forma_ir/

walker.rs

//! Static HTML walker — walks the IR opcode stream to produce HTML output.
//!
//! This is the core SSR rendering engine. It takes a parsed `IrModule` plus
//! populated `SlotData`, walks the opcode stream linearly, and produces an
//! HTML string suitable for embedding in the page.

#[cfg(feature = "tracing")]
use crate::format::SlotSource;
use crate::format::{IrError, IslandTrigger, Opcode};
use crate::parser::IrModule;
use crate::slot::{SlotData, SlotValue};
use std::fmt;

// ---------------------------------------------------------------------------
// Walk state
// ---------------------------------------------------------------------------

/// Pending island info to be injected on the next OPEN_TAG or VOID_TAG.
struct IslandPending {
    id: u16,
    component_name: String,
    inline_props: Option<String>,
    trigger: IslandTrigger,
}

/// Serialized-JSON size above which inline island props are spilled into
/// the shared `__forma_islands` block instead of a `data-forma-props`
/// attribute.
///
/// Matches the client's documented guidance ("inline for small props, < 1KB;
/// the script block for larger props"). Measured on the *JSON*, before HTML
/// attribute escaping — a string-heavy payload inflates roughly 1.8x on the
/// wire because every `"` becomes `&quot;`, so the attribute this bounds is
/// closer to 2 KiB in the worst case.
///
/// The spill needs no client change: `loadIslandProps`
/// (`@getforma/core`, src/dom/activate.ts) reads `data-forma-props` first and
/// falls back to the shared block, and the walker emits exactly one channel
/// per island so that precedence never has two answers to choose between.
///
/// An internal fragment render (`walk_island`) never spills — it cannot legally emit
/// a second `__forma_islands` block — so an over-size fragment keeps its props
/// inline.
///
/// Verified by: crates/forma-ir/src/walker.rs > "inline_props_over_the_ceiling_spill_to_the_shared_block"
/// Verified by: crates/forma-ir/src/walker.rs > "island_fragment_keeps_over_size_props_inline"
pub const INLINE_PROPS_MAX_BYTES: usize = 1024;

/// Default cap on the HTML a single walk may produce.
///
/// A structurally valid module can otherwise force an arbitrarily large
/// `String` allocation inside one request handler, and Rust answers allocation
/// failure with `handle_alloc_error` → process abort, which kills every
/// in-flight request. Raise it via [`WalkLimits`] for an app with a
/// legitimately large data-driven page rather than accepting a silent
/// degradation.
pub const DEFAULT_MAX_OUTPUT_BYTES: usize = 8 * 1024 * 1024;

/// Default cap on total LIST item iterations per render, across all depths.
///
/// `MAX_LIST_DEPTH` bounds nesting but not volume: four LISTs bound to the
/// same array give n^4 body walks from one small module plus one large
/// request array.
pub const DEFAULT_MAX_LIST_ITERATIONS: usize = 50_000;

/// Resource budgets for a single walk.
///
/// Both are per-render totals, not per-nesting-level.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct WalkLimits {
    /// Maximum bytes of HTML the walk may emit.
    pub max_output_bytes: usize,
    /// Maximum total LIST item iterations across all nesting depths.
    pub max_list_iterations: usize,
}

impl Default for WalkLimits {
    fn default() -> Self {
        WalkLimits {
            max_output_bytes: DEFAULT_MAX_OUTPUT_BYTES,
            max_list_iterations: DEFAULT_MAX_LIST_ITERATIONS,
        }
    }
}

/// Mutable state threaded through recursive `walk_range` calls.
///
/// This avoids adding extra parameters every time we need new walker state
/// (e.g., list depth, output budget).
struct WalkState {
    /// Current nesting depth for LIST opcodes.
    list_depth: u8,
    /// Pending island info to inject on the next OPEN_TAG/VOID_TAG.
    pending_island: Option<IslandPending>,
    /// Pending list-item key to inject on the next OPEN_TAG/VOID_TAG.
    pending_list_key: Option<String>,
    /// Accumulated props for ScriptTag mode, keyed by island id.
    script_tag_props: std::collections::BTreeMap<u16, serde_json::Value>,
    /// True when an OpenTag or VoidTag has been opened but the `>` has not
    /// been written yet. DYN_ATTR opcodes may still append attributes.
    pending_tag_close: bool,
    /// Tag name of the element currently being opened — needed to decide
    /// whether a `data:image/svg+xml` URL is in an image context.
    pending_tag_name: String,
    /// Output-size budget. Lives on the state (not as a `walk_range`
    /// parameter) so every recursive call sharing the same `out` enforces the
    /// same cumulative budget by construction.
    max_output_bytes: usize,
    /// Running total of LIST item iterations, counted across all depths and
    /// never decremented.
    list_iterations: usize,
    /// Cap for `list_iterations`.
    max_list_iterations: usize,
    /// Undo log for slot writes made inside a LIST body.
    ///
    /// A list row must render from its own scope: the item binding and any
    /// PROP the body extracts from it are visible to that row and to nothing
    /// else. The loop used to buy that by deep-cloning the whole `SlotData`
    /// per row, which costs O(rows x slots) — the walk was measurably
    /// quadratic in row count. Instead each write swaps the new value in and
    /// pushes the displaced one here; the row's `Drop`-equivalent pops back to
    /// the mark it took on entry, restoring exactly the state the caller had.
    ///
    /// Entries are strictly LIFO across nesting: an inner list unwinds its own
    /// entries before its enclosing row unwinds. The `Vec` keeps its capacity
    /// between rows, so steady-state pushes do not allocate.
    slot_journal: Vec<(u16, SlotValue)>,
    /// When true, fragment islands inline their props on the
    /// root instead of accumulating into the shared `__forma_islands` block.
    /// Set for fragment renders, where a shared block would be dropped on
    /// return (or, if emitted, would duplicate the page's own block).
    force_inline_props: bool,
    /// The text-only element (`textarea`, `title`, `style`, `script`) the
    /// walk is inside, if any. Inside one, no hydration marker is written; see
    /// [`TextOnlyTag`].
    text_only: Option<TextOnlyParent>,
    /// Form-control state gathered from the attributes of the start tag that
    /// is still open, resolved when its `>` is written ([`close_start_tag`]).
    pending_control: PendingControl,
    /// The bound `select` the walk is inside, if any.
    select: Option<SelectBinding>,
    /// An `option` of a bound select with no `value` attribute: its value is
    /// its text, which is known only when the option ends.
    option_by_text: Option<OptionByText>,
    /// Elements and text nodes written so far ([`WalkCounts::nodes`]).
    nodes: usize,
    /// The islands open at this point of the walk, outermost first: the
    /// component path a failure reports ([`WalkFailure::component_path`]).
    islands: Vec<u16>,
    /// Whether `fault_injection::FAULT_TRIGGER` may fire: set only by
    /// [`walk_to_html_counted`], which catches the panic, so the uncaught
    /// `walk_to_html` path can never take it.
    #[cfg(any(test, feature = "__fault-injection"))]
    fault_armed: bool,
}

impl WalkState {
    fn new(limits: WalkLimits) -> Self {
        WalkState {
            list_depth: 0,
            pending_island: None,
            pending_list_key: None,
            script_tag_props: std::collections::BTreeMap::new(),
            pending_tag_close: false,
            pending_tag_name: String::new(),
            max_output_bytes: limits.max_output_bytes,
            list_iterations: 0,
            max_list_iterations: limits.max_list_iterations,
            slot_journal: Vec::new(),
            force_inline_props: false,
            text_only: None,
            pending_control: PendingControl::None,
            select: None,
            option_by_text: None,
            nodes: 0,
            islands: Vec::new(),
            #[cfg(any(test, feature = "__fault-injection"))]
            fault_armed: false,
        }
    }

    /// Record a slot write so the enclosing LIST row can undo it.
    ///
    /// Outside a list there is nothing to undo — a PROP at depth 0 writes to
    /// the walk's own `SlotData` copy for the rest of the page, which is what
    /// the clone-per-row implementation did too.
    fn journal_write(&mut self, slot_id: u16, previous: SlotValue) {
        if self.list_depth > 0 {
            self.slot_journal.push((slot_id, previous));
        }
    }

    /// Undo every journalled write back to `mark`, restoring `slots`.
    fn unwind_slot_journal(&mut self, slots: &mut SlotData, mark: usize) {
        while self.slot_journal.len() > mark {
            // `len() > mark >= 0`, so the pop cannot be None.
            if let Some((slot_id, previous)) = self.slot_journal.pop() {
                slots.set(slot_id, previous);
            }
        }
    }
}

// ---------------------------------------------------------------------------
// Dev-mode slot source check
// ---------------------------------------------------------------------------

/// Log a warning when a server-sourced slot has no value at render time.
///
/// This is a dev-mode diagnostic: if a slot is declared as `SlotSource::Server`
/// but the handler never populated it (still `SlotValue::Null`), the page
/// handler likely has a bug. The warning is informational and does not affect
/// output.
#[cfg_attr(not(feature = "tracing"), allow(unused_variables))]
fn check_slot_source(module: &IrModule, slot_id: u16, value: &SlotValue) {
    // Gated as a whole: with `tracing` off there is nothing to report, so the
    // lookup should not run at all. (It is an O(1) index lookup now either
    // way, but the source should say what it means.)
    #[cfg(feature = "tracing")]
    if let Some(entry) = module.slot_entry(slot_id) {
        if entry.source == SlotSource::Server && matches!(value, SlotValue::Null) {
            tracing::warn!(
                slot_id = slot_id,
                "Server-sourced slot has no value at render time — handler may have a bug"
            );
        }
    }
}

// ---------------------------------------------------------------------------
// Public API
// ---------------------------------------------------------------------------

/// Walk the IR opcode stream and produce an HTML string.
///
/// This is the main entry point for SSR rendering. It processes every opcode
/// in the module's bytecode section, looking up strings in the string table
/// and slot values in `slots`.
pub fn walk_to_html(module: &IrModule, slots: &SlotData) -> Result<String, IrError> {
    walk_to_html_with_limits(module, slots, WalkLimits::default())
}

/// Walk the IR opcode stream with explicit resource budgets.
///
/// Use this when the default 8 MiB output cap or 50,000-iteration LIST budget
/// is wrong for the page — raising the limit is the right answer for a
/// legitimately large list, rather than letting the render fail and silently
/// degrade to a client-mounted page.
pub fn walk_to_html_with_limits(
    module: &IrModule,
    slots: &SlotData,
    limits: WalkLimits,
) -> Result<String, IrError> {
    let ops = &module.opcodes;
    let len = ops.len();
    let mut out = String::with_capacity(initial_capacity(len));
    let mut state = WalkState::new(limits);
    let mut slots_mut = slots.clone();
    walk_range(module, &mut slots_mut, ops, 0, len, &mut out, &mut state, 0)?;
    finish_page(&mut out, &state)?;
    Ok(out)
}

/// The output buffer's first reservation for a module's opcode stream.
///
/// Capped: `len * 4` is a fine estimate for a real page (measured modules are
/// tens of bytes to low KiB) but a 4x reservation on an attacker-sized section
/// is a free amplifier, and `len * 4` can itself overflow on wasm32 where
/// `usize` is 32 bits. Beyond the cap, String's amortized doubling costs
/// O(log n) reallocs.
fn initial_capacity(opcodes_len: usize) -> usize {
    opcodes_len.saturating_mul(4).min(1 << 20)
}

/// After a whole-page walk: the `__forma_islands` block for ScriptTag props.
fn finish_page(out: &mut String, state: &WalkState) -> Result<(), IrError> {
    if !state.script_tag_props.is_empty() {
        let json =
            serde_json::to_string(&state.script_tag_props).unwrap_or_else(|_| "{}".to_string());
        push_checked(
            out,
            "<script id=\"__forma_islands\" type=\"application/json\">",
            state.max_output_bytes,
        )?;
        push_json_script_body(out, &json, state.max_output_bytes)?;
        push_checked(out, "</script>", state.max_output_bytes)?;
    }
    Ok(())
}

/// What a walk wrote, or what it had reached when it stopped.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
#[non_exhaustive]
pub struct WalkCounts {
    /// Elements and text nodes written from the module's opcodes. Hydration
    /// markers, comments and the `__forma_islands` data block are not nodes.
    pub nodes: usize,
    /// Bytes of HTML written: what [`WalkLimits::max_output_bytes`] bounds.
    pub bytes: usize,
    /// LIST rows walked, across every nesting depth: what
    /// [`WalkLimits::max_list_iterations`] bounds.
    pub list_iterations: usize,
}

/// A whole page's HTML and what writing it took.
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct WalkOutput {
    /// The page's HTML, as [`walk_to_html_with_limits`] writes it.
    pub html: String,
    /// What the walk wrote.
    pub counts: WalkCounts,
}

/// A walk that stopped: why, where, and how far it had got.
///
/// The partial HTML is dropped: nothing a failed walk wrote leaves it.
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct WalkFailure {
    /// Why it stopped.
    pub error: IrError,
    /// The component names of the islands open where it stopped, outermost
    /// first; empty when it stopped outside every island. The decoded v3
    /// source-position metadata is available for later diagnostic integration;
    /// this path continues to name declared islands.
    pub component_path: Vec<String>,
    /// What it had written by then.
    pub counts: WalkCounts,
}

impl fmt::Display for WalkFailure {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "{}", self.error)?;
        if !self.component_path.is_empty() {
            write!(f, " (in {})", self.component_path.join(" > "))?;
        }
        Ok(())
    }
}

impl std::error::Error for WalkFailure {
    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
        Some(&self.error)
    }
}

/// [`walk_to_html_with_limits`], reporting what the walk wrote, and on
/// failure where it stopped and how far it had got.
///
/// The same HTML, byte for byte, and the same errors, with two additions: the
/// counts (nodes, bytes, list rows), returned on success and on failure alike
/// so an over-budget page reports how far it got; and the component
/// path, the islands open at the failure. A panic inside the walk is caught
/// and returned as [`IrError::Panicked`] with the same path and counts, so
/// one bad page cannot take its request's connection down with it.
/// That holds only while the application unwinds on panic: under
/// `panic = "abort"` the process ends instead.
///
/// Verified by: crates/forma-ir/src/walker.rs > "counted_walk_returns_the_counts_reached_when_a_budget_stops_it"
/// Verified by: crates/forma-ir/src/walker.rs > "counted_walk_catches_a_panic_and_names_its_island"
pub fn walk_to_html_counted(
    module: &IrModule,
    slots: &SlotData,
    limits: WalkLimits,
) -> Result<WalkOutput, WalkFailure> {
    let ops = &module.opcodes;
    let len = ops.len();
    let mut out = String::with_capacity(initial_capacity(len));
    let mut state = WalkState::new(limits);
    #[cfg(any(test, feature = "__fault-injection"))]
    {
        state.fault_armed = true;
    }
    let mut slots_mut = slots.clone();

    // The closure only borrows: after an unwind, `state` and `out` still say
    // where the walk was and how much it had written. Nothing they hold is
    // used again except to read those counts.
    let walked = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
        walk_range(module, &mut slots_mut, ops, 0, len, &mut out, &mut state, 0)?;
        finish_page(&mut out, &state)
    }));
    let counts = WalkCounts {
        nodes: state.nodes,
        bytes: out.len(),
        list_iterations: state.list_iterations,
    };
    let error = match walked {
        Ok(Ok(())) => return Ok(WalkOutput { html: out, counts }),
        Ok(Err(error)) => error,
        Err(payload) => IrError::Panicked {
            message: panic_message(payload.as_ref()),
        },
    };
    let component_path = state
        .islands
        .iter()
        .map(|&id| {
            module
                .island_entry(id)
                .and_then(|entry| module.strings.get(entry.name_str_idx).ok())
                .map_or_else(|| format!("island {id}"), str::to_string)
        })
        .collect();
    Err(WalkFailure {
        error,
        component_path,
        counts,
    })
}

/// A panic payload's message: `panic!` with a literal gives a `&str`, with
/// formatting a `String`.
fn panic_message(payload: &(dyn std::any::Any + Send)) -> String {
    if let Some(message) = payload.downcast_ref::<&str>() {
        (*message).to_string()
    } else if let Some(message) = payload.downcast_ref::<String>() {
        message.clone()
    } else {
        "a panic with no message".to_string()
    }
}

/// Append a JSON document as the body of a `<script type="application/json">`
/// data block, escaped so it cannot terminate or re-open the enclosing
/// element.
///
/// Escaping `<` is total: `<` cannot appear in JSON outside a string literal,
/// and `<` is a valid JSON string escape, so `JSON.parse` yields
/// byte-identical *values*. It simultaneously kills `</script`, `<!--` and
/// `<script`. The previous `</` → `<\/` replace only covered the first of
/// those: a payload containing `<!--` followed later by `<script` drives a
/// spec-compliant tokenizer into the *script-data-double-escaped* state, in
/// which our own trailing `</script>` no longer closes the element and the
/// entire rest of the page is swallowed as script text.
///
/// `>` is escaped for symmetry and U+2028/U+2029 as defence in depth — those
/// two are not needed for a `JSON.parse(textContent)` consumer, only if the
/// payload is ever inlined as JS source instead of as a data block.
///
/// HYDRATION CONTRACT: the `__forma_islands` payload is JSON with `<`/`>`
/// escaped as `<`/`>`. Consumers MUST decode it with `JSON.parse`
/// (which undoes the escapes) and MUST NOT string-match the raw script text.
fn push_json_script_body(out: &mut String, json: &str, limit: usize) -> Result<(), IrError> {
    for ch in json.chars() {
        match ch {
            '<' => push_checked(out, "\\u003c", limit)?,
            '>' => push_checked(out, "\\u003e", limit)?,
            '\u{2028}' => push_checked(out, "\\u2028", limit)?,
            '\u{2029}' => push_checked(out, "\\u2029", limit)?,
            _ => {
                if out.len() >= limit {
                    return Err(IrError::OutputLimitExceeded { limit });
                }
                out.push(ch);
            }
        }
    }
    Ok(())
}

/// Walk a single island's content and produce an HTML string.
///
/// This internal fragment path has no supported caller (DR-10). It finds
/// the island by `island_id` in the module's island table, seeks to its
/// `byte_offset` in the opcode stream, and walks from after the ISLAND_START
/// opcode until the matching ISLAND_END opcode.
///
/// Returns the island ROOT element carrying the full `data-forma-*` attribute
/// set (`data-forma-island`, `-component`, `-status`, `-hydrate`, and
/// `-props` when the island has any). Clients MUST swap it in with
/// `replaceWith`/`outerHTML` and MUST NOT use `innerHTML` — that would discard
/// exactly the attributes the runtime selects on.
///
/// The `<!--f:iN-->` / `<!--/f:iN-->` marker comments are deliberately NOT
/// emitted: they live outside the root element and survive an `outerHTML`
/// swap, so re-emitting them would duplicate them.
///
/// Props are always inlined on the root as `data-forma-props`, even for an
/// island whose props would spill to the shared block. A fragment must be self-contained:
/// emitting a second `__forma_islands` block would duplicate a DOM id and,
/// because the injected copy precedes the SSR one in document order, would
/// shadow it for every other ScriptTag island on the page. The client already
/// reads `data-forma-props` first, so this needs no JS change.
#[allow(dead_code)] // Internal fragment path; no supported caller since the WASM walker retired.
pub(crate) fn walk_island(
    module: &IrModule,
    slots: &SlotData,
    island_id: u16,
) -> Result<String, IrError> {
    walk_island_with_limits(module, slots, island_id, WalkLimits::default())
}

/// [`walk_island`] with explicit resource budgets.
#[allow(dead_code)]
pub(crate) fn walk_island_with_limits(
    module: &IrModule,
    slots: &SlotData,
    island_id: u16,
    limits: WalkLimits,
) -> Result<String, IrError> {
    // 1. Find the island entry by id
    let entry = module
        .island_entry(island_id)
        .ok_or(IrError::IslandNotFound(island_id))?;

    let byte_offset = entry.byte_offset as usize;
    let ops = &module.opcodes;

    // 2. Validate byte_offset is in bounds. Saturating arithmetic: byte_offset
    //    is u32-wide and `usize` is 32 bits on wasm32.
    if byte_offset >= ops.len() {
        return Err(IrError::BufferTooShort {
            expected: byte_offset.saturating_add(1),
            actual: ops.len(),
        });
    }

    // 3. Verify we're at an ISLAND_START opcode
    let opcode = Opcode::from_byte(ops[byte_offset])?;
    if opcode != Opcode::IslandStart {
        return Err(IrError::InvalidOpcode(ops[byte_offset]));
    }

    // 4. Skip ISLAND_START opcode(1) + island_id(2) = 3 bytes
    let content_start = byte_offset.saturating_add(3);
    if content_start > ops.len() {
        return Err(IrError::BufferTooShort {
            expected: content_start,
            actual: ops.len(),
        });
    }

    // 5. Replicate the ISLAND_START handler: seeking past the opcode means it
    //    never runs, so without this the island root comes back with none of
    //    its data-forma-* attributes and would never hydrate.
    let mut out = String::with_capacity(256);
    let mut state = WalkState::new(limits);
    // Applies to nested islands inside this one as well, so a ScriptTag island
    // nested in the fragment keeps its props instead of losing them on return.
    state.force_inline_props = true;
    let mut slots_mut = slots.clone();

    let component_name = module.strings.get(entry.name_str_idx)?.to_string();
    let inline_props = if entry.slot_ids.is_empty() {
        None
    } else {
        let props = build_island_props(module, &slots_mut, &entry.slot_ids);
        Some(serde_json::to_string(&props).unwrap_or_else(|_| "{}".to_string()))
    };
    state.pending_island = Some(IslandPending {
        id: island_id,
        component_name,
        inline_props,
        trigger: entry.trigger,
    });

    // 6. Walk until the matching ISLAND_END, which stops the range.
    walk_range_until_island_end(
        module,
        &mut slots_mut,
        ops,
        content_start,
        island_id,
        &mut out,
        &mut state,
        0,
    )?;

    Ok(out)
}

// ---------------------------------------------------------------------------
// Internal: recursive sub-range walker
// ---------------------------------------------------------------------------

/// Maximum nesting depth for LIST opcodes. Prevents stack overflow from
/// deeply nested or malicious input.
const MAX_LIST_DEPTH: u8 = crate::format::MAX_LIST_DEPTH as u8;

/// Maximum recursion depth for control-flow opcodes (SHOW_IF, SWITCH, LIST,
/// TRY/FALLBACK). Prevents stack overflow from deeply nested or malicious IR.
const MAX_RECURSION_DEPTH: usize = crate::format::MAX_CONTROL_DEPTH;

/// Controls how the walker decides when to stop processing opcodes.
enum WalkMode {
    /// Walk a fixed byte range `ops[start..end]`.  Used for the top-level
    /// full-page walk **and** for all recursive sub-range calls inside
    /// control-flow opcodes (ShowIf, Switch, List).
    Range { end: usize },
    /// Walk until we encounter an ISLAND_END opcode whose `island_id` matches
    /// `target_island_id`.  Used by `walk_island()` for fragment rendering.
    UntilIslandEnd { target_island_id: u16 },
}

/// Walk a sub-range of the opcode stream `ops[start..end]`, appending HTML to `out`.
///
/// This is structured as a sub-range function so that control-flow opcodes
/// (ShowIf, List, Switch) can recurse into their body ranges.
///
/// `state` carries mutable walker context (list depth, output budget, etc.).
#[allow(clippy::too_many_arguments)]
fn walk_range(
    module: &IrModule,
    slots: &mut SlotData,
    ops: &[u8],
    start: usize,
    end: usize,
    out: &mut String,
    state: &mut WalkState,
    depth: usize,
) -> Result<(), IrError> {
    walk_range_impl(
        module,
        slots,
        ops,
        start,
        WalkMode::Range { end },
        out,
        state,
        depth,
    )
}

/// Walk the opcode stream starting at `start` until we encounter an ISLAND_END
/// with the matching `target_island_id`. Appends HTML output to `out`.
///
/// This is used by `walk_island()` to render just one island's content.
/// It shares the same opcode interpretation as `walk_range` but has a different
/// termination condition: it stops at ISLAND_END instead of a fixed end position.
#[allow(clippy::too_many_arguments)]
fn walk_range_until_island_end(
    module: &IrModule,
    slots: &mut SlotData,
    ops: &[u8],
    start: usize,
    target_island_id: u16,
    out: &mut String,
    state: &mut WalkState,
    depth: usize,
) -> Result<(), IrError> {
    walk_range_impl(
        module,
        slots,
        ops,
        start,
        WalkMode::UntilIslandEnd { target_island_id },
        out,
        state,
        depth,
    )
}

/// Shared implementation for both `walk_range` and `walk_range_until_island_end`.
///
/// The `mode` parameter controls the termination condition:
/// - `WalkMode::Range { end }` — stop when `pos >= end` (with bounds check)
/// - `WalkMode::UntilIslandEnd { target_island_id }` — stop when we hit an
///   ISLAND_END opcode matching the target id
///
/// All opcode handling is identical regardless of mode. The only differences
/// are:
/// 1. The loop termination condition
/// 2. How ISLAND_END is handled (in Range mode it emits the comment marker
///    and continues; in UntilIslandEnd mode a match causes an early return)
/// 3. What happens when the loop ends without an explicit stop (Range returns
///    Ok, UntilIslandEnd returns an error)
#[allow(clippy::too_many_arguments)]
fn walk_range_impl(
    module: &IrModule,
    slots: &mut SlotData,
    ops: &[u8],
    start: usize,
    mode: WalkMode,
    out: &mut String,
    state: &mut WalkState,
    depth: usize,
) -> Result<(), IrError> {
    if depth > MAX_RECURSION_DEPTH {
        return Err(IrError::RecursionLimitExceeded);
    }

    let strings = &module.strings;
    let mut pos = start;
    let limit = state.max_output_bytes;
    // Range-local, not shared on WalkState: a TRY_START and its FALLBACK are
    // emitted in the same opcode range by construction, so a FALLBACK reached
    // inside a nested range must never pop an entry pushed by an outer
    // TRY_START and skip that many bytes of the wrong region. A stray FALLBACK
    // then finds an empty stack and is a no-op, mirroring how a stray
    // SHOW_ELSE is already tolerated. This also removes the unbounded growth
    // when a TRY_START is walked but its FALLBACK never is.

