diff --git a/Cargo.toml b/Cargo.toml
index 6fd813c4..498ff402 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,7 +39,7 @@ exclude = ["sites", "packages/blitz-wasm/guest"]
 resolver = "2"
 
 [workspace.package]
-version = "0.4.6"
+version = "0.4.7"
 license = "MIT OR Apache-2.0"
 homepage = "https://github.com/pathscale/ps-blitz"
 repository = "https://github.com/pathscale/ps-blitz"
diff --git a/packages/blitz-dom/assets/default.css b/packages/blitz-dom/assets/default.css
index 1681772a..ff8f5d43 100644
--- a/packages/blitz-dom/assets/default.css
+++ b/packages/blitz-dom/assets/default.css
@@ -116,6 +116,23 @@ input[type="file"] {
     background-color: transparent;
 }
 
+/*
+ * There was no `select` rule at all, so a select computed `display: inline`,
+ * and the `option` rule below left it with no in-flow content. Height on a
+ * non-replaced inline is ignored, so even `<select style="height:34px">`
+ * reported 0x0 and nothing on a page could find it or press it. Its content
+ * size comes from `layout::select_metrics_of`, because the options it is sized
+ * from are not in flow.
+ */
+select {
+    display: inline-block;
+    border: 1px solid #999;
+    padding: 1px 4px;
+    background-color: white;
+    white-space: nowrap;
+    overflow: clip;
+}
+
 option {
     display: none;
 }
diff --git a/packages/blitz-dom/src/accessibility.rs b/packages/blitz-dom/src/accessibility.rs
index cbd5aefc..9b0421c5 100644
--- a/packages/blitz-dom/src/accessibility.rs
+++ b/packages/blitz-dom/src/accessibility.rs
@@ -136,6 +136,33 @@ impl BaseDocument {
             };
 
             builder.set_role(role);
+
+            /*
+             * A select and its options carried their roles and nothing else, so
+             * the tree said "there is a combo box here" and stopped. What it
+             * offers, what is chosen, and which option that is were all absent,
+             * which is exactly the set of questions a QA harness asks of a
+             * picker before it can drive one.
+             *
+             * The options are already in the tree: the traversal walks raw
+             * children, so `option { display: none }` does not hide them. Only
+             * the state was missing.
+             */
+            match &*name {
+                "select" => {
+                    builder.set_value(self.select_label(node.id));
+                }
+                "option" => {
+                    // An explicit label, rather than relying on the text child
+                    // labelling its parent: an option's text is `display: none`
+                    // and a consumer that resolves names through the child text
+                    // runs would be reading a node that never gets laid out.
+                    builder.set_label(self.option_label(node.id));
+                    builder.set_selected(self.option_is_selected(node.id));
+                }
+                _ => {}
+            }
+
             builder.set_html_tag(name);
         } else if node.is_text_node() {
             builder.set_role(Role::TextRun);
diff --git a/packages/blitz-dom/src/document.rs b/packages/blitz-dom/src/document.rs
index 5f731cb8..13d26253 100644
--- a/packages/blitz-dom/src/document.rs
+++ b/packages/blitz-dom/src/document.rs
@@ -1252,6 +1252,12 @@ impl BaseDocument {
             self.drag_mode = DragMode::None;
         }
         self.scrollbar_activity.remove(&node_id);
+
+        // The form-owner map is keyed by control id and was never pruned, so a
+        // page that re-renders its fields grew an entry per render, every one
+        // of them a freed slot. Nothing dereferences those any more, but an
+        // unbounded map keyed on dead ids is a leak either way.
+        self.controls_to_form.remove(&node_id);
     }
 
     pub(crate) fn drop_node_ignoring_parent(&mut self, node_id: NodeId) -> Option<Node> {
@@ -1389,6 +1395,31 @@ impl BaseDocument {
         })
     }
 
+    /// Navigate to `raw`, resolved against this document's base URL.
+    ///
+    /// The same route a link click takes, exposed so that script can reach it:
+    /// `location.assign`, `location.replace` and `location.reload` had nowhere
+    /// to go, because `resolve_url` and the navigation provider are both
+    /// internal to this crate. Returns `false` when `raw` will not resolve,
+    /// so the caller can report that rather than navigate somewhere wrong.
+    pub fn navigate_to_url(&self, raw: &str) -> bool {
+        let Some(url) = self.url.resolve_relative(raw) else {
+            return false;
+        };
+        self.navigation_provider
+            .navigate_to(blitz_traits::navigation::NavigationOptions::new(
+                url,
+                None,
+                self.id(),
+            ));
+        true
+    }
+
+    /// This document's URL, as a page's `location.href` reads it.
+    pub fn current_url(&self) -> String {
+        self.url.to_string()
+    }
+
     pub fn print_tree(&self) {
         crate::util::walk_tree(0, self.root_node());
     }
diff --git a/packages/blitz-dom/src/events/keyboard.rs b/packages/blitz-dom/src/events/keyboard.rs
index 8f58edfe..f1bdcda0 100644
--- a/packages/blitz-dom/src/events/keyboard.rs
+++ b/packages/blitz-dom/src/events/keyboard.rs
@@ -86,6 +86,25 @@ pub(crate) fn handle_key_or_input_event<F: FnMut(DomEvent)>(
             return;
         }
 
+        // A focussed select owns the arrows, Home and End: they move the
+        // selection. Checked before the mutable borrow below, because deciding
+        // where a select's selection goes means reading its options, which are
+        // other nodes.
+        //
+        // There was no keyboard activation for anything but a text input, so a
+        // picker could be focussed and then not driven at all. A harness has no
+        // other way in: worktables.dev's schema designer selects its column
+        // type by keyboard or not at all.
+        if doc
+            .get_node(node_id)
+            .is_some_and(|node| node.data.is_element_with_tag_name(&local_name!("select")))
+        {
+            if let KeyboardOrTextInputEvent::KeyPress(key_event) = &event {
+                handle_select_keypress(doc, node_id, key_event, dispatch_event);
+            }
+            return;
+        }
+
         let node = &mut doc.nodes[node_id];
         let Some(element_data) = node.element_data_mut() else {
             return;
@@ -116,6 +135,49 @@ pub(crate) fn handle_key_or_input_event<F: FnMut(DomEvent)>(
     }
 }
 
+/// Move a focussed select's selection with the arrows, Home and End.
+///
+/// A select commits immediately, the way a checkbox does and unlike a text
+/// control: the keystroke *is* the commit, so `input` fires here and
+/// blitz-script synthesises the `change` that follows it. Waiting for blur, as
+/// a text field does, would leave a picker that never reports what was chosen.
+fn handle_select_keypress<F: FnMut(DomEvent)>(
+    doc: &mut BaseDocument,
+    node_id: NodeId,
+    event: &BlitzKeyEvent,
+    mut dispatch_event: F,
+) {
+    if !event.state.is_pressed() {
+        return;
+    }
+
+    let target_index = match &event.key {
+        Key::ArrowDown => doc.select_index_step(node_id, true),
+        Key::ArrowUp => doc.select_index_step(node_id, false),
+        Key::Home => doc.select_index_edge(node_id, false),
+        Key::End => doc.select_index_edge(node_id, true),
+        _ => return,
+    };
+    let Some(index) = target_index else {
+        // Already at the end of the list, or nothing selectable. Silently
+        // doing nothing is right: a browser does not wrap around.
+        return;
+    };
+
+    if !doc.set_select_selected_index(node_id, index) {
+        return;
+    }
+    // The selectedness is what `:checked` and the accessibility tree read, so
+    // the restyle has to be asked for or the change is invisible.
+    doc.snapshot_node(node_id);
+
+    let value = doc.select_value(node_id);
+    dispatch_event(DomEvent::new(
+        node_id,
+        DomEventData::Input(BlitzInputEvent { value }),
+    ));
+}
+
 impl BaseDocument {
     pub(crate) fn apply_generated_text_input_event<F: FnMut(DomEvent)>(
         &mut self,
@@ -150,20 +212,66 @@ impl BaseDocument {
     }
 }
 
-/// https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#field-that-blocks-implicit-submission
+/// Whether this control is a submit button, and so a candidate for the form's
+/// default button.
+///
+/// <https://html.spec.whatwg.org/multipage/forms.html#default-button>
+fn is_submit_button(element_data: &crate::ElementData) -> bool {
+    // `ElementData::is_submit_button` covers `<button>`, including the
+    // command-attribute cases that take it back out of the Submit Button state.
+    element_data.is_submit_button()
+        || (element_data.name.local == local_name!("input")
+            && matches!(
+                element_data.attr(local_name!("type")),
+                Some("submit" | "image")
+            ))
+}
+
+/// <https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#implicit-submission>
 fn implicit_form_submission<F: FnMut(DomEvent)>(
     doc: &BaseDocument,
     text_target: NodeId,
     mut dispatch_event: F,
 ) {
-    let Some(form_owner_id) = doc.controls_to_form.get(&text_target) else {
+    let Some(&form_owner_id) = doc.controls_to_form.get(&text_target) else {
         return;
     };
-    if doc
-        .controls_to_form
+
+    // Walked over the tree rather than over `controls_to_form` directly, for
+    // two reasons. Tree order is what names the default button, and the map is
+    // not a reliable source of live node ids: a control removed from the
+    // document leaves its key behind, so a framework that re-rendered a field
+    // left a freed id in it and indexing the slab for that id panicked with
+    // "invalid SlotMap key used", taking the host process down. The traverser
+    // only yields nodes that are still in the tree.
+    let controls: Vec<NodeId> = crate::traversal::TreeTraverser::new(doc)
+        .filter(|control_id| doc.controls_to_form.get(control_id) == Some(&form_owner_id))
+        .collect();
+
+    // "If the form has a default button, then act as if that button was
+    // clicked." The multiple-fields rule below applies only when there is none,
+    // which is the whole of the gate: a login form with a user field, a
+    // password field and a Sign in button submits on Enter, and this returned
+    // early on it instead.
+    if let Some(default_button) = controls.iter().copied().find(|control_id| {
+        doc.get_node(*control_id)
+            .and_then(|node| node.element_data())
+            .is_some_and(is_submit_button)
+    }) {
+        dispatch_event(DomEvent::new(
+            form_owner_id,
+            DomEventData::Submit(BlitzSubmitEvent {
+                form: form_owner_id.as_u64(),
+                submitter: default_button.as_u64(),
+            }),
+        ));
+        return;
+    }
+
+    if controls
         .iter()
-        .filter(|(_control_id, form_id)| *form_id == form_owner_id)
-        .filter_map(|(control_id, _)| doc.nodes[*control_id].element_data())
+        .filter_map(|control_id| doc.get_node(*control_id))
+        .filter_map(|node| node.element_data())
         .filter(|element_data| {
             element_data.attr(local_name!("type")).is_some_and(|t| {
                 matches!(
@@ -193,10 +301,10 @@ fn implicit_form_submission<F: FnMut(DomEvent)>(
     // pressing Enter in the only text field of a form is a submission a page
     // handles, and a default action nothing can cancel is not one.
     dispatch_event(DomEvent::new(
-        *form_owner_id,
+        form_owner_id,
         DomEventData::Submit(BlitzSubmitEvent {
-            form: (*form_owner_id).as_u64(),
-            submitter: (*form_owner_id).as_u64(),
+            form: form_owner_id.as_u64(),
+            submitter: form_owner_id.as_u64(),
         }),
     ));
 }
diff --git a/packages/blitz-dom/src/events/mod.rs b/packages/blitz-dom/src/events/mod.rs
index b1f0409d..d4c279ff 100644
--- a/packages/blitz-dom/src/events/mod.rs
+++ b/packages/blitz-dom/src/events/mod.rs
@@ -371,7 +371,14 @@ fn scroll_key_is_claimed_by(doc: &BaseDocument, node_id: NodeId, key: &Key) -> b
     }
     doc.get_node(node_id)
         .and_then(|node| node.element_data())
-        .is_some_and(|element| element.text_input_data().is_some())
+        .is_some_and(|element| {
+            element.text_input_data().is_some()
+                // A focussed select moves its selection with the arrows, Home
+                // and End. Without claiming them here the branch above scrolls
+                // the page and *returns*, so the keyboard handler never runs
+                // and a select could not be driven by keyboard at all.
+                || element.select_data().is_some()
+        })
 }
 
 /// The scroll a key asks for, in CSS pixels, or `None` if it asks for none.
diff --git a/packages/blitz-dom/src/events/pointer.rs b/packages/blitz-dom/src/events/pointer.rs
index 09d63e03..4bd3fd50 100644
--- a/packages/blitz-dom/src/events/pointer.rs
+++ b/packages/blitz-dom/src/events/pointer.rs
@@ -638,6 +638,12 @@ pub(crate) fn checkable_activation_target(doc: &BaseDocument, target: NodeId) ->
                 return Some(node_id);
             }
             local_name!("label") => return None,
+            // A select is not checkable and has an activation behaviour of its
+            // own, so the walk stops here for the same reason it stops at a
+            // text input: `handle_click` claims the press, and the two have to
+            // agree about where the walk ends or a checkbox wrapping a select
+            // would toggle without ever seeing a click.
+            local_name!("select") => return None,
             _ => {}
         }
 
