From 80803cbec8fbfe67c504b15e45cd8e158507e01b Mon Sep 17 00:00:00 2001
From: Andrey Mnatsakanov <andrey@3ig.dev>
Date: Sun, 26 Jul 2026 11:04:02 +0200
Subject: [PATCH 01/17] fix(js): sync el.style with the style attribute in both
 directions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CSSStyleDeclaration was backed by an in-memory _props map that was never
bridged to the element's style content attribute. Parsed inline styles were
invisible to el.style.*, setAttribute('style', …) did not update el.style, and
el.style.x = … never reached the attribute or serialization; getComputedStyle
read the same disconnected declaration.

Give the declaration its owner element: lazily pull the style attribute into
_props on read (skipping the reparse when unchanged) and push _props back to the
attribute on every mutation. Owner-less declarations (getComputedStyle fallback,
stylesheet rules) stay purely in-memory, so their behavior is unchanged.

Fixes #488
---
 crates/obscura-js/js/bootstrap.js | 81 ++++++++++++++++++++++++-------
 crates/obscura-js/src/runtime.rs  | 60 +++++++++++++++++++++++
 2 files changed, 123 insertions(+), 18 deletions(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 4a0f53f..b8de04a 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -514,35 +514,77 @@ const _CSS_PROPERTY_NAMES = [
 ];
 const _CSS_PROP_SET = new Set(_CSS_PROPERTY_NAMES);
 
+// Parse a `style` attribute string (`"color: red; margin: 5px"`) into the given
+// dashed-key store, replacing its contents in place.
+function _parseCssInto(props, text) {
+  for (const k in props) delete props[k];
+  if (text) String(text).split(";").forEach((p) => {
+    const i = p.indexOf(":");
+    if (i > 0) { const k = p.slice(0, i).trim(); const v = p.slice(i + 1).trim(); if (k && v) props[_cssCamelToKebab(k)] = v; }
+  });
+}
+function _serializeCss(props) {
+  const e = Object.entries(props);
+  return e.length ? e.map(([k, v]) => `${k}: ${v}`).join("; ") + ";" : "";
+}
+
 class CSSStyleDeclaration {
-  constructor() {
-    // Non-enumerable so it never leaks through the proxy's own-key traps.
+  constructor(owner) {
+    // Non-enumerable so they never leak through the proxy's own-key traps.
     Object.defineProperty(this, "_props", { value: {}, writable: true, enumerable: false, configurable: true });
+    // The owner Element, if any. A live declaration reflects that element's
+    // `style` content attribute in both directions; an owner-less declaration
+    // (getComputedStyle fallback, stylesheet rules) is purely in-memory.
+    Object.defineProperty(this, "_owner", { value: owner || null, writable: true, enumerable: false, configurable: true });
+    // Last `style` attribute string we parsed/wrote, so a read can skip the
+    // reparse when the attribute has not changed underneath us. Held in a
+    // one-field object so the sync helpers can mutate it without a bare
+    // `this._x = …` assignment (which the style proxy would reroute into
+    // setProperty).
+    Object.defineProperty(this, "_sync", { value: { last: null }, writable: true, enumerable: false, configurable: true });
+  }
+  // Pull the owner's `style` attribute into `_props` if it changed since our
+  // last read/write. Keeps parsed HTML and setAttribute('style', …) visible via
+  // el.style.*. No-op when owner-less.
+  _pull() {
+    const o = this._owner;
+    if (!o) return;
+    const attr = o.getAttribute("style");
+    if (attr === this._sync.last) return;
+    _parseCssInto(this._props, attr);
+    this._sync.last = attr;
+  }
+  // Serialize `_props` back onto the owner's `style` attribute after a mutation,
+  // so el.style.x = … and cssText reflect into getAttribute('style') and
+  // serialization. No-op when owner-less.
+  _push() {
+    const o = this._owner;
+    if (!o) return;
+    const text = _serializeCss(this._props);
+    this._sync.last = text;
+    if (text) o.setAttribute("style", text);
+    else o.removeAttribute("style");
   }
   // Storage is keyed by the dashed CSS name, matching CSSOM. The proxy maps the
   // camelCase IDL access (el.style.fontSize) onto the dashed key (font-size), so
   // getPropertyValue('font-size') and el.style.fontSize stay in sync.
   setProperty(name, value) {
+    this._pull();
     const k = _cssCamelToKebab(String(name));
-    if (value === "" || value == null) { delete this._props[k]; return; }
-    this._props[k] = String(value);
+    if (value === "" || value == null) delete this._props[k];
+    else this._props[k] = String(value);
+    this._push();
   }
-  removeProperty(name) { const k = _cssCamelToKebab(String(name)); const old = this._props[k]; delete this._props[k]; return old || ""; }
-  getPropertyValue(name) { return this._props[_cssCamelToKebab(String(name))] || ""; }
+  removeProperty(name) { this._pull(); const k = _cssCamelToKebab(String(name)); const old = this._props[k]; delete this._props[k]; this._push(); return old || ""; }
+  getPropertyValue(name) { this._pull(); return this._props[_cssCamelToKebab(String(name))] || ""; }
   getPropertyPriority() { return ""; }
-  get cssText() {
-    const e = Object.entries(this._props);
-    return e.length ? e.map(([k, v]) => `${k}: ${v}`).join("; ") + ";" : "";
-  }
+  get cssText() { this._pull(); return _serializeCss(this._props); }
   set cssText(v) {
-    for (const k in this._props) delete this._props[k];
-    if (v) String(v).split(";").forEach((p) => {
-      const i = p.indexOf(":");
-      if (i > 0) { const k = p.slice(0, i).trim(); const val = p.slice(i + 1).trim(); if (k && val) this._props[_cssCamelToKebab(k)] = val; }
-    });
+    _parseCssInto(this._props, v);
+    this._push();
   }
-  get length() { return Object.keys(this._props).length; }
-  item(i) { return Object.keys(this._props)[i] || ""; }
+  get length() { this._pull(); return Object.keys(this._props).length; }
+  item(i) { this._pull(); return Object.keys(this._props)[i] || ""; }
 }
 
 const _styleProxy = (decl) => new Proxy(decl, {
@@ -561,11 +603,13 @@ const _styleProxy = (decl) => new Proxy(decl, {
   has(t, p) {
     if (typeof p !== "string") return Reflect.has(t, p);
     if (p in Object.getPrototypeOf(t)) return true;
+    t._pull();
     if (_cssCamelToKebab(p) in t._props) return true;
     if (_CSS_PROP_SET.has(p) || _CSS_PROP_SET.has(_cssKebabToCamel(p))) return true;
     return /^\d+$/.test(p) && +p < t.length;
   },
   ownKeys(t) {
+    t._pull();
     const keys = [];
     const n = t.length;
     for (let i = 0; i < n; i++) keys.push(String(i));
@@ -576,6 +620,7 @@ const _styleProxy = (decl) => new Proxy(decl, {
   },
   getOwnPropertyDescriptor(t, p) {
     if (typeof p !== "string") return Reflect.getOwnPropertyDescriptor(t, p);
+    t._pull();
     if (/^\d+$/.test(p) && +p < t.length) return { value: t.item(+p), writable: false, enumerable: true, configurable: true };
     if (_cssCamelToKebab(p) in t._props || _CSS_PROP_SET.has(p) || _CSS_PROP_SET.has(_cssKebabToCamel(p))) {
       return { value: t.getPropertyValue(p), writable: true, enumerable: true, configurable: true };
@@ -1180,7 +1225,7 @@ function _isSubmitButton(el) {
 class Element extends Node {
   constructor(nid) {
     super(nid);
-    this._style = _styleProxy(new CSSStyleDeclaration());
+    this._style = _styleProxy(new CSSStyleDeclaration(this));
   }
   // Element wrappers always back a nodeType-1 node (_wrap/_wrapEl only build an
   // Element for element nodes, and node ids are never freed-and-reused), so this
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index fdfeb4d..3fc4db0 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1317,6 +1317,66 @@ mod tests {
         rt
     }
 
+    #[test]
+    fn style_attribute_parses_into_style_object() {
+        // Inline styles present in the parsed HTML must be visible via el.style.*
+        let mut rt = setup_runtime(
+            r#"<html><body><div id="d" style="color: red; display: none">hi</div></body></html>"#,
+        );
+        assert_eq!(
+            rt.evaluate("document.getElementById('d').style.color").unwrap(),
+            serde_json::json!("red")
+        );
+        assert_eq!(
+            rt.evaluate("document.getElementById('d').style.display").unwrap(),
+            serde_json::json!("none")
+        );
+    }
+
+    #[test]
+    fn set_style_attribute_updates_style_object() {
+        let mut rt = setup_runtime(r#"<html><body><div id="d">hi</div></body></html>"#);
+        let margin = rt
+            .evaluate(
+                "(function(){var e=document.getElementById('d'); e.setAttribute('style','margin: 5px'); return e.style.margin;})()",
+            )
+            .unwrap();
+        assert_eq!(margin, serde_json::json!("5px"));
+    }
+
+    #[test]
+    fn setting_style_property_updates_the_attribute_and_serialization() {
+        let mut rt = setup_runtime(r#"<html><body><div id="d">hi</div></body></html>"#);
+        let attr = rt
+            .evaluate(
+                "(function(){var e=document.getElementById('d'); e.style.color='blue'; return e.getAttribute('style');})()",
+            )
+            .unwrap();
+        assert_eq!(attr, serde_json::json!("color: blue;"));
+        let html = rt
+            .evaluate("document.getElementById('d').outerHTML")
+            .unwrap();
+        assert!(
+            html.as_str().unwrap().contains("color: blue"),
+            "outerHTML should carry the style set via el.style: {html}"
+        );
+    }
+
+    #[test]
+    fn style_object_reflects_external_attribute_change() {
+        // A later setAttribute('style', …) must supersede an earlier value read
+        // through el.style (the declaration re-syncs from the attribute).
+        let mut rt = setup_runtime(
+            r#"<html><body><div id="d" style="color: red">hi</div></body></html>"#,
+        );
+        let color = rt
+            .evaluate(
+                "(function(){var e=document.getElementById('d'); e.style.color; e.setAttribute('style','color: green'); return e.style.color;})()",
+            )
+            .unwrap();
+        assert_eq!(color, serde_json::json!("green"));
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From 491ecfb0f1800b7d0c4680c724b88fc361ceb7e2 Mon Sep 17 00:00:00 2001
From: Andrey Mnatsakanov <andrey@3ig.dev>
Date: Sun, 26 Jul 2026 11:09:42 +0200
Subject: [PATCH 02/17] fix(js): clone nodes structurally instead of via
 div.innerHTML
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cloneNode(true) round-tripped through a throwaway <div>'s innerHTML, so the
HTML fragment parser discarded elements that are not valid children of <div>
(<tr>, <td>, <option>, <tbody>, …) — createElement('tr').cloneNode(true)
returned null — and JS-set inline styles were lost. The shallow path also
re-derived attributes by regex-scraping serialized HTML.