    // The loop bound depends on the mode:
    // - Range: stop at `end`, but also guard against `pos >= ops.len()`
    // - UntilIslandEnd: stop at `ops.len()` (or earlier via ISLAND_END match)
    let loop_bound = match mode {
        WalkMode::Range { end } => end,
        WalkMode::UntilIslandEnd { .. } => usize::MAX, // guarded by ops.len() check below
    };

    // Upper bound every derived offset (branch/body ends) must respect. In
    // Range mode that is the enclosing region; on the island path there is no
    // `end`, so the opcode stream itself is the bound.
    let region_limit = match mode {
        WalkMode::Range { end } => end.min(ops.len()),
        WalkMode::UntilIslandEnd { .. } => ops.len(),
    };

    while pos < loop_bound {
        // Cheap redundancy: every append also goes through a checked push, so
        // a single opcode cannot blow past the budget between iterations.
        if out.len() > limit {
            return Err(IrError::OutputLimitExceeded { limit });
        }

        // In Range mode, `end` could exceed ops.len()` for a malformed stream.
        // In UntilIslandEnd mode, loop_bound is MAX so we always need this check.
        if pos >= ops.len() {
            match mode {
                WalkMode::Range { .. } => {
                    return Err(IrError::BufferTooShort {
                        expected: pos + 1,
                        actual: ops.len(),
                    });
                }
                WalkMode::UntilIslandEnd { .. } => break, // fall through to IslandNotFound error
            }
        }

        let opcode = Opcode::from_byte(ops[pos])?;
        pos += 1; // advance past the opcode byte

        // Flush pending tag close before any opcode that is NOT DYN_ATTR.
        // DYN_ATTR needs the tag still open so it can append attributes.
        if state.pending_tag_close && opcode != Opcode::DynAttr {
            close_start_tag(out, state, limit)?;
        }

        match opcode {
            // ----- Fully implemented opcodes -----
            Opcode::OpenTag | Opcode::VoidTag => {
                let (tag_str_idx, attrs, new_pos) = read_tag_with_attrs(ops, pos, strings)?;
                let tag = strings.get(tag_str_idx)?;
                let has_content = opcode == Opcode::OpenTag;
                emit_open_tag(out, tag, &attrs, has_content, state, limit)?;
                state.nodes += 1;
                pos = new_pos;
            }

            Opcode::CloseTag => {
                let str_idx = read_u32(ops, pos)?;
                pos += 4;
                let tag = strings.get(str_idx)?;
                // Names are written to the output stream unescaped, so an
                // IR-authored name is markup injection unless it is validated.
                if !is_valid_name(tag) {
                    return Err(IrError::InvalidName(tag.to_string()));
                }
                leave_element(out, tag, state, limit)?;
                push_checked(out, "</", limit)?;
                push_checked(out, tag, limit)?;
                push_checked(out, ">", limit)?;
            }

            Opcode::Text => {
                let str_idx = read_u32(ops, pos)?;
                pos += 4;
                let text = strings.get(str_idx)?;
                if let Some(parent) = state.text_only.as_mut() {
                    if !parent.value_bound {
                        write_text_only(out, parent, text, limit)?;
                    }
                } else {
                    push_escaped_html(out, text, limit)?;
                    if let Some(option) = state.option_by_text.as_mut() {
                        option.text.push_str(text);
                    }
                }
                state.nodes += 1;
            }

            Opcode::DynText => {
                // slot_id(u16) + marker_id(u16)
                let slot_id = read_u16(ops, pos)?;
                pos += 2;
                let marker_id = read_u16(ops, pos)?;
                pos += 2;

                check_slot_source(module, slot_id, slots.get(slot_id));
                let value = slots.get(slot_id).to_text();

                // SR44's stand-in for a component that panics: this crate's
                // tests and the internal `__fault-injection` feature only, and
                // armed only inside `walk_to_html_counted`, which catches it.
                #[cfg(any(test, feature = "__fault-injection"))]
                #[allow(clippy::panic)]
                if state.fault_armed && value == crate::fault_injection::FAULT_TRIGGER {
                    panic!("stand-in component panicked (FAULT_TRIGGER)");
                }

                if let Some(parent) = state.text_only.as_mut() {
                    // Inside a text-only element a marker comment is literal
                    // text, so the value is written on its own (TextOnlyTag).
                    if !parent.value_bound {
                        write_text_only(out, parent, &value, limit)?;
                    }
                } else {
                    push_checked(out, "<!--f:t", limit)?;
                    push_u16(out, marker_id, limit)?;
                    push_checked(out, "-->", limit)?;
                    // Always emit at least a zero-width space so the browser
                    // creates a Text node between the markers. Without this,
                    // <!--f:t0--><!--/f:t0--> produces no Text node in the DOM
                    // and the hydration walker has nothing to bind the
                    // reactive effect to.
                    let written = if value.is_empty() {
                        "\u{200B}"
                    } else {
                        value.as_str()
                    };
                    push_escaped_html(out, written, limit)?;
                    push_checked(out, "<!--/f:t", limit)?;
                    push_u16(out, marker_id, limit)?;
                    push_checked(out, "-->", limit)?;
                    if let Some(option) = state.option_by_text.as_mut() {
                        option.text.push_str(written);
                    }
                }
                state.nodes += 1;
            }

            Opcode::DynAttr => {
                // attr_str_idx(u32) + slot_id(u16) = 6 bytes
                let attr_str_idx = read_u32(ops, pos)?;
                let slot_id = read_u16(ops, pos + 4)?;
                pos += 6;
                check_slot_source(module, slot_id, slots.get(slot_id));

                if state.pending_tag_close {
                    let attr_name = strings.get(attr_str_idx)?;
                    // `value` on a textarea or select, and `selected` on an
                    // option of a bound select, are written another way.
                    if consume_control_attr(state, attr_name, Prop::Slot(slots.get(slot_id))) {
                        continue;
                    }
                    // `text` outlives the borrow only for the Valued case; it
                    // is declared here so the &str can point into it.
                    let text;
                    let value = match slots.get(slot_id) {
                        // An HTML boolean attribute is ON whenever it is
                        // present, so the old `disabled="false"` meant
                        // DISABLED. Absent for false/null, bare for true —
                        // byte-for-byte what `renderAttr` in @getforma/core
                        // produces for the same value.
                        SlotValue::Bool(false) | SlotValue::Null => None,
                        SlotValue::Bool(true) => Some(AttrValue::Bare),
                        other => {
                            text = other.to_text();
                            // An empty string is a value, not an absence:
                            // `renderAttr` emits `value=""`, and dropping the
                            // attribute instead is a hydration mismatch on the
                            // common `value=""` / `alt=""` case.
                            Some(AttrValue::Valued(text.as_str()))
                        }
                    };
                    if let Some(value) = value {
                        // `pending_tag_name` is the element this attribute is
                        // being written to — it decides whether a
                        // data:image/svg+xml value is in an image context.
                        let tag = std::mem::take(&mut state.pending_tag_name);
                        emit_attr(out, &tag, attr_name, value, limit)?;
                        state.pending_tag_name = tag;
                    }
                }
                // If not inside a tag opening (shouldn't happen in well-formed IR), skip silently.
            }

            Opcode::IslandStart => {
                // island_id(u16)
                let island_id = read_u16(ops, pos)?;
                pos += 2;

                // Only one element can carry a `data-forma-island` set. If an
                // island's body starts another island before opening a tag of
                // its own, the outer island's attributes are silently
                // discarded and it never hydrates, never disposes, and cannot
                // be found by `activateIslands`. Fail the render instead: the
                // compiler owes every island a shell element.
                if let Some(outer) = &state.pending_island {
                    return Err(IrError::NestedIslandRoot {
                        outer: outer.id,
                        inner: island_id,
                    });
                }
                state.islands.push(island_id);

                // No marker inside a text-only element, where it is text.
                if state.text_only.is_none() {
                    push_checked(out, "<!--f:i", limit)?;
                    push_u16(out, island_id, limit)?;
                    push_checked(out, "-->", limit)?;
                }

                // Look up island entry from the island table (O(1) index).
                // `IrModule::validate` rejects an ISLAND_START naming an
                // island the table does not declare, so the `else` below is
                // reachable only for a module that skipped validation.
                // Verified by: crates/forma-ir/src/parser.rs > "validate_rejects_island_start_missing_from_table"
                if let Some(entry) = module.island_entry(island_id) {
                    let component_name = strings.get(entry.name_str_idx)?.to_string();

                    // Build props JSON from the island's slot_ids
                    let inline_props = if entry.slot_ids.is_empty() {
                        None
                    } else {
                        let props = build_island_props(module, slots, &entry.slot_ids);
                        let json =
                            serde_json::to_string(&props).unwrap_or_else(|_| "{}".to_string());
                        if json.len() > INLINE_PROPS_MAX_BYTES && !state.force_inline_props {
                            state
                                .script_tag_props
                                .insert(island_id, serde_json::Value::Object(props));
                            None
                        } else {
                            Some(json)
                        }
                    };

                    state.pending_island = Some(IslandPending {
                        id: island_id,
                        component_name,
                        inline_props,
                        trigger: entry.trigger,
                    });
                } else {
                    #[cfg(feature = "tracing")]
                    tracing::warn!(
                        island_id = island_id,
                        "ISLAND_START names an island that is not in the island table — \
                         markers emitted but no data-forma-* attributes, so it will not hydrate \
                         (module was not validated)"
                    );
                }
            }

            Opcode::IslandEnd => {
                // island_id(u16)
                let island_id = read_u16(ops, pos)?;
                pos += 2;
                if state.islands.last() == Some(&island_id) {
                    state.islands.pop();
                }

                // The island is over: anything still pending belongs to no
                // element inside it. Without this, an ISLAND_START not
                // followed by a tag leaks its identity attributes onto
                // whatever element comes next — possibly one emitted after the
                // island's own closing marker.
                if state.pending_island.take().is_some() {
                    #[cfg(feature = "tracing")]
                    tracing::warn!(
                        island_id = island_id,
                        "ISLAND_START was not followed by an element — island attributes dropped, \
                         this island will not hydrate (compiler should emit a shell element)"
                    );
                }

                // In UntilIslandEnd mode, a matching island_id means we are done.
                if let WalkMode::UntilIslandEnd { target_island_id } = mode {
                    if island_id == target_island_id {
                        // Flush any pending tag close before returning.
                        if state.pending_tag_close {
                            close_start_tag(out, state, limit)?;
                        }
                        return Ok(());
                    }
                }

                // Either Range mode, or a nested (non-matching) island end —
                // emit the closing marker comment and continue (no marker
                // inside a text-only element, where it is text).
                if state.text_only.is_none() {
                    push_checked(out, "<!--/f:i", limit)?;
                    push_u16(out, island_id, limit)?;
                    push_checked(out, "-->", limit)?;
                }
            }

            Opcode::ShowIf => {
                // slot_id(2) + then_len(4) + else_len(4) = 10 bytes header
                let slot_id = read_u16(ops, pos)?;
                let then_len = read_u32(ops, pos + 2)? as usize;
                let else_len = read_u32(ops, pos + 6)? as usize;
                pos += 10;

                check_slot_source(module, slot_id, slots.get(slot_id));
                let condition = slots.get(slot_id).as_bool();
                let then_start = pos;
                // Checked, and bounded by the enclosing region: a corrupt
                // length would otherwise silently relocate content across the
                // hydration markers, and plain `+` can wrap on wasm32.
                let then_end = bounded_offset(pos, then_len, region_limit)?;
                // The SHOW_ELSE marker byte must itself be inside the region
                // (`<` not `<=`), or a SHOW_IF at the tail of a sub-range would
                // read a byte its parent never granted.
                if then_end >= region_limit || ops[then_end] != Opcode::ShowElse as u8 {
                    return Err(IrError::InvalidSection);
                }
                let else_start = then_end + 1; // skip SHOW_ELSE byte
                let else_end = bounded_offset(else_start, else_len, region_limit)?;

                // Emit conditional marker — none inside a text-only element,
                // where it is text. Decided once, so the pair always matches.
                let markers = state.text_only.is_none();
                if markers {
                    push_checked(out, "<!--f:s", limit)?;
                    push_u16(out, slot_id, limit)?;
                    push_checked(out, "-->", limit)?;
                }

                if condition {
                    walk_range(
                        module,
                        slots,
                        ops,
                        then_start,
                        then_end,
                        out,
                        state,
                        depth + 1,
                    )?;
                } else {
                    walk_range(
                        module,
                        slots,
                        ops,
                        else_start,
                        else_end,
                        out,
                        state,
                        depth + 1,
                    )?;
                }

                if markers {
                    push_checked(out, "<!--/f:s", limit)?;
                    push_u16(out, slot_id, limit)?;
                    push_checked(out, "-->", limit)?;
                }

                // Advance pos past both branches + SHOW_ELSE marker byte
                pos = else_end;
            }

            Opcode::ShowElse => {
                // SHOW_ELSE should never be reached during normal walking — it is
                // skipped over by the SHOW_IF handler. If we reach it, the opcode
                // stream is malformed, but we tolerate it gracefully by doing nothing.
            }

            // LIMITATION, not an oversight: SWITCH emits no `<!--f:…-->`
            // marker pair, because the hydration wire contract has no switch
            // marker — it defines exactly `f:tN` (text), `f:sN` (conditional),
            // `f:lN` (list) and `f:iN` (island), and those bytes are shared
            // with @getforma/core and ksx Studio. A switched region is
            // therefore server-rendered only: the client cannot locate it to
            // re-render when the slot changes. Adding one is a coordinated
            // change to both renderers and the client walker, not a
            // walker-local fix. SWITCH also has no default case in the opcode
            // layout; a non-matching value renders nothing.
            Opcode::List => {
                // slot_id(2) + item_slot_id(2) + body_len(4) = 8 bytes header
                let slot_id = read_u16(ops, pos)?;
                let item_slot_id = read_u16(ops, pos + 2)?;
                let body_len = read_u32(ops, pos + 4)? as usize;
                pos += 8;

                check_slot_source(module, slot_id, slots.get(slot_id));

                let body_start = pos;
                let body_end = bounded_offset(pos, body_len, region_limit)?;

                // Emit list markers — none inside a text-only element, where
                // they are text. Decided once, so the pair always matches.
                let list_marker_id = slot_id;
                let markers = state.text_only.is_none();
                if markers {
                    push_checked(out, "<!--f:l", limit)?;
                    push_u16(out, list_marker_id, limit)?;
                    push_checked(out, "-->", limit)?;
                }

                // Take a cheap handle on the array to release the borrow on
                // `slots` before the loop mutates it. The payload is
                // Arc-backed, so this is a refcount bump — and holding it
                // means a body that writes to the list's own slot cannot
                // change what we are iterating.
                let items = match slots.get(slot_id) {
                    SlotValue::Array(a) => Some(a.clone()),
                    _ => None,
                };

                if let Some(items) = items.filter(|a| !a.is_empty()) {
                    state.list_depth += 1;
                    if state.list_depth > MAX_LIST_DEPTH {
                        return Err(IrError::ListDepthExceeded {
                            max: MAX_LIST_DEPTH,
                        });
                    }
                    // A list longer than what is left of the budget fails
                    // here, before its first row, instead of walking up to
                    // the budget and failing there (DR-13, SR38): a hostile
                    // 60,000-row list costs a comparison, not 50,000 rows.
                    // It fails exactly when the per-row check below would
                    // have, sooner, and before any error the rows would have
                    // raised first (an output budget, a malformed row). That
                    // check stays: rows of nested lists can spend the budget
                    // after this list was let in.
                    //
                    // Verified by: crates/forma-ir/src/walker.rs > "a_list_longer_than_the_remaining_budget_fails_before_its_first_row"
                    // Verified by: crates/forma-ir/src/walker.rs > "a_list_exactly_at_the_remaining_budget_still_renders"
                    let remaining = state
                        .max_list_iterations
                        .saturating_sub(state.list_iterations);
                    if items.len() > remaining {
                        return Err(IrError::ListBudgetExceeded {
                            max: state.max_list_iterations,
                        });
                    }
                    for item in items.iter() {
                        // Total across all depths, never decremented: depth
                        // alone does not bound volume, and four nested LISTs
                        // over the same array give n^4 body walks.
                        //
                        // Checked before counting, so at the error the count
                        // is the rows actually walked (`WalkCounts`).
                        if state.list_iterations >= state.max_list_iterations {
                            return Err(IrError::ListBudgetExceeded {
                                max: state.max_list_iterations,
                            });
                        }
                        state.list_iterations += 1;
                        // Scoped binding instead of a per-row `SlotData`
                        // clone: swap the item in, walk, swap back. Same
                        // isolation between rows, without copying every other
                        // slot on the page once per row.
                        let mark = state.slot_journal.len();
                        let previous = slots.replace(item_slot_id, item.clone());
                        state.slot_journal.push((item_slot_id, previous));

                        let walked = walk_range(
                            module,
                            slots,
                            ops,
                            body_start,
                            body_end,
                            out,
                            state,
                            depth + 1,
                        );
                        // Unwind before propagating: an aborted walk must
                        // still hand `slots` back exactly as it was, because
                        // an enclosing row is about to unwind on top of it.
                        state.unwind_slot_journal(slots, mark);
                        walked?;

                        // A LIST_ITEM_KEY that never met an element belongs to
                        // this item only — do not let it leak onto whatever
                        // element the next item (or the code after the list)
                        // happens to open.
                        state.pending_list_key = None;
                    }
                    state.list_depth -= 1;
                }
                state.pending_list_key = None;

                if markers {
                    push_checked(out, "<!--/f:l", limit)?;
                    push_u16(out, list_marker_id, limit)?;
                    push_checked(out, "-->", limit)?;
                }

                pos = body_end;
            }

            Opcode::Prop => {
                // src_slot_id(u16) + prop_str_idx(u32) + target_slot_id(u16) = 8 bytes
                let src_slot_id = read_u16(ops, pos)?;
                let prop_str_idx = read_u32(ops, pos + 2)?;
                let target_slot_id = read_u16(ops, pos + 6)?;
                pos += 8;

                let prop_name = strings.get(prop_str_idx)?;
                let value = slots.get(src_slot_id).get_property(prop_name);
                // Mutate `slots` directly and journal the displaced value, so
                // the enclosing LIST row restores it when the row ends. A PROP
                // outside any list writes for the rest of the page, which is
                // what it did when each row got its own clone.
                let previous = slots.replace(target_slot_id, value);
                state.journal_write(target_slot_id, previous);
            }
        }
    }

    // Post-loop handling depends on the mode:
    match mode {
        WalkMode::Range { .. } => {
            // Flush any pending tag close at the end of the opcode range.
            //
            // NOTE: `pending_island` / `pending_list_key` are deliberately NOT
            // cleared here. This function runs for every nested control-flow
            // body with the same state, so clearing at range end would wipe
            // the island attributes of a legitimate
            // ISLAND_START → SHOW_IF → OPEN_TAG stream (the island root would
            // silently never hydrate). They are cleared at their owning
            // boundaries instead: ISLAND_END and the LIST item loop.
            if state.pending_tag_close {
                close_start_tag(out, state, limit)?;
            }
            Ok(())
        }
        WalkMode::UntilIslandEnd { target_island_id } => {
            // If we reach the end of the opcode stream without finding ISLAND_END,
            // that means the IR is malformed. Return an error.
            Err(IrError::IslandNotFound(target_island_id))
        }
    }
}

// ---------------------------------------------------------------------------
// Island props helpers
// ---------------------------------------------------------------------------

/// Build a JSON object from the island's slot_ids, looking up names from
/// the slot table and values from the current SlotData.
///
/// DUPLICATE-NAME RULE: two of the island's slots can carry the same name (the
/// compiler derives some names per-element, not per-module). The first one in
/// `slot_ids` order wins, matching [`IrModule::slot_id_by_name`] and
/// [`SlotData::from_json`]; a plain `insert` made the LAST one win here, so the
/// island's props disagreed with every other name lookup in the crate and one
/// of the two values vanished with no diagnostic.
///
/// Verified by: crates/forma-ir/src/walker.rs > "island_props_keep_the_first_slot_for_a_duplicated_name"
fn build_island_props(
    module: &IrModule,
    slots: &SlotData,
    slot_ids: &[u16],
) -> serde_json::Map<String, serde_json::Value> {
    let mut map = serde_json::Map::new();
    for &slot_id in slot_ids {
        // Look up slot name from the slot table (O(1) index)
        if let Some(entry) = module.slot_entry(slot_id) {
            if let Ok(name) = module.strings.get(entry.name_str_idx) {
                if map.contains_key(name) {
                    #[cfg(feature = "tracing")]
                    tracing::warn!(
                        slot_id = slot_id,
                        name = name,
                        "Island declares two slots with the same name — keeping the first, \
                         the later value is not reachable from the props object"
                    );
                    continue;
                }
                let value = slots.get(slot_id).to_json();
                map.insert(name.to_string(), value);
            }
        } else {
            // `IrModule::validate` rejects this at parse time; keep the branch
            // observable in case a module reaches the walker unvalidated,
            // since a silently dropped prop means the island's SSR props
            // disagree with what the client expects.
            #[cfg(feature = "tracing")]
            tracing::warn!(
                slot_id = slot_id,
                "Island references a slot id that is not in the slot table — prop dropped"
            );
        }
    }
    map
}

// ---------------------------------------------------------------------------
// Offset arithmetic
// ---------------------------------------------------------------------------

/// `base + len`, rejected if it overflows or leaves the enclosing region.
///
/// Plain `+` on `usize` can overflow on a 32-bit target. The parser accepts
/// arbitrary bytes, so the offset must be checked before indexing.
fn bounded_offset(base: usize, len: usize, limit: usize) -> Result<usize, IrError> {
    base.checked_add(len)
        .filter(|e| *e <= limit)
        .ok_or(IrError::InvalidSection)
}

// ---------------------------------------------------------------------------
// Name and URL safety
// ---------------------------------------------------------------------------

/// True if `name` is safe to emit verbatim as a tag or attribute name.
///
/// Names are written to the output stream unescaped (only *values* go through
/// the escapers), so a string-table entry used as a tag name — `div onload=x`
/// — or as an attribute key — `x"><script` — is direct markup injection. The
/// accepted class is `[A-Za-z_:][-A-Za-z0-9_:.]*`, byte-identical to
/// formajs's `isSafeAttrName`/`isSafeTagName`, and covers every valid HTML,
/// SVG and custom-element name (`data-*`, `aria-*`, `xlink:href`, `viewBox`,
/// dotted component names).
fn is_valid_name(name: &str) -> bool {
    let mut chars = name.chars();
    match chars.next() {
        Some(c) if c.is_ascii_alphabetic() || c == '_' || c == ':' => {}
        _ => return false,
    }
    chars.all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | ':' | '.'))
}

/// True for any `on…` event-handler attribute name (case-insensitive).
fn is_event_handler_attr(name: &str) -> bool {
    name.len() >= 2 && name.as_bytes()[..2].eq_ignore_ascii_case(b"on")
}

/// Attributes whose value the browser resolves as a URL.
///
/// Mirrors formajs's `URL_ATTRS` exactly. `srcset` is deliberately absent (a
/// comma-separated candidate list that a single scheme test would misparse,
/// and always fetched in image mode) and so is `cite`; adding either would
/// make the Rust walker stricter than the JS renderer, which is itself a
/// hydration divergence.
const URL_ATTRS: [&str; 8] = [
    "href",
    "src",
    "action",
    "formaction",
    "xlink:href",
    "poster",
    "background",
    "data",
];

/// Tags whose URL-bearing attributes are always fetched as an image or media
/// resource and never parsed as a document — the only places a
/// `data:image/svg+xml` value is safe. Mirrors formajs's `IMAGE_CONTEXT_TAGS`.
const IMAGE_CONTEXT_TAGS: [&str; 13] = [
    "img", "image", "video", "audio", "source", "body", "table", "thead", "tbody", "tfoot", "tr",
    "td", "th",
];

/// True if `name` is a URL-bearing attribute (case-insensitive).
fn is_url_attr(name: &str) -> bool {
    URL_ATTRS.iter().any(|a| name.eq_ignore_ascii_case(a))
}

/// True if writing `value` to a URL attribute on `<tag>` would create an XSS
/// sink.
///
/// Browsers strip ASCII whitespace and C0/C1 control characters out of a URL
/// before resolving its scheme, so `java\tscript:alert(1)` executes even
/// though a naive prefix test does not match it. The value is normalized the
/// same way before testing — byte-identical to formajs's `isDangerousUrl`, so
/// the server emits exactly what the client would have produced.
fn is_dangerous_url(value: &str, tag: &str) -> bool {
    let normalized: String = value
        .chars()
        .filter(|c| {
            let n = *c as u32;
            !((n <= 0x20) || (0x7F..=0x9F).contains(&n))
        })
        .collect();
    let lower = normalized.to_ascii_lowercase();

    if lower.starts_with("javascript") || lower.starts_with("vbscript") {
        return true;
    }
    if lower.starts_with("data:text/html") {
        return true;
    }
    // `data:image/svg+xml` is a *conditional* hazard: through an image sink it
    // decodes in image mode where script never runs; through a document sink
    // an `onload=` inside it fires. It is not blanket-blocked because the
    // stock CSP explicitly permits `img-src data:`.
    if lower.starts_with("data:image/svg+xml") {
        return !IMAGE_CONTEXT_TAGS
            .iter()
            .any(|t| tag.eq_ignore_ascii_case(t));
    }
    false
}

/// How an attribute's value is written out.
///
/// The distinction exists because `key` and `key=""` are the same DOM but
/// `key` and `key="false"` are not: an HTML boolean attribute is ON whenever
/// it is present, whatever its value, so `disabled="false"` disables the
/// control. See [`AttrValue::from_slot`].
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum AttrValue<'a> {
    /// Write the bare name, no `="…"`.
    Bare,
    /// Write `key="escaped"`, including when `value` is empty.
    Valued(&'a str),
}