@@ -716,6 +722,27 @@ pub(crate) fn handle_click(
 
                     break 'matched true;
                 }
+                // A press on a select focuses it. Nothing else yet: there is no
+                // popup to open.
+                //
+                // Without an arm of its own the walk fell through to the
+                // no-match tail below, which calls `clear_focus()`. Clicking a
+                // select therefore actively *unfocused* the page, and since the
+                // keyboard handler is gated on focus, the arrows could not
+                // drive a select the user had just pressed. `handle_pointerdown`
+                // is no help either: it classifies a select as
+                // `ClickTarget::SelectableText` and only the `TextInput` arm
+                // there generates focus events.
+                local_name!("select") => {
+                    generate_focus_events(
+                        doc,
+                        &mut |doc| {
+                            doc.set_focus_to(node_id);
+                        },
+                        dispatch_event,
+                    );
+                    break 'matched true;
+                }
                 // Activating the first <summary> of a <details> element toggles
                 // the details' `open` attribute (expand/collapse).
                 local_name!("summary") => {
diff --git a/packages/blitz-dom/src/form.rs b/packages/blitz-dom/src/form.rs
index 86f5a66f..e0e09202 100644
--- a/packages/blitz-dom/src/form.rs
+++ b/packages/blitz-dom/src/form.rs
@@ -267,11 +267,29 @@ fn construct_entry_list(doc: &BaseDocument, form_id: NodeId, submitter_id: NodeI
             continue;
         };
 
-        // TODO: If the field element is a select element,
-        //  then for each option element in the select element's
-        //  list of options whose selectedness is true and that is not disabled,
-        //  create an entry with name and the value of the option element,
-        //  and append it to entry list.
+        // If the field element is a select element, then for each option
+        // element in the select element's list of options whose selectedness is
+        // true and that is not disabled, create an entry with name and the
+        // value of the option element, and append it to entry list.
+        //
+        // Without this a select fell through to the generic tail below and
+        // submitted its own literal `value` attribute, which a select does not
+        // have. Every form containing a picker posted the wrong body.
+        if element.name.local == local_name!("select") {
+            let options = doc.select_options(control_id);
+            for (index, option_id) in options.iter().enumerate() {
+                let is_selected = element
+                    .select_data()
+                    .map(|data| data.is_selected(index))
+                    // Before layout construction has run there is no live
+                    // state, and the content attribute is all there is.
+                    .unwrap_or_else(|| doc.option_is_selected(*option_id));
+                if is_selected && !doc.option_is_disabled(*option_id) {
+                    create_entry(name, doc.option_value(*option_id).as_str().into());
+                }
+            }
+            continue;
+        }
 
         // Otherwise, if the field element is an input element whose type attribute is in the Checkbox state or the Radio Button state, then:
         if element.name.local == local_name!("input")
diff --git a/packages/blitz-dom/src/layout/construct.rs b/packages/blitz-dom/src/layout/construct.rs
index caebb689..1e37f020 100644
--- a/packages/blitz-dom/src/layout/construct.rs
+++ b/packages/blitz-dom/src/layout/construct.rs
@@ -501,6 +501,14 @@ pub(crate) fn collect_layout_children(
             }
         }
 
+        // A select has no in-flow content of its own: `option { display: none }`
+        // in the user-agent sheet sees to that, so returning here costs nothing
+        // and keeps the options out of the box the control occupies.
+        if tag_name == "select" {
+            create_select(doc, container_node_id);
+            return;
+        }
+
         #[cfg(feature = "svg")]
         if matches!(tag_name, "svg") {
             // Serialised rather than `outer_html`, so that symbols referenced
@@ -581,6 +589,25 @@ pub(crate) fn collect_layout_children(
             push_hoisted_children_and_pseudos(doc, container_node_id, out);
         }
         DisplayInside::Flow | DisplayInside::FlowRoot | DisplayInside::TableCell => {
+            // An anonymous table box, fused into this container rather than
+            // inserted under it.
+            //
+            // `table { display: block }` is the standard wide-table
+            // horizontal-scroll pattern, and it left `thead` and `tbody` as
+            // plain block children whose own displays have no mapping in the
+            // style conversion. They fell through to Taffy's default, which is
+            // flex, so every row rendered SIDE BY SIDE. CSS 2.1 17.2.1 requires
+            // an anonymous table box around misparented table-internal boxes.
+            //
+            // Fusing is exact when the container holds nothing but those boxes,
+            // which is this whole pattern and every case seen on a real page:
+            // the anonymous table would be the container's only child and would
+            // take its content box. A container with mixed content still needs a
+            // separate anonymous box, and does not get one here.
+            if block_contains_only_table_internals(doc, container_node_id) {
+                return make_table_root(doc, container_node_id, out);
+            }
+
             // display:contents children are transparent for box generation:
             // their children participate in this container's formatting
             // context, so classification must recurse into them.
@@ -678,26 +705,7 @@ pub(crate) fn collect_layout_children(
             );
         }
 
-        DisplayInside::Table => {
-            let (table_context, tlayout_children) = build_table_context(doc, container_node_id);
-            #[allow(clippy::arc_with_non_send_sync)]
-            let data = SpecialElementData::TableRoot(Arc::new(table_context));
-            doc.nodes[container_node_id]
-                .flags
-                .insert(NodeFlags::IS_TABLE_ROOT);
-            doc.nodes[container_node_id]
-                .data
-                .downcast_element_mut()
-                .unwrap()
-                .special_data = data;
-            if let Some(before) = doc.nodes[container_node_id].before() {
-                out.push(before, doc);
-            }
-            out.extend(&tlayout_children, doc);
-            if let Some(after) = doc.nodes[container_node_id].after() {
-                out.push(after, doc);
-            }
-        }
+        DisplayInside::Table => make_table_root(doc, container_node_id, out),
 
         _ => {
             // Internal table boxes can receive direct text from malformed or
@@ -737,6 +745,74 @@ pub(crate) fn collect_layout_children(
     }
 }
 
+/// Turn `container_node_id` into a table root and give it the flattened grid of
+/// cells as its layout children.
+fn make_table_root(doc: &mut BaseDocument, container_node_id: NodeId, out: &mut LayoutChildren) {
+    let (table_context, tlayout_children) = build_table_context(doc, container_node_id);
+    #[allow(clippy::arc_with_non_send_sync)]
+    let data = SpecialElementData::TableRoot(Arc::new(table_context));
+    doc.nodes[container_node_id]
+        .flags
+        .insert(NodeFlags::IS_TABLE_ROOT);
+    doc.nodes[container_node_id]
+        .data
+        .downcast_element_mut()
+        .unwrap()
+        .special_data = data;
+    if let Some(before) = doc.nodes[container_node_id].before() {
+        out.push(before, doc);
+    }
+    out.extend(&tlayout_children, doc);
+    if let Some(after) = doc.nodes[container_node_id].after() {
+        out.push(after, doc);
+    }
+}
+
+/// Whether every box this container generates is a table-internal one, so the
+/// container is the table its author took the `display: table` off.
+fn block_contains_only_table_internals(doc: &BaseDocument, container_node_id: NodeId) -> bool {
+    // Not for an anonymous block: those are generated *by* this pass, and one
+    // of them wrapping table internals means the wrapping has already been
+    // decided elsewhere.
+    if doc.nodes[container_node_id]
+        .data
+        .downcast_element()
+        .is_none()
+    {
+        return false;
+    }
+
+    let mut saw_table_internal = false;
+    for child_id in doc.nodes[container_node_id]
+        .layout_dom_children()
+        .iter()
+        .copied()
+    {
+        let child = &doc.nodes[child_id];
+        if child.data.kind() == NodeKind::Comment || child.is_whitespace_node() {
+            continue;
+        }
+        let Some(display) = child.display_style() else {
+            // A text child: real content, so this is a block with a stray table
+            // box in it and not a table.
+            return false;
+        };
+        match display.inside() {
+            DisplayInside::None => {}
+            DisplayInside::TableRowGroup
+            | DisplayInside::TableHeaderGroup
+            | DisplayInside::TableFooterGroup
+            | DisplayInside::TableRow
+            | DisplayInside::TableCell
+            | DisplayInside::TableColumn
+            | DisplayInside::TableColumnGroup => saw_table_internal = true,
+            _ => return false,
+        }
+    }
+
+    saw_table_internal
+}
+
 /// Extract the text generated by a pseudo-element's `content` property
 /// (only string content items are currently supported).
 fn pe_content_text(style: &style::properties::ComputedValues) -> Option<&str> {
@@ -1050,6 +1126,24 @@ fn create_checkbox_input(doc: &mut BaseDocument, input_element_id: NodeId) {
     }
 }
 
+fn create_select(doc: &mut BaseDocument, select_element_id: NodeId) {
+    // Read before the node is borrowed mutably: the seed comes from the
+    // options, which are other nodes.
+    let initial = doc.initial_select_data(select_element_id);
+    let option_count = initial.len();
+
+    let node = &mut doc.nodes[select_element_id];
+    let element = &mut node.data.downcast_element_mut().unwrap();
+    match element.special_data {
+        // Construction runs again on every resolve. Re-seeding would put the
+        // control back to its parsed state on the next frame, so a selection
+        // made by the user or by script would survive exactly until anything
+        // else on the page changed. Only the option count is refreshed.
+        SpecialElementData::Select(ref mut data) => data.resize(option_count),
+        _ => element.special_data = SpecialElementData::Select(initial),
+    }
+}
+
 /// Find and return the "layout_children" (inline boxes) for an inline layout
 /// without actually constructing the layout. This allows us to defer the expensive
 /// construction of the Parley layout (which invokes text shaping) to a paralell phase.
diff --git a/packages/blitz-dom/src/layout/mod.rs b/packages/blitz-dom/src/layout/mod.rs
index b6c88efc..49dc1236 100644
--- a/packages/blitz-dom/src/layout/mod.rs
+++ b/packages/blitz-dom/src/layout/mod.rs
@@ -331,7 +331,59 @@ impl BaseDocument {
     }
 }
 
+/// The widest option label, in characters, and the number of visible rows, for
+/// a `<select>`. `None` for anything else.
+///
+/// A select has no in-flow content: `option { display: none }` in the user-agent
+/// sheet sees to that, and nothing replaces it. Without a measure of its own it
+/// laid out at zero and no site's country picker, currency picker or language
+/// picker had a box to press.
+///
+/// Still a character count rather than shaped text, because the options never
+/// reach layout and so are never shaped. What it counts is now the option's
+/// *label*, which is the string the control actually shows: a `label`
+/// attribute overrides the element's text, and the text is collapsed the way it
+/// would be rendered. Counting `text_content().trim()` measured the hidden text
+/// of a labelled option, and `trim()` only strips the ends, so a label whose own
+/// words were split across source lines counted the newline and the indentation
+/// before the next word and came out that much too wide.
+fn select_metrics_of(
+    doc: &BaseDocument,
+    node_id: blitz_traits::node_id::NodeId,
+) -> Option<(usize, f32)> {
+    let node = doc.nodes.get(node_id)?;
+    let element = node.data.downcast_element()?;
+    if element.name.local != local_name!("select") {
+        return None;
+    }
+
+    let widest = doc
+        .select_options(node_id)
+        .into_iter()
+        .map(|option_id| doc.option_label(option_id).chars().count())
+        .max()
+        .unwrap_or(0);
+
+    // A dropdown shows one row. `size` names the row count for a list box, and
+    // `multiple` without `size` shows four, which is what browsers settled on.
+    let rows = element
+        .attr(local_name!("size"))
+        .and_then(|size| size.parse::<f32>().ok())
+        .filter(|rows| *rows >= 1.0)
+        .unwrap_or(if element.attr(local_name!("multiple")).is_some() {
+            4.0
+        } else {
+            1.0
+        });
+
+    Some((widest, rows))
+}
+
 impl BaseDocument {
+    fn select_metrics(&self, node_id: blitz_traits::node_id::NodeId) -> Option<(usize, f32)> {
+        select_metrics_of(self, node_id)
+    }
+
     fn compute_child_layout_internal(
         &mut self,
         node_id: NodeId,
@@ -344,6 +396,11 @@ impl BaseDocument {
         // radius separates them, and a cache hit never reaches this function.
         #[cfg(feature = "log-phase-times")]
         layout_counters::note_computed(dom_node_id(node_id));
+
+        // Read before the node is borrowed mutably: a `<select>` is sized from
+        // its options, which are other nodes.
+        let select_metrics = self.select_metrics(dom_node_id(node_id));
+
         let node = &mut self.nodes[dom_node_id(node_id)];
 
