input.indexOf("<", pos);
@@ -925,10 +910,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						pos++;
 					}
 				} else if (cc === CC_QUESTION_MARK) {
-					// U+003F QUESTION MARK (?)
-					// This is an unexpected-question-mark-instead-of-tag-name parse error.
-					// Create a comment token whose data is the empty string. Reconsume in the
-					// bogus comment state.
+					// `?`: unexpected-question-mark-instead-of-tag-name parse error. Create a
+					// comment token with empty data, reconsume in bogus comment.
 					reportError(
 						"unexpected-question-mark-instead-of-tag-name",
 						pos,
@@ -959,26 +942,20 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#end-tag-open-state
 			case STATE_END_TAG_OPEN:
-				// Consume the next input character. The spec's ASCII-alpha arc (create
-				// an end tag token, reconsume in the tag name state) is taken inline by
-				// the `<` `/` arc above, the only way into this state, so `cc` is never
-				// ASCII alpha here.
+				// The spec's ASCII-alpha arc is taken inline by the `<` `/` arc above,
+				// the only way into this state, so `cc` is never ASCII alpha here.
 				if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is a missing-end-tag-name parse error. Switch to the data state.
-					// No token is emitted, so `</>` is dropped rather than left in the
-					// text run: a browser renders nothing for it, and keeping it would
-					// resurface as visible text once the text node is re-escaped.
+					// `>`: missing-end-tag-name parse error, switch to data. Emitting no
+					// token drops `</>` rather than keeping it in the text run, where
+					// re-escaping the text node would resurface it as visible text.
 					reportError("missing-end-tag-name", pos, pos + 1, "warning");
 					flushText(tagStart);
 					state = STATE_DATA;
 					pos++;
 					textStart = pos;
 				} else {
-					// Anything else
-					// This is an invalid-first-character-of-tag-name parse error. Create a
-					// comment token whose data is the empty string. Reconsume in the bogus
-					// comment state.
+					// Anything else: invalid-first-character-of-tag-name parse error. Create a
+					// comment token with empty data, reconsume in bogus comment.
 					reportError(
 						"invalid-first-character-of-tag-name",
 						pos,
@@ -996,11 +973,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#tag-name-state
 			case STATE_TAG_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
+				// Whitespace (tab, LF, FF, space)
 				// Switch to the before attribute name state.
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
@@ -1043,20 +1016,13 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#before-attribute-name-state
 			case STATE_BEFORE_ATTRIBUTE_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
+				// Whitespace (tab, LF, FF, space)
 				// Ignore the character.
 				// Reconsume so space is handled in BEFORE_ATTRIBUTE_NAME
 				if (isSpace(cc)) {
 					pos++;
 				} else if (cc === CC_SOLIDUS || cc === CC_GREATER_THAN) {
-					// U+002F SOLIDUS (/)
-					// U+003E GREATER-THAN SIGN (>)
-					// EOF
-					// Reconsume in the after attribute name state.
+					// `/` / `>` / EOF: reconsume in after attribute name.
 					state = STATE_AFTER_ATTRIBUTE_NAME;
 					// Reconsume
 				} else if (cc === CC_EQUALS) {
@@ -1108,15 +1074,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#attribute-name-state
 			case STATE_ATTRIBUTE_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
-				// U+002F SOLIDUS (/)
-				// U+003E GREATER-THAN SIGN (>)
-				// EOF
-				// Reconsume in the after attribute name state.
+				// Whitespace (tab, LF, FF, space) / `/` / `>` / EOF: reconsume in after
+				// attribute name.
 				if (isSpace(cc) || cc === CC_SOLIDUS || cc === CC_GREATER_THAN) {
 					attributeNameEnd = pos;
 					state = STATE_AFTER_ATTRIBUTE_NAME;
@@ -1141,10 +1100,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 							"warning"
 						);
 					}
-					// Fast-forward over the ordinary run of the attribute name; stop on
-					// any terminator (space / `/` / `>` / `=`) or a char that needs a
-					// per-occurrence parse error (NULL / `"` / `'` / `<`), which the
-					// outer switch then re-handles.
+					// Fast-forward over the attribute name, stopping on a terminator
+					// (space, `/`, `>`, `=`) or on a char needing a per-occurrence parse
+					// error (NUL, `"`, `'`, `<`), which the outer switch re-handles.
 					pos++;
 					while (pos < len) {
 						const c2 = input.charCodeAt(pos);
@@ -1158,11 +1116,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#after-attribute-name-state
 			case STATE_AFTER_ATTRIBUTE_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
+				// Whitespace (tab, LF, FF, space)
 				// Ignore the character.
 				if (isSpace(cc)) {
 					pos++;
@@ -1201,11 +1155,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#before-attribute-value-state
 			case STATE_BEFORE_ATTRIBUTE_VALUE:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
+				// Whitespace (tab, LF, FF, space)
 				// Ignore the character.
 				if (isSpace(cc)) {
 					pos++;
@@ -1254,11 +1204,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					}
 					pos = Math.min(nextSQuote, nextAmp, nextNul);
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is a missing-attribute-value parse error. Switch to the data
-					// state. Emit the current tag token. The attribute is reported with
-					// an empty value range pointing at the `>` so the open-tag offset range
-					// still includes the `>`.
+					// `>`: missing-attribute-value parse error, switch to data and emit
+					// the tag token. The attribute's empty value range points at the `>`,
+					// so the open tag's own range still includes it.
 					reportError("missing-attribute-value", pos, pos + 1, "warning");
 					attributeValueStart = pos;
 					attrQuoteType = QUOTE_NONE;
@@ -1409,11 +1357,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#after-attribute-value-(quoted)-state
 			case STATE_AFTER_ATTRIBUTE_VALUE_QUOTED:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
+				// Whitespace (tab, LF, FF, space)
 				// Switch to the before attribute name state.
 				if (isSpace(cc)) {
 					state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -1449,10 +1393,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#self-closing-start-tag-state
 			case STATE_SELF_CLOSING_START_TAG:
-				// Consume the next input character:
-				// U+003E GREATER-THAN SIGN (>)
-				// Set the self-closing flag of the current tag token. Switch to the data
-				// state. Emit the current tag token.
+				// `>`: Set the self-closing flag of the tag token, switch to data. Emit the
+				// tag token.
 				if (cc === CC_GREATER_THAN) {
 					if (input.charCodeAt(tagStart + 1) === CC_SOLIDUS) {
 						// An end tag emitted with the self-closing flag set is an
@@ -1481,10 +1423,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#markup-declaration-open-state
 			case STATE_MARKUP_DECLARATION_OPEN:
-				// If the next few characters are:
-				// Two U+002D HYPHEN-MINUS characters (-)
-				// Consume those two characters, create a comment token whose data
-				// is the empty string, and switch to the comment start state.
+				// `--`: Consume those two characters, create a comment token with empty
+				// data, and switch to the comment start state.
 				if (
 					cc === CC_HYPHEN_MINUS &&
 					input.charCodeAt(pos + 1) === CC_HYPHEN_MINUS
@@ -1516,13 +1456,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					doctypeForceQuirks = false;
 					state = STATE_DOCTYPE;
 				} else if (
-					// The string "[CDATA[" (the five uppercase letters "CDATA" with a
-					// U+005B LEFT SQUARE BRACKET character before and after)
-					// Consume those characters and switch to the CDATA section state.
-					// Only when there is an adjusted current node and it is not an
-					// element in the HTML namespace: everywhere else this is the
-					// "anything else" branch below, a bogus comment ending at the first
-					// `>`, which leaves the rest (typically `]]>`) as text.
+					// `[CDATA[`: consume it and switch to CDATA section, but only with an
+					// adjusted current node outside the HTML namespace. Elsewhere it is a
+					// bogus comment, leaving the rest as text.
 					cc === CC_LEFT_SQUARE_BRACKET &&
 					input.charCodeAt(pos + 1) === 0x43 /* C */ &&
 					input.charCodeAt(pos + 2) === 0x44 /* D */ &&
@@ -1539,10 +1475,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					commentDataEnd = pos;
 					state = STATE_CDATA_SECTION;
 				} else {
-					// Anything else
-					// This is an incorrectly-opened-comment parse error. Create a comment token
-					// whose data is the empty string. Switch to the bogus comment state (don't
-					// consume anything in the current state).
+					// Anything else: incorrectly-opened-comment parse error. Create a comment
+					// token with empty data, switch to bogus comment (don't consume anything
+					// in the current state).
 					reportError("incorrectly-opened-comment", tagStart, pos, "warning");
 					commentStart = tagStart;
 					commentDataStart = pos;
@@ -1681,10 +1616,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_COMMENT_END;
 					pos++;
 				} else {
-					// Anything else
-					// Append a U+002D HYPHEN-MINUS character (-) to the comment token's data.
-					// Reconsume in the comment state (so e.g. NULL and `<` are
-					// handled there).
+					// Anything else: append a `-` to the comment data and reconsume in
+					// comment, where NUL and `<` are handled.
 					commentDataEnd = pos;
 					state = STATE_COMMENT;
 					// Reconsume
@@ -1721,10 +1654,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					commentDataEnd++;
 					pos++;
 				} else {
-					// Anything else
-					// Append two U+002D HYPHEN-MINUS characters (-) to the comment token's
-					// data. Reconsume in the comment state (so NULL and `<` are
-					// handled there).
+					// Anything else: append two `-` to the comment data and reconsume in
+					// comment, where NUL and `<` are handled.
 					commentDataEnd = pos;
 					state = STATE_COMMENT;
 					// Reconsume
@@ -1733,11 +1664,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#comment-end-bang-state
 			case STATE_COMMENT_END_BANG:
-				// Consume the next input character:
-				// U+002D HYPHEN-MINUS (-)
-				// Append two U+002D HYPHEN-MINUS characters (-) and a U+0021 EXCLAMATION
-				// MARK character (!) to the comment token's data. Switch to the comment end
-				// dash state.
+				// `-`: Append two `-` and a `!` to the comment data, switch to comment end
+				// dash.
 				if (cc === CC_HYPHEN_MINUS) {
 					commentDataEnd = pos;
 					state = STATE_COMMENT_END_DASH;
@@ -1761,10 +1689,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else {
-					// Anything else
-					// Append two U+002D HYPHEN-MINUS characters (-) and a U+0021 EXCLAMATION
-					// MARK character (!) to the comment token's data. Reconsume in the comment
-					// state (so NULL and `<` are handled there).
+					// Anything else: append two `-` and a `!` to the comment data and
+					// reconsume in comment, where NUL and `<` are handled.
 					commentDataEnd = pos;
 					state = STATE_COMMENT;
 					// Reconsume
@@ -1813,10 +1739,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#comment-less-than-sign-state
 			case STATE_COMMENT_LESS_THAN_SIGN:
-				// Consume the next input character:
-				// U+0021 EXCLAMATION MARK (!)
-				// Append the current input character to the comment token's data. Switch to
-				// the comment less-than sign bang state.
+				// `!`: Append the input character to the comment data, switch to comment
+				// less-than sign bang.
 				if (cc === CC_EXCLAMATION_MARK) {
 					state = STATE_COMMENT_LESS_THAN_SIGN_BANG;
 					pos++;
@@ -1868,12 +1792,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#comment-less-than-sign-bang-dash-dash-state
 			case STATE_COMMENT_LESS_THAN_SIGN_BANG_DASH_DASH:
-				// Consume the next input character:
-				// U+003E GREATER-THAN SIGN (>)
-				// EOF
-				// Reconsume in the comment end state.
-				// Anything else
-				// This is a nested-comment parse error. Reconsume in the comment end state.
+				// `>` / EOF: reconsume in comment end. Anything else: nested-comment parse
+				// error, reconsume in comment end.
 				if (cc !== CC_GREATER_THAN) {
 					reportError("nested-comment", pos, pos + 1, "warning");
 				}
@@ -1883,11 +1803,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#doctype-state
 			case STATE_DOCTYPE:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
+				// Whitespace (tab, LF, FF, space)
 				// Switch to the before DOCTYPE name state.
 				if (isSpace(cc)) {
 					state = STATE_BEFORE_DOCTYPE_NAME;
@@ -1912,29 +1828,21 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#before-doctype-name-state
 			case STATE_BEFORE_DOCTYPE_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
+				// Whitespace (tab, LF, FF, space)
 				// Ignore the character.
 				if (isSpace(cc)) {
 					pos++;
 				} else if (cc === CC_NULL) {
-					// U+0000 NULL
-					// This is an unexpected-null-character parse error. Create a new DOCTYPE
-					// token. Set the token's name to a U+FFFD REPLACEMENT CHARACTER character.
-					// Switch to the DOCTYPE name state.
+					// NUL: unexpected-null-character parse error. Create a new DOCTYPE token.
+					// Set the token's name to a U+FFFD, switch to DOCTYPE name.
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					state = STATE_DOCTYPE_NAME;
 					doctypeNameStart = pos;
 					pos++;
 					doctypeNameEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is a missing-doctype-name parse error. Create a new DOCTYPE token.
-					// Set its force-quirks flag to on. Switch to the data state. Emit the
-					// current token.
+					// `>`: missing-doctype-name parse error. Create a new DOCTYPE token, force
+					// quirks, switch to data. Emit the token.
 					reportError("missing-doctype-name", pos, pos + 1, "warning");
 					doctypeForceQuirks = true;
 					let nextPos = pos + 1;
@@ -1956,13 +1864,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else {
-					// ASCII upper alpha
-					// Create a new DOCTYPE token. Set the token's name to the lowercase version
-					// of the current input character (add 0x0020 to the character's code
-					// point). Switch to the DOCTYPE name state.
-					// Anything else
-					// Create a new DOCTYPE token. Set the token's name to the current input
-					// character. Switch to the DOCTYPE name state.
+					// ASCII upper alpha, and anything else: create a DOCTYPE token, set
+					// its name to the input character — lowercased in the first case —
+					// and switch to DOCTYPE name.
 					state = STATE_DOCTYPE_NAME;
 					doctypeNameStart = pos;
 					pos++;
@@ -1972,11 +1876,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#doctype-name-state
 			case STATE_DOCTYPE_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
+				// Whitespace (tab, LF, FF, space)
 				// Switch to the after DOCTYPE name state.
 				if (isSpace(cc)) {
 					state = STATE_AFTER_DOCTYPE_NAME;
@@ -2010,11 +1910,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					pos++;
 					doctypeNameEnd = pos;
 				} else {
-					// ASCII upper alpha
-					// Append the lowercase version of the current input character (add 0x0020
-					// to the character's code point) to the current DOCTYPE token's name.
-					// Anything else
-					// Append the current input character to the current DOCTYPE token's name.
+					// ASCII upper alpha: Append the lowercased input character to the DOCTYPE
+					// token's name. Anything else: Append the input character to the DOCTYPE
+					// token's name.
 					pos++;
 					doctypeNameEnd = pos;
 				}
@@ -2024,10 +1922,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_AFTER_DOCTYPE_NAME:
 				// Consume the next input character:
 				if (isSpace(cc)) {
-					// U+0009 CHARACTER TABULATION (tab)
-					// U+000A LINE FEED (LF)
-					// U+000C FORM FEED (FF)
-					// U+0020 SPACE
+					// Whitespace (tab, LF, FF, space)
 					// Ignore the character.
 					pos++;
 				} else if (cc === CC_GREATER_THAN) {
@@ -2076,10 +1971,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					pos += 6;
 					state = STATE_AFTER_DOCTYPE_SYSTEM_KEYWORD;
 				} else {
-					// Anything else
-					// This is an invalid-character-sequence-after-doctype-name parse error. Set
-					// the current DOCTYPE token's force-quirks flag to on. Reconsume in the
-					// bogus DOCTYPE state.
+					// Anything else: invalid-character-sequence-after-doctype-name parse
+					// error, force quirks, reconsume in bogus DOCTYPE.
 					reportError(
 						"invalid-character-sequence-after-doctype-name",
 						pos,
@@ -2095,19 +1988,14 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_AFTER_DOCTYPE_PUBLIC_KEYWORD:
 				// Consume the next input character:
 				if (isSpace(cc)) {
-					// U+0009 CHARACTER TABULATION (tab)
-					// U+000A LINE FEED (LF)
-					// U+000C FORM FEED (FF)
-					// U+0020 SPACE
+					// Whitespace (tab, LF, FF, space)
 					// Switch to the before DOCTYPE public identifier state.
 					state = STATE_BEFORE_DOCTYPE_PUBLIC_IDENTIFIER;
 					pos++;
 				} else if (cc === CC_QUOTATION_MARK) {
-					// U+0022 QUOTATION MARK (")
-					// This is a missing-whitespace-after-doctype-public-keyword parse error.
-					// Set the current DOCTYPE token's public identifier to the empty string
-					// (not missing), then switch to the DOCTYPE public identifier
-					// (double-quoted) state.
+					// `"`: missing-whitespace-after-doctype-public-keyword parse error. Set
+					// the DOCTYPE token's public identifier to the empty string (not missing),
+					// then switch to the DOCTYPE public identifier (double-quoted) state.
 					reportError(
 						"missing-whitespace-after-doctype-public-keyword",
 						pos,
@@ -2119,11 +2007,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					doctypePublicStart = pos;
 					doctypePublicEnd = pos;
 				} else if (cc === CC_APOSTROPHE) {
-					// U+0027 APOSTROPHE (')
-					// This is a missing-whitespace-after-doctype-public-keyword parse error.
-					// Set the current DOCTYPE token's public identifier to the empty string
-					// (not missing), then switch to the DOCTYPE public identifier
-					// (single-quoted) state.
+					// `'`: missing-whitespace-after-doctype-public-keyword parse error. Set
+					// the DOCTYPE token's public identifier to the empty string (not missing),
+					// then switch to the DOCTYPE public identifier (single-quoted) state.
 					reportError(
 						"missing-whitespace-after-doctype-public-keyword",
 						pos,
@@ -2135,10 +2021,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					doctypePublicStart = pos;
 					doctypePublicEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is a missing-doctype-public-identifier parse error. Set the current
-					// DOCTYPE token's force-quirks flag to on. Switch to the data state. Emit
-					// the current DOCTYPE token.
+					// `>`: missing-doctype-public-identifier parse error, force quirks, switch
+					// to data. Emit the DOCTYPE token.
 					reportError(
 						"missing-doctype-public-identifier",
 						pos,
@@ -2165,10 +2049,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else {
-					// Anything else
-					// This is a missing-quote-before-doctype-public-identifier parse error. Set
-					// the current DOCTYPE token's force-quirks flag to on. Reconsume in the
-					// bogus DOCTYPE state.
+					// Anything else: missing-quote-before-doctype-public-identifier parse
+					// error, force quirks, reconsume in bogus DOCTYPE.
 					reportError(
 						"missing-quote-before-doctype-public-identifier",
 						pos,
@@ -2184,35 +2066,28 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_BEFORE_DOCTYPE_PUBLIC_IDENTIFIER:
 				// Consume the next input character:
 				if (isSpace(cc)) {
-					// U+0009 CHARACTER TABULATION (tab)
-					// U+000A LINE FEED (LF)
-					// U+000C FORM FEED (FF)
-					// U+0020 SPACE
+					// Whitespace (tab, LF, FF, space)
 					// Ignore the character.
 					pos++;
 				} else if (cc === CC_QUOTATION_MARK) {
-					// U+0022 QUOTATION MARK (")
-					// Set the current DOCTYPE token's public identifier to the empty string
-					// (not missing), then switch to the DOCTYPE public identifier
-					// (double-quoted) state.
+					// `"`: Set the DOCTYPE token's public identifier to the empty string (not
+					// missing), then switch to the DOCTYPE public identifier (double-quoted)
+					// state.
 					state = STATE_DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED;
 					pos++;
 					doctypePublicStart = pos;
 					doctypePublicEnd = pos;
 				} else if (cc === CC_APOSTROPHE) {
-					// U+0027 APOSTROPHE (')
-					// Set the current DOCTYPE token's public identifier to the empty string
-					// (not missing), then switch to the DOCTYPE public identifier
-					// (single-quoted) state.
+					// `'`: Set the DOCTYPE token's public identifier to the empty string (not
+					// missing), then switch to the DOCTYPE public identifier (single-quoted)
+					// state.
 					state = STATE_DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED;
 					pos++;
 					doctypePublicStart = pos;
 					doctypePublicEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is a missing-doctype-public-identifier parse error. Set the current
-					// DOCTYPE token's force-quirks flag to on. Switch to the data state. Emit
-					// the current DOCTYPE token.
+					// `>`: missing-doctype-public-identifier parse error, force quirks, switch
+					// to data. Emit the DOCTYPE token.
 					reportError(
 						"missing-doctype-public-identifier",
 						pos,
@@ -2239,10 +2114,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else {
-					// Anything else
-					// This is a missing-quote-before-doctype-public-identifier parse error. Set
-					// the current DOCTYPE token's force-quirks flag to on. Reconsume in the
-					// bogus DOCTYPE state.
+					// Anything else: missing-quote-before-doctype-public-identifier parse
+					// error, force quirks, reconsume in bogus DOCTYPE.
 					reportError(
 						"missing-quote-before-doctype-public-identifier",
 						pos,
@@ -2263,18 +2136,14 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_AFTER_DOCTYPE_PUBLIC_IDENTIFIER;
 					pos++;
 				} else if (cc === CC_NULL) {
-					// U+0000 NULL
-					// This is an unexpected-null-character parse error. Append a U+FFFD
-					// REPLACEMENT CHARACTER character to the current DOCTYPE token's public
-					// identifier.
+					// NUL: unexpected-null-character parse error. Append a U+FFFD to the
+					// DOCTYPE token's public identifier.
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 					doctypePublicEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is an abrupt-doctype-public-identifier parse error. Set the current
-					// DOCTYPE token's force-quirks flag to on. Switch to the data state. Emit
-					// the current DOCTYPE token.
+					// `>`: abrupt-doctype-public-identifier parse error, force quirks, switch
+					// to data. Emit the DOCTYPE token.
 					reportError(
 						"abrupt-doctype-public-identifier",
 						pos,
@@ -2318,18 +2187,14 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_AFTER_DOCTYPE_PUBLIC_IDENTIFIER;
 					pos++;
 				} else if (cc === CC_NULL) {
-					// U+0000 NULL
-					// This is an unexpected-null-character parse error. Append a U+FFFD
-					// REPLACEMENT CHARACTER character to the current DOCTYPE token's public
-					// identifier.
+					// NUL: unexpected-null-character parse error. Append a U+FFFD to the
+					// DOCTYPE token's public identifier.
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 					doctypePublicEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is an abrupt-doctype-public-identifier parse error. Set the current
-					// DOCTYPE token's force-quirks flag to on. Switch to the data state. Emit
-					// the current DOCTYPE token.
+					// `>`: abrupt-doctype-public-identifier parse error, force quirks, switch
+					// to data. Emit the DOCTYPE token.
 					reportError(
 						"abrupt-doctype-public-identifier",
 						pos,
@@ -2368,10 +2233,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_AFTER_DOCTYPE_PUBLIC_IDENTIFIER:
 				// Consume the next input character:
 				if (isSpace(cc)) {
-					// U+0009 CHARACTER TABULATION (tab)
-					// U+000A LINE FEED (LF)
-					// U+000C FORM FEED (FF)
-					// U+0020 SPACE
+					// Whitespace (tab, LF, FF, space)
 					// Switch to the between DOCTYPE public and system identifiers state.
 					state = STATE_BETWEEN_DOCTYPE_PUBLIC_AND_SYSTEM_IDENTIFIERS;
 					pos++;
@@ -2397,11 +2259,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else if (cc === CC_QUOTATION_MARK) {
-					// U+0022 QUOTATION MARK (")
-					// This is a missing-whitespace-between-doctype-public-and-system-identifiers
-					// parse error. Set the current DOCTYPE token's system
-					// identifier to the empty string (not missing), then switch
-					// to the DOCTYPE system identifier (double-quoted) state.
+					// `"`: missing-whitespace-between-doctype-public-and-system-identifiers
+					// parse error. Set the system identifier to empty (not missing), then
+					// switch to DOCTYPE system identifier (double-quoted).
 					reportError(
 						"missing-whitespace-between-doctype-public-and-system-identifiers",
 						pos,
@@ -2413,11 +2273,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					doctypeSystemStart = pos;
 					doctypeSystemEnd = pos;
 				} else if (cc === CC_APOSTROPHE) {
-					// U+0027 APOSTROPHE (')
-					// This is a missing-whitespace-between-doctype-public-and-system-identifiers
-					// parse error. Set the current DOCTYPE token's system
-					// identifier to the empty string (not missing), then switch
-					// to the DOCTYPE system identifier (single-quoted) state.
+					// `'`: missing-whitespace-between-doctype-public-and-system-identifiers
+					// parse error. Set the system identifier to empty (not missing), then
+					// switch to DOCTYPE system identifier (single-quoted).
 					reportError(
 						"missing-whitespace-between-doctype-public-and-system-identifiers",
 						pos,
@@ -2429,10 +2287,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					doctypeSystemStart = pos;
 					doctypeSystemEnd = pos;
 				} else {
-					// Anything else
-					// This is a missing-quote-before-doctype-system-identifier parse error. Set
-					// the current DOCTYPE token's force-quirks flag to on. Reconsume in the
-					// bogus DOCTYPE state.
+					// Anything else: missing-quote-before-doctype-system-identifier parse
+					// error, force quirks, reconsume in bogus DOCTYPE.
 					reportError(
 						"missing-quote-before-doctype-system-identifier",
 						pos,
@@ -2448,10 +2304,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_BETWEEN_DOCTYPE_PUBLIC_AND_SYSTEM_IDENTIFIERS:
 				// Consume the next input character:
 				if (isSpace(cc)) {
-					// U+0009 CHARACTER TABULATION (tab)
-					// U+000A LINE FEED (LF)
-					// U+000C FORM FEED (FF)
-					// U+0020 SPACE
+					// Whitespace (tab, LF, FF, space)
 					// Ignore the character.
 					pos++;
 				} else if (cc === CC_GREATER_THAN) {
@@ -2476,28 +2329,24 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else if (cc === CC_QUOTATION_MARK) {
-					// U+0022 QUOTATION MARK (")
-					// Set the current DOCTYPE token's system identifier to the empty string
-					// (not missing), then switch to the DOCTYPE system identifier
-					// (double-quoted) state.
+					// `"`: Set the DOCTYPE token's system identifier to the empty string (not
+					// missing), then switch to the DOCTYPE system identifier (double-quoted)
+					// state.
 					state = STATE_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED;
 					pos++;
 					doctypeSystemStart = pos;
 					doctypeSystemEnd = pos;
 				} else if (cc === CC_APOSTROPHE) {
-					// U+0027 APOSTROPHE (')
-					// Set the current DOCTYPE token's system identifier to the empty string
-					// (not missing), then switch to the DOCTYPE system identifier
-					// (single-quoted) state.
+					// `'`: Set the DOCTYPE token's system identifier to the empty string (not
+					// missing), then switch to the DOCTYPE system identifier (single-quoted)
+					// state.
 					state = STATE_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED;
 					pos++;
 					doctypeSystemStart = pos;
 					doctypeSystemEnd = pos;
 				} else {
-					// Anything else
-					// This is a missing-quote-before-doctype-system-identifier parse error. Set
-					// the current DOCTYPE token's force-quirks flag to on. Reconsume in the
-					// bogus DOCTYPE state.
+					// Anything else: missing-quote-before-doctype-system-identifier parse
+					// error, force quirks, reconsume in bogus DOCTYPE.
 					reportError(
 						"missing-quote-before-doctype-system-identifier",
 						pos,
@@ -2513,19 +2362,14 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_AFTER_DOCTYPE_SYSTEM_KEYWORD:
 				// Consume the next input character:
 				if (isSpace(cc)) {
-					// U+0009 CHARACTER TABULATION (tab)
-					// U+000A LINE FEED (LF)
-					// U+000C FORM FEED (FF)
-					// U+0020 SPACE
+					// Whitespace (tab, LF, FF, space)
 					// Switch to the before DOCTYPE system identifier state.
 					state = STATE_BEFORE_DOCTYPE_SYSTEM_IDENTIFIER;
 					pos++;
 				} else if (cc === CC_QUOTATION_MARK) {
-					// U+0022 QUOTATION MARK (")
-					// This is a missing-whitespace-after-doctype-system-keyword parse error.
-					// Set the current DOCTYPE token's system identifier to the empty string
-					// (not missing), then switch to the DOCTYPE system identifier
-					// (double-quoted) state.
+					// `"`: missing-whitespace-after-doctype-system-keyword parse error. Set
+					// the DOCTYPE token's system identifier to the empty string (not missing),
+					// then switch to the DOCTYPE system identifier (double-quoted) state.
 					reportError(
 						"missing-whitespace-after-doctype-system-keyword",
 						pos,
@@ -2537,11 +2381,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					doctypeSystemStart = pos;
 					doctypeSystemEnd = pos;
 				} else if (cc === CC_APOSTROPHE) {
-					// U+0027 APOSTROPHE (')
-					// This is a missing-whitespace-after-doctype-system-keyword parse error.
-					// Set the current DOCTYPE token's system identifier to the empty string
-					// (not missing), then switch to the DOCTYPE system identifier
-					// (single-quoted) state.
+					// `'`: missing-whitespace-after-doctype-system-keyword parse error. Set
+					// the DOCTYPE token's system identifier to the empty string (not missing),
+					// then switch to the DOCTYPE system identifier (single-quoted) state.
 					reportError(
 						"missing-whitespace-after-doctype-system-keyword",
 						pos,
@@ -2553,10 +2395,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					doctypeSystemStart = pos;
 					doctypeSystemEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is a missing-doctype-system-identifier parse error. Set the current
-					// DOCTYPE token's force-quirks flag to on. Switch to the data state. Emit
-					// the current DOCTYPE token.
+					// `>`: missing-doctype-system-identifier parse error, force quirks, switch
+					// to data. Emit the DOCTYPE token.
 					reportError(
 						"missing-doctype-system-identifier",
 						pos,
@@ -2583,10 +2423,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else {
-					// Anything else
-					// This is a missing-quote-before-doctype-system-identifier parse error. Set
-					// the current DOCTYPE token's force-quirks flag to on. Reconsume in the
-					// bogus DOCTYPE state.
+					// Anything else: missing-quote-before-doctype-system-identifier parse
+					// error, force quirks, reconsume in bogus DOCTYPE.
 					reportError(
 						"missing-quote-before-doctype-system-identifier",
 						pos,
@@ -2602,35 +2440,28 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_BEFORE_DOCTYPE_SYSTEM_IDENTIFIER:
 				// Consume the next input character:
 				if (isSpace(cc)) {
-					// U+0009 CHARACTER TABULATION (tab)
-					// U+000A LINE FEED (LF)
-					// U+000C FORM FEED (FF)
-					// U+0020 SPACE
+					// Whitespace (tab, LF, FF, space)
 					// Ignore the character.
 					pos++;
 				} else if (cc === CC_QUOTATION_MARK) {
-					// U+0022 QUOTATION MARK (")
-					// Set the current DOCTYPE token's system identifier to the empty string
-					// (not missing), then switch to the DOCTYPE system identifier
-					// (double-quoted) state.
+					// `"`: Set the DOCTYPE token's system identifier to the empty string (not
+					// missing), then switch to the DOCTYPE system identifier (double-quoted)
+					// state.
 					state = STATE_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED;
 					pos++;
 					doctypeSystemStart = pos;
 					doctypeSystemEnd = pos;
 				} else if (cc === CC_APOSTROPHE) {
-					// U+0027 APOSTROPHE (')
-					// Set the current DOCTYPE token's system identifier to the empty string
-					// (not missing), then switch to the DOCTYPE system identifier
-					// (single-quoted) state.
+					// `'`: Set the DOCTYPE token's system identifier to the empty string (not
+					// missing), then switch to the DOCTYPE system identifier (single-quoted)
+					// state.
 					state = STATE_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED;
 					pos++;
 					doctypeSystemStart = pos;
 					doctypeSystemEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is a missing-doctype-system-identifier parse error. Set the current
-					// DOCTYPE token's force-quirks flag to on. Switch to the data state. Emit
-					// the current DOCTYPE token.
+					// `>`: missing-doctype-system-identifier parse error, force quirks, switch
+					// to data. Emit the DOCTYPE token.
 					reportError(
 						"missing-doctype-system-identifier",
 						pos,
@@ -2657,10 +2488,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else {
-					// Anything else
-					// This is a missing-quote-before-doctype-system-identifier parse error. Set
-					// the current DOCTYPE token's force-quirks flag to on. Reconsume in the
-					// bogus DOCTYPE state.
+					// Anything else: missing-quote-before-doctype-system-identifier parse
+					// error, force quirks, reconsume in bogus DOCTYPE.
 					reportError(
 						"missing-quote-before-doctype-system-identifier",
 						pos,
@@ -2681,18 +2510,14 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_AFTER_DOCTYPE_SYSTEM_IDENTIFIER;
 					pos++;
 				} else if (cc === CC_NULL) {
-					// U+0000 NULL
-					// This is an unexpected-null-character parse error. Append a U+FFFD
-					// REPLACEMENT CHARACTER character to the current DOCTYPE token's system
-					// identifier.
+					// NUL: unexpected-null-character parse error. Append a U+FFFD to the
+					// DOCTYPE token's system identifier.
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 					doctypeSystemEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is an abrupt-doctype-system-identifier parse error. Set the current
-					// DOCTYPE token's force-quirks flag to on. Switch to the data state. Emit
-					// the current DOCTYPE token.
+					// `>`: abrupt-doctype-system-identifier parse error, force quirks, switch
+					// to data. Emit the DOCTYPE token.
 					reportError(
 						"abrupt-doctype-system-identifier",
 						pos,
@@ -2736,18 +2561,14 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_AFTER_DOCTYPE_SYSTEM_IDENTIFIER;
 					pos++;
 				} else if (cc === CC_NULL) {
-					// U+0000 NULL
-					// This is an unexpected-null-character parse error. Append a U+FFFD
-					// REPLACEMENT CHARACTER character to the current DOCTYPE token's system
-					// identifier.
+					// NUL: unexpected-null-character parse error. Append a U+FFFD to the
+					// DOCTYPE token's system identifier.
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 					doctypeSystemEnd = pos;
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// This is an abrupt-doctype-system-identifier parse error. Set the current
-					// DOCTYPE token's force-quirks flag to on. Switch to the data state. Emit
-					// the current DOCTYPE token.
+					// `>`: abrupt-doctype-system-identifier parse error, force quirks, switch
+					// to data. Emit the DOCTYPE token.
 					reportError(
 						"abrupt-doctype-system-identifier",
 						pos,
@@ -2786,10 +2607,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_AFTER_DOCTYPE_SYSTEM_IDENTIFIER:
 				// Consume the next input character:
 				if (isSpace(cc)) {
-					// U+0009 CHARACTER TABULATION (tab)
-					// U+000A LINE FEED (LF)
-					// U+000C FORM FEED (FF)
-					// U+0020 SPACE
+					// Whitespace (tab, LF, FF, space)
 					// Ignore the character.
 					pos++;
 				} else if (cc === CC_GREATER_THAN) {
@@ -2814,10 +2632,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					textStart = nextPos;
 					pos = nextPos;
 				} else {
-					// Anything else
-					// This is an unexpected-character-after-doctype-system-identifier parse
-					// error. Reconsume in the bogus DOCTYPE state. (This does not set the
-					// current DOCTYPE token's force-quirks flag to on.)
+					// Anything else: unexpected-character-after-doctype-system-identifier
+					// parse error, reconsume in bogus DOCTYPE. (This does not set the DOCTYPE
+					// token's force-quirks flag to on.)
 					reportError(
 						"unexpected-character-after-doctype-system-identifier",
 						pos,
@@ -2873,10 +2690,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_CDATA_SECTION_BRACKET;
 					pos++;
 				} else {
-					// Anything else
-					// Emit the current input character as a character token.
-					// Fast-forward to the next `]` (the only code point with its own
-					// arc) in one native scan.
+					// Anything else: emit the input character. Fast-forwards to the next
+					// `]`, the only code point with an arc of its own, in one scan.
 					pos = input.indexOf("]", pos + 1);
 					if (pos === -1) pos = len;
 				}
@@ -2937,10 +2752,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_RCDATA:
 				// Consume the next input character:
 				if (cc === CC_AMPERSAND) {
-					// U+0026 AMPERSAND (&)
-					// Set the return state to the RCDATA state. Switch to the
-					// character reference state. (RCDATA processes references;
-					// RAWTEXT/script/PLAINTEXT do not.)
+					// `&`: Set the return state to the RCDATA state, switch to character
+					// reference. (RCDATA processes references; RAWTEXT/script/PLAINTEXT do
+					// not.)
 					returnState = STATE_RCDATA;
 					state = STATE_CHARACTER_REFERENCE;
 					pos++;
@@ -2983,11 +2797,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#rcdata-less-than-sign-state
 			case STATE_RCDATA_LESS_THAN_SIGN:
-				// Consume the next input character:
-				// U+002F SOLIDUS (/)
-				// Switch to the RCDATA end tag open state. (Spec sets a
-				// temporary buffer here; we track the would-be content via
-				// offset ranges instead.)
+				// `/`: switch to RCDATA end tag open. (Spec sets a temporary buffer here;
+				// we track the would-be content via offset ranges instead.)
 				if (cc === CC_SOLIDUS) {
 					state = STATE_RCDATA_END_TAG_OPEN;
 					pos++;
@@ -3002,10 +2813,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#rcdata-end-tag-open-state
 			case STATE_RCDATA_END_TAG_OPEN:
-				// Consume the next input character:
-				// ASCII alpha
-				// Create a new end tag token, set its tag name to the empty string.
-				// Reconsume in the RCDATA end tag name state.
+				// ASCII alpha: Create a new end tag token, set its tag name to the empty
+				// string, reconsume in RCDATA end tag name.
 				if (isAsciiAlpha(cc)) {
 					tagNameStart = pos;
 					state = STATE_RCDATA_END_TAG_NAME;
@@ -3021,14 +2830,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#rcdata-end-tag-name-state
 			case STATE_RCDATA_END_TAG_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
-				// If the current end tag token is an appropriate end tag token, then switch
-				// to the before attribute name state. Otherwise, treat it as per the
-				// "anything else" entry below.
+				// Whitespace (tab, LF, FF, space): If the current end tag token is an
+				// appropriate end tag token, then switch to the before attribute name
+				// state. Otherwise, treat it as per the "anything else" entry below.
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
@@ -3047,10 +2851,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						// Reconsume
 					}
 				} else if (cc === CC_SOLIDUS) {
-					// U+002F SOLIDUS (/)
-					// If the current end tag token is an appropriate end tag token, then switch
-					// to the self-closing start tag state. Otherwise, treat it as per the
-					// "anything else" entry below.
+					// `/`: If the current end tag token is an appropriate end tag token, then
+					// switch to the self-closing start tag state. Otherwise, treat it as per
+					// the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
 						rangeEqualsLowerCase(
@@ -3068,9 +2871,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						// Reconsume
 					}
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// If the current end tag token is an appropriate end tag token, then switch
-					// to the data state and emit the current tag token. Otherwise, treat it as
+					// `>`: If the current end tag token is an appropriate end tag token, then
+					// switch to the data state and emit the tag token. Otherwise, treat it as
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
@@ -3089,19 +2891,13 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						// Reconsume
 					}
 				} else if (isAsciiAlpha(cc)) {
-					// ASCII upper alpha / ASCII lower alpha
-					// Append the lowercase version of the current input character to the
-					// current tag token's tag name. Append the current input character to
-					// the temporary buffer.
-					// Fused: consume the whole alpha run in one dispatch.
+					// ASCII alpha: append it lowercased to the tag name and as written to
+					// the temporary buffer. Fused, so the whole run is one dispatch.
 					pos++;
 					while (pos < len && isAsciiAlpha(input.charCodeAt(pos))) pos++;
 				} else {
-					// Anything else
-					// Emit a U+003C LESS-THAN SIGN character token, a U+002F SOLIDUS character
-					// token, and a character token for each of the characters in the temporary
-					// buffer (in the order they were added to the buffer). Reconsume in the
-					// RCDATA state.
+					// Anything else: emit `<`, `/` and the temporary buffer in order,
+					// then reconsume in RCDATA.
 					state = STATE_RCDATA;
 					// Reconsume
 				}
@@ -3145,10 +2941,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#rawtext-less-than-sign-state
 			case STATE_RAWTEXT_LESS_THAN_SIGN:
-				// Consume the next input character:
-				// U+002F SOLIDUS (/)
-				// Switch to the RAWTEXT end tag open state. (Spec sets a
-				// temporary buffer here; we track via offset ranges instead.)
+				// `/`: switch to RAWTEXT end tag open. (Spec sets a temporary buffer here;
+				// we track via offset ranges instead.)
 				if (cc === CC_SOLIDUS) {
 					state = STATE_RAWTEXT_END_TAG_OPEN;
 					pos++;
@@ -3163,10 +2957,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-open-state
 			case STATE_RAWTEXT_END_TAG_OPEN:
-				// Consume the next input character:
-				// ASCII alpha
-				// Create a new end tag token, set its tag name to the empty string.
-				// Reconsume in the RAWTEXT end tag name state.
+				// ASCII alpha: Create a new end tag token, set its tag name to the empty
+				// string, reconsume in RAWTEXT end tag name.
 				if (isAsciiAlpha(cc)) {
 					tagNameStart = pos;
 					state = STATE_RAWTEXT_END_TAG_NAME;
@@ -3182,14 +2974,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state
 			case STATE_RAWTEXT_END_TAG_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
-				// If the current end tag token is an appropriate end tag token, then switch
-				// to the before attribute name state. Otherwise, treat it as per the
-				// "anything else" entry below.
+				// Whitespace (tab, LF, FF, space): If the current end tag token is an
+				// appropriate end tag token, then switch to the before attribute name
+				// state. Otherwise, treat it as per the "anything else" entry below.
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
@@ -3207,10 +2994,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						state = STATE_RAWTEXT;
 					}
 				} else if (cc === CC_SOLIDUS) {
-					// U+002F SOLIDUS (/)
-					// If the current end tag token is an appropriate end tag token, then switch
-					// to the self-closing start tag state. Otherwise, treat it as per the
-					// "anything else" entry below.
+					// `/`: If the current end tag token is an appropriate end tag token, then
+					// switch to the self-closing start tag state. Otherwise, treat it as per
+					// the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
 						rangeEqualsLowerCase(
@@ -3227,9 +3013,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						state = STATE_RAWTEXT;
 					}
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// If the current end tag token is an appropriate end tag token, then switch
-					// to the data state and emit the current tag token. Otherwise, treat it as
+					// `>`: If the current end tag token is an appropriate end tag token, then
+					// switch to the data state and emit the tag token. Otherwise, treat it as
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
@@ -3247,19 +3032,13 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						state = STATE_RAWTEXT;
 					}
 				} else if (isAsciiAlpha(cc)) {
-					// ASCII upper alpha / ASCII lower alpha
-					// Append the lowercase version of the current input character to the
-					// current tag token's tag name. Append the current input character to
-					// the temporary buffer.
-					// Fused: consume the whole alpha run in one dispatch.
+					// ASCII alpha: append it lowercased to the tag name and as written to
+					// the temporary buffer. Fused, so the whole run is one dispatch.
 					pos++;
 					while (pos < len && isAsciiAlpha(input.charCodeAt(pos))) pos++;
 				} else {
-					// Anything else
-					// Emit a U+003C LESS-THAN SIGN character token, a U+002F SOLIDUS character
-					// token, and a character token for each of the characters in the temporary
-					// buffer (in the order they were added to the buffer). Reconsume in the
-					// RAWTEXT state.
+					// Anything else: emit `<`, `/` and the temporary buffer in order,
+					// then reconsume in RAWTEXT.
 					state = STATE_RAWTEXT;
 					// Reconsume
 				}
@@ -3303,10 +3082,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-less-than-sign-state
 			case STATE_SCRIPT_DATA_LESS_THAN_SIGN:
-				// Consume the next input character:
-				// U+002F SOLIDUS (/)
-				// Switch to the script data end tag open state. (Spec sets a
-				// temporary buffer here; we track via offset ranges instead.)
+				// `/`: switch to script data end tag open. (Spec sets a temporary buffer
+				// here; we track via offset ranges instead.)
 				if (cc === CC_SOLIDUS) {
 					state = STATE_SCRIPT_DATA_END_TAG_OPEN;
 					pos++;
@@ -3327,10 +3104,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-end-tag-open-state
 			case STATE_SCRIPT_DATA_END_TAG_OPEN:
-				// Consume the next input character:
-				// ASCII alpha
-				// Create a new end tag token, set its tag name to the empty string.
-				// Reconsume in the script data end tag name state.
+				// ASCII alpha: Create a new end tag token, set its tag name to the empty
+				// string, reconsume in script data end tag name.
 				if (isAsciiAlpha(cc)) {
 					tagNameStart = pos;
 					state = STATE_SCRIPT_DATA_END_TAG_NAME;
@@ -3346,14 +3121,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-end-tag-name-state
 			case STATE_SCRIPT_DATA_END_TAG_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
-				// If the current end tag token is an appropriate end tag token, then switch
-				// to the before attribute name state. Otherwise, treat it as per the
-				// "anything else" entry below.
+				// Whitespace (tab, LF, FF, space): If the current end tag token is an
+				// appropriate end tag token, then switch to the before attribute name
+				// state. Otherwise, treat it as per the "anything else" entry below.
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
@@ -3371,10 +3141,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						state = STATE_SCRIPT_DATA;
 					}
 				} else if (cc === CC_SOLIDUS) {
-					// U+002F SOLIDUS (/)
-					// If the current end tag token is an appropriate end tag token, then switch
-					// to the self-closing start tag state. Otherwise, treat it as per the
-					// "anything else" entry below.
+					// `/`: If the current end tag token is an appropriate end tag token, then
+					// switch to the self-closing start tag state. Otherwise, treat it as per
+					// the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
 						rangeEqualsLowerCase(
@@ -3391,9 +3160,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						state = STATE_SCRIPT_DATA;
 					}
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// If the current end tag token is an appropriate end tag token, then switch
-					// to the data state and emit the current tag token. Otherwise, treat it as
+					// `>`: If the current end tag token is an appropriate end tag token, then
+					// switch to the data state and emit the tag token. Otherwise, treat it as
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
@@ -3416,11 +3184,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					pos++;
 					while (pos < len && isAsciiAlpha(input.charCodeAt(pos))) pos++;
 				} else {
-					// Anything else
-					// Emit a U+003C LESS-THAN SIGN character token, a U+002F SOLIDUS character
-					// token, and a character token for each of the characters in the temporary
-					// buffer (in the order they were added to the buffer). Reconsume in the
-					// script data state.
+					// Anything else: emit `<`, `/` and the temporary buffer in order,
+					// then reconsume in script data.
 					state = STATE_SCRIPT_DATA;
 					// Reconsume
 				}
@@ -3428,10 +3193,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-escape-start-state
 			case STATE_SCRIPT_DATA_ESCAPE_START:
-				// Consume the next input character:
-				// U+002D HYPHEN-MINUS (-)
-				// Switch to the script data escape start dash state. Emit a U+002D
-				// HYPHEN-MINUS character token.
+				// `-`: switch to script data escape start dash. Emit a U+002D HYPHEN-MINUS
+				// character token.
 				if (cc === CC_HYPHEN_MINUS) {
 					state = STATE_SCRIPT_DATA_ESCAPE_START_DASH;
 					pos++;
@@ -3445,10 +3208,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-escape-start-dash-state
 			case STATE_SCRIPT_DATA_ESCAPE_START_DASH:
-				// Consume the next input character:
-				// U+002D HYPHEN-MINUS (-)
-				// Switch to the script data escaped dash dash state. Emit a U+002D
-				// HYPHEN-MINUS character token.
+				// `-`: switch to script data escaped dash dash. Emit a U+002D HYPHEN-MINUS
+				// character token.
 				if (cc === CC_HYPHEN_MINUS) {
 					state = STATE_SCRIPT_DATA_ESCAPED_DASH_DASH;
 					pos++;
@@ -3462,9 +3223,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-escaped-state
 			case STATE_SCRIPT_DATA_ESCAPED:
-				// Consume the next input character:
-				// U+002D HYPHEN-MINUS (-)
-				// Switch to the script data escaped dash state. Emit a U+002D HYPHEN-MINUS
+				// `-`: switch to script data escaped dash. Emit a U+002D HYPHEN-MINUS
 				// character token.
 				if (cc === CC_HYPHEN_MINUS) {
 					state = STATE_SCRIPT_DATA_ESCAPED_DASH;
@@ -3501,10 +3260,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-escaped-dash-state
 			case STATE_SCRIPT_DATA_ESCAPED_DASH:
-				// Consume the next input character:
-				// U+002D HYPHEN-MINUS (-)
-				// Switch to the script data escaped dash dash state. Emit a U+002D
-				// HYPHEN-MINUS character token.
+				// `-`: switch to script data escaped dash dash. Emit a U+002D HYPHEN-MINUS
+				// character token.
 				if (cc === CC_HYPHEN_MINUS) {
 					state = STATE_SCRIPT_DATA_ESCAPED_DASH_DASH;
 					pos++;
@@ -3559,18 +3316,15 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-escaped-less-than-sign-state
 			case STATE_SCRIPT_DATA_ESCAPED_LESS_THAN_SIGN:
-				// Consume the next input character:
-				// U+002F SOLIDUS (/)
-				// Switch to the script data escaped end tag open state.
-				// (Spec sets a temporary buffer; we track via offset ranges.)
+				// `/`: switch to script data escaped end tag open. (Spec sets a temporary
+				// buffer; we track via offset ranges.)
 				if (cc === CC_SOLIDUS) {
 					state = STATE_SCRIPT_DATA_ESCAPED_END_TAG_OPEN;
 					pos++;
 				} else if (isAsciiAlpha(cc)) {
-					// ASCII alpha
-					// Set the temporary buffer to the empty string. Emit a U+003C LESS-THAN
-					// SIGN character token. Reconsume in the script data double escape start
-					// state.
+					// ASCII alpha: Set the temporary buffer to the empty string. Emit a U+003C
+					// LESS-THAN SIGN character token, reconsume in script data double escape
+					// start.
 					scriptMatch = 0;
 					state = STATE_SCRIPT_DATA_DOUBLE_ESCAPE_START;
 					// Reconsume
@@ -3585,10 +3339,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-escaped-end-tag-open-state
 			case STATE_SCRIPT_DATA_ESCAPED_END_TAG_OPEN:
-				// Consume the next input character:
-				// ASCII alpha
-				// Create a new end tag token, set its tag name to the empty string.
-				// Reconsume in the script data escaped end tag name state.
+				// ASCII alpha: Create a new end tag token, set its tag name to the empty
+				// string, reconsume in script data escaped end tag name.
 				if (isAsciiAlpha(cc)) {
 					tagNameStart = pos;
 					state = STATE_SCRIPT_DATA_ESCAPED_END_TAG_NAME;
@@ -3604,14 +3356,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-escaped-end-tag-name-state
 			case STATE_SCRIPT_DATA_ESCAPED_END_TAG_NAME:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
-				// If the current end tag token is an appropriate end tag token, then switch
-				// to the before attribute name state. Otherwise, treat it as per the
-				// "anything else" entry below.
+				// Whitespace (tab, LF, FF, space): If the current end tag token is an
+				// appropriate end tag token, then switch to the before attribute name
+				// state. Otherwise, treat it as per the "anything else" entry below.
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
@@ -3629,10 +3376,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						state = STATE_SCRIPT_DATA_ESCAPED;
 					}
 				} else if (cc === CC_SOLIDUS) {
-					// U+002F SOLIDUS (/)
-					// If the current end tag token is an appropriate end tag token, then switch
-					// to the self-closing start tag state. Otherwise, treat it as per the
-					// "anything else" entry below.
+					// `/`: If the current end tag token is an appropriate end tag token, then
+					// switch to the self-closing start tag state. Otherwise, treat it as per
+					// the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
 						rangeEqualsLowerCase(
@@ -3649,9 +3395,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 						state = STATE_SCRIPT_DATA_ESCAPED;
 					}
 				} else if (cc === CC_GREATER_THAN) {
-					// U+003E GREATER-THAN SIGN (>)
-					// If the current end tag token is an appropriate end tag token, then switch
-					// to the data state and emit the current tag token. Otherwise, treat it as
+					// `>`: If the current end tag token is an appropriate end tag token, then
+					// switch to the data state and emit the tag token. Otherwise, treat it as
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
@@ -3674,11 +3419,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					pos++;
 					while (pos < len && isAsciiAlpha(input.charCodeAt(pos))) pos++;
 				} else {
-					// Anything else
-					// Emit a U+003C LESS-THAN SIGN character token, a U+002F SOLIDUS character
-					// token, and a character token for each of the characters in the temporary
-					// buffer (in the order they were added to the buffer). Reconsume in the
-					// script data escaped state.
+					// Anything else: emit `<`, `/` and the temporary buffer in order,
+					// then reconsume in script data escaped.
 					state = STATE_SCRIPT_DATA_ESCAPED;
 					// Reconsume
 				}
@@ -3686,16 +3428,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-double-escape-start-state
 			case STATE_SCRIPT_DATA_DOUBLE_ESCAPE_START:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
-				// U+002F SOLIDUS (/)
-				// U+003E GREATER-THAN SIGN (>)
-				// If the temporary buffer is the string "script", then switch to the script
-				// data double escaped state. Otherwise, switch to the script data escaped
-				// state. Emit the current input character as a character token.
+				// Whitespace, `/` or `>`: switch to script data double escaped where the
+				// temporary buffer is "script", otherwise to script data escaped, and
+				// emit the input character.
 				if (isSpace(cc) || cc === CC_SOLIDUS || cc === CC_GREATER_THAN) {
 					state =
 						scriptMatch === 6
@@ -3703,10 +3438,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 							: STATE_SCRIPT_DATA_ESCAPED;
 					pos++;
 				} else if (isAsciiUpperAlpha(cc) || isAsciiLowerAlpha(cc)) {
-					// ASCII alpha — advance the `"script"` match counter if the
-					// lowercase form matches the next expected char, otherwise
-					// snap to the sentinel so further chars can't revive a
-					// match. No buffer allocation.
+					// ASCII alpha: advance the `"script"` match counter while the
+					// lowercased char is the expected one, otherwise snap to the
+					// sentinel so a later char cannot revive the match.
 					const lower = isAsciiUpperAlpha(cc) ? cc + 0x20 : cc;
 					if (scriptMatch < 6 && lower === "script".charCodeAt(scriptMatch)) {
 						scriptMatch++;
@@ -3724,9 +3458,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-double-escaped-state
 			case STATE_SCRIPT_DATA_DOUBLE_ESCAPED:
-				// Consume the next input character:
-				// U+002D HYPHEN-MINUS (-)
-				// Switch to the script data double escaped dash state. Emit a U+002D
+				// `-`: switch to script data double escaped dash. Emit a U+002D
 				// HYPHEN-MINUS character token.
 				if (cc === CC_HYPHEN_MINUS) {
 					state = STATE_SCRIPT_DATA_DOUBLE_ESCAPED_DASH;
@@ -3763,9 +3495,7 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-double-escaped-dash-state
 			case STATE_SCRIPT_DATA_DOUBLE_ESCAPED_DASH:
-				// Consume the next input character:
-				// U+002D HYPHEN-MINUS (-)
-				// Switch to the script data double escaped dash dash state. Emit a U+002D
+				// `-`: switch to script data double escaped dash dash. Emit a U+002D
 				// HYPHEN-MINUS character token.
 				if (cc === CC_HYPHEN_MINUS) {
 					state = STATE_SCRIPT_DATA_DOUBLE_ESCAPED_DASH_DASH;
@@ -3821,10 +3551,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-double-escaped-less-than-sign-state
 			case STATE_SCRIPT_DATA_DOUBLE_ESCAPED_LESS_THAN_SIGN:
-				// Consume the next input character:
-				// U+002F SOLIDUS (/)
-				// Set the temporary buffer to the empty string. Switch to the script data
-				// double escape end state. Emit a U+002F SOLIDUS character token.
+				// `/`: Set the temporary buffer to the empty string, switch to script data
+				// double escape end. Emit a U+002F SOLIDUS character token.
 				if (cc === CC_SOLIDUS) {
 					scriptMatch = 0;
 					state = STATE_SCRIPT_DATA_DOUBLE_ESCAPE_END;
@@ -3839,16 +3567,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#script-data-double-escape-end-state
 			case STATE_SCRIPT_DATA_DOUBLE_ESCAPE_END:
-				// Consume the next input character:
-				// U+0009 CHARACTER TABULATION (tab)
-				// U+000A LINE FEED (LF)
-				// U+000C FORM FEED (FF)
-				// U+0020 SPACE
-				// U+002F SOLIDUS (/)
-				// U+003E GREATER-THAN SIGN (>)
-				// If the temporary buffer is the string "script", then switch to the script
-				// data escaped state. Otherwise, switch to the script data double escaped
-				// state. Emit the current input character as a character token.
+				// Whitespace, `/` or `>`: switch to script data escaped where the
+				// temporary buffer is "script", otherwise to script data double escaped,
+				// and emit the input character.
 				if (isSpace(cc) || cc === CC_SOLIDUS || cc === CC_GREATER_THAN) {
 					state =
 						scriptMatch === 6
@@ -3856,10 +3577,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 							: STATE_SCRIPT_DATA_DOUBLE_ESCAPED;
 					pos++;
 				} else if (isAsciiUpperAlpha(cc) || isAsciiLowerAlpha(cc)) {
-					// ASCII alpha — advance the `"script"` match counter if the
-					// lowercase form matches the next expected char, otherwise
-					// snap to the sentinel so further chars can't revive a
-					// match. No buffer allocation.
+					// ASCII alpha: advance the `"script"` match counter while the
+					// lowercased char is the expected one, otherwise snap to the
+					// sentinel so a later char cannot revive the match.
 					const lower = isAsciiUpperAlpha(cc) ? cc + 0x20 : cc;
 					if (scriptMatch < 6 && lower === "script".charCodeAt(scriptMatch)) {
 						scriptMatch++;
@@ -3904,10 +3624,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_NAMED_CHARACTER_REFERENCE;
 					// Reconsume
 				} else if (cc === CC_NUMBER_SIGN) {
-					// U+0023 NUMBER SIGN (#)
-					// Append the current input character to the temporary buffer.
-					// Set the character reference code to zero. Switch to the
-					// numeric character reference state.
+					// `#`: Append the input character to the temporary buffer. Set the
+					// character reference code to zero, switch to numeric character reference.
 					charRefCode = 0;
 					state = STATE_NUMERIC_CHARACTER_REFERENCE;
 					pos++;
@@ -3922,16 +3640,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state
 			case STATE_NAMED_CHARACTER_REFERENCE: {
-				// Consume the maximum number of characters possible where the
-				// consumed characters are one of the identifiers in the first
-				// column of the named character references table.
-				//
-				// We measure the longest run of ASCII alphanumeric characters
-				// (capped at MAX_ENTITY_NAME_LEN - 1 since the optional `;` is
-				// handled separately), then walk that run from longest to
-				// shortest looking for the first prefix that exists in the
-				// entity table (with a trailing `;` if present, otherwise the
-				// legacy bare form).
+				// Consume the longest run naming a character reference: measure the
+				// alphanumeric run, capped at MAX_ENTITY_NAME_LEN - 1 as the `;` is
+				// separate, then walk it longest-first for the first prefix in the table.
 				let runLen = 0;
 				while (
 					pos + runLen < len &&
@@ -3966,11 +3677,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					}
 				}
 				if (namedEntityConsumed > 0) {
-					// A legacy match without a trailing `;` is a
-					// missing-semicolon-after-character-reference parse error,
-					// except for the spec's historical attribute rule: when
-					// consumed in an attribute value and the next char is `=` or
-					// ASCII alphanumeric, the reference is left undecoded silently.
+					// A legacy match without its `;` is a
+					// missing-semicolon-after-character-reference parse error, except
+					// where the spec's attribute rule silences it.
 					if (!matchedWithSemicolon) {
 						const next = input.charCodeAt(pos + namedEntityConsumed);
 						const inAttribute =
@@ -4003,11 +3712,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_AMBIGUOUS_AMPERSAND:
 				// Consume the next input character:
 				if (isAsciiAlphanumeric(cc)) {
-					// ASCII alphanumeric
-					// If the character reference was consumed as part of an
-					// attribute, then append the current input character to the
-					// current attribute's value. Otherwise, emit the current
-					// input character as a character token.
+					// ASCII alphanumeric: append the input character to the attribute's
+					// value where the reference was consumed in one, otherwise emit it.
 					pos++;
 				} else if (cc === CC_SEMICOLON) {
 					// U+003B SEMICOLON (;)
@@ -4034,11 +3740,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 				// Set the character reference code to zero (0).
 				// Consume the next input character:
 				if (cc === 0x78 || cc === 0x58) {
-					// U+0078 LATIN SMALL LETTER X
-					// U+0058 LATIN CAPITAL LETTER X
-					// Append the current input character to the temporary
-					// buffer. Switch to the hexadecimal character reference
-					// start state.
+					// U+0078 / U+0058: Append the input character to the temporary buffer,
+					// switch to hexadecimal character reference start.
 					state = STATE_HEXADECIMAL_CHARACTER_REFERENCE_START;
 					pos++;
 				} else {
@@ -4051,11 +3754,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#hexadecimal-character-reference-start-state
 			case STATE_HEXADECIMAL_CHARACTER_REFERENCE_START:
-				// Consume the next input character:
-				// ASCII hex digit: reconsume in the hexadecimal character reference state.
+				// ASCII hex digit: reconsume in hexadecimal character reference.
 				// Anything else: absence-of-digits-in-numeric-character-reference parse
-				// error. Flush code points consumed as a character reference. Reconsume
-				// in the return state.
+				// error, flush the consumed code points and reconsume in the return.
 				if (isAsciiHexDigit(cc)) {
 					state = STATE_HEXADECIMAL_CHARACTER_REFERENCE;
 				} else {
@@ -4072,11 +3773,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 
 			// https://html.spec.whatwg.org/multipage/parsing.html#decimal-character-reference-start-state
 			case STATE_DECIMAL_CHARACTER_REFERENCE_START:
-				// Consume the next input character:
-				// ASCII digit: reconsume in the decimal character reference state.
-				// Anything else: absence-of-digits-in-numeric-character-reference parse
-				// error. Flush code points consumed as a character reference. Reconsume
-				// in the return state.
+				// ASCII digit: reconsume in the decimal character reference state. Anything
+				// else: absence-of-digits-in-numeric-character-reference parse error. Flush
+				// code points consumed as a character reference, reconsume in return.
 				if (isAsciiDigit(cc)) {
 					state = STATE_DECIMAL_CHARACTER_REFERENCE;
 				} else {
@@ -4095,12 +3794,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_HEXADECIMAL_CHARACTER_REFERENCE:
 				// Consume the next input character:
 				if (isAsciiHexDigit(cc)) {
-					// ASCII digit / upper hex / lower hex
-					// Multiply the character reference code by 16. Add a numeric
-					// version of the current input character to the character
-					// reference code. Stop accumulating once past the Unicode
-					// range so the value can't overflow (still flags as
-					// outside-range at the end).
+					// ASCII hex digit: multiply the reference code by 16 and add the
+					// input character's value. Accumulation stops past the Unicode range
+					// so it cannot overflow, and still flags as outside-range.
 					if (charRefCode < 0x110000) {
 						const v = cc <= 0x39 ? cc - 0x30 : (cc | 0x20) - 0x61 + 10;
 						charRefCode = charRefCode * 16 + v;
@@ -4112,10 +3808,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_NUMERIC_CHARACTER_REFERENCE_END;
 					pos++;
 				} else {
-					// Anything else
-					// This is a missing-semicolon-after-character-reference
-					// parse error. Reconsume in the numeric character reference
-					// end state.
+					// Anything else: missing-semicolon-after-character-reference parse error,
+					// reconsume in numeric character reference end.
 					reportError(
 						"missing-semicolon-after-character-reference",
 						pos,
@@ -4131,12 +3825,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			case STATE_DECIMAL_CHARACTER_REFERENCE:
 				// Consume the next input character:
 				if (isAsciiDigit(cc)) {
-					// ASCII digit
-					// Multiply the character reference code by 10. Add a numeric
-					// version of the current input character (subtract 0x0030
-					// from the character's code point) to the character reference
-					// code. Stop accumulating once past the Unicode range so the
-					// value can't overflow (still flags as outside-range).
+					// ASCII digit: multiply the reference code by 10 and add the input
+					// character's value. Accumulation stops past the Unicode range so it
+					// cannot overflow, and still flags as outside-range.
 					if (charRefCode < 0x110000) {
 						charRefCode = charRefCode * 10 + (cc - 0x30);
 					}
@@ -4147,10 +3838,8 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 					state = STATE_NUMERIC_CHARACTER_REFERENCE_END;
 					pos++;
 				} else {
-					// Anything else
-					// This is a missing-semicolon-after-character-reference
-					// parse error. Reconsume in the numeric character reference
-					// end state.
+					// Anything else: missing-semicolon-after-character-reference parse error,
+					// reconsume in numeric character reference end.
 					reportError(
 						"missing-semicolon-after-character-reference",
 						pos,
@@ -4179,17 +3868,13 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 		}
 	}
 
