diff --git a/CLAUDE.md b/CLAUDE.md
index 060685f..89c6e33 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -13,7 +13,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Overview
 
-RDFa-Editor is a prototype XHTML+RDFa authoring tool using client-side XSLT. Content lives in a `#content` container of structured blocks (p, h1–h3, ul/ol, blockquote, pre, figure, table), always editable Notion-style: typing within blocks, Enter splits, Backspace-at-start merges, toolbar for block types / inline formatting / lists / figures / tables / links, drag-handle reordering. Tables are composite blocks (structure locked; `td`/`th`/`caption` editable) inserted via a rows×cols dialog with an optional header row and caption; row/column toolbar controls, Tab/Shift+Tab cell traversal and Enter (step down a column) all grow the grid at its bottom edge. Right-click a text selection to annotate it with RDFa; right-click an existing annotation to edit or remove it. "Extract RDF" shows the page's triples; "Source" shows the canonical XHTML+RDFa serialization (all editing ephemera stripped).
+RDFa-Editor is a prototype XHTML+RDFa authoring tool using client-side XSLT. Content lives in a `#content` container of structured blocks (p, h1–h3, ul/ol, blockquote, pre, figure, table), always editable Notion-style: typing within blocks, Enter splits, Backspace-at-start merges, toolbar for block types / inline formatting / lists / figures / tables / links, drag-handle reordering. Nesting follows the **XHTML Strict content model** (see content-model.xsl below): `blockquote` is a block *container* (`blockquote > p+` — bare text inside it is invalid and gets normalized; the toolbar quote toggle wraps/unwraps), `li`/`td`/`th`/`dd`/`figcaption` are `%Flow;` (mixed text AND nested blocks — Tab/Shift+Tab indent/outdent nested lists), `p`/`h1–h6`/`caption`/`dt` are inline-only. Tables are composite blocks (structure locked; `td`/`th`/`caption` editable) inserted via a rows×cols dialog with an optional header row and caption; row/column toolbar controls, Tab/Shift+Tab cell traversal and Enter (step down a column) all grow the grid at its bottom edge. Right-click a text selection to annotate it with RDFa; right-click an existing annotation to edit or remove it. "Extract RDF" shows the page's triples; "Source" shows the canonical XHTML+RDFa serialization (all editing ephemera stripped).
 
 ## Architecture
 
@@ -23,15 +23,17 @@ Modules under `src/`:
 
 - **index.xsl** — entry point: `$vocab-hrefs` param, `main` template (async vocabulary prefetch via `ixsl:schedule-action/@document`, then overlay init), `local:document-uri()`.
 - **RDFa2RDFXML-v3.xsl** — RDFa 1.1 → RDF/XML extraction. **Pure XSLT, no `ixsl:`** — it runs headless via `xslt3` for the test suite. Strictly W3C-conformant (RDFa 1.1 processing rules, section 7.5, including chaining via typed resources and `rdfa:usesVocabulary`). Covers `@about`/`@typeof`/`@property`/`@content`/`@datatype`/`@resource`/`@href`/`@src`/`@prefix` (and `xmlns:*`)/`@vocab` with bare terms, `@lang`+`@xml:lang` inheritance, base-URI resolution (`about=""` = the document, `<base href>` honored), and exclusion of `head`/`script`/`style`/`[data-role='rendering']` subtrees. Out of scope (documented future work): `@rel`/`@rev`, `@inlist`, safe CURIEs, `@datetime`/`<time>`, `xml:base`.
+- **content-model.xsl** — the XHTML content model as data. **Pure XSLT, include-free** (no dependencies; `index.xsl` includes it once, before its consumers): a 1:1 transcription of the XHTML 1.0 Strict DTD (Second Edition, Appendix A.1 entities + element declarations) and the Appendix B prohibitions, extended with HTML5 `figure`/`figcaption`. `$cm:model` (element → allowed children + `#PCDATA` flag), `$cm:prohibitions`, predicates `cm:known`/`cm:block`/`cm:inline`/`cm:allows-child`/`cm:allows-text`/`cm:inline-only`/`cm:flow`/`cm:structural`/`cm:valid-nesting`. The **single source of truth** for nesting: editability init and keyboard machines (edit.xsl), boundary normalization (canonical-xhtml.xsl) and nesting lint (lint-xhtml.xsl) all consult it, so verdicts can't drift. `$cm:model` is built with `map:merge`+`map:entry` — the SaxonJS compiler fails an internal assertion on large nested map literals. The editor contract "region children are blocks" is deliberately NOT in this module.
 - **vocab.xsl** — generic ontology RDF/XML → dropdown options. Handles typed elements (`<owl:Class rdf:about>`) and `rdf:Description`+`rdf:type` shapes (including striped one-triple-per-description files like DCMI terms); labels as attributes or child elements; terms outside the ontology namespace filtered out.
 - **overlay.xsl** — the annotation form (single copy), form reading (`local:form-values` map), pre-filling (`local:populate-form`), show/hide with viewport clamping (`local:show-at`, shared with the edit dialogs).
 - **annotate.xsl** — the unified right-click dispatcher (edit vs create), `local:apply-annotation` (single write path for RDFa attributes), shared `local:wrap-range`/`local:unwrap-element` (used by annotations AND inline formatting), invalid-selection flash, the shared output modal (`local:show-output`).
-- **edit.xsl** — the XHTML editor: per-block-kind `contenteditable` init (`ul`/`ol`/`figure`/`table` structure locked; `li`/`figcaption`/`td`/`th`/`caption` editable; `img` never editable but given `tabindex="-1"` so a block image is a focusable **navigation island**), first-child chrome injection (`span[@data-role='chrome']`, hover-revealed via CSS), the Enter/Backspace state machine (split/merge primitives with explicit caret placement), plain-text-only paste, toolbar (block-type conversion preserving RDFa attributes, strong/em toggles, link/figure dialogs), block insert/delete, and drag-and-drop ported from LinkedDataHub's `client/block.xsl` (handle-gated `draggable`, midpoint before/after marks). Arrow-key block crossing walks `local:nav-targets` (editable hosts **plus** block images, in document order): a host gets a caret, an image is *selected* (`local:select-image` focuses it, clearing the caret) — so images are never skipped; on a selected image, arrows step to the adjacent target and Backspace/Delete removes the whole figure (no confirm, undo-covered). Table cell keys (Tab/Enter) and the table dialog live in **tables.xsl**.
-- **tables.xsl** — table blocks as a composite kind: the insert dialog (rows×cols + header-row + caption, modeled on the figure dialog), positional row/column operations (`local:op-insert-row`/`-column`, `-delete-row`/`-column`) gated behind `local:has-spans` (disabled on pasted `colspan`/`rowspan` grids — positional edits would corrupt a spanned table) and toolbar-synced via `local:sync-table-toolbar` riding `local:update-breadcrumb`, plus `local:table-tab`/`local:table-enter` cell traversal that appends a body row at the bottom edge. Deleting the last body row/column is a no-op — the confirm-guarded delete-block button removes the whole table. **Undo hazard:** a chrome `span` serialized as a direct child of `<table>` is foster-parented out by the HTML fragment parser on `innerHTML` restore, so `local:restore-snapshot` drops stray region-child chrome and re-injects (idempotent) before caret resolution.
+- **edit.xsl** — the XHTML editor. **Recursive editability init** (`local:init-block`): an element is a *text host* (contenteditable) while its content model allows text and it holds no block children; mixed flow containers (`li`/`td`/`dd`/… with blocks) and structural containers (blockquote, lists, figure, table) lock their own markup and recurse into their parts (`figure` is always composite: image island + caption host); `img` never editable but given `tabindex="-1"` so a block image is a focusable **navigation island**. **Run wrappers**: the stray inline runs of a mixed flow container (`<li>text<ul>…</ul></li>`) get an ephemeral `p.rdfa-editor-run` host (`local:wrap-stray-runs`) so they stay editable — unwrapped again at canonicalization (C11), so mixed content round-trips byte-identical; structural gestures promote a wrapper to a real paragraph. **Load-init normalization**: each region is probed for invalid nesting (`cm:valid-nesting`, stray text in structural containers, stray region-level inline) and rebuilt through `mode="cm-normalize"` only when invalid (the valid case is zero-churn; host-page node references into a rewritten region go stale, same as undo restore). First-child chrome injection is a **top-level-only** affordance (`span[@data-role='chrome']`, hover-revealed via CSS) — nested hosts never carry drag handles. The Enter/Backspace state machine (split/merge primitives with explicit caret placement): splitting a run wrapper *promotes* it (marker class off); E4a — Enter on the empty last item of a *nested* list outdents one level (progressive), E4b — top-level exits to a paragraph; B2 merges text blocks, B2b descends into a preceding non-composite container's (blockquote/list) last host — bare text in the container itself would be invalid — while tables/figures stay hard boundaries (B3); B4 merges an `li` into the *visually preceding line* (`local:merge-host-in` — the last host of the previous item, unless it sits inside a nested table/figure: composites are hard boundaries at any depth, the gesture stays inert), B4b outdents the first item of a nested list, B4c merges the first item of a container-nested list (cell, quote, dd) into the preceding line inside the container — dissolving the emptied list and collapsing the container back to a text host — B7 exits the first block of a blockquote upward (emptied quote removed); E4b anchors the list-exit paragraph *before* removal, so it lands where the list was (inside the cell/quote for nested lists); E6 anchors the caption-exit paragraph after the figure/table itself (which may be nested). **Ancestor walks clamp at the region root** (`[exists(local:block-of(.))]` on `local:item-of`, the Tab cell lookup and the quote-toggle's blockquote lookup) — a host-page li/td/blockquote wrapping an embedded region is never touched. A focused image island deletes its *figure* when it has one, else just the image — never the whole containing list/table. **Tab/Shift+Tab** indent/outdent list items (`local:list-indent`/`local:list-outdent`: indent moves the item into a trailing-or-fresh nested list *inside the previous item* per `ul → (li)+`; outdent moves it after the container item, demoting followers into a nested list inside it; `local:collapse-container` reverts an emptied container to a text host; extremes flash) — the innermost context wins over table-cell traversal (li-in-td indents, a table nested in an item traverses). The **quote toggle** (`format-quote`) wraps the current host block in a `blockquote` where the parent admits one / unwraps all children out (refused with a flash when the quote carries RDFa — triples would drop); the block-type select is **host-based** (`local:current-host`): a paragraph inside a quote converts alone, non-convertible hosts disable it. The **insert buttons** (+¶, lists) place the new block per the content model (`local:insert-block-at-caret`): after the caret's host when its parent admits the kind, *inside* a leaf flow host otherwise (a list inserted in a cell nests in the cell; in a list item it becomes a sublist), after the top-level block as a last resort. **Paste** is cm-driven: clipboard HTML runs `mode="canonical"` + `mode="cm-normalize"`, then blocks land *inside* a mixed flow host (`local:paste-into-flow-host` — head/tail runs wrapped, host re-inited as container), or as siblings of an inline-only host via split-and-thread (when `cm:allows-child` permits), or flatten to text (caption, dt). Drag-and-drop ported from LinkedDataHub's `client/block.xsl` (handle-gated `draggable`, midpoint before/after marks). Arrow-key block crossing walks `local:nav-targets` (editable hosts **plus** block images, in document order): a host gets a caret, an image is *selected* (`local:select-image` focuses it, clearing the caret) — so images are never skipped; on a selected image, arrows step to the adjacent target and Backspace/Delete removes the whole figure (no confirm, undo-covered). Table cell keys (Tab/Enter) and the table dialog live in **tables.xsl**.
+- **tables.xsl** — table blocks as a composite kind: the insert dialog (rows×cols + header-row + caption, modeled on the figure dialog), positional row/column operations (`local:op-insert-row`/`-column`, `-delete-row`/`-column`) gated behind `local:has-spans` (disabled on pasted `colspan`/`rowspan` grids — positional edits would corrupt a spanned table) and toolbar-synced via `local:sync-table-toolbar` riding `local:update-breadcrumb`, plus `local:table-tab`/`local:table-enter` cell traversal that appends a body row at the bottom edge. Cells are `%Flow;` containers: every caret landing resolves through `local:first-host-in`/`local:last-host-in`, so a cell holding blocks lands the caret in its first/last editable host; the Tab dispatcher (edit.xsl) passes the *cell* as the traversal host even when the caret sits in a nested block. Deleting the last body row/column is a no-op — the confirm-guarded delete-block button removes the whole table. **Undo hazard:** a chrome `span` serialized as a direct child of `<table>` is foster-parented out by the HTML fragment parser on `innerHTML` restore, so `local:restore-snapshot` drops stray region-child chrome and re-injects (idempotent) before caret resolution.
 - **undo.xsl** — unified snapshot undo/redo over `#content` innerHTML: every mutating handler calls `local:push-undo` first and `local:after-mutation` last; plain typing coalesces into ~1s bursts via `ixsl:onbeforeinput`. Ctrl/Cmd+Z / Shift+Z / Ctrl+Y are intercepted (native undo is replaced). Stacks live in a hidden DOM stash (`#undo-storage`, `data-role="storage"`) — JS arrays don't survive the IXSL boundary and sequence-valued window properties keep only their first item. Caret restoration after undo is approximate (first host) by design.
 - **navigate.xsl** — FontoXML-inspired navigation: ToC drawer (recursive `for-each-group group-starting-with` outline, click-to-jump, section drag-reorder via `local:section-of`), breadcrumb bar (element path + `rdfa:in-scope-subject` at the caret), lint surfacing (markers + badge + issues modal), find & replace (single-text-node matches, `nodeValue`-rewrite replace-all — annotation-safe by construction).
 - **lint-rdfa.xsl** — RDFa lint logic. **Pure XSLT**, tested headless via `tests/lint-driver.xsl` (`xsl:import` resolves the output-method conflict). Reuses the extractor's resolution functions so lint verdicts can't drift from extraction semantics. Checks: term-unresolvable, empty-href, content-resource-conflict, empty-literal, about-relative.
-- **canonical-xhtml.xsl** — canonical serialization form. **Pure XSLT** (`mode="canonical"`), tested headless: drops `*[@data-role]` subtrees, strips `contenteditable`/`draggable`/`class`/`id`/`style`/`tabindex`/`aria-*`/`data-*`, normalizes browser mess (`b`→`strong`, `i`→`em`, `font`/`u`/meaningless `span` unwrap, attributeless `div`→`p`, empty non-RDFa inline pruning, trailing-`br` drop, `br`-in-`pre`→newline). RDFa attributes and `pre` whitespace are never touched.
+- **lint-xhtml.xsl** — nesting lint (`lint:nesting-issues`, concatenated with `lint:element-issues` at every surfacing site). **Pure XSLT**, consults content-model.xsl only, so verdicts can't drift from normalization. Checks: invalid-nesting (known child not allowed by known parent), stray-text (non-ws text in an element-only container), prohibited-nesting (Appendix B), unknown-element (outside the model — preserved, unvalidated).
+- **canonical-xhtml.xsl** — canonical serialization form. **Pure XSLT**, tested headless via `tests/canonical-driver.xsl` (it consults `cm:*`, so it is no longer standalone-compilable). **Two passes in fixed order**: `mode="canonical"` (drops `*[@data-role]` subtrees — nesting analysis must never see chrome; strips `contenteditable`/`draggable`/`class`/`id`/`style`/`tabindex`/`aria-*`/`data-*`; normalizes browser mess: `b`→`strong`, `i`→`em`, `font`/`u`/meaningless `span` unwrap, empty non-RDFa inline pruning, trailing-`br` drop, `br`-in-`pre`→newline; content-aware `div`: inline-content attributeless div → `p` (C7a), block-holding attributeless div unwraps (C7b); run-wrapper `p.rdfa-editor-run` unwraps (C11) unless RDFa-annotated; non-RDFa HTML5 sectioning wrappers unwrap (C12)), then `mode="cm-normalize"` (N-rules: N1 matches every inline-only element and decides on the PROCESSED children, so inner splits reach the fixed point in one bottom-up pass — an RDFa-bearing parent keeps its blocks as recursively-demoted inline via `mode="cm-demote"` (a list becomes nested spans, never a bare `li` in a `span`), a plain parent splits around them with shells keeping ALL attributes (an `<a href>` split by a block keeps its target on both halves — safe, the branch is non-RDFa by construction); N2 blockquote stray runs → `p`; N3/N4/N5 `ul`/`dl`/`tr` strays wrapped in `li`/`dd`/`td`; N5b section strays → rows; N6 invalid `table` children hoisted before it; N7/N8 Appendix B fixes: `pre` exclusions unwrap/alt-text, `a`-in-`a` → `span` with attributes kept). `cm:wrap-inline-runs` pulls only text and known-inline elements into its inline-only wrapper — blocks, ephemera, unknowns AND known non-inline strays (an `li` outside any list) pass through bare for lint to report, never wrapped into fresh invalid nesting. The entry template finally coerces region children to blocks (the editor contract, not the DTD's). Shared primitives `cm:normalize`, `cm:wrap-inline-runs`, `cm:coerce-children` are reused by edit.xsl's load-init and paste. RDFa attributes and `pre` whitespace are never touched.
 
 The editor **emits absolute IRIs** in RDFa attributes (LinkedDataHub v6 convention — no CURIEs/`@vocab`/`@prefix` in output).
 
@@ -50,16 +52,19 @@ Run `make sef` after any XSLT change; run the tests after any extractor change.
 ## Key constraints
 
 - **No deviation from W3C specs.** The extractor follows the RDFa 1.1 processing rules exactly. Markup that relies on non-conformant readings (e.g. `about="#part" property="schema:hasPart"` expected to yield an edge) is a markup bug — the conformant containment idiom is `property="…hasPart" resource="#part" typeof="…"`.
+- **Content model: XHTML 1.0 Strict + HTML5 figure**, transcribed in `content-model.xsl` — nesting the DTD allows must round-trip intact; nesting it disallows is normalized at boundaries (canonical serialization, paste, load-init) and reported by lint. This changed the **storage contract for blockquote**: it is block-only, so stored bare-text quotes are rewritten to `blockquote > p` once at load/save (LDH content audit advised).
+- All `innerHTML` writes of serialized XDM use `serialize(…, map{ 'method': 'html' })` — XML's self-closing `<p/>` reads as an *open* tag to the HTML fragment parser and swallows following siblings.
 - The `$base-uri` global param is declared in `RDFa2RDFXML-v3.xsl` **only** — a second declaration in an including module is a static error (XTSE0630). The browser passes the page URI as a template param to `extract-rdfa` instead.
 - The SEF is compiled with `-relocate:on`: relative `doc()`/`document()`/`@document` hrefs resolve against the SEF's **load location** (`dist/`), which is why `generate-sef.sh` copies `vocabs/` to `dist/vocabs/`.
 - Form state (`checked`/`value`/`disabled`) is read **and** written via `ixsl:get`/`ixsl:set-property` — the attributes never reflect user input. `ixsl:set-attribute` is used only for RDFa attributes that must serialize into content.
 - Vocabularies are plain ontology RDF/XML files in `vocabs/` — no custom manifest format. Adding a vocabulary = drop the file in `vocabs/` and add its href to `$vocab-hrefs`.
 - `src/index.xsl` (and other editor modules) may use DOCTYPE entities; the SaxonJS compiler does not expand them, hence the `xmlstarlet c14n` step in `generate-sef.sh`. The extractor is entity-free so the test suite runs against `src/` directly.
 - Tests: expected files are authored as readable, grouped RDF/XML; `tests/normalize.xsl` canonicalizes both sides into sorted triple lists, so prefixes/grouping/order don't matter. Blank-node labels are deterministic sibling-position paths (e.g. `b1.1.2`), not `generate-id()`. Canonical-XHTML fixtures live in `tests/fixtures/canonical/` and compare via `tests/normalize-xhtml.xsl` (whitespace-only text dropped only in element-only containers — `pre` stays exact).
-- **Editable region convention**: the host page provides `<div id="content" about="" typeof="…">` with blocks as direct children and **no hardcoded `contenteditable`** — init sets editability per block kind and injects chrome. Everything carrying `@data-role` (chrome, rendering) is ephemeral: skipped by the extractor, stripped by canonicalization (LDH v6 contract).
+- **Editable region convention**: the host page provides `<div id="content" about="" typeof="…">` with blocks as direct children and **no hardcoded `contenteditable`** — init sets editability recursively per the content model and injects chrome (top-level only). Everything carrying `@data-role` (chrome, rendering) is ephemeral: skipped by the extractor, stripped by canonicalization (LDH v6 contract).
+- **Run-wrapper contract**: `p.rdfa-editor-run` is an editing-DOM-only marker for the stray inline runs of mixed flow containers — created by init/paste, unwrapped by canonicalization (C11), promoted to a real `p` by structural gestures, never by plain typing. It renders margin-free via `rdfa-editor.css`.
 - **Undo contract**: every mutating handler pushes a snapshot first (`local:push-undo`, optionally with a pre-captured `$snapshot` when the operation can fail) and calls `local:after-mutation` last — never push from shared primitives. Undo/redo restore invalidates all node-valued window properties (cleared in `local:restore-snapshot`) and closes overlay/dialogs. The caret rides along on stash entries as (block, text-node, offset) data attributes and is restored on undo/redo.
 - **Content markers**: anything written into `#content` for UI purposes must be `@class` (or `aria-*`) only — both are canonicalization-stripped. `@title` is NOT stripped and is forbidden as a marker.
-- **SaxonJS gotchas**: computed numeric predicates (`[xs:integer(...)]`) are evaluated as booleans in some contexts — bind to a variable and use the bare `[$index]` form. JS arrays returned by `ixsl:call` marshal to XDM sequences (empty array = empty sequence).
-- Browser tests live in `tests/browser/` (`npm run test:browser` self-serves the repo): `editor.mjs`, `features.mjs`, `fixes.mjs`, `hardening.mjs`. CI runs both headless loops and the browser suites (`.github/workflows/ci.yml`).
+- **SaxonJS gotchas**: computed numeric predicates (`[xs:integer(...)]`) are evaluated as booleans in some contexts — bind to a variable and use the bare `[$index]` form. JS arrays returned by `ixsl:call` marshal to XDM sequences (empty array = empty sequence). Large nested map literals fail the compiler with an internal assertion — build them with `map:merge` over `map:entry` (see `$cm:model`).
+- Browser tests live in `tests/browser/` (`npm run test:browser` self-serves the repo): `editor.mjs`, `features.mjs`, `fixes.mjs`, `hardening.mjs`, `multiinstance.mjs`, `tables.mjs`, `datatype.mjs`, `inspector.mjs`, `nesting.mjs` (content-model foundation), `authoring.mjs` (nesting gestures) and `invariants.mjs` (the cross-product net: a uniform gesture battery in every caret context asserting properties that must always hold — no orphan text outside an editable host, no nested hosts, chrome top-level only, run wrappers editable, zero lint issues, undo restores the exact baseline), all against `tests/fixture-nesting.html`. Scenario tests assert *semantics* (where things land); the invariant suite catches *validity/editability/undo* regressions in combinations nobody enumerated. CI runs both headless loops and the browser suites (`.github/workflows/ci.yml`).
 - **Sanitization**: `canonical-xhtml.xsl` is the storage boundary — it drops script/style/iframe/object/embed/applet/form controls/link/meta/base subtrees, comments/PIs, all `on*` attributes, and `javascript:`/`vbscript:`/`data:` URLs (`data:image/*` allowed in `@src`). HTML paste goes through this same mode. Lint mirrors these as `unsafe-attribute`/`unsafe-url`.
 - Editor-contract CSS lives in `rdfa-editor.css` (host pages include it; the container needs ~2.5em left padding for the gutter handles); `index.html` keeps only demo styles.
diff --git a/rdfa-editor.css b/rdfa-editor.css
index e90dda8..97f5bb3 100644
--- a/rdfa-editor.css
+++ b/rdfa-editor.css
@@ -85,6 +85,12 @@
                 width: 2.25em;
             }
 
+/* the editing-DOM run wrapper (mixed flow content, e.g. <li>text<ul>...) renders
+   like the bare inline run it stands for; unwrapped again at canonicalization */
+            .rdfa-editor-content p.rdfa-editor-run {
+                margin: 0;
+            }
+
 .rdfa-editor-content figure {
                 margin: 16px 0;
             }
diff --git a/src/canonical-xhtml.xsl b/src/canonical-xhtml.xsl
index b921f0b..a815c53 100644
--- a/src/canonical-xhtml.xsl
+++ b/src/canonical-xhtml.xsl
@@ -2,34 +2,119 @@
 <xsl:stylesheet
 xmlns="http://www.w3.org/1999/xhtml"
 xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+xmlns:xs="http://www.w3.org/2001/XMLSchema"
+xmlns:cm="urn:rdfa-editor:content-model"
 xpath-default-namespace="http://www.w3.org/1999/xhtml"
 exclude-result-prefixes="#all"
 version="3.0">
 
 <!--
     Canonical XHTML+RDFa serialization form. Pure XSLT 3.0 - no ixsl: dependencies,
-    so it runs headless via xslt3 for testing (see tests/run-tests.sh).
+    so it runs headless for testing (see tests/run-tests.sh), but NOT standalone-
+    compilable: it consults content-model.xsl (cm:*) - include/import both together
+    (index.xsl does; the test driver is tests/canonical-driver.xsl).
 