         let font_styles = node.primary_styles().map(|style| {
@@ -396,6 +453,26 @@ impl BaseDocument {
                 // })
             }
             NodeData::Element(element_data) | NodeData::AnonymousBlock(element_data) => {
+                // A `<select>` is measured from its options, which are not in
+                // flow. The character-count estimate is the same one the
+                // `cols` attribute of a textarea uses below: a select's label
+                // is not laid out as text anywhere yet, so there is no real
+                // measurement to take. An authored width or height still wins,
+                // this only supplies the content size.
+                if let Some((widest_label, rows)) = select_metrics {
+                    let advance = font_size.unwrap_or(16.0) * 0.6;
+                    let line_height = resolved_line_height.unwrap_or(16.0);
+                    return compute_leaf_layout(
+                        inputs,
+                        node.style(),
+                        resolve_calc_value,
+                        |_known_size, _available_space| taffy::Size {
+                            width: widest_label as f32 * advance,
+                            height: line_height * rows,
+                        },
+                    );
+                }
+
                 // TODO: deduplicate with single-line text input
                 if *element_data.name.local == *"textarea" {
                     let rows = element_data
@@ -519,7 +596,17 @@ impl BaseDocument {
                                 },
                             );
                         }
-                        None | Some("text" | "password" | "email" | "tel" | "url" | "search") => {
+                        // Kept in step with the list in
+                        // `layout::construct::collect_layout_children`, which
+                        // decides which inputs get a text editor. A type that
+                        // is on that list and not this one gets an editor and
+                        // no content box: `number` measured 6x6, its padding
+                        // and border alone, against 306x25.2 for every other
+                        // text-like type.
+                        None
+                        | Some(
+                            "text" | "password" | "email" | "number" | "tel" | "url" | "search",
+                        ) => {
                             return compute_leaf_layout(
                                 inputs,
                                 node.style(),
diff --git a/packages/blitz-dom/src/layout/table.rs b/packages/blitz-dom/src/layout/table.rs
index c25ff139..b4ef366b 100644
--- a/packages/blitz-dom/src/layout/table.rs
+++ b/packages/blitz-dom/src/layout/table.rs
@@ -29,6 +29,7 @@ pub struct TableContext {
     pub style: taffy::Style<Atom>,
     pub cells: Vec<TableCell>,
     pub rows: Vec<TableRow>,
+    pub row_groups: Vec<TableRowGroup>,
     pub computed_grid_info: AtomicRefCell<Option<DetailedGridInfo>>,
     pub border_style: Option<ServoArc<Border>>,
     pub border_collapse: BorderCollapse,
@@ -52,6 +53,21 @@ pub struct TableRow {
     // kind: TableItemKind,
     pub node_id: NodeId,
     pub height: f32,
+    /// Where this row's cells sit in [`TableContext::cells`].
+    ///
+    /// Rows are flattened away into the grid, so nothing else records which
+    /// cells belong to which row, and without that a row cannot be given the
+    /// box its cells occupy. It reported 0x0 and "not displayed", and anything
+    /// walking a table by row had nothing to walk.
+    pub cells: Range<usize>,
+}
+
+/// A `<thead>`, `<tbody>` or `<tfoot>`, and the rows it holds.
+#[derive(Debug, Clone)]
+pub struct TableRowGroup {
+    pub node_id: NodeId,
+    /// Where this group's rows sit in [`TableContext::rows`].
+    pub rows: Range<usize>,
 }
 
 pub(crate) fn build_table_context(
@@ -60,6 +76,7 @@ pub(crate) fn build_table_context(
 ) -> (TableContext, Vec<NodeId>) {
     let mut cells: Vec<TableCell> = Vec::new();
     let mut rows: Vec<TableRow> = Vec::new();
+    let mut row_groups: Vec<TableRowGroup> = Vec::new();
     let mut row = 0u16;
     let mut col = 0u16;
 
@@ -104,6 +121,7 @@ pub(crate) fn build_table_context(
             &mut col,
             &mut cells,
             &mut rows,
+            &mut row_groups,
             &mut column_sizes,
             &mut first_cell_border,
         );
@@ -170,6 +188,7 @@ pub(crate) fn build_table_context(
             style,
             cells,
             rows,
+            row_groups,
             computed_grid_info: AtomicRefCell::new(None),
             border_collapse,
             border_style: first_cell_border,
@@ -188,6 +207,7 @@ pub(crate) fn collect_table_cells(
     col: &mut u16,
     cells: &mut Vec<TableCell>,
     rows: &mut Vec<TableRow>,
+    row_groups: &mut Vec<TableRowGroup>,
     columns: &mut Vec<TrackSizingFunction>,
     first_cell_border: &mut Option<ServoArc<Border>>,
 ) {
@@ -213,6 +233,8 @@ pub(crate) fn collect_table_cells(
         | DisplayInside::TableHeaderGroup
         | DisplayInside::TableFooterGroup
         | DisplayInside::Contents => {
+            let is_row_group = !matches!(display.inside(), DisplayInside::Contents);
+            let first_row = rows.len();
             let children = std::mem::take(&mut doc.nodes[node_id].children);
             for child_id in children.iter().copied() {
                 doc.nodes[child_id]
@@ -226,20 +248,30 @@ pub(crate) fn collect_table_cells(
                     col,
                     cells,
                     rows,
+                    row_groups,
                     columns,
                     first_cell_border,
                 );
             }
             doc.nodes[node_id].children = children;
+            if is_row_group {
+                row_groups.push(TableRowGroup {
+                    node_id,
+                    rows: first_row..rows.len(),
+                });
+            }
         }
         DisplayInside::TableRow => {
             node.remove_damage(CONSTRUCT_DESCENDENT | CONSTRUCT_FC | CONSTRUCT_BOX);
             *row += 1;
             *col = 0;
 
+            let row_index = rows.len();
+            let first_cell = cells.len();
             rows.push(TableRow {
                 node_id,
                 height: 0.0,
+                cells: first_cell..first_cell,
             });
 
             let children = std::mem::take(&mut doc.nodes[node_id].children);
@@ -253,11 +285,13 @@ pub(crate) fn collect_table_cells(
                     col,
                     cells,
                     rows,
+                    row_groups,
                     columns,
                     first_cell_border,
                 );
             }
             doc.nodes[node_id].children = children;
+            rows[row_index].cells = first_cell..cells.len();
         }
         DisplayInside::TableCell => {
             // node.remove_damage(CONSTRUCT_DESCENDENT | CONSTRUCT_FC | CONSTRUCT_BOX);
@@ -355,6 +389,107 @@ pub(crate) fn collect_table_cells(
     }
 }
 
+/// Give every `<tr>` and every row group the box its cells occupy.
+///
+/// Table layout flattens the rows into a grid of cells, so the row and
+/// row-group nodes never reach Taffy and nothing ever wrote a layout for them:
+/// each one reported 0x0 and, to anything asking whether an element is
+/// displayed, "no". A row is not laid out, it is described, so this runs after
+/// the grid is computed and derives each box from the cells that are.
+///
+/// Rounded and unrounded are both written. The rounding pass walks the box
+/// tree, and these nodes are not in it, so a value left only in the unrounded
+/// slot would never reach `final_layout`, which is what every geometry query
+/// reads.
+impl BaseDocument {
+    pub(crate) fn assign_table_row_layouts(&mut self) {
+        let contexts: Vec<Arc<TableContext>> = self
+            .nodes
+            .iter()
+            .filter(|(_, node)| node.flags.is_table_root())
+            .filter_map(
+                |(_, node)| match &node.data.downcast_element()?.special_data {
+                    crate::node::SpecialElementData::TableRoot(context) => {
+                        Some(Arc::clone(context))
+                    }
+                    _ => None,
+                },
+            )
+            .collect();
+        for context in contexts {
+            assign_row_layouts(self, &context);
+        }
+    }
+}
+
+pub(crate) fn assign_row_layouts(doc: &mut BaseDocument, ctx: &TableContext) {
+    if ctx.rows.is_empty() {
+        return;
+    }
+
+    // The grid's own extent, so that a row spans the table rather than only the
+    // cells that happen to be in it. A row with a colspan short of the full
+    // width is still as wide as the table.
+    let mut left = f32::MAX;
+    let mut right = f32::MIN;
+    for cell in &ctx.cells {
+        let Some(node) = doc.nodes.get(cell.node_id) else {
+            continue;
+        };
+        let layout = node.final_layout();
+        left = left.min(layout.location.x);
+        right = right.max(layout.location.x + layout.size.width);
+    }
+    if left > right {
+        return;
+    }
+
+    let mut row_extents: Vec<Option<(f32, f32)>> = Vec::with_capacity(ctx.rows.len());
+    for row in &ctx.rows {
+        let mut top = f32::MAX;
+        let mut bottom = f32::MIN;
+        for cell in &ctx.cells[row.cells.clone()] {
+            let Some(node) = doc.nodes.get(cell.node_id) else {
+                continue;
+            };
+            let layout = node.final_layout();
+            top = top.min(layout.location.y);
+            bottom = bottom.max(layout.location.y + layout.size.height);
+        }
+        if top > bottom {
+            row_extents.push(None);
+            continue;
+        }
+        row_extents.push(Some((top, bottom)));
+        write_box(doc, row.node_id, left, top, right - left, bottom - top);
+    }
+
+    for group in &ctx.row_groups {
+        let mut top = f32::MAX;
+        let mut bottom = f32::MIN;
+        for extent in row_extents[group.rows.clone()].iter().flatten() {
+            top = top.min(extent.0);
+            bottom = bottom.max(extent.1);
+        }
+        if top > bottom {
+            continue;
+        }
+        write_box(doc, group.node_id, left, top, right - left, bottom - top);
+    }
+}
+
+fn write_box(doc: &mut BaseDocument, node_id: NodeId, x: f32, y: f32, width: f32, height: f32) {
+    let Some(node) = doc.nodes.get_mut(node_id) else {
+        return;
+    };
+    let mut layout = taffy::Layout::with_order(node.final_layout().order);
+    layout.location = taffy::Point { x, y };
+    layout.size = taffy::Size { width, height };
+    layout.content_size = layout.size;
+    *node.unrounded_layout_mut() = layout;
+    *node.final_layout_mut() = layout;
+}
+
 pub struct RangeIter(Range<usize>);
 
 impl Iterator for RangeIter {
diff --git a/packages/blitz-dom/src/lib.rs b/packages/blitz-dom/src/lib.rs
index 6b83f9c8..70570688 100644
--- a/packages/blitz-dom/src/lib.rs
+++ b/packages/blitz-dom/src/lib.rs
@@ -53,6 +53,7 @@ mod mutator;
 pub mod paint_damage;
 mod query_selector;
 mod resolve;
+mod select;
 mod selection;
 #[cfg(feature = "shadow-dom")]
 mod shadow;
@@ -98,7 +99,7 @@ pub use markup5ever::{
     namespace_prefix, namespace_url, ns,
 };
 pub use mutator::DocumentMutator;
-pub use node::{Attribute, DocumentData, ElementData, Node, NodeData, TextNodeData};
+pub use node::{Attribute, DocumentData, ElementData, Node, NodeData, SelectData, TextNodeData};
 pub use paint_damage::PaintDamage;
 // Re-exported because `PaintDamage` takes and returns `kurbo::Rect` across the
 // crate boundary. A consumer that pulls kurbo in itself and lands on a
diff --git a/packages/blitz-dom/src/mutator.rs b/packages/blitz-dom/src/mutator.rs
index 4b6ef2c0..84dc62fd 100644
--- a/packages/blitz-dom/src/mutator.rs
+++ b/packages/blitz-dom/src/mutator.rs
@@ -497,6 +497,49 @@ impl DocumentMutator<'_> {
             || (tag, attr) == tag_and_attr!("iframe", "srcdoc")
         {
             self.load_iframe(node_id);
+        } else if (tag, attr) == tag_and_attr!("option", "selected") {
+            // `selected` is an HTML boolean attribute: present means selected,
+            // whatever the value reads. The same trap `checked` fell into, where
+            // `selected="false"` selected the option.
+            //
+            // Selectedness lives on the owning select once that has been
+            // constructed, and construction is idempotent, so writing the
+            // attribute alone would land nowhere anything reads. Before
+            // construction the attribute is the only carrier and seeds the
+            // state on the next resolve, which is why this is allowed to do
+            // nothing at all.
+            self.set_option_selected_state(node_id, true);
+        }
+    }
+
+    /// Push an option's selectedness into the owning select's live state, if
+    /// that state exists yet.
+    fn set_option_selected_state(&mut self, option_id: NodeId, selected: bool) {
+        let Some(select_id) = self.doc.option_owner_select(option_id) else {
+            return;
+        };
+        let Some(index) = self
+            .doc
+            .select_options(select_id)
+            .iter()
+            .position(|id| *id == option_id)
+        else {
+            return;
+        };
+        let changed = if selected {
+            self.doc.set_select_selected_index(select_id, index)
+        } else {
+            self.doc
+                .get_node_mut(select_id)
+                .and_then(|node| node.data.downcast_element_mut())
+                .and_then(|el| el.select_data_mut())
+                .is_some_and(|data| data.set_selected(index, false))
+        };
+        if changed {
+            // `option:checked` is matched from this state, so the restyle has
+            // to be asked for here or the change is invisible to CSS.
+            self.doc.snapshot_node(option_id);
+            self.doc.snapshot_node(select_id);
         }
     }
 
@@ -1392,6 +1435,7 @@ impl<'doc> DocumentMutator<'doc> {
                 SpecialElementData::TableRoot(_) => {}
                 SpecialElementData::TextInput(_) => {}
                 SpecialElementData::CheckboxInput(_) => {}
+                SpecialElementData::Select(_) => {}
                 #[cfg(feature = "file-input")]
                 SpecialElementData::FileInput(_) => {}
                 SpecialElementData::None => {}
diff --git a/packages/blitz-dom/src/node/element.rs b/packages/blitz-dom/src/node/element.rs
index 15075fb8..49061f72 100644
--- a/packages/blitz-dom/src/node/element.rs
+++ b/packages/blitz-dom/src/node/element.rs
@@ -32,7 +32,7 @@ use super::stylo_data::StyloData;
 use super::{Attribute, Attributes};
 use crate::Document;
 use crate::layout::table::TableContext;
-use crate::node::{TextBrush, TextInputData, TextLayout};
+use crate::node::{SelectData, TextBrush, TextInputData, TextLayout};
 
