fix: only make CSS and HTML transformations an engine cannot tell apart - #21774

`initial-value` is read against the `syntax` beside it, which webpack does not
interpret — so `0px` there is not the `0` a length accepts, and the registered
property came back with a different initial value. Opaque now, the way a custom
property's own value already is.

The wpt tier compared an SVG `<style>` as page text and never as CSS, so
minifying one read as a change and the stylesheets inside SVG went unchecked.
Both defects that filed are gone; the third is traced and re-filed with it.

`font-style: oblique calc(100deg)` is clamped to the ±90deg bound CSS Fonts 4
§2.3 states, while the same angle written bare is rejected — and Chrome takes
`oblique 100grad` off while reading `oblique 2rad` at face value, so a unit the
range is not stated in loses the clamp too. Fold a math function to a bare term
only where the property carries no clamp, or the term is inside it in the unit
the clamp is stated in.

`attr( name unit )` is dropped where `attr(name unit)` parses, so keep the space
before the `)` rather than trimming it like any other.

The two config-tier defects the equivalence suite had filed were the harness's,
not the printer's: an escape is resolved before a name is matched, so `\2d-two`
and `\2d\2d two` are one identifier, and a value the engine echoes rather than
computes is compared under the one name the spec gives it — which is what the
four filed `steps(N, jump-start)` and implied-last-stop values needed as well.

Declarations that follow a nested rule are their own `CSSNestedDeclarations`
rule, which Chrome reports under the selector `&`. The equivalence harness took
that at face value, so once an empty rule ahead of them was dropped and they
became the parent's own, the same declarations read as a different rule under a
shorter at-rule chain — the `css-cascade/scope-nesting.html` divergence.

`&` alone is the rule it sits in, so a block labelled that way is now read under
the enclosing style rule's own selector and chain. A reorder across a rule that
prints something still diverges, which is what the two `minimize-nesting` cases
hold: `.v` folds, `.w` keeps the block a rule of its own.

Found by running the equivalence suite's DOM/CSSOM comparison over the whole
49,400-document wpt HTML corpus rather than the subset the committed tier reads.

A featureless element matches no type or universal selector (CSS Scoping 1
§3.1), so the `*` a compound implies before `:host`, `:host()` or
`:host-context()` is what keeps the rule from matching — dropping it brought
`css/selectors/featureless-002` and `-003` to life.

§13.2.3.5 rewrites a literal CR to LF before the tokenizer reads it, so a CR a
character reference put in a text node has to stay one. The printer wrote it
out raw, which re-parsed as a newline — `css/css-text/white-space`'s CR cases
lost the character they test.

**An empty rule a `@namespace` after it is made inert by** stays. Only a rule
the engine keeps ends the run a `@namespace` may stand in (CSS Namespaces 3
§3.1) — an unknown at-rule is thrown away and does not — so the guard closes on
a qualified rule alone, which every engine keeps, and arms only for a source
naming a `@namespace` at all. Dropping that rule carried the dead `@namespace`
back to the head, where `attr(y|href)` started resolving.

**A truncated escape** names U+FFFD (§4.3.7), and nothing at all inside a string
(§4.3.5) — not the `\` the source shows, which escaped the `}` the printer
closes the rule with, so `--foo: foo\` read back as `foo}`.

**`flex-wrap: balance`** is in the grammar `mdn-data` states and in no engine, so
merging it into `flex-flow` dropped the shorthand whole and took
`flex-direction: column` with it. Measured over all 119 family slot keywords in
headless Chromium: it is the only one the printer merges that Chrome rejects.

**A mirrored `<selectedcontent>`** is content the engine makes, with no source
behind it, so it is no longer mirrored while printing — serializing it wrote the
selected option's subtree into the document, which the engine reading the output
then mirrored a second time.