-    Strips editing ephemera per the LDH v6 convention (everything carrying @data-role
-    is removable by construction: injected chrome, hydrated rendering output) and
-    normalizes browser-generated markup mess. RDFa attributes and pre whitespace are
-    never touched; text is never reflowed.
+    Two passes in a fixed order:
+    1. mode="canonical"     strips editing ephemera per the LDH v6 convention
+                            (everything carrying @data-role is removable by
+                            construction), sanitizes, and normalizes browser mess.
+                            Nesting analysis must never see chrome, so this runs first.
+    2. mode="cm-normalize"  coerces the result to the XHTML Strict content model
+                            (blockquote is block-only, p is inline-only, ul holds
+                            only li, ...), always RDFa-preserving. The load-init
+                            path (edit.xsl) runs this pass ALONE on host content.
+
+    The entry template finally applies the editor contract - region children are
+    blocks - which is deliberately not part of the DTD transcription.
+    RDFa attributes and pre whitespace are never touched; text is never reflowed.
 -->
 
     <!-- serialization is the caller's job (view-source serialize(), test -o output);
          no xsl:output here - it would conflict with the including stylesheet's -->
     <xsl:mode name="canonical" on-no-match="shallow-copy"/>
+    <xsl:mode name="cm-normalize" on-no-match="shallow-copy"/>
 
     <xsl:template name="canonical-xhtml">
         <xsl:param name="content" as="element()" select="/*"/>
-        <xsl:apply-templates select="$content" mode="canonical"/>
+        <xsl:variable name="pass1" as="node()*">
+            <xsl:apply-templates select="$content" mode="canonical"/>
+        </xsl:variable>
+        <xsl:for-each select="$pass1/self::*">
+            <xsl:copy>
+                <xsl:copy-of select="@*"/>
+                <!-- editor contract (not the DTD's rule): region children are blocks -->
+                <xsl:sequence select="cm:wrap-inline-runs(cm:normalize(node()), 'p')"/>
+            </xsl:copy>
+        </xsl:for-each>
     </xsl:template>
 
     <!-- -im:canonical entry for CLI fallback -->
     <xsl:template match="/" mode="canonical">
-        <xsl:apply-templates select="*" mode="#current"/>
+        <xsl:call-template name="canonical-xhtml"/>
     </xsl:template>
 
+    <!-- ................ shared coercion primitives ................ -->
+
+    <xsl:function name="cm:normalize" as="node()*">
+        <xsl:param name="nodes" as="node()*"/>
+        <xsl:apply-templates select="$nodes" mode="cm-normalize"/>
+    </xsl:function>
+
+    <!-- the wrapper is inline-only, so only text and KNOWN-INLINE elements may be
+         pulled into it; everything else passes through bare - blocks and ephemera
+         by design, and both unknown elements (an RDFa-bearing article) and known
+         non-inline strays (an li outside any list) stay put for lint to report
+         rather than being wrapped into fresh invalid nesting. Adjacent runs with
+         substance (an element or non-whitespace text) get wrapped; whitespace-only
+         runs between blocks stay bare. The one grouping axis shared by the entry
+         coercion, N2 and the paste handler (edit.xsl) -->
+    <xsl:function name="cm:wrap-inline-runs" as="node()*">
+        <xsl:param name="kids" as="node()*"/>
+        <xsl:param name="wrapper" as="xs:string"/>
+        <xsl:for-each-group select="$kids"
+                group-adjacent="boolean(self::*[not(cm:inline(local-name(.))) or @data-role])">
+            <xsl:choose>
+                <xsl:when test="current-grouping-key()">
+                    <xsl:sequence select="current-group()"/>
+                </xsl:when>
+                <xsl:when test="exists(current-group()[self::* or self::text()[normalize-space()]])">
+                    <xsl:element name="{$wrapper}">
+                        <xsl:sequence select="current-group()"/>
+                    </xsl:element>
+                </xsl:when>
+                <xsl:otherwise>
+                    <xsl:sequence select="current-group()"/>
+                </xsl:otherwise>
+            </xsl:choose>
+        </xsl:for-each-group>
+    </xsl:function>
+
+    <!-- element-only containers (ul, dl, tr): allowed/@data-role children pass,
+         adjacent runs of anything else get wrapped in the container's item kind -->
+    <xsl:function name="cm:coerce-children" as="node()*">
+        <xsl:param name="kids" as="node()*"/>
+        <xsl:param name="allowed" as="xs:string*"/>
+        <xsl:param name="wrapper" as="xs:string"/>
+        <xsl:for-each-group select="$kids"
+                group-adjacent="boolean(self::*[local-name() = $allowed or @data-role])">
+            <xsl:choose>
+                <xsl:when test="current-grouping-key()">
+                    <xsl:sequence select="current-group()"/>
+                </xsl:when>
+                <xsl:when test="exists(current-group()[self::* or self::text()[normalize-space()]])">
+                    <xsl:element name="{$wrapper}">
+                        <xsl:sequence select="current-group()"/>
+                    </xsl:element>
+                </xsl:when>
+                <xsl:otherwise>
+                    <xsl:sequence select="current-group()"/>
+                </xsl:otherwise>
+            </xsl:choose>
+        </xsl:for-each-group>
+    </xsl:function>
+
+    <!-- ................ pass 1: mode="canonical" ................ -->
+
     <!-- C1: everything carrying @data-role is ephemeral (chrome, rendering) -->
     <xsl:template match="*[@data-role]" mode="canonical" priority="2"/>
 
@@ -80,13 +165,41 @@ version="3.0">
         <xsl:apply-templates select="node()" mode="#current"/>
     </xsl:template>
 
-    <!-- C7: browser-generated attributeless div becomes a paragraph; RDFa-bearing divs pass -->
-    <xsl:template match="div[not(@property or @about or @typeof or @resource)]" mode="canonical">
+    <!-- C7a: browser-generated attributeless div with inline content becomes a
+         paragraph; RDFa-bearing divs pass -->
+    <xsl:template match="div[not(@property or @about or @typeof or @resource)]
+            [empty(*[cm:block(local-name(.))])]" mode="canonical">
         <p>
             <xsl:apply-templates select="@* | node()" mode="#current"/>
         </p>
     </xsl:template>
 
+    <!-- C7b: an attributeless div holding blocks is a semantics-free grouping
+         wrapper (p may not contain blocks) - unwrap to its children; stray inline
+         residue is re-coerced by pass 2 in the parent's context -->
+    <xsl:template match="div[not(@property or @about or @typeof or @resource)]
+            [exists(*[cm:block(local-name(.))])]" mode="canonical">
+        <xsl:apply-templates select="node()" mode="#current"/>
+    </xsl:template>
+
+    <!-- C11: the editing-DOM run wrapper (edit.xsl wraps stray inline runs of mixed
+         flow containers in p.rdfa-editor-run so they stay editable) unwraps, so
+         <li>text<ul>...</ul></li> round-trips byte-identical. An annotated wrapper
+         has become real content and stays a p -->
+    <xsl:template match="p[contains-token(@class, 'rdfa-editor-run')]
+            [not(@property or @about or @typeof or @resource or @content or @datatype)]"
+        mode="canonical" priority="1">
+        <xsl:apply-templates select="node()" mode="#current"/>
+    </xsl:template>
+
+    <!-- C12: HTML5 sectioning wrappers have no XHTML Strict equivalent - unwrap
+         clipboard/host wrappers, keep RDFa-bearing ones (dropping them would lose
+         triples; lint reports them as unknown-element) -->
+    <xsl:template match="(section | article | main | aside | header | footer | nav | hgroup)
+            [not(@property or @about or @typeof or @resource)]" mode="canonical">
+        <xsl:apply-templates select="node()" mode="#current"/>
+    </xsl:template>
+
     <!-- C8: empty non-RDFa inline elements are junk; RDFa-bearing empties
          (hidden <span property resource/> definitions) are kept by C6's predicates -->
     <xsl:template match="(strong | em | a | code)[not(normalize-space(.))][not(.//img)]
@@ -101,4 +214,197 @@ version="3.0">
     <xsl:template match="br[not(following-sibling::node()[self::* or self::text()[normalize-space()]])]"
         mode="canonical"/>
 
+    <!-- ................ pass 2: mode="cm-normalize" ................ -->
+
+    <!-- N0: ephemera are placed by the editor, not judged by the DTD (the load-init
+         path runs this pass alone, where chrome and rendering subtrees still exist) -->
+    <xsl:template match="*[@data-role]" mode="cm-normalize" priority="2">
+        <xsl:copy-of select="."/>
+    </xsl:template>
+
+    <!-- N1: blocks inside an inline-only element (p, h1-h6, dt, caption, pre, inlines).
+         Matches EVERY inline-only element and decides on the PROCESSED children, so
+         blocks surfaced by inner splits are handled in the same bottom-up pass (one
+         invocation reaches the fixed point). An RDFa-bearing parent stays whole -
+         its block children demote to inline via mode="cm-demote" (recursive, all
+         attributes kept), so the extracted literal and triples are unchanged. A
+         plain parent splits around its block children; inline runs keep a shell
+         copying ALL attributes (safe: this branch is non-RDFa by construction, so
+         nothing duplicates a triple - an <a href> split by a block keeps its target
+         on both halves); whitespace-only residue between blocks drops -->
+    <xsl:template match="*[cm:inline-only(local-name(.))]" mode="cm-normalize">
+        <xsl:variable name="name" as="xs:string" select="local-name(.)"/>
+        <xsl:variable name="kids" as="node()*">
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </xsl:variable>
+        <xsl:choose>
+            <xsl:when test="empty($kids/self::*[cm:block(local-name(.))])">
+                <xsl:copy>
+                    <xsl:copy-of select="@*"/>
+                    <xsl:sequence select="$kids"/>
+                </xsl:copy>
+            </xsl:when>
+            <xsl:when test="@property or @about or @typeof or @resource or @content or @datatype">
+                <xsl:copy>
+                    <xsl:copy-of select="@*"/>
+                    <xsl:apply-templates select="$kids" mode="cm-demote"/>
+                </xsl:copy>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:variable name="attributes" as="attribute()*" select="@*"/>
+                <xsl:for-each-group select="$kids"
+                        group-adjacent="boolean(self::*[cm:block(local-name(.))])">
+                    <xsl:choose>
+                        <xsl:when test="current-grouping-key()">
+                            <xsl:sequence select="current-group()"/>
+                        </xsl:when>
+                        <xsl:when test="exists(current-group()[self::* or self::text()[normalize-space()]])">
+                            <xsl:element name="{$name}">
+                                <xsl:copy-of select="$attributes"/>
+                                <xsl:sequence select="current-group()"/>
+                            </xsl:element>
+                        </xsl:when>
+                        <xsl:otherwise/>
+                    </xsl:choose>
+                </xsl:for-each-group>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+
+    <!-- inline demotion for content preserved inside an RDFa-bearing inline-only
+         element: every known non-inline element renames to span (all attributes
+         kept), recursively - a demoted list becomes nested spans, never a bare li
+         inside a span. Text, inline and unknown elements pass through with their
+         children demoted likewise -->
+    <xsl:mode name="cm-demote" on-no-match="shallow-copy"/>
+
+    <xsl:template match="*[cm:known(local-name(.))][not(cm:inline(local-name(.)))]" mode="cm-demote">
+        <span>
+            <xsl:copy-of select="@*"/>
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </span>
+    </xsl:template>
+
+    <!-- N2: blockquote (and noscript) is block-only per Strict - stray text/inline
+         runs become paragraphs; RDFa attributes on the container are untouched -->
+    <xsl:template match="blockquote | noscript" mode="cm-normalize">
+        <xsl:variable name="kids" as="node()*">
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </xsl:variable>
+        <xsl:copy>
+            <xsl:copy-of select="@*"/>
+            <xsl:sequence select="cm:wrap-inline-runs($kids, 'p')"/>
+        </xsl:copy>
+    </xsl:template>
+
+    <!-- N3: ul/ol hold only li - stray children become item content (li is flow) -->
+    <xsl:template match="ul | ol" mode="cm-normalize">
+        <xsl:variable name="kids" as="node()*">
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </xsl:variable>
+        <xsl:copy>
+            <xsl:copy-of select="@*"/>
+            <xsl:sequence select="cm:coerce-children($kids, 'li', 'li')"/>
+        </xsl:copy>
+    </xsl:template>
+
+    <!-- N4: dl holds only dt/dd - strays become dd content (dd is flow, dt is not) -->
+    <xsl:template match="dl" mode="cm-normalize">
+        <xsl:variable name="kids" as="node()*">
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </xsl:variable>
+        <xsl:copy>
+            <xsl:copy-of select="@*"/>
+            <xsl:sequence select="cm:coerce-children($kids, ('dt', 'dd'), 'dd')"/>
+        </xsl:copy>
+    </xsl:template>
+
+    <!-- N5: tr holds only th/td - strays become cell content (td is flow) -->
+    <xsl:template match="tr" mode="cm-normalize">
+        <xsl:variable name="kids" as="node()*">
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </xsl:variable>
+        <xsl:copy>
+            <xsl:copy-of select="@*"/>
+            <xsl:sequence select="cm:coerce-children($kids, ('th', 'td'), 'td')"/>
+        </xsl:copy>
+    </xsl:template>
+
+    <!-- N5b: table sections hold only tr - a stray cell run keeps its cells in a
+         fresh row; anything else becomes a one-cell row -->
+    <xsl:template match="thead | tbody | tfoot" mode="cm-normalize">
+        <xsl:variable name="kids" as="node()*">
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </xsl:variable>
+        <xsl:copy>
+            <xsl:copy-of select="@*"/>
+            <xsl:for-each-group select="$kids"
+                    group-adjacent="boolean(self::*[local-name() = 'tr' or @data-role])">
+                <xsl:choose>
+                    <xsl:when test="current-grouping-key()">
+                        <xsl:sequence select="current-group()"/>
+                    </xsl:when>
+                    <xsl:when test="exists(current-group()[self::* or self::text()[normalize-space()]])">
+                        <tr>
+                            <xsl:choose>
+                                <xsl:when test="every $n in current-group()[self::*]
+                                        satisfies local-name($n) = ('th', 'td')">
+                                    <xsl:sequence select="current-group()"/>
+                                </xsl:when>
+                                <xsl:otherwise>
+                                    <td>
+                                        <xsl:sequence select="current-group()"/>
+                                    </td>
+                                </xsl:otherwise>
+                            </xsl:choose>
+                        </tr>
+                    </xsl:when>
+                    <xsl:otherwise>
+                        <xsl:sequence select="current-group()"/>
+                    </xsl:otherwise>
+                </xsl:choose>
+            </xsl:for-each-group>
+        </xsl:copy>
+    </xsl:template>
+
+    <!-- N6: children a table cannot hold are hoisted before it (mirrors browser
+         foster parenting); whitespace and ephemera stay put -->
+    <xsl:template match="table" mode="cm-normalize">
+        <xsl:variable name="kids" as="node()*">
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </xsl:variable>
+        <xsl:variable name="valid" as="xs:string*"
+            select="'caption', 'col', 'colgroup', 'thead', 'tfoot', 'tbody', 'tr'"/>
+        <xsl:sequence select="$kids[(self::*[not(local-name() = $valid)][not(@data-role)])
+            or self::text()[normalize-space()]]"/>
+        <xsl:copy>
+            <xsl:copy-of select="@*"/>
+            <xsl:sequence select="$kids[self::*[local-name() = $valid or @data-role]
+                or self::text()[not(normalize-space())]]"/>
+        </xsl:copy>
+    </xsl:template>
+
+    <!-- N7: Appendix B pre exclusions, text-preserving: size/position markup
+         unwraps, replaced objects fall back to their alternative text -->
+    <xsl:template match="(big | small | sub | sup)[ancestor::pre]" mode="cm-normalize" priority="1">
+        <xsl:apply-templates select="node()" mode="#current"/>
+    </xsl:template>
+
+    <xsl:template match="(img | object)[ancestor::pre]" mode="cm-normalize" priority="1">
+        <xsl:value-of select="@alt"/>
+    </xsl:template>
+
+    <!-- N8: Appendix B nesting prohibitions - the inner element keeps all its
+         attributes (RDFa preserved; a dead @href is harmless) under a valid name -->
+    <xsl:template match="a[ancestor::a]" mode="cm-normalize" priority="1">
+        <span>
+            <xsl:copy-of select="@*"/>
+            <xsl:apply-templates select="node()" mode="#current"/>
+        </span>
+    </xsl:template>
+
+    <xsl:template match="label[ancestor::label]" mode="cm-normalize" priority="1">
+        <xsl:apply-templates select="node()" mode="#current"/>
+    </xsl:template>
+
 </xsl:stylesheet>
diff --git a/src/content-model.xsl b/src/content-model.xsl
new file mode 100644
index 0000000..6f8b3ae
--- /dev/null
+++ b/src/content-model.xsl
@@ -0,0 +1,192 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet
+xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+xmlns:xs="http://www.w3.org/2001/XMLSchema"
+xmlns:map="http://www.w3.org/2005/xpath-functions/map"
+xmlns:cm="urn:rdfa-editor:content-model"
+exclude-result-prefixes="#all"
+version="3.0">
+
+<!--
+    XHTML content model as data: a 1:1 transcription of the XHTML 1.0 Strict DTD
+    (Second Edition, REC-xhtml1-20020801, Appendix A.1) parameter entities and
+    element declarations, plus the Appendix B element prohibitions, extended with
+    HTML5 figure/figcaption (WHATWG HTML 4.4.12-4.4.13) - the one editor block
+    kind XHTML 1.0 lacks.
+
+    Pure XSLT 3.0, include-free, namespace-agnostic (all predicates take element
+    names, callers pass local-name()). The single source of truth for nesting
+    decisions across the editor: editability init and the keyboard state machines
+    (edit.xsl), boundary normalization (canonical-xhtml.xsl) and nesting lint
+    (lint-xhtml.xsl) all consult these predicates, so their verdicts cannot drift
+    apart. The editor contract "region children are blocks" is deliberately NOT
+    encoded here - it is not the DTD's rule.
+-->
+
+    <!-- ................. Appendix A.1 parameter entities ................. -->
+
+    <xsl:variable name="cm:special.pre"  as="xs:string*" select="'br', 'span', 'bdo', 'map'"/>
+    <xsl:variable name="cm:special"      as="xs:string*" select="$cm:special.pre, 'object', 'img'"/>
+    <xsl:variable name="cm:fontstyle"    as="xs:string*" select="'tt', 'i', 'b', 'big', 'small'"/>
+    <xsl:variable name="cm:phrase"       as="xs:string*" select="'em', 'strong', 'dfn', 'code', 'q',
+        'samp', 'kbd', 'var', 'cite', 'abbr', 'acronym', 'sub', 'sup'"/>
+    <xsl:variable name="cm:inline.forms" as="xs:string*" select="'input', 'select', 'textarea', 'label', 'button'"/>
+    <xsl:variable name="cm:misc.inline"  as="xs:string*" select="'ins', 'del', 'script'"/>
+    <xsl:variable name="cm:misc"         as="xs:string*" select="'noscript', $cm:misc.inline"/>
+    <xsl:variable name="cm:inline"       as="xs:string*" select="'a', $cm:special, $cm:fontstyle,
+        $cm:phrase, $cm:inline.forms"/>
+    <xsl:variable name="cm:heading"      as="xs:string*" select="'h1', 'h2', 'h3', 'h4', 'h5', 'h6'"/>
+    <xsl:variable name="cm:lists"        as="xs:string*" select="'ul', 'ol', 'dl'"/>
+    <xsl:variable name="cm:blocktext"    as="xs:string*" select="'pre', 'hr', 'blockquote', 'address'"/>
+    <!-- %block; plus the figure extension (figure is flow/block content in HTML5,
+         so it participates wherever %block; appears: regions, blockquote, li, td) -->
+    <xsl:variable name="cm:block-set"    as="xs:string*" select="'p', $cm:heading, 'div', $cm:lists,
+        $cm:blocktext, 'fieldset', 'table', 'figure'"/>
+
+    <!-- content-model child sets: %Inline;, %Block;, %Flow;, %a.content;, %pre.content; -->
+    <xsl:variable name="cm:Inline-children" as="xs:string*" select="$cm:inline, $cm:misc.inline"/>
+    <xsl:variable name="cm:Block-children"  as="xs:string*" select="$cm:block-set, 'form', $cm:misc"/>
+    <xsl:variable name="cm:Flow-children"   as="xs:string*" select="$cm:block-set, 'form', $cm:inline, $cm:misc"/>
+    <xsl:variable name="cm:a-children"      as="xs:string*" select="$cm:special, $cm:fontstyle,
+        $cm:phrase, $cm:inline.forms, $cm:misc.inline"/>
+    <xsl:variable name="cm:pre-children"    as="xs:string*" select="'a', $cm:fontstyle, $cm:phrase,
+        $cm:special.pre, $cm:misc.inline, $cm:inline.forms"/>
+
+    <!-- ................. per-element content models ................. -->
+
+    <!-- one entry per element declaration: allowed child element names ('children')
+         and whether #PCDATA is allowed ('text'). Empty 'children' + false 'text'
+         = EMPTY. Appendix B prohibitions are NOT folded in here (the DTD cannot
+         express them either) - see $cm:prohibitions.
+         map:merge over map:entry rather than one map literal: the SaxonJS 3
+         compiler fails an internal assertion on large nested map literals -->
+    <xsl:variable name="cm:model" as="map(xs:string, map(*))" select="map:merge((
+        (: %Inline; elements :)
+        ('p', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'address', 'dt', 'caption', 'legend',
+            'label', 'span', 'bdo', $cm:fontstyle, $cm:phrase)
+            ! map:entry(., map{ 'children': $cm:Inline-children, 'text': true() }),
+        (: %Flow; elements :)
+        ('div', 'li', 'dd', 'td', 'th', 'ins', 'del')
+            ! map:entry(., map{ 'children': $cm:Flow-children, 'text': true() }),
+        (: restricted-inline and element-only content models :)
+        map:entry('pre',        map{ 'children': $cm:pre-children, 'text': true() }),
+        map:entry('a',          map{ 'children': $cm:a-children, 'text': true() }),
+        map:entry('blockquote', map{ 'children': $cm:Block-children, 'text': false() }),
+        map:entry('noscript',   map{ 'children': $cm:Block-children, 'text': false() }),
+        (: %form.content; = (%block; | %misc;)* - unlike %Block;, it excludes form
+           (forms must not be nested) :)
+        map:entry('form',       map{ 'children': ($cm:block-set, $cm:misc), 'text': false() }),
+        map:entry('fieldset',   map{ 'children': ('legend', $cm:Flow-children), 'text': true() }),
+        map:entry('button',     map{ 'children': ('p', $cm:heading, 'div', $cm:lists, $cm:blocktext,
+                                    'table', $cm:special, $cm:fontstyle, $cm:phrase, $cm:misc), 'text': true() }),
+        map:entry('object',     map{ 'children': ('param', $cm:Flow-children), 'text': true() }),
+        map:entry('map',        map{ 'children': ($cm:block-set, 'form', $cm:misc, 'area'), 'text': false() }),
+        map:entry('ul',         map{ 'children': 'li', 'text': false() }),
+        map:entry('ol',         map{ 'children': 'li', 'text': false() }),
+        map:entry('dl',         map{ 'children': ('dt', 'dd'), 'text': false() }),
+        map:entry('select',     map{ 'children': ('optgroup', 'option'), 'text': false() }),
+        map:entry('optgroup',   map{ 'children': 'option', 'text': false() }),
+        ('option', 'textarea', 'script')
+            ! map:entry(., map{ 'children': (), 'text': true() }),
+        (: table structure :)
+        map:entry('table',      map{ 'children': ('caption', 'col', 'colgroup', 'thead', 'tfoot', 'tbody', 'tr'), 'text': false() }),
+        ('thead', 'tfoot', 'tbody')
+            ! map:entry(., map{ 'children': 'tr', 'text': false() }),
+        map:entry('tr',         map{ 'children': ('th', 'td'), 'text': false() }),
+        map:entry('colgroup',   map{ 'children': 'col', 'text': false() }),
+        (: EMPTY elements :)
+        ('hr', 'br', 'img', 'param', 'area', 'col', 'input')
+            ! map:entry(., map{ 'children': (), 'text': false() }),
+        (: HTML5 figure extension :)
+        map:entry('figure',     map{ 'children': ($cm:Flow-children, 'figcaption'), 'text': true() }),
+        map:entry('figcaption', map{ 'children': $cm:Flow-children, 'text': true() })
+    ))"/>
+
+    <!-- Appendix B element prohibitions: element name -> ancestor element names
+         under which it must not appear, at any depth -->
+    <xsl:variable name="cm:prohibitions" as="map(xs:string, xs:string*)" select="map{
+        'a':        'a',
+        'img':      'pre',
+        'object':   'pre',
+        'big':      'pre',
+        'small':    'pre',
+        'sub':      'pre',
+        'sup':      'pre',
+        'input':    'button',
+        'select':   'button',
+        'textarea': 'button',
+        'label':    ('button', 'label'),
+        'button':   'button',
+        'form':     ('button', 'form'),
+        'fieldset': 'button',
+        'iframe':   'button',
+        'isindex':  'button'
+    }"/>
+
+    <!-- ................. predicates ................. -->
+
+    <xsl:function name="cm:known" as="xs:boolean">
+        <xsl:param name="name" as="xs:string"/>
+        <xsl:sequence select="map:contains($cm:model, $name)"/>
+    </xsl:function>
+
+    <!-- block-level per %block; (+ figure): the grouping axis for run wrapping -->
+    <xsl:function name="cm:block" as="xs:boolean">
+        <xsl:param name="name" as="xs:string"/>
+        <xsl:sequence select="$name = $cm:block-set"/>
+    </xsl:function>
+
+    <xsl:function name="cm:inline" as="xs:boolean">
+        <xsl:param name="name" as="xs:string"/>
+        <xsl:sequence select="$name = $cm:Inline-children"/>
+    </xsl:function>
+
+    <xsl:function name="cm:allows-child" as="xs:boolean">
+        <xsl:param name="parent" as="xs:string"/>
+        <xsl:param name="child" as="xs:string"/>
+        <xsl:sequence select="$child = $cm:model($parent)?children"/>
+    </xsl:function>
+
+    <xsl:function name="cm:allows-text" as="xs:boolean">
+        <xsl:param name="name" as="xs:string"/>
+        <xsl:sequence select="($cm:model($name)?text, false())[1]"/>
+    </xsl:function>
+
+    <!-- text-bearing element that admits no block children: p, h1-h6, dt, caption, pre, inlines -->
+    <xsl:function name="cm:inline-only" as="xs:boolean">
+        <xsl:param name="name" as="xs:string"/>
+        <xsl:sequence select="cm:allows-text($name) and not($cm:model($name)?children = $cm:block-set)"/>
+    </xsl:function>
+
+    <!-- mixed-content element admitting text AND blocks: li, dd, td, th, div, figure, figcaption -->
+    <xsl:function name="cm:flow" as="xs:boolean">
+        <xsl:param name="name" as="xs:string"/>
+        <xsl:sequence select="cm:allows-text($name) and $cm:model($name)?children = $cm:block-set"/>
+    </xsl:function>
+
+    <!-- element-only container: ul, ol, dl, blockquote, table structure - never a text host -->
+    <xsl:function name="cm:structural" as="xs:boolean">
+        <xsl:param name="name" as="xs:string"/>
+        <xsl:sequence select="cm:known($name) and not(cm:allows-text($name))
+            and exists($cm:model($name)?children)"/>
+    </xsl:function>
+
+    <xsl:function name="cm:prohibited-ancestors" as="xs:string*">
+        <xsl:param name="name" as="xs:string"/>
+        <xsl:sequence select="if (map:contains($cm:prohibitions, $name)) then $cm:prohibitions($name) else ()"/>
+    </xsl:function>
+
+    <!-- an element sits validly under its parent: child of a known parent must be
+         declared, and no Appendix B ancestor prohibition may apply. Unknown child
+         or parent names are not judged (lint reports them as unknown-element) -->
+    <xsl:function name="cm:valid-nesting" as="xs:boolean">
+        <xsl:param name="element" as="element()"/>
+        <xsl:variable name="name" as="xs:string" select="local-name($element)"/>
+        <xsl:sequence select="(empty($element/parent::*)
+                or not(cm:known(local-name($element/parent::*)))
+                or not(cm:known($name))
+                or cm:allows-child(local-name($element/parent::*), $name))
+            and empty($element/ancestor::*[local-name() = cm:prohibited-ancestors($name)])"/>
+    </xsl:function>
+
+</xsl:stylesheet>
diff --git a/src/edit.xsl b/src/edit.xsl
index cae43e6..1ecb9d4 100644
--- a/src/edit.xsl
+++ b/src/edit.xsl
@@ -4,6 +4,7 @@ xmlns="http://www.w3.org/1999/xhtml"
 xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 xmlns:ixsl="http://saxonica.com/ns/interactiveXSLT"
 xmlns:xs="http://www.w3.org/2001/XMLSchema"
+xmlns:cm="urn:rdfa-editor:content-model"
 xmlns:local="urn:rdfa-editor:functions"
 extension-element-prefixes="ixsl"
 xpath-default-namespace="http://www.w3.org/1999/xhtml"
@@ -60,6 +61,37 @@ version="3.0">
         <xsl:sequence select="$node/ancestor-or-self::*[@contenteditable = 'true'][1]"/>
     </xsl:function>
 