Clone structurally with real DOM APIs: shallow-clone each node via
createElement/createElementNS plus a getAttributeNames() attribute copy (no
parsing context, every attribute preserved), then descend into children with an
explicit stack so a deep subtree cannot overflow the JS stack. Text, Comment,
DocumentFragment and <template> contents are handled.

Fixes #490
---
 crates/obscura-js/js/bootstrap.js | 75 +++++++++++++++++++++----------
 crates/obscura-js/src/runtime.rs  | 52 +++++++++++++++++++++
 2 files changed, 104 insertions(+), 23 deletions(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 4a0f53f..3ce7268 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -584,6 +584,29 @@ const _styleProxy = (decl) => new Proxy(decl, {
   },
 });
 
+// Clone a single node (no children), used by Node.cloneNode. Elements are built
+// with createElement/createElementNS and their content attributes copied, so no
+// HTML parsing context is involved and every attribute (including style) is
+// preserved. Text/Comment/DocumentFragment map to their factory; anything else
+// yields null.
+function _shallowCloneNode(node) {
+  const nt = node.nodeType;
+  if (nt === 3) return document.createTextNode(node.data != null ? node.data : (node.textContent || ""));
+  if (nt === 8) return document.createComment(node.data != null ? node.data : (node.nodeValue || ""));
+  if (nt === 11) return document.createDocumentFragment();
+  if (nt !== 1) return null;
+  const ns = node.namespaceURI;
+  const el = (ns && ns !== "http://www.w3.org/1999/xhtml")
+    ? document.createElementNS(ns, node.nodeName)
+    : document.createElement(node.localName || node.nodeName.toLowerCase());
+  const names = node.getAttributeNames ? node.getAttributeNames() : [];
+  for (const name of names) {
+    const v = node.getAttribute(name);
+    if (v !== null) el.setAttribute(name, v);
+  }
+  return el;
+}
+
 class Node {
   static ELEMENT_NODE = 1;
   static ATTRIBUTE_NODE = 2;
@@ -774,32 +797,38 @@ class Node {
   contains(o) { return o ? _dom("contains", this._nid, o._nid) === "true" : false; }
   hasChildNodes() { return _dom("has_child_nodes", this._nid) === "true"; }
   cloneNode(deep) {
-    const t = this.nodeType;
-    if (t === 1) {
-      if (deep) {
-        const wrapper = document.createElement('div');
-        wrapper.innerHTML = _domParse("outer_html", this._nid) || "";
-        const clone = wrapper.firstChild;
-        return clone;
-      }
-      const el = document.createElement(this.nodeName.toLowerCase());
-      const html = _domParse("outer_html", this._nid) || "";
-      const attrMatch = html.match(/^<[a-zA-Z][^\s>]*([\s\S]*?)>/);
-      if (attrMatch && attrMatch[1]) {
-        const attrStr = attrMatch[1].trim();
-        const re = /([a-zA-Z_:][a-zA-Z0-9_.:-]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|(\S+)))?/g;
-        let m;
-        while ((m = re.exec(attrStr)) !== null) {
-          const name = m[1];
-          const val = m[2] !== undefined ? m[2] : m[3] !== undefined ? m[3] : m[4] || "";
-          if (name !== this.nodeName.toLowerCase()) el.setAttribute(name, val);
+    // Clone structurally via real DOM nodes rather than round-tripping through a
+    // throwaway <div>.innerHTML: the fragment parser discards elements that are
+    // not valid children of <div> (<tr>, <td>, <option>, …), so the old path
+    // returned null for them and lost JS-set inline styles. Building each node
+    // directly with createElement(NS) + attribute copy avoids any parsing
+    // context, and an explicit stack keeps a deep subtree from overflowing the
+    // JS stack (issue #490).
+    const root = _shallowCloneNode(this);
+    if (!deep || !root) return root;
+    const stack = [[this, root]];
+    while (stack.length) {
+      const [src, dst] = stack.pop();
+      // A <template>'s children hang off its content fragment, not childNodes,
+      // so clone them into the clone's fragment. Gated on the tag name because
+      // .content means something else on other elements (e.g. <meta>).
+      if (src.localName === 'template' && dst.localName === 'template') {
+        const sc = src.content, dc = dst.content;
+        if (sc && dc && sc.childNodes) {
+          const tk = sc.childNodes;
+          for (let i = 0; i < tk.length; i++) {
+            const c = _shallowCloneNode(tk[i]);
+            if (c) { dc.appendChild(c); stack.push([tk[i], c]); }
+          }
         }
       }
-      return el;
+      const kids = src.childNodes;
+      for (let i = 0; i < kids.length; i++) {
+        const c = _shallowCloneNode(kids[i]);
+        if (c) { dst.appendChild(c); stack.push([kids[i], c]); }
+      }
     }
-    if (t === 3) return document.createTextNode(this.textContent);
-    if (t === 8) return document.createComment(this.nodeValue || "");
-    return null;
+    return root;
   }
   compareDocumentPosition(other) {
     if (!other) return 0;
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index fdfeb4d..94bc177 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1317,6 +1317,58 @@ mod tests {
         rt
     }
 
+    #[test]
+    fn clone_node_deep_preserves_context_sensitive_elements() {
+        // A <tr> is not a valid child of <div>, so cloning through a throwaway
+        // <div>.innerHTML dropped it and returned null. A structural clone keeps it.
+        let mut rt = setup_runtime("<html><body></body></html>");
+        let tag = rt
+            .evaluate("(document.createElement('tr').cloneNode(true) || {}).tagName || 'NULL'")
+            .unwrap();
+        assert_eq!(tag, serde_json::json!("TR"));
+        let td = rt
+            .evaluate("(document.createElement('td').cloneNode(true) || {}).tagName || 'NULL'")
+            .unwrap();
+        assert_eq!(td, serde_json::json!("TD"));
+    }
+
+    #[test]
+    fn clone_node_deep_copies_children_and_attributes() {
+        let mut rt = setup_runtime(r#"<html><body><ul id="l"><li class="a">one</li><li class="b">two</li></ul></body></html>"#);
+        let out = rt
+            .evaluate(
+                "(function(){var c=document.getElementById('l').cloneNode(true); return c.children.length + '|' + c.children[0].className + '|' + c.children[1].textContent;})()",
+            )
+            .unwrap();
+        assert_eq!(out, serde_json::json!("2|a|two"));
+    }
+
+    #[test]
+    fn clone_node_deep_preserves_table_rows() {
+        let mut rt = setup_runtime(
+            r#"<html><body><table id="t"><tbody><tr><td>1</td><td>2</td></tr></tbody></table></body></html>"#,
+        );
+        // Navigate the detached clone directly (querySelector does not traverse
+        // detached subtrees). tbody > tr > (td, td).
+        let out = rt
+            .evaluate(
+                "(function(){var tb=document.querySelector('#t tbody').cloneNode(true); var tr=tb.children[0]; return tr.tagName + '|' + tr.children.length + '|' + tr.children[1].textContent;})()",
+            )
+            .unwrap();
+        assert_eq!(out, serde_json::json!("TR|2|2"));
+    }
+
+    #[test]
+    fn clone_node_shallow_copies_attributes_without_children() {
+        let mut rt = setup_runtime(r#"<html><body><div id="d" data-x="7"><span>kid</span></div></body></html>"#);
+        let out = rt
+            .evaluate(
+                "(function(){var c=document.getElementById('d').cloneNode(false); return c.getAttribute('data-x') + '|' + c.childNodes.length;})()",
+            )
+            .unwrap();
+        assert_eq!(out, serde_json::json!("7|0"));
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From 52e110b67ca891f3720232b3ca863ad941961491 Mon Sep 17 00:00:00 2001
From: Andrey Mnatsakanov <andrey@3ig.dev>
Date: Sun, 26 Jul 2026 12:41:12 +0200
Subject: [PATCH 03/17] fix(dom): guard DomTree::remove() against OOB and
 double-free

remove() freed a node and its descendants by directly indexing inner.nodes and
unconditionally pushing each slot onto the free list. An out-of-range id panicked
out-of-bounds, and removing an already-freed node pushed its slot a second time,
so two later allocations could be handed the same NodeId (aliasing/corruption).
Free a slot only when it is currently live, via checked access.