… out

§13.2.6.4 makes a `<template>` carrying `shadowrootmode` its parent's shadow
root and removes it from the tree, so an end tag after it reconstructs a
formatting element around one child fewer. webpack models neither, because the
tree it builds is also what it serializes — a template removed from the tree is
a template missing from the output, so implementing this means separating the
two, not adding a step.

Filed against a fixture of its own rather than tracked only in a sweep: the
browser tier reads `html/syntax`, `css/css-cascade` and `css/css-color`, and the
one wpt document that shows this sits under `css/css-contain`, which is 810
documents to carry for one entry. The filing expires itself the run after the
divergence goes.

Inside a custom property the value is written back as it stands, so a `url(`
the input ended in kept no `)` — and the `}` the printer closes the rule with
was read as part of the url, leaving `url(foo�}` where the engine has
`url(foo�)`. Closed only where the escape ran out, which is the one shape
Chrome writes back from the token's value rather than from its text: `url(foo`
and `foo(bar` it echoes unclosed, and so does the printer.

An enumerated attribute's value is an ASCII case-insensitive match for one of
its keywords and nothing else — no whitespace is stripped — so `type="time "`
names no keyword and leaves the input in its default `text` state. Trimming
before the lookup made it a `time` input, which is a different control.

Found by `html/semantics/forms/the-input-element/time.html`, whose fixture is
`<input type="time "id="chkDefaultValue">`; case folding is unchanged, and the
integer, URL and token-list attributes that do strip whitespace take their own
branches.

The attribute is minified inside a throwaway rule, which is what gives its
declaration list the duplicate-drop and shorthand merges a block gets — but a
`}` in the attribute closed that rule, and everything after it fell outside and
was lost: `style="background:red;};background:limegreen"` painted red where the
engine paints green. A style attribute is a declaration list, where such a `}`
is part of a bad declaration and the declarations after it still apply.

The value is now scanned first, and one holding a `}` outside every string,
comment and bracket is left as written. A `}` inside a string or a balanced pair
is not one, so `content: '}'` and `--custom: {a:b}` minify now where the old
brace-free wrapper check declined them.

A `<td>` outside a row makes the parser imply a `<tr>`, and an implied element
is printed transparently — but the `</tr>` closing it is the source's, and
load-bearing: without it the whitespace after the row moves inside the row, and
two text nodes become one.

    <table>
      <tr><td>a</td></tr>
          <td>b</td>
      </tr>
    </table>

webpack's parse is right — it matches Chrome node for node — so only the
serializer loses it. The implied case now asks `_canOmitEndTag`, which already
refuses to drop an end tag a text or comment node follows. `html`, `head` and
`body` keep their own `_canOmitShellEnd` path: routing them through this one
materializes `</head></body></html>` on every document.

The sweep caught four documents the wrapper scan had regressed. A value ending
inside an unclosed string, comment or bracket swallows the `}` the throwaway
rule is closed with, so `background-image:url(foo` came back as
`url(foo})` and `box-shadow:var(--t,10px` as `var(--t,10px})`. The old
brace-free unwrap check had caught these by accident; the scan replacing it
looked only for a `}` that closes the wrapper early.

It now refuses both: a `}` outside every string, comment and bracket, and
anything the value leaves open at its end — which the attribute's own end
closes, and the wrapper's `}` does not.

Four comparisons read a difference where the two values say the same thing:

- An at-rule descriptor was compared verbatim, so `override-colors: 3 red` and
  the `3 rgb(255, 0, 0)` it was handed read as different rules. It now goes
  through the same normalization a declaration's value does, and `transparent`
  is folded to the `rgba(0, 0, 0, 0)` CSS Color 4 §5 defines it as.
- A number was compared exactly, so a value derived from one the printer
  rounded — a matrix entry, a resolved font size — read as a change at the
  seventh digit. Numbers now compare within a relative 1e-5, which is under
  Chromium's 1/64px layout grid at every length a stylesheet uses and is the
  bound the printer's own rounding rests on. Everything that is not a number
  still has to match exactly, and the numbers have to line up one for one.
- Two adjacent rules a printer joined were compared by adding their two
  separately computed lists together, so a `min()` or a percentage that
  resolves against the other's declarations came out differently on the two
  sides. The joined block is now resolved as the one block it is.
- A zero length held as written — a `var()`-carrying value — was compared
  against the `0` the printer writes for it.