 #[cfg(feature = "shadow-dom")]
 use super::custom_element::CustomElementData;
@@ -383,6 +383,7 @@ pub enum SpecialElementType {
     TableRoot,
     TextInput,
     CheckboxInput,
+    Select,
     #[cfg(feature = "file-input")]
     FileInput,
     #[default]
@@ -412,6 +413,8 @@ pub enum SpecialElementData {
     TextInput(TextInputData),
     /// Checkbox checked state
     CheckboxInput(bool),
+    /// A \<select\> element's selectedness and open state
+    Select(SelectData),
     /// Selected files
     #[cfg(feature = "file-input")]
     FileInput(FileData),
@@ -434,6 +437,7 @@ impl Clone for SpecialElementData {
             Self::TableRoot(data) => Self::TableRoot(data.clone()),
             Self::TextInput(data) => Self::TextInput(data.clone()),
             Self::CheckboxInput(data) => Self::CheckboxInput(*data),
+            Self::Select(data) => Self::Select(data.clone()),
             #[cfg(feature = "file-input")]
             Self::FileInput(data) => Self::FileInput(data.clone()),
             Self::None => Self::None,
@@ -682,6 +686,27 @@ impl ElementData {
         }
     }
 
+    /// The live state of a `<select>`, or `None` for anything else.
+    ///
+    /// Deliberately not modelled the way `checkbox_input_checked` is: that one
+    /// hands back an `Option<bool>` whose `None` means both "not a checkbox"
+    /// and, to every caller that reaches for `unwrap_or(false)`, "unchecked".
+    /// A select's answer to "what is selected" is a whole vector, so the
+    /// borrow is handed out instead and the two questions stay apart.
+    pub fn select_data(&self) -> Option<&SelectData> {
+        match &self.special_data {
+            SpecialElementData::Select(data) => Some(data),
+            _ => None,
+        }
+    }
+
+    pub fn select_data_mut(&mut self) -> Option<&mut SelectData> {
+        match &mut self.special_data {
+            SpecialElementData::Select(data) => Some(data),
+            _ => None,
+        }
+    }
+
     #[cfg(feature = "file-input")]
     pub fn file_data(&self) -> Option<&FileData> {
         match &self.special_data {
@@ -1066,6 +1091,9 @@ impl std::fmt::Debug for SpecialElementData {
             SpecialElementData::TableRoot(_) => f.write_str("NodeSpecificData::TableRoot"),
             SpecialElementData::TextInput(_) => f.write_str("NodeSpecificData::TextInput"),
             SpecialElementData::CheckboxInput(_) => f.write_str("NodeSpecificData::CheckboxInput"),
+            SpecialElementData::Select(data) => {
+                write!(f, "NodeSpecificData::Select({data:?})")
+            }
             #[cfg(feature = "file-input")]
             SpecialElementData::FileInput(_) => f.write_str("NodeSpecificData::FileInput"),
             SpecialElementData::None => f.write_str("NodeSpecificData::None"),
diff --git a/packages/blitz-dom/src/node/mod.rs b/packages/blitz-dom/src/node/mod.rs
index 0178e069..75d8aa3f 100644
--- a/packages/blitz-dom/src/node/mod.rs
+++ b/packages/blitz-dom/src/node/mod.rs
@@ -8,6 +8,7 @@ mod custom_widget;
 mod element;
 mod node;
 pub(crate) mod scrollbar;
+mod select;
 mod stylo_data;
 mod text;
 
@@ -30,4 +31,5 @@ pub use element::{
 };
 pub use node::*;
 pub use scrollbar::{ScrollbarColor, ScrollbarRef, ScrollbarWidth};
+pub use select::SelectData;
 pub use text::{GeneratedTextInputEvent, TextBrush, TextInputData, TextLayout};
diff --git a/packages/blitz-dom/src/node/select.rs b/packages/blitz-dom/src/node/select.rs
new file mode 100644
index 00000000..41aa1745
--- /dev/null
+++ b/packages/blitz-dom/src/node/select.rs
@@ -0,0 +1,106 @@
+//! Live state for a `<select>` element.
+
+/// The selectedness of a `<select>` element's list of options, plus whether its
+/// drop-down is showing.
+///
+/// Positions, not node ids. `selectedIndex` is the spec's own handle on an
+/// option, and a position cannot dangle the way a stored id does once the
+/// option is removed from the tree. The list of options itself is recomputed
+/// from the subtree on every read, so a stale position is at worst out of
+/// range rather than pointing at some unrelated node.
+///
+/// A `Vec<bool>` rather than a single index because `<select multiple>` can
+/// have any number of options selected at once, and a single index would make
+/// the multiple case unrepresentable rather than merely unsupported.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct SelectData {
+    selected: Vec<bool>,
+    open: bool,
+}
+
+impl SelectData {
+    /// Seed the state with one entry per option, in the select's list order.
+    pub fn new(selected: Vec<bool>) -> Self {
+        Self {
+            selected,
+            open: false,
+        }
+    }
+
+    /// Grow or shrink to `len` options, keeping the selectedness of the options
+    /// that are still there.
+    ///
+    /// Layout construction runs again on every resolve, so this is the only
+    /// place a script-added `<option>` gets an entry of its own. Re-seeding
+    /// from the `selected` content attributes instead would throw away whatever
+    /// the user had actually chosen the moment anything else on the page
+    /// changed.
+    pub fn resize(&mut self, len: usize) {
+        self.selected.resize(len, false);
+    }
+
+    /// The number of options the state has entries for.
+    pub fn len(&self) -> usize {
+        self.selected.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.selected.is_empty()
+    }
+
+    /// Whether the option at `index` is selected. Out of range reads `false`.
+    pub fn is_selected(&self, index: usize) -> bool {
+        self.selected.get(index).copied().unwrap_or(false)
+    }
+
+    /// The first selected option, which is `selectedIndex` for a single select.
+    pub fn selected_index(&self) -> Option<usize> {
+        self.selected.iter().position(|selected| *selected)
+    }
+
+    /// Set one option's selectedness without touching the others. Returns
+    /// whether it changed.
+    pub fn set_selected(&mut self, index: usize, selected: bool) -> bool {
+        match self.selected.get_mut(index) {
+            Some(entry) if *entry != selected => {
+                *entry = selected;
+                true
+            }
+            _ => false,
+        }
+    }
+
+    /// Select `index` and clear every other option. Returns whether anything
+    /// changed.
+    pub fn select_only(&mut self, index: usize) -> bool {
+        if index >= self.selected.len() {
+            return false;
+        }
+        let mut changed = false;
+        for (i, entry) in self.selected.iter_mut().enumerate() {
+            let want = i == index;
+            changed |= *entry != want;
+            *entry = want;
+        }
+        changed
+    }
+
+    /// Deselect every option. Returns whether anything changed.
+    pub fn clear_selection(&mut self) -> bool {
+        let mut changed = false;
+        for entry in self.selected.iter_mut() {
+            changed |= *entry;
+            *entry = false;
+        }
+        changed
+    }
+
+    /// Whether the drop-down list is showing.
+    pub fn is_open(&self) -> bool {
+        self.open
+    }
+
+    pub fn set_open(&mut self, open: bool) {
+        self.open = open;
+    }
+}
diff --git a/packages/blitz-dom/src/resolve.rs b/packages/blitz-dom/src/resolve.rs
index 61436d38..afdf500f 100644
--- a/packages/blitz-dom/src/resolve.rs
+++ b/packages/blitz-dom/src/resolve.rs
@@ -859,6 +859,29 @@ impl BaseDocument {
                 continue;
             };
 
+            // A stacking context is assembled during a style flush and then
+            // outlives it. `flush_styles_to_layout` returns early on a
+            // `display: none` subtree, so a host hidden after its list was
+            // built never rebuilds that list, while this pass walks every node
+            // that has a context, hidden or not. Removing one of the listed
+            // children left a freed key behind, and the next resolve panicked
+            // with "invalid SlotMap key used" rather than painting one frame
+            // stale. Prune here, where the whole list is already in hand.
+            if context
+                .children
+                .iter()
+                .any(|child| !self.nodes.contains_key(child.node_id))
+            {
+                context
+                    .children
+                    .retain(|child| self.nodes.contains_key(child.node_id));
+                context.negative_z_count = context
+                    .children
+                    .iter()
+                    .take_while(|child| child.z_index < 0)
+                    .count() as u32;
+            }
+
             for child in context.children.iter_mut() {
                 let node = &self.nodes[child.node_id];
                 if node
@@ -1035,6 +1058,13 @@ impl BaseDocument {
         taffy::compute_root_layout(self, root_element_id, available_space);
         taffy::round_layout(self, root_element_id);
 