Fixes #500
---
 crates/obscura-dom/src/tree.rs | 40 ++++++++++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/crates/obscura-dom/src/tree.rs b/crates/obscura-dom/src/tree.rs
index 01db8af..8ca2475 100644
--- a/crates/obscura-dom/src/tree.rs
+++ b/crates/obscura-dom/src/tree.rs
@@ -469,12 +469,20 @@ impl DomTree {
             inner.id_index.remove(&id_str);
         }
 
+        // Only free slots that are currently live. Freeing an out-of-range id
+        // would panic on direct indexing, and freeing an already-freed slot
+        // would push it onto the free list a second time — later handing the
+        // same NodeId to two live nodes (aliasing).
         for desc_id in descendants {
-            inner.nodes[desc_id.index()] = None;
-            inner.free_list.push(desc_id.0);
+            if matches!(inner.nodes.get(desc_id.index()), Some(Some(_))) {
+                inner.nodes[desc_id.index()] = None;
+                inner.free_list.push(desc_id.0);
+            }
+        }
+        if matches!(inner.nodes.get(node_id.index()), Some(Some(_))) {
+            inner.nodes[node_id.index()] = None;
+            inner.free_list.push(node_id.0);
         }
-        inner.nodes[node_id.index()] = None;
-        inner.free_list.push(node_id.0);
     }
 
     pub fn children(&self, node_id: NodeId) -> Vec<NodeId> {
@@ -932,6 +940,30 @@ mod tests {
         assert!(node.is_document());
     }
 
+    #[test]
+    fn remove_out_of_range_id_is_a_noop() {
+        let tree = DomTree::new();
+        // Direct indexing into `nodes` panicked out-of-bounds for an id past the
+        // end of the slot vector; it must be a no-op instead.
+        tree.remove(NodeId::new(9999));
+        assert_eq!(tree.len(), 1);
+    }
+
+    #[test]
+    fn remove_twice_does_not_alias_slots() {
+        let tree = DomTree::new();
+        let doc = tree.document();
+        let a = tree.new_node(NodeData::Text { contents: "a".into() });
+        tree.append_child(doc, a);
+        tree.remove(a);
+        // Removing the already-freed node again must not push its slot onto the
+        // free list a second time, or two later allocations alias one slot.
+        tree.remove(a);
+        let x = tree.new_node(NodeData::Text { contents: "x".into() });
+        let y = tree.new_node(NodeData::Text { contents: "y".into() });
+        assert_ne!(x, y, "double-free aliased two live nodes onto the same slot");
+    }
+
     #[test]
     fn test_append_child() {
         let tree = DomTree::new();

From 72a9c3ced3f09d39a03d38a3ff7aba6a6d0e9ae4 Mon Sep 17 00:00:00 2001
From: Andrey Mnatsakanov <andrey@3ig.dev>
Date: Sun, 26 Jul 2026 12:46:03 +0200
Subject: [PATCH 04/17] fix(dom): honor quirks mode for class/id selector
 case-sensitivity

set_quirks_mode was a no-op and the selector MatchingContext hardcoded
QuirksMode::NoQuirks, so class/id selectors were always case-sensitive even on
quirks-mode (no-doctype) pages where browsers match .foo / #bar
ASCII-case-insensitively. Store the parser-reported quirks mode on DomTree, pass
it into the selector context, and skip the exact-case #id index fast path in
quirks mode so it falls through to case-insensitive matching.

Fixes #499
---
 crates/obscura-dom/src/selector.rs  | 67 +++++++++++++++++++++++------
 crates/obscura-dom/src/tree.rs      | 15 +++++++
 crates/obscura-dom/src/tree_sink.rs |  5 ++-
 3 files changed, 74 insertions(+), 13 deletions(-)

diff --git a/crates/obscura-dom/src/selector.rs b/crates/obscura-dom/src/selector.rs
index 4c5acf4..6f85797 100644
--- a/crates/obscura-dom/src/selector.rs
+++ b/crates/obscura-dom/src/selector.rs
@@ -580,16 +580,21 @@ impl DomTree {
         // Fast path: a bare "#id" selector resolves through the id index in O(1)
         // instead of scanning every descendant. The index holds the first element
         // in tree order per id, which is exactly what the full scan would return.
-        if let Some(id) = simple_id_selector(selector) {
-            match self.get_element_by_id(id) {
-                // querySelector matches strict descendants of root only, so the
-                // indexed element must have root among its ancestors.
-                Some(nid) if self.ancestors(nid).contains(&root) => return Ok(Some(nid)),
-                // Index miss or stale entry (detached node) — fall through to full scan.
-                // The id_index is best-effort: it only registers nodes at creation time
-                // and does not update on reparent, so it can point to a detached clone
-                // while the live node (with the same id) is elsewhere in the tree.
-                _ => {}
+        // In quirks mode `#id` matches ASCII-case-insensitively, but the id
+        // index is keyed on the exact-case id, so skip the fast path and let the
+        // selector engine (below) do the case-insensitive match.
+        if !self.is_quirks() {
+            if let Some(id) = simple_id_selector(selector) {
+                match self.get_element_by_id(id) {
+                    // querySelector matches strict descendants of root only, so the
+                    // indexed element must have root among its ancestors.
+                    Some(nid) if self.ancestors(nid).contains(&root) => return Ok(Some(nid)),
+                    // Index miss or stale entry (detached node) — fall through to full scan.
+                    // The id_index is best-effort: it only registers nodes at creation time
+                    // and does not update on reparent, so it can point to a detached clone
+                    // while the live node (with the same id) is elsewhere in the tree.
+                    _ => {}
+                }
             }
         }
         let selector_list = parse_selector(selector)?;
@@ -598,7 +603,7 @@ impl DomTree {
             MatchingMode::Normal,
             None,
             &mut caches,
-            QuirksMode::NoQuirks,
+            self.selector_quirks_mode(),
             NeedsSelectorFlags::No,
             MatchingForInvalidation::No,
         );
@@ -619,6 +624,16 @@ impl DomTree {
         Ok(None)
     }
 
+    // Map the document's quirks flag onto the selector crate's QuirksMode. In
+    // quirks mode the crate matches class/id selectors ASCII-case-insensitively.
+    fn selector_quirks_mode(&self) -> QuirksMode {
+        if self.is_quirks() {
+            QuirksMode::Quirks
+        } else {
+            QuirksMode::NoQuirks
+        }
+    }
+
     pub fn query_selector_all_from(&self, root: NodeId, selector: &str) -> Result<Vec<NodeId>, String> {
         let selector_list = parse_selector(selector)?;
         let mut caches = selectors::context::SelectorCaches::default();
@@ -626,7 +641,7 @@ impl DomTree {
             MatchingMode::Normal,
             None,
             &mut caches,
-            QuirksMode::NoQuirks,
+            self.selector_quirks_mode(),
             NeedsSelectorFlags::No,
             MatchingForInvalidation::No,
         );
@@ -729,6 +744,34 @@ mod tests {
         assert!(result.is_none());
     }
 
+    #[test]
+    fn quirks_mode_matches_class_and_id_case_insensitively() {
+        // No doctype => quirks mode; class/id match ASCII case-insensitively.
+        let tree = parse_html(r#"<div class="Foo" id="Bar">x</div>"#);
+        assert!(
+            tree.query_selector(".foo").unwrap().is_some(),
+            ".foo should match class=\"Foo\" in quirks mode"
+        );
+        assert!(
+            tree.query_selector("#bar").unwrap().is_some(),
+            "#bar should match id=\"Bar\" in quirks mode"
+        );
+    }
+
+    #[test]
+    fn standards_mode_matches_class_and_id_case_sensitively() {
+        // With a doctype => no-quirks; class/id remain case-sensitive.
+        let tree = parse_html(r#"<!DOCTYPE html><div class="Foo" id="Bar">x</div>"#);
+        assert!(
+            tree.query_selector(".foo").unwrap().is_none(),
+            ".foo must NOT match class=\"Foo\" in standards mode"
+        );
+        assert!(
+            tree.query_selector("#bar").unwrap().is_none(),
+            "#bar must NOT match id=\"Bar\" in standards mode"
+        );
+    }
+
     #[test]
     fn test_query_selector_complex() {
         let tree = parse_html(
diff --git a/crates/obscura-dom/src/tree.rs b/crates/obscura-dom/src/tree.rs
index 01db8af..2667206 100644
--- a/crates/obscura-dom/src/tree.rs
+++ b/crates/obscura-dom/src/tree.rs
@@ -143,6 +143,9 @@ pub(crate) struct DomTreeInner {
     pub(crate) free_list: Vec<u32>,
     pub(crate) document: NodeId,
     pub(crate) id_index: HashMap<String, NodeId>,
+    // Whether the document was parsed in (full) quirks mode. In quirks mode CSS
+    // class and id selectors match ASCII-case-insensitively.
+    pub(crate) quirks: bool,
 }
 
 impl DomTree {
@@ -162,6 +165,7 @@ impl DomTree {
                 free_list: Vec::new(),
                 document: NodeId(0),
                 id_index: HashMap::new(),
+                quirks: false,
             }),
         }
     }
@@ -170,6 +174,17 @@ impl DomTree {
         self.inner.borrow().document
     }
 
+    /// Record whether the document was parsed in (full) quirks mode.
+    pub fn set_quirks(&self, quirks: bool) {
+        self.inner.borrow_mut().quirks = quirks;
+    }
+
+    /// Whether the document is in (full) quirks mode, in which CSS class and id
+    /// selectors match ASCII-case-insensitively.
+    pub fn is_quirks(&self) -> bool {
+        self.inner.borrow().quirks
+    }
+
     pub(crate) fn borrow_inner(&self) -> std::cell::Ref<'_, DomTreeInner> {
         self.inner.borrow()
     }
diff --git a/crates/obscura-dom/src/tree_sink.rs b/crates/obscura-dom/src/tree_sink.rs
index 674732f..e116b5a 100644
--- a/crates/obscura-dom/src/tree_sink.rs
+++ b/crates/obscura-dom/src/tree_sink.rs
@@ -218,7 +218,10 @@ impl TreeSink for DomTree {
         x == y
     }
 
-    fn set_quirks_mode(&self, _mode: QuirksMode) {
+    fn set_quirks_mode(&self, mode: QuirksMode) {
+        // Only full quirks mode makes CSS class/id selectors case-insensitive;
+        // limited-quirks behaves like no-quirks for selector matching.
+        self.set_quirks(mode == QuirksMode::Quirks);
     }
 
     fn is_mathml_annotation_xml_integration_point(&self, target: &NodeId) -> bool {

From cdab919599b0dca4bc859828e2342688587f62b8 Mon Sep 17 00:00:00 2001
From: Andrey Mnatsakanov <andrey@3ig.dev>
Date: Sun, 26 Jul 2026 12:31:29 +0200
Subject: [PATCH 05/17] fix(js): make performance.now() monotonic

The old sub-millisecond bump (_sub += 0.1) was uncapped, so after >10 calls in
one millisecond it exceeded 1.0; when the wall clock then ticked over and the
bump reset to 0, now() returned a value below the previous call. Track the last
returned value and never go below it (advance by a tiny epsilon when the clock
has not moved past it).