/// Emit one attribute, dropping it entirely if it is unsafe.
///
/// Dropping (rather than emitting an empty value) is what the client does:
/// `renderAttr` returns null and hydration calls `removeAttribute`. An
/// SSR-emitted `href=""` resolves to the current page — a real navigation —
/// and would not match the client DOM.
fn emit_attr(
    out: &mut String,
    tag: &str,
    key: &str,
    val: AttrValue<'_>,
    limit: usize,
) -> Result<(), IrError> {
    if !is_valid_name(key) {
        // Skip silently (matching the walker's existing convention for
        // malformed attribute operands) rather than failing the whole page
        // for one bad key.
        #[cfg(feature = "tracing")]
        tracing::warn!(attr = key, "Dropping attribute with an unsafe name");
        return Ok(());
    }
    if is_event_handler_attr(key) {
        #[cfg(feature = "tracing")]
        tracing::warn!(attr = key, "Dropping event-handler attribute from IR");
        return Ok(());
    }
    if let AttrValue::Valued(v) = val {
        if is_url_attr(key) && is_dangerous_url(v, tag) {
            #[cfg(feature = "tracing")]
            tracing::warn!(attr = key, "Dropping URL attribute with a dangerous scheme");
            return Ok(());
        }
    }

    push_checked(out, " ", limit)?;
    push_checked(out, key, limit)?;
    if let AttrValue::Valued(v) = val {
        push_checked(out, "=\"", limit)?;
        push_escaped_attr(out, v, limit)?;
        push_checked(out, "\"", limit)?;
    }
    Ok(())
}

/// Emit `<tag ...attrs`, plus any pending island / list-item attributes.
///
/// Shared by OPEN_TAG and VOID_TAG, which differ only in whether a matching
/// CLOSE_TAG follows (`has_content`). The `>` is deliberately not written yet:
/// DYN_ATTR opcodes may still append attributes.
fn emit_open_tag(
    out: &mut String,
    tag: &str,
    attrs: &[(&str, &str)],
    has_content: bool,
    state: &mut WalkState,
    limit: usize,
) -> Result<(), IrError> {
    if !is_valid_name(tag) {
        return Err(IrError::InvalidName(tag.to_string()));
    }
    if has_content {
        enter_element(out, tag, state, limit)?;
    }
    push_checked(out, "<", limit)?;
    push_checked(out, tag, limit)?;

    for (key, val) in attrs {
        // `value` on a textarea or select, and `selected` on an option of a
        // bound select, are written another way.
        if consume_control_attr(state, key, Prop::Static(val)) {
            continue;
        }
        // A static attribute is authored text, never a boolean. An empty value
        // stays the bare name: `key` and `key=""` parse to the same DOM, and
        // keeping the shorthand leaves already-compiled modules byte-stable.
        let value = if val.is_empty() {
            AttrValue::Bare
        } else {
            AttrValue::Valued(val)
        };
        emit_attr(out, tag, key, value, limit)?;
    }

    // Inject pending island attributes
    if let Some(island) = state.pending_island.take() {
        push_checked(out, " data-forma-island=\"", limit)?;
        push_u16(out, island.id, limit)?;
        push_checked(out, "\" data-forma-component=\"", limit)?;
        push_escaped_attr(out, &island.component_name, limit)?;
        push_checked(out, "\" data-forma-status=\"pending\"", limit)?;
        let trigger_str = match island.trigger {
            IslandTrigger::Load => "load",
            IslandTrigger::Visible => "visible",
            IslandTrigger::Interaction => "interaction",
            IslandTrigger::Idle => "idle",
        };
        push_checked(out, " data-forma-hydrate=\"", limit)?;
        push_checked(out, trigger_str, limit)?;
        push_checked(out, "\"", limit)?;
        if let Some(ref props_json) = island.inline_props {
            push_checked(out, " data-forma-props=\"", limit)?;
            push_escaped_attr(out, props_json, limit)?;
            push_checked(out, "\"", limit)?;
        }
    }

    // Inject pending list-item key
    if let Some(key) = state.pending_list_key.take() {
        push_checked(out, " data-forma-key=\"", limit)?;
        push_escaped_attr(out, &key, limit)?;
        push_checked(out, "\"", limit)?;
    }

    // Don't close the tag yet — DYN_ATTR opcodes may follow.
    state.pending_tag_close = true;
    state.pending_tag_name.clear();
    state.pending_tag_name.push_str(tag);
    Ok(())
}

// ---------------------------------------------------------------------------
// Parsing context: text-only parents and form controls
// ---------------------------------------------------------------------------

/// An element whose content the HTML tokenizer reads as text, not markup.
///
/// `textarea` and `title` are RCDATA: character references are decoded, but
/// a comment is not a comment. `style` (RAWTEXT) and `script` (script data)
/// decode nothing. A hydration marker inside any of them is literal text:
/// before JavaScript it is the control's value, what a form submits, and the
/// title the reader sees. So inside these four the walker writes no `f:`
/// marker of any kind (text, conditional, list or island) and no zero-width
/// space: the content is the element's static and dynamic text, in order.
///
/// The client adopts `textarea` and `title` text as a whole, by the element
/// (formajs, FORMA-003). A reactive child of `style` or `script` is not
/// supported for adoption in 0.2.x: its text is right before JavaScript, but
/// adoption may rewrite it. DR-7 makes it a build error in 3.0.0.
///
/// Dynamic text is still HTML-escaped. In RCDATA the parser decodes it back,
/// so the text is exact. In `style` and `script` nothing is decoded, so a
/// value holding `&`, `<` or `>` reads as the entity until the client writes
/// the element; that is the price of a hole that can neither close its
/// element (`</style>`) nor, in a script, swallow the rest of the page. A
/// hole there is still a code sink: the escaping does not make the value safe
/// as JavaScript or CSS.
///
/// Matched ASCII case-insensitively and in any namespace. An SVG `title` has
/// ordinary content, but its text written without markers is equally right,
/// and a single rule is one the client can match exactly.
///
/// Verified by: crates/forma-ir/src/walker.rs > "dyn_text_in_a_text_only_parent_is_written_without_markers"
/// Verified by: crates/forma-ir/src/walker.rs > "no_marker_kind_is_written_inside_a_text_only_parent"
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum TextOnlyTag {
    Textarea,
    Title,
    Style,
    Script,
}

impl TextOnlyTag {
    fn from_tag(tag: &str) -> Option<Self> {
        [Self::Textarea, Self::Title, Self::Style, Self::Script]
            .into_iter()
            .find(|t| tag.eq_ignore_ascii_case(t.name()))
    }

    fn name(self) -> &'static str {
        match self {
            TextOnlyTag::Textarea => "textarea",
            TextOnlyTag::Title => "title",
            TextOnlyTag::Style => "style",
            TextOnlyTag::Script => "script",
        }
    }
}

/// The text-only element the walk is inside.
#[derive(Debug)]
struct TextOnlyParent {
    tag: TextOnlyTag,
    /// Whether any content has been written: the leading-LF rule looks at the
    /// first byte only.
    started: bool,
    /// A `textarea` whose `value` is bound: the value is its whole content,
    /// as it is on the live control, so its children are not written.
    value_bound: bool,
}

/// Write text into a text-only parent: escaped, with no marker and no
/// zero-width space, under the textarea's leading-LF rule.
///
/// The parser drops one line feed straight after `<textarea>` (a CR or CRLF is
/// a line feed by then). A marker used to stand between the tag and the first
/// line; without one, content that starts with a line break gets one more, so
/// the parsed value is the value written.
///
/// Verified by: crates/forma-ir/src/walker.rs > "a_textarea_doubles_a_leading_line_feed"
fn write_text_only(
    out: &mut String,
    parent: &mut TextOnlyParent,
    text: &str,
    limit: usize,
) -> Result<(), IrError> {
    if text.is_empty() {
        return Ok(());
    }
    if parent.tag == TextOnlyTag::Textarea
        && !parent.started
        && (text.starts_with('\n') || text.starts_with('\r'))
    {
        push_checked(out, "\n", limit)?;
    }
    parent.started = true;
    push_escaped_html(out, text, limit)
}

/// Form-control state gathered from a start tag that is still open.
///
/// A `value` on a `textarea` or a `select` is a property: HTML never reads it
/// as an attribute, so the server shipped an empty textarea and a select
/// showing its first option, and a form submitted those before JavaScript.
/// The client's writer (`writeFormControlProperty` in `@getforma/core`) sets
/// `value == null ? '' : String(value)`; the walker writes the HTML that
/// parses to the same control, and no `value` attribute.
#[derive(Debug, Default)]
enum PendingControl {
    #[default]
    None,
    /// A `textarea`; `value` is the text its bound value stands for.
    Textarea { value: Option<String> },
    /// A `select`; `multiple` records whether that attribute is written.
    Select {
        value: Option<SlotValue>,
        multiple: bool,
    },
    /// An `option` of a bound select; `value` is its `value` attribute as
    /// written, `None` when it has none.
    OptionTag { value: Option<String> },
}

/// What a bound `select` selects.
///
/// Mirrors the client's writer. A `multiple` select given an array selects
/// every option whose value is in it (`value.map(String)`). Anything else is
/// `select.value = String(value)`, which selects the FIRST option with that
/// value; a second `selected` in the HTML would win instead, since the parser
/// keeps the last. An option's value is its `value` attribute or, without
/// one, its text, stripped and collapsed. A value no option has selects
/// nothing, and the browser then shows the first option: HTML cannot write
/// the client's `selectedIndex = -1`.
///
/// Verified by: crates/forma-ir/src/walker.rs > "a_select_value_binding_selects_the_matching_option"
/// Verified by: crates/forma-ir/src/walker.rs > "a_single_select_selects_only_the_first_matching_option"
/// Verified by: crates/forma-ir/src/walker.rs > "a_multiple_select_selects_every_option_in_an_array_value"
#[derive(Debug)]
struct SelectBinding {
    wanted: SelectWanted,
    /// A single select has selected its option.
    matched: bool,
}

#[derive(Debug)]
enum SelectWanted {
    One(String),
    Any(Vec<String>),
}

impl SelectBinding {
    fn new(value: &SlotValue, multiple: bool) -> Self {
        let wanted = match value {
            SlotValue::Array(items) if multiple => {
                SelectWanted::Any(items.iter().map(js_string).collect())
            }
            // `value == null ? '' : String(value)` is exactly `to_text`.
            other => SelectWanted::One(other.to_text()),
        };
        SelectBinding {
            wanted,
            matched: false,
        }
    }

    /// Whether the option valued `option_value` is selected.
    fn selects(&mut self, option_value: &str) -> bool {
        match &self.wanted {
            SelectWanted::Any(values) => values.iter().any(|v| v == option_value),
            SelectWanted::One(value) => {
                let hit = !self.matched && value == option_value;
                self.matched |= hit;
                hit
            }
        }
    }
}

/// `String(value)` for one member of an array: unlike a text hole, `null` is
/// `"null"`.
fn js_string(value: &SlotValue) -> String {
    match value {
        SlotValue::Null => "null".to_string(),
        other => other.to_text(),
    }
}

/// An option of a bound select with no `value` attribute. Its value is its
/// text, known only when the option ends, so ` selected` is inserted then.
#[derive(Debug)]
struct OptionByText {
    /// Byte offset of the `>` that ends the option's start tag. The walker
    /// only ever appends to its output, so the offset stays valid.
    insert_at: usize,
    /// The option's text as the parser will read it.
    text: String,
}

/// An attribute value as the IR gives it: authored text, or a slot.
#[derive(Clone, Copy)]
enum Prop<'a> {
    Static(&'a str),
    Slot(&'a SlotValue),
}

impl Prop<'_> {
    /// The client's control text: `value == null ? '' : String(value)`.
    fn control_text(self) -> String {
        match self {
            Prop::Static(s) => s.to_string(),
            Prop::Slot(v) => v.to_text(),
        }
    }

    /// Whether the generic path writes the attribute at all (DYN_ATTR's
    /// boolean rule: `false` and `null` omit it).
    fn is_written(self) -> bool {
        !matches!(
            self,
            Prop::Slot(SlotValue::Null) | Prop::Slot(SlotValue::Bool(false))
        )
    }

    /// The value the attribute is written with: `None` when omitted, `""`
    /// when bare.
    fn written(self) -> Option<String> {
        match self {
            _ if !self.is_written() => None,
            Prop::Slot(SlotValue::Bool(true)) => Some(String::new()),
            other => Some(other.control_text()),
        }
    }

    fn to_slot(self) -> SlotValue {
        match self {
            Prop::Static(s) => SlotValue::Text(s.to_string()),
            Prop::Slot(v) => v.clone(),
        }
    }
}

/// Apply the form-control rules to one attribute of the open start tag.
/// Returns true when the attribute is consumed and must not be written.
///
/// Keys match exactly, as the client's `isFormControlProperty` does.
fn consume_control_attr(state: &mut WalkState, key: &str, prop: Prop<'_>) -> bool {
    match &mut state.pending_control {
        PendingControl::None => false,
        PendingControl::Textarea { value } => {
            if key != "value" {
                return false;
            }
            *value = Some(prop.control_text());
            true
        }
        PendingControl::Select { value, multiple } => match key {
            "value" => {
                *value = Some(prop.to_slot());
                true
            }
            "multiple" => {
                *multiple |= prop.is_written();
                false
            }
            _ => false,
        },
        PendingControl::OptionTag { value } => match key {
            // The binding decides, as on the client, where the select's
            // value is written after its options.
            "selected" => true,
            "value" => {
                // The parser keeps the first of two same-named attributes.
                if value.is_none() {
                    *value = prop.written();
                }
                false
            }
            _ => false,
        },
    }
}

/// Set up the parsing context for an element whose start tag (OPEN_TAG) is
/// about to be written.
fn enter_element(
    out: &mut String,
    tag: &str,
    state: &mut WalkState,
    limit: usize,
) -> Result<(), IrError> {
    let is = |name: &str| tag.eq_ignore_ascii_case(name);
    // A new option or optgroup ends the open option: `</option>` is optional.
    if is("option") || is("optgroup") {
        finish_option_by_text(out, state, limit)?;
    }
    state.pending_control = if is("textarea") {
        PendingControl::Textarea { value: None }
    } else if is("select") {
        PendingControl::Select {
            value: None,
            multiple: false,
        }
    } else if is("option") && state.select.is_some() {
        PendingControl::OptionTag { value: None }
    } else {
        PendingControl::None
    };
    if state.text_only.is_none() {
        state.text_only = TextOnlyTag::from_tag(tag).map(|tag| TextOnlyParent {
            tag,
            started: false,
            value_bound: false,
        });
    }
    Ok(())
}

/// Tear down the parsing context at a CLOSE_TAG, before `</tag>` is written.
fn leave_element(
    out: &mut String,
    tag: &str,
    state: &mut WalkState,
    limit: usize,
) -> Result<(), IrError> {
    let is = |name: &str| tag.eq_ignore_ascii_case(name);
    if is("option") || is("optgroup") || is("select") {
        finish_option_by_text(out, state, limit)?;
    }
    if is("select") {
        state.select = None;
    }
    if state
        .text_only
        .as_ref()
        .is_some_and(|parent| is(parent.tag.name()))
    {
        state.text_only = None;
    }
    Ok(())
}

/// Write the `>` that ends the open start tag, resolving the form-control
/// state gathered from its attributes.
///
/// Every place that used to write a bare `>` for `pending_tag_close` calls
/// this instead, so a control is resolved whichever opcode ends its tag.
fn close_start_tag(out: &mut String, state: &mut WalkState, limit: usize) -> Result<(), IrError> {
    state.pending_tag_close = false;
    match std::mem::take(&mut state.pending_control) {
        PendingControl::None => {}
        PendingControl::Textarea { value } => {
            push_checked(out, ">", limit)?;
            if let (Some(value), Some(parent)) = (value, state.text_only.as_mut()) {
                if parent.tag == TextOnlyTag::Textarea {
                    parent.value_bound = true;
                    write_text_only(out, parent, &value, limit)?;
                }
            }
            return Ok(());
        }
        PendingControl::Select { value, multiple } => {
            state.select = value.map(|value| SelectBinding::new(&value, multiple));
        }
        PendingControl::OptionTag { value: Some(value) } => {
            if state.select.as_mut().is_some_and(|s| s.selects(&value)) {
                push_checked(out, " selected", limit)?;
            }
        }
        PendingControl::OptionTag { value: None } => {
            state.option_by_text = Some(OptionByText {
                insert_at: out.len(),
                text: String::new(),
            });
        }
    }
    push_checked(out, ">", limit)
}

/// End an option whose value is its text, selecting it now if the text
/// matches. Runs at `</option>` and wherever the parser ends one implicitly.
///
/// Verified by: crates/forma-ir/src/walker.rs > "a_select_value_binding_matches_an_option_without_a_value_by_its_text"
fn finish_option_by_text(
    out: &mut String,
    state: &mut WalkState,
    limit: usize,
) -> Result<(), IrError> {
    let Some(option) = state.option_by_text.take() else {
        return Ok(());
    };
    let value = strip_and_collapse_ascii_whitespace(&option.text);
    if state.select.as_mut().is_some_and(|s| s.selects(&value)) {
        const SELECTED: &str = " selected";
        if out.len().saturating_add(SELECTED.len()) > limit {
            return Err(IrError::OutputLimitExceeded { limit });
        }
        out.insert_str(option.insert_at, SELECTED);
    }
    Ok(())
}

/// HTML's "strip and collapse ASCII whitespace", which turns an option's text
/// into its value.
fn strip_and_collapse_ascii_whitespace(text: &str) -> String {
    let mut out = String::with_capacity(text.len());
    for word in text.split_ascii_whitespace() {
        if !out.is_empty() {
            out.push(' ');
        }
        out.push_str(word);
    }
    out
}

// ---------------------------------------------------------------------------
// Byte-reading helpers
// ---------------------------------------------------------------------------

/// Read a little-endian u16 from `data` at `pos`.
pub(crate) fn read_u16(data: &[u8], pos: usize) -> Result<u16, IrError> {
    if pos + 2 > data.len() {
        return Err(IrError::BufferTooShort {
            expected: pos + 2,
            actual: data.len(),
        });
    }
    Ok(u16::from_le_bytes([data[pos], data[pos + 1]]))
}

/// Read a little-endian u32 from `data` at `pos`.
pub(crate) fn read_u32(data: &[u8], pos: usize) -> Result<u32, IrError> {
    if pos + 4 > data.len() {
        return Err(IrError::BufferTooShort {
            expected: pos + 4,
            actual: data.len(),
        });
    }
    Ok(u32::from_le_bytes([
        data[pos],
        data[pos + 1],
        data[pos + 2],
        data[pos + 3],
    ]))
}

/// Read an OPEN_TAG or VOID_TAG operand block:
/// `str_idx(u32) + attr_count(u16) + [(key_str_idx(u32), val_str_idx(u32))] x attr_count`
///
/// Returns `(tag_str_idx, vec of (key, val) string refs, new position)`.
pub(crate) fn read_tag_with_attrs<'a>(
    ops: &[u8],
    pos: usize,
    strings: &'a crate::parser::StringTable,
) -> Result<(u32, Vec<(&'a str, &'a str)>, usize), IrError> {
    let tag_str_idx = read_u32(ops, pos)?;
    let attr_count = read_u16(ops, pos + 4)? as usize;
    let mut cursor = pos + 6; // past str_idx(4) + attr_count(2)

    // `attr_count` is u16-bounded but each pair costs 8 bytes on disk and a
    // fat-pointer pair in memory — bound the reservation by what is actually
    // left. A valid stream still gets one exact allocation.
    let mut attrs = Vec::with_capacity(attr_count.min(ops.len().saturating_sub(cursor) / 8));
    for _ in 0..attr_count {
        let key_idx = read_u32(ops, cursor)?;
        let val_idx = read_u32(ops, cursor + 4)?;
        let key = strings.get(key_idx)?;
        let val = strings.get(val_idx)?;
        attrs.push((key, val));
        cursor += 8;
    }

    Ok((tag_str_idx, attrs, cursor))
}

// ---------------------------------------------------------------------------
// Budgeted output helpers
// ---------------------------------------------------------------------------

/// Longest escape sequence any of the escapers can emit for one character
/// (`&amp;`, `&quot;`, `<`).
const MAX_ESCAPE_EXPANSION: usize = 6;

/// Append `s`, refusing to exceed the walk's output budget.
///
/// Every append routes through here (or one of the escaping variants below)
/// because a *single* opcode can emit gigabytes: OPEN_TAG accepts up to 65,535
/// attributes, each with a 65,535-character value that escapes 5x, so a check
/// only at the top of the opcode loop never runs in time.
fn push_checked(out: &mut String, s: &str, limit: usize) -> Result<(), IrError> {
    if out.len().saturating_add(s.len()) > limit {
        return Err(IrError::OutputLimitExceeded { limit });
    }
    out.push_str(s);
    Ok(())
}

/// Append a `u16` in decimal, within the output budget, without allocating.
///
/// Marker ids are the hottest thing the walker writes — every DYN_TEXT emits
/// its id twice, every SHOW_IF and LIST likewise, and a list body repeats all
/// of that once per row. `to_string()` heap-allocated for each one.
fn push_u16(out: &mut String, value: u16, limit: usize) -> Result<(), IrError> {
    // u16::MAX is 65535: five digits, never more.
    let mut buf = [0u8; 5];
    let mut remaining = value;
    let mut start = buf.len();
    loop {
        start -= 1;
        buf[start] = b'0' + (remaining % 10) as u8;
        remaining /= 10;
        if remaining == 0 {
            break;
        }
    }
    // ASCII digits are always UTF-8; the error arm is unreachable and costs
    // nothing, where `expect` would put a panic on the hottest write.
    match core::str::from_utf8(&buf[start..]) {
        Ok(digits) => push_checked(out, digits, limit),
        Err(e) => Err(IrError::InvalidUtf8(e.to_string())),
    }
}

/// Escape text for HTML content (`& < >`), within the output budget.
fn push_escaped_html(out: &mut String, text: &str, limit: usize) -> Result<(), IrError> {
    // Fast path: even worst-case expansion fits, so no per-character checks.
    if out
        .len()
        .saturating_add(text.len().saturating_mul(MAX_ESCAPE_EXPANSION))
        <= limit
    {
        for ch in text.chars() {
            match ch {
                '&' => out.push_str("&amp;"),
                '<' => out.push_str("&lt;"),
                '>' => out.push_str("&gt;"),
                _ => out.push(ch),
            }
        }
        return Ok(());
    }
    for ch in text.chars() {
        match ch {
            '&' => push_checked(out, "&amp;", limit)?,
            '<' => push_checked(out, "&lt;", limit)?,
            '>' => push_checked(out, "&gt;", limit)?,
            _ => {
                if out.len() >= limit {
                    return Err(IrError::OutputLimitExceeded { limit });
                }
                out.push(ch);
            }
        }
    }
    Ok(())
}

/// Escape text for HTML attribute values (`& " < >`), within the output budget.
fn push_escaped_attr(out: &mut String, text: &str, limit: usize) -> Result<(), IrError> {
    if out
        .len()
        .saturating_add(text.len().saturating_mul(MAX_ESCAPE_EXPANSION))
        <= limit
    {
        for ch in text.chars() {
            match ch {
                '&' => out.push_str("&amp;"),
                '"' => out.push_str("&quot;"),
                '<' => out.push_str("&lt;"),
                '>' => out.push_str("&gt;"),
                _ => out.push(ch),
            }
        }
        return Ok(());
    }
    for ch in text.chars() {
        match ch {
            '&' => push_checked(out, "&amp;", limit)?,
            '"' => push_checked(out, "&quot;", limit)?,
            '<' => push_checked(out, "&lt;", limit)?,
            '>' => push_checked(out, "&gt;", limit)?,
            _ => {
                if out.len() >= limit {
                    return Err(IrError::OutputLimitExceeded { limit });
                }
                out.push(ch);
            }
        }
    }
    Ok(())
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;
    use crate::parser::test_helpers::{
        build_minimal_ir, encode_close_tag, encode_list, encode_open_tag, encode_show_if,
        encode_text, encode_void_tag,
    };
    use crate::slot::{SlotData, SlotValue};

    // -- Opcode encoding helpers local to walker tests ----------------------

    /// Encode a DYN_TEXT opcode: opcode(1) + slot_id(2) + marker_id(2)
    fn encode_dyn_text(slot_id: u16, marker_id: u16) -> Vec<u8> {
        let mut buf = Vec::new();
        buf.push(0x05); // Opcode::DynText
        buf.extend_from_slice(&slot_id.to_le_bytes());
        buf.extend_from_slice(&marker_id.to_le_bytes());
        buf
    }

    /// Encode an ISLAND_START opcode: opcode(1) + island_id(2)
    fn encode_island_start(island_id: u16) -> Vec<u8> {
        let mut buf = vec![0x0B];
        buf.extend_from_slice(&island_id.to_le_bytes());
        buf
    }

    /// Encode an ISLAND_END opcode: opcode(1) + island_id(2)
    fn encode_island_end(island_id: u16) -> Vec<u8> {
        let mut buf = vec![0x0C];
        buf.extend_from_slice(&island_id.to_le_bytes());
        buf
    }

    /// Helper: build an IrModule, walk it with empty slots, return the HTML.
    fn walk_static(strings: &[&str], opcodes: &[u8]) -> String {
        let data = build_minimal_ir(strings, &[], opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        let slots = SlotData::new(0);
        walk_to_html(&module, &slots).unwrap()
    }

    /// Helper: build an IrModule with slot declarations, walk with given SlotData.
    fn walk_with_slots(
        strings: &[&str],
        slot_decls: &[(u16, u32, u8, u8, &[u8])],
        opcodes: &[u8],
        slots: &SlotData,
    ) -> String {
        let data = build_minimal_ir(strings, slot_decls, opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        walk_to_html(&module, slots).unwrap()
    }

    /// Helper: build an IrModule with slots AND islands, walk with given SlotData.
    fn walk_with_islands(
        strings: &[&str],
        slot_decls: &[(u16, u32, u8, u8, &[u8])],
        island_decls: &[(u16, u8, u8, u32, u32, &[u16])],
        opcodes: &[u8],
        slots: &SlotData,
    ) -> String {
        let data = build_minimal_ir(strings, slot_decls, opcodes, island_decls);
        let module = IrModule::parse(&data).unwrap();
        walk_to_html(&module, slots).unwrap()
    }