+        // Table rows and row groups are flattened into a grid of cells and
+        // never reach Taffy, so nothing wrote a layout for them at all. Describe
+        // each from the cells it holds, after rounding: `final_layout` is what
+        // every geometry query reads and the rounding pass is what fills it, so
+        // doing this any earlier reads cells that are still zero.
+        self.assign_table_row_layouts();
+
         // Taffy currently maps CSS `position: fixed` to absolute positioning,
         // which leaves the box relative to its DOM layout parent. A portal
         // mounted after a full-height application root therefore starts one
diff --git a/packages/blitz-dom/src/select.rs b/packages/blitz-dom/src/select.rs
new file mode 100644
index 00000000..879eb18d
--- /dev/null
+++ b/packages/blitz-dom/src/select.rs
@@ -0,0 +1,350 @@
+//! The `<select>` element's list of options and its selectedness.
+//!
+//! There was no notion of selectedness anywhere in the engine: an `<option>`
+//! was a `display: none` node with a `selected` attribute nobody read, so a
+//! select could be measured and pressed but could not say what it offered or
+//! what was chosen. A QA harness driving worktables.dev's schema designer had
+//! nothing to assert against and nothing to change.
+
+use crate::node::SelectData;
+use crate::traversal::TreeTraverser;
+use crate::{BaseDocument, local_name};
+use blitz_traits::node_id::NodeId;
+
+impl BaseDocument {
+    /// A select's *list of options*: every descendant `<option>` in tree order.
+    ///
+    /// A subtree walk rather than a scan of the direct children, because
+    /// `<optgroup>` nests them one level down and the flattened order is what
+    /// `selectedIndex` counts.
+    ///
+    /// Recomputed on every call rather than cached on the select. The cached
+    /// form would have to be invalidated from every mutation path that can add
+    /// or remove an option, and the walk is over a handful of nodes.
+    pub fn select_options(&self, select_id: NodeId) -> Vec<NodeId> {
+        if !self
+            .get_node(select_id)
+            .is_some_and(|node| node.data.is_element_with_tag_name(&local_name!("select")))
+        {
+            return Vec::new();
+        }
+        TreeTraverser::new_with_root(self, select_id)
+            .filter(|id| {
+                self.get_node(*id)
+                    .is_some_and(|node| node.data.is_element_with_tag_name(&local_name!("option")))
+            })
+            .collect()
+    }
+
+    /// Whether the option is disabled, either in itself or through the
+    /// `<optgroup>` containing it. A disabled option cannot be picked and is
+    /// skipped by the arrow keys.
+    pub fn option_is_disabled(&self, option_id: NodeId) -> bool {
+        let mut current = Some(option_id);
+        while let Some(id) = current {
+            let Some(node) = self.get_node(id) else {
+                return false;
+            };
+            let Some(el) = node.data.downcast_element() else {
+                return false;
+            };
+            if el.attr(local_name!("disabled")).is_some() {
+                return true;
+            }
+            if el.name.local == local_name!("select") {
+                // The select's own `disabled` is the control's, not the
+                // option's; stop before inheriting it.
+                return false;
+            }
+            current = node.parent;
+        }
+        false
+    }
+
+    /// An option's label: the `label` attribute if it has one, otherwise its
+    /// stripped-and-collapsed text. This is what the option shows and what the
+    /// accessibility tree reports as its name.
+    pub fn option_label(&self, option_id: NodeId) -> String {
+        let Some(node) = self.get_node(option_id) else {
+            return String::new();
+        };
+        if let Some(label) = node.data.downcast_element().and_then(|el| {
+            el.attr(local_name!("label"))
+                .filter(|label| !label.is_empty())
+        }) {
+            return label.to_string();
+        }
+        collapse_whitespace(&node.text_content())
+    }
+
+    /// An option's submission value: the `value` attribute if present,
+    /// otherwise its label. An empty `value=""` is a value, not an absence,
+    /// which is why this tests for the attribute rather than for a non-empty
+    /// string.
+    pub fn option_value(&self, option_id: NodeId) -> String {
+        let Some(node) = self.get_node(option_id) else {
+            return String::new();
+        };
+        if let Some(value) = node
+            .data
+            .downcast_element()
+            .and_then(|el| el.attr(local_name!("value")))
+        {
+            return value.to_string();
+        }
+        self.option_label(option_id)
+    }
+
+    /// The selectedness a freshly constructed select should start with.
+    ///
+    /// The `selected` content attribute seeds it. A single select then has to
+    /// end up with exactly one option selected if it has any enabled ones at
+    /// all: HTML's *ask for a reset* step picks the last option carrying the
+    /// attribute, or the first non-disabled option when none does. Without that
+    /// last part a plain `<select>` with no `selected` anywhere would report an
+    /// empty value, which is not what it submits or displays.
+    pub fn initial_select_data(&self, select_id: NodeId) -> SelectData {
+        let options = self.select_options(select_id);
+        let mut selected: Vec<bool> = options
+            .iter()
+            .map(|id| {
+                self.get_node(*id)
+                    .and_then(|node| node.data.downcast_element())
+                    .is_some_and(|el| el.attr(local_name!("selected")).is_some())
+            })
+            .collect();
+
+        let multiple = self
+            .get_node(select_id)
+            .and_then(|node| node.data.downcast_element())
+            .is_some_and(|el| el.attr(local_name!("multiple")).is_some());
+
+        if !multiple {
+            let last = selected.iter().rposition(|s| *s);
+            let chosen = last.or_else(|| {
+                options
+                    .iter()
+                    .position(|id| !self.option_is_disabled(*id))
+                    .filter(|_| self.select_display_size(select_id) <= 1)
+            });
+            for (i, entry) in selected.iter_mut().enumerate() {
+                *entry = Some(i) == chosen;
+            }
+        }
+
+        SelectData::new(selected)
+    }
+
+    /// The number of rows the select shows: `size`, or one for a drop-down and
+    /// four for a `multiple` list box, which is what browsers settled on.
+    ///
+    /// Only the "is this a drop-down" question is asked of it here: a list box
+    /// (`size` greater than one) does *not* auto-select its first option, while
+    /// a drop-down must, because a drop-down always displays something.
+    pub fn select_display_size(&self, select_id: NodeId) -> u32 {
+        let Some(el) = self
+            .get_node(select_id)
+            .and_then(|node| node.data.downcast_element())
+        else {
+            return 1;
+        };
+        el.attr(local_name!("size"))
+            .and_then(|size| size.parse::<u32>().ok())
+            .filter(|rows| *rows >= 1)
+            .unwrap_or(if el.attr(local_name!("multiple")).is_some() {
+                4
+            } else {
+                1
+            })
+    }
+
+    /// The node id of the select's currently selected option, if any.
+    pub fn select_selected_option(&self, select_id: NodeId) -> Option<NodeId> {
+        let data = self
+            .get_node(select_id)?
+            .data
+            .downcast_element()?
+            .select_data()?;
+        let index = data.selected_index()?;
+        self.select_options(select_id).get(index).copied()
+    }
+
+    /// A select's value: the value of its first selected option, or the empty
+    /// string when nothing is selected. This is `HTMLSelectElement.value`.
+    pub fn select_value(&self, select_id: NodeId) -> String {
+        self.select_selected_option(select_id)
+            .map(|option_id| self.option_value(option_id))
+            .unwrap_or_default()
+    }
+
+    /// The label of the select's selected option, which is what the control
+    /// displays and what the accessibility tree reports as its value.
+    pub fn select_label(&self, select_id: NodeId) -> String {
+        self.select_selected_option(select_id)
+            .map(|option_id| self.option_label(option_id))
+            .unwrap_or_default()
+    }
+
+    /// `selectedIndex`, or `None` when nothing is selected.
+    pub fn select_selected_index(&self, select_id: NodeId) -> Option<usize> {
+        self.get_node(select_id)?
+            .data
+            .downcast_element()?
+            .select_data()?
+            .selected_index()
+    }
+
+    /// Whether the option is selected, according to the parent select's live
+    /// state when it has any and the `selected` content attribute before
+    /// construction has run.
+    pub fn option_is_selected(&self, option_id: NodeId) -> bool {
+        match self.option_owner_select(option_id) {
+            Some(select_id) => {
+                let index = self
+                    .select_options(select_id)
+                    .iter()
+                    .position(|id| *id == option_id);
+                match (index, self.select_live_data(select_id)) {
+                    (Some(index), Some(data)) => data.is_selected(index),
+                    _ => self.option_has_selected_attr(option_id),
+                }
+            }
+            None => self.option_has_selected_attr(option_id),
+        }
+    }
+
+    /// The `<select>` an option belongs to, walking out through any
+    /// `<optgroup>`.
+    pub fn option_owner_select(&self, option_id: NodeId) -> Option<NodeId> {
+        let mut current = self.get_node(option_id)?.parent;
+        while let Some(id) = current {
+            let node = self.get_node(id)?;
+            if node.data.is_element_with_tag_name(&local_name!("select")) {
+                return Some(id);
+            }
+            current = node.parent;
+        }
+        None
+    }
+
+    fn select_live_data(&self, select_id: NodeId) -> Option<&SelectData> {
+        self.get_node(select_id)?
+            .data
+            .downcast_element()?
+            .select_data()
+    }
+
+    fn option_has_selected_attr(&self, option_id: NodeId) -> bool {
+        self.get_node(option_id)
+            .and_then(|node| node.data.downcast_element())
+            .is_some_and(|el| el.attr(local_name!("selected")).is_some())
+    }
+
+    /// Select the option at `index`, clearing the others on a single select.
+    /// Returns whether the selection actually changed, so a caller can decide
+    /// whether an `input` event is owed.
+    ///
+    /// Selecting a disabled option is refused rather than ignored, because the
+    /// keyboard handler steps over disabled options and a script that asks for
+    /// one directly should not end up with a value the control would never
+    /// submit.
+    pub fn set_select_selected_index(&mut self, select_id: NodeId, index: usize) -> bool {
+        let options = self.select_options(select_id);
+        if options
+            .get(index)
+            .is_none_or(|id| self.option_is_disabled(*id))
+        {
+            return false;
+        }
+        let multiple = self
+            .get_node(select_id)
+            .and_then(|node| node.data.downcast_element())
+            .is_some_and(|el| el.attr(local_name!("multiple")).is_some());
+        let option_count = options.len();
+
+        let Some(data) = self
+            .get_node_mut(select_id)
+            .and_then(|node| node.data.downcast_element_mut())
+            .and_then(|el| el.select_data_mut())
+        else {
+            return false;
+        };
+        // Construction sizes this, but a script can append an <option> and set
+        // it selected before the next resolve has run, at which point the entry
+        // does not exist yet and the write would be silently dropped.
+        data.resize(option_count);
+        if multiple {
+            data.set_selected(index, true)
+        } else {
+            data.select_only(index)
+        }
+    }
+
+    /// The index the arrow keys move to from the current selection, skipping
+    /// disabled options. `None` when there is nowhere to go.
+    pub fn select_index_step(&self, select_id: NodeId, forwards: bool) -> Option<usize> {
+        let options = self.select_options(select_id);
+        if options.is_empty() {
+            return None;
+        }
+        let current = self.select_selected_index(select_id);
+        let mut index = match current {
+            Some(current) => current as isize,
+            // With nothing selected, the first press lands on the end the key
+            // points away from rather than moving off nowhere.
+            None => {
+                return options
+                    .iter()
+                    .enumerate()
+                    .filter(|(_, id)| !self.option_is_disabled(**id))
+                    .map(|(i, _)| i)
+                    .next_back()
+                    .filter(|_| !forwards)
+                    .or_else(|| {
+                        options
+                            .iter()
+                            .position(|id| !self.option_is_disabled(*id))
+                            .filter(|_| forwards)
+                    });
+            }
+        };
+        loop {
+            index += if forwards { 1 } else { -1 };
+            if index < 0 || index as usize >= options.len() {
+                return None;
+            }
+            if !self.option_is_disabled(options[index as usize]) {
+                return Some(index as usize);
+            }
+        }
+    }
+
+    /// The first or last selectable option, for Home and End.
+    pub fn select_index_edge(&self, select_id: NodeId, last: bool) -> Option<usize> {
+        let options = self.select_options(select_id);
+        let mut enabled = options
+            .iter()
+            .enumerate()
+            .filter(|(_, id)| !self.option_is_disabled(**id))
+            .map(|(i, _)| i);
+        if last {
+            enabled.next_back()
+        } else {
+            enabled.next()
+        }
+    }
+}
+
+/// Strip and collapse the way an option's label is rendered. Authors indent
+/// their markup, so the raw text of `<option>\n  France\n</option>` is neither
+/// what is shown nor what is submitted.
+fn collapse_whitespace(text: &str) -> String {
+    let mut out = String::with_capacity(text.len());
+    for word in text.split_whitespace() {
+        if !out.is_empty() {
+            out.push(' ');
+        }
+        out.push_str(word);
+    }
+    out
+}
diff --git a/packages/blitz-script/Cargo.toml b/packages/blitz-script/Cargo.toml
index 14e75903..495d13a3 100644
--- a/packages/blitz-script/Cargo.toml
+++ b/packages/blitz-script/Cargo.toml
@@ -86,6 +86,7 @@ blitz-paint = { workspace = true }
 blitz-traits = { workspace = true }
 image = { workspace = true, features = ["png"] }
 keyboard-types = { workspace = true }
+markup5ever = { workspace = true }
 url = { workspace = true }
 
 # Only on macOS, and only for `tests/text_metrics_macos.rs`, which measures
diff --git a/packages/blitz-script/src/dom/element.rs b/packages/blitz-script/src/dom/element.rs
index 505621a9..f63c7314 100644
--- a/packages/blitz-script/src/dom/element.rs
+++ b/packages/blitz-script/src/dom/element.rs
@@ -40,6 +40,21 @@ pub(crate) fn init_element_proto(proto: &JsObject, context: &mut Context) {
         Some(set_checked),
         context,
     );
+    define_accessor(
+        proto,
+        "selectedIndex",
+        Some(get_selected_index),
+        Some(set_selected_index),
+        context,
+    );
+    define_accessor(
+        proto,
+        "selected",
+        Some(get_selected),
+        Some(set_selected),
+        context,
+    );
+    define_accessor(proto, "options", Some(get_options), None, context);
     define_accessor(
         proto,
         "disabled",
@@ -122,6 +137,7 @@ pub(crate) fn init_element_proto(proto: &JsObject, context: &mut Context) {
     define_method(proto, "hasAttribute", 1, has_attribute, context);
     define_method(proto, "focus", 0, focus, context);
     define_method(proto, "blur", 0, blur, context);
+    define_method(proto, "scrollIntoView", 1, scroll_into_view, context);
     define_method(
         proto,
         "getBoundingClientRect",
@@ -483,9 +499,29 @@ fn set_autofocus(this: &JsValue, args: &[JsValue], context: &mut Context) -> JsR
     Ok(JsValue::undefined())
 }
 
+/// Whether the node is a `<select>`.
+///
+/// Tag-guarded rather than given a prototype of its own: every element shares
+/// one `Element` prototype here, exactly as `get_value` already branches on
+/// `text_input_data()` rather than on the tag having its own object.
+fn is_select(ctx: &DomCtx, node_id: NodeId) -> bool {
+    let doc = ctx.doc.borrow();
+    doc.get_node(node_id).is_some_and(|node| {
+        node.data
+            .is_element_with_tag_name(&blitz_dom::local_name!("select"))
+    })
+}
+
 fn get_value(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
     let ctx = dom_ctx(context)?;
     let node_id = this_node_id(this)?;
+    if is_select(&ctx, node_id) {
+        // A select has no `value` attribute of its own, so the generic tail
+        // below read an attribute that is never there and every picker
+        // reported the empty string.
+        let value = ctx.doc.borrow().select_value(node_id);
+        return Ok(js_str(&value));
+    }
     let value = {
         let doc = ctx.doc.borrow();
         doc.get_node(node_id)
@@ -505,9 +541,168 @@ fn get_value(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<J
 }
 
 fn set_value(this: &JsValue, args: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let node_id = this_node_id(this)?;
+    if is_select(&ctx, node_id) {
+        let value = to_rust_string(args.first().unwrap_or(&JsValue::undefined()), context)?;
+        select_by_value(&ctx, node_id, &value);
+        return Ok(JsValue::undefined());
+    }
     attr_setter("value", this, args, context)
 }
 