-	// Handle EOF in non-data states per the WHATWG spec.
-	//
-	// Each in-progress comment / doctype / cdata / tag emits its partial
-	// token range plus a corresponding `eof-in-X` parse error. Severity is
-	// `"error"` because the emitted token offset range is incomplete (missing
-	// trailing `-->`, `>`, `]]>`, etc.). For data / `<` / `</` / `<!`-only
-	// inputs we emit `eof-before-tag-name` and fall through to flush the
-	// pending text span (which still contains the lone `<`).
-	// EOF inside a character-reference state: run the end-of-reference
-	// processing (numeric end states never run when the reference ends at
-	// EOF), then resume in the return state for the branches below.
+	// WHY: EOF in a non-data state, per the WHATWG spec. An in-progress comment,
+	// doctype, cdata or tag emits its partial range and an `eof-in-X` parse
+	// error, at severity `"error"` because that range is missing its terminator.
+	// A data / `<` / `</` / `<!` input emits `eof-before-tag-name` and falls
+	// through to flush the pending text, which still holds the lone `<`. Inside a
+	// character reference, the end-of-reference processing runs first — the
+	// numeric end states never do at EOF — then the return state's branch below.
 	if (
 		state >= STATE_CHARACTER_REFERENCE &&
 		state <= STATE_NUMERIC_CHARACTER_REFERENCE_END
@@ -4231,10 +3916,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 		state === STATE_SCRIPT_DATA_END_TAG_NAME ||
 		state === STATE_SCRIPT_DATA_ESCAPED_END_TAG_NAME
 	) {
-		// EOF mid-tag — emit the partial open/close tag at EOF so the
-		// consumer still sees the tag. This is a deliberate deviation
-		// from the spec's per-character emission model: rather than
-		// dropping the in-progress tag, we emit its offset range up to EOF.
+		// A deliberate deviation from the spec's per-character emission
+		// model — the in-progress tag is emitted as its offset range up to EOF
+		// rather than dropped, so the consumer still sees it.
 		reportError("eof-in-tag", len, len, "error");
 		// If we hit EOF mid-attribute-name, the name runs to EOF. Set
 		// attributeNameEnd here so the emitted attribute range is valid.
@@ -4242,11 +3926,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			attributeNameEnd = len;
 		}
 		if (attributeNameStart !== -1) emitAttribute(len);
-		// If we hit EOF before the tag-name end was recorded, the name runs
-		// to EOF. `tagNameEnd` may carry over from a previously emitted tag,
-		// so reset it whenever it's missing or stale (less than `tagNameStart`)
-		// — covers `<div` open-tag EOFs as well as `<title>x</tit` and other
-		// content-mode end-tag-name EOFs.
+		// At EOF before the tag-name end was recorded the name runs to EOF, and
+		// `tagNameEnd` may carry over from a previous tag — so it is reset
+		// whenever missing or stale, below `tagNameStart`.
 		if (tagNameStart !== -1 && tagNameEnd < tagNameStart) {
 			tagNameEnd = len;
 		}
@@ -4319,11 +4001,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 			state === STATE_SCRIPT_DATA_DOUBLE_ESCAPED_LESS_THAN_SIGN ||
 			state === STATE_SCRIPT_DATA_DOUBLE_ESCAPE_END
 		) {
-			// Inside `<script><!-- … ` at EOF — spec calls this an
-			// eof-in-script-html-comment-like-text parse error. The
-			// less-than-sign and double-escape-end states reconsume back
-			// into the (double-)escaped state on EOF per spec, which then
-			// hits this same error.
+			// Inside `<script><!-- … ` at EOF: an
+			// eof-in-script-html-comment-like-text parse error. The less-than-sign
+			// and double-escape-end states reconsume into it at EOF, per spec.
 			reportError("eof-in-script-html-comment-like-text", len, len, "error");
 		} else if (state === STATE_TAG_OPEN || state === STATE_END_TAG_OPEN) {
 			// `<` or `</` with nothing after; spec calls this
@@ -4339,10 +4019,9 @@ const tokenize = (input, pos = 0, callbacks = {}) => {
 	return pos;
 };
 