    /// Encode a DYN_ATTR opcode: opcode(1) + attr_str_idx(4) + slot_id(2)
    fn encode_dyn_attr(attr_str_idx: u32, slot_id: u16) -> Vec<u8> {
        let mut bytes = vec![0x06]; // Opcode::DynAttr
        bytes.extend_from_slice(&attr_str_idx.to_le_bytes());
        bytes.extend_from_slice(&slot_id.to_le_bytes());
        bytes
    }

    // -- Test 1: walk_static_div -------------------------------------------

    #[test]
    fn walk_static_div() {
        // <div class="container">Hello</div>
        // strings: 0="div", 1="class", 2="container", 3="Hello"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[(1, 2)]));
        opcodes.extend_from_slice(&encode_text(3));
        opcodes.extend_from_slice(&encode_close_tag(0));

        let html = walk_static(&["div", "class", "container", "Hello"], &opcodes);
        assert_eq!(html, r#"<div class="container">Hello</div>"#);
    }

    // -- Test 2: walk_void_tag ---------------------------------------------

    #[test]
    fn walk_void_tag() {
        // <input type="email">
        // strings: 0="input", 1="type", 2="email"
        let opcodes = encode_void_tag(0, &[(1, 2)]);

        let html = walk_static(&["input", "type", "email"], &opcodes);
        assert_eq!(html, r#"<input type="email">"#);
    }

    // -- Test 3: walk_nested_elements --------------------------------------

    #[test]
    fn walk_nested_elements() {
        // <div><span>Hi</span></div>
        // strings: 0="div", 1="span", 2="Hi"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_open_tag(1, &[]));
        opcodes.extend_from_slice(&encode_text(2));
        opcodes.extend_from_slice(&encode_close_tag(1));
        opcodes.extend_from_slice(&encode_close_tag(0));

        let html = walk_static(&["div", "span", "Hi"], &opcodes);
        assert_eq!(html, "<div><span>Hi</span></div>");
    }

    // -- Test 4: walk_text_escaping ----------------------------------------

    #[test]
    fn walk_text_escaping() {
        // TEXT with "<script>alert('xss')</script>"
        let opcodes = encode_text(0);

        let html = walk_static(&["<script>alert('xss')</script>"], &opcodes);
        assert_eq!(html, "&lt;script&gt;alert('xss')&lt;/script&gt;");
    }

    // -- Test 5: walk_attr_escaping ----------------------------------------

    #[test]
    fn walk_attr_escaping() {
        // OPEN_TAG with attr value containing a double quote
        // strings: 0="div", 1="title", 2=r#"a"b"#
        let opcodes = encode_open_tag(0, &[(1, 2)]);

        let html = walk_static(&["div", "title", "a\"b"], &opcodes);
        assert_eq!(html, r#"<div title="a&quot;b">"#);
    }

    // -- Test 6: walk_empty_element ----------------------------------------

    #[test]
    fn walk_empty_element() {
        // <div></div> (no children)
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));

        let html = walk_static(&["div"], &opcodes);
        assert_eq!(html, "<div></div>");
    }

    // -- Test 7: walk_dyn_text ---------------------------------------------

    #[test]
    fn walk_dyn_text() {
        // DYN_TEXT with slot data produces marker comments + value
        // strings: 0="greeting" (slot name)
        // slot decl: slot_id=0, name_str_idx=0, type=Text(0x01)
        let opcodes = encode_dyn_text(0, 0);

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("World".to_string()));

        let html = walk_with_slots(&["greeting"], &[(0, 0, 0x01, 0x00, &[])], &opcodes, &slots);
        assert_eq!(html, "<!--f:t0-->World<!--/f:t0-->");
    }

    #[test]
    fn walk_dyn_text_null_emits_zwsp() {
        // DYN_TEXT with null slot value must emit a zero-width space between
        // markers so the browser creates a Text node for hydration to bind to.
        let opcodes = encode_dyn_text(0, 0);
        let slots = SlotData::new(1); // slot 0 defaults to Null

        let html = walk_with_slots(&["msg"], &[(0, 0, 0x01, 0x00, &[])], &opcodes, &slots);
        assert_eq!(html, "<!--f:t0-->\u{200B}<!--/f:t0-->");
    }

    #[test]
    fn walk_dyn_text_empty_string_emits_zwsp() {
        // DYN_TEXT with explicit empty string also needs the ZWSP placeholder.
        let opcodes = encode_dyn_text(0, 0);
        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text(String::new()));

        let html = walk_with_slots(&["msg"], &[(0, 0, 0x01, 0x00, &[])], &opcodes, &slots);
        assert_eq!(html, "<!--f:t0-->\u{200B}<!--/f:t0-->");
    }

    // -- Test 8: walk_dyn_text_escaping ------------------------------------

    #[test]
    fn walk_dyn_text_escaping() {
        // DYN_TEXT value with HTML chars is escaped
        let opcodes = encode_dyn_text(0, 1);

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("<b>bold</b>".to_string()));

        let html = walk_with_slots(&["content"], &[(0, 0, 0x01, 0x00, &[])], &opcodes, &slots);
        assert_eq!(html, "<!--f:t1-->&lt;b&gt;bold&lt;/b&gt;<!--/f:t1-->");
    }

    // -- Test 9: walk_island_markers ---------------------------------------

    #[test]
    fn walk_island_markers() {
        // ISLAND_START(0) + TEXT content + ISLAND_END(0). The island body
        // opens no element, so the island contributes markers only — its
        // attributes are dropped at ISLAND_END with a warning.
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_text(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let slots = SlotData::new(0);
        let html = walk_with_islands(
            &["Hello"],
            &[],
            &[(0, 0x01, 0x01, 0, 0, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(html, "<!--f:i0-->Hello<!--/f:i0-->");
    }

    // -- Test 10: walk_comment ---------------------------------------------

    // -- Test 11: walk_boolean_attr ----------------------------------------

    #[test]
    fn walk_boolean_attr() {
        // <input disabled> — attribute with empty string value renders as valueless
        // strings: 0="input", 1="disabled", 2="" (empty string for boolean attr)
        let opcodes = encode_void_tag(0, &[(1, 2)]);

        let html = walk_static(&["input", "disabled", ""], &opcodes);
        assert_eq!(html, "<input disabled>");
    }

    // -- DYN_ATTR value semantics (W2 / F15) --------------------------------

    /// Helper: `<input DYN_ATTR(disabled, slot 0)>` with slot 0 set to `value`.
    fn walk_dyn_attr_with(value: SlotValue) -> String {
        let mut opcodes = encode_void_tag(0, &[]);
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        let mut slots = SlotData::new(1);
        slots.set(0, value);
        walk_with_slots(
            &["input", "disabled"],
            &[(0, 1, 0x02, 0x00, &[])],
            &opcodes,
            &slots,
        )
    }

    #[test]
    fn dyn_attr_bool_matches_the_client_renderer() {
        // An HTML boolean attribute is ON whenever it is PRESENT, whatever its
        // value — `disabled="false"` disables the control. The walker used to
        // emit exactly that, so SSR shipped a disabled/hidden/checked control
        // that only un-broke itself after hydration, and never at all for a
        // visible/idle/interaction island the user had not reached, or with JS
        // off. These are byte-for-byte what `renderAttr` in @getforma/core
        // produces for the same values.
        assert_eq!(
            walk_dyn_attr_with(SlotValue::Bool(true)),
            "<input disabled>",
            "true must render the bare attribute"
        );
        assert_eq!(
            walk_dyn_attr_with(SlotValue::Bool(false)),
            "<input>",
            "false must omit the attribute, not write disabled=\"false\""
        );
        assert_eq!(
            walk_dyn_attr_with(SlotValue::Null),
            "<input>",
            "null must omit the attribute"
        );
    }

    #[test]
    fn dyn_attr_empty_string_is_a_value_not_an_absence() {
        // `renderAttr(key, "")` emits `key=""`, and the client hydrating the
        // same slot calls setAttribute(key, "") — dropping the attribute here
        // is a real DOM difference on the common `value=""` / `alt=""` case.
        assert_eq!(
            walk_dyn_attr_with(SlotValue::Text(String::new())),
            "<input disabled=\"\">"
        );
        assert_eq!(
            walk_dyn_attr_with(SlotValue::Text("yes".into())),
            "<input disabled=\"yes\">"
        );
        // Numbers stringify, they do not vanish: 0 is a value.
        assert_eq!(
            walk_dyn_attr_with(SlotValue::Number(0.0)),
            "<input disabled=\"0\">"
        );
    }

    // -- Test 12: walk_multiple_attrs --------------------------------------

    #[test]
    fn walk_multiple_attrs() {
        // <div id="main" class="container" data-x="42"></div>
        // strings: 0="div", 1="id", 2="main", 3="class", 4="container", 5="data-x", 6="42"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[(1, 2), (3, 4), (5, 6)]));
        opcodes.extend_from_slice(&encode_close_tag(0));

        let html = walk_static(
            &["div", "id", "main", "class", "container", "data-x", "42"],
            &opcodes,
        );
        assert_eq!(
            html,
            r#"<div id="main" class="container" data-x="42"></div>"#
        );
    }

    // -- Test 13: walk_show_if_true_branch ---------------------------------

    #[test]
    fn walk_show_if_true_branch() {
        // SHOW_IF(slot=0): then=TEXT("Yes"), else=TEXT("No")
        // slot 0 = Bool(true) → render "Yes"
        // strings: 0="visible", 1="Yes", 2="No"
        let then_ops = encode_text(1); // TEXT "Yes"
        let else_ops = encode_text(2); // TEXT "No"
        let opcodes = encode_show_if(0, &then_ops, &else_ops);

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Bool(true));

        let html = walk_with_slots(
            &["visible", "Yes", "No"],
            &[(0, 0, 0x02, 0x00, &[])], // slot 0, name="visible", type=Bool
            &opcodes,
            &slots,
        );
        assert!(html.contains("Yes"), "should contain then-branch text");
        assert!(!html.contains("No"), "should NOT contain else-branch text");
        assert!(html.contains("<!--f:s0-->"), "should have opening marker");
        assert!(html.contains("<!--/f:s0-->"), "should have closing marker");
    }

    // -- Test 14: walk_show_if_false_branch --------------------------------

    #[test]
    fn walk_show_if_false_branch() {
        // SHOW_IF(slot=0): then=TEXT("Yes"), else=TEXT("No")
        // slot 0 = Bool(false) → render "No"
        let then_ops = encode_text(1);
        let else_ops = encode_text(2);
        let opcodes = encode_show_if(0, &then_ops, &else_ops);

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Bool(false));

        let html = walk_with_slots(
            &["visible", "Yes", "No"],
            &[(0, 0, 0x02, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert!(html.contains("No"), "should contain else-branch text");
        assert!(!html.contains("Yes"), "should NOT contain then-branch text");
        assert!(html.contains("<!--f:s0-->"), "should have opening marker");
        assert!(html.contains("<!--/f:s0-->"), "should have closing marker");
    }

    // -- Test 15: walk_show_if_truthy_text ---------------------------------

    #[test]
    fn walk_show_if_truthy_text() {
        // slot 0 = Text("hello") → truthy → render then branch
        let then_ops = encode_text(1);
        let else_ops = encode_text(2);
        let opcodes = encode_show_if(0, &then_ops, &else_ops);

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("hello".to_string()));

        let html = walk_with_slots(
            &["greeting", "Shown", "Hidden"],
            &[(0, 0, 0x01, 0x00, &[])], // type=Text
            &opcodes,
            &slots,
        );
        assert!(
            html.contains("Shown"),
            "truthy text should render then branch"
        );
        assert!(
            !html.contains("Hidden"),
            "truthy text should NOT render else branch"
        );
    }

    // -- Test 16: walk_show_if_falsy_null ----------------------------------

    #[test]
    fn walk_show_if_falsy_null() {
        // slot 0 = Null (default) → falsy → render else branch
        let then_ops = encode_text(1);
        let else_ops = encode_text(2);
        let opcodes = encode_show_if(0, &then_ops, &else_ops);

        let slots = SlotData::new(1); // slot 0 is Null by default

        let html = walk_with_slots(
            &["maybe", "Present", "Missing"],
            &[(0, 0, 0x01, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert!(html.contains("Missing"), "null should render else branch");
        assert!(
            !html.contains("Present"),
            "null should NOT render then branch"
        );
    }

    // -- Test 17: walk_show_if_no_else ------------------------------------

    #[test]
    fn walk_show_if_no_else() {
        // SHOW_IF with empty else branch. When false, nothing rendered between markers.
        let then_ops = encode_text(1);
        let else_ops: Vec<u8> = vec![]; // empty else
        let opcodes = encode_show_if(0, &then_ops, &else_ops);

        let slots = SlotData::new(1); // Null → false

        let html = walk_with_slots(
            &["flag", "Content"],
            &[(0, 0, 0x02, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(
            html, "<!--f:s0--><!--/f:s0-->",
            "empty else should produce only markers"
        );
    }

    // -- Test 18: walk_show_if_nested -------------------------------------

    #[test]
    fn walk_show_if_nested() {
        // Outer SHOW_IF(slot=0, true) → then branch contains inner SHOW_IF(slot=1, false)
        // Inner then=TEXT("inner-yes"), inner else=TEXT("inner-no")
        // strings: 0="outer", 1="inner", 2="outer-yes", 3="outer-no", 4="inner-yes", 5="inner-no"
        let inner_then = encode_text(4);
        let inner_else = encode_text(5);
        let inner_show_if = encode_show_if(1, &inner_then, &inner_else);

        let outer_then = inner_show_if; // outer then = inner SHOW_IF
        let outer_else = encode_text(3);
        let opcodes = encode_show_if(0, &outer_then, &outer_else);

        let mut slots = SlotData::new(2);
        slots.set(0, SlotValue::Bool(true)); // outer true
        slots.set(1, SlotValue::Bool(false)); // inner false

        let html = walk_with_slots(
            &[
                "outer",
                "inner",
                "outer-yes",
                "outer-no",
                "inner-yes",
                "inner-no",
            ],
            &[(0, 0, 0x02, 0x00, &[]), (1, 1, 0x02, 0x00, &[])],
            &opcodes,
            &slots,
        );
        // Outer is true → walk inner. Inner is false → render "inner-no"
        assert!(
            html.contains("inner-no"),
            "nested: inner false should render inner else"
        );
        assert!(
            !html.contains("inner-yes"),
            "nested: inner true branch should not render"
        );
        assert!(
            !html.contains("outer-no"),
            "nested: outer else should not render"
        );
        // Verify correct nesting of markers
        assert!(
            html.contains("<!--f:s0-->"),
            "should have outer opening marker"
        );
        assert!(
            html.contains("<!--/f:s0-->"),
            "should have outer closing marker"
        );
        assert!(
            html.contains("<!--f:s1-->"),
            "should have inner opening marker"
        );
        assert!(
            html.contains("<!--/f:s1-->"),
            "should have inner closing marker"
        );
    }

    // -- Test 19: walk_show_if_with_elements ------------------------------

    #[test]
    fn walk_show_if_with_elements() {
        // Then branch contains OPEN_TAG("span") + TEXT("Hello") + CLOSE_TAG("span")
        // strings: 0="flag", 1="span", 2="Hello", 3="Bye"
        let mut then_ops = Vec::new();
        then_ops.extend_from_slice(&encode_open_tag(1, &[]));
        then_ops.extend_from_slice(&encode_text(2));
        then_ops.extend_from_slice(&encode_close_tag(1));

        let else_ops = encode_text(3);
        let opcodes = encode_show_if(0, &then_ops, &else_ops);

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Bool(true));

        let html = walk_with_slots(
            &["flag", "span", "Hello", "Bye"],
            &[(0, 0, 0x02, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(
            html, "<!--f:s0--><span>Hello</span><!--/f:s0-->",
            "then branch should produce full HTML element"
        );
    }

    // -- Test 20: walk_list_renders_items -----------------------------------

    #[test]
    fn walk_list_renders_items() {
        // LIST(slot=0, item_slot=1): body = DYN_TEXT(slot=1, marker=0)
        // slot 0 = Array([Text("Alice"), Text("Bob")])
        // strings: 0="items", 1="item"
        let body = encode_dyn_text(1, 0);
        let opcodes = encode_list(0, 1, &body);

        let mut slots = SlotData::new(2);
        slots.set(
            0,
            SlotValue::array(vec![
                SlotValue::Text("Alice".to_string()),
                SlotValue::Text("Bob".to_string()),
            ]),
        );

        let html = walk_with_slots(
            &["items", "item"],
            &[(0, 0, 0x04, 0x00, &[]), (1, 1, 0x01, 0x00, &[])], // slot 0=Array, slot 1=Text
            &opcodes,
            &slots,
        );
        assert!(html.contains("Alice"), "should contain first item");
        assert!(html.contains("Bob"), "should contain second item");
        assert!(
            html.starts_with("<!--f:l0-->"),
            "should start with list open marker"
        );
        assert!(
            html.ends_with("<!--/f:l0-->"),
            "should end with list close marker"
        );
    }

    // -- Test 21: walk_list_empty_array ------------------------------------

    #[test]
    fn walk_list_empty_array() {
        // LIST(slot=0, item_slot=1): body = DYN_TEXT(slot=1, marker=0)
        // slot 0 = Array([])
        let body = encode_dyn_text(1, 0);
        let opcodes = encode_list(0, 1, &body);

        let mut slots = SlotData::new(2);
        slots.set(0, SlotValue::array(vec![]));

        let html = walk_with_slots(
            &["items", "item"],
            &[(0, 0, 0x04, 0x00, &[]), (1, 1, 0x01, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(
            html, "<!--f:l0--><!--/f:l0-->",
            "empty array should produce only markers"
        );
    }

    // -- Test 22: walk_list_with_elements ----------------------------------

    #[test]
    fn walk_list_with_elements() {
        // LIST(slot=0, item_slot=1): body = <li>DYN_TEXT(slot=1)</li>
        // slot 0 = Array([Text("A"), Text("B")])
        // strings: 0="items", 1="item", 2="li"
        let mut body = Vec::new();
        body.extend_from_slice(&encode_open_tag(2, &[]));
        body.extend_from_slice(&encode_dyn_text(1, 0));
        body.extend_from_slice(&encode_close_tag(2));

        let opcodes = encode_list(0, 1, &body);

        let mut slots = SlotData::new(2);
        slots.set(
            0,
            SlotValue::array(vec![
                SlotValue::Text("A".to_string()),
                SlotValue::Text("B".to_string()),
            ]),
        );

        let html = walk_with_slots(
            &["items", "item", "li"],
            &[(0, 0, 0x04, 0x00, &[]), (1, 1, 0x01, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert!(
            html.contains("<li><!--f:t0-->A<!--/f:t0--></li><li><!--f:t0-->B<!--/f:t0--></li>"),
            "should render li elements with content, got: {html}"
        );
    }

    // -- Test 23: walk_list_null_slot --------------------------------------

    #[test]
    fn walk_list_null_slot() {
        // LIST(slot=0, item_slot=1): body = DYN_TEXT(slot=1, marker=0)
        // slot 0 = Null (not Array) → no iteration, empty markers
        let body = encode_dyn_text(1, 0);
        let opcodes = encode_list(0, 1, &body);

        let slots = SlotData::new(2); // slot 0 remains Null

        let html = walk_with_slots(
            &["items", "item"],
            &[(0, 0, 0x04, 0x00, &[]), (1, 1, 0x01, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(
            html, "<!--f:l0--><!--/f:l0-->",
            "null slot should produce only markers"
        );
    }

    // -- Test 24: walk_list_nested -----------------------------------------

    #[test]
    fn walk_list_nested() {
        // Outer LIST(slot=0, item_slot=1): each item is an Array
        // Inner LIST(slot=1, item_slot=2): each sub-item is Text
        // Body of inner: DYN_TEXT(slot=2, marker=0)
        // strings: 0="outer", 1="inner", 2="item"
        let inner_body = encode_dyn_text(2, 0);
        let inner_list = encode_list(1, 2, &inner_body);
        let opcodes = encode_list(0, 1, &inner_list);

        let mut slots = SlotData::new(3);
        slots.set(
            0,
            SlotValue::array(vec![
                SlotValue::array(vec![
                    SlotValue::Text("a".to_string()),
                    SlotValue::Text("b".to_string()),
                ]),
                SlotValue::array(vec![SlotValue::Text("c".to_string())]),
            ]),
        );

        let html = walk_with_slots(
            &["outer", "inner", "item"],
            &[
                (0, 0, 0x04, 0x00, &[]),
                (1, 1, 0x04, 0x00, &[]),
                (2, 2, 0x01, 0x00, &[]),
            ],
            &opcodes,
            &slots,
        );
        // Verify all items rendered
        assert!(html.contains("a"), "should contain nested item 'a'");
        assert!(html.contains("b"), "should contain nested item 'b'");
        assert!(html.contains("c"), "should contain nested item 'c'");
        // Verify outer list markers
        assert!(
            html.starts_with("<!--f:l0-->"),
            "should have outer list open marker"
        );
        assert!(
            html.ends_with("<!--/f:l0-->"),
            "should have outer list close marker"
        );
        // Verify inner list markers present
        assert!(
            html.contains("<!--f:l1-->"),
            "should have inner list open marker"
        );
        assert!(
            html.contains("<!--/f:l1-->"),
            "should have inner list close marker"
        );
    }

    // -- Test 25: walk_list_depth_exceeded ---------------------------------

    #[test]
    fn walk_list_depth_exceeded() {
        // Nest 5 lists deep (exceeds MAX_LIST_DEPTH of 4)
        // Innermost body is a DYN_TEXT
        // strings: 0..=5 = "s0".."s5"
        let innermost_body = encode_dyn_text(5, 0);
        // Build from inside out: level 5 (innermost) → level 1 (outermost)
        let level5 = encode_list(4, 5, &innermost_body);
        let level4 = encode_list(3, 4, &level5);
        let level3 = encode_list(2, 3, &level4);
        let level2 = encode_list(1, 2, &level3);
        let level1 = encode_list(0, 1, &level2);

        let mut slots = SlotData::new(6);
        // Each level needs an array with at least one item to trigger iteration
        slots.set(
            0,
            SlotValue::array(vec![SlotValue::array(vec![SlotValue::array(vec![
                SlotValue::array(vec![SlotValue::array(vec![SlotValue::Text(
                    "deep".to_string(),
                )])]),
            ])])]),
        );
        // Inner slots get shadowed during iteration

        let data = build_minimal_ir(
            &["s0", "s1", "s2", "s3", "s4", "s5"],
            &[
                (0, 0, 0x04, 0x00, &[]),
                (1, 1, 0x04, 0x00, &[]),
                (2, 2, 0x04, 0x00, &[]),
                (3, 3, 0x04, 0x00, &[]),
                (4, 4, 0x04, 0x00, &[]),
                (5, 5, 0x01, 0x00, &[]),
            ],
            &level1,
            &[],
        );
        let module = IrModule::parse(&data).unwrap();
        let result = walk_to_html(&module, &slots);
        assert!(result.is_err(), "should fail with depth exceeded");
        match result.unwrap_err() {
            IrError::ListDepthExceeded { max: 4 } => {}
            other => panic!("expected ListDepthExceeded {{ max: 4 }}, got {other:?}"),
        }
    }

    // -- Test 26: walk_switch_matching_case --------------------------------

    // -- Test 27: walk_switch_no_match ------------------------------------

    // -- Test 28: walk_switch_first_case ----------------------------------

    // -- Test 29: walk_switch_with_elements -------------------------------

    // -- Test 30: walk_try_renders_main -----------------------------------

    // -- Test 31: walk_preload_font ---------------------------------------

    // -- Test 32: walk_preload_style --------------------------------------

    // =========================================================================
    // Hydration-roundtrip tests — verify walker produces exact expected HTML
    // from programmatically-built IR. These tests complement the TS-side
    // roundtrip tests (ir-roundtrip.test.ts) to ensure the binary contract
    // between the TS emitter and the Rust walker is correct.
    // =========================================================================

    // -- Roundtrip 1: Full page skeleton ------------------------------------

    #[test]
    fn roundtrip_page_structure() {
        // Build IR for a realistic page skeleton:
        // <html lang="en"><head><meta charset="utf-8"><title>Test</title></head>
        // <body><div id="app"></div></body></html>
        //
        // strings: 0="html", 1="lang", 2="en", 3="head", 4="meta",
        //          5="charset", 6="utf-8", 7="title", 8="Test",
        //          9="body", 10="div", 11="id", 12="app"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[(1, 2)])); // <html lang="en">
        opcodes.extend_from_slice(&encode_open_tag(3, &[])); // <head>
        opcodes.extend_from_slice(&encode_void_tag(4, &[(5, 6)])); // <meta charset="utf-8">
        opcodes.extend_from_slice(&encode_open_tag(7, &[])); // <title>
        opcodes.extend_from_slice(&encode_text(8)); // Test
        opcodes.extend_from_slice(&encode_close_tag(7)); // </title>
        opcodes.extend_from_slice(&encode_close_tag(3)); // </head>
        opcodes.extend_from_slice(&encode_open_tag(9, &[])); // <body>
        opcodes.extend_from_slice(&encode_open_tag(10, &[(11, 12)])); // <div id="app">
        opcodes.extend_from_slice(&encode_close_tag(10)); // </div>
        opcodes.extend_from_slice(&encode_close_tag(9)); // </body>
        opcodes.extend_from_slice(&encode_close_tag(0)); // </html>

        let ir = build_minimal_ir(
            &[
                "html", "lang", "en", "head", "meta", "charset", "utf-8", "title", "Test", "body",
                "div", "id", "app",
            ],
            &[],
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&ir).unwrap();
        let slots = SlotData::new(0);
        let html = walk_to_html(&module, &slots).unwrap();
        assert_eq!(
            html,
            r#"<html lang="en"><head><meta charset="utf-8"><title>Test</title></head><body><div id="app"></div></body></html>"#
        );
    }