+/// Select the first option whose value matches, or deselect everything when
+/// none does, which is what `HTMLSelectElement.value` does on a single select.
+///
+/// Live state, then snapshot: the same rule `set_checked` is written to. The
+/// selectedness in special data is what the accessibility tree, form
+/// submission and `change` all read, and the snapshot is what asks for the
+/// restyle that a state-derived selector needs.
+fn select_by_value(ctx: &DomCtx, node_id: NodeId, value: &str) {
+    let target = {
+        let doc = ctx.doc.borrow();
+        doc.select_options(node_id)
+            .into_iter()
+            .position(|option_id| doc.option_value(option_id) == value)
+    };
+    let mut doc = ctx.mutate_doc();
+    let changed = match target {
+        Some(index) => doc.set_select_selected_index(node_id, index),
+        None => doc
+            .get_node_mut(node_id)
+            .and_then(|node| node.data.downcast_element_mut())
+            .and_then(|el| el.select_data_mut())
+            .is_some_and(|data| data.clear_selection()),
+    };
+    if changed {
+        doc.snapshot_node(node_id);
+    }
+}
+
+fn get_selected_index(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let node_id = this_node_id(this)?;
+    // -1 for "nothing selected", which is what the IDL says and what every
+    // caller comparing against a numeric index expects.
+    let index = ctx
+        .doc
+        .borrow()
+        .select_selected_index(node_id)
+        .map(|index| index as i64)
+        .unwrap_or(-1);
+    Ok(JsValue::from(index))
+}
+
+fn set_selected_index(
+    this: &JsValue,
+    args: &[JsValue],
+    context: &mut Context,
+) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let node_id = this_node_id(this)?;
+    let index = args
+        .first()
+        .map(|value| value.to_number(context))
+        .transpose()?
+        .unwrap_or(-1.0);
+
+    let mut doc = ctx.mutate_doc();
+    let changed = if index < 0.0 {
+        doc.get_node_mut(node_id)
+            .and_then(|node| node.data.downcast_element_mut())
+            .and_then(|el| el.select_data_mut())
+            .is_some_and(|data| data.clear_selection())
+    } else {
+        doc.set_select_selected_index(node_id, index as usize)
+    };
+    if changed {
+        doc.snapshot_node(node_id);
+    }
+    Ok(JsValue::undefined())
+}
+
+/// A select's `options` collection: its list of options, flattened out of any
+/// `<optgroup>`, which is what `selectedIndex` counts against.
+fn get_options(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let node_id = this_node_id(this)?;
+    let option_ids = ctx.doc.borrow().select_options(node_id);
+    let wrappers: Vec<JsValue> = option_ids
+        .into_iter()
+        .map(|option_id| node_wrapper(&ctx, option_id, context).into())
+        .collect();
+    Ok(boa_engine::object::builtins::JsArray::from_iter(wrappers, context).into())
+}
+
+fn get_selected(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let node_id = this_node_id(this)?;
+    let selected = ctx.doc.borrow().option_is_selected(node_id);
+    Ok(JsValue::from(selected))
+}
+
+fn set_selected(this: &JsValue, args: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let node_id = this_node_id(this)?;
+    let selected = args.first().map(JsValue::to_boolean).unwrap_or(false);
+
+    let owner = {
+        let doc = ctx.doc.borrow();
+        doc.option_owner_select(node_id).map(|select_id| {
+            let index = doc
+                .select_options(select_id)
+                .into_iter()
+                .position(|id| id == node_id);
+            (select_id, index)
+        })
+    };
+    let Some((select_id, Some(index))) = owner else {
+        // An option outside a select has nowhere to record selectedness, so
+        // the attribute is all there is.
+        if selected {
+            write_attr(&ctx, node_id, "selected", "");
+        } else {
+            clear_attr(&ctx, node_id, "selected");
+        }
+        return Ok(JsValue::undefined());
+    };
+
+    let mut doc = ctx.mutate_doc();
+    let has_live_state = doc
+        .get_node(select_id)
+        .and_then(|node| node.data.downcast_element())
+        .is_some_and(|el| el.select_data().is_some());
+    if has_live_state {
+        let changed = if selected {
+            doc.set_select_selected_index(select_id, index)
+        } else {
+            doc.get_node_mut(select_id)
+                .and_then(|node| node.data.downcast_element_mut())
+                .and_then(|el| el.select_data_mut())
+                .is_some_and(|data| data.set_selected(index, false))
+        };
+        if changed {
+            doc.snapshot_node(node_id);
+            doc.snapshot_node(select_id);
+        }
+        return Ok(JsValue::undefined());
+    }
+    drop(doc);
+
+    /*
+     * Before layout construction has run there is no live state, so a property
+     * write has to reach the attribute or the value is lost. `selected` is an
+     * HTML boolean attribute: present means selected whatever the value reads,
+     * which is the trap `checked` fell into where `checked="false"` came up on.
+     */
+    if selected {
+        write_attr(&ctx, node_id, "selected", "");
+    } else {
+        clear_attr(&ctx, node_id, "selected");
+    }
+    Ok(JsValue::undefined())
+}
+
 fn get_checked(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
     let ctx = dom_ctx(context)?;
     let node_id = this_node_id(this)?;
@@ -1057,6 +1252,25 @@ fn blur(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValu
     Ok(JsValue::undefined())
 }
 
+/// `scrollIntoView`, which blitz-dom has had all along as `scroll_to_node` but
+/// only ever offered to the harness. A page calling it got
+/// "TypeError: not a callable function", which is what any anchor-scrolling
+/// router, "back to top" control or validation-error focuser calls.
+///
+/// The argument (a boolean or a `ScrollIntoViewOptions`) is accepted and
+/// ignored: `scroll_to_node` lands the node at the top-left of each scrollport,
+/// which is `block: "start"`, the default. Ignoring it is what a page expects
+/// far more than throwing at it.
+fn scroll_into_view(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let node_id = this_node_id(this)?;
+    // Scrolling is a geometry operation, so the mutations script already made
+    // have to be laid out before the offsets are computed. See DomCtx::flush_layout.
+    ctx.flush_layout();
+    ctx.mutate_doc().scroll_to_node(node_id);
+    Ok(JsValue::undefined())
+}
+
 // === Geometry ===
 
 fn get_scroll_left(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
diff --git a/packages/blitz-script/src/dom/event.rs b/packages/blitz-script/src/dom/event.rs
index 0c653509..0d75ab42 100644
--- a/packages/blitz-script/src/dom/event.rs
+++ b/packages/blitz-script/src/dom/event.rs
@@ -46,6 +46,19 @@ pub(crate) fn init_event_proto(proto: &JsObject, context: &mut Context) {
         None,
         context,
     );
+    // `cancelBubble` is the legacy alias for the stop-propagation flag, and
+    // delegated dispatchers still read and write it. Without it a framework's
+    // own `stopPropagation` shim had nothing to set and nothing to check, so
+    // propagation did not actually stop: pressing a category button inside a
+    // cookie-preferences panel also ran the dismiss handler on the backdrop
+    // that contains the panel, and the whole dialog closed.
+    define_accessor(
+        proto,
+        "cancelBubble",
+        Some(get_cancel_bubble),
+        Some(set_cancel_bubble),
+        context,
+    );
 }
 
 pub(crate) fn set_event_path(event: &JsObject, path: Vec<JsObject>) {
@@ -213,6 +226,21 @@ fn stop_immediate_propagation(this: &JsValue, _: &[JsValue], _: &mut Context) ->
     Ok(JsValue::undefined())
 }
 
+fn get_cancel_bubble(this: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(
+        event_ref(this, |event| event.stopped.get()).unwrap_or(false),
+    ))
+}
+
+/// Setting it to true sets the stop-propagation flag. Setting it to false does
+/// nothing, per the DOM standard: the flag cannot be unset once raised.
+fn set_cancel_bubble(this: &JsValue, args: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    if args.first().unwrap_or(&JsValue::undefined()).to_boolean() {
+        event_ref(this, |event| event.stopped.set(true));
+    }
+    Ok(JsValue::undefined())
+}
+
 fn default_prevented(this: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
     Ok(JsValue::from(
         event_ref(this, |event| event.prevented.get()).unwrap_or(false),
diff --git a/packages/blitz-script/src/runtime.rs b/packages/blitz-script/src/runtime.rs
index 28e79b25..8bb414d6 100644
--- a/packages/blitz-script/src/runtime.rs
+++ b/packages/blitz-script/src/runtime.rs
@@ -158,6 +158,10 @@ pub(crate) struct ScriptRuntime {
     /// a failure at evaluation time would report an error against every module
     /// on the modern web that waits for anything.
     pending_modules: Vec<(JsPromise, String)>,
+    /// The value a text control held when it was focussed, so that losing
+    /// focus can tell an edited field from an untouched one. `change` is a
+    /// commit event, not a blur notification.
+    focussed_text_value: Option<(NodeId, String)>,
 }
 
 impl ScriptRuntime {
@@ -404,6 +408,7 @@ impl ScriptRuntime {
             2,
             window_remove_event_listener,
         );
+        register_global_fn(&mut context, "dispatchEvent", 1, window_dispatch_event);
         register_global_fn(&mut context, "__blitzRandomU32", 0, random_u32);
 
         let mut runtime = Self {
@@ -412,6 +417,7 @@ impl ScriptRuntime {
             diagnostics,
             module_loader,
             pending_modules: Vec::new(),
+            focussed_text_value: None,
         };
 
         // Small JS bootstrap for APIs that are easiest to define in JS
@@ -579,6 +585,12 @@ impl ScriptRuntime {
                         if (next === index) return;
                         index = next;
                         applyUrl(entries[index].url);
+                        // A traversal has to announce itself. Without this a
+                        // router's `navigate(-1)` changed the URL and nothing
+                        // redrew, so every route was one-way.
+                        const event = new Event("popstate");
+                        event.state = entries[index].state;
+                        globalThis.dispatchEvent(event);
                     },
                     back() { this.go(-1); },
                     forward() { this.go(1); },
@@ -938,9 +950,33 @@ impl ScriptRuntime {
         // Browsers fire a `change` event after `input` events on checkbox/radio
         // inputs. Blitz only generates `input` events, so synthesise the `change`
         // event here.
-        if matches!(event.data, DomEventData::Input(_))
-            && self.target_is_checkbox_or_radio(event.target)
-        {
+        //
+        // A text control commits instead: `change` fires when it loses focus
+        // having been edited, never on each keystroke. Only checkbox and radio
+        // were covered, so `change` on a text field was dead, and a phone-number
+        // field bound to it gated a Confirm button that nothing could open.
+        let synthesise_change = match &event.data {
+            DomEventData::Input(_) => {
+                // A select commits on selection, not on blur: the keystroke or
+                // the press is the commit, exactly as it is for a checkbox.
+                self.target_is_checkbox_or_radio(event.target)
+                    || self.target_is_select(event.target)
+            }
+            DomEventData::Focus(_) => {
+                self.focussed_text_value = self
+                    .text_control_value(event.target)
+                    .map(|value| (event.target, value));
+                false
+            }
+            DomEventData::Blur(_) => match self.focussed_text_value.take() {
+                Some((node_id, focussed_value)) if node_id == event.target => self
+                    .text_control_value(event.target)
+                    .is_some_and(|current| current != focussed_value),
+                _ => false,
+            },
+            _ => false,
+        };
+        if synthesise_change {
             let mut change_state = EventState::default();
             any_called |= self.dispatch_event_inner(
                 chain,
@@ -973,6 +1009,24 @@ impl ScriptRuntime {
         any_called
     }
 
+    /// The current text of a text input or textarea, or `None` for anything
+    /// that is not one.
+    fn text_control_value(&self, node_id: NodeId) -> Option<String> {
+        let doc = self.ctx.doc.borrow();
+        doc.get_node(node_id)?
+            .element_data()?
+            .text_input_data()
+            .map(|input| input.editor.text().to_string())
+    }
+
+    fn target_is_select(&self, node_id: NodeId) -> bool {
+        let doc = self.ctx.doc.borrow();
+        doc.get_node(node_id).is_some_and(|node| {
+            node.data
+                .is_element_with_tag_name(&blitz_dom::local_name!("select"))
+        })
+    }
+
     fn target_is_checkbox_or_radio(&self, node_id: NodeId) -> bool {
         let doc = self.ctx.doc.borrow();
         doc.get_node(node_id)
@@ -1498,10 +1552,51 @@ fn build_location(base_url: Option<&Url>, context: &mut Context) -> JsValue {
             Attribute::all(),
         )
         .property(js_string!("hash"), JsString::from(hash), Attribute::all())
+        // `assign`, `replace` and `reload`. Without them `location` was a plain
+        // data object, so a page calling any of the three threw a TypeError out
+        // of whatever ran it. All three go through the document's navigation
+        // provider, which is where a link click goes.
+        .function(
+            NativeFunction::from_fn_ptr(location_assign),
+            js_string!("assign"),
+            1,
+        )
+        .function(
+            NativeFunction::from_fn_ptr(location_assign),
+            js_string!("replace"),
+            1,
+        )
+        .function(
+            NativeFunction::from_fn_ptr(location_reload),
+            js_string!("reload"),
+            0,
+        )
         .build()
         .into()
 }
 
+/// Serves both `assign` and `replace`. They differ only in whether the current
+/// entry is kept in the session history, and this runtime's history is a
+/// script-level shim that a real navigation replaces wholesale either way.
+fn location_assign(_: &JsValue, args: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let url = crate::dom::to_rust_string(args.first().unwrap_or(&JsValue::undefined()), context)?;
+    if !ctx.doc.borrow().navigate_to_url(&url) {
+        return Err(JsNativeError::typ()
+            .with_message(format!("{url} is not a valid URL"))
+            .into());
+    }
+    Ok(JsValue::undefined())
+}
+
+fn location_reload(_: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let doc = ctx.doc.borrow();
+    let current = doc.current_url();
+    doc.navigate_to_url(&current);
+    Ok(JsValue::undefined())
+}
+
 fn window_inner_width(_: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
     let ctx = dom_ctx(context)?;
     let viewport = ctx.doc.borrow().get_viewport();
@@ -1619,6 +1714,69 @@ fn clear_timer(_: &JsValue, args: &[JsValue], context: &mut Context) -> JsResult
     Ok(JsValue::undefined())
 }
 
