[Bikebrainz]

What changes

The reflected-tag probe counted inert HTML template contents as active and treated SVG/MathML elements such as title as HTML raw text. The reduced parser now tracks namespaces and template boundaries, including HTML integration points, foreign-content breakouts, self-closing foreign elements, CDATA and escaped script states.

Tag context changes occur only after a complete tag. Attribute values are parsed separately from names, duplicate encoding attributes use their first value, and apparent closing tags inside template comments or raw text remain inert.

The roadmap, changelog and build checklist record the fixes and retain a partial grade. A marker is evidence of element injection, not proof that arbitrary script executes. Frameset insertion modes remain a reproduced false positive; full browser tree construction and XML, stored and DOM XSS are separate work.

Validation

• Windows Release build and all 102 native suites passed.
• Focused reflected-XSS suite: 329 assertions passed.
• Pinned Chromium 151: 1,255 context comparisons passed, including malformed nesting, encoded/duplicate attributes and script states.
• Full live probe suite: 209 passed, zero failed. Thirteen new API cases verify both rejected inert reflections and detected active contexts.
• Website links, generated roadmap and desktop/mobile changelog/roadmap checks passed.
• Expanded native, browser and live API coverage runs in existing CI jobs. Merge requires all eight jobs green on the exact head.

Dependency #28 is merged. This PR contains the HTML-context correction and its tests/documentation.

Owner: Bikebrainz.

All eight CI jobs passed on c2539ce: https://github.com/Bikebrainz/Nullock/actions/runs/36658036595