Fixes #497
---
 crates/obscura-js/js/bootstrap.js | 11 ++++++++---
 crates/obscura-js/src/runtime.rs  | 13 +++++++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 3ef371a..2683dea 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -5360,11 +5360,16 @@ globalThis.XMLSerializer = class XMLSerializer {
 };
 globalThis.performance = globalThis.performance || {
   now: (function() {
-    var _lastMs = -1, _sub = 0;
+    // Monotonically non-decreasing: return the wall-clock offset, but never a
+    // value below the last one. The previous version added an uncapped per-call
+    // sub-millisecond bump that could exceed 1.0, so when the millisecond then
+    // ticked over and the bump reset to 0 the result went backwards.
+    var _last = 0;
     return function() {
       var ms = Date.now() - (globalThis.performance.timeOrigin || 0);
-      if (ms !== _lastMs) { _lastMs = ms; _sub = 0; } else { _sub += 0.1; }
-      return ms + _sub;
+      if (ms > _last) _last = ms;
+      else _last += 0.001; // same/earlier ms: advance by a tiny epsilon
+      return _last;
     };
   })(),
   mark(){}, measure(){},
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index fdfeb4d..5dca703 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1317,6 +1317,19 @@ mod tests {
         rt
     }
 
+    #[test]
+    fn performance_now_is_monotonic_under_bursty_calls() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        // Hammer performance.now() so many calls land in the same millisecond and
+        // the wall clock rolls over repeatedly; the value must never go backwards.
+        let violations = rt
+            .evaluate(
+                "(function(){var prev=-Infinity, bad=0; for(var i=0;i<500000;i++){var t=performance.now(); if(t<prev) bad++; prev=t;} return bad;})()",
+            )
+            .unwrap();
+        assert_eq!(violations.as_f64(), Some(0.0), "performance.now() went backwards");
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From 499a5ef983d308d3cf9b95830b3013cdead1b496 Mon Sep 17 00:00:00 2001
From: Andrey Mnatsakanov <andrey@3ig.dev>
Date: Sun, 26 Jul 2026 12:33:25 +0200
Subject: [PATCH 06/17] fix(js): coerce non-string primitives in
 before/after/replaceWith

before(), after() and replaceWith() only converted string arguments to Text
nodes; other primitives (numbers, booleans, null) were passed straight to
insert_before with no _nid, corrupting the call. Route them through the shared
_convertNodes helper (the same path append/prepend use), so every non-node
argument becomes document.createTextNode(String(n)).

Fixes #498
---
 crates/obscura-js/js/bootstrap.js | 18 ++++++------------
 crates/obscura-js/src/runtime.rs  | 20 ++++++++++++++++++++
 2 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 3ef371a..96353c0 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -4122,13 +4122,13 @@ if (typeof Response === 'undefined') {
 }
 
 if (!Element.prototype.replaceWith) {
+  // _convertNodes turns any non-node argument (numbers, booleans, null, …) into
+  // a Text node via String(n), matching the spec and append()/prepend(); the
+  // old `typeof n === 'string'` check corrupted insert_before for other types.
   Element.prototype.replaceWith = function(...nodes) {
     const parent = this.parentNode;
     if (!parent) return;
-    for (const n of nodes) {
-      if (typeof n === 'string') parent.insertBefore(document.createTextNode(n), this);
-      else parent.insertBefore(n, this);
-    }
+    for (const n of _convertNodes(nodes)) parent.insertBefore(n, this);
     parent.removeChild(this);
   };
   _markNative(Element.prototype.replaceWith);
@@ -4137,10 +4137,7 @@ if (!Element.prototype.before) {
   Element.prototype.before = function(...nodes) {
     const parent = this.parentNode;
     if (!parent) return;
-    for (const n of nodes) {
-      if (typeof n === 'string') parent.insertBefore(document.createTextNode(n), this);
-      else parent.insertBefore(n, this);
-    }
+    for (const n of _convertNodes(nodes)) parent.insertBefore(n, this);
   };
   _markNative(Element.prototype.before);
 }
@@ -4149,10 +4146,7 @@ if (!Element.prototype.after) {
     const parent = this.parentNode;
     if (!parent) return;
     const ref = this.nextSibling;
-    for (const n of nodes) {
-      if (typeof n === 'string') parent.insertBefore(document.createTextNode(n), ref);
-      else parent.insertBefore(n, ref);
-    }
+    for (const n of _convertNodes(nodes)) parent.insertBefore(n, ref);
   };
   _markNative(Element.prototype.after);
 }
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index fdfeb4d..a6bd24c 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1317,6 +1317,26 @@ mod tests {
         rt
     }
 
+    #[test]
+    fn childnode_helpers_coerce_non_string_primitives_to_text() {
+        let mut rt = setup_runtime(r#"<html><body><div id="p"><span id="t">x</span></div></body></html>"#);
+        let before = rt
+            .evaluate("(function(){var t=document.getElementById('t'); t.before(5); return t.previousSibling ? t.previousSibling.textContent : 'NULL';})()")
+            .unwrap();
+        assert_eq!(before, serde_json::json!("5"));
+        let after = rt
+            .evaluate("(function(){var t=document.getElementById('t'); t.after(true); return t.nextSibling ? t.nextSibling.textContent : 'NULL';})()")
+            .unwrap();
+        assert_eq!(after, serde_json::json!("true"));
+        let replaced = rt
+            .evaluate("(function(){var t=document.getElementById('t'); t.replaceWith(42); return document.getElementById('p').textContent;})()")
+            .unwrap();
+        assert!(
+            replaced.as_str().unwrap().contains("42"),
+            "replaceWith(42) should leave text '42': {replaced}"
+        );
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From a663a15556b41b7cecee6fa453e5b01bef8ed5c0 Mon Sep 17 00:00:00 2001
From: Andrey Mnatsakanov <andrey@3ig.dev>
Date: Sun, 26 Jul 2026 12:36:44 +0200
Subject: [PATCH 07/17] fix(js): case-insensitive insertAdjacentHTML that keeps
 table/select fragments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two defects: the position keyword was matched case-sensitively with no default
(so 'BeforeEnd' inserted nothing and an invalid position silently no-oped
instead of throwing SyntaxError), and fragments were parsed inside a throwaway
<div>, so context-sensitive children (<tr>, <td>, <option>, …) were dropped.

Lowercase the position and throw SyntaxError on an unknown value; parse via a
table/select-aware wrapMap (chosen from the fragment's leading tag, falling back
to the insertion context) so rows/cells/options survive.

Fixes #495
---
 crates/obscura-js/js/bootstrap.js | 70 +++++++++++++++++++++++++++----
 crates/obscura-js/src/runtime.rs  | 29 +++++++++++++
 2 files changed, 92 insertions(+), 7 deletions(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 3ef371a..9ec7e83 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -24,7 +24,7 @@
     '_isSpecialScheme', '_applyDocQueryEncoding', '_anchorBase',
     '_elemHrefURL', '_setElemHrefPart', '_pad', '_daysInMonth',
     '_isoWeek1Monday', '_inputParseNumber', '_inputFormatNumber',
-    '_htmlAttrName', '_convertNodes', '_elementClassFor', '_wrap', '_wrapEl',
+    '_htmlAttrName', '_convertNodes', '_parseHTMLFragment', '_elementClassFor', '_wrap', '_wrapEl',
     '_resolveUrl', '_registerIframe', '_base64ToUint8Array',
     '_bodyToUint8Array', '_arrayBufferFromBytes',
     '_installWasmStreamingFallback', '_urlParseOp', '_urlSetOp',
@@ -1177,6 +1177,47 @@ function _isSubmitButton(el) {
   return false;
 }
 
+// Ancestor chains required to parse table/select children, which the fragment
+// parser drops when parsed loosely (it uses a fixed <body> context). Each entry
+// is [openTags, closeTags, depth] — depth is how many lastChild hops reach the
+// container holding the parsed rows/cells/options. Classic jQuery wrapMap.
+const _wrapMap = {
+  option:   ['<select multiple="">', '</select>', 1],
+  optgroup: ['<select multiple="">', '</select>', 1],
+  tr:       ['<table><tbody>', '</tbody></table>', 2],
+  td:       ['<table><tbody><tr>', '</tr></tbody></table>', 3],
+  th:       ['<table><tbody><tr>', '</tr></tbody></table>', 3],
+  tbody:    ['<table>', '</table>', 1],
+  thead:    ['<table>', '</table>', 1],
+  tfoot:    ['<table>', '</table>', 1],
+  caption:  ['<table>', '</table>', 1],
+  colgroup: ['<table>', '</table>', 1],
+  col:      ['<table><colgroup>', '</colgroup></table>', 2],
+};
+// Parse an HTML string into an array of detached nodes. Table/select fragments
+// are wrapped in the required ancestor chain and dug back out so their children
+// survive; the wrapper is chosen from the fragment's own leading tag, falling
+// back to the insertion context element's tag.
+function _parseHTMLFragment(html, contextTag) {
+  html = String(html == null ? '' : html);
+  const m = /^\s*<\s*([a-zA-Z][a-zA-Z0-9]*)/.exec(html);
+  const lead = m ? m[1].toLowerCase() : '';
+  const key = _wrapMap[lead] ? lead : (contextTag ? String(contextTag).toLowerCase() : '');
+  const wrap = _wrapMap[key];
+  const tmp = document.createElement('div');
+  let container = tmp;
+  if (wrap) {
+    tmp.innerHTML = wrap[0] + html + wrap[1];
+    for (let d = 0; d < wrap[2]; d++) container = container.lastChild || container;
+  } else {
+    tmp.innerHTML = html;
+  }
+  const out = [];
+  let child;
+  while ((child = container.firstChild)) out.push(container.removeChild(child));
+  return out;
+}
+
 class Element extends Node {
   constructor(nid) {
     super(nid);
@@ -1429,20 +1470,35 @@ class Element extends Node {
     return null;
   }
   insertAdjacentHTML(position, html) {
+    // Position is matched ASCII-case-insensitively; an unknown value throws
+    // SyntaxError (both were silent no-ops before). Sibling insertions parse
+    // against the parent's context, child insertions against this element, so
+    // table/select fragments keep the right parsing context (_parseHTMLFragment).
+    const pos = String(position).toLowerCase();
     const parent = this.parentNode;
-    switch (position) {
+    const contextTag = (pos === 'beforebegin' || pos === 'afterend')
+      ? (parent && parent.nodeType === 1 ? parent.tagName : 'body')
+      : this.tagName;
+    switch (pos) {
       case 'beforebegin':
-        if (parent) { const tmp = document.createElement('div'); tmp.innerHTML = html; const children = tmp.childNodes; for (let i = 0; i < children.length; i++) parent.insertBefore(children[i], this); }
+        if (parent) for (const n of _parseHTMLFragment(html, contextTag)) parent.insertBefore(n, this);
         break;
-      case 'afterbegin':
-        { const tmp = document.createElement('div'); tmp.innerHTML = html; const children = tmp.childNodes; const first = this.firstChild; for (let i = children.length - 1; i >= 0; i--) this.insertBefore(children[i], first); }
+      case 'afterbegin': {
+        const first = this.firstChild;
+        for (const n of _parseHTMLFragment(html, contextTag)) this.insertBefore(n, first);
         break;
+      }
       case 'beforeend':
-        { const tmp = document.createElement('div'); tmp.innerHTML = html; const children = tmp.childNodes; for (let i = 0; i < children.length; i++) this.appendChild(children[i]); }
+        for (const n of _parseHTMLFragment(html, contextTag)) this.appendChild(n);
         break;
       case 'afterend':
-        if (parent) { const tmp = document.createElement('div'); tmp.innerHTML = html; const children = tmp.childNodes; const next = this.nextSibling; for (let i = 0; i < children.length; i++) parent.insertBefore(children[i], next); }
+        if (parent) { const next = this.nextSibling; for (const n of _parseHTMLFragment(html, contextTag)) parent.insertBefore(n, next); }
         break;
+      default:
+        throw new DOMException(
+          "Failed to execute 'insertAdjacentHTML' on 'Element': The value provided ('" + position + "') is not one of 'beforeBegin', 'afterBegin', 'beforeEnd', or 'afterEnd'.",
+          "SyntaxError"
+        );
     }
   }
   // Like insertAdjacentHTML but inserts a Text node instead of parsing markup,
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index fdfeb4d..7be59f6 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1317,6 +1317,35 @@ mod tests {
         rt
     }
 