-// WHATWG numeric-character-reference-end Windows-1252 remap table for the
-// 0x80-0x9F range. Per spec these C1 control code points decode to the
-// corresponding Windows-1252 glyph (with a parse error) rather than to the
-// raw C1 control character.
+// WHATWG numeric-character-reference-end remap for 0x80-0x9F: these C1 control
+// code points decode to the matching Windows-1252 glyph, with a parse error,
+// rather than to the control character itself.
 const NUMERIC_C1_REMAP = {
 	0x80: "€",
 	0x82: "‚",
@@ -4378,12 +4057,10 @@ const NUMERIC_C1_REMAP = {
  * @returns {string} decoded character per WHATWG remap rules
  */
 const decodeNumericReference = (code) => {
-	// Per WHATWG numeric-character-reference-end-state:
-	//   - 0x00, > 0x10FFFF, or surrogate (0xD800-0xDFFF) -> U+FFFD.
-	//   - 0x80-0x9F -> Windows-1252 remap (above).
-	//   - Anything else (including noncharacters and C0 controls) -> the
-	//     code point itself; we don't surface the spec's parse-error
-	//     classes here since decoding is happening after the scanner ran.
+	// WHY: numeric-character-reference-end-state maps 0x00, anything above
+	// 0x10FFFF and the surrogates to U+FFFD, 0x80-0x9F through the table above,
+	// and everything else — noncharacters and C0 controls included — to itself.
+	// Its parse-error classes are not raised here: the scanner has already run.
 	if (code === 0 || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff)) {
 		return "�";
 	}
@@ -4419,12 +4096,9 @@ const decodeNamedReference = (str, start, end, nextCharCode, isAttribute) => {
 	const name = str.slice(start + 1, end);
 	const matchEndsWithSemi = name.charCodeAt(name.length - 1) === 0x3b;
 