+    <!-- the list item a node sits in (the host may be a nested block inside a
+         container item): the unit Tab indent/outdent acts on. Clamped at the
+         region root - a host-page li wrapping an embedded region is not ours -->
+    <xsl:function name="local:item-of" as="element()?">
+        <xsl:param name="node"/>
+        <xsl:sequence select="$node/ancestor-or-self::li[exists(local:block-of(.))][1]"/>
+    </xsl:function>
+
+    <!-- the first/last editable host within an element (the element itself when it
+         is a host): where the caret lands entering a container from either side -->
+    <xsl:function name="local:first-host-in" as="element()?">
+        <xsl:param name="element" as="element()?"/>
+        <xsl:sequence select="($element/descendant-or-self::*[@contenteditable = 'true'])[1]"/>
+    </xsl:function>
+
+    <xsl:function name="local:last-host-in" as="element()?">
+        <xsl:param name="element" as="element()?"/>
+        <xsl:sequence select="($element/descendant-or-self::*[@contenteditable = 'true'])[last()]"/>
+    </xsl:function>
+
+    <!-- the merge target for Backspace joins: the last editable host within an
+         element, unless it sits inside a composite (table, figure) at or below
+         the element - composites are hard boundaries (B3/B6), so an empty result
+         leaves the gesture inert -->
+    <xsl:function name="local:merge-host-in" as="element()?">
+        <xsl:param name="element" as="element()?"/>
+        <xsl:sequence select="local:last-host-in($element)
+            [empty(ancestor-or-self::*[self::table or self::figure]
+                intersect $element/descendant-or-self::*)]"/>
+    </xsl:function>
+
     <!-- keyboard-navigation stops within a region, in document order: the editable
          hosts plus block-level (figure) images. An image can't hold a caret, so it
          is a navigation island in its own right - focused (selected) rather than
@@ -79,6 +111,16 @@ version="3.0">
         <xsl:sequence select="($anchor ! local:block-of(.), ixsl:get(local:editor-state(), 'activeBlock') ! local:block-of(.))[1]"/>
     </xsl:function>
 
+    <!-- host-based resolution for actions that act on the leaf block the caret
+         sits in (block-type convert, quote toggle) rather than the top-level block -->
+    <xsl:function name="local:current-host" as="element()?">
+        <xsl:variable name="selection" select="local:selection()"/>
+        <xsl:variable name="anchor" select="if (ixsl:get($selection, 'rangeCount') ge 1)
+            then ixsl:get($selection, 'anchorNode') else ()"/>
+        <xsl:sequence select="($anchor ! local:host-of(.),
+            ixsl:get(local:editor-state(), 'activeBlock') ! local:host-of(.))[1]"/>
+    </xsl:function>
+
     <xsl:function name="local:chrome-count" as="xs:integer">
         <xsl:param name="block" as="element()"/>
         <xsl:sequence select="count($block/*[@data-role = 'chrome'])"/>
@@ -112,10 +154,12 @@ version="3.0">
 
     <!-- an empty editable host needs a <br> placeholder: without one it has no height
          and no valid caret position (its only child may be non-editable chrome), so
-         clicks and typing go nowhere. Dropped again by canonical-xhtml.xsl -->
+         clicks and typing go nowhere. Dropped again by canonical-xhtml.xsl. Never
+         fires on element-only containers (blockquote) - br is inline content -->
     <xsl:template name="local:ensure-placeholder">
         <xsl:param name="host" as="element()"/>
-        <xsl:if test="local:block-text($host) = '' and empty($host/br)">
+        <xsl:if test="local:block-text($host) = '' and empty($host/br)
+                and cm:allows-child(local-name($host), 'br')">
             <xsl:sequence select="ixsl:call($host, 'appendChild',
                 [ local:element('br') ])[current-date() lt xs:date('2000-01-01')]"/>
         </xsl:if>
@@ -240,6 +284,23 @@ version="3.0">
                 <xsl:call-template name="local:render-table-dialog"/>
             </xsl:result-document>
         </xsl:for-each>
+        <xsl:for-each select="local:roots()">
+            <!-- boundary-normalize invalid host markup (bare text in blockquote,
+                 blocks inside p, stray inline at region level, ...) before
+                 editability init; the probe keeps the valid case zero-churn -->
+            <xsl:variable name="region" as="element()" select="."/>
+            <xsl:variable name="invalid" as="xs:boolean" select="
+                exists($region//*[not(ancestor-or-self::*[@data-role])][not(cm:valid-nesting(.))])
+                or exists($region//*[not(ancestor-or-self::*[@data-role])]
+                    [cm:structural(local-name(.))][text()[normalize-space()]])
+                or exists($region/(text()[normalize-space()] | *[cm:inline(local-name(.))]))"/>
+            <xsl:if test="$invalid">
+                <xsl:variable name="fixed" as="node()*"
+                    select="cm:wrap-inline-runs(cm:normalize($region/node()), 'p')"/>
+                <ixsl:set-property name="innerHTML"
+                    select="serialize($fixed, map{ 'method': 'html' })" object="$region"/>
+            </xsl:if>
+        </xsl:for-each>
         <xsl:for-each select="local:roots()/*">
             <xsl:call-template name="local:init-block">
                 <xsl:with-param name="block" select="."/>
@@ -247,24 +308,109 @@ version="3.0">
         </xsl:for-each>
     </xsl:template>
 
-    <!-- editability per block kind: composite blocks lock their structure -->
+    <!-- editability per the content model, recursively: an element is a text host
+         while it allows text and holds no block children; mixed flow containers
+         (li, td, dd, ... with blocks) and structural containers (blockquote, lists,
+         figure, table) lock their own markup and recurse into their parts. Chrome
+         and drag stay top-level affordances -->
     <xsl:template name="local:init-block">
         <xsl:param name="block" as="element()"/>
+        <xsl:variable name="name" as="xs:string" select="local-name($block)"/>
 
-        <xsl:for-each select="$block[self::p or self::h1 or self::h2 or self::h3
-                or self::blockquote or self::pre],
-                $block[self::ul or self::ol]/li, $block[self::figure]/figcaption,
-                $block[self::table]/(caption, ((thead | tbody | tfoot)/tr, tr)/(td | th))">
-            <ixsl:set-attribute name="contenteditable" select="'true'"/>
-        </xsl:for-each>
+        <xsl:choose>
+            <!-- text host: inline-only elements, and flow elements without block
+                 children (figure is always composite structure - its parts are the
+                 image island, the caption host and any wrapped runs) -->
+            <xsl:when test="not($block/self::figure) and (cm:inline-only($name)
+                    or (cm:flow($name) and empty($block/*[cm:block(local-name(.))])))">
+                <xsl:for-each select="$block">
+                    <ixsl:set-attribute name="contenteditable" select="'true'"/>
+                </xsl:for-each>
+            </xsl:when>
+            <xsl:otherwise>
+                <!-- mixed flow container: stray inline runs get an editable wrapper -->
+                <xsl:if test="cm:flow($name)">
+                    <xsl:call-template name="local:wrap-stray-runs">
+                        <xsl:with-param name="container" select="$block"/>
+                    </xsl:call-template>
+                </xsl:if>
+                <!-- an empty blockquote cannot hold a caret itself: seed a paragraph -->
+                <xsl:if test="$block/self::blockquote and empty($block/*[not(@data-role)])">
+                    <xsl:variable name="p" as="element()" select="local:element('p')"/>
+                    <xsl:sequence select="ixsl:call($p, 'appendChild', [ local:element('br') ])[current-date() lt xs:date('2000-01-01')]"/>
+                    <xsl:sequence select="ixsl:call($block, 'appendChild', [ $p ])[current-date() lt xs:date('2000-01-01')]"/>
+                </xsl:if>
+                <xsl:for-each select="$block/*[not(@data-role)][cm:known(local-name(.))]
+                        [not(cm:inline(local-name(.)))]">
+                    <xsl:call-template name="local:init-block">
+                        <xsl:with-param name="block" select="."/>
+                    </xsl:call-template>
+                </xsl:for-each>
+            </xsl:otherwise>
+        </xsl:choose>
         <!-- block images can't hold a caret, so they are made focusable to serve as
              keyboard-navigation islands (tabindex is canonicalization-stripped) -->
-        <xsl:for-each select="$block[self::figure]//img[empty(ancestor::*[@contenteditable = 'true'])]">
+        <xsl:for-each select="$block/descendant-or-self::img[empty(ancestor::*[@contenteditable = 'true'])]">
             <ixsl:set-attribute name="tabindex" select="'-1'"/>
         </xsl:for-each>
-        <xsl:call-template name="local:inject-chrome">
-            <xsl:with-param name="block" select="$block"/>
-        </xsl:call-template>
+        <xsl:if test="$block/parent::*[contains-token(@class, 'rdfa-editor-content')]">
+            <xsl:call-template name="local:inject-chrome">
+                <xsl:with-param name="block" select="$block"/>
+            </xsl:call-template>
+        </xsl:if>
+    </xsl:template>
+
+    <!-- the inverse of local:wrap-stray-runs: when a flow container loses its last
+         block child, remaining run wrappers unwrap (adjacent runs merge back) and
+         the container becomes a plain text host again -->
+    <xsl:template name="local:collapse-container">
+        <xsl:param name="container" as="element()"/>
+        <xsl:if test="cm:flow(local-name($container))
+                and empty($container/*[not(@data-role)][cm:block(local-name(.)) or self::figcaption]
+                    [not(contains-token(@class, 'rdfa-editor-run')
+                        and not(@property or @about or @typeof or @resource or @content or @datatype))])">
+            <xsl:for-each select="$container/p[contains-token(@class, 'rdfa-editor-run')]
+                    [not(@property or @about or @typeof or @resource or @content or @datatype)]">
+                <xsl:variable name="wrapper" as="element()" select="."/>
+                <xsl:for-each select="1 to xs:integer(ixsl:get($wrapper, 'childNodes.length'))">
+                    <xsl:sequence select="ixsl:call($wrapper, 'before', [ ixsl:get($wrapper, 'firstChild') ])[current-date() lt xs:date('2000-01-01')]"/>
+                </xsl:for-each>
+                <xsl:sequence select="ixsl:call($wrapper, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
+            </xsl:for-each>
+            <xsl:for-each select="$container">
+                <ixsl:set-attribute name="contenteditable" select="'true'"/>
+            </xsl:for-each>
+            <xsl:call-template name="local:ensure-placeholder">
+                <xsl:with-param name="host" select="$container"/>
+            </xsl:call-template>
+        </xsl:if>
+    </xsl:template>
+
+    <!-- editing-DOM run wrapper: the stray inline runs of a mixed flow container
+         are wrapped in p.rdfa-editor-run hosts so they stay editable; the marker
+         class is unwrapped again by canonical-xhtml.xsl (C11), so mixed content
+         like <li>text<ul>...</ul></li> round-trips intact. Blocks, block images,
+         figcaption, ephemera and unknown elements stay put. Structural gestures
+         (Enter-split, block-type convert) promote a wrapper to a real paragraph -->
+    <xsl:template name="local:wrap-stray-runs">
+        <xsl:param name="container" as="element()"/>
+        <!-- snapshot the child sequence: wrapping mutates the live list -->
+        <xsl:variable name="kids" as="node()*" select="$container/node()"/>
+        <xsl:for-each-group select="$kids" group-adjacent="boolean(self::*[cm:block(local-name(.))
+                or self::img or self::figcaption or @data-role or not(cm:known(local-name(.)))])">
+            <xsl:if test="not(current-grouping-key())
+                    and exists(current-group()[self::* or self::text()[normalize-space()]])">
+                <xsl:variable name="wrapper" as="element()" select="local:element('p')"/>
+                <ixsl:set-attribute name="class" select="'rdfa-editor-run'" object="$wrapper"/>
+                <!-- the wrapper IS the run's editable host - callers outside init
+                     (insert, indent, outdent) never re-init the container -->
+                <ixsl:set-attribute name="contenteditable" select="'true'" object="$wrapper"/>
+                <xsl:sequence select="ixsl:call(current-group()[1], 'before', [ $wrapper ])[current-date() lt xs:date('2000-01-01')]"/>
+                <xsl:for-each select="current-group()">
+                    <xsl:sequence select="ixsl:call($wrapper, 'appendChild', [ . ])[current-date() lt xs:date('2000-01-01')]"/>
+                </xsl:for-each>
+            </xsl:if>
+        </xsl:for-each-group>
     </xsl:template>
 
     <!-- first-child chrome keeps split ranges (caret to end of block) clean of it -->
@@ -297,7 +443,6 @@ version="3.0">
                     <option value="h1">Heading 1</option>
                     <option value="h2">Heading 2</option>
                     <option value="h3">Heading 3</option>
-                    <option value="blockquote">Quote</option>
                     <option value="pre">Preformatted</option>
                 </select>
             </div>
@@ -310,6 +455,7 @@ version="3.0">
                 <button type="button" class="insert-block" title="Add paragraph" aria-label="Add paragraph">+ &#xB6;</button>
                 <button type="button" class="insert-list" data-list="ul" aria-pressed="false" title="Bulleted list" aria-label="Bulleted list">&#x2022; List</button>
                 <button type="button" class="insert-list" data-list="ol" aria-pressed="false" title="Numbered list" aria-label="Numbered list">1. List</button>
+                <button type="button" class="format-quote" aria-pressed="false" title="Quote" aria-label="Quote">&#x201C;&#x201D;</button>
             </div>
             <div class="tb-group" role="group" aria-label="Insert">
                 <button type="button" class="insert-figure" title="Insert figure" aria-label="Insert figure">&#x1F5BC;</button>
@@ -361,12 +507,29 @@ version="3.0">
             <xsl:variable name="on" as="xs:boolean" select="exists($list) and local-name($list) = string(@data-list)"/>
             <ixsl:set-attribute name="aria-pressed" select="if ($on) then 'true' else 'false'" object="."/>
         </xsl:for-each>
-        <!-- block-type select follows a convertible current block; other containers leave it as-is -->
-        <xsl:variable name="block" as="element()?" select="$leaf ! local:block-of(.)"/>
-        <xsl:for-each select="$block[self::p or self::h1 or self::h2 or self::h3 or self::blockquote or self::pre]">
-            <xsl:variable name="kind" as="xs:string" select="local-name(.)"/>
-            <xsl:for-each select="id('edit-toolbar', ixsl:page())//select[@name = 'block-type']">
-                <ixsl:set-property name="value" select="$kind" object="."/>
+        <!-- quote toggle: pressed inside a blockquote (of this region - host-page
+             quotes around an embedded region don't count), disabled where neither
+             pressed nor a valid wrap target exists -->
+        <xsl:variable name="in-quote" as="xs:boolean"
+            select="exists($host) and exists($leaf/ancestor-or-self::blockquote[exists(local:block-of(.))])"/>
+        <xsl:variable name="wrappable" as="xs:boolean" select="exists($host[cm:block(local-name(.))]
+            [parent::*[contains-token(@class, 'rdfa-editor-content')]
+                or cm:allows-child(local-name(parent::*), 'blockquote')])"/>
+        <xsl:for-each select="id('edit-toolbar', ixsl:page())//button[contains-token(@class, 'format-quote')]">
+            <ixsl:set-attribute name="aria-pressed" select="if ($in-quote) then 'true' else 'false'" object="."/>
+            <ixsl:set-property name="disabled" select="not($in-quote or $wrappable)" object="."/>
+        </xsl:for-each>
+        <!-- block-type select follows the convertible HOST (a quote paragraph reads
+             as Paragraph); disabled on non-convertible hosts (li, cells, captions) -->
+        <xsl:variable name="convertible" as="element()?"
+            select="$host[self::p or self::h1 or self::h2 or self::h3 or self::pre]"/>
+        <xsl:for-each select="id('edit-toolbar', ixsl:page())//select[@name = 'block-type']">
+            <ixsl:set-property name="disabled" select="empty($convertible)" object="."/>
+            <xsl:for-each select="$convertible">
+                <xsl:variable name="kind" as="xs:string" select="local-name(.)"/>
+                <xsl:for-each select="id('edit-toolbar', ixsl:page())//select[@name = 'block-type']">
+                    <ixsl:set-property name="value" select="$kind" object="."/>
+                </xsl:for-each>
             </xsl:for-each>
         </xsl:for-each>
     </xsl:template>
@@ -417,13 +580,42 @@ version="3.0">
                     </xsl:call-template>
                     <xsl:call-template name="local:after-mutation"/>
                 </xsl:when>
-                <!-- Tab walks table cells (and grows the table); native Tab everywhere else -->
-                <xsl:when test="$key = 'Tab' and (self::td or self::th or self::caption)">
-                    <xsl:call-template name="local:table-tab">
-                        <xsl:with-param name="host" select="."/>
-                        <xsl:with-param name="event" select="$event"/>
-                        <xsl:with-param name="shift" select="ixsl:get($event, 'shiftKey') = true()"/>
-                    </xsl:call-template>
+                <!-- Tab indents/outdents list items and walks table cells; the
+                     innermost context wins (li inside a cell indents, a table
+                     nested in an item traverses); native Tab everywhere else -->
+                <xsl:when test="$key = 'Tab'">
+                    <xsl:variable name="item" as="element()?" select="local:item-of(.)"/>
+                    <!-- clamped at the region root: a host-page cell wrapping an
+                         embedded region must never be traversed or grown -->
+                    <xsl:variable name="cell" as="element()?"
+                        select="ancestor-or-self::*[self::td or self::th or self::caption]
+                            [exists(local:block-of(.))][1]"/>
+                    <xsl:choose>
+                        <xsl:when test="exists($item) and (empty($cell)
+                                or exists($item/ancestor::* intersect $cell))">
+                            <xsl:sequence select="ixsl:call($event, 'preventDefault', [])[current-date() lt xs:date('2000-01-01')]"/>
+                            <xsl:choose>
+                                <xsl:when test="ixsl:get($event, 'shiftKey')">
+                                    <xsl:call-template name="local:list-outdent">
+                                        <xsl:with-param name="item" select="$item"/>
+                                    </xsl:call-template>
+                                </xsl:when>
+                                <xsl:otherwise>
+                                    <xsl:call-template name="local:list-indent">
+                                        <xsl:with-param name="item" select="$item"/>
+                                    </xsl:call-template>
+                                </xsl:otherwise>
+                            </xsl:choose>
+                        </xsl:when>
+                        <xsl:when test="exists($cell)">
+                            <xsl:call-template name="local:table-tab">
+                                <xsl:with-param name="host" select="$cell"/>
+                                <xsl:with-param name="event" select="$event"/>
+                                <xsl:with-param name="shift" select="ixsl:get($event, 'shiftKey') = true()"/>
+                            </xsl:call-template>
+                        </xsl:when>
+                        <xsl:otherwise/>
+                    </xsl:choose>
                 </xsl:when>
                 <!-- arrow keys cross block boundaries: each block is its own
                      contenteditable island, so the browser stops at its edges.
@@ -537,19 +729,30 @@ version="3.0">
                         </xsl:call-template>
                     </xsl:for-each>
                 </xsl:when>
-                <!-- a selected image is deleted whole (no smaller unit, no confirm -
-                     it was explicitly selected and undo covers accidents); the caret
-                     lands on the previous target for Backspace, the next for Delete -->
+                <!-- a selected image is deleted whole with its FIGURE when it has one
+                     (no smaller unit, no confirm - it was explicitly selected and
+                     undo covers accidents); a bare island in a mixed container is
+                     deleted alone, never its whole list/table. The caret lands on
+                     the previous target for Backspace, the next for Delete -->
                 <xsl:when test="$key = ('Backspace', 'Delete')">
                     <xsl:sequence select="ixsl:call($event, 'preventDefault', [])[current-date() lt xs:date('2000-01-01')]"/>
-                    <xsl:variable name="block" as="element()" select="local:block-of($image)"/>
+                    <xsl:variable name="victim" as="element()"
+                        select="($image/ancestor-or-self::figure[exists(local:block-of(.))][1], $image)[1]"/>
+                    <xsl:variable name="container" as="element()?" select="$victim/parent::*"/>
                     <xsl:variable name="outside" as="element()*"
-                        select="$targets[empty(. intersect $block/descendant-or-self::*)]"/>
-                    <xsl:variable name="prev" as="element()?" select="($outside[. &lt;&lt; $block])[last()]"/>
-                    <xsl:variable name="next" as="element()?" select="($outside[. &gt;&gt; $block])[1]"/>
+                        select="$targets[empty(. intersect $victim/descendant-or-self::*)]"/>
+                    <xsl:variable name="prev" as="element()?" select="($outside[. &lt;&lt; $victim])[last()]"/>
+                    <xsl:variable name="next" as="element()?" select="($outside[. &gt;&gt; $victim])[1]"/>
                     <xsl:call-template name="local:push-undo"/>
-                    <xsl:sequence select="ixsl:call($block, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
+                    <xsl:sequence select="ixsl:call($victim, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
                     <ixsl:set-property name="activeBlock" select="()" object="local:editor-state()"/>
+                    <!-- a mixed container that just lost its only nested block
+                         becomes a plain text host again -->
+                    <xsl:for-each select="$container[not(contains-token(@class, 'rdfa-editor-content'))]">
+                        <xsl:call-template name="local:collapse-container">
+                            <xsl:with-param name="container" select="."/>
+                        </xsl:call-template>
+                    </xsl:for-each>
                     <xsl:for-each select="if ($key = 'Backspace') then ($prev, $next)[1] else ($next, $prev)[1]">
                         <xsl:choose>
                             <xsl:when test=". is $prev">
@@ -615,21 +818,33 @@ version="3.0">
                     <xsl:with-param name="host" select="$host"/>
                 </xsl:call-template>
             </xsl:when>
-            <!-- E4: Enter on the empty last item exits the list -->
+            <!-- E4a: Enter on the empty last item of a NESTED list outdents one
+                 level (progressive: each press lifts it until it reaches the top) -->
+            <xsl:when test="$host/self::li and local:block-text($host) = ''
+                    and empty($host/following-sibling::li) and exists($host/parent::*/parent::li)">
+                <xsl:call-template name="local:list-outdent">
+                    <xsl:with-param name="item" select="$host"/>
+                </xsl:call-template>
+            </xsl:when>
+            <!-- E4b: Enter on the empty last item of a list exits it - the paragraph
+                 anchors after the list BEFORE anything is removed (a sole-item list
+                 disappears with it), so the exit lands where the list was: at the
+                 region for top-level lists, inside the cell/quote for nested ones -->
             <xsl:when test="$host/self::li and local:block-text($host) = '' and empty($host/following-sibling::li)">
                 <xsl:variable name="list" as="element()" select="$host/parent::*"/>
+                <xsl:call-template name="local:insert-empty-paragraph">
+                    <xsl:with-param name="after" select="$list"/>
+                </xsl:call-template>
                 <xsl:sequence select="ixsl:call($host, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
                 <xsl:if test="empty($list/li)">
                     <xsl:sequence select="ixsl:call($list, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
                 </xsl:if>
-                <xsl:call-template name="local:insert-empty-paragraph">
-                    <xsl:with-param name="after" select="$list[exists(parent::*)]"/>
-                </xsl:call-template>
             </xsl:when>
-            <!-- E6: Enter in a figure/table caption starts a paragraph after the block -->
+            <!-- E6: Enter in a figure/table caption starts a paragraph after the
+                 figure/table itself - which may be nested inside an item or cell -->
             <xsl:when test="$host/self::figcaption or $host/self::caption">
                 <xsl:call-template name="local:insert-empty-paragraph">
-                    <xsl:with-param name="after" select="local:block-of($host)"/>
+                    <xsl:with-param name="after" select="$host/parent::*"/>
                 </xsl:call-template>
             </xsl:when>
             <!-- E3/E5/E7/E8: split, never through an annotation (the split point moves
@@ -666,9 +881,11 @@ version="3.0">
             </xsl:otherwise>
         </xsl:choose>
         <ixsl:set-attribute name="contenteditable" select="'true'" object="$p"/>
-        <xsl:call-template name="local:inject-chrome">
-            <xsl:with-param name="block" select="$p"/>
-        </xsl:call-template>
+        <xsl:if test="$p/parent::*[contains-token(@class, 'rdfa-editor-content')]">
+            <xsl:call-template name="local:inject-chrome">
+                <xsl:with-param name="block" select="$p"/>
+            </xsl:call-template>
+        </xsl:if>
         <xsl:call-template name="local:focus-caret">
     <xsl:with-param name="node" select="$p"/>
     <xsl:with-param name="offset" select="local:chrome-count($p)"/>
@@ -687,18 +904,27 @@ version="3.0">
     </xsl:template>
 