+    #[test]
+    fn insert_adjacent_html_parses_table_fragments() {
+        let mut rt = setup_runtime(
+            r#"<html><body><table id="t"><tbody id="tb"></tbody></table></body></html>"#,
+        );
+        let out = rt
+            .evaluate("(function(){var tb=document.getElementById('tb'); tb.insertAdjacentHTML('beforeend','<tr><td>1</td><td>2</td></tr>'); var tr=tb.firstElementChild; return tr ? (tr.tagName+':'+tr.children.length) : 'NULL';})()")
+            .unwrap();
+        assert_eq!(out, serde_json::json!("TR:2"));
+    }
+
+    #[test]
+    fn insert_adjacent_html_position_is_case_insensitive() {
+        let mut rt = setup_runtime(r#"<html><body><div id="host"><span>base</span></div></body></html>"#);
+        let out = rt
+            .evaluate("(function(){var h=document.getElementById('host'); h.insertAdjacentHTML('BeforeEnd','<b>x</b>'); return h.lastElementChild ? h.lastElementChild.tagName : 'NULL';})()")
+            .unwrap();
+        assert_eq!(out, serde_json::json!("B"));
+    }
+
+    #[test]
+    fn insert_adjacent_html_rejects_invalid_position() {
+        let mut rt = setup_runtime(r#"<html><body><div id="host"></div></body></html>"#);
+        let out = rt
+            .evaluate("(function(){var h=document.getElementById('host'); try { h.insertAdjacentHTML('nope','<b>x</b>'); return 'no-throw'; } catch(e){ return e.name; }})()")
+            .unwrap();
+        assert_eq!(out, serde_json::json!("SyntaxError"));
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From 1fc5a24e9887d5cd83303c24f32c9fb3d01f2338 Mon Sep 17 00:00:00 2001
From: Andrey Mnatsakanov <andrey@3ig.dev>
Date: Sun, 26 Jul 2026 12:32:27 +0200
Subject: [PATCH 08/17] fix(js): keep the current URL when
 pushState/replaceState omit url

resolveOrFallback(undefined) returned undefined, so applyVirtual set
__virtualUrl to null and location reverted to the document URL. Per the HTML
spec a missing url keeps the current document URL; return __currentUrl() so the
new history entry captures the current location instead of clearing it.

Fixes #496
---
 crates/obscura-js/js/bootstrap.js |  5 ++++-
 crates/obscura-js/src/runtime.rs  | 22 ++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 3ef371a..e3073d8 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -5613,7 +5613,10 @@ globalThis.atob = globalThis.atob || ((s) => { const c="ABCDEFGHIJKLMNOPQRSTUVWX
   const stack = [{state: null, url: undefined}]; // initial entry; url=undefined means "use document URL"
   let idx = 0;
   const resolveOrFallback = (url) => {
-    if (url === null || url === undefined) return undefined;
+    // A missing url (pushState/replaceState called with < 3 args) keeps the
+    // current document URL per the HTML spec — capture it so the entry does not
+    // reset location back to the original document URL.
+    if (url === null || url === undefined) return __currentUrl();
     try { return new URL(String(url), __currentUrl()).href; } catch (e) { return String(url); }
   };
   const applyVirtual = () => {
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index fdfeb4d..5b4d27e 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1317,6 +1317,28 @@ mod tests {
         rt
     }
 
+    #[test]
+    fn replace_state_without_url_preserves_current_location() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        let path = rt
+            .evaluate(
+                "(function(){history.pushState({}, '', '/dashboard'); history.replaceState({scroll:1}); return location.pathname;})()",
+            )
+            .unwrap();
+        assert_eq!(path, serde_json::json!("/dashboard"));
+    }
+
+    #[test]
+    fn push_state_without_url_preserves_current_location() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        let path = rt
+            .evaluate(
+                "(function(){history.pushState({}, '', '/a'); history.pushState({b:1}); return location.pathname;})()",
+            )
+            .unwrap();
+        assert_eq!(path, serde_json::json!("/a"));
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From 3d39e59c14dc61adc2733a7e1aea3708a0e25ee0 Mon Sep 17 00:00:00 2001
From: "hol\"mo\"fy" <hff1996723@163.com>
Date: Sun, 26 Jul 2026 20:57:02 +0800
Subject: [PATCH 09/17] Update bootstrap.js

---
 crates/obscura-js/js/bootstrap.js | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 3ef371a..9dddfba 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -406,12 +406,24 @@ const _scheduleAfter = (delay, fn) => {
   else Deno.core.ops.op_sleep(d).then(fn);
 };
 
+// Timers accept a string first arg per the HTML spec (e.g. the Aliyun WAF
+// `acw_sc__v2` challenge drives `setTimeout('reload(arg2)', 2)`). A string is
+// compiled and run in global scope, identical to a real browser; otherwise the
+// call silently no-ops and JS-triggered navigations (cookie → reload) never fire.
+const _coerceTimerFn = (fn) => {
+  if (typeof fn === "string") {
+    try { return new Function(fn); } catch (_) { return null; }
+  }
+  return typeof fn === "function" ? fn : null;
+};
+
 globalThis.setTimeout = (fn, delay = 0, ...args) => {
-  if (typeof fn !== "function") return ++_tid;
+  const f = _coerceTimerFn(fn);
+  if (f === null) return ++_tid;
   const id = ++_tid;
   _scheduleAfter(delay, () => {
     if (_clearedTimers.has(id)) return;
-    try { fn(...args); } catch(e) { console.error("Timer error:", e); }
+    try { f(...args); } catch(e) { console.error("Timer error:", e); }
   });
   return id;
 };
@@ -419,12 +431,13 @@ globalThis.setTimeout = (fn, delay = 0, ...args) => {
 globalThis.clearTimeout = (id) => { _clearedTimers.add(id); };
 
 globalThis.setInterval = (fn, delay = 0, ...args) => {
-  if (typeof fn !== "function") return ++_tid;
+  const f = _coerceTimerFn(fn);
+  if (f === null) return ++_tid;
   const id = ++_tid;
   _intervals.add(id);
   const tick = () => {
     if (!_intervals.has(id)) return;
-    try { fn(...args); } catch(e) { console.error("Interval error:", e); }
+    try { f(...args); } catch(e) { console.error("Interval error:", e); }
     if (!_intervals.has(id)) return;
     _scheduleAfter(delay, tick);
   };

From d93ff517fc96f7eb6b9434621c5f0223c2af35a0 Mon Sep 17 00:00:00 2001
From: SGavrl <277843151+SGavrl@users.noreply.github.com>
Date: Sat, 1 Aug 2026 15:20:35 +0000
Subject: [PATCH 10/17] fix(js): keep performance clock bounded

---
 crates/obscura-js/js/bootstrap.js | 12 ++++++------
 crates/obscura-js/src/runtime.rs  | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 2683dea..ca85f03 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -5361,14 +5361,14 @@ globalThis.XMLSerializer = class XMLSerializer {
 globalThis.performance = globalThis.performance || {
   now: (function() {
     // Monotonically non-decreasing: return the wall-clock offset, but never a
-    // value below the last one. The previous version added an uncapped per-call
-    // sub-millisecond bump that could exceed 1.0, so when the millisecond then
-    // ticked over and the bump reset to 0 the result went backwards.
-    var _last = 0;
+    // value below the last one. Equal readings are allowed, and avoiding a
+    // synthetic per-call increment keeps tight loops from advancing the clock
+    // faster than real elapsed time.
+    var _last = -Infinity;
     return function() {
       var ms = Date.now() - (globalThis.performance.timeOrigin || 0);
-      if (ms > _last) _last = ms;
-      else _last += 0.001; // same/earlier ms: advance by a tiny epsilon
+      if (ms < _last) return _last;
+      _last = ms;
       return _last;
     };
   })(),
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index 5dca703..f6a058e 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1330,6 +1330,20 @@ mod tests {
         assert_eq!(violations.as_f64(), Some(0.0), "performance.now() went backwards");
     }
 
+    #[test]
+    fn performance_now_does_not_outrun_elapsed_time() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        let lead = rt
+            .evaluate(
+                "(function(){for(var i=0;i<500000;i++)performance.now(); return performance.now()-(Date.now()-performance.timeOrigin);})()",
+            )
+            .unwrap();
+        assert!(
+            lead.as_f64().unwrap() <= 1.0,
+            "performance.now() advanced ahead of elapsed time: {lead}"
+        );
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From dbc87e86f99a7a89c69c8746f177091dafabb9bd Mon Sep 17 00:00:00 2001
From: SGavrl <277843151+SGavrl@users.noreply.github.com>
Date: Sat, 1 Aug 2026 15:37:17 +0000
Subject: [PATCH 11/17] test(js): cover string timer handlers