    // -- Roundtrip 2: Dynamic greeting with DYN_TEXT ------------------------

    #[test]
    fn roundtrip_dynamic_greeting() {
        // Build IR for: <div class="greeting"><!--f:t0-->Hello, World<!--/f:t0--></div>
        // with slot 0 = Text("Hello, World")
        //
        // strings: 0="div", 1="class", 2="greeting", 3="content"
        // slot decl: slot_id=0, name_str_idx=3 ("content"), type=Text
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[(1, 2)])); // <div class="greeting">
        opcodes.extend_from_slice(&encode_dyn_text(0, 0)); // DYN_TEXT slot=0 marker=0
        opcodes.extend_from_slice(&encode_close_tag(0)); // </div>

        let ir = build_minimal_ir(
            &["div", "class", "greeting", "content"],
            &[(0, 3, 0x01, 0x00, &[])], // slot 0, name="content", type=Text
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&ir).unwrap();
        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("Hello, World".into()));
        let html = walk_to_html(&module, &slots).unwrap();
        assert_eq!(
            html,
            r#"<div class="greeting"><!--f:t0-->Hello, World<!--/f:t0--></div>"#
        );
    }

    // -- Roundtrip 3: Conditional content (SHOW_IF both branches) -----------

    #[test]
    fn roundtrip_conditional_content() {
        // SHOW_IF slot=0
        //   then: <span class="badge">Logged In</span>
        //   else: <span class="badge">Guest</span>
        //
        // strings: 0="auth", 1="span", 2="class", 3="badge",
        //          4="Logged In", 5="Guest"
        let mut then_ops = Vec::new();
        then_ops.extend_from_slice(&encode_open_tag(1, &[(2, 3)]));
        then_ops.extend_from_slice(&encode_text(4));
        then_ops.extend_from_slice(&encode_close_tag(1));

        let mut else_ops = Vec::new();
        else_ops.extend_from_slice(&encode_open_tag(1, &[(2, 3)]));
        else_ops.extend_from_slice(&encode_text(5));
        else_ops.extend_from_slice(&encode_close_tag(1));

        let opcodes = encode_show_if(0, &then_ops, &else_ops);

        let ir = build_minimal_ir(
            &["auth", "span", "class", "badge", "Logged In", "Guest"],
            &[(0, 0, 0x02, 0x00, &[])], // slot 0, name="auth", type=Bool
            &opcodes,
            &[],
        );

        // Test true branch
        {
            let module = IrModule::parse(&ir).unwrap();
            let mut slots = SlotData::new(1);
            slots.set(0, SlotValue::Bool(true));
            let html = walk_to_html(&module, &slots).unwrap();
            assert_eq!(
                html,
                r#"<!--f:s0--><span class="badge">Logged In</span><!--/f:s0-->"#
            );
        }

        // Test false branch
        {
            let module = IrModule::parse(&ir).unwrap();
            let mut slots = SlotData::new(1);
            slots.set(0, SlotValue::Bool(false));
            let html = walk_to_html(&module, &slots).unwrap();
            assert_eq!(
                html,
                r#"<!--f:s0--><span class="badge">Guest</span><!--/f:s0-->"#
            );
        }
    }

    // -- Roundtrip 4: List rendering ----------------------------------------

    #[test]
    fn roundtrip_list_rendering() {
        // LIST slot=0 item=1 → <li><!--f:t0-->{item}<!--/f:t0--></li>
        // Items: ["Alice", "Bob", "Charlie"]
        //
        // strings: 0="items", 1="item", 2="li"
        // slot decls: slot 0=Array, slot 1=Text (item)
        let mut body = Vec::new();
        body.extend_from_slice(&encode_open_tag(2, &[])); // <li>
        body.extend_from_slice(&encode_dyn_text(1, 0)); // DYN_TEXT slot=1 marker=0
        body.extend_from_slice(&encode_close_tag(2)); // </li>

        let opcodes = encode_list(0, 1, &body);

        let ir = build_minimal_ir(
            &["items", "item", "li"],
            &[(0, 0, 0x04, 0x00, &[]), (1, 1, 0x01, 0x00, &[])], // slot 0=Array, slot 1=Text
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&ir).unwrap();
        let mut slots = SlotData::new(2);
        slots.set(
            0,
            SlotValue::array(vec![
                SlotValue::Text("Alice".into()),
                SlotValue::Text("Bob".into()),
                SlotValue::Text("Charlie".into()),
            ]),
        );
        let html = walk_to_html(&module, &slots).unwrap();
        assert_eq!(
            html,
            "<!--f:l0-->\
             <li><!--f:t0-->Alice<!--/f:t0--></li>\
             <li><!--f:t0-->Bob<!--/f:t0--></li>\
             <li><!--f:t0-->Charlie<!--/f:t0--></li>\
             <!--/f:l0-->"
        );
    }

    // -- Roundtrip 5: Switch view -------------------------------------------

    // -- Roundtrip 6: Nested realistic structure ----------------------------

    #[test]
    fn roundtrip_nested_structure() {
        // Realistic page fragment: nav with conditional auth + list of links
        //
        // <nav class="main-nav">
        //   <!--f:s0-->  (SHOW_IF: logged in?)
        //     <span>Welcome</span>
        //   <!--/f:s0-->
        //   <ul>
        //     <!--f:l1-->  (LIST: nav items)
        //       <li><!--f:t0-->{item}<!--/f:t0--></li>
        //     <!--/f:l1-->
        //   </ul>
        // </nav>
        //
        // strings: 0="nav", 1="class", 2="main-nav", 3="auth",
        //          4="span", 5="Welcome", 6="items", 7="item",
        //          8="ul", 9="li"
        //
        // slots: 0=Bool (auth), 1=Array (items), 2=Text (item shadow)

        // SHOW_IF then body: <span>Welcome</span>
        let mut then_ops = Vec::new();
        then_ops.extend_from_slice(&encode_open_tag(4, &[]));
        then_ops.extend_from_slice(&encode_text(5));
        then_ops.extend_from_slice(&encode_close_tag(4));

        let show_if_ops = encode_show_if(0, &then_ops, &[]);

        // LIST body: <li>DYN_TEXT(slot=2)</li>
        let mut list_body = Vec::new();
        list_body.extend_from_slice(&encode_open_tag(9, &[]));
        list_body.extend_from_slice(&encode_dyn_text(2, 0));
        list_body.extend_from_slice(&encode_close_tag(9));

        let list_ops = encode_list(1, 2, &list_body);

        // Full opcode stream
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[(1, 2)])); // <nav class="main-nav">
        opcodes.extend_from_slice(&show_if_ops); // SHOW_IF auth
        opcodes.extend_from_slice(&encode_open_tag(8, &[])); // <ul>
        opcodes.extend_from_slice(&list_ops); // LIST items
        opcodes.extend_from_slice(&encode_close_tag(8)); // </ul>
        opcodes.extend_from_slice(&encode_close_tag(0)); // </nav>

        let ir = build_minimal_ir(
            &[
                "nav", "class", "main-nav", "auth", "span", "Welcome", "items", "item", "ul", "li",
            ],
            &[
                (0, 3, 0x02, 0x00, &[]), // slot 0 = Bool (auth)
                (1, 6, 0x04, 0x00, &[]), // slot 1 = Array (items)
                (2, 7, 0x01, 0x00, &[]), // slot 2 = Text (item)
            ],
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&ir).unwrap();
        let mut slots = SlotData::new(3);
        slots.set(0, SlotValue::Bool(true));
        slots.set(
            1,
            SlotValue::array(vec![
                SlotValue::Text("Home".into()),
                SlotValue::Text("About".into()),
            ]),
        );

        let html = walk_to_html(&module, &slots).unwrap();
        assert_eq!(
            html,
            r#"<nav class="main-nav"><!--f:s0--><span>Welcome</span><!--/f:s0--><ul><!--f:l1--><li><!--f:t0-->Home<!--/f:t0--></li><li><!--f:t0-->About<!--/f:t0--></li><!--/f:l1--></ul></nav>"#
        );
    }

    // =========================================================================
    // Island attribute injection tests
    // =========================================================================

    // -- Test 33: walk_island_attrs_on_open_tag --------------------------------

    #[test]
    fn walk_island_attrs_on_open_tag() {
        // ISLAND_START(0) + OPEN_TAG("div") + TEXT("Hello") + CLOSE_TAG("div") + ISLAND_END(0)
        // With island table entry: id=0, trigger=Load, props=Inline, name="AuthForm", no slots
        // strings: 0="div", 1="Hello", 2="AuthForm"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_text(1));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let slots = SlotData::new(0);
        let html = walk_with_islands(
            &["div", "Hello", "AuthForm"],
            &[],
            // island: id=0, trigger=Load(0x01), props=Inline(0x01), name_str_idx=2, byte_offset=0, no slot_ids
            &[(0, 0x01, 0x01, 2, 0, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(
            html,
            r#"<!--f:i0--><div data-forma-island="0" data-forma-component="AuthForm" data-forma-status="pending" data-forma-hydrate="load">Hello</div><!--/f:i0-->"#
        );
    }

    // -- Test 34: walk_island_attrs_with_existing_attrs -----------------------

    #[test]
    fn walk_island_attrs_with_existing_attrs() {
        // ISLAND_START(0) + OPEN_TAG("div" class="form") + CLOSE_TAG + ISLAND_END(0)
        // strings: 0="div", 1="class", 2="form", 3="AuthForm"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[(1, 2)]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let slots = SlotData::new(0);
        let html = walk_with_islands(
            &["div", "class", "form", "AuthForm"],
            &[],
            &[(0, 0x01, 0x01, 3, 0, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(
            html,
            r#"<!--f:i0--><div class="form" data-forma-island="0" data-forma-component="AuthForm" data-forma-status="pending" data-forma-hydrate="load"></div><!--/f:i0-->"#
        );
    }

    // -- Test 35: walk_island_attrs_on_void_tag -------------------------------

    #[test]
    fn walk_island_attrs_on_void_tag() {
        // ISLAND_START(0) + VOID_TAG("input") + ISLAND_END(0)
        // strings: 0="input", 1="Widget"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_void_tag(0, &[]));
        opcodes.extend_from_slice(&encode_island_end(0));

        let slots = SlotData::new(0);
        let html = walk_with_islands(
            &["input", "Widget"],
            &[],
            &[(0, 0x01, 0x01, 1, 0, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(
            html,
            r#"<!--f:i0--><input data-forma-island="0" data-forma-component="Widget" data-forma-status="pending" data-forma-hydrate="load"><!--/f:i0-->"#
        );
    }

    // -- Test 36: walk_inline_props_attribute ---------------------------------

    #[test]
    fn walk_inline_props_attribute() {
        // ISLAND_START(0) + OPEN_TAG("div") + CLOSE_TAG + ISLAND_END(0)
        // Island entry has slots [0, 1]; small props stay inline
        // Slot 0 = "title" (Text), Slot 1 = "count" (Number)
        // strings: 0="div", 1="MyComponent", 2="title", 3="count"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let mut slots = SlotData::new(2);
        slots.set(0, SlotValue::Text("Hello".to_string()));
        slots.set(1, SlotValue::Number(42.0));

        let html = walk_with_islands(
            &["div", "MyComponent", "title", "count"],
            &[
                (0, 2, 0x01, 0x00, &[]), // slot 0, name="title", Text, Server
                (1, 3, 0x03, 0x00, &[]), // slot 1, name="count", Number, Server
            ],
            // island: id=0, Load, Inline, name_str_idx=1, byte_offset=0, slot_ids=[0, 1]
            &[(0, 0x01, 0x01, 1, 0, &[0, 1])],
            &opcodes,
            &slots,
        );
        // Props should be JSON: {"title":"Hello","count":42}
        assert!(
            html.contains("data-forma-props="),
            "should contain data-forma-props, got: {html}"
        );
        assert!(
            html.contains(r#"data-forma-island="0""#),
            "should contain island id, got: {html}"
        );
        assert!(
            html.contains(r#"data-forma-component="MyComponent""#),
            "should contain component name, got: {html}"
        );
        // Parse the JSON from the props attribute to verify correctness.
        // The attribute uses double quotes with HTML entity escaping:
        //   data-forma-props="{&quot;title&quot;:&quot;Hello&quot;,&quot;count&quot;:42}"
        // Browsers auto-decode &quot; back to " when reading getAttribute(),
        // so we simulate that here by reversing the entity encoding.
        let marker = "data-forma-props=\"";
        let props_start = html.find(marker).unwrap() + marker.len();
        let props_end = html[props_start..].find('"').unwrap() + props_start;
        let raw_attr = &html[props_start..props_end];
        let decoded = raw_attr
            .replace("&quot;", "\"")
            .replace("&amp;", "&")
            .replace("&lt;", "<")
            .replace("&gt;", ">");
        let props_json: serde_json::Value = serde_json::from_str(&decoded).unwrap();
        assert_eq!(props_json["title"], "Hello");
        assert_eq!(props_json["count"], 42);
    }

    // -- Test 37: walk_list_item_key_on_first_open_tag -----------------------

    // -- Test 38: walk_list_item_key_on_void_tag -----------------------------

    // -- Test 39: walk_list_item_key_with_attrs ------------------------------

    // -- Test 40: walk_script_tag_props_mode ---------------------------------

    // -- Test 41: walk_deferred_props_mode -----------------------------------

    // -- Test 42: walk_island_no_entry_in_table -------------------------------

    #[test]
    fn walk_island_no_entry_in_table() {
        // An ISLAND_START whose id is absent from the island table used to
        // render happily: markers, but no `data-forma-*` attributes, so the
        // client could never hydrate that island and nothing said why. It is
        // now a load-time error instead of an invisible one at runtime.
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(5));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_text(1));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(5));

        let data = build_minimal_ir(&["div", "Hello"], &[], &opcodes, &[]);
        assert_eq!(
            IrModule::parse(&data).unwrap_err(),
            IrError::UnknownIslandId(5)
        );
    }

    #[test]
    fn walk_nested_island_start_before_a_root_element_is_an_error() {
        // Only one element can carry a data-forma-island set, so an island
        // that opens another island before its own root element would have
        // silently lost its identity — never hydrated, never disposed.
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_island_start(1));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(1));
        opcodes.extend_from_slice(&encode_island_end(0));

        let slots = SlotData::new(0);
        let data = build_minimal_ir(
            &["div", "Outer", "Inner"],
            &[],
            &opcodes,
            &[(0, 0x01, 0x01, 1, 0, &[]), (1, 0x01, 0x01, 2, 3, &[])],
        );
        let module = IrModule::parse(&data).unwrap();
        assert_eq!(
            walk_to_html(&module, &slots).unwrap_err(),
            IrError::NestedIslandRoot { outer: 0, inner: 1 }
        );
    }

    #[test]
    fn walk_island_nested_inside_another_islands_root_is_fine() {
        // The legal shape: each island opens its own element first.
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_island_start(1));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(1));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let slots = SlotData::new(0);
        let inner_offset = (encode_island_start(0).len() + encode_open_tag(0, &[]).len()) as u32;
        let html = walk_with_islands(
            &["div", "Outer", "Inner"],
            &[],
            &[
                (0, 0x01, 0x01, 1, 0, &[]),
                (1, 0x01, 0x01, 2, inner_offset, &[]),
            ],
            &opcodes,
            &slots,
        );
        assert!(html.contains(r#"data-forma-component="Outer""#));
        assert!(html.contains(r#"data-forma-component="Inner""#));
    }

    // -- Test 43: walk_inline_props_empty_slots ------------------------------

    #[test]
    fn walk_inline_props_empty_slots() {
        // Island with Inline props mode but no slot_ids — should not emit data-forma-props
        // strings: 0="div", 1="Simple"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let slots = SlotData::new(0);
        let html = walk_with_islands(
            &["div", "Simple"],
            &[],
            &[(0, 0x01, 0x01, 1, 0, &[])], // no slot_ids
            &opcodes,
            &slots,
        );
        assert!(
            !html.contains("data-forma-props"),
            "empty slot_ids should not emit props, got: {html}"
        );
        assert!(
            html.contains(r#"data-forma-island="0""#),
            "should contain island id"
        );
    }

    // -- Inline props size ceiling (F8) --------------------------------------

    /// Build a one-island page whose single prop slot holds `payload`.
    fn walk_island_with_prop_payload(payload: &str) -> String {
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text(payload.to_string()));
        walk_with_islands(
            &["div", "Big", "blob"],
            &[(0, 2, 0x01, 0x00, &[])],
            &[(0, 0x01, 0x01, 1, 0, &[0])],
            &opcodes,
            &slots,
        )
    }

    #[test]
    fn island_props_keep_the_first_slot_for_a_duplicated_name() {
        // Slots 0 and 1 are both named "dup". The three name-resolving paths
        // in this crate used to pick differently (first / last / last by
        // ascending id); they all keep the first now.
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let mut slots = SlotData::new(2);
        slots.set(0, SlotValue::Text("first".into()));
        slots.set(1, SlotValue::Text("second".into()));

        let html = walk_with_islands(
            &["div", "Comp", "dup"],
            &[(0, 2, 0x01, 0x00, &[]), (1, 2, 0x01, 0x00, &[])],
            &[(0, 0x01, 0x01, 1, 0, &[0, 1])],
            &opcodes,
            &slots,
        );
        assert!(
            html.contains(r#"data-forma-props="{&quot;dup&quot;:&quot;first&quot;}""#),
            "expected the first slot to win, got: {html}"
        );
    }

    #[test]
    fn inline_props_under_the_ceiling_stay_inline() {
        let html = walk_island_with_prop_payload("small");
        assert!(html.contains(r#"data-forma-props="{&quot;blob&quot;:&quot;small&quot;}""#));
        assert!(!html.contains("__forma_islands"));
    }

    #[test]
    fn inline_props_over_the_ceiling_spill_to_the_shared_block() {
        // An unbounded `data-forma-props` is a multi-kilobyte attribute
        // repeated on every island root. Above the ceiling the payload moves
        // to the shared block — and to EXACTLY one of the two channels, since
        // the client reads the inline attribute first and would never look at
        // the block if both were present.
        let payload = "x".repeat(INLINE_PROPS_MAX_BYTES + 1);
        let html = walk_island_with_prop_payload(&payload);
        assert!(
            !html.contains("data-forma-props"),
            "over-size props must not stay in the attribute"
        );
        assert!(
            html.contains(r#"<script id="__forma_islands" type="application/json">"#),
            "over-size props must land in the shared block, got: {}",
            &html[..html.len().min(200)]
        );
        assert!(html.contains(&payload), "the payload itself must survive");
    }

    #[test]
    fn island_fragment_keeps_over_size_props_inline() {
        // A fragment cannot emit a second `__forma_islands` block: it would
        // duplicate a DOM id and, being earlier in document order after the
        // swap, shadow the page's own block for every other island.
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let payload = "x".repeat(INLINE_PROPS_MAX_BYTES + 1);
        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text(payload));

        let data = build_minimal_ir(
            &["div", "Big", "blob"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[(0, 0x01, 0x01, 1, 0, &[0])],
        );
        let module = IrModule::parse(&data).unwrap();
        let fragment = walk_island(&module, &slots, 0).unwrap();
        assert!(fragment.contains("data-forma-props"));
        assert!(!fragment.contains("__forma_islands"));
    }

    // -- Test 44: walk_island_and_list_key_combined --------------------------

    // -- Test 45: walk_multiple_islands_script_tag ---------------------------

    #[test]
    fn walk_multiple_islands_script_tag() {
        // Two large inline-props islands spill into a single script tag
        // with both entries
        // strings: 0="div", 1="span", 2="CompA", 3="CompB", 4="msg", 5="flag"
        let mut opcodes = Vec::new();
        // Island 0
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));
        // Island 1 — its byte_offset must point at its own ISLAND_START.
        let island1_offset = opcodes.len() as u32;
        opcodes.extend_from_slice(&encode_island_start(1));
        opcodes.extend_from_slice(&encode_open_tag(1, &[]));
        opcodes.extend_from_slice(&encode_close_tag(1));
        opcodes.extend_from_slice(&encode_island_end(1));

        let mut slots = SlotData::new(3);
        slots.set(0, SlotValue::Text("hello".to_string()));
        slots.set(1, SlotValue::Bool(true));
        slots.set(2, SlotValue::Text("x".repeat(INLINE_PROPS_MAX_BYTES)));

        let html = walk_with_islands(
            &["div", "span", "CompA", "CompB", "msg", "flag", "padding"],
            &[
                (0, 4, 0x01, 0x00, &[]), // slot 0, name="msg", Text
                (1, 5, 0x02, 0x00, &[]),
                (2, 6, 0x01, 0, &[]), // slot 1, name="flag", Bool
            ],
            &[
                (0, 0x01, 0x02, 2, 0, &[0, 2]), // island 0, ScriptTag, name="CompA", byte_offset=0, slots=[0]
                (1, 0x01, 0x02, 3, island1_offset, &[1, 2]), // island 1, ScriptTag, name="CompB", slots=[1]
            ],
            &opcodes,
            &slots,
        );
        // Parse the script tag JSON
        let script_start =
            html.find(r#"type="application/json">"#).unwrap() + r#"type="application/json">"#.len();
        let script_end = html[script_start..].find("</script>").unwrap() + script_start;
        let json: serde_json::Value =
            serde_json::from_str(&html[script_start..script_end]).unwrap();
        assert_eq!(json["0"]["msg"], "hello");
        assert_eq!(json["1"]["flag"], true);
    }

    // -- Test 46: walk_list_item_key_consumed_once --------------------------

    // -- Test 47: walk_slot_value_to_json -----------------------------------

    #[test]
    fn slot_value_to_json_all_types() {
        // Verify SlotValue::to_json() for all variants
        assert_eq!(SlotValue::Null.to_json(), serde_json::Value::Null);
        assert_eq!(
            SlotValue::Text("hello".to_string()).to_json(),
            serde_json::Value::String("hello".to_string())
        );
        assert_eq!(
            SlotValue::Bool(true).to_json(),
            serde_json::Value::Bool(true)
        );
        assert_eq!(
            SlotValue::Bool(false).to_json(),
            serde_json::Value::Bool(false)
        );
        assert_eq!(SlotValue::Number(42.0).to_json(), serde_json::json!(42));
        assert_eq!(SlotValue::Number(3.15).to_json(), serde_json::json!(3.15));
        assert_eq!(
            SlotValue::array(vec![
                SlotValue::Text("a".to_string()),
                SlotValue::Number(1.0)
            ])
            .to_json(),
            serde_json::json!(["a", 1])
        );
        assert_eq!(
            SlotValue::object(vec![(
                "key".to_string(),
                SlotValue::Text("val".to_string())
            ),])
            .to_json(),
            serde_json::json!({"key": "val"})
        );
    }

    // -- Test 48: dyn_attr_emits_attribute_with_value ----------------------

    #[test]
    fn dyn_attr_emits_attribute_with_value() {
        // OPEN_TAG("input") + DYN_ATTR("type", slot=0) + CLOSE_TAG("input")
        // slot 0 = Text("password") → <input type="password"></input>
        // strings: 0="input", 1="type", 2="input_type" (slot name)
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        opcodes.extend_from_slice(&encode_close_tag(0));

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("password".to_string()));

        let html = walk_with_slots(
            &["input", "type", "input_type"],
            &[(0, 2, 0x01, 0x01, b"password")], // slot_id=0, name_str_idx=2, Text, Client, default="password"
            &opcodes,
            &slots,
        );
        assert_eq!(html, r#"<input type="password"></input>"#);
    }

    // -- Test 49: dyn_attr_skips_when_slot_null ----------------------------

    #[test]
    fn dyn_attr_skips_when_slot_null() {
        // DYN_ATTR with Null slot value should emit no attribute at all.
        // <div> (no class attr) </div>
        // strings: 0="div", 1="class", 2="cls" (slot name)
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        opcodes.extend_from_slice(&encode_close_tag(0));

        let slots = SlotData::new(1); // slot 0 is Null by default

        let html = walk_with_slots(
            &["div", "class", "cls"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert_eq!(html, "<div></div>");
    }

    // -- Test 50: dyn_attr_multiple_on_same_element ------------------------

    #[test]
    fn dyn_attr_multiple_on_same_element() {
        // OPEN_TAG("input") + DYN_ATTR("type", slot=0) + DYN_ATTR("class", slot=1) + CLOSE_TAG
        // strings: 0="input", 1="type", 2="class", 3="slot_type", 4="slot_class"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        opcodes.extend_from_slice(&encode_dyn_attr(2, 1));
        opcodes.extend_from_slice(&encode_close_tag(0));

        let mut slots = SlotData::new(2);
        slots.set(0, SlotValue::Text("email".to_string()));
        slots.set(1, SlotValue::Text("form-input".to_string()));

        let html = walk_with_slots(
            &["input", "type", "class", "slot_type", "slot_class"],
            &[(0, 3, 0x01, 0x01, b"text"), (1, 4, 0x01, 0x01, b"")],
            &opcodes,
            &slots,
        );
        assert_eq!(html, r#"<input type="email" class="form-input"></input>"#);
    }

    // -- Test 51: dyn_attr_on_void_tag -------------------------------------

    #[test]
    fn dyn_attr_on_void_tag() {
        // VOID_TAG("input") + DYN_ATTR("type", slot=0)
        // slot 0 = Text("checkbox") → <input type="checkbox">
        // strings: 0="input", 1="type", 2="slot_type"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_void_tag(0, &[]));
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("checkbox".to_string()));

        let html = walk_with_slots(
            &["input", "type", "slot_type"],
            &[(0, 2, 0x01, 0x01, b"text")],
            &opcodes,
            &slots,
        );
        assert_eq!(html, r#"<input type="checkbox">"#);
    }