     <!-- move everything from the caret to the end of the host into a fresh sibling
-         of the same name; inline elements wholly after the caret move intact -->
+         of the same name; inline elements wholly after the caret move intact.
+         Splitting a run wrapper promotes it: the marker class comes off the first
+         half (the fresh second half never has it) - a structural edit makes both
+         halves real paragraphs -->
     <xsl:template name="local:split-block">
         <xsl:param name="host" as="element()"/>
         <xsl:param name="range"/>
 
+        <xsl:if test="contains-token($host/@class, 'rdfa-editor-run')">
+            <xsl:sequence select="ixsl:call(ixsl:get($host, 'classList'), 'remove',
+                [ 'rdfa-editor-run' ])[current-date() lt xs:date('2000-01-01')]"/>
+        </xsl:if>
         <xsl:sequence select="ixsl:call($range, 'setEnd', [ $host, xs:integer(ixsl:get($host, 'childNodes.length')) ])[current-date() lt xs:date('2000-01-01')]"/>
         <xsl:variable name="fragment" select="ixsl:call($range, 'extractContents', [])"/>
         <xsl:variable name="new" as="element()" select="ixsl:call(ixsl:page(), 'createElement', [ local-name($host) ])"/>
         <xsl:sequence select="ixsl:call($new, 'appendChild', [ $fragment ])[current-date() lt xs:date('2000-01-01')]"/>
         <xsl:sequence select="ixsl:call($host, 'after', [ $new ])[current-date() lt xs:date('2000-01-01')]"/>
         <ixsl:set-attribute name="contenteditable" select="'true'" object="$new"/>
-        <xsl:if test="not($host/self::li)">
+        <!-- chrome is a top-level affordance: nested hosts (li, quote paragraphs,
+             cell blocks) never carry a drag handle -->
+        <xsl:if test="$host/parent::*[contains-token(@class, 'rdfa-editor-content')]">
             <xsl:call-template name="local:inject-chrome">
                 <xsl:with-param name="block" select="$new"/>
             </xsl:call-template>
@@ -725,9 +951,12 @@ version="3.0">
         <xsl:if test="local:at-start($host, $range)">
             <xsl:sequence select="ixsl:call($event, 'preventDefault', [])[current-date() lt xs:date('2000-01-01')]"/>
             <xsl:choose>
-                <!-- B4/B5: list items merge into the previous item; the first is inert -->
-                <xsl:when test="$host/self::li">
-                    <xsl:for-each select="$host/preceding-sibling::li[1]">
+                <!-- B4: a list item merges into the visually preceding line - the
+                     deepest last host of the previous item (which may be a container
+                     holding a nested list); a previous item ending in a composite
+                     is a hard boundary (merge-host-in returns nothing - inert) -->
+                <xsl:when test="$host/self::li and exists($host/preceding-sibling::li)">
+                    <xsl:for-each select="local:merge-host-in($host/preceding-sibling::li[1])">
                         <xsl:call-template name="local:push-undo">
                             <xsl:with-param name="host" select="$host"/>
                         </xsl:call-template>
@@ -738,6 +967,60 @@ version="3.0">
                         <xsl:call-template name="local:after-mutation"/>
                     </xsl:for-each>
                 </xsl:when>
+                <!-- B4b: the first item of a NESTED list outdents (mirrors Shift+Tab) -->
+                <xsl:when test="$host/self::li and exists($host/parent::*/parent::li)">
+                    <xsl:call-template name="local:list-outdent">
+                        <xsl:with-param name="item" select="$host"/>
+                    </xsl:call-template>
+                </xsl:when>
+                <!-- B4c: the first item of a list nested in a container (cell,
+                     quote, dd) merges into the preceding line inside it; the
+                     emptied list goes and the container collapses back to a text
+                     host - composites (table, figure) stay hard boundaries -->
+                <xsl:when test="$host/self::li
+                        and $host/parent::*/parent::*[not(contains-token(@class, 'rdfa-editor-content'))]
+                        and exists(local:merge-host-in($host/parent::*/preceding-sibling::*[not(@data-role)][1]))">
+                    <xsl:variable name="list" as="element()" select="$host/parent::*"/>
+                    <xsl:variable name="container" as="element()" select="$list/parent::*"/>
+                    <!-- the caret target must survive the merge AND the collapse
+                         unwrap (text-node references ride through both moves) -->
+                    <xsl:variable name="first-text" select="($host//text()[not(ancestor::*[@data-role])])[1]"/>
+                    <xsl:call-template name="local:push-undo">
+                        <xsl:with-param name="host" select="$host"/>
+                    </xsl:call-template>
+                    <xsl:call-template name="local:merge-into-previous">
+                        <xsl:with-param name="host" select="$host"/>
+                        <xsl:with-param name="prev" select="local:merge-host-in(
+                            $list/preceding-sibling::*[not(@data-role)][1])"/>
+                    </xsl:call-template>
+                    <xsl:if test="empty($list/li)">
+                        <xsl:sequence select="ixsl:call($list, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
+                    </xsl:if>
+                    <xsl:call-template name="local:collapse-container">
+                        <xsl:with-param name="container" select="$container"/>
+                    </xsl:call-template>
+                    <xsl:choose>
+                        <xsl:when test="exists($first-text)">
+                            <xsl:call-template name="local:focus-caret">
+                                <xsl:with-param name="node" select="$first-text"/>
+                                <xsl:with-param name="offset" select="0"/>
+                            </xsl:call-template>
+                        </xsl:when>
+                        <xsl:otherwise>
+                            <xsl:for-each select="local:last-host-in($container)">
+                                <xsl:call-template name="local:focus-caret">
+                                    <xsl:with-param name="node" select="."/>
+                                    <xsl:with-param name="offset"
+                                        select="count(node()) - count(node()[last()][self::br])"/>
+                                </xsl:call-template>
+                            </xsl:for-each>
+                        </xsl:otherwise>
+                    </xsl:choose>
+                    <xsl:call-template name="local:after-mutation"/>
+                </xsl:when>
+                <!-- B5: the first item of a top-level list (or of a list with
+                     nothing mergeable before it) is inert -->
+                <xsl:when test="$host/self::li"/>
                 <!-- B6: cells, captions and pre absorb Backspace-at-start (never merge away) -->
                 <xsl:when test="$host/self::figcaption or $host/self::pre
                         or $host/self::td or $host/self::th or $host/self::caption"/>
@@ -745,7 +1028,7 @@ version="3.0">
                     <xsl:variable name="prev" as="element()?" select="$host/preceding-sibling::*[1]"/>
                     <xsl:choose>
                         <!-- B2: text blocks merge -->
-                        <xsl:when test="$prev[self::p or self::h1 or self::h2 or self::h3 or self::blockquote]">
+                        <xsl:when test="$prev[self::p or self::h1 or self::h2 or self::h3]">
                             <xsl:call-template name="local:push-undo">
                                 <xsl:with-param name="host" select="$host"/>
                             </xsl:call-template>
@@ -755,8 +1038,47 @@ version="3.0">
                             </xsl:call-template>
                             <xsl:call-template name="local:after-mutation"/>
                         </xsl:when>
+                        <!-- B2b: a preceding non-composite container (blockquote,
+                             list) merges into its last editable host, never into
+                             the container itself (bare text there would be invalid;
+                             tables and figures stay hard boundaries - B3 - even
+                             nested at the container's tail: merge-host-in) -->
+                        <xsl:when test="$prev[self::blockquote or self::ul or self::ol or self::dl]">
+                            <xsl:for-each select="local:merge-host-in($prev)">
+                                <xsl:call-template name="local:push-undo">
+                                    <xsl:with-param name="host" select="$host"/>
+                                </xsl:call-template>
+                                <xsl:call-template name="local:merge-into-previous">
+                                    <xsl:with-param name="host" select="$host"/>
+                                    <xsl:with-param name="prev" select="."/>
+                                </xsl:call-template>
+                                <xsl:call-template name="local:after-mutation"/>
+                            </xsl:for-each>
+                        </xsl:when>
+                        <!-- B7: the first block of a blockquote exits upward - it
+                             moves before the quote; an emptied quote is removed -->
+                        <xsl:when test="empty($prev[not(@data-role)]) and $host/parent::blockquote">
+                            <xsl:variable name="quote" as="element()" select="$host/parent::blockquote"/>
+                            <xsl:call-template name="local:push-undo">
+                                <xsl:with-param name="host" select="$host"/>
+                            </xsl:call-template>
+                            <xsl:sequence select="ixsl:call($quote, 'before', [ $host ])[current-date() lt xs:date('2000-01-01')]"/>
+                            <xsl:if test="empty($quote/*[not(@data-role)])">
+                                <xsl:sequence select="ixsl:call($quote, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
+                            </xsl:if>
+                            <xsl:if test="$host/parent::*[contains-token(@class, 'rdfa-editor-content')]">
+                                <xsl:call-template name="local:inject-chrome">
+                                    <xsl:with-param name="block" select="$host"/>
+                                </xsl:call-template>
+                            </xsl:if>
+                            <xsl:call-template name="local:focus-caret">
+                                <xsl:with-param name="node" select="$host"/>
+                                <xsl:with-param name="offset" select="local:chrome-count($host)"/>
+                            </xsl:call-template>
+                            <xsl:call-template name="local:after-mutation"/>
+                        </xsl:when>
                         <!-- B3: never merge across composite blocks; an empty block is removed -->
-                        <xsl:when test="exists($prev) and local:block-text($host) = ''">
+                        <xsl:when test="exists($prev[not(@data-role)]) and local:block-text($host) = ''">
                             <xsl:call-template name="local:push-undo"/>
                             <xsl:sequence select="ixsl:call($host, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
                             <ixsl:set-property name="activeBlock" select="()" object="local:editor-state()"/>
@@ -777,6 +1099,147 @@ version="3.0">
         </xsl:if>
     </xsl:template>
 
+    <!-- ................................ list indent/outdent ................................ -->
+
+    <!-- Tab: the item indents under its previous sibling - per ul/ol -> (li)+ the
+         nested list lives INSIDE the previous item, which becomes a container
+         (trailing nested list reused, else a fresh list of the same kind). A first
+         item has nowhere to go - flash -->
+    <xsl:template name="local:list-indent">
+        <xsl:param name="item" as="element()"/>
+
+        <xsl:variable name="prev" as="element()?" select="$item/preceding-sibling::li[1]"/>
+        <xsl:choose>
+            <xsl:when test="exists($prev)">
+                <xsl:call-template name="local:push-undo">
+                    <xsl:with-param name="host" select="$item"/>
+                </xsl:call-template>
+                <!-- text-node caret references survive reparenting -->
+                <xsl:variable name="selection" select="local:selection()"/>
+                <xsl:variable name="caret-node" select="if (ixsl:get($selection, 'rangeCount') ge 1)
+                    then ixsl:get($selection, 'anchorNode') else ()"/>
+                <xsl:variable name="caret-offset" as="xs:integer"
+                    select="if (exists($caret-node)) then xs:integer(ixsl:get($selection, 'anchorOffset')) else 0"/>
+                <xsl:variable name="target" as="element()?"
+                    select="$prev/*[not(@data-role)][last()][self::ul or self::ol]"/>
+                <xsl:if test="empty($target)">
+                    <xsl:for-each select="$prev[@contenteditable = 'true']">
+                        <ixsl:remove-attribute name="contenteditable"/>
+                        <xsl:call-template name="local:wrap-stray-runs">
+                            <xsl:with-param name="container" select="."/>
+                        </xsl:call-template>
+                    </xsl:for-each>
+                </xsl:if>
+                <xsl:variable name="list" as="element()" select="if (exists($target)) then $target
+                    else local:element(local-name($item/parent::*))"/>
+                <xsl:if test="empty($target)">
+                    <xsl:sequence select="ixsl:call($prev, 'appendChild', [ $list ])[current-date() lt xs:date('2000-01-01')]"/>
+                </xsl:if>
+                <xsl:sequence select="ixsl:call($list, 'appendChild', [ $item ])[current-date() lt xs:date('2000-01-01')]"/>
+                <xsl:choose>
+                    <xsl:when test="exists($caret-node)">
+                        <xsl:call-template name="local:focus-caret">
+                            <xsl:with-param name="node" select="$caret-node"/>
+                            <xsl:with-param name="offset" select="$caret-offset"/>
+                        </xsl:call-template>
+                    </xsl:when>
+                    <xsl:otherwise>
+                        <xsl:for-each select="local:first-host-in($item)">
+                            <xsl:call-template name="local:focus-caret">
+                                <xsl:with-param name="node" select="."/>
+                                <xsl:with-param name="offset" select="0"/>
+                            </xsl:call-template>
+                        </xsl:for-each>
+                    </xsl:otherwise>
+                </xsl:choose>
+                <xsl:call-template name="local:after-mutation"/>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:for-each select="local:caret-range()">
+                    <xsl:call-template name="local:show-flash">
+                        <xsl:with-param name="range" select="."/>
+                    </xsl:call-template>
+                </xsl:for-each>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+
+    <!-- Shift+Tab (and progressive Enter/Backspace exits): the item moves after its
+         container item; following siblings demote into a nested list inside the
+         moved item (they were logically below it). The emptied nested list is
+         removed and the container collapses back to a text host when its last
+         block leaves. A top-level item has nowhere to go - flash -->
+    <xsl:template name="local:list-outdent">
+        <xsl:param name="item" as="element()"/>
+
+        <xsl:variable name="list" as="element()" select="$item/parent::*"/>
+        <xsl:variable name="container" as="element()?" select="$list/parent::li"/>
+        <xsl:choose>
+            <xsl:when test="exists($container)">
+                <xsl:call-template name="local:push-undo">
+                    <xsl:with-param name="host" select="$item"/>
+                </xsl:call-template>
+                <xsl:variable name="selection" select="local:selection()"/>
+                <xsl:variable name="caret-node" select="if (ixsl:get($selection, 'rangeCount') ge 1)
+                    then ixsl:get($selection, 'anchorNode') else ()"/>
+                <xsl:variable name="caret-offset" as="xs:integer"
+                    select="if (exists($caret-node)) then xs:integer(ixsl:get($selection, 'anchorOffset')) else 0"/>
+                <xsl:variable name="followers" as="element()*" select="$item/following-sibling::li"/>
+                <xsl:if test="exists($followers)">
+                    <xsl:variable name="target" as="element()?"
+                        select="$item/*[not(@data-role)][last()][self::ul or self::ol]"/>
+                    <xsl:if test="empty($target)">
+                        <xsl:for-each select="$item[@contenteditable = 'true']">
+                            <ixsl:remove-attribute name="contenteditable"/>
+                            <xsl:call-template name="local:wrap-stray-runs">
+                                <xsl:with-param name="container" select="."/>
+                            </xsl:call-template>
+                        </xsl:for-each>
+                    </xsl:if>
+                    <xsl:variable name="sub" as="element()" select="if (exists($target)) then $target
+                        else local:element(local-name($list))"/>
+                    <xsl:if test="empty($target)">
+                        <xsl:sequence select="ixsl:call($item, 'appendChild', [ $sub ])[current-date() lt xs:date('2000-01-01')]"/>
+                    </xsl:if>
+                    <xsl:for-each select="$followers">
+                        <xsl:sequence select="ixsl:call($sub, 'appendChild', [ . ])[current-date() lt xs:date('2000-01-01')]"/>
+                    </xsl:for-each>
+                </xsl:if>
+                <xsl:sequence select="ixsl:call($container, 'after', [ $item ])[current-date() lt xs:date('2000-01-01')]"/>
+                <xsl:if test="empty($list/li)">
+                    <xsl:sequence select="ixsl:call($list, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
+                </xsl:if>
+                <xsl:call-template name="local:collapse-container">
+                    <xsl:with-param name="container" select="$container"/>
+                </xsl:call-template>
+                <xsl:choose>
+                    <xsl:when test="exists($caret-node)">
+                        <xsl:call-template name="local:focus-caret">
+                            <xsl:with-param name="node" select="$caret-node"/>
+                            <xsl:with-param name="offset" select="$caret-offset"/>
+                        </xsl:call-template>
+                    </xsl:when>
+                    <xsl:otherwise>
+                        <xsl:for-each select="local:first-host-in($item)">
+                            <xsl:call-template name="local:focus-caret">
+                                <xsl:with-param name="node" select="."/>
+                                <xsl:with-param name="offset" select="0"/>
+                            </xsl:call-template>
+                        </xsl:for-each>
+                    </xsl:otherwise>
+                </xsl:choose>
+                <xsl:call-template name="local:after-mutation"/>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:for-each select="local:caret-range()">
+                    <xsl:call-template name="local:show-flash">
+                        <xsl:with-param name="range" select="."/>
+                    </xsl:call-template>
+                </xsl:for-each>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+
     <!-- counted firstChild moves (never iterate a live child list lazily); no
          normalize() afterwards - the caret index depends on the node count -->
     <xsl:template name="local:merge-into-previous">
@@ -800,10 +1263,6 @@ version="3.0">
 
     <!-- ................................ paste / focus ................................ -->
 
-    <!-- block-level element names after canonicalization (attributeless divs became p) -->
-    <xsl:variable name="local:block-names" as="xs:string*" select="('p', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
-        'ul', 'ol', 'blockquote', 'pre', 'figure', 'table', 'div', 'dl', 'hr', 'section', 'article')"/>
-
     <xsl:template match="*[@contenteditable = 'true']" mode="ixsl:onpaste">
         <xsl:variable name="event" select="ixsl:event()"/>
         <xsl:if test="exists(local:block-of(.))">
@@ -853,49 +1312,44 @@ version="3.0">
     </xsl:template>
 
     <!-- clipboard HTML: browser-parse it on a DETACHED element (scripts inert),
-         sanitize/normalize via mode="canonical", then insert - inline fragments at
-         the caret, block-level content as new blocks between the split halves -->
+         sanitize/normalize via mode="canonical" + mode="cm-normalize", then insert
+         where the content model allows - inline fragments at the caret, blocks
+         inside a flow host (li, td, ...) or as new siblings between the split
+         halves of an inline-only host; hosts that can take blocks neither way
+         (caption, dt) flatten to text -->
     <xsl:template name="local:paste-html">
         <xsl:param name="host" as="element()"/>
         <xsl:param name="html" as="xs:string"/>
 
         <xsl:variable name="carrier" as="element()" select="local:element('div')"/>
         <ixsl:set-property name="innerHTML" select="$html" object="$carrier"/>
-        <xsl:variable name="clean">
+        <xsl:variable name="pass1">
             <xsl:apply-templates select="$carrier/node()" mode="canonical"/>
         </xsl:variable>
+        <xsl:variable name="clean">
+            <xsl:sequence select="cm:normalize($pass1/node())"/>
+        </xsl:variable>
         <xsl:variable name="has-blocks" as="xs:boolean"
-            select="exists($clean/*[local-name() = $local:block-names])"/>
+            select="exists($clean/*[cm:block(local-name(.))])"/>
         <xsl:variable name="selection" select="local:selection()"/>
 
         <xsl:choose>
             <xsl:when test="empty($clean/node()) or ixsl:get($selection, 'rangeCount') lt 1"/>
-            <!-- composite hosts cannot contain blocks: flatten to text -->
-            <xsl:when test="$has-blocks and $host[self::li or self::figcaption
-                    or self::td or self::th or self::caption]">
-                <xsl:call-template name="local:paste-text">
+            <!-- a mixed flow host takes the blocks inside itself -->
+            <xsl:when test="$has-blocks and cm:flow(local-name($host))">
+                <xsl:call-template name="local:paste-into-flow-host">
                     <xsl:with-param name="host" select="$host"/>
-                    <xsl:with-param name="raw" select="string($carrier)"/>
+                    <xsl:with-param name="clean" select="$clean/node()"/>
                 </xsl:call-template>
             </xsl:when>
-            <xsl:when test="$has-blocks">
+            <!-- an inline-only host splits when its parent takes the blocks as
+                 siblings (the region by contract; blockquote, containers by model) -->
+            <xsl:when test="$has-blocks and (not(cm:known(local-name($host/parent::*)))
+                    or (every $block in $clean/*[cm:block(local-name(.))]
+                        satisfies cm:allows-child(local-name($host/parent::*), local-name($block))))">
                 <!-- stray top-level inline runs become paragraphs -->
-                <xsl:variable name="blocks" as="element()*">
-                    <xsl:for-each-group select="$clean/node()"
-                            group-adjacent="boolean(self::*[local-name() = $local:block-names])">
-                        <xsl:choose>
-                            <xsl:when test="current-grouping-key()">
-                                <xsl:sequence select="current-group()"/>
-                            </xsl:when>
-                            <xsl:when test="normalize-space(string-join(current-group() ! string(.)))">
-                                <p>
-                                    <xsl:sequence select="current-group()"/>
-                                </p>
-                            </xsl:when>
-                            <xsl:otherwise/>
-                        </xsl:choose>
-                    </xsl:for-each-group>
-                </xsl:variable>
+                <xsl:variable name="blocks" as="element()*"
+                    select="cm:wrap-inline-runs($clean/node(), 'p')[self::*]"/>
                 <xsl:variable name="range" select="local:caret-range()"/>
                 <xsl:call-template name="local:push-undo">
                     <xsl:with-param name="host" select="$host"/>
@@ -908,8 +1362,10 @@ version="3.0">
                     <xsl:with-param name="host" select="$host"/>
                     <xsl:with-param name="range" select="$range"/>
                 </xsl:call-template>
+                <!-- method html: XML's self-closing <p/> reads as an OPEN tag to the
+                     HTML fragment parser and swallows following siblings -->
                 <xsl:variable name="stage" as="element()" select="local:element('div')"/>
-                <ixsl:set-property name="innerHTML" select="serialize($blocks, map{ 'method': 'xml' })" object="$stage"/>
+                <ixsl:set-property name="innerHTML" select="serialize($blocks, map{ 'method': 'html' })" object="$stage"/>
                 <xsl:variable name="count" as="xs:integer" select="xs:integer(ixsl:get($stage, 'childNodes.length'))"/>
                 <xsl:iterate select="1 to $count">
                     <xsl:param name="anchor" select="$host"/>
@@ -934,6 +1390,14 @@ version="3.0">
                 </xsl:for-each>
                 <xsl:call-template name="local:after-mutation"/>
             </xsl:when>
+            <!-- blocks fit neither inside the host nor beside it (caption, dt):
+                 flatten to sanitized text -->
+            <xsl:when test="$has-blocks">
+                <xsl:call-template name="local:paste-text">
+                    <xsl:with-param name="host" select="$host"/>
+                    <xsl:with-param name="raw" select="string($clean)"/>
+                </xsl:call-template>
+            </xsl:when>
             <!-- inline-only fragment: insert at the caret -->
             <xsl:otherwise>
                 <xsl:variable name="range" select="local:caret-range()"/>
@@ -942,7 +1406,7 @@ version="3.0">
                 </xsl:call-template>
                 <xsl:sequence select="ixsl:call($range, 'deleteContents', [])[current-date() lt xs:date('2000-01-01')]"/>
                 <xsl:variable name="stage" as="element()" select="local:element('div')"/>
-                <ixsl:set-property name="innerHTML" select="serialize($clean/node(), map{ 'method': 'xml' })" object="$stage"/>
+                <ixsl:set-property name="innerHTML" select="serialize($clean/node(), map{ 'method': 'html' })" object="$stage"/>
                 <xsl:variable name="last" select="ixsl:get($stage, 'lastChild')"/>
                 <xsl:variable name="fragment" select="ixsl:call(ixsl:page(), 'createDocumentFragment', [])"/>
                 <xsl:for-each select="1 to xs:integer(ixsl:get($stage, 'childNodes.length'))">
@@ -960,6 +1424,49 @@ version="3.0">
         </xsl:choose>
     </xsl:template>
 