-	// Attribute-context guard: if the entity match didn't end with `;`
-	// and the next character in the source is `=` or ASCII
-	// alphanumeric, the WHATWG spec says to flush the literal text
-	// rather than decode. The greedy scan already absorbed any
-	// trailing alphanumerics, so the only candidate "next char" here
-	// is `=` (or any non-alphanumeric).
+	// Attribute-context guard: a match not ending in `;` whose next source
+	// character is `=` or alphanumeric is flushed literally rather than decoded.
+	// The greedy scan absorbed the alphanumerics, so only `=` can reach here.
 	if (isAttribute && !matchEndsWithSemi && nextCharCode === 0x3d /* = */) {
 		return undefined;
 	}
@@ -4436,11 +4110,9 @@ const decodeNamedReference = (str, start, end, nextCharCode, isAttribute) => {
 		if (full !== undefined) return full;
 	}
 
-	// Cap the longest-prefix search at MAX_ENTITY_NAME_LEN so pathological
-	// inputs like `&` + thousands of alphanumerics stay linear-time.
-	// Anything past that cap can't possibly match and is appended
-	// verbatim as part of `name.slice(i)`. The full-length case was just
-	// handled above, so start one shorter when it's the cap.
+	// Capping the longest-prefix search at MAX_ENTITY_NAME_LEN keeps `&` plus
+	// thousands of alphanumerics linear-time; nothing past it can match, so it
+	// rides along in `name.slice(i)`. The full length was handled just above.
 	const searchLen =
 		name.length > MAX_ENTITY_NAME_LEN ? MAX_ENTITY_NAME_LEN : name.length - 1;
 	for (let i = searchLen; i > 0; i--) {
@@ -4501,13 +4173,12 @@ const decodeNamedReference = (str, start, end, nextCharCode, isAttribute) => {
  * @returns {string | DecodedEntitiesWithMap} decoded string (with map when `withMap`)
  */
 const decodeEntities = (str, isAttribute, withMap) => {
-	// Hand-rolled scan of one of three reference forms, each with an optional
-	// trailing `;` — `&#x<hex>+` / `&#<dec>+` / `&<alpha><alnum>*` (kept separate
-	// so `&#65b` doesn't eat the `b` as hex): entity-dense text pays no regex
-	// machinery or per-match object, and a string whose references all stay
-	// literal is returned unchanged without rebuilding. Map bookkeeping is
-	// gated on `withMap` at the rare per-decoded-reference points, so the
-	// dominant no-map mode pays nothing for the unified implementation.
+	// WHY: a hand-rolled scan of the three reference forms — `&#x<hex>+`,
+	// `&#<dec>+`, `&<alpha><alnum>*`, kept apart so `&#65b` does not eat the `b`
+	// as hex. Entity-dense text then pays no regex machinery and no per-match
+	// object, and a string whose references all stay literal is returned as it
+	// came. Map bookkeeping is gated on `withMap` at the rare per-reference
+	// points, so the dominant no-map mode pays nothing for sharing this code.
 	let amp = str.indexOf("&");
 	if (amp === -1) return withMap ? { text: str, map: undefined } : str;
 	let out = "";
@@ -4515,10 +4186,9 @@ const decodeEntities = (str, isAttribute, withMap) => {
 	/** @type {number[] | undefined} */
 	let map;
 	do {
-		// `end` stays 0 when the `&` doesn't start a well-formed reference; a
-		// numeric reference's code point accumulates during the digit scan
-		// (saturating above the code-point range — every overflow decodes the
-		// same replacement) so it needs no slice at all.
+		// `end` stays 0 where the `&` starts no well-formed reference. A numeric
+		// reference accumulates during the digit scan, saturating above the
+		// code-point range since every overflow decodes alike, so it needs no slice.
 		let end = 0;
 		let code = -1;
 		let cc = str.charCodeAt(amp + 1);
@@ -4642,17 +4312,9 @@ const escapeAttribute = (s, delimiter, minimal) => {
 		switch (s.charCodeAt(i)) {
 			case CC_AMPERSAND: {
 				// §13.2.5.41: a `&` the parser cannot continue into a reference is
-				// data. The minifier writes it bare; generated markup escapes it.
-				const next = s.charCodeAt(i + 1);
-				if (
-					minimal === true &&
-					next !== CC_NUMBER_SIGN &&
-					!(
-						(next >= 0x30 && next <= 0x39) ||
-						(next >= 0x41 && next <= 0x5a) ||
-						(next >= 0x61 && next <= 0x7a)
-					)
-				) {
+				// data — asked of the table, since `&c` names none. The minifier
+				// writes it bare; generated markup escapes it.
+				if (minimal === true && !_startsCharacterReference(s, i, true)) {
 					continue;
 				}
 				rep = "&amp;";
@@ -4827,23 +4489,20 @@ const EMPTY_ATTRS = /** @type {AttributeRun} */ (
 	Object.freeze({ start: 0, count: 0 })
 );
 
-// === Struct-of-arrays AST backend ===
-// One AST node = one integer id (`HtmlNodeRef`) indexing the parallel columns
-// below — no per-node object and no per-parent children array. Tree shape
-// lives in the four link columns (parent / firstChild / lastChild /
-// nextSibling); the only heap references are the string payload / attribute
-// name-and-value side arrays. Columns are module-level and reused
-// across parses (grown, shrunk on release only past `_COLUMN_SHRINK_CAPACITY`,
-// mirroring the CSS parser's column backend), so a steady-state parse
-// allocates almost nothing per node; consumers must fully read a tree before
-// the next `parseHtml` call. Id 0 is reserved as "no node" so the link columns
-// can use 0 as null.
+// WHY: struct-of-arrays AST backend. One node is one integer id
+// (`HtmlNodeRef`) into the parallel columns below, so there is no per-node
+// object and no per-parent children array: shape lives in the four link
+// columns, and the only heap references are the payload and attribute side
+// arrays. The columns are module-level and reused across parses — grown, and
+// shrunk on release only past `_COLUMN_SHRINK_CAPACITY` — so a steady-state
+// parse allocates almost nothing per node, at the price of a tree being valid
+// only until the next `parseHtml`. Id 0 is reserved so the links can use it as
+// null.
 let _nodeCapacity = 0;
 let _nodeCount = 0;
-// Highest id `_nodeCount` ever reached this parse. Streaming rewinds the
-// allocator, so `_nodeCount` alone no longer bounds the ids that were written —
-// the release pass has to clear up to here or the recycled slots keep their
-// strings alive until a later parse happens to overwrite them.
+// Highest id `_nodeCount` reached this parse. Streaming rewinds the allocator,
+// so `_nodeCount` no longer bounds the ids written, and the release pass has to
+// clear up to here or a recycled slot keeps its strings alive.
 let _nodeHighWater = 0;
 /** `NodeType` per node */
 let _nodeTypes = new Uint8Array(0);
@@ -4917,12 +4576,10 @@ const _templateContentOf = (el) =>
 const _namespaceOf = (el) => _nodeFlags[el] & NS_MASK;
 