    // -- walk_island tests -------------------------------------------------

    #[test]
    fn walk_island_basic() {
        // Build IR with an island containing <p>hello</p>
        // strings: 0="MyIsland", 1="div", 2="p", 3="hello"
        // We need a wrapper div before the island, the island content, and wrapper close.
        //
        // Opcodes layout:
        // OPEN_TAG "div" []       -> offset 0
        // ISLAND_START id=0       -> offset X (byte_offset for island table)
        // OPEN_TAG "p" []
        // TEXT "hello"
        // CLOSE_TAG "p"
        // ISLAND_END id=0
        // CLOSE_TAG "div"

        let pre_island = encode_open_tag(1, &[]); // OPEN_TAG "div" -> str_idx=1
        let island_start = encode_island_start(0);
        let open_p = encode_open_tag(2, &[]); // OPEN_TAG "p" -> str_idx=2
        let text_hello = encode_text(3);
        let close_p = encode_close_tag(2);
        let island_end = encode_island_end(0);
        let close_div = encode_close_tag(1);

        let byte_offset = pre_island.len() as u32; // island starts after the div open

        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&pre_island);
        opcodes.extend_from_slice(&island_start);
        opcodes.extend_from_slice(&open_p);
        opcodes.extend_from_slice(&text_hello);
        opcodes.extend_from_slice(&close_p);
        opcodes.extend_from_slice(&island_end);
        opcodes.extend_from_slice(&close_div);

        let data = build_minimal_ir(
            &["MyIsland", "div", "p", "hello"],
            &[],
            &opcodes,
            &[(0, 0x01, 0x01, 0, byte_offset, &[])], // island 0, Load, Inline, name="MyIsland"
        );
        let module = IrModule::parse(&data).unwrap();
        let slots = SlotData::new(0);

        let html = walk_island(&module, &slots, 0).unwrap();
        // The fragment is the island ROOT carrying the full data-forma-* set —
        // seeking past ISLAND_START used to drop all of it, so a fragment
        // swapped in via outerHTML never hydrated.
        assert_eq!(
            html,
            "<p data-forma-island=\"0\" data-forma-component=\"MyIsland\" \
             data-forma-status=\"pending\" data-forma-hydrate=\"load\">hello</p>"
        );
        // The f:iN markers live outside the root and survive an outerHTML
        // swap, so the fragment must not re-emit them.
        assert!(!html.contains("<!--f:i0-->"));
        assert!(!html.contains("<!--/f:i0-->"));
    }

    #[test]
    fn walk_island_attrs_match_walk_to_html() {
        // Parity: the fragment's root must carry the same data-forma-*
        // attribute set that the full-page walk produces for the same island.
        let island_start = encode_island_start(0);
        let open_div = encode_open_tag(1, &[]);
        let dyn_text = encode_dyn_text(0, 0);
        let close_div = encode_close_tag(1);
        let island_end = encode_island_end(0);

        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&island_start);
        opcodes.extend_from_slice(&open_div);
        opcodes.extend_from_slice(&dyn_text);
        opcodes.extend_from_slice(&close_div);
        opcodes.extend_from_slice(&island_end);

        let data = build_minimal_ir(
            &["IslandComp", "div", "greeting"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[(0, 0x02, 0x01, 0, 0, &[0])], // trigger=Visible, Inline props
        );
        let module = IrModule::parse(&data).unwrap();
        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("World".to_string()));

        let page = walk_to_html(&module, &slots).unwrap();
        let fragment = walk_island(&module, &slots, 0).unwrap();

        for attr in [
            "data-forma-island=\"0\"",
            "data-forma-component=\"IslandComp\"",
            "data-forma-status=\"pending\"",
            "data-forma-hydrate=\"visible\"",
            "data-forma-props=",
        ] {
            assert!(page.contains(attr), "page missing {attr}: {page}");
            assert!(
                fragment.contains(attr),
                "fragment missing {attr}: {fragment}"
            );
        }
    }

    #[test]
    fn walk_island_script_tag_mode_inlines_props_in_fragment() {
        // A ScriptTag island rendered as a fragment must inline its props
        // rather than emit a second __forma_islands block: that would
        // duplicate a DOM id, and because the injected copy precedes the SSR
        // one in document order it would shadow it — every other ScriptTag
        // island would then read a truncated shared-props map.
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(1, &[]));
        opcodes.extend_from_slice(&encode_close_tag(1));
        opcodes.extend_from_slice(&encode_island_end(0));

        let data = build_minimal_ir(
            &["IslandComp", "div", "greeting"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[(0, 0x01, 0x02, 0, 0, &[0])], // props_mode = ScriptTag
        );
        let module = IrModule::parse(&data).unwrap();
        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("World".to_string()));

        let fragment = walk_island(&module, &slots, 0).unwrap();
        assert!(
            fragment.contains("data-forma-props="),
            "ScriptTag island fragment must inline its props: {fragment}"
        );
        assert!(
            !fragment.contains("__forma_islands"),
            "fragment must not emit a second islands block: {fragment}"
        );
    }

    #[test]
    fn walk_island_nested_script_tag_island_keeps_its_props() {
        // A nested ScriptTag island would otherwise push into the shared
        // script_tag_props map, which a fragment render drops on return — so
        // the nested island would mount with null props.
        let mut opcodes = encode_island_start(0);
        opcodes.extend_from_slice(&encode_open_tag(1, &[]));
        let inner_offset = opcodes.len() as u32;
        opcodes.extend_from_slice(&encode_island_start(1));
        opcodes.extend_from_slice(&encode_open_tag(1, &[]));
        opcodes.extend_from_slice(&encode_close_tag(1));
        opcodes.extend_from_slice(&encode_island_end(1));
        opcodes.extend_from_slice(&encode_close_tag(1));
        opcodes.extend_from_slice(&encode_island_end(0));

        let data = build_minimal_ir(
            &["Outer", "div", "greeting", "Inner"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[
                (0, 0x01, 0x01, 0, 0, &[]),
                (1, 0x01, 0x02, 3, inner_offset, &[0]), // nested, ScriptTag
            ],
        );
        let module = IrModule::parse(&data).unwrap();
        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("World".into()));

        let fragment = walk_island(&module, &slots, 0).unwrap();
        assert!(
            fragment.contains("data-forma-component=\"Inner\""),
            "nested island must render: {fragment}"
        );
        assert!(
            fragment.contains("data-forma-props="),
            "nested ScriptTag island must keep its props inline: {fragment}"
        );
        assert!(!fragment.contains("__forma_islands"), "{fragment}");
    }

    #[test]
    fn walk_island_not_found() {
        // Build IR with no islands, then request island_id=5
        let opcodes = encode_text(0);
        let data = build_minimal_ir(&["Hello"], &[], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        let slots = SlotData::new(0);

        let result = walk_island(&module, &slots, 5);
        assert!(result.is_err());
        match result.unwrap_err() {
            IrError::IslandNotFound(5) => {} // expected
            other => panic!("expected IslandNotFound(5), got {other:?}"),
        }
    }

    #[test]
    fn walk_island_with_dyn_text() {
        // Island containing DYN_TEXT that references a slot
        // strings: 0="IslandComp", 1="div", 2="greeting"
        // slot 0: name_str_idx=2 ("greeting"), type=Text

        let island_start = encode_island_start(0);
        let open_div = encode_open_tag(1, &[]); // str_idx=1 -> "div"
        let dyn_text = encode_dyn_text(0, 0); // slot_id=0, marker_id=0
        let close_div = encode_close_tag(1);
        let island_end = encode_island_end(0);

        let byte_offset = 0u32; // island starts at beginning of opcodes

        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&island_start);
        opcodes.extend_from_slice(&open_div);
        opcodes.extend_from_slice(&dyn_text);
        opcodes.extend_from_slice(&close_div);
        opcodes.extend_from_slice(&island_end);

        let data = build_minimal_ir(
            &["IslandComp", "div", "greeting"],
            &[(0, 2, 0x01, 0x00, &[])], // slot_id=0, name="greeting", Text, Server
            &opcodes,
            &[(0, 0x01, 0x01, 0, byte_offset, &[0])], // island 0, slot_ids=[0]
        );
        let module = IrModule::parse(&data).unwrap();

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("World".to_string()));

        let html = walk_island(&module, &slots, 0).unwrap();
        // Root element keeps its island identity AND its props.
        assert_eq!(
            html,
            "<div data-forma-island=\"0\" data-forma-component=\"IslandComp\" \
             data-forma-status=\"pending\" data-forma-hydrate=\"load\" \
             data-forma-props=\"{&quot;greeting&quot;:&quot;World&quot;}\">\
             <!--f:t0-->World<!--/f:t0--></div>"
        );
    }

    #[test]
    fn walk_island_byte_offset_out_of_bounds() {
        // Island table entry with byte_offset pointing past the opcode stream.
        // This is now rejected at parse time: a byte_offset must point at that
        // island's own ISLAND_START opcode, which is both a bounds check and a
        // structural one (an in-range offset landing mid-operand on a stray
        // 0x0B byte would pass a bare bounds check).
        let opcodes = encode_text(0); // just a small opcode stream

        let data = build_minimal_ir(
            &["BadIsland", "hello"],
            &[],
            &opcodes,
            &[(0, 0x01, 0x01, 0, 9999, &[])], // byte_offset=9999, way past end
        );
        let err = IrModule::parse(&data).unwrap_err();
        assert_eq!(
            err,
            IrError::IslandOffsetMismatch {
                island_id: 0,
                byte_offset: 9999
            }
        );
    }

    // -- PROP opcode tests -------------------------------------------------

    /// Encode a PROP opcode: opcode(1) + src_slot_id(2) + prop_str_idx(4) + target_slot_id(2)
    fn encode_prop(src_slot_id: u16, prop_str_idx: u32, target_slot_id: u16) -> Vec<u8> {
        let mut buf = vec![0x12]; // Opcode::Prop
        buf.extend_from_slice(&src_slot_id.to_le_bytes());
        buf.extend_from_slice(&prop_str_idx.to_le_bytes());
        buf.extend_from_slice(&target_slot_id.to_le_bytes());
        buf
    }

    // -- Test: PROP extracts object property inside LIST body ----------------

    #[test]
    fn walk_prop_in_list_body() {
        // LIST(slot=0, item_slot=1):
        //   PROP(src=1, "name", target=2)
        //   DYN_TEXT(slot=2, marker=0)
        //
        // Slot 0 = Array([Object{name:"Alice"}, Object{name:"Bob"}])
        // Strings: 0="items", 1="item", 2="name"
        let mut body = Vec::new();
        body.extend_from_slice(&encode_prop(1, 2, 2)); // PROP(item_slot=1, prop="name", target=2)
        body.extend_from_slice(&encode_dyn_text(2, 0)); // DYN_TEXT(slot=2)
        let opcodes = encode_list(0, 1, &body);

        let mut slots = SlotData::new(3);
        slots.set(
            0,
            SlotValue::array(vec![
                SlotValue::object(vec![(
                    "name".to_string(),
                    SlotValue::Text("Alice".to_string()),
                )]),
                SlotValue::object(vec![(
                    "name".to_string(),
                    SlotValue::Text("Bob".to_string()),
                )]),
            ]),
        );

        let html = walk_with_slots(
            &["items", "item", "name"],
            &[
                (0, 0, 0x04, 0x00, &[]), // slot 0: Array, Server
                (1, 1, 0x05, 0x00, &[]), // slot 1: Object, Server
                (2, 2, 0x01, 0x00, &[]), // slot 2: Text, Server
            ],
            &opcodes,
            &slots,
        );
        assert!(html.contains("Alice"), "should contain Alice, got: {html}");
        assert!(html.contains("Bob"), "should contain Bob, got: {html}");
    }

    // -- Test: PROP with multiple properties ---------------------------------

    #[test]
    fn walk_prop_multiple_properties() {
        // LIST(slot=0, item_slot=1):
        //   PROP(src=1, "name", target=2)
        //   PROP(src=1, "email", target=3)
        //   <tr><td>DYN_TEXT(2)</td><td>DYN_TEXT(3)</td></tr>
        //
        // Strings: 0="rows", 1="row", 2="name", 3="email", 4="tr", 5="td"
        let mut body = Vec::new();
        body.extend_from_slice(&encode_prop(1, 2, 2)); // PROP(1, "name", 2)
        body.extend_from_slice(&encode_prop(1, 3, 3)); // PROP(1, "email", 3)
        body.extend_from_slice(&encode_open_tag(4, &[])); // <tr>
        body.extend_from_slice(&encode_open_tag(5, &[])); // <td>
        body.extend_from_slice(&encode_dyn_text(2, 0)); // name
        body.extend_from_slice(&encode_close_tag(5)); // </td>
        body.extend_from_slice(&encode_open_tag(5, &[])); // <td>
        body.extend_from_slice(&encode_dyn_text(3, 1)); // email
        body.extend_from_slice(&encode_close_tag(5)); // </td>
        body.extend_from_slice(&encode_close_tag(4)); // </tr>
        let opcodes = encode_list(0, 1, &body);

        let mut slots = SlotData::new(4);
        slots.set(
            0,
            SlotValue::array(vec![
                SlotValue::object(vec![
                    ("name".to_string(), SlotValue::Text("Alice".to_string())),
                    (
                        "email".to_string(),
                        SlotValue::Text("alice@test.com".to_string()),
                    ),
                ]),
                SlotValue::object(vec![
                    ("name".to_string(), SlotValue::Text("Bob".to_string())),
                    (
                        "email".to_string(),
                        SlotValue::Text("bob@test.com".to_string()),
                    ),
                ]),
            ]),
        );

        let html = walk_with_slots(
            &["rows", "row", "name", "email", "tr", "td"],
            &[
                (0, 0, 0x04, 0x00, &[]),
                (1, 1, 0x05, 0x00, &[]),
                (2, 2, 0x01, 0x00, &[]),
                (3, 3, 0x01, 0x00, &[]),
            ],
            &opcodes,
            &slots,
        );
        assert!(
            html.contains("<td><!--f:t0-->Alice<!--/f:t0--></td>"),
            "should contain Alice td, got: {html}"
        );
        assert!(
            html.contains("<td><!--f:t1-->alice@test.com<!--/f:t1--></td>"),
            "should contain alice email, got: {html}"
        );
        assert!(
            html.contains("<td><!--f:t0-->Bob<!--/f:t0--></td>"),
            "should contain Bob td, got: {html}"
        );
        assert!(
            html.contains("<td><!--f:t1-->bob@test.com<!--/f:t1--></td>"),
            "should contain bob email, got: {html}"
        );
    }

    // -- Test: PROP on non-Object returns Null (empty string for DYN_TEXT) ----

    #[test]
    fn walk_prop_on_non_object() {
        // PROP(src=0, "name", target=1) then DYN_TEXT(1)
        // Slot 0 = Text("hello") — not an object
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_prop(0, 1, 1));
        opcodes.extend_from_slice(&encode_dyn_text(1, 0));

        let mut slots = SlotData::new(2);
        slots.set(0, SlotValue::Text("hello".to_string()));

        let html = walk_with_slots(
            &["src", "name"],
            &[(0, 0, 0x01, 0x00, &[]), (1, 1, 0x01, 0x00, &[])],
            &opcodes,
            &slots,
        );
        // PROP on non-Object produces Null → DYN_TEXT renders zero-width space (U+200B)
        assert!(
            html.contains("<!--f:t0-->\u{200B}<!--/f:t0-->"),
            "non-object PROP should produce empty text, got: {html}"
        );
    }

    // -- Test: PROP with missing property returns Null -----------------------

    #[test]
    fn walk_prop_missing_property() {
        // PROP(src=0, "missing", target=1) then DYN_TEXT(1)
        // Slot 0 = Object with only "name" key
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_prop(0, 2, 1));
        opcodes.extend_from_slice(&encode_dyn_text(1, 0));

        let mut slots = SlotData::new(2);
        slots.set(
            0,
            SlotValue::object(vec![(
                "name".to_string(),
                SlotValue::Text("Alice".to_string()),
            )]),
        );

        let html = walk_with_slots(
            &["src", "target", "missing"],
            &[(0, 0, 0x05, 0x00, &[]), (1, 1, 0x01, 0x00, &[])],
            &opcodes,
            &slots,
        );
        assert!(
            html.contains("<!--f:t0-->\u{200B}<!--/f:t0-->"),
            "missing property should produce empty text, got: {html}"
        );
    }

    // -- Recursion depth limit tests ----------------------------------------

    #[test]
    fn walk_nested_show_if_within_limit() {
        // 5 levels of nested SHOW_IF — well within the 64-level limit.
        // Each level wraps the next; innermost renders TEXT "deep".
        // strings: 0..=4 = "s0".."s4", 5 = "deep"
        let inner = encode_text(5);
        let level4 = encode_show_if(4, &inner, &[]);
        let level3 = encode_show_if(3, &level4, &[]);
        let level2 = encode_show_if(2, &level3, &[]);
        let level1 = encode_show_if(1, &level2, &[]);
        let level0 = encode_show_if(0, &level1, &[]);

        let mut slots = SlotData::new(5);
        for i in 0..5 {
            slots.set(i, SlotValue::Bool(true));
        }

        let html = walk_with_slots(
            &["s0", "s1", "s2", "s3", "s4", "deep"],
            &[
                (0, 0, 0x02, 0x00, &[]),
                (1, 1, 0x02, 0x00, &[]),
                (2, 2, 0x02, 0x00, &[]),
                (3, 3, 0x02, 0x00, &[]),
                (4, 4, 0x02, 0x00, &[]),
            ],
            &level0,
            &slots,
        );
        assert!(
            html.contains("deep"),
            "5 levels of nesting should succeed, got: {html}"
        );
    }

    /// Build a one-island large-props page whose single prop is `payload`,
    /// and return (full html, the raw script-block body).
    fn script_tag_props_html(payload: &str) -> (String, String) {
        // ISLAND_START(0) + OPEN_TAG("div") + CLOSE_TAG + ISLAND_END(0)
        // strings: 0="div", 1="Comp", 2="payload"
        let mut opcodes = Vec::new();
        opcodes.extend_from_slice(&encode_island_start(0));
        opcodes.extend_from_slice(&encode_open_tag(0, &[]));
        opcodes.extend_from_slice(&encode_close_tag(0));
        opcodes.extend_from_slice(&encode_island_end(0));

        let mut slots = SlotData::new(2);
        slots.set(0, SlotValue::Text(payload.to_string()));
        slots.set(1, SlotValue::Text("x".repeat(INLINE_PROPS_MAX_BYTES)));

        let html = walk_with_islands(
            &["div", "Comp", "payload", "padding"],
            &[(0, 2, 0x01, 0x00, &[]), (1, 3, 0x01, 0, &[])],
            &[(0, 0x01, 0x01, 1, 0, &[0, 1])],
            &opcodes,
            &slots,
        );

        const OPEN: &str = "type=\"application/json\">";
        let start = html.find(OPEN).expect("islands script block") + OPEN.len();
        let end = html[start..].find("</script>").expect("script close") + start;
        let body = html[start..end].to_string();
        (html, body)
    }

    #[test]
    fn walk_script_tag_props_body_has_no_raw_angle_brackets() {
        // The property that actually makes the escaping total: no bare '<' or
        // '>' survives into the data block, so nothing in it can terminate or
        // re-open the enclosing <script> element. Escaping only "</" (as this
        // used to) is not enough — see the breakout test below.
        let (_html, body) = script_tag_props_html("</script>alert(1)");
        assert!(
            !body.contains('<') && !body.contains('>'),
            "islands block must contain no raw angle brackets, got: {body}"
        );
        assert!(body.contains("\\u003c/script\\u003e"), "got: {body}");

        // ...and the escaping is value-preserving: JSON.parse (here
        // serde_json::from_str, which decodes \u003c identically) round-trips
        // back to the original prop value.
        let parsed: serde_json::Value = serde_json::from_str(&body).unwrap();
        assert_eq!(parsed["0"]["payload"], "</script>alert(1)");
    }

    #[test]
    fn walk_script_tag_props_escapes_comment_script_breakout() {
        // The payload the old "</" replace did NOT handle. `<!--` followed by
        // `<script` drives a spec-compliant HTML tokenizer into the
        // script-data-double-escaped state, where our own trailing </script>
        // is consumed as text instead of ending the element — swallowing the
        // whole rest of the page and leaving an inert page.
        let payload = "<!--<script>PAYLOAD";
        let (html, body) = script_tag_props_html(payload);

        assert!(
            !html.contains("<!--<script"),
            "must not emit the script-data-double-escape trigger, got: {html}"
        );
        assert!(!body.contains('<') && !body.contains('>'), "got: {body}");

        let parsed: serde_json::Value = serde_json::from_str(&body).unwrap();
        assert_eq!(parsed["0"]["payload"], payload);
    }

    #[test]
    #[ignore = "requires admin/dist IR files — run in monorepo or after `npm run build`"]
    fn walk_real_benchmark_ir() {
        // Find the benchmark IR file dynamically (hash changes on rebuild)
        let dist_dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../admin/dist");
        let ir_path = std::fs::read_dir(&dist_dir)
            .expect("admin/dist must exist")
            .filter_map(|e| e.ok())
            .find(|e| {
                let name = e.file_name();
                let s = name.to_string_lossy();
                s.starts_with("platform-benchmark.") && s.ends_with(".ir")
            })
            .map(|e| e.path())
            .expect("platform-benchmark.*.ir must exist in admin/dist");
        let data = std::fs::read(&ir_path).expect("benchmark IR file must exist");
        let module = IrModule::parse(&data).expect("IR must parse");

        // Walk with default slots
        let slots = SlotData::new_from_defaults(&module.slots);
        let html = walk_to_html(&module, &slots).expect("walk must succeed");

        // Verify island markers exist
        assert!(html.contains("<!--f:i0-->"), "missing island 0 start");
        assert!(html.contains("<!--/f:i0-->"), "missing island 0 end");
        assert!(
            html.contains("data-forma-island=\"0\""),
            "missing island 0 attr"
        );

        // The key assertion: island content must include FilterBar's children
        // (not just an empty shell div)
        assert!(
            html.contains("Search"),
            "FilterBar must contain 'Search' label text in SSR"
        );
        assert!(
            html.contains("filter-group"),
            "FilterBar must contain filter-group divs in SSR"
        );
        assert!(
            html.contains("Sort by"),
            "FilterBar must contain 'Sort by' label text in SSR"
        );

        // PerfPanel content
        assert!(
            html.contains("Performance"),
            "PerfPanel must contain 'Performance' heading in SSR"
        );

        // BenchmarkDataTable — SHOW_IF may pick either branch depending on slot defaults
        // Just check the structure exists
        assert!(
            html.contains("benchmark-data-table"),
            "BenchmarkDataTable root class must exist"
        );

        // The FilterBar island must be a real, closed region, not just a
        // stray opening marker. (This replaced a pair of `eprintln!`s that
        // printed the region "for manual inspection" and asserted nothing.)
        let start = html
            .find("<!--f:i0-->")
            .expect("FilterBar island start marker");
        let end = html
            .find("<!--/f:i0-->")
            .expect("FilterBar island end marker");
        assert!(end > start, "island end marker must follow its start");
    }

    // -- Output budget (F-02) -----------------------------------------------

    #[test]
    fn walk_output_limit_trips_inside_one_opcode() {
        // The case a top-of-loop check cannot catch: ONE OpenTag opcode can
        // emit hundreds of megabytes, because attr_count goes to u16::MAX and
        // every value escapes up to 5x. The budget must be enforced by the
        // append itself, not once per iteration.
        let big = "&".repeat(4096); // escapes to 5x = 20 KiB each
        let attrs: Vec<(u32, u32)> = (0..200).map(|_| (1u32, 2u32)).collect();
        let opcodes = encode_open_tag(0, &attrs);

        let data = build_minimal_ir(&["div", "data-x", &big], &[], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        let slots = SlotData::new(0);

        let limits = WalkLimits {
            max_output_bytes: 64 * 1024,
            ..WalkLimits::default()
        };
        let err = walk_to_html_with_limits(&module, &slots, limits).unwrap_err();
        assert_eq!(err, IrError::OutputLimitExceeded { limit: 64 * 1024 });

        // ...and a generous budget still renders it.
        let ok = WalkLimits {
            max_output_bytes: 64 * 1024 * 1024,
            ..WalkLimits::default()
        };
        assert!(walk_to_html_with_limits(&module, &slots, ok).is_ok());
    }

    #[test]
    fn walk_output_limit_trips_on_a_single_dyn_text_value() {
        // DynText emits a whole slot value in one iteration too.
        let opcodes = encode_dyn_text(0, 0);
        let data = build_minimal_ir(&["msg"], &[(0, 0, 0x01, 0x00, &[])], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();

        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("x".repeat(100_000)));

        let limits = WalkLimits {
            max_output_bytes: 4096,
            ..WalkLimits::default()
        };
        assert!(matches!(
            walk_to_html_with_limits(&module, &slots, limits),
            Err(IrError::OutputLimitExceeded { .. })
        ));
    }

    // -- LIST iteration budget (F-08) ---------------------------------------

    #[test]
    fn walk_list_budget_exceeded() {
        // Depth bounds nesting, not volume: two nested LISTs over the same
        // 300-element array is 90,000 body walks from a tiny module.
        let body = encode_text(2);
        let inner = encode_list(0, 1, &body);
        let opcodes = encode_list(0, 1, &inner);

        let data = build_minimal_ir(
            &["items", "item", "x"],
            &[(0, 0, 0x04, 0x00, &[]), (1, 1, 0x01, 0x00, &[])],
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&data).unwrap();

        let mut slots = SlotData::new(2);
        slots.set(
            0,
            SlotValue::array((0..300).map(|_| SlotValue::Text("a".into())).collect()),
        );

        let err = walk_to_html(&module, &slots).unwrap_err();
        assert_eq!(
            err,
            IrError::ListBudgetExceeded {
                max: DEFAULT_MAX_LIST_ITERATIONS
            }
        );
        // Deliberately a DIFFERENT error from ListDepthExceeded — an operator
        // reading "nested LIST depth exceeded maximum of 4" for this case
        // would be chasing the wrong thing.
        assert_ne!(
            err,
            IrError::ListDepthExceeded {
                max: MAX_LIST_DEPTH
            }
        );
    }

    // -- Offset arithmetic and structural tiling (F-06 / F-07) --------------

    /// Corrupt a u32 length field inside an opcode buffer.
    fn patch_u32(buf: &mut [u8], at: usize, value: u32) {
        buf[at..at + 4].copy_from_slice(&value.to_le_bytes());
    }

    #[test]
    fn parse_rejects_show_if_then_len_past_the_stream() {
        // SHOW_IF: opcode(1) slot_id(2) then_len(4) else_len(4)
        let mut opcodes = encode_show_if(0, &encode_text(1), &encode_text(1));
        patch_u32(&mut opcodes, 3, 0xFFFF_FF00); // then_len
        let data = build_minimal_ir(&["flag", "hi"], &[(0, 0, 0x02, 0x00, &[])], &opcodes, &[]);
        assert!(matches!(
            IrModule::parse(&data),
            Err(IrError::MalformedControlFlow { .. })
        ));
    }