+/// `window.dispatchEvent`, which the window did not have.
+///
+/// `Node.prototype.dispatchEvent` walks a node chain and never reaches the
+/// window listeners, so there was no way at all to raise a window-targeted
+/// event, from a page or from the runtime's own `history` shim.
+fn window_dispatch_event(
+    _: &JsValue,
+    args: &[JsValue],
+    context: &mut Context,
+) -> JsResult<JsValue> {
+    let ctx = dom_ctx(context)?;
+    let event = args
+        .first()
+        .and_then(JsValue::as_object)
+        .filter(|event| event.downcast_ref::<EventRef>().is_some())
+        .ok_or_else(|| JsNativeError::typ().with_message("dispatchEvent requires an Event"))?;
+    let event_type = crate::dom::to_rust_string(&event.get(js_string!("type"), context)?, context)?;
+
+    let global: JsValue = context.global_object().into();
+    crate::dom::define_value(&event, "target", global.clone(), context);
+    crate::dom::define_value(&event, "srcElement", global.clone(), context);
+    crate::dom::define_value(&event, "currentTarget", global.clone(), context);
+    crate::dom::define_value(&event, "eventPhase", JsValue::from(2), context);
+
+    let listeners: Vec<Listener> = {
+        let mut state = ctx.state.borrow_mut();
+        match state.window_listeners.get_mut(&event_type) {
+            Some(listeners) => {
+                let cloned = listeners.clone();
+                listeners.retain(|listener| !listener.once);
+                cloned
+            }
+            None => Vec::new(),
+        }
+    };
+    for listener in listeners {
+        listener
+            .callback
+            .call(&global, &[event.clone().into()], context)?;
+        if event
+            .downcast_ref::<EventRef>()
+            .is_some_and(|event| event.stopped_immediate.get())
+        {
+            break;
+        }
+    }
+
+    // The `window.on<event>` form, which is how a page most often listens for
+    // `popstate`.
+    let on_name = JsString::from(format!("on{event_type}"));
+    if let Some(handler) = context.global_object().get(on_name, context)?.as_object()
+        && handler.is_callable()
+    {
+        handler.call(&global, &[event.clone().into()], context)?;
+    }
+
+    crate::dom::define_value(&event, "currentTarget", JsValue::null(), context);
+    let prevented = event
+        .downcast_ref::<EventRef>()
+        .is_some_and(|event| event.prevented.get());
+    Ok(JsValue::from(!prevented))
+}
+
 fn window_add_event_listener(
     _: &JsValue,
     args: &[JsValue],
diff --git a/packages/blitz-script/tests/cancel_bubble.rs b/packages/blitz-script/tests/cancel_bubble.rs
new file mode 100644
index 00000000..633a6a21
--- /dev/null
+++ b/packages/blitz-script/tests/cancel_bubble.rs
@@ -0,0 +1,124 @@
+//! `Event.cancelBubble`, the legacy alias for the stop-propagation flag.
+//!
+//! Absent from both the shim and the bundled framework, so a delegated
+//! dispatcher had nothing to read and `stopPropagation` did not hold. Measured
+//! on two sites: pressing a cookie-preferences category dismissed the whole
+//! dialog, because the closing backdrop is an ancestor of the panel.
+
+use blitz_dom::{Document, DocumentConfig};
+use blitz_script::ScriptDocument;
+use blitz_traits::events::{DomEvent, DomEventData};
+
+fn doc_from_html(html: &str) -> ScriptDocument {
+    // A real viewport: a zero-width one gives every box a zero content size, so
+    // nothing overflows and nothing scrolls.
+    let mut doc = ScriptDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(blitz_traits::shell::Viewport::new(
+                800,
+                600,
+                1.0,
+                blitz_traits::shell::ColorScheme::Light,
+            )),
+            ..Default::default()
+        },
+    );
+    doc.execute_scripts();
+    doc
+}
+
+fn text_of_selector(doc: &ScriptDocument, selector: &str) -> String {
+    let inner = doc.inner();
+    let node_id = inner
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    inner.get_node(node_id).unwrap().text_content()
+}
+
+#[test]
+fn cancel_bubble_reads_and_writes_the_stop_propagation_flag() {
+    let mut doc = doc_from_html(
+        r#"
+        <html><body>
+            <div id="backdrop"><button id="category">Analytics</button></div>
+            <div id="out"></div>
+            <script>
+                const out = document.getElementById("out");
+                document.getElementById("category").addEventListener("click", (event) => {
+                    event.stopPropagation();
+                    out.textContent += "category:" + event.cancelBubble + "|";
+                });
+                document.getElementById("backdrop").addEventListener("click", () => {
+                    out.textContent += "backdrop|";
+                });
+            </script>
+        </body></html>
+        "#,
+    );
+
+    let (category, pointer) = {
+        let inner = doc.inner();
+        let category = inner.query_selector("#category").unwrap().unwrap();
+        let pointer = match inner
+            .get_node(category)
+            .unwrap()
+            .synthetic_click_event(keyboard_types::Modifiers::empty())
+        {
+            DomEventData::Click(pointer) => pointer,
+            _ => unreachable!(),
+        };
+        (category, pointer)
+    };
+    doc.dispatch_dom_event(DomEvent::new(category, DomEventData::Click(pointer)));
+
+    assert_eq!(
+        text_of_selector(&doc, "#out"),
+        "category:true|",
+        "cancelBubble must report the stop-propagation flag, and the ancestor must not run"
+    );
+}
+
+#[test]
+fn setting_cancel_bubble_stops_propagation() {
+    let mut doc = doc_from_html(
+        r#"
+        <html><body>
+            <div id="backdrop"><button id="category">Analytics</button></div>
+            <div id="out"></div>
+            <script>
+                const out = document.getElementById("out");
+                document.getElementById("category").addEventListener("click", (event) => {
+                    event.cancelBubble = true;
+                    out.textContent += "category|";
+                });
+                document.getElementById("backdrop").addEventListener("click", () => {
+                    out.textContent += "backdrop|";
+                });
+            </script>
+        </body></html>
+        "#,
+    );
+
+    let (category, pointer) = {
+        let inner = doc.inner();
+        let category = inner.query_selector("#category").unwrap().unwrap();
+        let pointer = match inner
+            .get_node(category)
+            .unwrap()
+            .synthetic_click_event(keyboard_types::Modifiers::empty())
+        {
+            DomEventData::Click(pointer) => pointer,
+            _ => unreachable!(),
+        };
+        (category, pointer)
+    };
+    doc.dispatch_dom_event(DomEvent::new(category, DomEventData::Click(pointer)));
+
+    assert_eq!(
+        text_of_selector(&doc, "#out"),
+        "category|",
+        "the backdrop is an ancestor of the panel, so a dismiss handler on it must not run"
+    );
+}
diff --git a/packages/blitz-script/tests/location_navigation.rs b/packages/blitz-script/tests/location_navigation.rs
new file mode 100644
index 00000000..1dc94203
--- /dev/null
+++ b/packages/blitz-script/tests/location_navigation.rs
@@ -0,0 +1,66 @@
+//! `location.assign`, `location.replace` and `location.reload`. `location`
+//! was a plain data object, so a page calling any of the three threw.
+
+use blitz_dom::{Document, DocumentConfig};
+use blitz_script::ScriptDocument;
+use blitz_traits::navigation::{NavigationOptions, NavigationProvider};
+use std::sync::{Arc, Mutex};
+
+fn text_of_selector(doc: &ScriptDocument, selector: &str) -> String {
+    let inner = doc.inner();
+    let node_id = inner
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    inner.get_node(node_id).unwrap().text_content()
+}
+
+#[derive(Default)]
+struct RecordingNavigation {
+    navigations: Mutex<Vec<String>>,
+}
+
+impl NavigationProvider for RecordingNavigation {
+    fn navigate_to(&self, options: NavigationOptions) {
+        self.navigations
+            .lock()
+            .unwrap()
+            .push(options.url.to_string());
+    }
+}
+
+#[test]
+fn location_exposes_assign_replace_and_reload() {
+    let navigation = Arc::new(RecordingNavigation::default());
+    let mut doc = ScriptDocument::from_html(
+        r#"
+        <html><body>
+            <div id="out"></div>
+            <script>
+                const out = document.getElementById("out");
+                const shape = ["assign", "replace", "reload"]
+                    .map((name) => name + ":" + typeof location[name])
+                    .join("|");
+                out.textContent = shape;
+                location.assign("/next");
+            </script>
+        </body></html>
+        "#,
+        DocumentConfig {
+            navigation_provider: Some(Arc::clone(&navigation) as Arc<dyn NavigationProvider>),
+            base_url: Some("https://example.test/page".to_string()),
+            ..Default::default()
+        },
+    );
+    doc.execute_scripts();
+
+    assert_eq!(
+        text_of_selector(&doc, "#out"),
+        "assign:function|replace:function|reload:function"
+    );
+    assert_eq!(
+        navigation.navigations.lock().unwrap().as_slice(),
+        ["https://example.test/next"],
+        "location.assign must reach the navigation provider"
+    );
+}
diff --git a/packages/blitz-script/tests/popstate.rs b/packages/blitz-script/tests/popstate.rs
new file mode 100644
index 00000000..483557d7
--- /dev/null
+++ b/packages/blitz-script/tests/popstate.rs
@@ -0,0 +1,61 @@
+//! `history.back` and `history.forward` must dispatch `popstate`.
+//!
+//! Without it a router's `navigate(-1)` changed the URL and nothing redrew, so
+//! every route was one-way.
+
+use blitz_dom::{Document, DocumentConfig};
+use blitz_script::ScriptDocument;
+
+fn doc_from_html(html: &str) -> ScriptDocument {
+    // A real viewport: a zero-width one gives every box a zero content size, so
+    // nothing overflows and nothing scrolls.
+    let mut doc = ScriptDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(blitz_traits::shell::Viewport::new(
+                800,
+                600,
+                1.0,
+                blitz_traits::shell::ColorScheme::Light,
+            )),
+            ..Default::default()
+        },
+    );
+    doc.execute_scripts();
+    doc
+}
+
+fn text_of_selector(doc: &ScriptDocument, selector: &str) -> String {
+    let inner = doc.inner();
+    let node_id = inner
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    inner.get_node(node_id).unwrap().text_content()
+}
+
+#[test]
+fn history_back_dispatches_popstate() {
+    let doc = doc_from_html(
+        r#"
+        <html><body>
+            <div id="out"></div>
+            <script>
+                const out = document.getElementById("out");
+                addEventListener("popstate", (event) => {
+                    out.textContent += "pop:" + JSON.stringify(event.state) + "|";
+                });
+                history.pushState({ route: "b" }, "", "/b");
+                history.back();
+                history.forward();
+            </script>
+        </body></html>
+        "#,
+    );
+
+    assert_eq!(
+        text_of_selector(&doc, "#out"),
+        "pop:null|pop:{\"route\":\"b\"}|",
+        "a traversal must announce itself, or a router never redraws"
+    );
+}
diff --git a/packages/blitz-script/tests/scroll_into_view.rs b/packages/blitz-script/tests/scroll_into_view.rs
new file mode 100644
index 00000000..3e65bda7
--- /dev/null
+++ b/packages/blitz-script/tests/scroll_into_view.rs
@@ -0,0 +1,90 @@
+//! `scrollIntoView` on an element, which blitz-dom has had all along as
+//! `scroll_to_node` but never exposed to page script. A page calling it got
+//! "TypeError: not a callable function", which is what an anchor-scrolling
+//! router, a "back to top" control and a validation-error focuser all call.
+
+use blitz_dom::{Document, DocumentConfig};
+use blitz_script::ScriptDocument;
+use blitz_traits::events::{DomEvent, DomEventData};
+
+fn doc_from_html(html: &str) -> ScriptDocument {
+    // A real viewport: a zero-width one gives every box a zero content size, so
+    // nothing overflows and nothing scrolls.
+    let mut doc = ScriptDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(blitz_traits::shell::Viewport::new(
+                800,
+                600,
+                1.0,
+                blitz_traits::shell::ColorScheme::Light,
+            )),
+            ..Default::default()
+        },
+    );
+    doc.execute_scripts();
+    doc
+}
+
+fn text_of_selector(doc: &ScriptDocument, selector: &str) -> String {
+    let inner = doc.inner();
+    let node_id = inner
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    inner.get_node(node_id).unwrap().text_content()
+}
+
+#[test]
+fn scroll_into_view_is_callable_from_page_script() {
+    let mut doc = doc_from_html(
+        r#"
+        <html><body style="margin:0">
+            <div id="pane" style="height:100px; overflow:scroll">
+                <div style="height:400px"></div>
+                <div id="target" style="height:20px">target</div>
+            </div>
+            <button id="jump">jump</button>
+            <div id="out"></div>
+            <script>
+                const out = document.getElementById("out");
+                document.getElementById("jump").addEventListener("click", () => {
+                    try {
+                        document.getElementById("target").scrollIntoView({ behavior: "instant" });
+                        out.textContent = "called";
+                    } catch (error) {
+                        out.textContent = "threw:" + error;
+                    }
+                });
+            </script>
+        </body></html>
+        "#,
+    );
+    doc.inner_mut().resolve(0.0);
+
+    let (jump, pointer) = {
+        let inner = doc.inner();
+        let jump = inner.query_selector("#jump").unwrap().unwrap();
+        let pointer = match inner
+            .get_node(jump)
+            .unwrap()
+            .synthetic_click_event(keyboard_types::Modifiers::empty())
+        {
+            DomEventData::Click(pointer) => pointer,
+            _ => unreachable!(),
+        };
+        (jump, pointer)
+    };
+    doc.dispatch_dom_event(DomEvent::new(jump, DomEventData::Click(pointer)));
+
+    assert_eq!(text_of_selector(&doc, "#out"), "called");
+    let scrolled = {
+        let inner = doc.inner();
+        let pane = inner.query_selector("#pane").unwrap().unwrap();
+        inner.get_node(pane).unwrap().scroll_offset().y
+    };
+    assert!(
+        scrolled > 0.0,
+        "scrollIntoView must move the nearest scroll container, not just return"
+    );
+}