 // === Attribute columns ===
-// One attribute = one integer id into these columns; an element (and a
-// start-tag token) holds a contiguous run. The value string is derived from
-// the source by offset on read — `_attrValues` carries an override only for
-// valueless attributes (`""`) and offset-less adoption-agency clones — and the
-// html5lib serializer name is derived from the adjusted name plus one flag
-// bit, so per attribute only the interned name pointer is retained.
+
+// One attribute is one integer id here, and an element holds a contiguous run.
+// Values are read from the source by offset and the serializer name from the
+// adjusted name, so only the name pointer is retained per attribute.
 let _attrCapacity = 0;
 let _attrCount = 0;
 // Elements a repeated `<html>` / `<body>` start tag merged attributes onto
@@ -5038,6 +4695,15 @@ const _attrValueOf = (i) => {
 		: _htmlSource.slice(_attrValueStarts[i], _attrValueEnds[i]);
 };
 
+/**
+ * An attribute's value as the element is handed it. The tree construction
+ * matches values the tokenizer has already resolved references in, so how one
+ * is spelled must not decide which branch a token takes.
+ * @param {number} i the attribute
+ * @returns {string} the value with its character references resolved
+ */
+const _attrValueDecoded = (i) => decodeEntities(_attrValueOf(i), true);
+
 // Linear name lookup in a run — attribute lists are short, a loop beats a Map.
 /** @type {(start: number, count: number, name: string) => number} */
 const _findAttr = (start, count, name) => {
@@ -5061,10 +4727,9 @@ const _copyAttr = (i) => {
 	return c;
 };
 
-// html5lib serializer name, derived: a `FOREIGN_ATTR_NS`-adjusted attribute is
-// flagged (its name is the table key), and a camelCase-adjusted name contains
-// an uppercase letter (unadjusted names are always lowercased), serializing as
-// itself. Everything else serializes as the plain name (undefined here).
+// Derived html5lib serializer name: a `FOREIGN_ATTR_NS`-adjusted attribute is
+// flagged and keyed by its name, a camelCase-adjusted one carries an uppercase
+// letter and serializes as itself, and everything else is the plain name.
 /** @type {(i: number) => string | undefined} */
 const _attrSerializedName = (i) => {
 	if ((_attrFlags[i] & 1) !== 0) return FOREIGN_ATTR_NS[_attrNames[i]];
@@ -5159,10 +4824,9 @@ const _resetAstColumns = () => {
 	_doctypeSystemId = null;
 };
 
-// The typed-array columns grow to the largest document ever parsed; above this
-// capacity they are re-shrunk on release so one pathological file can't pin
-// tens of MB at module level for the process lifetime (~46 bytes/node,
-// ~17 bytes/attribute of capacity across the columns).
+// The typed-array columns grow to the largest document parsed, and are shrunk
+// on release above this capacity so one pathological file cannot pin tens of MB
+// at module level for the process lifetime.
 const _COLUMN_SHRINK_CAPACITY = 65536;
 
 // Release the side arrays' heap references (strings, attribute names/values)
@@ -5531,10 +5195,9 @@ const buildNameInternTable = (names) => {
 		hashes[slot] = h;
 		values[slot] = name;
 	}
-	// `memo` short-circuits the hash walk for a name seen a moment ago (see
-	// `internLowerName`); "" marks an empty slot so the load stays monomorphic.
-	// `sourceBacked` lists the slots holding a slice of the parsed input — the
-	// only ones the next parse drops — and `noted` keeps each in it once.
+	// `memo` short-circuits the hash walk for a name just seen, with `""` as the
+	// empty slot so the load stays monomorphic. `sourceBacked` lists the slots
+	// holding a slice of the input — the only ones the next parse drops.
 	return {
 		mask,
 		hashes,
@@ -5583,10 +5246,9 @@ const _dropSourceBackedNames = (table) => {
  * @returns {string} lowercased name
  */
 const internLowerName = (table, input, start, end) => {
-	// A document spells the same few names over and over, so a direct-mapped
-	// memo keyed on folded first char + length answers most calls with one
-	// verified compare instead of the full hash walk. Every hit re-verifies
-	// against the current range, so a collision only ever misses, never lies.
+	// A document spells the same few names over and over, so a direct-mapped memo
+	// keyed on folded first char and length answers most calls in one compare.
+	// Every hit re-verifies, so a collision misses rather than lies.
 	let c0 = input.charCodeAt(start);
 	if (c0 >= 0x41 && c0 <= 0x5a) c0 += 0x20;
 	const memo = table.memo;
@@ -5912,7 +5574,7 @@ const htmlIntegrationPoint = (el) => {
 	if (_namespaceOf(el) === NS_MATHML && _tagNameOf(el) === "annotation-xml") {
 		const enc = _findAttr(_nodeAttrStarts[el], _nodeAttrCounts[el], "encoding");
 		if (enc !== 0) {
-			const value = _attrValueOf(enc).toLowerCase();
+			const value = _attrValueDecoded(enc).toLowerCase();
 			if (value === "text/html" || value === "application/xhtml+xml") {
 				return true;
 			}
@@ -5967,14 +5629,12 @@ const adjustMathmlAttrs = (run) => {
 };
 
 // ---- HTML tree-construction parser state ----
-// One active parse at a time (results are valid only until the next
-// `parseHtml`); kept at module scope so the helpers below are defined once
-// instead of re-created as closures on every parse.
+// One active parse at a time, its result valid only until the next `parseHtml`:
+// module scope is what defines the helpers below once rather than per parse.
 let source = "";
-// Whole-document properties, so a substring cannot contain what the input does
-// not. Decoding cannot introduce either: a numeric reference to 0 yields U+FFFD,
-// and CR normalization runs on the raw slice before decoding. Default to `true`
-// so an unset flag only ever costs the old scan.
+// Whole-document properties, so a substring cannot hold what the input does not,
+// and decoding introduces neither: a numeric reference to 0 yields U+FFFD, and
+// CR normalization runs on the raw slice first. An unset flag costs the old scan.
 let inputHasCr = true;
 let inputHasNul = true;
 let skipText = false;
@@ -6003,8 +5663,21 @@ const templateModes = [];
 let quirks = false;
 /** @type {HtmlElement} fragment context element (0 = document parse) */
 let fragment = 0;
+
+/**
+ * @returns {boolean} whether the parser is parsing template contents
+ */
+const parsingTemplateContents = () =>
+	open.some(isHtmlTemplateEl) || (fragment !== 0 && isHtmlTemplateEl(fragment));
+
 let tokenEnd = 0;
 let swallowNextNewline = false;
+// Which of `</html>` / `</head>` / `</body>` the source spelled, per parse: the
+// tree records no end tag, and `removeImpliedTags` keeps the ones that were written.
+let sourceShellEnds = 0;
+const SHELL_END_HTML = 1;
+const SHELL_END_HEAD = 2;
+const SHELL_END_BODY = 4;
 let eofInTag = false;
 let sawSelectedContent = false;
 const decode = decodeEntities;
@@ -6208,12 +5881,9 @@ const _recordFostered = (table, node) => {
 const insertCharacters = (data, start, end) => {
 	const place = appropriatePlace();
 	if (_nodeTypes[place.parent] === NodeType.Document) return; // never insert text into document
-	// `skip.text`: drop every `Text` node — construction already used the
-	// decoded token, so removing the node never affects element structure.
-	// For a raw-text element record the body end so a consumer reads the span
-	// [`tagEnd`, `contentEnd`] without a `Text` node (see `HtmlParser`).
-	// Namespace-agnostic: `HtmlParser` extracts `<script>`/`<style>` bodies in
-	// foreign content (e.g. SVG `<style>`) too.
+	// `skip.text` drops every `Text` node, which construction has already used,
+	// so element structure is unaffected. A raw-text element instead records its
+	// body end, giving a consumer the span [`tagEnd`, `contentEnd`].
 	if (skipText) {
 		const p = place.parent;
 		if (
@@ -6224,10 +5894,9 @@ const insertCharacters = (data, start, end) => {
 		}
 		return;
 	}
-	// Inlined text insert: when the run merges into the adjacent text sibling
-	// (common with inline formatting) only the string is appended — no
-	// throwaway text node is allocated. Mirrors `insertAtPlace`/`appendTo`,
-	// including that the before-node merge does not bump `end`.
+	// Inlined text insert: a run merging into the adjacent text sibling, common
+	// with inline formatting, appends the string alone rather than allocating a
+	// throwaway node. Mirrors `insertAtPlace` / `appendTo`, `end` included.
 	const p = effParent(place.parent);
 	const before = place.beforeNode;
 	if (before !== 0) {
@@ -6316,9 +5985,8 @@ const insertForeignElement = (tagName, ns, attrs, pos) => {
 };
 
 // ---- scopes ----
-// Scope "kind" selects which extra elements act as boundaries. Passed as a
-// small int so the scope checks below allocate no per-call predicate closure
-// (these run several times per body tag).
+// Scope "kind" selects which extra elements act as boundaries, as a small int so
+// the checks below — several per body tag — allocate no predicate closure.
 const SCOPE_DEFAULT = 0;
 const SCOPE_BUTTON = 1;
 const SCOPE_LIST_ITEM = 2;
@@ -6606,10 +6274,9 @@ const resetInsertionMode = () => {
 const leadingWs = (t, insert) => {
 	const m = /^[\t\n\f\r ]+/.exec(t.data);
 	const ws = m ? m[0] : "";
-	// `t.data` is decoded, the offsets are raw, so counting one in the other
-	// only lines up when decoding changed no length (no CRLF, no reference).
-	// Otherwise keep the whole span: too wide is harmless, too narrow names
-	// source that is not this text (see the `Text` printer).
+	// `t.data` is decoded and the offsets are raw, so counting one in the other
+	// lines up only where decoding changed no length. Otherwise the whole span is
+	// kept: too wide is harmless, too narrow names source that is not this text.
 	const aligned = t.end - t.start === t.data.length;
 	if (ws && insert) {
 		insertCharacters(ws, t.start, aligned ? t.start + ws.length : t.end);
@@ -6895,10 +6562,9 @@ const adoptionAgency = (subject, pos) => {
 			cloneAttrs(fmt),
 			null
 		);
-		// Take all direct children of `furthest` (a template's content fragment
-		// deliberately stays put — mirrors childrenOf-less spec behavior here). A
-		// declarative shadow root is not one of them: the engine took it out of
-		// the tree when it attached, so it stays with the host it hangs off.
+		// Take the direct children of `furthest`; a template's content fragment
+		// stays put. A declarative shadow root is not one of them — the engine took
+		// it out of the tree on attaching, so it stays with its host.
 		let k = _nodeFirstChildren[furthest];
 		_nodeFirstChildren[furthest] = 0;
 		_nodeLastChildren[furthest] = 0;
@@ -7185,7 +6851,7 @@ modes.inHead = (t) => {
 				_nodeTypes[host] === NodeType.Element &&
 				_isShadowHost(host)
 			) {
-				const mode = _attrValueOf(shadowRootMode).toLowerCase();
+				const mode = _attrValueDecoded(shadowRootMode).toLowerCase();
 				if (mode === "open" || mode === "closed") {
 					_nodeFlags[el] |= FLAG_SHADOW_ROOT;
 					_nodeFlags[host] |= FLAG_SHADOW_HOST;
@@ -7197,6 +6863,7 @@ modes.inHead = (t) => {
 	}
 	if (t.type === TOKEN_END_TAG) {
 		if (t.name === "head") {
+			sourceShellEnds |= SHELL_END_HEAD;
 			popOpen();
 			mode = MODE_AFTER_HEAD;
 			return;
@@ -7256,6 +6923,7 @@ modes.afterHead = (t) => {
 		const r = leadingWs(t, true);
 		if (!r) return;
 		insertHtmlElement("body", EMPTY_ATTRS, null);
+		framesetOk = true;
 		mode = MODE_IN_BODY;
 		process(r);
 		return;
@@ -7293,6 +6961,7 @@ modes.afterHead = (t) => {
 		if (!BODY_HTML_BR.has(t.name)) return;
 	}
 	insertHtmlElement("body", EMPTY_ATTRS, null);
+	framesetOk = true;
 	mode = MODE_IN_BODY;
 	process(t);
 };
@@ -7305,9 +6974,8 @@ modes.inBody = (t) => {
 		if (t.data === "") return;
 		reconstructAfe();
 		insertCharacters(t.data, t.start, t.end);
-		// `framesetOk` only ever goes true→false, so once it's false skip the
-		// per-text-token whitespace scan entirely (it flips false very early in
-		// real documents).
+		// After the implicit-body reset in "after head", `framesetOk` only goes
+		// true→false, so once false skip this per-text-token whitespace scan.
 		if (framesetOk && !isAllWs(t.data)) framesetOk = false;
 		return;
 	}
@@ -7409,7 +7077,7 @@ const startTagInBody = (t) => {
 		return;
 	}
 	if (name === "form") {
-		if (form && !open.some(isHtmlTemplateEl)) {
+		if (form && !parsingTemplateContents()) {
 			return;
 		}
 		closeIfPInButtonScope();
@@ -7417,7 +7085,7 @@ const startTagInBody = (t) => {
 		// not, so anything open between the two forms moves.
 		if (_formResetWouldPop()) _printFromSource = true;
 		const el = insertHtmlElement("form", t.attrs, t.pos);
-		if (!open.some(isHtmlTemplateEl)) {
+		if (!parsingTemplateContents()) {
 			form = el;
 		}
 		return;
@@ -7578,7 +7246,7 @@ const startTagInBody = (t) => {
 		insertHtmlElement("input", t.attrs, t.pos);
 		popOpen();
 		const ty = _findAttr(t.attrs.start, t.attrs.count, "type");
-		if (ty === 0 || _attrValueOf(ty).toLowerCase() !== "hidden") {
+		if (ty === 0 || _attrValueDecoded(ty).toLowerCase() !== "hidden") {
 			framesetOk = false;
 		}
 		return;
@@ -7697,6 +7365,7 @@ const endTagInBody = (t) => {
 	}
 	if (name === "body" || name === "html") {
 		if (!inScope("body")) return;
+		sourceShellEnds |= name === "html" ? SHELL_END_HTML : SHELL_END_BODY;
 		mode = MODE_AFTER_BODY;
 		if (name === "html") process(t);
 		return;
@@ -7708,7 +7377,7 @@ const endTagInBody = (t) => {
 		return;
 	}
 	if (name === "form") {
-		if (!open.some(isHtmlTemplateEl)) {
+		if (!parsingTemplateContents()) {
 			const node = form;
 			form = 0;
 			if (!node || !inScopeEl(node)) return;
@@ -7756,10 +7425,9 @@ const endTagInBody = (t) => {
 		/* take a deep breath */
 	}
 	if (FORMATTING.has(name)) {
-		// With no such element in the list, the algorithm hands the token back
-		// (§13.2.6.4.7, "any other end tag") rather than swallowing it — which is
-		// what Noah's Ark leaves behind: an element still open that the list no
-		// longer names.
+		// With no such element in the list, §13.2.6.4.7 hands the token back rather
+		// than swallowing it — which is what Noah's Ark leaves behind: an element
+		// still open that the list no longer names.
 		if (!adoptionAgency(name, t.pos)) anyOtherEndTag(name);
 		return;
 	}
@@ -7816,10 +7484,9 @@ modes.text = (t) => {
 		return;
 	}
 	if (t.type === TOKEN_END_TAG) {
-		// Treat as rawtext rather than an end tag when it can't close the
-		// current element: a non-matching name (e.g. a fragment context), or
-		// a name that ran straight to EOF with no delimiter (`</script` at
-		// EOF — the tokenizer still emits a partial tag there).
+		// Rawtext rather than an end tag where it cannot close the current
+		// element: a name that does not match, or one running to EOF with no
+		// delimiter, which the tokenizer still emits as a partial tag.
 		if (
 			cur() &&
 			(t.name !== _tagNameOf(cur()) || t.pos.end === t.pos.nameEnd)
@@ -7900,17 +7567,19 @@ modes.inTable = (t) => {
 		}
 		if (name === "input") {
 			const ty = _findAttr(t.attrs.start, t.attrs.count, "type");
-			if (ty !== 0 && _attrValueOf(ty).toLowerCase() === "hidden") {
+			if (ty !== 0 && _attrValueDecoded(ty).toLowerCase() === "hidden") {
 				insertHtmlElement("input", t.attrs, t.pos);
 				popOpen();
 				return;
 			}
 		}
 		if (name === "form") {
-			if (form || open.some(isHtmlTemplateEl)) {
+			const inTemplate = parsingTemplateContents();
+			if (form && !inTemplate) {
 				return;
 			}
-			form = insertHtmlElement("form", t.attrs, t.pos);
+			const el = insertHtmlElement("form", t.attrs, t.pos);
+			if (!inTemplate) form = el;
 			popOpen();
 			return;
 		}
@@ -8211,6 +7880,7 @@ modes.afterBody = (t) => {
 	if (t.type === TOKEN_START_TAG && t.name === "html") return modes.inBody(t);
 	if (t.type === TOKEN_END_TAG && t.name === "html") {
 		if (fragment) return;
+		sourceShellEnds |= SHELL_END_HTML;
 		mode = MODE_AFTER_AFTER_BODY;
 		return;
 	}
@@ -8317,11 +7987,11 @@ const dispatch = () => {
 	}
 };
 
-// Tokenizer callbacks, hoisted to module scope and closing over the module-
-// scope parser state. `tokenize`'s indirect `callbacks.text(...)` / `openTag`
-// / `attribute(...)` sites then see one stable function identity across every
-// parse, staying monomorphic so V8 can inline them — a fresh per-parse closure
-// made them megamorphic and blocked inlining. `parseHtml` only refreshes
+// WHY: tokenizer callbacks hoisted to module scope, over the module-scope
+// parser state, so `tokenize`'s indirect `callbacks.text(...)` / `openTag` /
+// `attribute(...)` sites see one stable function identity across every parse.
+// They stay monomorphic and V8 inlines them; a fresh per-parse closure made
+// them megamorphic and blocked that. `parseHtml` refreshes only
 // `fragmentContext` on the shared object before each tokenize.
 