+    <!-- blocks paste INSIDE a mixed flow host (li, td, th, dd, figcaption): the
+         host's content splits around the caret into head and tail runs with the
+         blocks between them, and re-init turns the host into a container (stray
+         runs wrapped as p.rdfa-editor-run, nested blocks inited recursively) -->
+    <xsl:template name="local:paste-into-flow-host">
+        <xsl:param name="host" as="element()"/>
+        <xsl:param name="clean" as="node()*"/>
+
+        <xsl:variable name="range" select="local:caret-range()"/>
+        <xsl:call-template name="local:push-undo">
+            <xsl:with-param name="host" select="$host"/>
+        </xsl:call-template>
+        <xsl:if test="not(ixsl:get($range, 'collapsed'))">
+            <xsl:sequence select="ixsl:call($range, 'deleteContents', [])[current-date() lt xs:date('2000-01-01')]"/>
+        </xsl:if>
+        <!-- the tail (caret to end of host) rides out as HTML -->
+        <xsl:sequence select="ixsl:call($range, 'setEnd', [ $host, xs:integer(ixsl:get($host, 'childNodes.length')) ])[current-date() lt xs:date('2000-01-01')]"/>
+        <xsl:variable name="tail-stage" as="element()" select="local:element('div')"/>
+        <xsl:sequence select="ixsl:call($tail-stage, 'appendChild',
+            [ ixsl:call($range, 'extractContents', []) ])[current-date() lt xs:date('2000-01-01')]"/>
+        <xsl:call-template name="local:remove-chrome">
+            <xsl:with-param name="block" select="$host"/>
+        </xsl:call-template>
+        <ixsl:set-property name="innerHTML" select="string(ixsl:get($host, 'innerHTML'))
+            || serialize($clean, map{ 'method': 'html' })
+            || string(ixsl:get($tail-stage, 'innerHTML'))" object="$host"/>
+        <!-- re-init decides text host vs container afresh -->
+        <xsl:for-each select="$host">
+            <ixsl:remove-attribute name="contenteditable"/>
+        </xsl:for-each>
+        <xsl:call-template name="local:init-block">
+            <xsl:with-param name="block" select="$host"/>
+        </xsl:call-template>
+        <!-- caret at the end of the last editable host in the rebuilt container -->
+        <xsl:for-each select="($host/descendant-or-self::*[@contenteditable = 'true'])[last()]">
+            <xsl:call-template name="local:focus-caret">
+                <xsl:with-param name="node" select="."/>
+                <xsl:with-param name="offset" select="count(node()) - count(node()[last()][self::br])"/>
+            </xsl:call-template>
+        </xsl:for-each>
+        <xsl:call-template name="local:after-mutation"/>
+    </xsl:template>
+
     <xsl:template match="*[@contenteditable = 'true']" mode="ixsl:onfocusin">
         <xsl:if test="exists(local:block-of(.))">
             <ixsl:set-property name="activeBlock" select="." object="local:editor-state()"/>
@@ -974,10 +1481,13 @@ version="3.0">
         <xsl:sequence select="ixsl:call(ixsl:event(), 'preventDefault', [])[current-date() lt xs:date('2000-01-01')]"/>
     </xsl:template>
 
+    <!-- the select acts on the HOST the caret sits in (a paragraph inside a quote
+         converts alone, leaving the quote intact); quote wrapping lives on the
+         format-quote toggle -->
     <xsl:template match="select[@name = 'block-type']" mode="ixsl:onchange">
         <xsl:variable name="name" as="xs:string" select="string(ixsl:get(., 'value'))"/>
-        <xsl:for-each select="local:current-block()[self::p or self::h1 or self::h2 or self::h3
-                or self::blockquote or self::pre][local-name() ne $name]">
+        <xsl:for-each select="local:current-host()[self::p or self::h1 or self::h2 or self::h3
+                or self::pre][exists(local:block-of(.))][local-name() ne $name]">
             <xsl:call-template name="local:convert-block">
                 <xsl:with-param name="block" select="."/>
                 <xsl:with-param name="name" select="$name"/>
@@ -985,16 +1495,148 @@ version="3.0">
         </xsl:for-each>
     </xsl:template>
 
+    <!-- the quote toggle: wrapping keeps the block's name, editability and caret
+         (text nodes survive reparenting); chrome moves to a new top-level quote.
+         Wrapping a run wrapper promotes it (blockquote > bare run would unwrap to
+         invalid bare text at canonicalization) -->
+    <xsl:template name="local:wrap-in-blockquote">
+        <xsl:param name="block" as="element()"/>
+
+        <xsl:call-template name="local:push-undo">
+            <xsl:with-param name="host" select="$block"/>
+        </xsl:call-template>
+        <xsl:if test="contains-token($block/@class, 'rdfa-editor-run')">
+            <xsl:sequence select="ixsl:call(ixsl:get($block, 'classList'), 'remove',
+                [ 'rdfa-editor-run' ])[current-date() lt xs:date('2000-01-01')]"/>
+        </xsl:if>
+        <xsl:variable name="quote" as="element()" select="local:element('blockquote')"/>
+        <xsl:sequence select="ixsl:call($block, 'before', [ $quote ])[current-date() lt xs:date('2000-01-01')]"/>
+        <xsl:call-template name="local:remove-chrome">
+            <xsl:with-param name="block" select="$block"/>
+        </xsl:call-template>
+        <xsl:sequence select="ixsl:call($quote, 'appendChild', [ $block ])[current-date() lt xs:date('2000-01-01')]"/>
+        <xsl:if test="$quote/parent::*[contains-token(@class, 'rdfa-editor-content')]">
+            <xsl:call-template name="local:inject-chrome">
+                <xsl:with-param name="block" select="$quote"/>
+            </xsl:call-template>
+        </xsl:if>
+        <ixsl:set-property name="activeBlock" select="$block" object="local:editor-state()"/>
+        <xsl:call-template name="local:focus">
+            <xsl:with-param name="element" select="$block"/>
+        </xsl:call-template>
+        <xsl:call-template name="local:after-mutation"/>
+    </xsl:template>
+
+    <!-- the quote toggle off: all children move out (counted sibling inserts) and
+         re-init (chrome iff now top-level); refused with a flash when the quote
+         carries RDFa attributes - unwrapping would silently drop triples -->
+    <xsl:template name="local:unwrap-blockquote">
+        <xsl:param name="quote" as="element()"/>
+
+        <xsl:choose>
+            <xsl:when test="$quote/@property or $quote/@about or $quote/@typeof
+                    or $quote/@resource or $quote/@content or $quote/@datatype">
+                <xsl:for-each select="local:caret-range()">
+                    <xsl:call-template name="local:show-flash">
+                        <xsl:with-param name="range" select="."/>
+                    </xsl:call-template>
+                </xsl:for-each>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:call-template name="local:push-undo">
+                    <xsl:with-param name="host" select="$quote"/>
+                </xsl:call-template>
+                <xsl:variable name="selection" select="local:selection()"/>
+                <xsl:variable name="caret-node" select="if (ixsl:get($selection, 'rangeCount') ge 1)
+                    then ixsl:get($selection, 'anchorNode') else ()"/>
+                <xsl:variable name="caret-offset" as="xs:integer"
+                    select="if (exists($caret-node)) then xs:integer(ixsl:get($selection, 'anchorOffset')) else 0"/>
+                <xsl:call-template name="local:remove-chrome">
+                    <xsl:with-param name="block" select="$quote"/>
+                </xsl:call-template>
+                <xsl:variable name="inner" as="element()*" select="$quote/*"/>
+                <xsl:for-each select="1 to xs:integer(ixsl:get($quote, 'childNodes.length'))">
+                    <xsl:sequence select="ixsl:call($quote, 'before', [ ixsl:get($quote, 'firstChild') ])[current-date() lt xs:date('2000-01-01')]"/>
+                </xsl:for-each>
+                <xsl:sequence select="ixsl:call($quote, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
+                <xsl:for-each select="$inner">
+                    <xsl:call-template name="local:init-block">
+                        <xsl:with-param name="block" select="."/>
+                    </xsl:call-template>
+                </xsl:for-each>
+                <ixsl:set-property name="activeBlock" select="()" object="local:editor-state()"/>
+                <xsl:choose>
+                    <xsl:when test="exists($caret-node)">
+                        <xsl:call-template name="local:focus-caret">
+                            <xsl:with-param name="node" select="$caret-node"/>
+                            <xsl:with-param name="offset" select="$caret-offset"/>
+                        </xsl:call-template>
+                    </xsl:when>
+                    <xsl:otherwise>
+                        <xsl:for-each select="local:first-host-in($inner[1])">
+                            <xsl:call-template name="local:focus-caret">
+                                <xsl:with-param name="node" select="."/>
+                                <xsl:with-param name="offset" select="local:chrome-count(.)"/>
+                            </xsl:call-template>
+                        </xsl:for-each>
+                    </xsl:otherwise>
+                </xsl:choose>
+                <xsl:call-template name="local:after-mutation"/>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+
+    <xsl:template match="button[contains-token(@class, 'format-quote')]" mode="ixsl:onclick">
+        <xsl:variable name="host" as="element()?" select="local:current-host()[exists(local:block-of(.))]"/>
+        <!-- clamped at the region root: a host-page blockquote wrapping an
+             embedded region is not ours to unwrap -->
+        <xsl:variable name="quote" as="element()?"
+            select="$host/ancestor-or-self::blockquote[exists(local:block-of(.))][1]"/>
+        <xsl:choose>
+            <xsl:when test="exists($quote)">
+                <xsl:call-template name="local:unwrap-blockquote">
+                    <xsl:with-param name="quote" select="$quote"/>
+                </xsl:call-template>
+            </xsl:when>
+            <!-- wrap the host block where its parent admits a blockquote (the
+                 region by contract; flow containers and blockquote by model) -->
+            <xsl:when test="$host[cm:block(local-name(.))]
+                    [parent::*[contains-token(@class, 'rdfa-editor-content')]
+                        or cm:allows-child(local-name(parent::*), 'blockquote')]">
+                <xsl:call-template name="local:wrap-in-blockquote">
+                    <xsl:with-param name="block" select="$host"/>
+                </xsl:call-template>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:for-each select="local:caret-range()">
+                    <xsl:call-template name="local:show-flash">
+                        <xsl:with-param name="range" select="."/>
+                    </xsl:call-template>
+                </xsl:for-each>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+
     <!-- rename by rebuild: copy RDFa/lang attributes, move children (text-node
          references survive reparenting, so the caret can be restored exactly) -->
     <xsl:template name="local:convert-block">
         <xsl:param name="block" as="element()"/>
         <xsl:param name="name" as="xs:string"/>
+        <!-- optionally pre-captured by the caller (unwrap+rename is one undo entry);
+             the defaults mirror local:push-undo's capture-now behavior -->
+        <xsl:param name="snapshot-root" as="element()?" select="local:active-root()"/>
+        <xsl:param name="snapshot" as="xs:string?"
+            select="$snapshot-root ! string(ixsl:get(., 'innerHTML'))"/>
 
-        <xsl:call-template name="local:push-undo"/>
+        <xsl:call-template name="local:push-undo">
+            <xsl:with-param name="root" select="$snapshot-root"/>
+            <xsl:with-param name="snapshot" select="$snapshot"/>
+        </xsl:call-template>
         <xsl:variable name="selection" select="local:selection()"/>
+        <!-- host-of, not block-of: $block may be a nested host (a paragraph in a
+             quote or cell) whose top-level block is the container -->
         <xsl:variable name="caret-node" select="if (ixsl:get($selection, 'rangeCount') ge 1)
-            then ixsl:get($selection, 'anchorNode')[local:block-of(.) is $block] else ()"/>
+            then ixsl:get($selection, 'anchorNode')[local:host-of(.) is $block] else ()"/>
         <xsl:variable name="caret-offset" as="xs:integer"
             select="if (exists($caret-node)) then xs:integer(ixsl:get($selection, 'anchorOffset')) else 0"/>
 
@@ -1071,10 +1713,60 @@ version="3.0">
         </xsl:if>
     </xsl:template>
 
+    <!-- places a freshly created block per the content model: after the caret's
+         host when its parent admits the kind (region children by contract; a
+         paragraph in a cell or quote gets the block as its sibling), INSIDE a leaf
+         flow host otherwise (a cell or list item grows a nested block, becoming a
+         container), after the current top-level block as a last resort (caption,
+         dt). Chrome stays a top-level affordance -->
+    <xsl:template name="local:insert-block-at-caret">
+        <xsl:param name="node" as="element()"/>
+
+        <xsl:variable name="host" as="element()?" select="local:current-host()[exists(local:block-of(.))]"/>
+        <xsl:choose>
+            <!-- not inside a figure: the figure is a locked composite, so a block
+                 inserted at its caption nests INSIDE the figcaption (flow branch)
+                 rather than growing the figure's children -->
+            <xsl:when test="$host[not(parent::figure)][parent::*[contains-token(@class, 'rdfa-editor-content')]
+                    or cm:allows-child(local-name(parent::*), local-name($node))]">
+                <xsl:sequence select="ixsl:call($host, 'after', [ $node ])[current-date() lt xs:date('2000-01-01')]"/>
+            </xsl:when>
+            <xsl:when test="$host[cm:flow(local-name(.))]">
+                <xsl:for-each select="$host">
+                    <ixsl:remove-attribute name="contenteditable"/>
+                </xsl:for-each>
+                <xsl:call-template name="local:wrap-stray-runs">
+                    <xsl:with-param name="container" select="$host"/>
+                </xsl:call-template>
+                <xsl:sequence select="ixsl:call($host, 'appendChild', [ $node ])[current-date() lt xs:date('2000-01-01')]"/>
+            </xsl:when>
+            <xsl:when test="exists(local:current-block())">
+                <xsl:sequence select="ixsl:call(local:current-block(), 'after', [ $node ])[current-date() lt xs:date('2000-01-01')]"/>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:for-each select="local:active-root()">
+                    <xsl:sequence select="ixsl:call(., 'appendChild', [ $node ])[current-date() lt xs:date('2000-01-01')]"/>
+                </xsl:for-each>
+            </xsl:otherwise>
+        </xsl:choose>
+        <xsl:if test="$node/parent::*[contains-token(@class, 'rdfa-editor-content')]">
+            <xsl:call-template name="local:inject-chrome">
+                <xsl:with-param name="block" select="$node"/>
+            </xsl:call-template>
+        </xsl:if>
+    </xsl:template>
+
     <xsl:template match="button[contains-token(@class, 'insert-block')]" mode="ixsl:onclick">
         <xsl:call-template name="local:push-undo"/>
-        <xsl:call-template name="local:insert-empty-paragraph">
-            <xsl:with-param name="after" select="local:current-block()"/>
+        <xsl:variable name="p" as="element()" select="local:element('p')"/>
+        <xsl:sequence select="ixsl:call($p, 'appendChild', [ local:element('br') ])[current-date() lt xs:date('2000-01-01')]"/>
+        <ixsl:set-attribute name="contenteditable" select="'true'" object="$p"/>
+        <xsl:call-template name="local:insert-block-at-caret">
+            <xsl:with-param name="node" select="$p"/>
+        </xsl:call-template>
+        <xsl:call-template name="local:focus-caret">
+            <xsl:with-param name="node" select="$p"/>
+            <xsl:with-param name="offset" select="local:chrome-count($p)"/>
         </xsl:call-template>
         <xsl:call-template name="local:after-mutation"/>
     </xsl:template>
@@ -1085,18 +1777,8 @@ version="3.0">
         <xsl:variable name="li" as="element()" select="local:element('li')"/>
         <ixsl:set-attribute name="contenteditable" select="'true'" object="$li"/>
         <xsl:sequence select="ixsl:call($list, 'appendChild', [ $li ])[current-date() lt xs:date('2000-01-01')]"/>
-        <xsl:choose>
-            <xsl:when test="exists(local:current-block())">
-                <xsl:sequence select="ixsl:call(local:current-block(), 'after', [ $list ])[current-date() lt xs:date('2000-01-01')]"/>
-            </xsl:when>
-            <xsl:otherwise>
-                <xsl:for-each select="local:active-root()">
-                    <xsl:sequence select="ixsl:call(., 'appendChild', [ $list ])[current-date() lt xs:date('2000-01-01')]"/>
-                </xsl:for-each>
-            </xsl:otherwise>
-        </xsl:choose>
-        <xsl:call-template name="local:inject-chrome">
-            <xsl:with-param name="block" select="$list"/>
+        <xsl:call-template name="local:insert-block-at-caret">
+            <xsl:with-param name="node" select="$list"/>
         </xsl:call-template>
         <xsl:call-template name="local:focus-caret">
     <xsl:with-param name="node" select="$li"/>
diff --git a/src/index.xsl b/src/index.xsl
index 286b95e..1c8955b 100644
--- a/src/index.xsl
+++ b/src/index.xsl
@@ -16,6 +16,7 @@ version="3.0">
 
     Modules:
     - RDFa2RDFXML-v3.xsl   RDFa 1.1 to RDF/XML extraction (pure XSLT, tested headless)
+    - content-model.xsl    XHTML Strict content model as data (pure XSLT, include-free)
     - canonical-xhtml.xsl  canonical serialization form (pure XSLT, tested headless)
     - vocab.xsl            generic ontology RDF/XML to dropdown options
     - overlay.xsl          annotation form: rendering, reading, populating, visibility
@@ -26,8 +27,10 @@ version="3.0">
 
     <xsl:include href="RDFa2RDFXML-v3.xsl"/>
     <xsl:include href="group-sort-triples.xsl"/>
+    <xsl:include href="content-model.xsl"/>
     <xsl:include href="canonical-xhtml.xsl"/>
     <xsl:include href="lint-rdfa.xsl"/>
+    <xsl:include href="lint-xhtml.xsl"/>
     <xsl:include href="vocab.xsl"/>
     <xsl:include href="overlay.xsl"/>
     <xsl:include href="annotate.xsl"/>
diff --git a/src/lint-xhtml.xsl b/src/lint-xhtml.xsl
new file mode 100644
index 0000000..d80c3af
--- /dev/null
+++ b/src/lint-xhtml.xsl
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns:xs="http://www.w3.org/2001/XMLSchema"
+    xmlns:cm="urn:rdfa-editor:content-model"
+    xmlns:lint="urn:rdfa-editor:lint"
+    xpath-default-namespace="http://www.w3.org/1999/xhtml"
+    exclude-result-prefixes="xs cm"
+    version="3.0">
+
+<!--
+    XHTML nesting lint: flags markup the content model disallows. Pure XSLT 3.0 -
+    no ixsl: - tested headless via tests/lint-driver.xsl. Consults content-model.xsl
+    (cm:*) - the same single source of truth the boundary normalization
+    (canonical-xhtml.xsl) applies - so lint verdicts and normalization behavior
+    cannot drift apart. Paths come from lint:path (lint-rdfa.xsl). Not standalone-
+    compilable: include/import alongside content-model.xsl and lint-rdfa.xsl.
+
+    Checks:
+    - invalid-nesting     a known element not allowed as a child of its known parent
+                          (e.g. blocks inside p, non-li children of ul)
+    - stray-text          non-whitespace text directly inside an element-only
+                          container (e.g. bare text in blockquote or ul)
+    - prohibited-nesting  XHTML 1.0 Appendix B prohibitions (a in a, img in pre, ...)
+    - unknown-element     an element outside the XHTML Strict (+figure) content
+                          model - preserved, but unvalidated
+-->
+
+    <xsl:function name="lint:nesting-issues" as="element(lint:issue)*">
+        <xsl:param name="element" as="element()"/>
+        <xsl:variable name="name" as="xs:string" select="local-name($element)"/>
+
+        <!-- unknown-element -->
+        <xsl:for-each select="$element[not(cm:known($name))]">
+            <lint:issue code="unknown-element" path="{lint:path($element)}">element '<xsl:value-of
+                select="$name"/>' is outside the XHTML content model - preserved, but its nesting is unvalidated</lint:issue>
+        </xsl:for-each>
+
+        <!-- invalid-nesting -->
+        <xsl:for-each select="$element[cm:known($name)]/parent::*[cm:known(local-name(.))]
+                [not(cm:allows-child(local-name(.), $name))]">
+            <lint:issue code="invalid-nesting" path="{lint:path($element)}">'<xsl:value-of
+                select="$name"/>' is not allowed inside '<xsl:value-of select="local-name(.)"/>'</lint:issue>
+        </xsl:for-each>
+
+        <!-- stray-text -->
+        <xsl:for-each select="$element[cm:structural($name)][text()[normalize-space()]]">
+            <lint:issue code="stray-text" path="{lint:path($element)}">'<xsl:value-of
+                select="$name"/>' allows no text content - stray text will be wrapped by canonicalization</lint:issue>
+        </xsl:for-each>
+
+        <!-- prohibited-nesting -->
+        <xsl:for-each select="$element/ancestor::*[local-name() = cm:prohibited-ancestors($name)][1]">
+            <lint:issue code="prohibited-nesting" path="{lint:path($element)}">'<xsl:value-of
+                select="$name"/>' must not appear inside '<xsl:value-of
+                select="local-name(.)"/>' (XHTML 1.0 Appendix B)</lint:issue>
+        </xsl:for-each>
+    </xsl:function>
+
+</xsl:stylesheet>
diff --git a/src/navigate.xsl b/src/navigate.xsl
index 7921d8a..2c3dff5 100644
--- a/src/navigate.xsl
+++ b/src/navigate.xsl
@@ -441,15 +441,16 @@ version="3.0">
             <xsl:sequence select="ixsl:call(ixsl:get(., 'classList'), 'remove', [ 'rdfa-invalid' ])[current-date() lt xs:date('2000-01-01')]"/>
         </xsl:for-each>
         <xsl:variable name="lintable" as="element()*" select="local:roots() ! lint:lintable(.)"/>
-        <xsl:for-each select="$lintable[exists(lint:element-issues(.))]">
+        <xsl:for-each select="$lintable[exists((lint:element-issues(.), lint:nesting-issues(.)))]">
             <xsl:sequence select="ixsl:call(ixsl:get(., 'classList'), 'add', [ 'rdfa-invalid' ])[current-date() lt xs:date('2000-01-01')]"/>
         </xsl:for-each>
-        <xsl:variable name="count" as="xs:integer" select="count($lintable ! lint:element-issues(.))"/>
+        <xsl:variable name="count" as="xs:integer"
+            select="count($lintable ! (lint:element-issues(.), lint:nesting-issues(.)))"/>
         <xsl:for-each select="id('lint-badge', ixsl:page())">
             <xsl:choose>
                 <xsl:when test="$count gt 0">
                     <ixsl:set-property name="textContent"
-                        select="$count || ' RDFa issue' || (if ($count gt 1) then 's' else '')" object="."/>
+                        select="$count || ' issue' || (if ($count gt 1) then 's' else '')" object="."/>
                     <ixsl:set-style name="display" select="'inline-block'"/>
                 </xsl:when>
                 <xsl:otherwise>
@@ -461,10 +462,10 @@ version="3.0">
 