---
 crates/obscura-js/src/runtime.rs | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index fdfeb4d..ccf8e1e 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1317,6 +1317,35 @@ mod tests {
         rt
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn string_timeout_handler_executes_in_global_scope() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        rt.evaluate(
+            "var __timerValue='pending'; setTimeout('__timerValue=\"done\"', 0)",
+        )
+        .unwrap();
+        rt.run_event_loop_bounded(100).await.unwrap();
+        assert_eq!(
+            rt.evaluate("globalThis.__timerValue").unwrap(),
+            serde_json::json!("done")
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn string_interval_handler_repeats_and_can_clear_itself() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        rt.evaluate("globalThis.__ticks=0").unwrap();
+        rt.evaluate(
+            "globalThis.__timerId=setInterval('__ticks++;if(__ticks===2)clearInterval(__timerId)',1)",
+        )
+        .unwrap();
+        rt.run_event_loop_bounded(100).await.unwrap();
+        assert_eq!(
+            rt.evaluate("globalThis.__ticks").unwrap(),
+            serde_json::json!(2.0)
+        );
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From 5d7a02041a26e794be02c18521507001c560281d Mon Sep 17 00:00:00 2001
From: SGavrl <277843151+SGavrl@users.noreply.github.com>
Date: Sat, 1 Aug 2026 15:41:45 +0000
Subject: [PATCH 12/17] fix(js): preserve inline styles when cloning

---
 crates/obscura-js/js/bootstrap.js |  4 ++++
 crates/obscura-js/src/runtime.rs  | 22 ++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index a63d335..eb2b223 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -654,6 +654,10 @@ function _shallowCloneNode(node) {
     const v = node.getAttribute(name);
     if (v !== null) el.setAttribute(name, v);
   }
+  // CSS declarations currently live on the JS wrapper independently of the
+  // DOM attribute. Copy that state as well so styles assigned through
+  // `node.style` survive cloning even before attribute reflection runs.
+  if (node.style && node.style.cssText) el.style.cssText = node.style.cssText;
   return el;
 }
 
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index 0f2b629..714543b 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1369,6 +1369,28 @@ mod tests {
         assert_eq!(out, serde_json::json!("7|0"));
     }
 
+    #[test]
+    fn clone_node_copies_js_assigned_inline_styles() {
+        let mut rt = setup_runtime("<html><body><div id='d'></div></body></html>");
+        let out = rt
+            .evaluate(
+                "(function(){var d=document.getElementById('d');d.style.color='red';d.style.fontSize='12px';var c=d.cloneNode(false);return c.style.color+'|'+c.style.fontSize+'|'+c.style.cssText;})()",
+            )
+            .unwrap();
+        assert_eq!(out, serde_json::json!("red|12px|color: red; font-size: 12px;"));
+    }
+
+    #[test]
+    fn clone_node_deep_copies_template_content() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        let out = rt
+            .evaluate(
+                "(function(){var t=document.createElement('template');t.content.appendChild(document.createElement('option')).textContent='choice';var c=t.cloneNode(true);return c.content.childNodes.length+'|'+c.content.firstChild.tagName+'|'+c.content.firstChild.textContent;})()",
+            )
+            .unwrap();
+        assert_eq!(out, serde_json::json!("1|OPTION|choice"));
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From 907e15d85d03438c38e51390e4133ea08d05c4d8 Mon Sep 17 00:00:00 2001
From: SGavrl <277843151+SGavrl@users.noreply.github.com>
Date: Sat, 1 Aug 2026 15:46:25 +0000
Subject: [PATCH 13/17] perf(js): avoid per-element style sync objects

---
 crates/obscura-js/js/bootstrap.js | 41 ++++++++++++++++---------------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 4d6fa04..a065015 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -586,23 +586,22 @@ class CSSStyleDeclaration {
     // `style` content attribute in both directions; an owner-less declaration
     // (getComputedStyle fallback, stylesheet rules) is purely in-memory.
     Object.defineProperty(this, "_owner", { value: owner || null, writable: true, enumerable: false, configurable: true });
-    // Last `style` attribute string we parsed/wrote, so a read can skip the
-    // reparse when the attribute has not changed underneath us. Held in a
-    // one-field object so the sync helpers can mutate it without a bare
-    // `this._x = …` assignment (which the style proxy would reroute into
-    // setProperty).
-    Object.defineProperty(this, "_sync", { value: { last: null }, writable: true, enumerable: false, configurable: true });
+    // Load the content attribute only when style is first observed. Keeping
+    // this as a primitive avoids allocating a separate sync object for every
+    // wrapped element.
+    Object.defineProperty(this, "_loaded", { value: !owner, writable: true, enumerable: false, configurable: true });
   }
-  // Pull the owner's `style` attribute into `_props` if it changed since our
-  // last read/write. Keeps parsed HTML and setAttribute('style', …) visible via
-  // el.style.*. No-op when owner-less.
+  // Pull the initial `style` attribute once. Later attribute mutations update
+  // the declaration directly from Element.setAttribute/removeAttribute, so
+  // repeated style reads do not cross the JS/Rust op boundary.
   _pull() {
-    const o = this._owner;
-    if (!o) return;
-    const attr = o.getAttribute("style");
-    if (attr === this._sync.last) return;
-    _parseCssInto(this._props, attr);
-    this._sync.last = attr;
+    if (this._loaded) return;
+    _parseCssInto(this._props, this._owner.getAttribute("style"));
+    this._loaded = true;
+  }
+  _replaceFromAttribute(text) {
+    _parseCssInto(this._props, text);
+    this._loaded = true;
   }
   // Serialize `_props` back onto the owner's `style` attribute after a mutation,
   // so el.style.x = … and cssText reflect into getAttribute('style') and
@@ -611,7 +610,6 @@ class CSSStyleDeclaration {
     const o = this._owner;
     if (!o) return;
     const text = _serializeCss(this._props);
-    this._sync.last = text;
     if (text) o.setAttribute("style", text);
     else o.removeAttribute("style");
   }
@@ -645,6 +643,7 @@ const _styleProxy = (decl) => new Proxy(decl, {
   },
   set(t, p, v) {
     if (typeof p === "symbol") { t[p] = v; return true; }
+    if (p === "_loaded") { t._loaded = v; return true; }
     if (p === "cssText") { t.cssText = v; return true; }
     if (/^\d+$/.test(p) || p in Object.getPrototypeOf(t)) return true;
     t.setProperty(p, v);
@@ -1443,13 +1442,15 @@ class Element extends Node {
   setAttribute(n, v) {
     n = _htmlAttrName(this, n);
     const popoverPrev = (n === "popover") ? this.popover : undefined;
-    _dom("set_attribute", this._nid, n + "\0" + String(v));
+    const value = String(v);
+    _dom("set_attribute", this._nid, n + "\0" + value);
+    if (n === "style") this._style._replaceFromAttribute(value);
     if (popoverPrev !== undefined) this._popoverTypeMaybeChanged(popoverPrev);
     if (globalThis.__mutationObservers?.length) globalThis.__notifyMutation('attributes', this._nid, [], [], n);
   }
-  setAttributeNS(ns, n, v) { _dom("set_attribute", this._nid, String(n) + "\0" + String(v)); } // exact name, no HTML folding
-  removeAttribute(n) { n = _htmlAttrName(this, n); const popoverPrev = (n === "popover") ? this.popover : undefined; _dom("remove_attribute", this._nid, n); if (popoverPrev !== undefined) this._popoverTypeMaybeChanged(popoverPrev); }
-  removeAttributeNS(ns, n) { _dom("remove_attribute", this._nid, String(n)); }
+  setAttributeNS(ns, n, v) { n = String(n); const value = String(v); _dom("set_attribute", this._nid, n + "\0" + value); if ((!ns || ns === "") && n === "style") this._style._replaceFromAttribute(value); } // exact name, no HTML folding
+  removeAttribute(n) { n = _htmlAttrName(this, n); const popoverPrev = (n === "popover") ? this.popover : undefined; _dom("remove_attribute", this._nid, n); if (n === "style") this._style._replaceFromAttribute(""); if (popoverPrev !== undefined) this._popoverTypeMaybeChanged(popoverPrev); }
+  removeAttributeNS(ns, n) { n = String(n); _dom("remove_attribute", this._nid, n); if ((!ns || ns === "") && n === "style") this._style._replaceFromAttribute(""); }
   hasAttribute(n) { return this.getAttribute(n) !== null; }
   hasAttributes() { return true; } // Simplified
   getAttributeNames() { return _domParse("attribute_names", this._nid) || []; }

From a2fd4d17356a58d6a4df2cb56b7ef7333f8c7754 Mon Sep 17 00:00:00 2001
From: SGavrl <277843151+SGavrl@users.noreply.github.com>
Date: Sat, 1 Aug 2026 15:54:51 +0000
Subject: [PATCH 14/17] fix(js): parse fragments in their insertion context

---
 crates/obscura-dom/src/lib.rs       |  2 +-
 crates/obscura-dom/src/tree_sink.rs | 10 +++--
 crates/obscura-js/js/bootstrap.js   | 58 ++++++++---------------------
 crates/obscura-js/src/ops.rs        | 11 +++++-
 crates/obscura-js/src/runtime.rs    | 26 +++++++++++++
 5 files changed, 60 insertions(+), 47 deletions(-)

diff --git a/crates/obscura-dom/src/lib.rs b/crates/obscura-dom/src/lib.rs
index 6d3d6fc..6ad84be 100644
--- a/crates/obscura-dom/src/lib.rs
+++ b/crates/obscura-dom/src/lib.rs
@@ -7,4 +7,4 @@ pub mod selector;
 pub mod serialize;
 
 pub use tree::{Attribute, DomTree, Node, NodeData, NodeId};
-pub use tree_sink::{parse_html, parse_fragment};
+pub use tree_sink::{parse_fragment, parse_fragment_with_context, parse_html};
diff --git a/crates/obscura-dom/src/tree_sink.rs b/crates/obscura-dom/src/tree_sink.rs
index 674732f..4909579 100644
--- a/crates/obscura-dom/src/tree_sink.rs
+++ b/crates/obscura-dom/src/tree_sink.rs
@@ -243,10 +243,14 @@ pub fn parse_html(html: &str) -> DomTree {
 }
 
 pub fn parse_fragment(html: &str) -> DomTree {
-    use html5ever::tendril::TendrilSink;
-    use html5ever::{parse_fragment, ParseOpts, QualName};
-
     let context_name = QualName::new(None, ns!(html), local_name!("body"));
+    parse_fragment_with_context(html, context_name)
+}
+
+pub fn parse_fragment_with_context(html: &str, context_name: QualName) -> DomTree {
+    use html5ever::tendril::TendrilSink;
+    use html5ever::{parse_fragment, ParseOpts};
+
     let tree = DomTree::new();
     parse_fragment(tree, ParseOpts::default(), context_name, vec![])
         .from_utf8()
diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 00b3b27..1baa768 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -1227,44 +1227,20 @@ function _isSubmitButton(el) {
   return false;
 }
 