    #[test]
    fn parse_rejects_show_if_marker_byte_that_is_not_show_else() {
        // then_len short by one, so the byte at then_end is a TEXT opcode
        // rather than the SHOW_ELSE marker.
        let mut opcodes = encode_show_if(0, &encode_text(1), &encode_text(1));
        patch_u32(&mut opcodes, 3, 4); // then body is 5 bytes; claim 4
        let data = build_minimal_ir(&["flag", "hi"], &[(0, 0, 0x02, 0x00, &[])], &opcodes, &[]);
        assert!(matches!(
            IrModule::parse(&data),
            Err(IrError::MalformedControlFlow { .. })
        ));
    }

    #[test]
    fn parse_rejects_list_body_len_past_the_stream() {
        // LIST: opcode(1) slot_id(2) item_slot_id(2) body_len(4)
        let mut opcodes = encode_list(0, 1, &encode_text(2));
        patch_u32(&mut opcodes, 5, 0xFFFF_FF00);
        let data = build_minimal_ir(
            &["items", "item", "x"],
            &[(0, 0, 0x04, 0x00, &[]), (1, 1, 0x01, 0x00, &[])],
            &opcodes,
            &[],
        );
        assert!(matches!(
            IrModule::parse(&data),
            Err(IrError::MalformedControlFlow { .. })
        ));
    }

    #[test]
    fn parse_accepts_zero_length_else_branch_known_residual() {
        // DOCUMENTED RESIDUAL: an under-long length whose orphaned bytes still
        // decode as a legal sibling sequence is structurally indistinguishable
        // from a legitimate module. No length check can reject it; only module
        // integrity (a CRC that the producer did not restamp) would. This test exists so the
        // case is not later mistaken for a fixed hole.
        let opcodes = encode_show_if(0, &encode_text(1), &[]);
        let data = build_minimal_ir(&["flag", "hi"], &[(0, 0, 0x02, 0x00, &[])], &opcodes, &[]);
        assert!(IrModule::parse(&data).is_ok());
    }

    // -- TRY/FALLBACK scoping (F-10) ----------------------------------------

    // -- Pending island / list-key scoping (F-11) ---------------------------

    #[test]
    fn walk_island_attrs_survive_an_empty_show_if_before_the_root() {
        // ISLAND_START, SHOW_IF (both branches empty), then the root element.
        // Clearing pending state at the end of every walk_range would wipe the
        // island attributes here and the island would never hydrate — the
        // reason the clear lives on ISLAND_END instead.
        let mut opcodes = encode_island_start(0);
        opcodes.extend_from_slice(&encode_show_if(0, &[], &[]));
        opcodes.extend_from_slice(&encode_open_tag(1, &[]));
        opcodes.extend_from_slice(&encode_close_tag(1));
        opcodes.extend_from_slice(&encode_island_end(0));

        let slots = SlotData::new(1);
        let html = walk_with_islands(
            &["Comp", "div", "flag"],
            &[(0, 2, 0x02, 0x00, &[])],
            &[(0, 0x01, 0x01, 0, 0, &[])],
            &opcodes,
            &slots,
        );
        assert!(
            html.contains("<div data-forma-island=\"0\""),
            "island root must keep its attributes, got: {html}"
        );
    }

    #[test]
    fn walk_island_attrs_do_not_leak_past_the_island_end() {
        // ISLAND_START with no element inside, then an element AFTER the
        // island's closing marker. The island's identity attributes must not
        // land on it.
        let mut opcodes = encode_island_start(0);
        opcodes.extend_from_slice(&encode_island_end(0));
        opcodes.extend_from_slice(&encode_open_tag(1, &[]));
        opcodes.extend_from_slice(&encode_close_tag(1));

        let slots = SlotData::new(0);
        let html = walk_with_islands(
            &["Comp", "div"],
            &[],
            &[(0, 0x01, 0x01, 0, 0, &[])],
            &opcodes,
            &slots,
        );
        assert!(
            !html.contains("data-forma-island"),
            "island attributes must not leak onto an element outside the island, got: {html}"
        );
    }

    // -- Name validation (S13) ----------------------------------------------

    #[test]
    fn walk_rejects_hostile_tag_name() {
        // Tag names are written unescaped, so an IR-authored name is direct
        // markup injection.
        let opcodes = encode_open_tag(0, &[]);
        let data = build_minimal_ir(&["div onload=\"alert(1)\""], &[], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        let slots = SlotData::new(0);
        assert!(matches!(
            walk_to_html(&module, &slots),
            Err(IrError::InvalidName(_))
        ));
    }

    #[test]
    fn walk_rejects_hostile_close_tag_name() {
        let mut opcodes = encode_open_tag(0, &[]);
        opcodes.extend_from_slice(&encode_close_tag(1));
        let data = build_minimal_ir(&["div", "div><script"], &[], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        let slots = SlotData::new(0);
        assert!(matches!(
            walk_to_html(&module, &slots),
            Err(IrError::InvalidName(_))
        ));
    }

    #[test]
    fn walk_drops_hostile_attribute_names() {
        // Attribute names are skippable, so one bad key costs the attribute
        // rather than the whole page.
        let opcodes = encode_open_tag(0, &[(1, 2), (3, 2)]);
        let data = build_minimal_ir(&["div", "x\"><script", "v", "ok-attr"], &[], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        let slots = SlotData::new(0);
        let html = walk_to_html(&module, &slots).unwrap();
        assert_eq!(html, "<div ok-attr=\"v\">");
    }

    #[test]
    fn walk_drops_hostile_boolean_attribute_name() {
        // Same, via the boolean (empty-value) branch.
        let opcodes = encode_open_tag(0, &[(1, 2)]);
        let data = build_minimal_ir(&["div", "y\"><script", ""], &[], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        let slots = SlotData::new(0);
        assert_eq!(walk_to_html(&module, &slots).unwrap(), "<div>");
    }

    #[test]
    fn walk_drops_hostile_dyn_attr_name() {
        let mut opcodes = encode_open_tag(0, &[]);
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        let data = build_minimal_ir(
            &["div", "z\"><script", "val"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&data).unwrap();
        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("x".into()));
        assert_eq!(walk_to_html(&module, &slots).unwrap(), "<div>");
    }

    // -- URL / event-handler attribute safety (S14) -------------------------

    #[test]
    fn walk_drops_javascript_url_in_dyn_attr() {
        let mut opcodes = encode_open_tag(0, &[]);
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        let data = build_minimal_ir(
            &["a", "href", "url"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&data).unwrap();

        // Also covers the normalization step: browsers strip control chars
        // before resolving the scheme, so `java\tscript:` executes.
        for payload in [
            "javascript:alert(1)",
            "JaVaScRiPt:alert(1)",
            "java\tscript:alert(1)",
            "  javascript:alert(1)",
            "vbscript:msgbox(1)",
            "data:text/html,<script>alert(1)</script>",
        ] {
            let mut slots = SlotData::new(1);
            slots.set(0, SlotValue::Text(payload.to_string()));
            let html = walk_to_html(&module, &slots).unwrap();
            // Dropped entirely, not emitted empty: href="" resolves to the
            // current page and would not match the client DOM either.
            assert_eq!(html, "<a>", "payload {payload:?} was not dropped");
        }
    }

    #[test]
    fn walk_keeps_safe_urls_and_data_images() {
        let mut opcodes = encode_open_tag(0, &[]);
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        let data = build_minimal_ir(
            &["img", "src", "url"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&data).unwrap();

        for payload in [
            "/about",
            "https://example.com/x?a=1",
            "data:image/png;base64,AAAA",
            // svg+xml is allowed here because <img> is an image context — the
            // stock CSP permits img-src data:, so a blanket data: block would
            // break legitimate inline images.
            "data:image/svg+xml,%3Csvg%3E%3C/svg%3E",
        ] {
            let mut slots = SlotData::new(1);
            slots.set(0, SlotValue::Text(payload.to_string()));
            let html = walk_to_html(&module, &slots).unwrap();
            assert!(html.contains("src="), "payload {payload:?} was dropped");
        }
    }

    #[test]
    fn walk_blocks_svg_data_url_outside_image_context() {
        let mut opcodes = encode_open_tag(0, &[]);
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        let data = build_minimal_ir(
            &["a", "href", "url"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&data).unwrap();
        let mut slots = SlotData::new(1);
        slots.set(
            0,
            SlotValue::Text("data:image/svg+xml,%3Csvg onload=alert(1)%3E".into()),
        );
        // Through a document sink the SVG is parsed as a document and its
        // onload fires, so it is blocked here even though <img> allows it.
        assert_eq!(walk_to_html(&module, &slots).unwrap(), "<a>");
    }

    #[test]
    fn walk_drops_event_handler_attributes() {
        // Static attribute path...
        let opcodes = encode_open_tag(0, &[(1, 2)]);
        let data = build_minimal_ir(&["div", "onmouseover", "alert(1)"], &[], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        assert_eq!(
            walk_to_html(&module, &SlotData::new(0)).unwrap(),
            "<div>",
            "static on* attribute must be dropped"
        );

        // ...and the dynamic one.
        let mut opcodes = encode_open_tag(0, &[]);
        opcodes.extend_from_slice(&encode_dyn_attr(1, 0));
        let data = build_minimal_ir(
            &["div", "ONCLICK", "h"],
            &[(0, 2, 0x01, 0x00, &[])],
            &opcodes,
            &[],
        );
        let module = IrModule::parse(&data).unwrap();
        let mut slots = SlotData::new(1);
        slots.set(0, SlotValue::Text("alert(1)".into()));
        assert_eq!(walk_to_html(&module, &slots).unwrap(), "<div>");
    }

    #[test]
    fn walk_drops_javascript_url_in_static_attr() {
        // Static values come from the string table (template-author level),
        // but renderAttr applies identical rules to static props — leaving
        // them unchecked would preserve an SSR/CSR divergence.
        let opcodes = encode_open_tag(0, &[(1, 2)]);
        let data = build_minimal_ir(&["a", "href", "javascript:alert(1)"], &[], &opcodes, &[]);
        let module = IrModule::parse(&data).unwrap();
        assert_eq!(walk_to_html(&module, &SlotData::new(0)).unwrap(), "<a>");
    }

    // -- Number rendering parity (F-05) -------------------------------------

    // -- Parsing context: text-only parents and form controls (FORMA-002) ---
    //
    // The tokenizer reads the content of `textarea` and `title` (RCDATA) and
    // of `style` and `script` (RAWTEXT, script data) as text, so a marker
    // comment there is literal text: it becomes the control's value and what a
    // form submits before JavaScript. A bound `value` on a `select` or a
    // `textarea` is a property HTML never reads as an attribute. Each test
    // asserts exact bytes for the affected element AND for a sibling in normal
    // content, so a rule cannot pass by dropping markers everywhere (P3).

    /// A small opcode assembler with an interning string table, so these
    /// tests read as markup rather than as string indices.
    struct Page {
        strings: Vec<String>,
        ops: Vec<u8>,
        slots: Vec<(u8, SlotValue)>,
        islands: Vec<(u16, u32, u32)>,
    }

    impl Page {
        fn new() -> Self {
            Page {
                strings: Vec::new(),
                ops: Vec::new(),
                slots: Vec::new(),
                islands: Vec::new(),
            }
        }

        fn intern(&mut self, s: &str) -> u32 {
            let index = match self.strings.iter().position(|x| x == s) {
                Some(i) => i,
                None => {
                    self.strings.push(s.to_string());
                    self.strings.len() - 1
                }
            };
            u32::try_from(index).unwrap()
        }

        /// Declare the next slot holding `value`; ids are assigned in order.
        fn slot(&mut self, value: SlotValue) -> u16 {
            let type_byte = match &value {
                SlotValue::Null | SlotValue::Text(_) => 0x01,
                SlotValue::Bool(_) => 0x02,
                SlotValue::Number(_) => 0x03,
                SlotValue::Array(_) => 0x04,
                SlotValue::Object(_) => 0x05,
            };
            self.slots.push((type_byte, value));
            u16::try_from(self.slots.len() - 1).unwrap()
        }

        fn open(&mut self, tag: &str, attrs: &[(&str, &str)]) -> &mut Self {
            let tag = self.intern(tag);
            let attrs: Vec<(u32, u32)> = attrs
                .iter()
                .map(|(k, v)| (self.intern(k), self.intern(v)))
                .collect();
            self.ops.extend_from_slice(&encode_open_tag(tag, &attrs));
            self
        }

        fn close(&mut self, tag: &str) -> &mut Self {
            let tag = self.intern(tag);
            self.ops.extend_from_slice(&encode_close_tag(tag));
            self
        }

        fn text(&mut self, text: &str) -> &mut Self {
            let text = self.intern(text);
            self.ops.extend_from_slice(&encode_text(text));
            self
        }

        /// DYN_TEXT whose marker id is its slot id, so ids stay distinct.
        fn dyn_text(&mut self, slot: u16) -> &mut Self {
            self.ops.extend_from_slice(&encode_dyn_text(slot, slot));
            self
        }

        fn dyn_attr(&mut self, name: &str, slot: u16) -> &mut Self {
            let name = self.intern(name);
            self.ops.extend_from_slice(&encode_dyn_attr(name, slot));
            self
        }

        /// PROP: `target = source[name]`.
        fn prop(&mut self, source: u16, name: &str, target: u16) -> &mut Self {
            let name = self.intern(name);
            self.ops
                .extend_from_slice(&encode_prop(source, name, target));
            self
        }

        /// Assemble `f`'s opcodes on their own, sharing the string table.
        fn body(&mut self, f: impl FnOnce(&mut Self)) -> Vec<u8> {
            let outer = std::mem::take(&mut self.ops);
            f(self);
            std::mem::replace(&mut self.ops, outer)
        }

        fn show_if(
            &mut self,
            slot: u16,
            then_ops: impl FnOnce(&mut Self),
            else_ops: impl FnOnce(&mut Self),
        ) -> &mut Self {
            let then_ops = self.body(then_ops);
            let else_ops = self.body(else_ops);
            self.ops
                .extend_from_slice(&encode_show_if(slot, &then_ops, &else_ops));
            self
        }

        fn list(&mut self, slot: u16, item: u16, body: impl FnOnce(&mut Self)) -> &mut Self {
            let body = self.body(body);
            self.ops.extend_from_slice(&encode_list(slot, item, &body));
            self
        }

        /// An island at the top level (its table offset is taken here, so it
        /// must not be nested inside a `body`).
        fn island(&mut self, id: u16, body: impl FnOnce(&mut Self)) -> &mut Self {
            let name = self.intern(&format!("Island{id}"));
            let offset = u32::try_from(self.ops.len()).unwrap();
            self.islands.push((id, name, offset));
            self.ops.extend_from_slice(&encode_island_start(id));
            body(self);
            self.ops.extend_from_slice(&encode_island_end(id));
            self
        }

        fn module_and_slots(&self) -> (IrModule, SlotData) {
            let mut strings = self.strings.clone();
            let mut decls = Vec::new();
            for (id, (type_byte, _)) in self.slots.iter().enumerate() {
                strings.push(format!("slot{id}"));
                let name = u32::try_from(strings.len() - 1).unwrap();
                decls.push((u16::try_from(id).unwrap(), name, *type_byte, 0x00, &[][..]));
            }
            let islands: Vec<(u16, u8, u8, u32, u32, &[u16])> = self
                .islands
                .iter()
                .map(|&(id, name, offset)| (id, 0x01, 0x01, name, offset, &[][..]))
                .collect();
            let strings: Vec<&str> = strings.iter().map(String::as_str).collect();
            let data = build_minimal_ir(&strings, &decls, &self.ops, &islands);
            let module = IrModule::parse(&data).unwrap();
            let mut slots = SlotData::new(self.slots.len());
            for (id, (_, value)) in self.slots.iter().enumerate() {
                slots.set(u16::try_from(id).unwrap(), value.clone());
            }
            (module, slots)
        }

        fn render(&self) -> String {
            let (module, slots) = self.module_and_slots();
            walk_to_html(&module, &slots).unwrap()
        }

        fn render_island(&self, id: u16) -> String {
            let (module, slots) = self.module_and_slots();
            walk_island(&module, &slots, id).unwrap()
        }
    }

    fn text(s: &str) -> SlotValue {
        SlotValue::Text(s.to_string())
    }

    #[test]
    fn dyn_text_in_a_text_only_parent_is_written_without_markers() {
        // One table over every text-only parent (P2), plus an upper-case tag:
        // HTML tag names are case-insensitive. The value is still escaped:
        // RCDATA decodes the references back, and in RAWTEXT the escaping is
        // what stops a value from closing the element.
        for parent in ["textarea", "title", "style", "script", "TEXTAREA"] {
            let mut page = Page::new();
            let inside = page.slot(text("a<b&c"));
            let outside = page.slot(text("world"));
            page.open("div", &[])
                .open(parent, &[])
                .dyn_text(inside)
                .close(parent)
                .open("p", &[])
                .dyn_text(outside)
                .close("p")
                .close("div");
            assert_eq!(
                page.render(),
                format!(
                    "<div><{parent}>a&lt;b&amp;c</{parent}>\
                     <p><!--f:t1-->world<!--/f:t1--></p></div>"
                ),
                "inside <{parent}>"
            );
        }
    }

    #[test]
    fn dyn_text_outside_the_text_only_parents_keeps_its_markers() {
        // Negative space (P5): the rule is four exact names, not a prefix or
        // substring match, and not every element with special parsing.
        for parent in ["pre", "option", "span", "titles", "xtextarea", "noscript"] {
            let mut page = Page::new();
            let value = page.slot(text("hello"));
            page.open(parent, &[]).dyn_text(value).close(parent);
            assert_eq!(
                page.render(),
                format!("<{parent}><!--f:t0-->hello<!--/f:t0--></{parent}>"),
                "inside <{parent}>"
            );
        }
    }

    #[test]
    fn an_empty_value_in_a_text_only_parent_writes_nothing() {
        // The zero-width space exists so a marker pair encloses a Text node.
        // With no markers it would only become part of the control's value.
        let mut page = Page::new();
        let inside = page.slot(text(""));
        let outside = page.slot(text(""));
        page.open("textarea", &[])
            .dyn_text(inside)
            .close("textarea")
            .open("p", &[])
            .dyn_text(outside)
            .close("p");
        assert_eq!(
            page.render(),
            "<textarea></textarea><p><!--f:t1-->\u{200B}<!--/f:t1--></p>"
        );
    }

    #[test]
    fn a_textarea_doubles_a_leading_line_feed() {
        // The parser drops one LF straight after `<textarea>` (CR and CRLF are
        // LF by then). The marker used to shield it; without one, the first
        // line of the value would be lost before JavaScript runs.
        fn textarea(build: impl FnOnce(&mut Page)) -> String {
            let mut page = Page::new();
            page.open("textarea", &[]);
            build(&mut page);
            page.close("textarea");
            page.render()
        }
        let cases: [(&str, String, &str); 5] = [
            (
                "a dynamic value",
                textarea(|p| {
                    let v = p.slot(text("\nhello"));
                    p.dyn_text(v);
                }),
                "<textarea>\n\nhello</textarea>",
            ),
            (
                "a CRLF value",
                textarea(|p| {
                    let v = p.slot(text("\r\nhello"));
                    p.dyn_text(v);
                }),
                "<textarea>\n\r\nhello</textarea>",
            ),
            (
                "an empty value first: the first written byte decides",
                textarea(|p| {
                    let empty = p.slot(text(""));
                    let v = p.slot(text("\nx"));
                    p.dyn_text(empty).dyn_text(v);
                }),
                "<textarea>\n\nx</textarea>",
            ),
            (
                "an LF after other content is kept as is",
                textarea(|p| {
                    let v = p.slot(text("\nb"));
                    p.text("a").dyn_text(v);
                }),
                "<textarea>a\nb</textarea>",
            ),
            (
                "static text",
                textarea(|p| {
                    p.text("\nstatic");
                }),
                "<textarea>\n\nstatic</textarea>",
            ),
        ];
        for (case, html, expected) in cases {
            assert_eq!(html, expected, "{case}");
        }

        // The rule is the textarea's alone: the parser drops no LF in a title.
        let mut page = Page::new();
        let v = page.slot(text("\nhello"));
        page.open("title", &[]).dyn_text(v).close("title");
        assert_eq!(page.render(), "<title>\nhello</title>");
    }

    #[test]
    fn no_marker_kind_is_written_inside_a_text_only_parent() {
        // SHOW_IF still chooses its branch and LIST still repeats its body;
        // only their markers go. The same SHOW_IF in a `p` keeps them.
        let mut page = Page::new();
        let loading = page.slot(SlotValue::Bool(false));
        let name = page.slot(text("Ada"));
        let tags = page.slot(SlotValue::array(vec![text("x"), text("y")]));
        let tag = page.slot(SlotValue::Null);
        page.open("title", &[])
            .show_if(
                loading,
                |p| {
                    p.text("Loading");
                },
                |p| {
                    p.dyn_text(name);
                },
            )
            .text(" | ")
            .list(tags, tag, |p| {
                p.dyn_text(tag).text(";");
            })
            .close("title")
            .open("p", &[])
            .show_if(
                loading,
                |p| {
                    p.text("Loading");
                },
                |p| {
                    p.dyn_text(name);
                },
            )
            .close("p");
        assert_eq!(
            page.render(),
            "<title>Ada | x;y;</title>\
             <p><!--f:s0--><!--f:t1-->Ada<!--/f:t1--><!--/f:s0--></p>"
        );

        // An island marker would be text too.
        let mut page = Page::new();
        page.open("textarea", &[])
            .island(0, |p| {
                p.text("x");
            })
            .close("textarea")
            .island(1, |p| {
                p.open("div", &[]).close("div");
            });
        assert_eq!(
            page.render(),
            "<textarea>x</textarea><!--f:i1--><div data-forma-island=\"1\" \
             data-forma-component=\"Island1\" data-forma-status=\"pending\" \
             data-forma-hydrate=\"load\"></div><!--/f:i1-->"
        );
    }

    #[test]
    fn a_textarea_value_binding_is_written_as_its_text() {
        // `<textarea value>` is a property: HTML ignores the attribute, so the
        // server shipped an empty control. The client writes
        // `value == null ? '' : String(value)`, and so does the walker.
        let cases = [
            (text("hello"), "hello"),
            (
                text("</textarea><script>x</script>"),
                "&lt;/textarea&gt;&lt;script&gt;x&lt;/script&gt;",
            ),
            (text("\nhello"), "\n\nhello"),
            (SlotValue::Null, ""),
            (SlotValue::Number(0.0), "0"),
            (SlotValue::Bool(false), "false"),
        ];
        for (value, inner) in cases {
            let mut page = Page::new();
            let v = page.slot(value.clone());
            let note = page.slot(text("note"));
            page.open("textarea", &[("name", "t")])
                .dyn_attr("value", v)
                .close("textarea")
                .open("p", &[])
                .dyn_text(note)
                .close("p");
            assert_eq!(
                page.render(),
                format!(
                    "<textarea name=\"t\">{inner}</textarea><p><!--f:t1-->note<!--/f:t1--></p>"
                ),
                "value {value:?}"
            );
        }

        // The static form, `<textarea value="hello">`, is the same property.
        let mut page = Page::new();
        page.open("textarea", &[("name", "t"), ("value", "hello")])
            .close("textarea");
        assert_eq!(page.render(), "<textarea name=\"t\">hello</textarea>");
    }

    #[test]
    fn a_textarea_value_binding_wins_over_its_children() {
        // The live control shows the bound value whatever its children say,
        // so the server writes the value and not the children.
        let mut page = Page::new();
        let v = page.slot(text("bound"));
        let child = page.slot(text("child"));
        page.open("textarea", &[])
            .dyn_attr("value", v)
            .dyn_text(child)
            .text(" default")
            .close("textarea")
            .open("p", &[])
            .dyn_text(child)
            .close("p");
        assert_eq!(
            page.render(),
            "<textarea>bound</textarea><p><!--f:t1-->child<!--/f:t1--></p>"
        );
    }

    /// `<select name="c" value={value}>` over options a, b and c, each label
    /// distinct from its value so a match on the wrong one shows.
    fn select_page(value: SlotValue) -> String {
        let mut page = Page::new();
        let v = page.slot(value);
        page.open("select", &[("name", "c")]).dyn_attr("value", v);
        for (value, label) in [("a", "Apple"), ("b", "Banana"), ("c", "Cherry")] {
            page.open("option", &[("value", value)])
                .text(label)
                .close("option");
        }
        page.close("select");
        page.render()
    }

    fn option(value: &str, label: &str, selected: bool) -> String {
        let selected = if selected { " selected" } else { "" };
        format!("<option value=\"{value}\"{selected}>{label}</option>")
    }

    #[test]
    fn a_select_value_binding_selects_the_matching_option() {
        // HTML ignores `value` on a select, so the server used to ship the
        // first option selected, and a form submitted it before JavaScript.
        for (value, chosen) in [("a", "a"), ("b", "b"), ("c", "c"), ("z", "")] {
            let expected = format!(
                "<select name=\"c\">{}{}{}</select>",
                option("a", "Apple", chosen == "a"),
                option("b", "Banana", chosen == "b"),
                option("c", "Cherry", chosen == "c"),
            );
            assert_eq!(select_page(text(value)), expected, "value {value}");
        }
    }

    #[test]
    fn a_select_value_binding_compares_as_the_client_string() {
        // `String(2)` is "2"; `null` is '' (the placeholder option).
        for (value, chosen) in [(SlotValue::Number(2.0), "2"), (SlotValue::Null, "")] {
            let mut page = Page::new();
            let v = page.slot(value.clone());
            page.open("select", &[]).dyn_attr("value", v);
            for (value, label) in [("", "Choose"), ("1", "One"), ("2", "Two")] {
                page.open("option", &[("value", value)])
                    .text(label)
                    .close("option");
            }
            page.close("select");
            // An empty static attribute is written bare (`emit_open_tag`).
            let placeholder = if chosen.is_empty() {
                "<option value selected>Choose</option>"
            } else {
                "<option value>Choose</option>"
            };
            let expected = format!(
                "<select>{placeholder}{}{}</select>",
                option("1", "One", chosen == "1"),
                option("2", "Two", chosen == "2"),
            );
            assert_eq!(page.render(), expected, "value {value:?}");
        }
    }