     <xsl:template match="button[@id = 'lint-badge']" mode="ixsl:onclick">
         <xsl:variable name="lines" as="xs:string*"
-            select="local:roots() ! lint:lintable(.) ! lint:element-issues(.)
+            select="local:roots() ! lint:lintable(.) ! (lint:element-issues(.), lint:nesting-issues(.))
                 ! (string(@code) || ' &#x2014; ' || normalize-space(string(.)))"/>
         <xsl:call-template name="local:show-output">
-            <xsl:with-param name="title" select="'RDFa validation issues'"/>
+            <xsl:with-param name="title" select="'Validation issues'"/>
             <xsl:with-param name="text" select="string-join($lines, '&#10;')"/>
         </xsl:call-template>
     </xsl:template>
diff --git a/src/tables.xsl b/src/tables.xsl
index 1f1145c..b52ed7a 100644
--- a/src/tables.xsl
+++ b/src/tables.xsl
@@ -311,7 +311,7 @@ version="3.0">
             </xsl:choose>
         </xsl:for-each>
         <xsl:variable name="j" as="xs:integer" select="$i + (if ($before) then 0 else 1)"/>
-        <xsl:for-each select="($cell/parent::tr/(td | th))[$j]">
+        <xsl:for-each select="local:first-host-in(($cell/parent::tr/(td | th))[$j])">
             <xsl:call-template name="local:focus-caret">
                 <xsl:with-param name="node" select="."/>
                 <xsl:with-param name="offset" select="0"/>
@@ -342,7 +342,8 @@ version="3.0">
                 <xsl:sequence select="ixsl:call($section, 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
             </xsl:if>
             <ixsl:set-property name="activeBlock" select="()" object="local:editor-state()"/>
-            <xsl:for-each select="(($target/(td | th))[$i], ($target/(td | th))[last()])[1]">
+            <xsl:for-each select="local:first-host-in(
+                    (($target/(td | th))[$i], ($target/(td | th))[last()])[1])">
                 <xsl:call-template name="local:focus-caret">
                     <xsl:with-param name="node" select="."/>
                     <xsl:with-param name="offset" select="0"/>
@@ -369,7 +370,8 @@ version="3.0">
                 <xsl:sequence select="ixsl:call(., 'remove', [])[current-date() lt xs:date('2000-01-01')]"/>
             </xsl:for-each>
             <ixsl:set-property name="activeBlock" select="()" object="local:editor-state()"/>
-            <xsl:for-each select="(($row/(td | th))[$i], ($row/(td | th))[last()])[1]">
+            <xsl:for-each select="local:first-host-in(
+                    (($row/(td | th))[$i], ($row/(td | th))[last()])[1])">
                 <xsl:call-template name="local:focus-caret">
                     <xsl:with-param name="node" select="."/>
                     <xsl:with-param name="offset" select="0"/>
@@ -394,7 +396,7 @@ version="3.0">
         <xsl:variable name="cells" as="element()*" select="local:table-cells($table)"/>
         <xsl:choose>
             <xsl:when test="$shift">
-                <xsl:for-each select="($cells[. &lt;&lt; $host])[last()]">
+                <xsl:for-each select="local:last-host-in(($cells[. &lt;&lt; $host])[last()])">
                     <!-- caret at the end, but before a trailing placeholder <br> -->
                     <xsl:call-template name="local:focus-caret">
                         <xsl:with-param name="node" select="."/>
@@ -403,7 +405,7 @@ version="3.0">
                 </xsl:for-each>
             </xsl:when>
             <xsl:when test="exists(($cells[. &gt;&gt; $host])[1])">
-                <xsl:for-each select="($cells[. &gt;&gt; $host])[1]">
+                <xsl:for-each select="local:first-host-in(($cells[. &gt;&gt; $host])[1])">
                     <xsl:call-template name="local:focus-caret">
                         <xsl:with-param name="node" select="."/>
                         <xsl:with-param name="offset" select="0"/>
@@ -450,7 +452,8 @@ version="3.0">
         <xsl:variable name="next" as="element()?" select="(local:table-rows($table)[. &gt;&gt; $row])[1]"/>
         <xsl:choose>
             <xsl:when test="exists($next)">
-                <xsl:for-each select="(($next/(td | th))[$i], ($next/(td | th))[last()])[1]">
+                <xsl:for-each select="local:first-host-in(
+                        (($next/(td | th))[$i], ($next/(td | th))[last()])[1])">
                     <xsl:call-template name="local:focus-caret">
                         <xsl:with-param name="node" select="."/>
                         <xsl:with-param name="offset" select="0"/>
diff --git a/tests/browser/authoring.mjs b/tests/browser/authoring.mjs
new file mode 100644
index 0000000..6207dd3
--- /dev/null
+++ b/tests/browser/authoring.mjs
@@ -0,0 +1,547 @@
+// Phase 2 authoring gestures: quote toggle (wrap/unwrap/RDFa refusal/inner
+// convert), nested-list Tab/Shift+Tab indent/outdent with container collapse,
+// progressive Enter/Backspace exits, container merges (B2b/B7), Tab dispatch in
+// flow cells, and toolbar enable/disable state (fixture-nesting.html).
+import { chromium } from 'playwright';
+
+const BASE = process.env.BASE_URL ?? 'http://localhost:8080';
+
+const errors = [];
+const results = {};
+const browser = await chromium.launch();
+const page = await browser.newPage();
+page.on('console', msg => { if (msg.type() === 'error') errors.push(msg.text()); });
+page.on('pageerror', err => errors.push(String(err)));
+page.on('dialog', d => d.accept());
+
+const undoKey = 'Control+z';
+const load = async () => {
+    await page.goto(BASE + '/tests/fixture-nesting.html');
+    await page.waitForSelector('#content > * > [data-role=chrome]', { state: 'attached', timeout: 15000 })
+        .catch(() => errors.push('chrome never injected'));
+};
+const caretIn = (selector, offset = 2) => page.evaluate(([sel, off]) => {
+    const host = document.querySelector(sel);
+    host.focus();
+    const t = [...host.childNodes].find(n => n.nodeType === 3 && n.textContent.trim().length > 2);
+    window.getSelection().collapse(t, off === -1 ? t.textContent.length : off);
+}, [selector, offset]);
+const paste = (selector, html, plain) => page.evaluate(([sel, h, p]) => {
+    const dt = new DataTransfer();
+    if (h) dt.setData('text/html', h);
+    if (p) dt.setData('text/plain', p);
+    document.querySelector(sel).dispatchEvent(
+        new ClipboardEvent('paste', { clipboardData: dt, bubbles: true, cancelable: true }));
+}, [selector, html, plain]);
+// caret inside the editable host whose DIRECT text carries the needle (a leaf li,
+// or the run wrapper of a container item)
+const caretInLi = (needle, offset = 0) => page.evaluate(([txt, off]) => {
+    const host = [...document.querySelectorAll('#content [contenteditable=true]')]
+        .find(el => [...el.childNodes].some(n => n.nodeType === 3 && n.textContent.includes(txt)));
+    host.focus();
+    const t = [...host.childNodes].find(n => n.nodeType === 3 && n.textContent.includes(txt));
+    window.getSelection().collapse(t, off === -1 ? t.textContent.length : off);
+}, [needle, offset]);
+
+// ==== A. quote toggle + toolbar state ===============================================
+await load();
+
+// toolbar state: caret in a plain list item disables the block-type select
+await caretInLi('Plain item', 1);
+await page.waitForTimeout(100);
+results.toolbar = await page.evaluate(() => ({
+    selectDisabledInLi: document.querySelector('#edit-toolbar select[name=block-type]').disabled,
+    // an li cannot wrap in a blockquote (ul holds only li) - the toggle disables
+    quoteDisabledInLi: document.querySelector('#edit-toolbar button.format-quote').disabled,
+}));
+// caret in the quote's paragraph: select enabled and reads Paragraph, toggle pressed
+await caretIn('#content > blockquote > p', 2);
+await page.waitForTimeout(100);
+Object.assign(results.toolbar, await page.evaluate(() => ({
+    selectEnabledInQuoteP: !document.querySelector('#edit-toolbar select[name=block-type]').disabled,
+    selectReadsParagraph: document.querySelector('#edit-toolbar select[name=block-type]').value === 'p',
+    quotePressed: document.querySelector('#edit-toolbar button.format-quote').getAttribute('aria-pressed') === 'true',
+})));
+
+// quote ON: wrap the intro paragraph
+await caretIn('#content > p', 2);
+await page.click('#edit-toolbar button.format-quote');
+results.quoteOn = await page.evaluate(() => {
+    const bq = [...document.querySelectorAll('#content > blockquote')]
+        .find(b => b.textContent.includes('Intro paragraph'));
+    return {
+        wrapped: !!bq && bq.querySelector(':scope > p')?.getAttribute('contenteditable') === 'true',
+        chromeOnQuote: !!bq?.querySelector(':scope > [data-role=chrome]'),
+        noChromeOnP: !bq?.querySelector(':scope > p > [data-role=chrome]'),
+        notEditableItself: bq?.getAttribute('contenteditable') !== 'true',
+    };
+});
+
+// inner convert: the paragraph inside the quote becomes a heading, quote intact
+await page.evaluate(() => {
+    const bq = [...document.querySelectorAll('#content > blockquote')]
+        .find(b => b.textContent.includes('Intro paragraph'));
+    const p = bq.querySelector(':scope > p');
+    p.focus();
+    window.getSelection().collapse([...p.childNodes].find(n => n.nodeType === 3), 2);
+});
+await page.selectOption('#edit-toolbar select[name=block-type]', 'h2');
+results.innerConvert = await page.evaluate(() => {
+    const bq = [...document.querySelectorAll('#content > blockquote')]
+        .find(b => b.textContent.includes('Intro paragraph'));
+    return {
+        converted: !!bq?.querySelector(':scope > h2'),
+        quoteIntact: !!bq,
+        editable: bq?.querySelector(':scope > h2')?.getAttribute('contenteditable') === 'true',
+    };
+});
+
+// quote OFF: the heading releases to the top level with chrome
+await page.click('#edit-toolbar button.format-quote');
+results.quoteOff = await page.evaluate(() => {
+    const h2 = [...document.querySelectorAll('#content > h2')]
+        .find(h => h.textContent.includes('Intro paragraph'));
+    return {
+        released: !!h2,
+        chromeRestored: !!h2?.querySelector(':scope > [data-role=chrome]'),
+        quoteGone: ![...document.querySelectorAll('#content > blockquote')]
+            .some(b => b.textContent.includes('Intro paragraph')),
+    };
+});
+// undo restores the quote, second undo the paragraph
+await page.keyboard.press(undoKey);
+results.quoteOff.undoRestoresQuote = await page.evaluate(() =>
+    [...document.querySelectorAll('#content > blockquote')]
+        .some(b => b.querySelector(':scope > h2')?.textContent.includes('Intro paragraph')));
+
+// RDFa refusal: an annotated quote refuses to unwrap
+await page.evaluate(() => {
+    const bq = [...document.querySelectorAll('#content > blockquote')]
+        .find(b => b.textContent.includes('Intro paragraph'));
+    bq.setAttribute('property', 'http://purl.org/dc/terms/description');
+    const h = bq.querySelector('[contenteditable=true]');
+    h.focus();
+    window.getSelection().collapse([...h.childNodes].find(n => n.nodeType === 3), 1);
+});
+await page.click('#edit-toolbar button.format-quote');
+results.rdfaRefusal = await page.evaluate(() =>
+    [...document.querySelectorAll('#content > blockquote')]
+        .some(b => b.getAttribute('property') && b.textContent.includes('Intro paragraph')));
+
+// ==== B. nested-list indent/outdent ================================================
+await load();
+
+// Tab indents the second item under the first
+await caretInLi('Mixed item', 1);
+await page.keyboard.press('Tab');
+results.indent = await page.evaluate(() => {
+    const plain = [...document.querySelectorAll('#content > ul > li')]
+        .find(l => l.textContent.includes('Plain item'));
+    const mixed = plain?.querySelector(':scope > ul > li');
+    return {
+        nested: !!mixed && mixed.textContent.includes('Mixed item'),
+        prevBecameContainer: plain?.getAttribute('contenteditable') !== 'true',
+        prevRunWrapper: plain?.querySelector(':scope > p.rdfa-editor-run')?.textContent === 'Plain item',
+        prevRunEditable: plain?.querySelector(':scope > p.rdfa-editor-run')
+            ?.getAttribute('contenteditable') === 'true',
+        subtreeIntact: !!mixed?.querySelector(':scope > ul > li'), // Mixed item kept its own sublist
+    };
+});
+// canonical source shows the conventional mixed form
+await page.click('#view-source');
+const src = await page.evaluate(() => document.getElementById('output-content').textContent);
+results.indent.canonicalConventional = /<li>Plain item<ul>/.test(src.replace(/>\s+</g, '><'))
+    && !src.includes('rdfa-editor-run');
+await page.keyboard.press('Escape');
+
+// Shift+Tab outdents it again and the emptied container collapses to a text host
+await caretInLi('Mixed item', 1);
+await page.keyboard.press('Shift+Tab');
+results.outdent = await page.evaluate(() => {
+    const top = [...document.querySelectorAll('#content > ul > li')];
+    const plain = top.find(l => l.textContent.includes('Plain item'));
+    return {
+        backAtTopLevel: top.some(l => l.textContent.includes('Mixed item')),
+        containerCollapsed: plain?.getAttribute('contenteditable') === 'true',
+        noRunWrapperLeft: !plain?.querySelector(':scope > p.rdfa-editor-run'),
+    };
+});
+
+// first item flashes and stays put
+await caretInLi('Plain item', 1);
+await page.keyboard.press('Tab');
+results.firstItemInert = await page.evaluate(() =>
+    [...document.querySelectorAll('#content > ul > li')].some(l => l.textContent.startsWith('Plain item')));
+
+// Shift+Tab with followers: outdenting Sub one demotes Sub two under it
+await caretInLi('Sub one', 1);
+await page.keyboard.press('Shift+Tab');
+results.outdentFollowers = await page.evaluate(() => {
+    const top = [...document.querySelectorAll('#content > ul > li')];
+    const subOne = top.find(l => l.textContent.includes('Sub one'));
+    const mixed = top.find(l => l.textContent.includes('Mixed item'));
+    return {
+        subOneAtTop: !!subOne,
+        subTwoDemoted: !!subOne?.querySelector(':scope > ul > li')
+            && subOne.querySelector(':scope > ul > li').textContent.includes('Sub two'),
+        subOneRunEditable: subOne?.querySelector(':scope > p.rdfa-editor-run')
+            ?.getAttribute('contenteditable') === 'true',
+        mixedCollapsed: mixed?.getAttribute('contenteditable') === 'true',
+    };
+});
+await page.keyboard.press(undoKey);
+results.outdentFollowers.undone = await page.evaluate(() => {
+    const mixed = [...document.querySelectorAll('#content > ul > li')]
+        .find(l => l.textContent.includes('Mixed item'));
+    return !!mixed?.querySelector(':scope > ul > li') // sublist back inside Mixed item
+        && mixed.getAttribute('contenteditable') !== 'true';
+});
+
+// progressive Enter: split at the end of the last nested item, then outdent
+await caretInLi('Sub two', -1);
+await page.keyboard.press('Enter');   // new empty item in the nested list
+await page.keyboard.press('Enter');   // E4a: outdents one level
+results.progressiveEnter = await page.evaluate(() => {
+    const sel = window.getSelection();
+    const li = sel.anchorNode?.nodeType === 1 ? sel.anchorNode : sel.anchorNode?.parentElement;
+    const item = li?.closest('li');
+    return {
+        outdentedToTop: !!item && item.parentElement.parentElement.id === 'content',
+        empty: item?.textContent.trim() === '',
+    };
+});
+
+// Backspace at the start of the first nested item outdents (B4b)
+await load();
+await caretInLi('Sub one', 0);
+await page.keyboard.press('Backspace');
+results.backspaceOutdent = await page.evaluate(() => {
+    const top = [...document.querySelectorAll('#content > ul > li')];
+    const subOne = top.find(l => l.textContent.includes('Sub one'));
+    return {
+        outdented: !!subOne,
+        followersDemoted: !!subOne?.querySelector(':scope > ul > li'),
+    };
+});
+
+// ==== C. container merges ==========================================================
+await load();
+
+// B7: Backspace at the start of the quote's first block exits upward
+await caretIn('#content > blockquote > p', 0);
+await page.keyboard.press('Backspace');
+results.quoteExit = await page.evaluate(() => {
+    const p = [...document.querySelectorAll('#content > p')]
+        .find(x => x.textContent.includes('Bare quote text'));
+    return {
+        released: !!p && p.getAttribute('contenteditable') === 'true',
+        chrome: !!p?.querySelector(':scope > [data-role=chrome]'),
+        emptyQuoteRemoved: ![...document.querySelectorAll('#content > blockquote')]
+            .some(b => b.textContent.trim().replace('⣿', '') === ''),
+    };
+});
+await page.keyboard.press(undoKey);
+results.quoteExit.undone = await page.evaluate(() =>
+    [...document.querySelectorAll('#content > blockquote > p')]
+        .some(p => p.textContent.includes('Bare quote text')));
+
+// B2b: Backspace at the start of the block after the quote merges into its last host
+await caretIn('#content > blockquote + p', 0);
+await page.keyboard.press('Backspace');
+results.mergeIntoQuote = await page.evaluate(() => {
+    const bq = document.querySelector('#content > blockquote');
+    return {
+        merged: bq?.querySelector(':scope > p')?.textContent.includes('Before'),
+        hostGone: ![...document.querySelectorAll('#content > p')]
+            .some(p => p.textContent.trim().replace('⣿', '') === 'Before'),
+    };
+});
+await page.keyboard.press(undoKey);
+
+// B2b: Backspace after a list merges into its last item
+await load();
+await caretIn('#content > ul + blockquote > p', 0); // move to a known spot first
+await caretIn('#content > blockquote + p', 0);
+await page.evaluate(() => { // place the caret at the start of the p after the fostered ul
+    const p = [...document.querySelectorAll('#content > p')]
+        .find(x => [...x.childNodes].some(n => n.nodeType === 3 && n.textContent.trim() === 'after'));
+    p.focus();
+    const t = [...p.childNodes].find(n => n.nodeType === 3 && n.textContent.trim());
+    window.getSelection().collapse(t, 0);
+});
+await page.keyboard.press('Backspace');
+results.mergeIntoList = await page.evaluate(() => {
+    const li = [...document.querySelectorAll('#content > ul > li')]
+        .find(l => l.textContent.includes('parser-fostered list'));
+    return { merged: !!li && li.textContent.includes('after') };
+});
+
+// ==== D. Tab dispatch in flow cells ================================================
+await load();
+
+// Tab from a paragraph inside a container cell traverses to the next cell
+await page.evaluate(() => {
+    const p = document.querySelector('#content td > p');
+    p.focus();
+    window.getSelection().collapse([...p.childNodes].find(n => n.nodeType === 3), 2);
+});
+await page.keyboard.press('Tab');
+results.cellTab = await page.evaluate(() => {
+    const plain = [...document.querySelectorAll('#content td')]
+        .find(td => td.textContent.includes('Plain cell'));
+    return { landedInNextCell: plain?.contains(window.getSelection().anchorNode) };
+});
+
+// ==== E. toolbar insert follows the caret context ==================================
+// a numbered list inserts INSIDE the cell the caret is in, not after the table
+await page.evaluate(() => {
+    const td = [...document.querySelectorAll('#content td')]
+        .find(t => t.textContent.includes('Plain cell'));
+    td.focus();
+    window.getSelection().collapse([...td.childNodes].find(n => n.nodeType === 3), 2);
+});
+await page.click('#edit-toolbar button.insert-list[data-list=ol]');
+results.insertListInCell = await page.evaluate(() => {
+    const td = [...document.querySelectorAll('#content td')]
+        .find(t => t.textContent.includes('Plain cell'));
+    return {
+        nestedInCell: !!td.querySelector(':scope > ol > li'),
+        cellIsContainer: td.getAttribute('contenteditable') !== 'true',
+        textKeptAsRun: td.querySelector(':scope > p.rdfa-editor-run')?.textContent === 'Plain cell',
+        runEditable: td.querySelector(':scope > p.rdfa-editor-run')?.getAttribute('contenteditable') === 'true',
+        noChromeInCell: !td.querySelector('[data-role=chrome]'),
+        notAfterTable: !document.querySelector('#content > table + ol'),
+        caretInNewItem: td.querySelector(':scope > ol > li').contains(window.getSelection().anchorNode)
+            || td.querySelector(':scope > ol > li') === window.getSelection().anchorNode,
+    };
+});
+// the original cell text must remain EDITABLE: type into it and verify
+await page.evaluate(() => {
+    const run = [...document.querySelectorAll('#content td > p.rdfa-editor-run')]
+        .find(p => p.textContent.includes('Plain cell'));
+    run.focus();
+    window.getSelection().collapse([...run.childNodes].find(n => n.nodeType === 3), 5);
+});
+await page.keyboard.type('QQ');
+results.insertListInCell.originalTextTypable = await page.evaluate(() =>
+    [...document.querySelectorAll('#content td')].some(t => t.textContent.includes('PlainQQ cell')));
+await page.waitForTimeout(1100);
+await page.keyboard.press(undoKey); // the QQ burst
+await page.keyboard.press(undoKey); // the list insert
+results.insertListInCell.undone = await page.evaluate(() =>
+    ![...document.querySelectorAll('#content td')].some(t => t.querySelector(':scope > ol')));
+
+// Backspace at the start of the first item of a cell-nested list merges it back
+// into the preceding line and dissolves the list (B4c)
+await page.evaluate(() => {
+    const td = [...document.querySelectorAll('#content td')]
+        .find(t => t.textContent.includes('Plain cell'));
+    td.focus();
+    window.getSelection().collapse([...td.childNodes].find(n => n.nodeType === 3), 2);
+});
+await page.click('#edit-toolbar button.insert-list[data-list=ol]');
+await page.keyboard.type('item text');
+await page.evaluate(() => {
+    const li = [...document.querySelectorAll('#content td li')]
+        .find(l => l.textContent.includes('item text'));
+    li.focus();
+    window.getSelection().collapse([...li.childNodes].find(n => n.nodeType === 3), 0);
+});
+await page.keyboard.press('Backspace');
+results.backspaceDissolvesCellList = await page.evaluate(() => {
+    const td = [...document.querySelectorAll('#content td')]
+        .find(t => t.textContent.includes('Plain cell'));
+    return {
+        listGone: !td.querySelector('ol'),
+        textMerged: td.textContent.includes('Plain cellitem text'),
+        cellCollapsed: td.getAttribute('contenteditable') === 'true',
+        noRunWrapperLeft: !td.querySelector('p.rdfa-editor-run'),
+        caretAtJunction: td.contains(window.getSelection().anchorNode),
+    };
+});
+// typing continues seamlessly at the junction
+await page.keyboard.type('Z');
+results.backspaceDissolvesCellList.typableAfter = await page.evaluate(() =>
+    [...document.querySelectorAll('#content td')].some(t => t.textContent.includes('Plain cellZitem text')));
+await page.waitForTimeout(1100);
+await page.keyboard.press(undoKey); // the Z burst
+await page.keyboard.press(undoKey); // the dissolve
+await page.keyboard.press(undoKey); // the item typing
+await page.keyboard.press(undoKey); // the list insert
+results.backspaceDissolvesCellList.undoUnwinds = await page.evaluate(() =>
+    [...document.querySelectorAll('#content td')].some(t =>
+        t.getAttribute('contenteditable') === 'true' && t.textContent.trim() === 'Plain cell'
+        && !t.querySelector('ol')));
+
+// with the caret in a list item, the list nests inside the item
+await caretInLi('Plain item', 1);
+await page.click('#edit-toolbar button.insert-list[data-list=ul]');
+results.insertListInLi = await page.evaluate(() => {
+    const li = [...document.querySelectorAll('#content > ul > li')]
+        .find(l => l.textContent.includes('Plain item'));
+    return { nestedInItem: !!li?.querySelector(':scope > ul > li') };
+});
+await page.keyboard.press(undoKey);
+
+// at the top level the list still lands after the current block, with chrome
+await caretIn('#content > p', 2);
+await page.click('#edit-toolbar button.insert-list[data-list=ul]');
+results.insertListTopLevel = await page.evaluate(() => {
+    const ul = document.querySelector('#content > p + ul');
+    return { afterBlock: !!ul, chrome: !!ul?.querySelector(':scope > [data-role=chrome]') };
+});
+await page.keyboard.press(undoKey);
+
+// Tab on the single li inside a cell hits the list branch (flash no-op, no traversal)
+const rowsBefore = await page.evaluate(() => document.querySelectorAll('#content table tr').length);
+await page.evaluate(() => {
+    const li = document.querySelector('#content td li');
+    li.focus();
+    window.getSelection().collapse([...li.childNodes].find(n => n.nodeType === 3), 1);
+});
+await page.keyboard.press('Tab');
+results.liInCellTab = await page.evaluate(([rows]) => {
+    const li = document.querySelector('#content td li');
+    return {
+        noTraversal: li.contains(window.getSelection().anchorNode),
+        noRowGrowth: document.querySelectorAll('#content table tr').length === rows,
+    };
+}, [rowsBefore]);
+
+// ==== F. review-fix regressions ====================================================
+await load();
+
+// F1: region-boundary clamp - Tab/quote in a region embedded in host-page
+// li/table/blockquote must not touch the host structures
+await caretIn('#embedded > p', 2);
+const hostShape = () => page.evaluate(() => ({
+    rows: document.querySelectorAll('#host-table tr').length,
+    items: document.querySelectorAll('#host-list > li').length,
+    regionInPlace: !!document.querySelector('#host-list > li > #embedded'),
+    hostQuote: !!document.querySelector('body > blockquote > #host-table'),
+}));
+const before = await hostShape();
+await page.keyboard.press('Tab');
+await page.keyboard.press('Shift+Tab');
+results.regionClamp = { hostUntouchedByTab: JSON.stringify(await hostShape()) === JSON.stringify(before) };
+// the quote toggle must not read the host-page blockquote as "pressed"
+await caretIn('#embedded > p', 2);
+await page.waitForTimeout(100);
+results.regionClamp.hostQuoteNotPressed = await page.evaluate(() =>
+    document.querySelector('#edit-toolbar button.format-quote').getAttribute('aria-pressed') === 'false');
+// toggling wraps INSIDE the region, never dissolves the host quote
+await page.click('#edit-toolbar button.format-quote');
+Object.assign(results.regionClamp, await page.evaluate(() => ({
+    wrappedInRegion: !!document.querySelector('#embedded > blockquote > p'),
+    hostQuoteIntact: !!document.querySelector('body > blockquote > #host-table'),
+})));
+await page.keyboard.press(undoKey);
+
+// F2: B2b composite boundary - Backspace after a quote ENDING in a table is inert
+await caretIn('#content > blockquote > p', -1);
+await paste('#content > blockquote > p', '<table><tr><td>qcell</td></tr></table>');
+await page.evaluate(() => { // drop the empty split half so the table is the quote's last block (B3)
+    const p = [...document.querySelectorAll('#content > blockquote > p')].pop();
+    p.focus();
+    window.getSelection().collapse(p, 0);
+});
+await page.keyboard.press('Backspace');
+await caretIn('#content > blockquote + p', 0);
+await page.keyboard.press('Backspace');
+results.compositeBoundary = await page.evaluate(() => ({
+    quoteEndsWithTable: !!document.querySelector('#content > blockquote > table:last-child'),
+    hostStays: [...document.querySelectorAll('#content > p')]
+        .some(p => [...p.childNodes].some(n => n.nodeType === 3 && n.textContent.includes('Before'))),
+    cellClean: [...document.querySelectorAll('#content blockquote td')]
+        .every(td => !td.textContent.includes('Before')),
+}));
+
+// F3: E4b in a cell - exiting a sole-item list stays INSIDE the cell
+await load();
+await page.evaluate(() => {
+    const td = [...document.querySelectorAll('#content td')].find(t => t.textContent.includes('Plain cell'));
+    td.focus();
+    window.getSelection().collapse([...td.childNodes].find(n => n.nodeType === 3), 2);
+});
+const regionBlocks = await page.evaluate(() => document.getElementById('content').children.length);
+await page.click('#edit-toolbar button.insert-list[data-list=ul]');
+await page.keyboard.press('Enter'); // E4b on the empty sole item
+results.cellListExit = await page.evaluate(([n]) => {
+    const td = [...document.querySelectorAll('#content td')].find(t => t.textContent.includes('Plain cell'));
+    return {
+        paragraphInCell: !!td.querySelector(':scope > p:not(.rdfa-editor-run)'),
+        listGone: !td.querySelector('ul'),
+        caretInCell: td.contains(window.getSelection().anchorNode),
+        noRegionEndParagraph: document.getElementById('content').children.length === n,
+    };
+}, [regionBlocks]);
+await page.keyboard.press(undoKey);
+await page.keyboard.press(undoKey);
+
+// F4: E6 nested - Enter in the figcaption of a figure pasted into an item
+// starts the paragraph INSIDE the item, after the figure
+await load();
+await caretInLi('Plain item', -1);
+await paste('#content > ul > li',
+    '<figure><img src="data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==" alt="nested"/><figcaption>nested cap</figcaption></figure>');
+await page.evaluate(() => {
+    const cap = [...document.querySelectorAll('#content li figcaption')]
+        .find(c => c.textContent.includes('nested cap'));
+    cap.focus();
+    window.getSelection().collapse([...cap.childNodes].find(n => n.nodeType === 3), 2);
+});
+await page.keyboard.press('Enter');
+results.nestedCaptionEnter = await page.evaluate(() => {
+    const li = [...document.querySelectorAll('#content > ul > li')]
+        .find(l => l.querySelector(':scope > figure'));
+    return {
+        paragraphInItem: !!li?.querySelector(':scope > figure + p'),
+        caretInItem: li?.contains(window.getSelection().anchorNode),
+    };
+});
+
+// F5: bare image island deletes ALONE, not its whole list
+await load();
+await caretInLi('Plain item', -1);
+await paste('#content > ul > li',
+    '<img src="data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==" alt="island"/><ul><li>survivor</li></ul>');
+await page.evaluate(() => {
+    const img = [...document.querySelectorAll('#content li > img')].find(i => i.alt === 'island');
+    img.focus();
+});
+await page.keyboard.press('Delete');
+results.islandDelete = await page.evaluate(() => ({
+    imageGone: ![...document.querySelectorAll('#content img')].some(i => i.alt === 'island'),
+    listSurvives: [...document.querySelectorAll('#content li')].some(l => l.textContent.includes('survivor')),
+    outerListSurvives: [...document.querySelectorAll('#content > ul > li')].some(l => l.textContent.includes('Plain item')),
+}));
+
+// F6: converting a nested host keeps the caret position
+await load();
+await caretIn('#content > blockquote > p', 4);
+await page.evaluate(() => {
+    const s = document.querySelector('#edit-toolbar select[name=block-type]');
+    s.value = 'h2'; s.dispatchEvent(new Event('change', { bubbles: true }));
+});
+results.nestedConvertCaret = await page.evaluate(() => {
+    const h2 = document.querySelector('#content > blockquote > h2');
+    const sel = window.getSelection();
+    return { converted: !!h2, caretKept: h2?.contains(sel.anchorNode) && sel.anchorOffset === 4 };
+});
+
+// F7: inserting at a figcaption nests inside the caption, not into the figure
+await load();
+await caretIn('#content figcaption', 2);
+await page.click('#edit-toolbar button.insert-list[data-list=ol]');
+results.figcaptionInsert = await page.evaluate(() => {
+    const fig = document.querySelector('#content > figure');
+    return {
+        nestedInCaption: !!fig.querySelector(':scope > figcaption > ol > li'),
+        figureNotGrown: fig.querySelectorAll(':scope > *:not([data-role])').length === 2, // img + figcaption
+    };
+});
+
+console.log(JSON.stringify({ results, errors: errors.slice(0, 5) }, null, 2));
+await browser.close();
+const flat = JSON.stringify(results);
+process.exit(errors.length || flat.includes('false') ? 1 : 0);
diff --git a/tests/browser/features.mjs b/tests/browser/features.mjs
index b09af82..794b49b 100644
--- a/tests/browser/features.mjs
+++ b/tests/browser/features.mjs
@@ -254,7 +254,7 @@ await page.click('#overlay button.spo-action');
 await page.waitForTimeout(200);
 results.lint.badgeShown = await page.evaluate(() =>
     getComputedStyle(document.getElementById('lint-badge')).display !== 'none'
-    && document.getElementById('lint-badge').textContent === '1 RDFa issue');
+    && document.getElementById('lint-badge').textContent === '1 issue');
 results.lint.squiggle = await page.evaluate(() =>
     document.querySelector('#content span[property="nmae"]')?.classList.contains('rdfa-invalid') === true);
 await page.click('#lint-badge');
diff --git a/tests/browser/hardening.mjs b/tests/browser/hardening.mjs
index 20ba589..962b16c 100644
--- a/tests/browser/hardening.mjs
+++ b/tests/browser/hardening.mjs
@@ -75,7 +75,7 @@ await page.keyboard.press('Control+z');
 results.pasteBlocks.singleUndoReverts = await page.evaluate(bc =>
     document.getElementById('content').children.length === bc, blocksBefore);
 