-// Ancestor chains required to parse table/select children, which the fragment
-// parser drops when parsed loosely (it uses a fixed <body> context). Each entry
-// is [openTags, closeTags, depth] — depth is how many lastChild hops reach the
-// container holding the parsed rows/cells/options. Classic jQuery wrapMap.
-const _wrapMap = {
-  option:   ['<select multiple="">', '</select>', 1],
-  optgroup: ['<select multiple="">', '</select>', 1],
-  tr:       ['<table><tbody>', '</tbody></table>', 2],
-  td:       ['<table><tbody><tr>', '</tr></tbody></table>', 3],
-  th:       ['<table><tbody><tr>', '</tr></tbody></table>', 3],
-  tbody:    ['<table>', '</table>', 1],
-  thead:    ['<table>', '</table>', 1],
-  tfoot:    ['<table>', '</table>', 1],
-  caption:  ['<table>', '</table>', 1],
-  colgroup: ['<table>', '</table>', 1],
-  col:      ['<table><colgroup>', '</colgroup></table>', 2],
-};
-// Parse an HTML string into an array of detached nodes. Table/select fragments
-// are wrapped in the required ancestor chain and dug back out so their children
-// survive; the wrapper is chosen from the fragment's own leading tag, falling
-// back to the insertion context element's tag.
-function _parseHTMLFragment(html, contextTag) {
+// Parse an HTML string into detached nodes using the actual insertion element
+// as html5ever's fragment context. This preserves table/select parsing rules,
+// comments, text-node order, and foreign-content namespaces without a wrap map.
+function _parseHTMLFragment(html, context) {
   html = String(html == null ? '' : html);
-  const m = /^\s*<\s*([a-zA-Z][a-zA-Z0-9]*)/.exec(html);
-  const lead = m ? m[1].toLowerCase() : '';
-  const key = _wrapMap[lead] ? lead : (contextTag ? String(contextTag).toLowerCase() : '');
-  const wrap = _wrapMap[key];
-  const tmp = document.createElement('div');
-  let container = tmp;
-  if (wrap) {
-    tmp.innerHTML = wrap[0] + html + wrap[1];
-    for (let d = 0; d < wrap[2]; d++) container = container.lastChild || container;
-  } else {
-    tmp.innerHTML = html;
-  }
+  const ns = context && context.nodeType === 1 ? context.namespaceURI : null;
+  const tag = context && context.nodeType === 1 ? context.localName : 'body';
+  const tmp = ns && ns !== 'http://www.w3.org/1999/xhtml'
+    ? document.createElementNS(ns, tag)
+    : document.createElement(tag);
+  tmp.innerHTML = html;
   const out = [];
   let child;
-  while ((child = container.firstChild)) out.push(container.removeChild(child));
+  while ((child = tmp.firstChild)) out.push(tmp.removeChild(child));
   return out;
 }
 
@@ -1526,23 +1502,21 @@ class Element extends Node {
     // table/select fragments keep the right parsing context (_parseHTMLFragment).
     const pos = String(position).toLowerCase();
     const parent = this.parentNode;
-    const contextTag = (pos === 'beforebegin' || pos === 'afterend')
-      ? (parent && parent.nodeType === 1 ? parent.tagName : 'body')
-      : this.tagName;
+    const context = (pos === 'beforebegin' || pos === 'afterend') ? parent : this;
     switch (pos) {
       case 'beforebegin':
-        if (parent) for (const n of _parseHTMLFragment(html, contextTag)) parent.insertBefore(n, this);
+        if (parent) for (const n of _parseHTMLFragment(html, context)) parent.insertBefore(n, this);
         break;
       case 'afterbegin': {
         const first = this.firstChild;
-        for (const n of _parseHTMLFragment(html, contextTag)) this.insertBefore(n, first);
+        for (const n of _parseHTMLFragment(html, context)) this.insertBefore(n, first);
         break;
       }
       case 'beforeend':
-        for (const n of _parseHTMLFragment(html, contextTag)) this.appendChild(n);
+        for (const n of _parseHTMLFragment(html, context)) this.appendChild(n);
         break;
       case 'afterend':
-        if (parent) { const next = this.nextSibling; for (const n of _parseHTMLFragment(html, contextTag)) parent.insertBefore(n, next); }
+        if (parent) { const next = this.nextSibling; for (const n of _parseHTMLFragment(html, context)) parent.insertBefore(n, next); }
         break;
       default:
         throw new DOMException(
diff --git a/crates/obscura-js/src/ops.rs b/crates/obscura-js/src/ops.rs
index 64aad05..37e5cc7 100644
--- a/crates/obscura-js/src/ops.rs
+++ b/crates/obscura-js/src/ops.rs
@@ -391,7 +391,16 @@ fn op_dom_inner(state: &OpState, cmd: String, arg1: String, arg2: String) -> Str
                 dom.detach(child);
             }
             if !arg2.is_empty() {
-                let fragment = obscura_dom::parse_fragment(&arg2);
+                let context_name = dom
+                    .with_node(target, |node| match &node.data {
+                        NodeData::Element { name, .. } => Some(name.clone()),
+                        _ => None,
+                    })
+                    .flatten();
+                let fragment = match context_name {
+                    Some(name) => obscura_dom::parse_fragment_with_context(&arg2, name),
+                    None => obscura_dom::parse_fragment(&arg2),
+                };
                 let import_root = fragment.find_body_or_root();
                 dom.import_children_from(target, &fragment, import_root);
             }
diff --git a/crates/obscura-js/src/runtime.rs b/crates/obscura-js/src/runtime.rs
index 2e022c0..8f6dc5c 100644
--- a/crates/obscura-js/src/runtime.rs
+++ b/crates/obscura-js/src/runtime.rs
@@ -1346,6 +1346,32 @@ mod tests {
         assert_eq!(out, serde_json::json!("SyntaxError"));
     }
 
+    #[test]
+    fn insert_adjacent_html_keeps_leading_comments_in_table_contexts() {
+        let mut rt = setup_runtime(
+            r#"<html><body><table><tbody id="tb"><tr id="row"></tr></tbody></table></body></html>"#,
+        );
+        let out = rt
+            .evaluate(
+                "(function(){var tb=document.getElementById('tb');tb.insertAdjacentHTML('beforeend','<!--m--><tr><td>v</td></tr>');var row=document.getElementById('row');row.insertAdjacentHTML('beforeend','<!--n--><td>x</td>');return Array.from(tb.childNodes).map(function(n){return n.nodeName}).join('|')+';'+Array.from(row.childNodes).map(function(n){return n.nodeName}).join('|');})()",
+            )
+            .unwrap();
+        assert_eq!(out, serde_json::json!("TR|#comment|TR;#comment|TD"));
+    }
+
+    #[test]
+    fn insert_adjacent_html_uses_the_insertion_element_as_context() {
+        let mut rt = setup_runtime(
+            r#"<html><body><div id="d"></div><table id="table"><tbody id="tb"></tbody></table></body></html>"#,
+        );
+        let out = rt
+            .evaluate(
+                "(function(){var d=document.getElementById('d');d.insertAdjacentHTML('beforeend','<tr><td>v</td></tr>');var table=document.getElementById('table');table.insertAdjacentHTML('beforeend','<tr><td>x</td></tr>');var tb=document.getElementById('tb');tb.insertAdjacentHTML('beforeend','<tr><td>y</td></tr>tail');return d.firstChild.nodeName+':'+d.textContent+';'+table.lastElementChild.tagName+';'+Array.from(tb.childNodes).map(function(n){return n.nodeName+(n.data?':'+n.data:'')}).join('|');})()",
+            )
+            .unwrap();
+        assert_eq!(out, serde_json::json!("#text:v;TBODY;TR|#text:tail"));
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");

From fb422292002b140cd6756806f82344cd76f17df7 Mon Sep 17 00:00:00 2001
From: Diego Cavalcante <dgcavalcante@gmail.com>
Date: Sun, 2 Aug 2026 01:10:02 -0300
Subject: [PATCH 15/17] fix(net): honor SSL_CERT_FILE / SSL_CERT_DIR in the
 stealth client

The #525 fix landed on the reqwest path (`client.rs`: `configured_root_paths()`
-> `add_root_certificate`) but did not cover `wreq_client.rs`. The stealth
client builds its `wreq::Client` without a certificate store, so those
variables are silently ignored whenever `--stealth` is on.

The consequence is inverted: the transport with the best TLS fingerprint is the
only one that cannot reach a host behind a private or incomplete CA chain --
precisely the environments #525 described.

Same binary on current main, same private-CA server, only the flag differs:

  SSL_CERT_FILE=ca.pem obscura           fetch https://127.0.0.1:8443/  -> ok
  SSL_CERT_FILE=ca.pem obscura --stealth fetch https://127.0.0.1:8443/  -> fails

`wreq` already exposes the hook -- `ClientBuilder::tls_cert_store(CertStore)`,
and `CertStore::builder().set_default_paths()` reads both variables. It is
simply never called.

Two constraints, both of which fail silently if got wrong:

* `tls_cert_store`, not `tls_options`. `emulation()` is documented as
  "This will overwrite the existing configuration" and internally calls
  `self.tls_options(emulation.tls_options)`; setting TLS options here would
  discard the Chrome fingerprint, which is the whole point of this client.
  `tls_cert_store` is a separate config field and composes with emulation.
* Opt-in only. Supplying a store REPLACES the webpki roots (see
  `set_cert_store` in `tls/conn/ext.rs`), it does not add to them. Applying it
  unconditionally would break ordinary sites whenever the bundle is
  incomplete. With neither variable set, behaviour is byte-for-byte unchanged.

Verified: with the variable, a private-CA host resolves under --stealth;
without it, the same host still fails; with a deliberately EMPTY bundle,
example.com fails -- which is what proves the store is actually applied rather
than the bundle merely happening to be right.