Each described the rule before this branch changed it:

- consume-a-declaration step 8 quoted the spec line without the clause the
  code now implements ("and also contains any other non-whitespace token").
- `bailOnCurly` said it aborts on any top-level `{`; it aborts only on one
  something non-whitespace already stands before.
- `A.source()` said "raw source slice"; an escape the input ran out of comes
  back as the character it names.
- `_customPropertyToken` said every token is written as it stands; a url or a
  string the input ended inside is closed.
- `_unwrapCalc` enumerated three shapes the parentheses cannot come off; a
  clamped range is a fourth.
- `_escapeTextContent` and `mirrorSelectedContent` said nothing about the CR
  reference and the print-time skip.

Measured in headless Chromium: a gradient's computed `background-image` reports
the legacy sRGB forms as `rgb(…)` however they were spelled, and hands back a
modern color-space function as written —

    linear-gradient(90deg, red, rgb(1,2,3))  -> rgb(255, 0, 0), rgb(1, 2, 3)
    linear-gradient(90deg, red, lch(50 20 30)) -> rgb(255, 0, 0), lch(50 20 30)

so folding an `lch()` stop moves the value the CSSOM reports even where the
stops interpolate in sRGB. The guard is now keyed on the color's space rather
than on the gradient stating one, which also covers the ramp itself: with
`in lch` the fold changed the painted pixels, in gamut as well as out.

The harness gained the other half: a named color is the same color spelled a
second way, so a bare identifier in a descriptor is now asked of the canvas
like the hex and function forms already were.

**Whitespace after an attribute selector's `|`.** The bar and the attribute
name are one token sequence, so a space between them makes the selector
invalid — `[| a]` is dropped where `[ |a]` is not. Collapsing it turned
`[ | data-test-4] { color: red }` into a live rule and painted
`selectors-attr-white-space-001` red where the source paints it green.

**A `{}` block standing as a whole declaration value.** No grammar reads it,
so the engine holds it as written like a custom property's value, and
`color:{ [ var(--a)] }` came back respaced.

**`initial` where the property's initial value is a length keyword.**
`initial` is resolved before `zoom` scales a length, so `outline-width:initial`
computes to 1.5px at `zoom:2` where `outline-width:medium` computes to 3px.
The keywords are read off `<line-width>` and `<absolute-size>`, the two
productions CSS states them in, rather than listed against the 15 properties
that carry one.

…itten

A container style query compares a custom property's value as the token
stream it was written as, so squeezing a whitespace run inside one asks a
different question. `@function`'s `result` is that same token stream — the
one the call substitutes — so an empty one is a value, not a declaration to
drop.

The equivalence harness gains three things the corpus asked for: a rule's
own declarations are read off the rule rather than off a probe Chrome
cannot re-parse, a value's open blocks are closed at its end the way the
tokenizer closes them, and a stylesheet is modelled one selector at a time
so a printer moving a selector between two adjacent lists compares equal.

A formatting end tag the list of active formatting elements cannot answer
for is read as any other end tag rather than dropped (§13.2.6.4.7), so an
element Noah's Ark unlisted — or one on the far side of the marker a
`<select>` leaves behind — still closes.

A `<template shadowrootmode>` is its parent's shadow root, which the engine
takes out of the tree; webpack keeps it where it was written, so it is no
longer a child the adoption agency may carry into the formatting element it
reconstructs around the rest. It attaches only where `attachShadow()` would.