-// paste blocks into li -> flattened text
+// paste blocks into li -> nested inside the item (li is %Flow; per XHTML Strict)
 await page.evaluate(() => {
     const li = document.querySelector('#content li');
     li.focus();
@@ -83,14 +83,18 @@ await page.evaluate(() => {
 });
 await paste('#content li', '<p>flat one</p><p>flat two</p>', '');
 results.pasteLi = await page.evaluate(() => {
-    const ul = document.querySelector('#content > ul');
+    const li = [...document.querySelectorAll('#content li')].find(l => l.textContent.includes('flat one'));
     return {
-        noNestedBlocks: !ul.querySelector('p'),
-        textFlattened: ul.textContent.includes('flat one') && ul.textContent.includes('flat two'),
+        blocksNested: !!li && li.querySelectorAll(':scope > p').length >= 2,
+        liIsContainer: li?.getAttribute('contenteditable') !== 'true',
+        headRunEditable: li?.querySelector(':scope > p.rdfa-editor-run')?.getAttribute('contenteditable') === 'true',
+        textKept: li?.textContent.includes('flat one') && li?.textContent.includes('flat two'),
     };
 });
-await page.evaluate(() => document.querySelector('#content li').focus());
+await page.evaluate(() => document.querySelector('#content [contenteditable=true]').focus());
 await page.keyboard.press('Control+z');
+results.pasteLi.singleUndoReverts = await page.evaluate(() =>
+    ![...document.querySelectorAll('#content li')].some(l => l.textContent.includes('flat one')));
 
 // ---- P3: a11y/keys ----
 // Escape closes the find dialog
@@ -136,7 +140,7 @@ results.aria = await page.evaluate(() => ({
 }));
 
 // ---- P4: undo caret restoration ----
-await caretInText('#content > blockquote', 4);
+await caretInText('#content > blockquote > p', 4);
 await page.keyboard.type('ZZZ');
 await page.waitForTimeout(1100);
 await caretInText('#content > p:first-of-type', 1); // move caret elsewhere
diff --git a/tests/browser/invariants.mjs b/tests/browser/invariants.mjs
new file mode 100644
index 0000000..d1d1765
--- /dev/null
+++ b/tests/browser/invariants.mjs
@@ -0,0 +1,161 @@
+// Invariant-based nesting suite: a uniform gesture battery runs in EVERY caret
+// context (top-level, quote paragraph, leaf/container/nested list items, leaf and
+// container cells, caption, figcaption), and after every gesture the editing DOM
+// must satisfy properties that hold regardless of what the gesture did:
+//   I1 every non-ws text node sits inside an editable host (nothing uneditable)
+//   I2 hosts never nest (contenteditable inside contenteditable)
+//   I3 chrome only as a direct child of top-level blocks
+//   I4 run wrappers are editable, marker-classed paragraphs inside containers
+//   I5 the lint badge stays hidden (editor gestures never produce invalid nesting)
+// and after the battery, undo unwinds back to the exact post-init baseline.
+// This is the cross-product net that hand-picked scenario tests cannot be.
+import { chromium } from 'playwright';
+
+const BASE = process.env.BASE_URL ?? 'http://localhost:8080';
+
+const errors = [];
+const results = {};
+const browser = await chromium.launch();
+const page = await browser.newPage();
+page.on('console', msg => { if (msg.type() === 'error') errors.push(msg.text()); });
+page.on('pageerror', err => errors.push(String(err)));
+page.on('dialog', d => d.accept());
+
+// caret contexts: needle fragments chosen to survive prefix insertions (typing
+// lands at offset 1, so the needle drops the first characters)
+const CONTEXTS = [
+    { name: 'top-level-p', needle: 'ntro paragraph' },
+    { name: 'quote-p', needle: 'are quote text' },
+    { name: 'leaf-li', needle: 'lain item' },
+    { name: 'container-li-run', needle: 'ixed item' },
+    { name: 'nested-li', needle: 'ub one' },
+    { name: 'leaf-td', needle: 'lain cell' },
+    { name: 'cell-p', needle: 'ell para' },
+    { name: 'li-in-td', needle: 'ell item' },
+    { name: 'figcaption', needle: 'caption for gestures' },
+];
+
+// place the caret in the editable host whose direct text carries the needle;
+// false when the host no longer exists (a gesture may legitimately restructure)
+const place = needle => page.evaluate(txt => {
+    const host = [...document.querySelectorAll('#content [contenteditable=true]')]
+        .find(el => [...el.childNodes].some(n => n.nodeType === 3 && n.textContent.includes(txt)));
+    if (!host) return false;
+    host.focus();
+    const t = [...host.childNodes].find(n => n.nodeType === 3 && n.textContent.includes(txt));
+    window.getSelection().collapse(t, 1);
+    return true;
+}, needle);
+
+const invariants = () => page.evaluate(() => {
+    const v = [];
+    const region = document.getElementById('content');
+    // I1: no orphan text
+    const walker = document.createTreeWalker(region, NodeFilter.SHOW_TEXT);
+    for (let n; (n = walker.nextNode());) {
+        if (!n.textContent.trim()) continue;
+        if (n.parentElement.closest('[data-role]')) continue;
+        if (!n.parentElement.closest('[contenteditable=true]'))
+            v.push('orphan text: "' + n.textContent.trim().slice(0, 30) + '"');
+    }
+    // I2: no nested hosts
+    for (const h of region.querySelectorAll('[contenteditable=true] [contenteditable=true]'))
+        v.push('nested host: ' + h.tagName.toLowerCase());
+    // I3: chrome only on top-level blocks
+    for (const c of region.querySelectorAll('[data-role=chrome]'))
+        if (c.parentElement.parentElement !== region)
+            v.push('nested chrome in: ' + c.parentElement.tagName.toLowerCase());
+    // I4: run wrappers are editable p's inside containers
+    for (const r of region.querySelectorAll('.rdfa-editor-run')) {
+        if (r.tagName !== 'P') v.push('run wrapper is ' + r.tagName.toLowerCase());
+        if (r.getAttribute('contenteditable') !== 'true') v.push('uneditable run wrapper');
+        if (r.parentElement === region) v.push('top-level run wrapper');
+    }
+    // I5: gestures never produce invalid nesting (lint refreshes on after-mutation)
+    if (document.getElementById('lint-badge').style.display !== 'none')
+        v.push('lint: ' + document.getElementById('lint-badge').textContent);
+    return v;
+});
+
+const gesture = async (name, act) => {
+    await act();
+    const v = await invariants();
+    if (v.length) return `${name}: ${v.join('; ')}`;
+    return null;
+};
+
+for (const ctx of CONTEXTS) {
+    await page.goto(BASE + '/tests/fixture-nesting.html');
+    await page.waitForSelector('#content > * > [data-role=chrome]', { state: 'attached', timeout: 15000 })
+        .catch(() => errors.push('chrome never injected'));
+    const baseline = await page.evaluate(() => document.getElementById('content').innerHTML);
+    const fails = [];
+
+    const battery = [
+        ['type', async () => { if (await place(ctx.needle)) await page.keyboard.type('xy'); }],
+        ['enter', async () => { if (await place(ctx.needle)) await page.keyboard.press('Enter'); }],
+        ['backspace-at-start', async () => {
+            if (await place(ctx.needle)) {
+                await page.evaluate(() => { // move to the very start of the host
+                    const sel = window.getSelection();
+                    const host = sel.anchorNode.parentElement.closest('[contenteditable=true]');
+                    sel.collapse(host, 0);
+                });
+                await page.keyboard.press('Backspace');
+            }
+        }],
+        ['tab', async () => { if (await place(ctx.needle)) await page.keyboard.press('Tab'); }],
+        ['shift-tab', async () => { if (await place(ctx.needle)) await page.keyboard.press('Shift+Tab'); }],
+        ['insert-list', async () => {
+            if (await place(ctx.needle)) await page.click('#edit-toolbar button.insert-list[data-list=ol]');
+        }],
+        ['insert-paragraph', async () => {
+            if (await place(ctx.needle)) await page.click('#edit-toolbar button.insert-block');
+        }],
+        ['quote-toggle-on', async () => {
+            if (await place(ctx.needle)
+                    && !await page.evaluate(() => document.querySelector('#edit-toolbar button.format-quote').disabled))
+                await page.click('#edit-toolbar button.format-quote');
+        }],
+        ['quote-toggle-off', async () => {
+            if (await place(ctx.needle)
+                    && !await page.evaluate(() => document.querySelector('#edit-toolbar button.format-quote').disabled))
+                await page.click('#edit-toolbar button.format-quote');
+        }],
+        ['convert-h2', async () => {
+            if (await place(ctx.needle)) await page.evaluate(() => {
+                const s = document.querySelector('#edit-toolbar select[name=block-type]');
+                if (!s.disabled) { s.value = 'h2'; s.dispatchEvent(new Event('change', { bubbles: true })); }
+            });
+        }],
+        ['paste-blocks', async () => {
+            if (await place(ctx.needle)) await page.evaluate(() => {
+                const dt = new DataTransfer();
+                dt.setData('text/html', '<p>pasted para</p><ul><li>pasted item</li></ul>');
+                dt.setData('text/plain', 'pasted para pasted item');
+                const host = window.getSelection().anchorNode.parentElement.closest('[contenteditable=true]');
+                host.dispatchEvent(new ClipboardEvent('paste', { clipboardData: dt, bubbles: true, cancelable: true }));
+            });
+        }],
+    ];
+    for (const [name, act] of battery) {
+        try {
+            const fail = await gesture(name, act);
+            if (fail) fails.push(fail);
+        } catch (e) {
+            fails.push(`${name}: threw ${String(e).slice(0, 120)}`);
+        }
+    }
+
+    // the battery unwinds to the exact post-init state
+    await page.evaluate(() => document.querySelector('#content [contenteditable=true]')?.focus());
+    for (let i = 0; i < 20; i++) await page.keyboard.press('Control+z');
+    const restored = await page.evaluate(() => document.getElementById('content').innerHTML);
+    if (restored !== baseline) fails.push('undo did not restore the baseline');
+
+    results[ctx.name] = fails.length ? fails : true;
+}
+
+console.log(JSON.stringify({ results, errors: errors.slice(0, 5) }, null, 2));
+await browser.close();
+process.exit(errors.length || Object.values(results).some(r => r !== true) ? 1 : 0);
diff --git a/tests/browser/nesting.mjs b/tests/browser/nesting.mjs
new file mode 100644
index 0000000..397fe90
--- /dev/null
+++ b/tests/browser/nesting.mjs
@@ -0,0 +1,171 @@
+// Phase 1 content-model foundation: recursive editability init, mixed-flow run
+// wrappers, load normalization, blockquote-as-container editing, nested paste,
+// nesting lint and undo across nested hosts (fixture-nesting.html).
+import { chromium } from 'playwright';
+
+const BASE = process.env.BASE_URL ?? 'http://localhost:8080';
+
+const errors = [];
+const results = {};
+const browser = await chromium.launch();
+const page = await browser.newPage();
+page.on('console', msg => { if (msg.type() === 'error') errors.push(msg.text()); });
+page.on('pageerror', err => errors.push(String(err)));
+page.on('dialog', d => d.accept());
+
+await page.goto(BASE + '/tests/fixture-nesting.html');
+await page.waitForSelector('#content > * > [data-role=chrome]', { state: 'attached', timeout: 15000 })
+    .catch(() => errors.push('chrome never injected'));
+
+const undoKey = 'Control+z';
+const caretInText = async (selector, offset = 2) => page.evaluate(([sel, off]) => {
+    const host = document.querySelector(sel);
+    host.focus();
+    const t = [...host.childNodes].find(n => n.nodeType === 3 && n.textContent.trim().length > 2);
+    window.getSelection().collapse(t, off);
+}, [selector, offset]);
+const paste = (selector, html, plain) => page.evaluate(([sel, h, p]) => {
+    const dt = new DataTransfer();
+    if (h) dt.setData('text/html', h);
+    if (p) dt.setData('text/plain', p);
+    document.querySelector(sel).dispatchEvent(
+        new ClipboardEvent('paste', { clipboardData: dt, bubbles: true, cancelable: true }));
+}, [selector, html, plain]);
+
+// ---- 1. recursive editability init -----------------------------------------------
+results.init = await page.evaluate(() => {
+    const editable = el => el?.getAttribute('contenteditable') === 'true';
+    const mixed = [...document.querySelectorAll('#content > ul > li')]
+        .find(li => li.textContent.includes('Mixed item'));
+    const blockItem = [...document.querySelectorAll('#content > ul > li')]
+        .find(li => li.textContent.includes('Block item'));
+    const bq = document.querySelector('#content > blockquote');
+    const cell = document.querySelector('#content td');
+    const plainCell = [...document.querySelectorAll('#content td')]
+        .find(td => td.textContent.includes('Plain cell'));
+    return {
+        plainLiEditable: editable([...document.querySelectorAll('#content > ul > li')]
+            .find(li => li.textContent.startsWith('Plain item'))),
+        mixedLiIsContainer: mixed && !editable(mixed),
+        mixedLiRunWrapper: editable(mixed?.querySelector(':scope > p.rdfa-editor-run'))
+            && mixed?.querySelector(':scope > p.rdfa-editor-run').textContent === 'Mixed item',
+        mixedLiSubEditable: editable(mixed?.querySelector(':scope > ul > li')),
+        blockItemIsContainer: blockItem && !editable(blockItem),
+        blockItemPEditable: editable(blockItem?.querySelector(':scope > p')),
+        nestedQuotePEditable: editable(blockItem?.querySelector(':scope > blockquote > p')),
+        // drag handles are direct children of top-level blocks only, never nested deeper
+        noChromeBelowTopLevel: [...document.querySelectorAll('#content [data-role=chrome]')]
+            .every(c => c.parentElement.parentElement === document.getElementById('content')),
+        chromeOnTopLevel: !!document.querySelector('#content > ul > [data-role=chrome]'),
+        cellIsContainer: cell && !editable(cell),
+        cellPEditable: editable(cell?.querySelector(':scope > p')),
+        cellNestedLiEditable: editable(cell?.querySelector(':scope > ul > li')),
+        plainCellEditable: editable(plainCell),
+    };
+});
+
+// ---- 2. load normalization ---------------------------------------------------------
+results.loadNormalize = await page.evaluate(() => {
+    const bq = document.querySelector('#content > blockquote');
+    const content = document.getElementById('content');
+    return {
+        // bare quote text got a paragraph host
+        quoteWrapped: !!bq.querySelector(':scope > p')
+            && bq.querySelector(':scope > p').textContent.includes('Bare quote text'),
+        quoteNoBareText: ![...bq.childNodes].some(n => n.nodeType === 3 && n.textContent.trim()),
+        quoteNotEditable: bq.getAttribute('contenteditable') !== 'true',
+        // the HTML parser fostered "after" out of <p>Before<ul>; load init wrapped it
+        noStrayRegionText: ![...content.childNodes].some(n => n.nodeType === 3 && n.textContent.trim()),
+        afterWrapped: [...content.querySelectorAll(':scope > p')]
+            .some(p => [...p.childNodes].some(n => n.nodeType === 3 && n.textContent.trim() === 'after')),
+    };
+});
+
+// ---- 3. canonical source round-trips the mixed li, unwraps run wrappers ------------
+await page.click('#view-source');
+const source = await page.evaluate(() => document.getElementById('output-content').textContent);
+results.source = {
+    mixedLiIntact: /<li>Mixed item<ul>/.test(source.replace(/\s+</g, '<')),
+    noRunMarker: !source.includes('rdfa-editor-run'),
+    quoteHasParagraph: /<blockquote><p>Bare quote text/.test(source.replace(/>\s+</g, '><')),
+    clean: !/data-role|contenteditable|draggable|aria-|⠿/.test(source),
+};
+await page.keyboard.press('Escape');
+
+// ---- 4. editing inside the blockquote container ------------------------------------
+await caretInText('#content > blockquote > p', 4);
+await page.keyboard.press('Enter');
+results.quoteEnter = await page.evaluate(() => {
+    const bq = document.querySelector('#content > blockquote');
+    return {
+        splitIntoTwo: bq.querySelectorAll(':scope > p').length === 2,
+        noChromeInside: !bq.querySelector('p [data-role=chrome], :scope > p > [data-role=chrome]'),
+        caretInSecond: bq.querySelectorAll(':scope > p')[1].contains(window.getSelection().anchorNode),
+    };
+});
+// Backspace at the start of the second paragraph merges back
+await page.keyboard.press('Backspace');
+results.quoteBackspace = await page.evaluate(() => {
+    const bq = document.querySelector('#content > blockquote');
+    return {
+        mergedBack: bq.querySelectorAll(':scope > p').length === 1,
+        textIntact: bq.textContent.includes('Bare quote text to normalize.'),
+    };
+});
+
+// ---- 5. block paste into a list item nests (no flattening) -------------------------
+await caretInText('#content > ul > li', 2);
+await paste('#content > ul > li', '<p>Pasted para</p><ul><li>pasted item</li></ul>');
+results.pasteIntoLi = await page.evaluate(() => {
+    const li = [...document.querySelectorAll('#content > ul > li')]
+        .find(l => l.textContent.includes('Pasted para'));
+    return {
+        nested: !!li && !!li.querySelector(':scope > ul > li') && !!li.querySelector(':scope > p'),
+        liIsContainer: li?.getAttribute('contenteditable') !== 'true',
+        headRunKept: li?.textContent.includes('Pl') && li?.textContent.includes('ain item'),
+        pastedItemEditable: li?.querySelector(':scope > ul > li')?.getAttribute('contenteditable') === 'true',
+    };
+});
+// one undo reverts the whole paste
+await page.keyboard.press(undoKey);
+results.pasteIntoLi.undone = await page.evaluate(() =>
+    ![...document.querySelectorAll('#content li')].some(l => l.textContent.includes('Pasted para')));
+
+// ---- 6. nesting lint surfaces live violations --------------------------------------
+results.lintBadgeHiddenWhenValid = await page.evaluate(() =>
+    document.getElementById('lint-badge').style.display === 'none');
+await page.evaluate(() => {
+    // inject stray text into a structural container behind the editor's back
+    document.querySelector('#content > ul').appendChild(document.createTextNode('stray in list'));
+});
+await caretInText('#content > p:first-of-type');
+await page.keyboard.type('x'); // any mutation runs lint via after-mutation
+await page.waitForTimeout(100);
+results.lint = await page.evaluate(() => ({
+    badgeVisible: document.getElementById('lint-badge').style.display !== 'none',
+    badgeCounts: /issue/.test(document.getElementById('lint-badge').textContent),
+}));
+await page.evaluate(() => {
+    const ul = document.querySelector('#content > ul');
+    [...ul.childNodes].filter(n => n.nodeType === 3 && n.textContent.includes('stray')).forEach(n => n.remove());
+});
+await page.keyboard.press(undoKey); // revert the 'x'
+
+// ---- 7. undo across a nested-host edit ---------------------------------------------
+await caretInText('#content > blockquote > p', 4);
+await page.keyboard.type('XYZ');
+await page.waitForTimeout(1100);
+await page.keyboard.press(undoKey);
+results.nestedUndo = await page.evaluate(() => {
+    const bq = document.querySelector('#content > blockquote');
+    return {
+        reverted: !bq.textContent.includes('XYZ'),
+        stillContainer: bq.getAttribute('contenteditable') !== 'true'
+            && bq.querySelector(':scope > p')?.getAttribute('contenteditable') === 'true',
+    };
+});
+
+console.log(JSON.stringify({ results, errors: errors.slice(0, 5) }, null, 2));
+await browser.close();
+const flat = JSON.stringify(results);
+process.exit(errors.length || flat.includes('false') ? 1 : 0);
diff --git a/tests/browser/run.mjs b/tests/browser/run.mjs
index 5c997d8..c02c694 100644
--- a/tests/browser/run.mjs
+++ b/tests/browser/run.mjs
@@ -25,7 +25,7 @@ const base = `http://localhost:${server.address().port}`;
 console.log(`serving ${root} at ${base}`);
 