Refs #538, #525
---
 crates/obscura-net/src/wreq_client.rs | 33 +++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/crates/obscura-net/src/wreq_client.rs b/crates/obscura-net/src/wreq_client.rs
index bf56a9a..397e1c1 100644
--- a/crates/obscura-net/src/wreq_client.rs
+++ b/crates/obscura-net/src/wreq_client.rs
@@ -57,6 +57,39 @@ impl StealthHttpClient {
             .timeout(Duration::from_secs(30))
             .redirect(wreq::redirect::Policy::none());
 
+        // Honor SSL_CERT_FILE / SSL_CERT_DIR in the stealth client too.
+        //
+        // `client.rs` (the reqwest path) already reads these via `configured_root_paths()` and
+        // feeds `add_root_certificate`, so a private CA works there. This client did not, which
+        // made the *better-fingerprinted* transport the only one unable to reach hosts behind a
+        // private/national CA (measured against a Brazilian government portal whose leaf is
+        // issued by an ICP-Brasil intermediate: `--stealth` failed with CERTIFICATE_VERIFY_FAILED
+        // while the reqwest path, with SSL_CERT_FILE set, completed the handshake).
+        //
+        // Two deliberate constraints:
+        //
+        // 1. `tls_cert_store` is used, NOT `tls_options`. `emulation()` overwrites `tls_options`
+        //    wholesale ("This will overwrite the existing configuration"), so setting TLS options
+        //    here would silently discard the Chrome fingerprint — the whole point of this client.
+        //    `tls_cert_store` is a separate field on the config and composes with emulation.
+        //
+        // 2. Opt-in only. Supplying a store REPLACES the webpki roots (see `set_cert_store` in
+        //    `tls/conn/ext.rs`), it does not add to them. Applying it unconditionally would break
+        //    every ordinary site whenever the bundle is incomplete. With neither variable set,
+        //    behaviour is byte-for-byte what it was before.
+        if std::env::var_os("SSL_CERT_FILE").is_some()
+            || std::env::var_os("SSL_CERT_DIR").is_some()
+        {
+            match wreq::tls::trust::CertStore::builder().set_default_paths().build() {
+                Ok(store) => builder = builder.tls_cert_store(store),
+                Err(error) => tracing::warn!(
+                    %error,
+                    "SSL_CERT_FILE/SSL_CERT_DIR set but the certificate store failed to build; \
+                     continuing with the default roots"
+                ),
+            }
+        }
+
         if let Some(proxy) = proxy_url {
             if let Ok(p) = wreq::Proxy::all(proxy) {
                 builder = builder.proxy(p);

From c7e7c703b755a202e483fb718c12bcc244a971e5 Mon Sep 17 00:00:00 2001
From: Diego Cavalcante <dgcavalcante@gmail.com>
Date: Sun, 2 Aug 2026 01:26:42 -0300
Subject: [PATCH 16/17] fix(js): expose WebIDL interfaces as non-enumerable,
 like a real browser

`bootstrap.js` publishes its DOM interfaces with `globalThis.Node = Node`,
which defaults to `enumerable: true`. A real browser exposes every WebIDL
interface on the global as `enumerable: false`, so the difference is a
one-liner for any script that cares:

    Object.getOwnPropertyDescriptor(window, 'Node').enumerable
    // real Chrome: false     obscura: true

It also means `Object.keys(window)` and `for...in` over the global enumerate
22 names a browser would never list.

The file already has the mechanism for this -- `_preHideInternals()`
pre-declares internal globals with `enumerable: false`, and its own comment
notes that later `globalThis.x = value` assignments only update the value and
leave the descriptor intact. This just adds the WebIDL names to that list, so
no assignment site changes.

Before: 9 of 10 sampled interfaces enumerable. After: 0 of 10, matching Chrome.

Regression: interfaces still callable (`typeof Node === 'function'`),
`instanceof Node` / `instanceof Element` hold, `querySelector` works, Hacker
News still yields 30 results under `--stealth`, snapshot builds clean.

Composes with #537 -- verified with both applied: `var Node` pages run, the
JSF/RichFaces case loads (jQuery/A4J/RichFaces all live), and enumerability
stays at 0/10.
---
 crates/obscura-js/js/bootstrap.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 3215d79..c9c41e9 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -36,6 +36,18 @@
     '_rngAncestors', '_rngOrder', '_rngCmp', '_rngCheckOffset',
     '_idbRequest', '_idbObjectStore', '_idbTransaction', '_idbDatabase',
     '_makeListenerBox',
+    // WebIDL interfaces. A real browser exposes these on the global as
+    // enumerable:false; here they were assigned with `globalThis.X = X`, which
+    // defaults to enumerable:true and is detectable in one line:
+    //   Object.getOwnPropertyDescriptor(window, 'Node').enumerable
+    // Pre-declaring them non-enumerable here is enough -- per the note above,
+    // the later `globalThis.X = X` assignments only update the value.
+    'Node', 'Element', 'Document', 'DocumentFragment', 'DocumentType',
+    'Text', 'Comment', 'CDATASection', 'ProcessingInstruction', 'CharacterData',
+    'CSSStyleDeclaration', 'DOMTokenList', 'Screen', 'NetworkInformation',
+    'MessageChannel', 'MessagePort', 'CustomElementRegistry',
+    'XMLHttpRequestEventTarget', 'HTMLMediaElement', 'HTMLVideoElement',
+    'HTMLAudioElement', 'WebGL2RenderingContext',
   ];
   var _desc = { value: undefined, writable: true, enumerable: false, configurable: true };
   for (var _i = 0; _i < _names.length; _i++) {

From 84513d5bcc8ffffb99b604107c4dba72d86d57b8 Mon Sep 17 00:00:00 2001
From: lisa0314 <lishaguo1991@outlook.com>
Date: Mon, 3 Aug 2026 14:42:03 +0800
Subject: [PATCH 17/17] feat(cdp): support DOM.scrollIntoViewIfNeeded

---
 crates/obscura-cdp/src/domains/dom.rs | 115 ++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)

diff --git a/crates/obscura-cdp/src/domains/dom.rs b/crates/obscura-cdp/src/domains/dom.rs
index 7625a03..55b8820 100644
--- a/crates/obscura-cdp/src/domains/dom.rs
+++ b/crates/obscura-cdp/src/domains/dom.rs
@@ -236,6 +236,25 @@ pub async fn handle(
             let _ = page.evaluate(&code);
             Ok(json!({}))
         }
+        "scrollIntoViewIfNeeded" => {
+            let page = ctx.get_session_page_mut(session_id).ok_or("No page")?;
+            let node_id = resolve_node_id(page, params)?;
+            // Obscura has no layout viewport to move, but the JS shim records
+            // this element for the hit testing used by subsequent input events.
+            let code = format!(
+                "(function() {{ var el = globalThis._wrap && globalThis._wrap({0}); \
+                 if (!el || typeof el.scrollIntoView !== 'function') return false; \
+                 el.scrollIntoView(); return true; }})()",
+                node_id
+            );
+            let did_scroll = page.evaluate(&code).as_bool().unwrap_or(false);
+            if !did_scroll {
+                return Err(format!(
+                    "node {node_id} could not be resolved to a scrollable element"
+                ));
+            }
+            Ok(json!({}))
+        }
         "setFileInputFiles" => {
             // Puppeteer's ElementHandle.uploadFile / Playwright's setInputFiles
             // drive an <input type=file> through this CDP call (issue #359). Read
@@ -526,6 +545,102 @@ mod tests {
         );
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn scroll_into_view_if_needed_resolves_all_node_identifiers() {
+        let mut ctx = CdpContext::new();
+        let page_id = ctx.create_page();
+        let session = Some(format!("{page_id}-session"));
+        ctx.sessions.insert(session.clone().unwrap(), page_id);
+
+        crate::domains::page::handle(
+            "navigate",
+            &json!({
+                "url": "data:text/html,<main><button id=target>Go</button></main>",
+                "waitUntil": "load"
+            }),
+            &mut ctx,
+            &session,
+        )
+        .await
+        .expect("navigate should succeed");
+
+        let query = handle(
+            "querySelector",
+            &json!({ "selector": "#target" }),
+            &mut ctx,
+            &session,
+        )
+        .await
+        .expect("querySelector should succeed");
+        let node_id = query["nodeId"].as_u64().expect("button nodeId");
+
+        let resolved = handle(
+            "resolveNode",
+            &json!({ "nodeId": node_id }),
+            &mut ctx,
+            &session,
+        )
+        .await
+        .expect("resolveNode should succeed");
+        let object_id = resolved["object"]["objectId"]
+            .as_str()
+            .expect("button objectId")
+            .to_string();
+
+        for params in [
+            json!({ "nodeId": node_id }),
+            json!({ "backendNodeId": node_id }),
+            json!({ "objectId": object_id }),
+        ] {
+            ctx.get_session_page_mut(&session)
+                .unwrap()
+                .evaluate("globalThis.__obscura_click_target = null");
+
+            handle("scrollIntoViewIfNeeded", &params, &mut ctx, &session)
+                .await
+                .expect("scrollIntoViewIfNeeded should succeed");
+
+            let target_id = ctx
+                .get_session_page_mut(&session)
+                .unwrap()
+                .evaluate("globalThis.__obscura_click_target && globalThis.__obscura_click_target.id");
+            assert_eq!(target_id, json!("target"));
+        }
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn scroll_into_view_if_needed_requires_a_node_identifier() {
+        let mut ctx = CdpContext::new();
+        let page_id = ctx.create_page();
+        let session = Some(format!("{page_id}-session"));
+        ctx.sessions.insert(session.clone().unwrap(), page_id);
+
+        let error = handle(
+            "scrollIntoViewIfNeeded",
+            &json!({}),
+            &mut ctx,
+            &session,
+        )
+        .await
+        .expect_err("missing node identifier should fail");
+
+        assert_eq!(error, "nodeId, backendNodeId, or objectId required");
+
+        let error = handle(
+            "scrollIntoViewIfNeeded",
+            &json!({ "nodeId": 999_999 }),
+            &mut ctx,
+            &session,
+        )
+        .await
+        .expect_err("an unknown node should fail");
+
+        assert_eq!(
+            error,
+            "node 999999 could not be resolved to a scrollable element"
+        );
+    }
+
     // A hostile or heavy page can nest nodes tens of thousands deep (trivially
     // scriptable, and html5ever puts no cap on generic nesting). DOM.getDocument
     // with the standard depth:-1 (which becomes u32::MAX here) must handle such a