 /** @type {() => boolean} */
@@ -8380,10 +8050,9 @@ const handleDoctypeToken = (
 	// newline; anything else clears the flag (§13.2.6.4.7 "the next token").
 	swallowNextNewline = false;
 	tok.type = TOKEN_DOCTYPE;
-	// A missing name and an empty one are the same to every consumer here: the
-	// spec's name states always append at least one character.
-	// ASCII-only folding: the name states lowercase ASCII upper alpha and append
-	// every other character unchanged, so a name of `Ð` stays `Ð`.
+	// A missing name and an empty one are alike to every consumer here, since the
+	// spec's name states always append a character. Folding is ASCII-only, as
+	// those states lowercase upper alpha and append the rest as written.
 	tok.name =
 		nameStart === -1
 			? ""
@@ -8506,10 +8175,9 @@ const handleCommentToken = (input, start, end, dataStart, dataEnd) => {
 };
 /** @type {(input: string, start: number, end: number) => number} */
 const handleTextToken = (input, start, end) => {
-	// `skip.text` fast path: node dropped, so only whitespace-ness matters.
-	// With no `&`/`\0`/`\r` (and no pending newline-swallow) the decoded value
-	// equals the raw range — dispatch a canonical marker (`" "`/`"x"`) without
-	// the slice + entity decode; anything trickier falls through.
+	// `skip.text` drops the node, so only whitespace-ness matters. Absent `&`,
+	// `\0`, `\r` and a pending newline-swallow the decoded value is the raw range,
+	// so a canonical marker is dispatched without slicing or decoding.
 	if (skipText && !swallowNextNewline) {
 		let hasNonWhitespace = false;
 		let i = start;
@@ -8586,10 +8254,9 @@ const handleAttributeToken = (
 	}
 	if (dup) pendAttrDropped = true;
 	if (!dup) {
-		// The raw (undecoded) value is read from the source by offset on
-		// demand: consumers re-resolve requests from it and the offsets must
-		// stay aligned with the source. Only a valueless attribute stores an
-		// override ("").
+		// The raw value is read from the source by offset on demand, since
+		// consumers re-resolve requests from it and the offsets have to stay
+		// aligned. Only a valueless attribute stores an override.
 		_allocAttr(
 			name,
 			valueStart !== -1 ? null : "",
@@ -8710,6 +8377,7 @@ const parseHtml = (input, pos = 0, options = {}) => {
 	_dropSourceBackedNames(TAG_NAME_INTERN);
 	_dropSourceBackedNames(ATTR_NAME_INTERN);
 	const { fragmentContext, skip = EMPTY_SKIP } = options;
+	sourceShellEnds = 0;
 	skipText = skip.text === true;
 	skipComments = skip.comments === true;
 	skipDoctype = skip.doctype === true;
@@ -8721,26 +8389,21 @@ const parseHtml = (input, pos = 0, options = {}) => {
 	_openStackChanged = false;
 	_openSpliced = false;
 	_streamHalted = false;
-	// Pre-size the columns from the input length: a document big enough to
-	// exceed `_COLUMN_SHRINK_CAPACITY` re-enters with released (empty) columns,
-	// and growing through the doubling cascade re-allocates and copies every
-	// column several times per parse. ~12 bytes/node and ~50 bytes/attribute
-	// are the densest realistic HTML, so `len/12` (`len/48`) reaches the final
-	// capacity in one allocation; a sparser document over-allocates bounded
-	// scratch that the post-walk release frees, and the doubling growth remains
-	// as the safety net when the estimate is short. `skip.text` (what
-	// `HtmlParser` uses) drops every text node — roughly half of all nodes — so
-	// its node estimate uses `len/24`; attributes are unaffected by the skip and
-	// keep `len/48`.
+	// WHY: pre-size the columns from the input length. A document past
+	// `_COLUMN_SHRINK_CAPACITY` re-enters with released columns, and the doubling
+	// cascade would re-allocate and copy every one of them several times per
+	// parse. The densest realistic HTML runs about 12 bytes per node and 50 per
+	// attribute, so `len/12` and `len/48` reach the final capacity in one
+	// allocation, a sparser document over-allocates scratch the release frees,
+	// and doubling stays as the net under a short estimate. `skip.text`, which
+	// `HtmlParser` uses, drops roughly half the nodes and so estimates `len/24`;
+	// attributes are untouched by it.
 	let nodeEstimate = (input.length / (skipText ? 24 : 12)) | 0;
 	const attrEstimate = (input.length / 48) | 0;
 	if (_streamEligible) {
-		// Node ids are recycled once streaming starts, so a document past the
-		// threshold never needs the whole estimate — one allocation covering the
-		// activation point plus a batch of headroom is its high-water mark. A
-		// document below it is unaffected and still pre-sizes exactly. Attributes
-		// are not recycled (`_attrCount` only resets between parses), so their
-		// estimate stands either way.
+		// Streaming recycles node ids, so a document past the threshold peaks at
+		// the activation point plus a batch of headroom rather than at the whole
+		// estimate. Attributes are not recycled, so their estimate stands.
 		const cap = _STREAM_MIN_NODES + _FLUSH_BATCH * 2;
 		if (nodeEstimate > cap) nodeEstimate = cap;
 	}
@@ -8835,10 +8498,10 @@ const parseHtml = (input, pos = 0, options = {}) => {
 	tok.type = TOKEN_EOF;
 	dispatch();
 
-	// Not while printing: the mirror is content the engine makes, with no source
-	// text behind it, and the printer emits what it walks — so serializing it
-	// would write the selected option's subtree into the document, where the
-	// engine that reads the output mirrors it a second time.
+	// WHY: not while printing. The mirror is content the engine makes, with no
+	// source text behind it, and the printer emits what it walks — so serializing
+	// it would write the selected option's subtree into the document, which the
+	// engine reading that output would then mirror a second time.
 	if (sawSelectedContent && _writer === undefined) {
 		mirrorSelectedContent(doc, 0);
 	}
@@ -9009,7 +8672,7 @@ const mirrorSelectedContent = (node, select) => {
  * @property {boolean=} mergeScripts print a run of adjacent bare `<script>` elements whose bodies this print writes itself as one, which removes elements, hoists a later body's declarations into the ones before it, and lets a failing body end the whole run (default false)
  * @property {boolean=} sortAttributes print an element's attributes commonest name first, ties by name, which nothing in HTML reads (default false)
  * @property {boolean=} sortTokenLists print every token list the DOM reads as a set (`class`, `rel`, `part`, …) in token order (default false)
- * @property {(boolean | "smart" | "all")=} removeRedundantAttributes drop an attribute whose value is the element's own default; `true` is `"smart"`, and `"all"` also drops the spec defaults a selector can match (default false)
+ * @property {(boolean | "smart" | "all")=} removeRedundantAttributes drop an attribute whose value is the element's own default; `true` is `"smart"`, and `"all"` also drops the spec defaults a selector can match, and with them a value naming no keyword where that says the same (default false)
  * @property {(boolean | "smart" | "all")=} removeImpliedTags how much of the `<html>` / `<head>` / `<body>` shell §13.1.2.4 lets the parser imply may be left out: `"smart"` leaves out only the `<html>` start tag, `true` (or `"all"`) all six, `false` none (default `"smart"`)
  * @property {boolean=} deferSrcdoc whether an `<iframe srcdoc>` is among what `deferEmbeddedSource` collects (default true); false for a caller that minifies them itself, which keeps the attribute on the normal path and its shorter delimiter
  * @property {DeferredEmbeddedSource[]=} deferEmbeddedSource collects what `renderEmbeddedSource` would be offered instead of offering it, for a caller whose renderer is asynchronous: the print leaves a marker for each and `finish` puts the answers in their place, so one parse serves both. Takes precedence over `renderEmbeddedSource`
@@ -9063,19 +8726,20 @@ const _tailFusesWithNextTag = (s) => {
  * escape — and neither does the `&` in a query string.
  * @param {string} s decoded text
  * @param {number} i the `&`'s index
+ * @param {boolean=} terminated whether nothing can follow `s` in the same run
  * @returns {boolean} true when it has to be escaped
  */
-const _startsCharacterReference = (s, i) => {
-	// Nothing terminates the run before the node ends, so the next sibling's
-	// first characters could complete it once a comment between them is dropped
-	// (`a &am` + `p;`) — the same reason the source fast path keeps out.
+const _startsCharacterReference = (s, i, terminated) => {
+	// Unterminated, the next sibling's first characters could complete the run
+	// once a comment between them is dropped (`a &am` + `p;`) — the same reason
+	// the source fast path keeps out. An attribute value ends at its delimiter.
 	let end = i + 1;
 	while (end < s.length) {
 		const c = s.charCodeAt(end);
 		if (!isAsciiAlphanumeric(c) && c !== 0x23) break;
 		end++;
 	}
-	if (end === s.length) return true;
+	if (end === s.length && terminated !== true) return true;
 	const next = s.charCodeAt(i + 1);
 	// `#` opens a numeric reference.
 	if (next === 0x23) return true;
@@ -9089,6 +8753,26 @@ const _startsCharacterReference = (s, i) => {
 	return false;
 };
 
+/**
+ * Whether the `<` at `at` would leave §13.2.5.6's data state rather than stand
+ * as a character. A trailing one counts: what follows it in the output is the
+ * next sibling's first character, which this string does not hold.
+ * @param {string} s decoded text
+ * @param {number} at index of the `<`
+ * @returns {boolean} true when the `<` has to be written as a reference
+ */
+const _opensMarkup = (s, at) => {
+	if (at + 1 === s.length) return true;
+	const next = s.charCodeAt(at + 1);
+	return (
+		next === 0x21 ||
+		next === 0x2f ||
+		next === 0x3f ||
+		(next >= 0x41 && next <= 0x5a) ||
+		(next >= 0x61 && next <= 0x7a)
+	);
+};
+
 /**
  * Escape a text node's decoded data for re-serialization: `&` and `<`, which
  * start a character reference and a tag, plus `>` outside minification, where
@@ -9103,15 +8787,15 @@ const _startsCharacterReference = (s, i) => {
  */
 const _escapeTextContent = (s, minify) => {
 	// A bare `>` is only ever a character in text, so §13.3's escape of it buys
-	// nothing but bytes. `<` always starts a tag, and an `&` only sometimes
-	// starts a character reference — §13.2.5.72 flushes the rest as literal text.
+	// nothing but bytes. A `<` only opens markup before what §13.2.5.6 leaves the
+	// data state for, and an `&` only sometimes starts a character reference.
 	if (minify) {
 		if (!s.includes("&") && !s.includes("<") && !s.includes("\r")) return s;
 		let out = "";
 		let last = 0;
 		for (let i = 0; i < s.length; i++) {
 			const c = s.charCodeAt(i);
-			if (c === 0x3c) {
+			if (c === 0x3c && _opensMarkup(s, i)) {
 				out += `${s.slice(last, i)}&lt;`;
 				last = i + 1;
 			} else if (c === 0x26 && _startsCharacterReference(s, i)) {
@@ -9430,7 +9114,12 @@ const _impliedStartTagShape = (path, node, child) => {
 	if (path.attributeCount(node) !== 0 || path.namespace(node) !== NS_HTML) {
 		return false;
 	}
-	const first = path.firstChild(node);
+	// What will print, not what the tree holds: a comment minifying drops is not
+	// content the tag has to stay for, the same way the end tags read it.
+	let first = path.firstChild(node);
+	while (first !== 0 && _printsNothing(path, first)) {
+		first = path.nextSibling(first);
+	}
 	return (
 		first !== 0 &&
 		path.type(first) === NodeType.Element &&
@@ -9599,24 +9288,34 @@ let _deferEmbeddedSource;
 // them itself keeps the attribute on the normal path, which re-quotes it to
 // whichever delimiter its content makes shorter.
 /**
- * One attribute, written with whichever delimiter its value needs fewer escapes
- * inside — a minified document is mostly `"`, so one holding a `"` is shorter
- * quoted with `'`. Where neither costs anything the source's own is kept.
- * @param {string} name the attribute name
+ * One value, written with whichever delimiter it needs fewer escapes inside — a
+ * minified document is mostly `"`, so a value holding a `"` is shorter quoted
+ * with `'`. Where neither costs anything the source's own delimiter is kept.
  * @param {string} value the value to write
  * @param {string} source the delimiter the source spelled it with, if any
- * @returns {string} the attribute, delimiter and all
+ * @returns {string} the value, delimiters and all
  */
-const _writeQuotedAttribute = (name, value, source) => {
+const _quoteDecodedValue = (value, source) => {
 	const double = value.includes('"');
 	const single = value.includes("'");
 	const quote =
 		double !== single ? (double ? 39 : 34) : source === "'" ? 39 : 34;
 	const delimiter = String.fromCharCode(quote);
 
-	return ` ${name}=${delimiter}${escapeAttribute(value, quote, true)}${delimiter}`;
+	return `${delimiter}${escapeAttribute(value, quote, true)}${delimiter}`;
 };
 
+/**
+ * One attribute, written with the delimiter `_quoteDecodedValue` picks for its
+ * value.
+ * @param {string} name the attribute name
+ * @param {string} value the value to write
+ * @param {string} source the delimiter the source spelled it with, if any
+ * @returns {string} the attribute, delimiter and all
+ */
+const _writeQuotedAttribute = (name, value, source) =>
+	` ${name}=${_quoteDecodedValue(value, source)}`;
+
 let _deferSrcdoc = true;
 
 /**
@@ -9748,9 +9447,8 @@ let _mergeScripts = false;
 let _absorbed = null;
 
 // Foster parenting puts a node before the table it was written inside, so tree
-// order and source order disagree there. Recorded where it happens.
-// The tree holds something no arrangement of tags reaches: an element no source
-// tag wrote, or a list item a special element stopped the loop from closing.
+// and source order disagree there; it is recorded where it happens. The tree
+// then holds what no arrangement of tags reaches.
 let _printFromSource = false;
 /** @type {HtmlNodeRef[] | null} this parse's fosters, flat: table, then node */
 let _fosteredLog = null;
@@ -9773,14 +9471,14 @@ let _fosterOpenTail = null;
 /** @type {number} how far the furthest verbatim span reached */
 let _fosterSpanEnd = 0;
 
-// How much of the `<html>` / `<head>` / `<body>` shell §13.1.2.4 lets the
-// parser imply may be left out (see `HtmlProcessOptions`). Every *other*
-// optional tag goes unconditionally — nothing can observe that — but these six
-// are what a consumer reading the page with a regexp rather than a parser looks
-// for. `"smart"` leaves out the one such a reader never matches: the `<html>`
-// start tag, omittable only when it carries no attribute at all, so the
-// `<html lang=en>` anyone greps for keeps its tag anyway. `</html>` stays with
-// it — a truncation check reads a page as complete by finding one.
+// WHY: how much of the `<html>` / `<head>` / `<body>` shell §13.1.2.4 lets the
+// parser imply may be left out. Every other optional tag goes unconditionally,
+// since nothing can observe that, but these six are what a consumer reading the
+// page with a regexp rather than a parser looks for. `"smart"` drops the one
+// such a reader never matches: the `<html>` start tag, omittable only with no
+// attribute at all, so the `<html lang=en>` anyone greps for keeps its tag.
+// `</html>` stays with it, since a truncation check reads a page as complete by
+// finding one.
 /** @type {"none" | "smart" | "all"} */
 let _removeImpliedTags = "smart";
 
@@ -9807,7 +9505,11 @@ const _canOmitShellStart = (path, name, node) => {
 	if (name === "html") return true;
 	if (_removeImpliedTags !== "all") return false;
 	if (name === "head") return type === NodeType.Element;
-	if (type === NodeType.Text) return !startsWithWs(path.data(first));
+	// Whitespace `"all"` drops is not whitespace the tag has to stay for; any
+	// lesser tier keeps it, and without the tag the parser drops it on the way in.
+	if (type === NodeType.Text) {
+		return !startsWithWs(path.data(first)) || _collapseWhitespace === "all";
+	}
 	return !BODY_START_KEPT_BEFORE.has(path.tagName(first));
 };
 
@@ -9847,6 +9549,32 @@ const _shellEndTagOmittable = (path, name, node) => {
 const _canOmitShellEnd = (path, name, node) =>
 	_removeImpliedTags === "all" && _shellEndTagOmittable(path, name, node);
 
+/**
+ * The end tag a transparent implied element still prints: the parser re-implies
+ * the start tag behind it, never the end tag, and outside `"all"` a shell tag
+ * the source spelled stays — `</html>` is what a truncation check looks for.
+ * @param {HtmlPath} path the accessor
+ * @param {string} name the element's lowercased tag name
+ * @param {HtmlNodeRef} node the element
+ * @returns {string} the end tag, or `""` when nothing needs it
+ */
+const _impliedCloseTag = (path, name, node) => {
+	if (!SHELL_ELEMENTS.has(name)) {
+		return _canOmitEndTag(path, name, node) ? "" : `</${name}>`;
+	}
+	const spelled =
+		name === "html"
+			? SHELL_END_HTML
+			: name === "head"
+				? SHELL_END_HEAD
+				: SHELL_END_BODY;
+	return (sourceShellEnds & spelled) === 0 || _removeImpliedTags === "all"
+		? _shellEndTagOmittable(path, name, node)
+			? ""
+			: `</${name}>`
+		: `</${name}>`;
+};
+
 /**
  * Whether a parser-inserted table group has to print a start tag the source
  * never spelled. With `removeOptionalTags` off its end tag prints, and a
@@ -9901,9 +9629,8 @@ const _minifyStyleBody = (css) =>
 	css.trim() === "" ? css : _renderEmbedded(css, CSS_TYPE);
 
 // The throwaway rule a `style` attribute's declaration list is minified inside.
-// The selector is only ever written and read back here, so it is the shortest
-// one the printer cannot rewrite — and the two halves are named so the read back
-// out cannot drift from what was written in.
+// Its selector is only written and read back here, so it is the shortest one
+// the printer cannot rewrite, and both halves are named from one place.
 