 let failed = 0;
-for (const suite of ['editor', 'features', 'fixes', 'hardening', 'multiinstance', 'tables', 'datatype', 'inspector']) {
+for (const suite of ['editor', 'features', 'fixes', 'hardening', 'multiinstance', 'tables', 'datatype', 'inspector', 'nesting', 'authoring', 'invariants']) {
     console.log(`\n=== ${suite} ===`);
     const code = await new Promise(resolve => {
         const child = spawn(process.execPath, [fileURLToPath(new URL(`${suite}.mjs`, import.meta.url))],
diff --git a/tests/canonical-driver.xsl b/tests/canonical-driver.xsl
new file mode 100644
index 0000000..d300ec2
--- /dev/null
+++ b/tests/canonical-driver.xsl
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    version="3.0">
+
+<!--
+    CLI entry for the canonical-XHTML suite: canonical-xhtml.xsl consults the
+    content model (cm:*), so it is no longer standalone-compilable - this driver
+    imports both modules together (mirrors lint-driver.xsl).
+-->
+
+    <xsl:import href="../src/content-model.xsl"/>
+    <xsl:import href="../src/canonical-xhtml.xsl"/>
+
+    <xsl:output method="xml" indent="no"/>
+
+</xsl:stylesheet>
diff --git a/tests/expected/canonical/01-chrome-strip.xhtml b/tests/expected/canonical/01-chrome-strip.xhtml
index c0daeec..db4ffb3 100644
--- a/tests/expected/canonical/01-chrome-strip.xhtml
+++ b/tests/expected/canonical/01-chrome-strip.xhtml
@@ -6,7 +6,7 @@
         <li>Item one</li>
         <li>Item two</li>
     </ul>
-    <blockquote>A quote.</blockquote>
+    <blockquote><p>A quote.</p></blockquote>
     <figure>
         <img src="pic.png" alt="Pic"/>
         <figcaption>Caption</figcaption>
diff --git a/tests/expected/canonical/09-block-set-passthrough.xhtml b/tests/expected/canonical/09-block-set-passthrough.xhtml
index 8b7a244..fec1733 100644
--- a/tests/expected/canonical/09-block-set-passthrough.xhtml
+++ b/tests/expected/canonical/09-block-set-passthrough.xhtml
@@ -8,7 +8,7 @@
         <li>Ordered one</li>
         <li>Ordered <strong>two</strong></li>
     </ol>
-    <blockquote>Quote.</blockquote>
+    <blockquote><p>Quote.</p></blockquote>
     <pre>code here</pre>
     <figure>
         <img src="Mockup.png" alt="Mockup"/>
diff --git a/tests/expected/canonical/13-blockquote-block-only.xhtml b/tests/expected/canonical/13-blockquote-block-only.xhtml
new file mode 100644
index 0000000..80cc799
--- /dev/null
+++ b/tests/expected/canonical/13-blockquote-block-only.xhtml
@@ -0,0 +1,12 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <blockquote><p>Bare text quote with <em>emphasis</em>.</p></blockquote>
+    <blockquote><p>Leading stray</p><p>A real paragraph.</p><p>trailing <strong>bold</strong> run</p></blockquote>
+    <blockquote property="http://purl.org/dc/terms/description"><p>Annotated quote.</p></blockquote>
+    <blockquote>
+        <p>Valid one.</p>
+        <ul>
+            <li>Valid list</li>
+        </ul>
+    </blockquote>
+    <blockquote></blockquote>
+</div>
diff --git a/tests/expected/canonical/14-nested-lists-roundtrip.xhtml b/tests/expected/canonical/14-nested-lists-roundtrip.xhtml
new file mode 100644
index 0000000..2d100e7
--- /dev/null
+++ b/tests/expected/canonical/14-nested-lists-roundtrip.xhtml
@@ -0,0 +1,21 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about=""
+     typeof="https://www.w3.org/ns/ldt/document-hierarchy#Container">
+    <ul>
+        <li>Item one</li>
+        <li>Item two<ul>
+            <li>Sub one</li>
+            <li>Sub two<ol>
+                <li>Deep ordered</li>
+            </ol></li>
+        </ul></li>
+        <li><p>Block item</p><blockquote><p>Quote in item</p></blockquote></li>
+    </ul>
+    <ol>
+        <li>Mixed <strong>inline</strong> then<ul><li>nested</li></ul>tail text</li>
+    </ol>
+    <dl>
+        <dt>Term</dt>
+        <dd>Definition with<ul><li>a list</li></ul></dd>
+        <dd><p>Block definition</p></dd>
+    </dl>
+</div>
diff --git a/tests/expected/canonical/15-cell-flow-roundtrip.xhtml b/tests/expected/canonical/15-cell-flow-roundtrip.xhtml
new file mode 100644
index 0000000..51ab4e8
--- /dev/null
+++ b/tests/expected/canonical/15-cell-flow-roundtrip.xhtml
@@ -0,0 +1,17 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <table>
+        <thead>
+            <tr>
+                <th><p>Head para</p></th>
+                <th>Plain head</th>
+            </tr>
+        </thead>
+        <tbody>
+            <tr>
+                <td><p>Para</p><ul><li>item</li></ul><blockquote><p>quoted</p></blockquote></td>
+                <td>Mixed text<ul><li>then list</li></ul></td>
+                <td><table><tr><td>inner</td></tr></table></td>
+            </tr>
+        </tbody>
+    </table>
+</div>
diff --git a/tests/expected/canonical/16-inline-only-hoist.xhtml b/tests/expected/canonical/16-inline-only-hoist.xhtml
new file mode 100644
index 0000000..654029b
--- /dev/null
+++ b/tests/expected/canonical/16-inline-only-hoist.xhtml
@@ -0,0 +1,11 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <p>Before</p>
+    <ul><li>hoisted list</li></ul>
+    <p>after</p>
+    <h2>Head</h2>
+    <p>inner para</p>
+    <p lang="de">eins</p>
+    <ul><li>zwischen</li></ul>
+    <p lang="de">zwei</p>
+    <p property="http://purl.org/dc/terms/description">Literal with<span about="#part" typeof="http://schema.org/Thing">a part</span>inside</p>
+</div>
diff --git a/tests/expected/canonical/17-list-dl-child-normalization.xhtml b/tests/expected/canonical/17-list-dl-child-normalization.xhtml
new file mode 100644
index 0000000..d109c25
--- /dev/null
+++ b/tests/expected/canonical/17-list-dl-child-normalization.xhtml
@@ -0,0 +1,5 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <ul><li>Real item</li><li><p>Stray paragraph</p>stray tail</li></ul>
+    <ol><li>Loose lead</li><li>ok</li></ol>
+    <dl><dt>Term</dt><dd><p>Stray def</p>and text</dd></dl>
+</div>
diff --git a/tests/expected/canonical/18-run-wrapper-unwrap.xhtml b/tests/expected/canonical/18-run-wrapper-unwrap.xhtml
new file mode 100644
index 0000000..647d45f
--- /dev/null
+++ b/tests/expected/canonical/18-run-wrapper-unwrap.xhtml
@@ -0,0 +1,6 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <ul>
+        <li>Item text<ul><li>Sub</li></ul></li>
+        <li><p property="http://purl.org/dc/terms/title">Annotated run</p><ul><li>Sub two</li></ul></li>
+    </ul>
+</div>
diff --git a/tests/expected/canonical/19-region-stray-inline.xhtml b/tests/expected/canonical/19-region-stray-inline.xhtml
new file mode 100644
index 0000000..c4fab60
--- /dev/null
+++ b/tests/expected/canonical/19-region-stray-inline.xhtml
@@ -0,0 +1 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about=""><p>Loose lead text with <strong>bold</strong>.</p><p>Real para.</p><h2>In section</h2><p>Sectioned.</p><article about="#post" typeof="http://schema.org/Article"><p property="http://schema.org/name">Kept article</p></article><p>trailing text</p></div>
diff --git a/tests/expected/canonical/20-prohibitions.xhtml b/tests/expected/canonical/20-prohibitions.xhtml
new file mode 100644
index 0000000..56369bd
--- /dev/null
+++ b/tests/expected/canonical/20-prohibitions.xhtml
@@ -0,0 +1,6 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <p>Link <a href="http://outer.example/">outer <em><span href="http://inner.example/" property="http://schema.org/url">inner</span></em> tail</a>.</p>
+    <pre>keep <a href="http://ok.example/">links</a> and text[pic alt] but subscript unwraps and size too</pre>
+    <p>Fostered para</p>
+    <table><tr><td>cell</td></tr></table>
+</div>
diff --git a/tests/expected/canonical/21-inline-split-fidelity.xhtml b/tests/expected/canonical/21-inline-split-fidelity.xhtml
new file mode 100644
index 0000000..a8cdc76
--- /dev/null
+++ b/tests/expected/canonical/21-inline-split-fidelity.xhtml
@@ -0,0 +1,9 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <p property="http://example.org/x">text<span><span>a</span><span>b</span></span></p>
+    <p><a href="http://x.example/">click</a></p>
+    <p>body</p>
+    <p><a href="http://x.example/">more</a></p>
+    <p><a href="http://y.example/">x</a></p>
+    <p>y</p>
+    <p><a href="http://y.example/">z</a></p>
+</div>
diff --git a/tests/expected/canonical/22-stray-noninline-passthrough.xhtml b/tests/expected/canonical/22-stray-noninline-passthrough.xhtml
new file mode 100644
index 0000000..1319214
--- /dev/null
+++ b/tests/expected/canonical/22-stray-noninline-passthrough.xhtml
@@ -0,0 +1,4 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <li>stray region item</li>
+    <blockquote><li>stray quote item</li><p>with text</p></blockquote>
+</div>
diff --git a/tests/expected/lint/11-invalid-nesting.txt b/tests/expected/lint/11-invalid-nesting.txt
new file mode 100644
index 0000000..8d76244
--- /dev/null
+++ b/tests/expected/lint/11-invalid-nesting.txt
@@ -0,0 +1,6 @@
+stray-text b1.1 'blockquote' allows no text content - stray text will be wrapped by canonicalization
+invalid-nesting b1.2.1 'ul' is not allowed inside 'p'
+invalid-nesting b1.3.1 'p' is not allowed inside 'ul'
+prohibited-nesting b1.4.1.1.1 'a' must not appear inside 'a' (XHTML 1.0 Appendix B)
+prohibited-nesting b1.5.1.1 'img' must not appear inside 'pre' (XHTML 1.0 Appendix B)
+unknown-element b1.6 element 'video' is outside the XHTML content model - preserved, but its nesting is unvalidated
diff --git a/tests/expected/lint/12-valid-nesting-clean.txt b/tests/expected/lint/12-valid-nesting-clean.txt
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixture-nesting.html b/tests/fixture-nesting.html
new file mode 100644
index 0000000..140dc67
--- /dev/null
+++ b/tests/fixture-nesting.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html
+  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+    <head>
+        <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+        <title>RDFa Editor - nesting fixture</title>
+        <script type="text/javascript" src="../lib/SaxonJS3.js"></script>
+        <script type="text/javascript">
+            window.onload = function() {
+                const vocabs = ["vocabs/foaf.rdf", "vocabs/dcterms.rdf"];
+                Promise.all(vocabs.map(href =>
+                        SaxonJS.getResource({ location: "../" + href, type: "xml" })))
+                    .then(resources => {
+                        const pool = {};
+                        vocabs.forEach((href, i) =>
+                            pool[new URL(href, document.baseURI).href] = resources[i]);
+                        return SaxonJS.transform({
+                            documentPool: pool,
+                            stylesheetLocation: "../dist/index.xsl.sef.json",
+                            initialTemplate: "main",
+                            logLevel: 10
+                        }, "async");
+                    })
+                    .catch(err => console.log("Transformation failed: " + err));
+            }
+        </script>
+        <link rel="stylesheet" href="../rdfa-editor.css" type="text/css"/>
+        <style type="text/css">
+            body { padding-top: 70px; padding-bottom: 56px; }
+            .rdfa-editor-content { padding-left: 2.5em; }
+        </style>
+    </head>
+    <body>
+        <nav>
+            <button id="parse-rdf">Extract RDF</button>
+        </nav>
+
+        <div id="content" class="rdfa-editor-content" about="" typeof="https://www.w3.org/ns/ldt/document-hierarchy#Container">
+            <h1 property="http://purl.org/dc/terms/title">Nesting demo</h1>
+            <p>Intro paragraph.</p>
+            <ul>
+                <li>Plain item</li>
+                <li>Mixed item<ul>
+                    <li>Sub one</li>
+                    <li>Sub two</li>
+                </ul></li>
+                <li><p>Block item</p><blockquote><p>Quote in item</p></blockquote></li>
+            </ul>
+            <blockquote>Bare quote text to normalize.</blockquote>
+            <p>Before<ul><li>parser-fostered list</li></ul>after</p>
+            <table>
+                <tbody>
+                    <tr>
+                        <td><p>Cell para</p><ul><li>cell item</li></ul></td>
+                        <td>Plain cell</td>
+                    </tr>
+                </tbody>
+            </table>
+            <figure>
+                <img src="data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==" alt="A placeholder image"/>
+                <figcaption>A caption for gestures</figcaption>
+            </figure>
+        </div>
+
+        <!-- an embedded region wrapped in host-page structures: editor gesture
+             ancestor walks (Tab item/cell lookup, quote toggle) must clamp at the
+             region root and never mutate the host li/table/blockquote -->
+        <blockquote>
+            <table id="host-table">
+                <tbody>
+                    <tr>
+                        <td>
+                            <ul id="host-list">
+                                <li>host item before</li>
+                                <li>
+                                    <div id="embedded" class="rdfa-editor-content" about="#embedded">
+                                        <p>Embedded paragraph.</p>
+                                        <blockquote><p>Embedded quote.</p></blockquote>
+                                    </div>
+                                </li>
+                            </ul>
+                        </td>
+                    </tr>
+                </tbody>
+            </table>
+        </blockquote>
+    </body>
+</html>
diff --git a/tests/fixtures/canonical/13-blockquote-block-only.xhtml b/tests/fixtures/canonical/13-blockquote-block-only.xhtml
new file mode 100644
index 0000000..54ee887
--- /dev/null
+++ b/tests/fixtures/canonical/13-blockquote-block-only.xhtml
@@ -0,0 +1,12 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <blockquote contenteditable="true">Bare text quote with <em>emphasis</em>.</blockquote>
+    <blockquote>Leading stray<p>A real paragraph.</p>trailing <strong>bold</strong> run</blockquote>
+    <blockquote property="http://purl.org/dc/terms/description">Annotated quote.</blockquote>
+    <blockquote>
+        <p>Valid one.</p>
+        <ul>
+            <li>Valid list</li>
+        </ul>
+    </blockquote>
+    <blockquote></blockquote>
+</div>
diff --git a/tests/fixtures/canonical/14-nested-lists-roundtrip.xhtml b/tests/fixtures/canonical/14-nested-lists-roundtrip.xhtml
new file mode 100644
index 0000000..2d100e7
--- /dev/null
+++ b/tests/fixtures/canonical/14-nested-lists-roundtrip.xhtml
@@ -0,0 +1,21 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about=""
+     typeof="https://www.w3.org/ns/ldt/document-hierarchy#Container">
+    <ul>
+        <li>Item one</li>
+        <li>Item two<ul>
+            <li>Sub one</li>
+            <li>Sub two<ol>
+                <li>Deep ordered</li>
+            </ol></li>
+        </ul></li>
+        <li><p>Block item</p><blockquote><p>Quote in item</p></blockquote></li>
+    </ul>
+    <ol>
+        <li>Mixed <strong>inline</strong> then<ul><li>nested</li></ul>tail text</li>
+    </ol>
+    <dl>
+        <dt>Term</dt>
+        <dd>Definition with<ul><li>a list</li></ul></dd>
+        <dd><p>Block definition</p></dd>
+    </dl>
+</div>
diff --git a/tests/fixtures/canonical/15-cell-flow-roundtrip.xhtml b/tests/fixtures/canonical/15-cell-flow-roundtrip.xhtml
new file mode 100644
index 0000000..51ab4e8
--- /dev/null
+++ b/tests/fixtures/canonical/15-cell-flow-roundtrip.xhtml
@@ -0,0 +1,17 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <table>
+        <thead>
+            <tr>
+                <th><p>Head para</p></th>
+                <th>Plain head</th>
+            </tr>
+        </thead>
+        <tbody>
+            <tr>
+                <td><p>Para</p><ul><li>item</li></ul><blockquote><p>quoted</p></blockquote></td>
+                <td>Mixed text<ul><li>then list</li></ul></td>
+                <td><table><tr><td>inner</td></tr></table></td>
+            </tr>
+        </tbody>
+    </table>
+</div>
diff --git a/tests/fixtures/canonical/16-inline-only-hoist.xhtml b/tests/fixtures/canonical/16-inline-only-hoist.xhtml
new file mode 100644
index 0000000..9b8dfa6
--- /dev/null
+++ b/tests/fixtures/canonical/16-inline-only-hoist.xhtml
@@ -0,0 +1,6 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <p>Before<ul><li>hoisted list</li></ul>after</p>
+    <h2>Head<p>inner para</p></h2>
+    <p lang="de">eins<ul><li>zwischen</li></ul>zwei</p>
+    <p property="http://purl.org/dc/terms/description">Literal with<div about="#part" typeof="http://schema.org/Thing">a part</div>inside</p>
+</div>
diff --git a/tests/fixtures/canonical/17-list-dl-child-normalization.xhtml b/tests/fixtures/canonical/17-list-dl-child-normalization.xhtml
new file mode 100644
index 0000000..921bc03
--- /dev/null
+++ b/tests/fixtures/canonical/17-list-dl-child-normalization.xhtml
@@ -0,0 +1,5 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <ul><li>Real item</li><p>Stray paragraph</p>stray tail</ul>
+    <ol>Loose lead<li>ok</li></ol>
+    <dl><dt>Term</dt><p>Stray def</p>and text</dl>
+</div>
diff --git a/tests/fixtures/canonical/18-run-wrapper-unwrap.xhtml b/tests/fixtures/canonical/18-run-wrapper-unwrap.xhtml
new file mode 100644
index 0000000..a4593e2
--- /dev/null
+++ b/tests/fixtures/canonical/18-run-wrapper-unwrap.xhtml
@@ -0,0 +1,6 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <ul>
+        <li><p class="rdfa-editor-run" contenteditable="true">Item text</p><ul><li contenteditable="true">Sub</li></ul></li>
+        <li><p class="rdfa-editor-run" property="http://purl.org/dc/terms/title">Annotated run</p><ul><li>Sub two</li></ul></li>
+    </ul>
+</div>
diff --git a/tests/fixtures/canonical/19-region-stray-inline.xhtml b/tests/fixtures/canonical/19-region-stray-inline.xhtml
new file mode 100644
index 0000000..24f1bf7
--- /dev/null
+++ b/tests/fixtures/canonical/19-region-stray-inline.xhtml
@@ -0,0 +1 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">Loose lead text with <strong>bold</strong>.<p>Real para.</p><section><h2>In section</h2><p>Sectioned.</p></section><article about="#post" typeof="http://schema.org/Article"><p property="http://schema.org/name">Kept article</p></article>trailing text</div>
diff --git a/tests/fixtures/canonical/20-prohibitions.xhtml b/tests/fixtures/canonical/20-prohibitions.xhtml
new file mode 100644
index 0000000..8fcb8ea
--- /dev/null
+++ b/tests/fixtures/canonical/20-prohibitions.xhtml
@@ -0,0 +1,5 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <p>Link <a href="http://outer.example/">outer <em><a href="http://inner.example/" property="http://schema.org/url">inner</a></em> tail</a>.</p>
+    <pre>keep <a href="http://ok.example/">links</a> and text<img src="pic.png" alt="[pic alt]"/> but <sub>subscript</sub> unwraps and <big>size</big> too</pre>
+    <table><p>Fostered para</p><tr><td>cell</td></tr></table>
+</div>
diff --git a/tests/fixtures/canonical/21-inline-split-fidelity.xhtml b/tests/fixtures/canonical/21-inline-split-fidelity.xhtml
new file mode 100644
index 0000000..72d8c5c
--- /dev/null
+++ b/tests/fixtures/canonical/21-inline-split-fidelity.xhtml
@@ -0,0 +1,5 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <p property="http://example.org/x">text<ul><li>a</li><li>b</li></ul></p>
+    <p><a href="http://x.example/">click<p>body</p>more</a></p>
+    <p><a href="http://y.example/">x<p>y</p>z</a></p>
+</div>
diff --git a/tests/fixtures/canonical/22-stray-noninline-passthrough.xhtml b/tests/fixtures/canonical/22-stray-noninline-passthrough.xhtml
new file mode 100644
index 0000000..2704724
--- /dev/null
+++ b/tests/fixtures/canonical/22-stray-noninline-passthrough.xhtml
@@ -0,0 +1,4 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <li>stray region item</li>
+    <blockquote><li>stray quote item</li>with text</blockquote>
+</div>
diff --git a/tests/fixtures/lint/11-invalid-nesting.xhtml b/tests/fixtures/lint/11-invalid-nesting.xhtml
new file mode 100644
index 0000000..144483f
--- /dev/null
+++ b/tests/fixtures/lint/11-invalid-nesting.xhtml
@@ -0,0 +1,8 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <blockquote>Bare text in a quote</blockquote>
+    <p>Text<ul><li>list in p</li></ul></p>
+    <ul><p>para in list</p></ul>
+    <p><a href="http://outer.example/">out <em><a href="http://inner.example/">in</a></em></a></p>
+    <pre>text <a href="http://ok.example/"><img src="x.png" alt="x"/></a></pre>
+    <video controls="controls">clip</video>
+</div>
diff --git a/tests/fixtures/lint/12-valid-nesting-clean.xhtml b/tests/fixtures/lint/12-valid-nesting-clean.xhtml
new file mode 100644
index 0000000..a104a98
--- /dev/null
+++ b/tests/fixtures/lint/12-valid-nesting-clean.xhtml
@@ -0,0 +1,13 @@
+<div xmlns="http://www.w3.org/1999/xhtml" about="">
+    <ul>
+        <li>Mixed<ul><li>deep</li></ul></li>
+        <li><p>block</p><blockquote><p>quote</p></blockquote></li>
+    </ul>
+    <table><tr><td><blockquote><p>quoted cell</p></blockquote><ul><li>cell list</li></ul></td></tr></table>
+    <figure>
+        <img src="pic.png" alt="Pic"/>
+        <figcaption>Caption with <em>flow</em><p>and a block</p></figcaption>
+    </figure>
+    <dl><dt>Term</dt><dd><ul><li>def list</li></ul></dd></dl>
+    <pre>plain <a href="http://ok.example/">link</a> text</pre>
+</div>
diff --git a/tests/lint-driver.xsl b/tests/lint-driver.xsl
index 96d1d74..97d42c0 100644
--- a/tests/lint-driver.xsl
+++ b/tests/lint-driver.xsl
@@ -11,13 +11,15 @@
 -->
 
     <xsl:import href="../src/RDFa2RDFXML-v3.xsl"/>
+    <xsl:import href="../src/content-model.xsl"/>
     <xsl:import href="../src/lint-rdfa.xsl"/>
+    <xsl:import href="../src/lint-xhtml.xsl"/>
 
     <xsl:output method="text" encoding="UTF-8"/>
 
     <xsl:template name="lint-report">
         <xsl:param name="content" as="element()" select="/*"/>
-        <xsl:for-each select="lint:lintable($content) ! lint:element-issues(.)">
+        <xsl:for-each select="lint:lintable($content) ! (lint:element-issues(.), lint:nesting-issues(.))">
             <xsl:value-of select="@code || ' ' || @path || ' ' || normalize-space(.) || '&#10;'"/>
         </xsl:for-each>
     </xsl:template>
diff --git a/tests/normalize-xhtml.xsl b/tests/normalize-xhtml.xsl
index 863b328..90b107d 100644
--- a/tests/normalize-xhtml.xsl
+++ b/tests/normalize-xhtml.xsl
@@ -18,6 +18,7 @@
     <xsl:template match="text()[not(normalize-space())][not(ancestor::pre)]
         [parent::html | parent::head | parent::body | parent::div | parent::section
          | parent::article | parent::ul | parent::ol | parent::figure
-         | parent::table | parent::thead | parent::tbody | parent::tfoot | parent::tr]"/>
+         | parent::table | parent::thead | parent::tbody | parent::tfoot | parent::tr
+         | parent::blockquote | parent::dl | parent::colgroup]"/>
 
 </xsl:stylesheet>
diff --git a/tests/run-tests.sh b/tests/run-tests.sh
index d4893da..f6ee632 100755
--- a/tests/run-tests.sh
+++ b/tests/run-tests.sh
@@ -48,7 +48,7 @@ done
 
 for fixture in tests/fixtures/canonical/*.xhtml; do
     name=$(basename "$fixture" .xhtml)
-    if ! npx xslt3-he -xsl:src/canonical-xhtml.xsl -s:"$fixture" -it:canonical-xhtml -o:"$tmp/c-$name.xhtml" 2>"$tmp/c-$name.err"; then
+    if ! npx xslt3-he -xsl:tests/canonical-driver.xsl -s:"$fixture" -it:canonical-xhtml -o:"$tmp/c-$name.xhtml" 2>"$tmp/c-$name.err"; then
         echo "FAIL canonical/$name (transform error)"
         cat "$tmp/c-$name.err"
         fail=1