… place

…rator

`SHADOW_HOSTS`, `RESERVED_ELEMENT_NAMES` and `SHELL_ELEMENTS` are tables the
minifier looks a name up in, so they belong in `tooling/generate-html-data.js`
beside the rest of the parser vocabulary rather than next to the code reading
them. Each carries the reason no dataset states it: two are spec prose the DOM
and HTML name productions give, and the shell is the policy
`OPTIONAL_END_TAG_FOLLOWERS` already documents leaving out.

The heading names are named once and shared, so `HEADING` and `SHADOW_HOSTS`
cannot drift apart.

`mdn-data` writes this property's initial as CSS 2.1 prose
(`startOrNamelessValueIfLTRRightIfRTL`) rather than the keyword CSS Text 3
gives, so the name-shape test dropped it and the two bytes stayed. It is the
one property of the 21 whose initial `mdn-data` states as prose that both
names a fixed keyword and is shorter than `initial`: `text-size-adjust` and
`-ms-content-zooming` read differently per user agent, and `all` has no
initial at all.

The keyword is supplemented and then judged by the same grammar, name-shape
and length-keyword tests a derived one is, so the `zoom` rule that keeps
`outline-width` out still applies; the generator throws once `mdn-data`
states the keyword itself.

Measured in headless Chromium under both `dir=ltr` and `dir=rtl`: `initial`,
`start` and `unset` compute alike and paint the glyph at the same offset.

…space`

A container style query is written back from its source, comments included,
so the copies the writer had queued have to be claimed there — flushed after
the rule instead, the comment was emitted a second time.

An at-keyword carrying an escape can still name `@namespace`, and only
decoding tells the two apart, so the prologue scan now treats any escaped
at-keyword as one. Over-wide on purpose: a false positive keeps an empty
rule, which is the side that cannot change what the sheet means.

The equivalence harness maps a surrogate escape to U+FFFD as §4.3.7 says,
and normalizes a zero in every length unit CSS Values 4 states rather than
the nine it named — the printer folds `0vw` too.

Stop painting bare identifiers before comparing values: it made a named
color and its hex spelling normalize to the same pixel, so an unsafe fold
between the two compared equal.

Compare integer pairs exactly and apply the numeric tolerance only to an
element's own computed lengths, not to text, scripts or shadow content.

…iling escape

A block that streams entered its rule outside the walk that set the
`@property` / `@function` state, so `initial-value` and `result` were
printed with ordinary value transforms once the block grew past the
threshold. Carry the state per stream frame instead.

A `style` attribute ending in an escape takes the wrapper rule's own `}`
as an escaped brace, so it is declined rather than minified.

Cover both, plus the escape and closed-pair arcs of the wrapper test, the
non-minified text escapes and the two generator staleness guards.

§4.3.4 ignores a `\` at the end of a string, where an escape anywhere else
names U+FFFD — the oracle named one on the as-written side only, which
reads as a difference the printer never made.

§4.3.4 makes a `\` before a newline continue the line rather than name a
character, so the pair is read as nothing instead of as the newline.

A unit runs on through `-`, an escape and any non-ASCII name character, so
the trailing `\b` read `0rcap-foo` as `0rcap` and normalized it to the
`0-foo` a different declaration writes.

Keep the newline regexp above the JSDoc block it was splitting, which left
`readEscape` untyped.

An integration point runs HTML rules with a foreign current node, which is
the one way a `<template shadowrootmode>` reaches a host `attachShadow`
does not accept.

A `style` value ending inside a comment would swallow the wrapper's own
brace, so it is left as written.

A recursive arrow has none to infer, so `tsc` reads it as implicitly any.

Before `<body>` starts the insertion modes drop leading whitespace, so the
tag has to be written back for the text node to survive re-parsing.

`_gradientName` allocated a substring for every function token, and the
end-anchored regexp cannot reject early. Every gradient name ends in
`gradient`, so one code point rejects 92.8% of them first — the same shape
as the `_mayBeMathFunction` gate beside it.

A comment leaves the body altogether — the modes put it in the element
above — so it is its own case, not the head element's.