 /**
  * How one attribute is written out, and whether it leaves the tag ending in an
@@ -9914,15 +9641,27 @@ const _minifyStyleBody = (css) =>
  * @param {string} rawValue its value as the source spelled it
  * @param {string | null} decoded the value decoded, for one carrying character references, or null
  * @param {boolean} quoted whether the source spelled the value with a delimiter, which is two characters this has to beat
+ * @param {string} delimiter the delimiter the source spelled it with, if any
  * @returns {{ text: string, unquotedTail: boolean } | null} what to emit, or null to leave the source alone
  */
-const _writeAttribute = (attributeName, value, rawValue, decoded, quoted) => {
+const _writeAttribute = (
+	attributeName,
+	value,
+	rawValue,
+	decoded,
+	quoted,
+	delimiter
+) => {
+	// `normalizeAttributeQuotes` holds back the delimiters, not the spelling
+	// inside them, so a frozen value keeps the delimiter the source chose.
+	const frozen = !_transforms.normalizeAttributeQuotes;
 	const minimal =
-		_transforms.normalizeAttributeQuotes && decoded !== null
-			? _minimalAttributeValue(decoded)
-			: null;
-	const unquotable =
-		_transforms.normalizeAttributeQuotes && _canUnquoteAttributeValue(value);
+		decoded === null
+			? null
+			: frozen
+				? _quoteDecodedValue(decoded, delimiter)
+				: _minimalAttributeValue(decoded);
+	const unquotable = !frozen && _canUnquoteAttributeValue(value);
 
 	if (
 		minimal !== null &&
@@ -9942,7 +9681,9 @@ const _writeAttribute = (attributeName, value, rawValue, decoded, quoted) => {
 	}
 
 	if (value !== rawValue) {
-		const quotedValue = _quoteAttributeValue(value);
+		const quotedValue = frozen
+			? _quoteDecodedValue(value, delimiter)
+			: _quoteAttributeValue(value);
 
 		if (quotedValue !== null) {
 			return { text: ` ${attributeName}=${quotedValue}`, unquotedTail: false };
@@ -10029,11 +9770,12 @@ const _minimalAttributeValue = (value) => {
 };
 
 /**
- * Whether an attribute only restates the element's own default, so dropping it
- * leaves the DOM reading the same value — but leaves an attribute selector,
- * which matches the content attribute, with nothing to match. Both tables are
- * looked up per element by the caller, not per attribute here: the answer is the
- * same for every attribute of one tag.
+ * Whether an attribute only restates the element's own default — its value
+ * naming that default, or naming no keyword at all where the invalid value
+ * default is that same state — so dropping it leaves the DOM reading the same
+ * value, but leaves an attribute selector, which matches the content attribute,
+ * with nothing to match. Both tables are looked up per element by the caller,
+ * not per attribute here: the answer is the same for every attribute of one tag.
  * @param {Record<string, string> | undefined} markers the element's marker table
  * @param {Record<string, string> | undefined} defaults the element's spec-default table
  * @param {string} tagName lowercased element name
@@ -10042,19 +9784,30 @@ const _minimalAttributeValue = (value) => {
  * @returns {boolean} true when the attribute may be dropped
  */
 const _isRedundantAttribute = (markers, defaults, tagName, name, value) => {
-	const lowered = _asciiLowerCase(_asciiTrim(value));
+	// Looked up by what the value says, not how it was spelled — guarded on the
+	// `&` so a value carrying no reference pays nothing.
+	const lowered = _asciiLowerCase(
+		_asciiTrim(value.includes("&") ? decodeEntities(value, true) : value)
+	);
 	// `<script type>`: only a spelling that names JavaScript, which is what the
 	// element already runs. `module` and the empty spelling say something.
 	if (tagName === "script" && name === "type") {
-		// Read the way `_scriptType` reads it, or the two disagree about which
-		// `<script>` this is and the body's handler and this one part ways.
-		const type = _asciiLowerCase(_asciiTrim(decodeEntities(value, true)));
 		return (
-			type !== "" && type !== "module" && JAVASCRIPT_SCRIPT_TYPES.has(type)
+			lowered !== "" &&
+			lowered !== "module" &&
+			JAVASCRIPT_SCRIPT_TYPES.has(lowered)
 		);
 	}
 	if (markers !== undefined && markers[name] === lowered) return true;
-	return defaults !== undefined && defaults[name] === lowered;
+	if (defaults === undefined || defaults[name] === undefined) return false;
+	if (defaults[name] === lowered) return true;
+	// A value naming no keyword takes the attribute's invalid value default,
+	// which is the state a missing attribute names except where
+	// `INVALID_VALUE_DEFAULT_DIFFERS` says the two part.
+	const enumerated = ENUMERATED_KEYWORDS[tagName];
+	const keywords = enumerated === undefined ? undefined : enumerated[name];
+	if (keywords === undefined || keywords.has(lowered)) return false;
+	return !INVALID_VALUE_DEFAULT_DIFFERS.has(`${tagName} ${name}`);
 };
 
 /**
@@ -10069,9 +9822,12 @@ const _isRemovableEmptyAttribute = (elementName, name, value) => {
 	if (!_removeEmptyAttributes) return false;
 	const on = EMPTY_REMOVABLE_ATTRIBUTES.get(name);
 	if (on === undefined || (on !== null && !on.has(elementName))) return false;
-	// Read raw, so a value spelled with a character reference is kept whatever it
-	// decodes to. `_asciiTrim` returns the input when there is nothing to trim.
-	return _asciiTrim(value) === "";
+	// Read decoded: a reference is how a value is spelled, not what it says, and
+	// the tokenizer hands the element the same empty either way. Guarded on the
+	// `&`, and `_asciiTrim` returns the input when there is nothing to trim.
+	return (
+		_asciiTrim(value.includes("&") ? decodeEntities(value, true) : value) === ""
+	);
 };
 
 /**
@@ -10483,7 +10239,12 @@ const _scriptType = (path, element) => {
 const _isViewportMeta = (path) => {
 	for (const attribute of path.attributes()) {
 		if (attribute.name === "name") {
-			return _asciiLowerCase(_asciiTrim(attribute.value)) === "viewport";
+			const value = attribute.value;
+			return (
+				_asciiLowerCase(
+					_asciiTrim(value.includes("&") ? decodeEntities(value, true) : value)
+				) === "viewport"
+			);
 		}
 	}
 	return false;
@@ -10511,7 +10272,12 @@ const _minifyInlineJson = (json) =>
 const _isCssStyleElement = (path, element) => {
 	for (const attribute of path.attributes(element)) {
 		if (attribute.name !== "type") continue;
-		const value = _asciiLowerCase(_asciiTrim(attribute.value));
+		// Read the way `_scriptType` reads its own: the value the spec matches is
+		// the one the parser read, so a reference is decoded first.
+		const raw = attribute.value;
+		const value = _asciiLowerCase(
+			_asciiTrim(raw.includes("&") ? decodeEntities(raw, true) : raw)
+		);
 		return value === "" || value === "text/css";
 	}
 	return true;
@@ -10536,6 +10302,47 @@ const _onlyTextChild = (element) => {
 		: 0;
 };
 
+/**
+ * Whether an attribute reaches the output: one this print drops is not a
+ * difference between two elements, nor an attribute that keeps a run apart.
+ * @param {string} elementName lowercased element name
+ * @param {string} name lowercased attribute name
+ * @param {string} value its raw value
+ * @returns {boolean} true when it prints
+ */
+const _attributePrints = (elementName, name, value) => {
+	const markers =
+		_removeRedundantAttributes !== "none"
+			? REDUNDANT_TYPE_ATTRIBUTES[elementName]
+			: undefined;
+	const defaults =
+		_removeRedundantAttributes === "all"
+			? REDUNDANT_DEFAULT_ATTRIBUTES[elementName]
+			: undefined;
+	if (
+		(markers !== undefined || defaults !== undefined) &&
+		_isRedundantAttribute(markers, defaults, elementName, name, value)
+	) {
+		return false;
+	}
+	return !_isRemovableEmptyAttribute(elementName, name, value);
+};
+
+/**
+ * How many of an element's attributes this print keeps.
+ * @param {HtmlPath} path the accessor
+ * @param {HtmlNodeRef} element the element
+ * @returns {number} the count
+ */
+const _printedAttributeCount = (path, element) => {
+	const name = path.tagName(element);
+	let kept = 0;
+	for (const attribute of path.attributes(element)) {
+		if (_attributePrints(name, attribute.name, attribute.value)) kept++;
+	}
+	return kept;
+};
+
 /**
  * Whether two elements carry exactly the same attributes. Values compare raw:
  * two spellings of one value are rare enough not to be worth decoding for, and
@@ -10546,19 +10353,21 @@ const _onlyTextChild = (element) => {
  * @returns {boolean} true when the two agree on every attribute
  */
 const _sameAttributes = (path, one, other) => {
-	const count = path.attributeCount(one);
-	if (count !== path.attributeCount(other)) return false;
-	for (let i = 0; i < count; i++) {
-		const attribute = path.attributeAt(i, one);
-		const match = path.findAttribute(path.attributeName(attribute), other);
-		if (
-			match === 0 ||
-			path.attributeValue(match) !== path.attributeValue(attribute)
-		) {
+	// What each will spell, not what the tree holds: a `type` this print drops
+	// as redundant is not a difference between them.
+	const elementName = path.tagName(one);
+	let count = 0;
+	for (const attribute of path.attributes(one)) {
+		if (!_attributePrints(elementName, attribute.name, attribute.value)) {
+			continue;
+		}
+		count++;
+		const match = path.findAttribute(attribute.name, other);
+		if (match === 0 || path.attributeValue(match) !== attribute.value) {
 			return false;
 		}
 	}
-	return true;
+	return count === _printedAttributeCount(path, other);
 };
 
 /**
@@ -10582,6 +10391,12 @@ const _mergeableStyleAfter = (path, element) => {
 			if (!isAllWs(_nodeStrings[next])) return 0;
 			continue;
 		}
+		// A comment this print drops leaves the two adjacent, so it is not what
+		// stands between them; one it keeps still is.
+		if (type === NodeType.Comment) {
+			if (_printsNothing(path, next)) continue;
+			return 0;
+		}
 		return type === NodeType.Element &&
 			path.namespace(next) === NS_HTML &&
 			path.tagName(next) === "style" &&
@@ -10797,7 +10612,7 @@ const _opensWithHtmlCloseComment = (js) => {
  * @returns {HtmlElement} the next `<script>` of the run, or 0
  */
 const _mergeableScriptAfter = (path, element) => {
-	if (path.attributeCount(element) !== 0) return 0;
+	if (_printedAttributeCount(path, element) !== 0) return 0;
 	for (
 		let next = _nodeNextSiblings[element];
 		next !== 0;
@@ -10808,10 +10623,16 @@ const _mergeableScriptAfter = (path, element) => {
 			if (!isAllWs(_nodeStrings[next])) return 0;
 			continue;
 		}
+		// A comment this print drops leaves the two adjacent, so it is not what
+		// stands between them; one it keeps still is.
+		if (type === NodeType.Comment) {
+			if (_printsNothing(path, next)) continue;
+			return 0;
+		}
 		return type === NodeType.Element &&
 			path.namespace(next) === NS_HTML &&
 			path.tagName(next) === "script" &&
-			path.attributeCount(next) === 0 &&
+			_printedAttributeCount(path, next) === 0 &&
 			_onlyTextChild(next) !== 0
 			? next
 			: 0;
@@ -10933,7 +10754,7 @@ const _canUnquoteAttributeValue = (raw) => {
 			c === 0x3d ||
 			c === 0x3e ||
 			c === 0x60 ||
-			(c >= 0x09 && c <= 0x0d)
+			(c >= 0x09 && c <= 0x0d && c !== 0x0b)
 		) {
 			return false;
 		}
@@ -10942,9 +10763,8 @@ const _canUnquoteAttributeValue = (raw) => {
 };
 
 // How often each attribute name occurs in the document being printed, or null
-// until `sortAttributes` asks for it. Built from the parse's own attribute
-// column rather than by walking the tree: every attribute of every element is
-// already interned there, in one flat run.
+// until `sortAttributes` asks. Built from the parse's attribute column rather
+// than by walking the tree, which already holds every one in a flat run.
 /** @type {Map<string, number> | null} */
 let _attributeFrequencies = null;
 
@@ -10982,14 +10802,53 @@ const _attributeRank = () => {
 };
 
 /**
+ * How often each attribute name reaches the output. Counted over the runs the
+ * elements own rather than the whole column, because an attribute a transform
+ * drops is not one the print order should be ranked on.
  * @returns {Map<string, number>} how often each attribute name occurs
  */
 const _attributeFrequency = () => {
 	if (_attributeFrequencies !== null) return _attributeFrequencies;
 	const frequency = new Map();
-	for (let i = 1; i <= _attrCount; i++) {
-		const name = _attrNames[i];
-		frequency.set(name, (frequency.get(name) || 0) + 1);
+	for (let node = 1; node <= _nodeCount; node++) {
+		if (_nodeTypes[node] !== NodeType.Element) continue;
+		const count = _nodeAttrCounts[node];
+		if (count === 0) continue;
+		const start = _nodeAttrStarts[node];
+		// Foreign content keeps every attribute it was written with, so only an
+		// HTML element is asked what it drops — the same test the printer makes.
+		const html = _namespaceOf(node) === NS_HTML;
+		const elementName = _tagNameOf(node);
+		const markers =
+			html && _removeRedundantAttributes !== "none"
+				? REDUNDANT_TYPE_ATTRIBUTES[elementName]
+				: undefined;
+		const defaults =
+			html && _removeRedundantAttributes === "all"
+				? REDUNDANT_DEFAULT_ATTRIBUTES[elementName]
+				: undefined;
+		const mayDrop = markers !== undefined || defaults !== undefined;
+		for (let i = start; i < start + count; i++) {
+			const name = _attrNames[i];
+			if (html) {
+				// Valueless reads as the empty value here as it does there.
+				const value = _attrValueOf(i);
+				if (
+					(mayDrop &&
+						_isRedundantAttribute(
+							markers,
+							defaults,
+							elementName,
+							name,
+							value
+						)) ||
+					_isRemovableEmptyAttribute(elementName, name, value)
+				) {
+					continue;
+				}
+			}
+			frequency.set(name, (frequency.get(name) || 0) + 1);
+		}
 	}
 	_attributeFrequencies = frequency;
 	return frequency;
@@ -11092,10 +10951,9 @@ const _minifyOpenTag = (path, open) => {
 	// deferred answer held to the shape the built-in was written in.
 	const tailIsRead = !html && open.charCodeAt(open.length - 2) === 47;
 	let consumedEnd = path.nameEnd();
-	// HTML only, which is also what keeps `consumedEnd` meaningful: it is read
-	// once more below, and only for a foreign element's `/>`.
-	// Per element, not per attribute: every attribute of one tag gets the same
-	// answer out of these, and they are the hottest lookups in the printer.
+	// HTML only, which is what keeps `consumedEnd` meaningful: it is read once
+	// more below, for a foreign element's `/>` alone. Per element rather than per
+	// attribute, these being the printer's hottest lookups.
 	const markers =
 		html && _removeRedundantAttributes !== "none"
 			? REDUNDANT_TYPE_ATTRIBUTES[elementName]
@@ -11137,6 +10995,7 @@ const _minifyOpenTag = (path, open) => {
 		// at the closing one, so a quoted value's span is one wider on each side.
 		const quote = open.charCodeAt(valueStart - 1 - tagStart);
 		const quoted = quote === 34 || quote === 39;
+		const sourceDelimiter = quoted ? open[valueStart - tagStart - 1] : "";
 		const rawEnd = path.attributeValueEnd(attribute);
 		const valueEnd = rawEnd + (quoted ? 1 : 0);
 		const rawValue = open.slice(valueStart - tagStart, rawEnd - tagStart);
@@ -11173,7 +11032,7 @@ const _minifyOpenTag = (path, open) => {
 			if (_deferEmbeddedSource !== undefined && _deferSrcdoc) {
 				// Declining leaves the attribute as written, delimiter and all: a bare
 				// value has none, and quoting one would only lengthen it.
-				const delimiter = quoted ? open[valueStart - tagStart - 1] : "";
+				const delimiter = sourceDelimiter;
 				const asWritten = ` ${attributeName}=${delimiter}${rawValue}${delimiter}`;
 
 				out += _deferEmbedded(document, HTML_TYPE, (rendered) =>
@@ -11204,8 +11063,8 @@ const _minifyOpenTag = (path, open) => {
 		// `style`, and a bare value is already the shortest spelling of itself.
 		if (quoted || html || attributeName === "style" || rawValue.includes("&")) {
 			const hasReference = rawValue.includes("&");
-			// A character reference would decode to something these grammars read
-			// differently, so only a reference-free value is rewritten.
+			// Rewritten from the source text where it carries no reference; one that
+			// does is rewritten from what it decodes to, below.
 			let value = rawValue;
 			if (!hasReference) {
 				if (html) {
@@ -11223,22 +11082,42 @@ const _minifyOpenTag = (path, open) => {
 					value = _minifyStyleAttribute(rawValue);
 				}
 			}
-			// An empty value is the bare name: the tokenizer's after-attribute-name
-			// state reads `x` in `<p x>` and `<p x="">` as the same attribute with
-			// the same empty value, in foreign content too. A boolean attribute
-			// spelled with its own name (`disabled="disabled"`) is the same empty
-			// presence, and that one the spec does canonicalize.
-			// Both spellings are the same empty presence, and writing either as the
-			// bare name is the `=""` going — a quoting decision, so it answers to
-			// the switch that names the rest of them.
+			// WHY: an empty value is the bare name — the after-attribute-name state
+			// reads `x` in `<p x>` and `<p x="">` as one attribute with one empty
+			// value, in foreign content too — and a boolean spelled by its own name
+			// is the same presence, which the spec does canonicalize. Writing either
+			// as the bare name is just the `=""` going, a quoting decision, so it
+			// answers to the switch naming the rest of them. The decode is guarded on
+			// the reference to stay off the hot path, and tried before unquoting so
+			// every reference it writes stays bare.
+			const decoded = hasReference ? decodeEntities(rawValue, true) : null;
+			const spellable = decoded;
+			// The name the presence is spelled with is what it decodes to, so
+			// `checked="&#x63;…"` is the same presence as `checked="checked"`.
+			const presence = spellable !== null ? spellable : rawValue;
+			// The grammars read what the value decodes to, so a referenced one is
+			// rewritten from that and spelled back. `style` has its own path below.
+			const rewritten =
+				spellable !== null && html && attributeName !== "style"
+					? _rewriteAttributeValue(
+							elementName,
+							attributeName,
+							spellable,
+							isViewportMeta,
+							enumeratedOn
+						)
+					: spellable;
+			// What the attribute ends up saying, whichever spelling it arrived in:
+			// the bare name answers to that, not to the side the value was written.
+			const settled = rewritten !== null ? rewritten : value;
 			if (
 				_transforms.normalizeAttributeQuotes &&
-				(value === "" ||
+				(settled === "" ||
 					(html &&
 						_transforms.collapseBooleanAttributes &&
 						(_transforms.collapseBooleanAttributes === "all" ||
-							(rawValue.length === attributeName.length &&
-								_asciiLowerCase(rawValue) === attributeName)) &&
+							(presence.length === attributeName.length &&
+								_asciiLowerCase(presence) === attributeName)) &&
 						_isBooleanAttribute(elementName, attributeName)))
 			) {
 				out += ` ${attributeName}`;
@@ -11246,16 +11125,6 @@ const _minifyOpenTag = (path, open) => {
 				consumedEnd = valueEnd;
 				continue;
 			}
-			// Guarded on the reference, so the decode stays off the hot path — and
-			// tried before unquoting, which keeps every reference it writes bare.
-			const decoded = hasReference ? decodeEntities(rawValue, true) : null;
-			// A reference spelling whitespace is deliberate: writing it out would
-			// let `removeEmptyAttributes` read the attribute as empty on a re-run.
-			const spellable =
-				decoded !== null &&
-				(_asciiTrim(decoded) !== "" || _asciiTrim(rawValue) === "")
-					? decoded
-					: null;
 			const isStyle = attributeName === "style";
 			// A `style=""` carrying a character reference is a declaration list like
 			// any other once decoded — `&quot;` is a quote to CSS, not an entity — so
@@ -11268,17 +11137,32 @@ const _minifyOpenTag = (path, open) => {
 			 */
 			const writeStyle = (minified) =>
 				declarations !== null
-					? _writeAttribute(attributeName, rawValue, rawValue, minified, quoted)
+					? _writeAttribute(
+							attributeName,
+							rawValue,
+							rawValue,
+							minified,
+							quoted,
+							sourceDelimiter
+						)
 					: _writeAttribute(
 							attributeName,
 							minified,
 							rawValue,
 							spellable,
-							quoted
+							quoted,
+							sourceDelimiter
 						);
 			const written = isStyle
 				? writeStyle(declarations !== null ? declarations : value)
-				: _writeAttribute(attributeName, value, rawValue, spellable, quoted);
+				: _writeAttribute(
+						attributeName,
+						value,
+						rawValue,
+						rewritten,
+						quoted,
+						sourceDelimiter
+					);
 			// The JavaScript an event handler holds, offered decoded — `&amp;&amp;`
 			// is an operator to JavaScript rather than an entity. No built-in.
 			const handler =
@@ -11292,7 +11176,7 @@ const _minifyOpenTag = (path, open) => {
 					: null;
 
 			if (handler !== null && _asciiTrim(handler) !== "") {
-				const delimiter = quoted ? open[valueStart - tagStart - 1] : "";
+				const delimiter = sourceDelimiter;
 				// A foreign `/>` reads back whether this value ends unquoted, which a
 				// deferred answer is not there to decide: the source's quoting stands.
 				const holdQuoted = tailIsRead && _deferEmbeddedSource !== undefined;
@@ -11326,7 +11210,8 @@ const _minifyOpenTag = (path, open) => {
 								escapeAttribute(rendered, CC_QUOTATION_MARK, true),
 								rawValue,
 								rendered,
-								quoted
+								quoted,
+								sourceDelimiter
 							);
 