    #[test]
    fn a_select_value_binding_matches_an_option_without_a_value_by_its_text() {
        // An option without `value` is valued by its text, stripped and
        // collapsed: `<option> Dark \n green </option>` is "Dark green".
        let render = |value: &str| {
            let mut page = Page::new();
            let v = page.slot(text(value));
            let label = page.slot(text("Blue"));
            page.open("select", &[])
                .dyn_attr("value", v)
                .open("option", &[])
                .text("Red")
                .close("option")
                .open("option", &[])
                .text(" Dark \n  green ")
                .close("option")
                .open("option", &[])
                .dyn_text(label)
                .close("option")
                .close("select");
            page.render()
        };
        assert_eq!(
            render("Dark green"),
            "<select><option>Red</option><option selected> Dark \n  green </option>\
             <option><!--f:t1-->Blue<!--/f:t1--></option></select>"
        );
        assert_eq!(
            render("Blue"),
            "<select><option>Red</option><option> Dark \n  green </option>\
             <option selected><!--f:t1-->Blue<!--/f:t1--></option></select>"
        );
    }

    #[test]
    fn a_select_value_binding_reaches_options_rendered_by_a_list() {
        // A combination (P2): list rows, PROP, a dynamic attribute and the
        // select. Labels differ from values, so an option that lost its
        // `value` and fell back to its text would match nothing. Three rows,
        // then 45 with the match past row 32 (TESTING.md P4's depth floor).
        let short: Vec<(String, String)> = [("a", "Apple"), ("b", "Banana"), ("c", "Cherry")]
            .iter()
            .map(|(id, label)| (id.to_string(), label.to_string()))
            .collect();
        let long: Vec<(String, String)> = (0..45)
            .map(|i| (format!("r{i}"), format!("Row {i}")))
            .collect();
        let cases: [(&[(String, String)], &str, usize); 4] = [
            (&short, "a", 0),
            (&short, "c", 2),
            (&long, "r40", 40),
            (&long, "r44", 44),
        ];
        for (rows_in, value, chosen) in cases {
            let mut page = Page::new();
            let v = page.slot(text(value));
            let rows = rows_in
                .iter()
                .map(|(id, label)| {
                    SlotValue::object(vec![
                        ("id".to_string(), text(id)),
                        ("label".to_string(), text(label)),
                    ])
                })
                .collect();
            let items = page.slot(SlotValue::array(rows));
            let item = page.slot(SlotValue::Null);
            let id = page.slot(SlotValue::Null);
            let label = page.slot(SlotValue::Null);
            page.open("select", &[])
                .dyn_attr("value", v)
                .list(items, item, |p| {
                    p.prop(item, "id", id)
                        .prop(item, "label", label)
                        .open("option", &[])
                        .dyn_attr("value", id)
                        .dyn_text(label)
                        .close("option");
                })
                .close("select");
            let expected: String = rows_in
                .iter()
                .enumerate()
                .map(|(i, (id, label))| {
                    let selected = if i == chosen { " selected" } else { "" };
                    format!(
                        "<option value=\"{id}\"{selected}><!--f:t4-->{label}<!--/f:t4--></option>"
                    )
                })
                .collect();
            assert_eq!(
                page.render(),
                format!("<select><!--f:l1-->{expected}<!--/f:l1--></select>"),
                "value {value}"
            );
        }
    }

    #[test]
    fn a_select_binding_ends_with_its_select() {
        // A `datalist` option after a bound select is a suggestion, not a
        // choice: the binding must not reach it. The select has no option
        // valued "b", so its single match is still unspent when the datalist
        // opens; only ending the binding at `</select>` keeps it off.
        let mut page = Page::new();
        let v = page.slot(text("b"));
        page.open("select", &[])
            .dyn_attr("value", v)
            .open("option", &[("value", "a")])
            .text("A")
            .close("option")
            .close("select")
            .open("datalist", &[])
            .open("option", &[("value", "b")])
            .text("B")
            .close("option")
            .close("datalist");
        assert_eq!(
            page.render(),
            format!(
                "<select>{}</select><datalist>{}</datalist>",
                option("a", "A", false),
                option("b", "B", false)
            )
        );
    }

    #[test]
    fn an_options_first_value_attribute_is_its_value() {
        // `<option value="a" value="b">`: the parser keeps the first of two
        // same-named attributes, so the option's value is "a".
        for (bound, selected) in [("a", " selected"), ("b", "")] {
            let mut page = Page::new();
            let v = page.slot(text(bound));
            let second = page.slot(text("b"));
            page.open("select", &[])
                .dyn_attr("value", v)
                .open("option", &[("value", "a")])
                .dyn_attr("value", second)
                .text("Only")
                .close("option")
                .close("select");
            assert_eq!(
                page.render(),
                format!("<select><option value=\"a\" value=\"b\"{selected}>Only</option></select>"),
                "bound to {bound}"
            );
        }
    }

    #[test]
    fn multiple_counts_only_when_the_attribute_is_written() {
        // A `DYN_ATTR multiple` that is false writes no attribute, so the
        // select is single and an array value is `String(array)`, "a,c",
        // which matches none of these options. True writes it, and the
        // array then selects each member.
        for (multiple, attr, chosen) in [(false, "", false), (true, " multiple", true)] {
            let mut page = Page::new();
            let flag = page.slot(SlotValue::Bool(multiple));
            let v = page.slot(SlotValue::array(vec![text("a"), text("c")]));
            page.open("select", &[])
                .dyn_attr("multiple", flag)
                .dyn_attr("value", v);
            for (value, label) in [("a", "Apple"), ("b", "Banana"), ("c", "Cherry")] {
                page.open("option", &[("value", value)])
                    .text(label)
                    .close("option");
            }
            page.close("select");
            assert_eq!(
                page.render(),
                format!(
                    "<select{attr}>{}{}{}</select>",
                    option("a", "Apple", chosen),
                    option("b", "Banana", false),
                    option("c", "Cherry", chosen)
                ),
                "multiple {multiple}"
            );
        }
    }

    #[test]
    fn a_null_member_of_a_multiple_value_compares_as_null() {
        // The client builds its set with `value.map(String)`, and
        // `String(null)` is "null", not '' as it is for a text hole.
        let mut page = Page::new();
        let v = page.slot(SlotValue::array(vec![SlotValue::Null, text("b")]));
        page.open("select", &[("multiple", "")])
            .dyn_attr("value", v);
        for (value, label) in [("null", "Null"), ("x", "Empty"), ("b", "Banana")] {
            page.open("option", &[("value", value)])
                .text(label)
                .close("option");
        }
        page.close("select");
        // The middle option's static value cannot be empty (it would be
        // written bare), so it is `x`; the empty-string case is the
        // placeholder in `a_select_value_binding_compares_as_the_client_string`.
        assert_eq!(
            page.render(),
            format!(
                "<select multiple>{}{}{}</select>",
                option("null", "Null", true),
                option("x", "Empty", false),
                option("b", "Banana", true)
            )
        );
    }

    #[test]
    fn an_option_ends_at_the_next_option_or_optgroup() {
        // `</option>` is optional: the parser ends an option at the next
        // `<option>` or `<optgroup>`, and an option valued by its text is
        // valued by the text up to there.
        let mut page = Page::new();
        let v = page.slot(text("A"));
        page.open("select", &[])
            .dyn_attr("value", v)
            .open("option", &[])
            .text("A")
            .open("option", &[])
            .text("B")
            .close("select");
        assert_eq!(
            page.render(),
            "<select><option selected>A<option>B</select>",
            "ended by <option>"
        );

        let mut page = Page::new();
        let v = page.slot(text("A"));
        page.open("select", &[])
            .dyn_attr("value", v)
            .open("option", &[])
            .text("A")
            .open("optgroup", &[("label", "g")])
            .open("option", &[("value", "x")])
            .text("X")
            .close("option")
            .close("optgroup")
            .close("select");
        assert_eq!(
            page.render(),
            "<select><option selected>A<optgroup label=\"g\">\
             <option value=\"x\">X</option></optgroup></select>",
            "ended by <optgroup>"
        );
    }

    #[test]
    fn a_single_select_selects_only_the_first_matching_option() {
        // `select.value = v` selects the first option with that value. Two
        // `selected` options would let the parser keep the last instead.
        let mut page = Page::new();
        let v = page.slot(text("b"));
        page.open("select", &[])
            .dyn_attr("value", v)
            .open("option", &[("value", "b")])
            .text("First")
            .close("option")
            .open("option", &[("value", "b")])
            .text("Second")
            .close("option")
            .close("select");
        assert_eq!(
            page.render(),
            format!(
                "<select>{}{}</select>",
                option("b", "First", true),
                option("b", "Second", false)
            )
        );
    }

    #[test]
    fn a_multiple_select_selects_every_option_in_an_array_value() {
        // The client selects each option whose value is in the array, for a
        // `multiple` select only. A single select takes `String(array)`,
        // "a,c", which matches none of these options.
        let render = |attrs: &[(&str, &str)]| {
            let mut page = Page::new();
            let v = page.slot(SlotValue::array(vec![text("a"), text("c")]));
            page.open("select", attrs).dyn_attr("value", v);
            for (value, label) in [("a", "Apple"), ("b", "Banana"), ("c", "Cherry")] {
                page.open("option", &[("value", value)])
                    .text(label)
                    .close("option");
            }
            page.close("select");
            page.render()
        };
        assert_eq!(
            render(&[("multiple", "")]),
            format!(
                "<select multiple>{}{}{}</select>",
                option("a", "Apple", true),
                option("b", "Banana", false),
                option("c", "Cherry", true)
            )
        );
        assert_eq!(
            render(&[]),
            format!(
                "<select>{}{}{}</select>",
                option("a", "Apple", false),
                option("b", "Banana", false),
                option("c", "Cherry", false)
            )
        );
    }

    #[test]
    fn a_bound_select_overrides_authored_selected_on_its_options() {
        // The binding decides, as it does on the client. An unbound select
        // keeps what the author wrote, static and dynamic.
        let render = |bound: bool| {
            let mut page = Page::new();
            let v = page.slot(text("a"));
            let on = page.slot(SlotValue::Bool(true));
            page.open("select", &[]);
            if bound {
                page.dyn_attr("value", v);
            }
            page.open("option", &[("value", "a")])
                .text("A")
                .close("option")
                .open("option", &[("value", "b"), ("selected", "")])
                .text("B")
                .close("option")
                .open("option", &[("value", "c")])
                .dyn_attr("selected", on)
                .text("C")
                .close("option")
                .close("select");
            page.render()
        };
        assert_eq!(
            render(true),
            format!(
                "<select>{}{}{}</select>",
                option("a", "A", true),
                option("b", "B", false),
                option("c", "C", false)
            )
        );
        assert_eq!(
            render(false),
            format!(
                "<select>{}{}{}</select>",
                option("a", "A", false),
                option("b", "B", true),
                option("c", "C", true)
            )
        );
    }

    #[test]
    fn a_static_select_value_attribute_selects_its_option() {
        let mut page = Page::new();
        page.open("select", &[("value", "b")])
            .open("option", &[("value", "a")])
            .text("A")
            .close("option")
            .open("option", &[("value", "b")])
            .text("B")
            .close("option")
            .close("select");
        assert_eq!(
            page.render(),
            format!(
                "<select>{}{}</select>",
                option("a", "A", false),
                option("b", "B", true)
            )
        );
    }

    #[test]
    fn the_context_rules_hold_in_an_island_fragment() {
        // The internal fragment path must write what the
        // full page writes for the same island (P2).
        let mut page = Page::new();
        let body = page.slot(text("hello"));
        let choice = page.slot(text("b"));
        page.island(0, |p| {
            p.open("form", &[])
                .open("textarea", &[])
                .dyn_text(body)
                .close("textarea")
                .open("select", &[])
                .dyn_attr("value", choice)
                .open("option", &[("value", "a")])
                .text("A")
                .close("option")
                .open("option", &[("value", "b")])
                .text("B")
                .close("option")
                .close("select")
                .close("form");
        });
        let inner = format!(
            "<textarea>hello</textarea><select>{}{}</select>",
            option("a", "A", false),
            option("b", "B", true)
        );
        let full = page.render();
        let fragment = page.render_island(0);
        for (path, html) in [("walk_to_html", &full), ("walk_island", &fragment)] {
            assert!(html.contains(&inner), "{path}: {html}");
        }
        assert!(
            full.starts_with("<!--f:i0--><form data-forma-island=\"0\""),
            "{full}"
        );
    }

    // -- Counted walk (FORMA-120) -------------------------------------------

    /// A "Branding" island: `<div>` + the tenant's name + one `<i>` per colour.
    ///
    /// Strings: 0 div, 1 Branding, 2 i, 3 name, 4 colors, 5 color.
    /// Slots: 0 name (text), 1 colors (array), 2 color (the row's item).
    fn branding_module() -> IrModule {
        let mut row = encode_open_tag(2, &[]);
        row.extend_from_slice(&encode_dyn_text(2, 1));
        row.extend_from_slice(&encode_close_tag(2));
        let mut ops = encode_island_start(0);
        ops.extend_from_slice(&encode_open_tag(0, &[]));
        ops.extend_from_slice(&encode_dyn_text(0, 0));
        ops.extend_from_slice(&encode_list(1, 2, &row));
        ops.extend_from_slice(&encode_close_tag(0));
        ops.extend_from_slice(&encode_island_end(0));
        let data = build_minimal_ir(
            &["div", "Branding", "i", "name", "colors", "color"],
            &[
                (0, 3, 0x01, 0x00, &[]),
                (1, 4, 0x04, 0x00, &[]),
                (2, 5, 0x01, 0x00, &[]),
            ],
            &ops,
            &[(0, 0x01, 0x01, 1, 0, &[])],
        );
        IrModule::parse(&data).unwrap()
    }

    fn branding(name: &str, colors: usize) -> SlotData {
        let mut slots = SlotData::new(3);
        slots.set(0, SlotValue::Text(name.to_string()));
        slots.set(
            1,
            SlotValue::array(
                (0..colors)
                    .map(|i| SlotValue::Text(format!("c{i}")))
                    .collect(),
            ),
        );
        slots
    }

    #[test]
    fn counted_walk_writes_what_walk_to_html_writes_and_counts_it() {
        let module = branding_module();
        let slots = branding("Acme", 3);
        let out = walk_to_html_counted(&module, &slots, WalkLimits::default()).unwrap();

        assert_eq!(out.html, walk_to_html(&module, &slots).unwrap());
        assert_eq!(out.counts.bytes, out.html.len());
        // div + the name's text + 3 x (i + its text) = 8 nodes; markers and
        // comments are not nodes.
        assert_eq!(out.counts.nodes, 8);
        assert_eq!(out.counts.list_iterations, 3);
    }

    #[test]
    fn counted_walk_returns_the_counts_reached_when_a_budget_stops_it() {
        let module = branding_module();

        // The list budget: 5 rows allowed, 9 asked for. The list is refused
        // before its first row (FORMA-122): the div and the name were written.
        let limits = WalkLimits {
            max_list_iterations: 5,
            ..WalkLimits::default()
        };
        let failure = walk_to_html_counted(&module, &branding("Acme", 9), limits).unwrap_err();
        assert_eq!(failure.error, IrError::ListBudgetExceeded { max: 5 });
        assert_eq!(failure.counts.list_iterations, 0);
        assert_eq!(failure.counts.nodes, 2);
        assert_eq!(failure.component_path, vec!["Branding".to_string()]);
        assert!(failure.counts.bytes > 0);

        // The output budget, set to stop the walk part-way down the list: it
        // stops inside the limit, never past it, and says how far it got.
        let limits = WalkLimits {
            max_output_bytes: 400,
            ..WalkLimits::default()
        };
        let failure = walk_to_html_counted(&module, &branding("Acme", 50), limits).unwrap_err();
        assert_eq!(failure.error, IrError::OutputLimitExceeded { limit: 400 });
        let counts = failure.counts;
        assert!(counts.bytes <= 400 && counts.bytes > 300, "{counts:?}");
        assert!(
            counts.list_iterations > 1 && counts.list_iterations < 50,
            "{counts:?}"
        );
        assert!(
            counts.nodes >= 2 + 2 * (counts.list_iterations - 1),
            "{counts:?}"
        );
        assert_eq!(failure.component_path, vec!["Branding".to_string()]);
    }

    #[test]
    fn counted_walk_names_no_component_for_a_failure_outside_every_island() {
        // Invalid HTML names remain a render error; bad indices now fail at load.
        let mut ops = encode_open_tag(0, &[]);
        ops.extend_from_slice(&encode_open_tag(1, &[]));
        let data = build_minimal_ir(&["p", "bad name"], &[], &ops, &[]);
        let module = IrModule::parse(&data).unwrap();
        let failure =
            walk_to_html_counted(&module, &SlotData::new(0), WalkLimits::default()).unwrap_err();
        assert_eq!(failure.error, IrError::InvalidName("bad name".into()));
        assert!(failure.component_path.is_empty());
        assert_eq!(failure.counts.nodes, 1);
    }

    #[test]
    fn counted_walk_names_every_island_around_a_failure_outermost_first() {
        // Outer "Shell" > inner "Card", the failure inside "Card", and a
        // closed sibling island before it that must not appear in the path.
        // Strings: 0 div, 1 Shell, 2 Card, 3 Done, 4 x.
        let mut ops = encode_island_start(0); // Shell, at byte 0
        ops.extend_from_slice(&encode_open_tag(0, &[]));
        let done_at = ops.len() as u32;
        ops.extend_from_slice(&encode_island_start(2)); // Done
        ops.extend_from_slice(&encode_open_tag(0, &[]));
        ops.extend_from_slice(&encode_close_tag(0));
        ops.extend_from_slice(&encode_island_end(2));
        let card_at = ops.len() as u32;
        ops.extend_from_slice(&encode_island_start(1)); // Card
        ops.extend_from_slice(&encode_open_tag(0, &[]));
        ops.extend_from_slice(&encode_open_tag(4, &[])); // invalid HTML name fails here
        ops.extend_from_slice(&encode_close_tag(0));
        ops.extend_from_slice(&encode_island_end(1));
        ops.extend_from_slice(&encode_close_tag(0));
        ops.extend_from_slice(&encode_island_end(0));
        let data = build_minimal_ir(
            &["div", "Shell", "Card", "Done", "bad name"],
            &[],
            &ops,
            &[
                (0, 0x01, 0x01, 1, 0, &[]),
                (1, 0x01, 0x01, 2, card_at, &[]),
                (2, 0x01, 0x01, 3, done_at, &[]),
            ],
        );
        let module = IrModule::parse(&data).unwrap();
        let failure =
            walk_to_html_counted(&module, &SlotData::new(0), WalkLimits::default()).unwrap_err();
        assert_eq!(
            failure.component_path,
            vec!["Shell".to_string(), "Card".to_string()]
        );
    }

    #[test]
    fn the_fault_trigger_is_armed_only_by_the_counted_walk() {
        // With the trigger compiled in (this crate's tests), the uncaught
        // 0.2.1 path renders the value as text; only the counted walk, which
        // catches the panic, ever takes it.
        let module = branding_module();
        let slots = branding(crate::fault_injection::FAULT_TRIGGER, 1);
        let html = walk_to_html(&module, &slots).expect("walk_to_html never arms it");
        assert!(html.contains("forma-test-fault"), "{html}");
        let failure = walk_to_html_counted(&module, &slots, WalkLimits::default()).unwrap_err();
        assert!(matches!(failure.error, IrError::Panicked { .. }));
    }

    #[test]
    fn counted_walk_catches_a_panic_and_names_its_island() {
        // SR44's stand-in: a component that panics on one tenant's data. The
        // trigger exists only in test builds and under the internal
        // `__fault-injection` feature.
        let module = branding_module();
        let slots = branding(crate::fault_injection::FAULT_TRIGGER, 2);
        let failure = walk_to_html_counted(&module, &slots, WalkLimits::default()).unwrap_err();
        match &failure.error {
            IrError::Panicked { message } => {
                assert!(message.contains("stand-in"), "{message}")
            }
            other => panic!("expected Panicked, got {other:?}"),
        }
        assert_eq!(failure.component_path, vec!["Branding".to_string()]);
        // ...and the next walk, on the same module, renders.
        let out =
            walk_to_html_counted(&module, &branding("Acme", 2), WalkLimits::default()).unwrap();
        assert!(out.html.contains("Acme"));
    }

    // -- A list's length checked before its first row (FORMA-122, DR-13) ------

    /// `<div>` around one LIST per entry of `lists`, each over its own slot
    /// (slot 2k, item slot 2k+1) and writing `<i>` + the item per row; a list
    /// may nest an inner LIST over the item slot's array.
    fn lists_module(lists: usize, nested: bool) -> IrModule {
        let mut ops = encode_open_tag(0, &[]);
        let mut slots: Vec<(u16, u32, u8, u8, &[u8])> = Vec::new();
        for k in 0..lists as u16 {
            let (list_slot, item_slot) = (2 * k, 2 * k + 1);
            let mut row = encode_open_tag(1, &[]);
            if nested {
                // the inner list iterates the row's item, itself an array,
                // binding its rows to slot 2*lists (shared, rebound per row)
                let inner_item = 2 * lists as u16;
                let mut inner_row = encode_open_tag(1, &[]);
                inner_row.extend_from_slice(&encode_close_tag(1));
                row.extend_from_slice(&encode_list(item_slot, inner_item, &inner_row));
            }
            row.extend_from_slice(&encode_close_tag(1));
            ops.extend_from_slice(&encode_list(list_slot, item_slot, &row));
            slots.push((list_slot, 2, 0x04, 0x00, &[]));
            slots.push((item_slot, 3, if nested { 0x04 } else { 0x01 }, 0x00, &[]));
        }
        if nested {
            slots.push((2 * lists as u16, 3, 0x01, 0x00, &[]));
        }
        ops.extend_from_slice(&encode_close_tag(0));
        let data = build_minimal_ir(&["div", "i", "items", "item"], &slots, &ops, &[]);
        IrModule::parse(&data).unwrap()
    }

    fn rows(n: usize) -> SlotValue {
        SlotValue::array((0..n).map(|_| SlotValue::Text("x".into())).collect())
    }

    fn limits(max_list_iterations: usize) -> WalkLimits {
        WalkLimits {
            max_list_iterations,
            ..WalkLimits::default()
        }
    }

    #[test]
    fn a_list_longer_than_the_remaining_budget_fails_before_its_first_row() {
        // SR38: one row too many, and not one row is walked.
        let module = lists_module(1, false);
        let mut slots = SlotData::new(2);
        slots.set(0, rows(51));
        let failure = walk_to_html_counted(&module, &slots, limits(50)).unwrap_err();
        assert_eq!(failure.error, IrError::ListBudgetExceeded { max: 50 });
        assert_eq!(failure.counts.list_iterations, 0);
        assert_eq!(failure.counts.nodes, 1, "only the wrapping div was written");

        // The negative space: exactly the budget renders, every row.
        slots.set(0, rows(50));
        let out = walk_to_html_counted(&module, &slots, limits(50)).unwrap();
        assert_eq!(out.counts.list_iterations, 50);
        assert_eq!(out.html.matches("<i>").count(), 50);
    }

    #[test]
    fn a_list_exactly_at_the_remaining_budget_still_renders() {
        // The budget is per render: a first list spends 20 of 50 rows, so a
        // second of exactly 30 renders and one of 31 fails before its first.
        let module = lists_module(2, false);
        let mut slots = SlotData::new(4);
        slots.set(0, rows(20));
        slots.set(2, rows(30));
        let out = walk_to_html_counted(&module, &slots, limits(50)).unwrap();
        assert_eq!(out.counts.list_iterations, 50);
        assert_eq!(out.html.matches("<i>").count(), 50);

        slots.set(2, rows(31));
        let failure = walk_to_html_counted(&module, &slots, limits(50)).unwrap_err();
        assert_eq!(failure.error, IrError::ListBudgetExceeded { max: 50 });
        assert_eq!(
            failure.counts.list_iterations, 20,
            "the first list, and no more"
        );
        assert_eq!(failure.counts.nodes, 1 + 20);
    }

    #[test]
    fn a_nested_list_is_checked_against_what_its_parents_left() {
        // 3 outer rows of 20 inner rows each, under 59: the outer list fits
        // (3 <= 59); rows and inner rows spend 1 + 20 + 1 + 20 + 1 = 43; the
        // third inner list (20 > 16 left) fails at its entry. At 0.2.1 the
        // walk ran 16 of its rows first.
        let module = lists_module(1, true);
        let mut slots = SlotData::new(3);
        slots.set(0, SlotValue::array((0..3).map(|_| rows(20)).collect()));
        let failure = walk_to_html_counted(&module, &slots, limits(59)).unwrap_err();
        assert_eq!(failure.error, IrError::ListBudgetExceeded { max: 59 });
        assert_eq!(failure.counts.list_iterations, 43);

        // In all, 3 outer and 60 inner rows: a budget of 63 renders, 62 does not.
        let out = walk_to_html_counted(&module, &slots, limits(63)).unwrap();
        assert_eq!(out.counts.list_iterations, 63);
        assert!(walk_to_html_counted(&module, &slots, limits(62)).is_err());
    }

    #[test]
    fn the_per_row_check_still_stops_a_list_whose_nested_rows_spend_the_budget() {
        // 3 outer rows of 11 inner rows under 24: every list fits on entry
        // (3 <= 24, 11 <= 23, 11 <= 11), and the inner rows spend the rest, so
        // the outer list's third row is the one refused, by the per-row check.
        let module = lists_module(1, true);
        let mut slots = SlotData::new(3);
        slots.set(0, SlotValue::array((0..3).map(|_| rows(11)).collect()));
        let failure = walk_to_html_counted(&module, &slots, limits(24)).unwrap_err();
        assert_eq!(failure.error, IrError::ListBudgetExceeded { max: 24 });
        assert_eq!(failure.counts.list_iterations, 24);
    }
}