 					return answered !== null && answered.text.length < asWritten.length
@@ -11364,7 +11249,7 @@ const _minifyOpenTag = (path, open) => {
 			if (isStyle && _deferEmbeddedSource !== undefined) {
 				// Declining leaves the attribute as written, delimiter and all — an
 				// answer nothing beats is the renderer keeping what it was given.
-				const delimiter = quoted ? open[valueStart - tagStart - 1] : "";
+				const delimiter = sourceDelimiter;
 				const asWritten = ` ${attributeName}=${delimiter}${rawValue}${delimiter}`;
 				// What stands until an answer arrives, and the tag ending it commits
 				// to: the built-in's text where it beat the source, else the source.
@@ -11402,6 +11287,14 @@ const _minifyOpenTag = (path, open) => {
 				consumedEnd = valueEnd;
 				continue;
 			}
+			// Quoting may be frozen, but a rewrite changed what the value says, so
+			// the source's own spelling of it cannot stand.
+			if (rewritten !== null && rewritten !== spellable) {
+				out += _writeQuotedAttribute(attributeName, rewritten, sourceDelimiter);
+				unquotedTail = false;
+				consumedEnd = valueEnd;
+				continue;
+			}
 		}
 		// A quoted value carries its quotes over; an unquoted one starts at the
 		// value itself.
@@ -11412,10 +11305,10 @@ const _minifyOpenTag = (path, open) => {
 		unquotedTail = !quoted;
 		consumedEnd = valueEnd;
 	}
-	// A source `/>` self-closes a foreign element, so it survives there — but only
-	// when the `/` really is the flag: in `<a href=x/>` it is the last character of
-	// an unquoted value instead, and after one of those it needs a space or it
-	// would fuse into the value. An HTML element's parser ignores it, so it goes.
+	// WHY: a source `/>` self-closes a foreign element and survives there, but
+	// only where the `/` is the flag: in `<a href=x/>` it ends an unquoted value,
+	// and after one of those it needs a space or it fuses into the value. An HTML
+	// element's parser ignores it, so there it goes.
 	if (
 		path.namespace() !== NS_HTML &&
 		open.charCodeAt(open.length - 2) === 47 &&
@@ -11437,10 +11330,9 @@ const _minifyOpenTag = (path, open) => {
  * @returns {boolean} true to keep the comment
  */
 const _keepComment = (data, source) => {
-	// `<?php … ?>` / `<%… %>` reach the tree as bogus comments (§13.2.5.42) but
-	// are server-side directives, and the forms below drive IE branching or a
-	// server-side include — every one of them is code rather than a comment, so
-	// no level drops it.
+	// `<?php … ?>` and `<%… %>` reach the tree as bogus comments (§13.2.5.42),
+	// and the forms below drive IE branching or a server-side include. Every one
+	// is code rather than a comment, so no level drops it.
 	if (source.charCodeAt(1) === 63) return true;
 	const trimmed = data.trimStart();
 	// `<![` covers the downlevel-revealed forms: `<!--<![endif]-->` closers and
@@ -11558,6 +11450,13 @@ const _contentOpensOutside = (node) => {
 // so each streamed element costs no result object.
 let _streamOpen = "";
 let _streamClose = "";
+// The close that goes with a held-back start tag once it prints: an element
+// whose tag the parser no longer re-implies answers to `removeImpliedTags`.
+let _streamCloseIfOpened = "";
+// Which held-back opener `_emitPiece` settled into a start tag, `-1` for none.
+let _materializedPendingSlot = -1;
+/** @type {string[]} */
+const _printCloseIfOpened = [];
 let _streamImplied = "";
 
 /**
@@ -11628,11 +11527,8 @@ const _streamTags = (path, minify) => {
 		if (path.attributeCount() === 0 && TRANSPARENT_IMPLIED_ELEMENTS.has(name)) {
 			// The parser re-implies the start tag, but not the end tag the source
 			// carried: without it whatever follows moves inside this element.
-			_streamClose = (
-				SHELL_ELEMENTS.has(name)
-					? _shellEndTagOmittable(path, name, path.node)
-					: _canOmitEndTag(path, name, path.node)
-			)
+			_streamClose = _impliedCloseTag(path, name, path.node);
+			_streamCloseIfOpened = _canOmitEndTag(path, name, path.node)
 				? ""
 				: `</${name}>`;
 			// Leading whitespace is decided on the first piece emitted; what the modes
@@ -12091,10 +11987,9 @@ const _digest = (root) => {
 					attributes.push(`${name}=${_DIGEST_OPAQUE}`);
 					continue;
 				}
-				// The value as the DOM holds it — the same value can be written with a
-				// different quote and a different escape and still be the same
-				// attribute — with a boolean spelled by its own name as the bare
-				// presence the printer writes it back as.
+				// The value as the DOM holds it, since another quote and another escape
+				// spell the same attribute, with a boolean named by itself as the bare
+				// presence the printer writes back.
 				attributes.push(
 					`${name}=${
 						html &&
@@ -12349,13 +12244,7 @@ const printer = (path, writer) => {
 					}
 					// The parser re-implies the start tag, but not the end tag the
 					// source carried: without it whatever follows moves inside.
-					return (
-						SHELL_ELEMENTS.has(name)
-							? _shellEndTagOmittable(path, name, path.node)
-							: _canOmitEndTag(path, name, path.node)
-					)
-						? inner
-						: `${inner}</${name}>`;
+					return inner + _impliedCloseTag(path, name, path.node);
 				}
 				// Anything else tag-less (adoption-agency clone, reconstructed
 				// formatting element) must materialize or its formatting is lost.
@@ -12401,7 +12290,7 @@ const printer = (path, writer) => {
 					// A bare `<script>` is the classic one a run may fold into, and
 					// the run's first prints all of it — the rest printed into it here.
 					let body = data;
-					if (_mergeScripts && path.attributeCount(parent) === 0) {
+					if (_mergeScripts && _printedAttributeCount(path, parent) === 0) {
 						if (_absorbed !== null && _absorbed.has(parent)) return "";
 						body = _mergedScriptRun(path, parent, data);
 					}
@@ -12466,18 +12355,17 @@ const printer = (path, writer) => {
 				}
 			}
 			const raw = path.source();
-			// Off-spec workaround: §13.3 escapes `<`/`>` in text, which would rewrite
-			// `<%= x %>` to `&lt;%= x %&gt;` in HTML webpack only passes through. Text
-			// that decoded to itself re-tokenizes to itself, so emit its source bytes.
-			// The guards are what keep that equivalence: every character reference is
-			// at least two characters longer than what it decodes to, so equal lengths
-			// mean nothing decoded — an unequal one means the node was merged or
-			// foster-parented and its range no longer describes `data`. The tail is
-			// checked separately because it is the only place concatenation can change
-			// tokenization: a `<`, or a `&` still open on a reference, would fuse with
-			// the next sibling once a comment between them is dropped. A CR is the one
-			// rewrite the length test cannot see — preprocessing maps a lone one to LF
-			// without changing length — so it is excluded by name.
+			// WHY: off-spec workaround. §13.3 escapes `<` and `>` in text, which
+			// would rewrite `<%= x %>` to `&lt;%= x %&gt;` in HTML webpack only passes
+			// through, so text that decoded to itself is emitted as its source bytes.
+			// The guards keep that equivalence: a character reference is at least two
+			// characters longer than what it decodes to, so equal lengths mean nothing
+			// decoded, while unequal ones mean the node was merged or foster-parented
+			// and its range no longer describes `data`. The tail is checked separately
+			// as the one place concatenation can change tokenization — a `<`, or a `&`
+			// still open on a reference, fuses with the next sibling once a comment
+			// between them is dropped. A CR is the rewrite the length test cannot see,
+			// preprocessing mapping a lone one to LF, so it is excluded by name.
 			if (
 				raw.length === data.length &&
 				!_tailFusesWithNextTag(raw) &&
@@ -12533,12 +12421,12 @@ let _visitors = EMPTY_VISITORS;
 /** @type {PrintContext | undefined} */
 let _writer;
 
-// Iterative depth-first walk over the link columns: `firstChild` /
-// `nextSibling` descend, the `parent` column ascends, so arbitrarily deep
-// markup can't overflow the call stack (the old recursive walk died at
-// ~10⁵ nesting). A `<template>`'s content fragment is visited before the
-// element's children; ascending out of it continues with those children
-// (the fragment is never in a sibling chain, `_nodeNextSiblings` = 0).
+// WHY: an iterative depth-first walk over the link columns — `firstChild` and
+// `nextSibling` descend, `parent` ascends — so arbitrarily deep markup cannot
+// overflow the call stack, where the old recursive walk died at ~10⁵ nesting. A
+// `<template>`'s content fragment is visited before the element's children, and
+// ascending out of it continues with those: the fragment is never in a sibling
+// chain, so its `_nodeNextSiblings` is 0.
 
 /**
  * Fire a node's `enter` visitors; true when the walk may descend.
@@ -12567,13 +12455,13 @@ const _enterNode = (node) => {
 	return !skip;
 };
 
-// === Printing in pieces ===
-// The printer composes a node from its children's text, so the store holds every
-// node's until the root is taken — several times the output on a document of any
-// size. A node whose text is exactly `open + children + close` instead emits its
-// opener as it opens and its closer as it exits, and each child goes straight out
-// as it finishes; the store then only ever holds the subtrees that cannot (see
-// `_streamTags`). Indexed by print depth, which is the open path.
+// WHY: printing in pieces.
+// The printer composes a node from its children's text, so the store would
+// hold every node's until the root is taken — several times the output on a
+// document of any size. A node whose text is exactly `open + children + close`
+// instead emits its opener as it opens and its closer as it exits, with each
+// child going straight out as it finishes, so the store only ever holds the
+// subtrees that cannot. Indexed by print depth, which is the open path.
 /** @type {number} depth of the node the printing walk is on (maintained by `_walkRun`) */
 let _printDepth = 0;
 /** @type {number[]} 1 while the node at that depth prints in pieces */
@@ -12604,6 +12492,7 @@ const _emitPiece = (text) => {
 		const c = text.charCodeAt(0);
 		if (c === 0x09 || c === 0x0a || c === 0x0c || c === 0x0d || c === 0x20) {
 			w.setPending(held - 1, `<${_printPendingNames[held - 1]}>`);
+			_materializedPendingSlot = held - 1;
 		}
 		_printPendingNames.length = 0;
 		w.flushPending();
@@ -12641,6 +12530,7 @@ const _openStreamed = (node, depth, descending) => {
 				if (_streamImplied === "") {
 					_emitPiece(_streamOpen);
 				} else {
+					_printCloseIfOpened[depth] = _streamCloseIfOpened;
 					_printPendingSlot[depth] = w.pushPending("");
 					_printPendingNames.push(_streamImplied);
 				}
@@ -12693,8 +12583,14 @@ const _exitNode = (node) => {
 	if (_printOpen[depth] === 1) {
 		// Printed in pieces: its opener went out as it opened and its children as
 		// they finished, so only its closer is left.
-		_emitPiece(_printClose[depth]);
 		const slot = _printPendingSlot[depth];
+		// Its start tag printed after all, so the end tag is no longer the one a
+		// transparent element leaves behind.
+		_emitPiece(
+			slot !== -1 && slot === _materializedPendingSlot
+				? _printCloseIfOpened[depth]
+				: _printClose[depth]
+		);
 		// Nothing inside it printed, so its held-back opener never had to.
 		if (slot !== -1 && _writer.isPending(slot)) {
 			_printPendingNames.pop();
@@ -12729,8 +12625,8 @@ const _firstInner = (node) => {
 	return 0;
 };
 
-// === Streaming walk ===
-// The walk follows the parser's open element stack: everything under the
+// WHY: the streaming walk.
+// It follows the parser's open element stack: everything under the
 // deepest *entered* element is finished markup, so it is visited and its node
 // ids recycled, and peak storage is the open subtree rather than the whole
 // document — the HTML analog of the CSS grammar's per-top-level-rule recycling.
@@ -12763,12 +12659,12 @@ const _entered = [];
 let _skipFrom = -1;
 /** set when `open` was spliced mid-stack, so the next sync scans it in full */
 let _openSpliced = false;
-// Set when a mid-stack `open.splice` removes an element the walk already
-// entered (`</form>` with content still open inside it). The element leaves the
-// open stack without its subtree ending, so the open stack no longer describes
+// WHY: set when a mid-stack `open.splice` removes an element the walk already
+// entered, such as a `</form>` with content still open inside it. The element
+// leaves the stack without its subtree ending, so the stack no longer describes
 // what has finished and reconciling against it would close and re-enter live
-// elements. Rare enough to simply stop streaming for the rest of the parse: what
-// is already visited stays visited, and the remainder is walked at EOF.
+// elements. Rare enough to stop streaming for the rest of the parse: what is
+// visited stays visited, and the remainder is walked at EOF.
 let _streamHalted = false;
 /** set by `popOpen`: the open stack changed, so the walk has work at token end */
 let _openStackChanged = false;
@@ -12776,11 +12672,11 @@ let _openStackChanged = false;
 // earns its walk setup. Closing an entered element always flushes, so this only
 // bounds how much an un-entered subtree holds — a few KB of columns.
 const _FLUSH_BATCH = 4096;
-// Documents below this many nodes are walked once at EOF instead: recycling
-// only pays once the columns are big enough that not growing them beats the
-// per-token sync, and a page that never reaches it must not carry the cost.
-// Chosen so the streamed cap below stays under `_COLUMN_SHRINK_CAPACITY`,
-// keeping a streamed parse's columns reusable by the next one.
+// WHY: below this many nodes a document is walked once at EOF instead.
+// Recycling only pays once the columns are big enough that not growing them
+// beats the per-token sync, and a page never reaching that must not carry the
+// cost. Chosen so the streamed cap below stays under
+// `_COLUMN_SHRINK_CAPACITY`, keeping the columns reusable by the next parse.
 const _STREAM_MIN_NODES = 49152;
 
 /**
@@ -12974,9 +12870,8 @@ const _streamSync = () => {
 
 	let i = _enteredPrefix();
 	// Close: everything entered below the divergence has finished. A descendant
-	// of a `skipChildren()` element was tracked without being entered, so it must
-	// not exit either — the buffered walk fires `exit` for the skipped element
-	// itself and nothing below it.
+	// of a `skipChildren()` element was tracked without being entered, so it does
+	// not exit either — only the skipped element itself does.
 	for (let k = _entered.length - 1; k >= i; k--) {
 		const el = _entered[k];
 		const belowSkip = _skipFrom !== -1 && k > _skipFrom;
@@ -13032,12 +12927,12 @@ const _streamFinish = (root) => {
  * @param {HtmlProcessOptions} options process options
  */
 const grammar = (input, visitors, writer, options) => {
-	// The walk's state — the visitors, the print context, the open path, the AST
-	// columns — is module-scoped so the tokenizer's call sites stay monomorphic,
-	// which means one parse at a time: a visitor that started another would take
-	// this one's state over and release its columns on the way out. Nesting the
-	// *other* language is fine (a `<style>`'s CSS has its own module state), and
-	// an `<iframe srcdoc>` is a separate module webpack parses on its own.
+	// WHY: the walk's state — visitors, print context, open path, AST columns —
+	// is module-scoped so the tokenizer's call sites stay monomorphic, which means
+	// one parse at a time: a visitor starting another would take this one's state
+	// over and release its columns on the way out. Nesting the other language is
+	// fine, a `<style>`'s CSS having module state of its own, and an
+	// `<iframe srcdoc>` is a separate module webpack parses on its own.
 	if (_parsing) {
 		throw new Error(
 			"html syntax: process() is already running; a visitor cannot start another HTML parse"
@@ -13160,6 +13055,8 @@ const grammar = (input, visitors, writer, options) => {
 		_printClose.length = 0;
 		_printPendingNames.length = 0;
 		_printPendingSlot.length = 0;
+		_printCloseIfOpened.length = 0;
+		_materializedPendingSlot = -1;
 		// Hoisting these to module scope outlives the call, so drop the caller's
 		// visitors and print context here — they used to fall away with `grammar`.
 		_visitors = EMPTY_VISITORS;
@@ -13197,9 +13094,8 @@ const RIGHT_PARENTHESIS = ")".charCodeAt(0);
 const SMALL_LETTER_W = "w".charCodeAt(0);
 const SMALL_LETTER_X = "x".charCodeAt(0);
 const SMALL_LETTER_H = "h".charCodeAt(0);
-// (Don't use \s, to avoid matching non-breaking space)
-// Sticky so `collectCharacters` matches at an offset without slicing the
-// whole remaining input per call (which made srcset parsing quadratic).
+// Not `\s`, which matches a non-breaking space. Sticky so `collectCharacters`
+// matches at an offset rather than slicing per call, which was quadratic.
 // eslint-disable-next-line no-control-regex
 const LEADING_SPACES_REGEXP = /[ \t\n\r\u000C]+/y;
 // eslint-disable-next-line no-control-regex
@@ -13208,10 +13104,8 @@ const LEADING_COMMAS_OR_SPACES_REGEXP = /[, \t\n\r\u000C]+/y;
 const LEADING_NOT_SPACES = /[^ \t\n\r\u000C]+/y;
 const TRAILING_COMMAS_REGEXP = /[,]+$/;
 const NON_NEGATIVE_INTEGER_REGEXP = /^\d+$/;
-// ( Positive or negative or unsigned integers or decimals, without or without exponents.
-// Must include at least one digit.
-// According to spec tests any decimal point must be followed by a digit.
-// No leading plus sign is allowed.)
+// A signed or unsigned integer or decimal, with or without an exponent, holding
+// at least one digit, no leading plus, and a digit after any decimal point.
 // https://html.spec.whatwg.org/multipage/infrastructure.html#valid-floating-point-number
 const FLOATING_POINT_REGEXP =
 	/^-?(?:[0-9]+|[0-9]*\.[0-9]+)(?:[eE][+-]?[0-9]+)?$/;
@@ -13400,10 +13294,8 @@ const parseSrcset = (input) => {
 			if (state === "in descriptor") {
 				// Do the following, depending on the value of charCode:
 
-				// Space character
-				// If current descriptor is not empty, append current descriptor to
-				// descriptors and let current descriptor be the empty string.
-				// Set state to after descriptor.
+				// Space: append a non-empty current descriptor to descriptors and empty
+				// it, then set state to after descriptor.
 				if (isSpace(charCode)) {
 					if (descriptorStart !== -1) {
 						descriptors.push(input.slice(descriptorStart, position));
@@ -13411,10 +13303,9 @@ const parseSrcset = (input) => {
 						state = "after descriptor";
 					}
 				}
-				// U+002C COMMA (,)
-				// Advance position to the next character in input. If current descriptor
-				// is not empty, append current descriptor to descriptors. Jump to the step
-				// labeled descriptor parser.
+				// `,`: Advance position to the next character in input. If current
+				// descriptor is not empty, append current descriptor to descriptors. Jump
+				// to the step labeled descriptor parser.
 				else if (charCode === COMMA) {
 					position += 1;
 
@@ -13696,10 +13587,9 @@ let _currentParent = null;
  */
 /* eslint-enable jsdoc/require-template */
 
-// AST field-access seam (mirrors the CSS parser's `A`): every AST field a
-// consumer reads goes through one of these accessors, so the node
-// representation can change underneath without touching consumers. `n` is an
-// `HtmlNodeRef`; results are valid until the next `parseHtml` call.
+// AST field-access seam, mirroring the CSS parser's `A`: every field a consumer
+// reads goes through an accessor here, so the node representation can change
+// underneath. `n` is an `HtmlNodeRef`, valid until the next `parseHtml`.
 const A = {
 	// === path position (rebound by the walk before every visitor call) ===
 	/**