diff --git a/packages/blitz-script/tests/select_change.rs b/packages/blitz-script/tests/select_change.rs
new file mode 100644
index 00000000..be57cc16
--- /dev/null
+++ b/packages/blitz-script/tests/select_change.rs
@@ -0,0 +1,106 @@
+//! `change` on a `<select>`.
+//!
+//! `change` was synthesised only for checkbox and radio, so a picker fired
+//! nothing at all when the user chose something. A select commits immediately
+//! rather than on blur, like a checkbox and unlike a text control: the
+//! keystroke is the commit.
+
+use blitz_dom::{Document, DocumentConfig};
+use blitz_script::ScriptDocument;
+use blitz_traits::events::{BlitzKeyEvent, KeyState, UiEvent};
+use keyboard_types::{Code, Key, Location, Modifiers};
+
+fn doc_from_html(html: &str) -> ScriptDocument {
+    let mut doc = ScriptDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(blitz_traits::shell::Viewport::new(
+                800,
+                600,
+                1.0,
+                blitz_traits::shell::ColorScheme::Light,
+            )),
+            ..Default::default()
+        },
+    );
+    // Resolve before the scripts run: the live selectedness a select reports
+    // is created by layout construction.
+    doc.inner_mut().resolve(0.0);
+    doc.execute_scripts();
+    doc
+}
+
+fn text_of(doc: &ScriptDocument, selector: &str) -> String {
+    let inner = doc.inner();
+    let node_id = inner
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    inner.get_node(node_id).unwrap().text_content()
+}
+
+fn key(key: Key, state: KeyState) -> BlitzKeyEvent {
+    BlitzKeyEvent {
+        key: key.clone(),
+        code: match key {
+            Key::ArrowDown => Code::ArrowDown,
+            Key::ArrowUp => Code::ArrowUp,
+            _ => Code::Unidentified,
+        },
+        modifiers: Modifiers::empty(),
+        location: Location::Standard,
+        is_auto_repeating: false,
+        is_composing: false,
+        state,
+        text: None,
+    }
+}
+
+const PAGE: &str = r#"
+    <html><body>
+        <select id="country">
+            <option value="us">United States</option>
+            <option value="fr">France</option>
+        </select>
+        <div id="out"></div>
+        <script>
+            const out = document.getElementById("out");
+            const select = document.getElementById("country");
+            select.addEventListener("input", () => { out.textContent += "input|"; });
+            select.addEventListener("change", (event) => {
+                out.textContent += "change:" + event.target.value + "|";
+            });
+        </script>
+    </body></html>
+"#;
+
+fn press_arrow_down(doc: &mut ScriptDocument) {
+    let select = doc.inner().query_selector("#country").unwrap().unwrap();
+    doc.inner_mut().set_focus_to(select);
+    doc.handle_ui_event(UiEvent::KeyDown(key(Key::ArrowDown, KeyState::Pressed)));
+    doc.handle_ui_event(UiEvent::KeyUp(key(Key::ArrowDown, KeyState::Released)));
+}
+
+#[test]
+fn a_keyboard_selection_fires_input_and_then_change() {
+    let mut doc = doc_from_html(PAGE);
+    press_arrow_down(&mut doc);
+
+    assert_eq!(
+        text_of(&doc, "#out"),
+        "input|change:fr|",
+        "a select commits on selection, so change must follow input immediately"
+    );
+}
+
+#[test]
+fn a_keystroke_that_changes_nothing_fires_nothing() {
+    let mut doc = doc_from_html(PAGE);
+    // Already on the last option after one press, so the second has nowhere to
+    // go: a select does not wrap, and an event for a selection that did not
+    // move would make every `change` listener fire on a no-op.
+    press_arrow_down(&mut doc);
+    press_arrow_down(&mut doc);
+
+    assert_eq!(text_of(&doc, "#out"), "input|change:fr|");
+}
diff --git a/packages/blitz-script/tests/select_properties.rs b/packages/blitz-script/tests/select_properties.rs
new file mode 100644
index 00000000..03566732
--- /dev/null
+++ b/packages/blitz-script/tests/select_properties.rs
@@ -0,0 +1,145 @@
+//! `HTMLSelectElement` and `HTMLOptionElement` properties.
+//!
+//! `HTMLSelectElement` existed only as an `instanceof` brand. `select.value`
+//! fell through to the generic attribute read, and a select has no `value`
+//! attribute, so every picker reported the empty string; there was no
+//! `selectedIndex`, no `options`, and no `option.selected` at all. A
+//! controlled component rendering a `<select>` from its own state could
+//! neither read what it showed nor drive it.
+
+use blitz_dom::{Document, DocumentConfig};
+use blitz_script::ScriptDocument;
+
+fn doc_from_html(html: &str) -> ScriptDocument {
+    let mut doc = ScriptDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(blitz_traits::shell::Viewport::new(
+                800,
+                600,
+                1.0,
+                blitz_traits::shell::ColorScheme::Light,
+            )),
+            ..Default::default()
+        },
+    );
+    // Resolve before the scripts run: the live selectedness is created by
+    // layout construction, so a script that reads a select before the first
+    // resolve is reading the pre-construction fallback.
+    doc.inner_mut().resolve(0.0);
+    doc.execute_scripts();
+    doc
+}
+
+fn text_of(doc: &ScriptDocument, selector: &str) -> String {
+    let inner = doc.inner();
+    let node_id = inner
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    inner.get_node(node_id).unwrap().text_content()
+}
+
+const PICKER: &str = r#"
+    <select id="country">
+        <option value="us">United States</option>
+        <option value="fr" selected>France</option>
+        <option value="jp">Japan</option>
+    </select>
+    <div id="out"></div>
+"#;
+
+fn run(script: &str) -> String {
+    let doc = doc_from_html(&format!(
+        "<html><body>{PICKER}<script>const out = document.getElementById(\"out\");{script}</script></body></html>"
+    ));
+    text_of(&doc, "#out")
+}
+
+#[test]
+fn a_select_reports_the_selected_options_value() {
+    assert_eq!(
+        run(r#"out.textContent = document.getElementById("country").value;"#),
+        "fr"
+    );
+}
+
+#[test]
+fn a_select_reports_its_selected_index() {
+    assert_eq!(
+        run(r#"out.textContent = String(document.getElementById("country").selectedIndex);"#),
+        "1"
+    );
+}
+
+#[test]
+fn setting_value_moves_the_selection() {
+    assert_eq!(
+        run(r#"
+            const select = document.getElementById("country");
+            select.value = "jp";
+            out.textContent = select.value + ":" + select.selectedIndex;
+        "#),
+        "jp:2"
+    );
+}
+
+#[test]
+fn setting_a_value_no_option_carries_clears_the_selection() {
+    assert_eq!(
+        run(r#"
+            const select = document.getElementById("country");
+            select.value = "nowhere";
+            out.textContent = "[" + select.value + "]:" + select.selectedIndex;
+        "#),
+        "[]:-1",
+        "a value no option carries deselects everything, and selectedIndex is then -1"
+    );
+}
+
+#[test]
+fn setting_selected_index_moves_the_selection() {
+    assert_eq!(
+        run(r#"
+            const select = document.getElementById("country");
+            select.selectedIndex = 0;
+            out.textContent = select.value;
+        "#),
+        "us"
+    );
+}
+
+#[test]
+fn options_lists_every_option_in_order() {
+    assert_eq!(
+        run(r#"
+            const select = document.getElementById("country");
+            out.textContent = select.options.map((o) => o.value).join(",");
+        "#),
+        "us,fr,jp"
+    );
+}
+
+#[test]
+fn an_options_selected_property_reads_the_live_state() {
+    assert_eq!(
+        run(r#"
+            const select = document.getElementById("country");
+            out.textContent = select.options.map((o) => o.selected).join(",");
+        "#),
+        "false,true,false"
+    );
+}
+
+#[test]
+fn setting_an_options_selected_property_moves_the_selection() {
+    assert_eq!(
+        run(r#"
+            const select = document.getElementById("country");
+            select.options[2].selected = true;
+            out.textContent = select.value + ":" + select.options.map((o) => o.selected).join(",");
+        "#),
+        "jp:false,false,true",
+        "selecting one option on a single select must clear the others"
+    );
+}
diff --git a/packages/blitz-script/tests/text_input_change.rs b/packages/blitz-script/tests/text_input_change.rs
new file mode 100644
index 00000000..97b14234
--- /dev/null
+++ b/packages/blitz-script/tests/text_input_change.rs
@@ -0,0 +1,121 @@
+//! `change` on a text control.
+//!
+//! It was synthesised only for checkbox and radio, so any `onChange` on a text
+//! field was dead. That shipped a product bug: a phone-number field bound to
+//! `change` gated a Confirm button that nothing could ever open.
+
+use blitz_dom::{Document, DocumentConfig};
+use blitz_script::ScriptDocument;
+use blitz_traits::events::{DomEvent, DomEventData};
+
+fn doc_from_html(html: &str) -> ScriptDocument {
+    // A real viewport: a zero-width one gives every box a zero content size, so
+    // nothing overflows and nothing scrolls.
+    let mut doc = ScriptDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(blitz_traits::shell::Viewport::new(
+                800,
+                600,
+                1.0,
+                blitz_traits::shell::ColorScheme::Light,
+            )),
+            ..Default::default()
+        },
+    );
+    doc.execute_scripts();
+    doc
+}
+
+fn text_of_selector(doc: &ScriptDocument, selector: &str) -> String {
+    let inner = doc.inner();
+    let node_id = inner
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    inner.get_node(node_id).unwrap().text_content()
+}
+
+#[test]
+fn a_text_input_fires_change_when_it_loses_focus_with_a_new_value() {
+    let mut doc = doc_from_html(
+        r#"
+        <html><body>
+            <input id="phone" type="tel">
+            <div id="out"></div>
+            <script>
+                const out = document.getElementById("out");
+                document.getElementById("phone").addEventListener("change", (event) => {
+                    out.textContent += "change:" + event.target.value + "|";
+                });
+                document.getElementById("phone").addEventListener("input", () => {
+                    out.textContent += "input|";
+                });
+            </script>
+        </body></html>
+        "#,
+    );
+
+    doc.inner_mut().resolve(0.0);
+    let phone = doc.inner().query_selector("#phone").unwrap().unwrap();
+    doc.dispatch_dom_event(DomEvent::new(
+        phone,
+        DomEventData::Focus(blitz_traits::events::BlitzFocusEvent),
+    ));
+    doc.inner_mut().mutate().set_attribute(
+        phone,
+        markup5ever::QualName::new(None, markup5ever::ns!(), markup5ever::local_name!("value")),
+        "555",
+    );
+    doc.dispatch_dom_event(DomEvent::new(
+        phone,
+        DomEventData::Input(blitz_traits::events::BlitzInputEvent {
+            value: "555".to_string(),
+        }),
+    ));
+    doc.dispatch_dom_event(DomEvent::new(
+        phone,
+        DomEventData::Blur(blitz_traits::events::BlitzFocusEvent),
+    ));
+
+    assert_eq!(
+        text_of_selector(&doc, "#out"),
+        "input|change:555|",
+        "a text field must commit a change event, or an onChange gate can never open"
+    );
+}
+
+#[test]
+fn an_unedited_text_input_does_not_fire_change_on_blur() {
+    let mut doc = doc_from_html(
+        r#"
+        <html><body>
+            <input id="phone" type="tel" value="555">
+            <div id="out"></div>
+            <script>
+                const out = document.getElementById("out");
+                document.getElementById("phone").addEventListener("change", () => {
+                    out.textContent += "change|";
+                });
+            </script>
+        </body></html>
+        "#,
+    );
+
+    doc.inner_mut().resolve(0.0);
+    let phone = doc.inner().query_selector("#phone").unwrap().unwrap();
+    doc.dispatch_dom_event(DomEvent::new(
+        phone,
+        DomEventData::Focus(blitz_traits::events::BlitzFocusEvent),
+    ));
+    doc.dispatch_dom_event(DomEvent::new(
+        phone,
+        DomEventData::Blur(blitz_traits::events::BlitzFocusEvent),
+    ));
+
+    assert_eq!(
+        text_of_selector(&doc, "#out"),
+        "",
+        "change is a commit, not a blur notification"
+    );
+}
diff --git a/tests/blitz-tests/tests/display_block_table.rs b/tests/blitz-tests/tests/display_block_table.rs
new file mode 100644
index 00000000..5d398b43
--- /dev/null
+++ b/tests/blitz-tests/tests/display_block_table.rs
@@ -0,0 +1,94 @@
+//! `table { display: block }` still lays its rows out as a table.
+//!
+//! This is the standard wide-table horizontal-scroll pattern, and it made every
+//! row render SIDE BY SIDE: the header row on one line, then six data rows all
+//! at the same y and at increasing x. With the table no longer a table, its
+//! `thead` and `tbody` were plain children of a block, and their own displays
+//! (`table-header-group`, `table-row-group`) have no mapping in the style
+//! conversion, so they fell through to Taffy's default, which is flex. A flex
+//! container lays its items out in a row.
+//!
+//! CSS 2.1 17.2.1 requires an anonymous table box to be generated around
+//! misparented table-internal boxes instead.
+
+use blitz_dom::DocumentConfig;
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use std::sync::Arc;
+
+const HTML: &str = r#"<!DOCTYPE html>
+<html><head><style>
+    body { margin: 0 }
+    .doc-prose table { display: block; overflow-x: auto }
+    td, th { padding: 0; height: 20px; width: 100px }
+</style></head>
+<body>
+    <div class="doc-prose">
+        <table>
+            <thead><tr><th id="h1">Name</th><th id="h2">Size</th></tr></thead>
+            <tbody>
+                <tr><td id="a1">alpha</td><td id="a2">1</td></tr>
+                <tr><td id="b1">beta</td><td id="b2">2</td></tr>
+            </tbody>
+        </table>
+    </div>
+</body></html>
+"#;
+
+fn origin(doc: &HtmlDocument, selector: &str) -> (f32, f32) {
+    let node_id = doc
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    let position = doc.get_node(node_id).unwrap().absolute_position(0.0, 0.0);
+    (position.x, position.y)
+}
+
+#[test]
+fn rows_stack_when_the_table_is_display_block() {
+    let mut doc = HtmlDocument::from_html(
+        HTML,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+
+    let head = origin(&doc, "#h1");
+    let first = origin(&doc, "#a1");
+    let second = origin(&doc, "#b1");
+
+    assert!(
+        head.1 < first.1 && first.1 < second.1,
+        "rows must stack, not sit side by side: header {head:?} first {first:?} second {second:?}"
+    );
+    assert_eq!(
+        (head.0, first.0),
+        (first.0, second.0),
+        "the first cell of every row starts at the same x"
+    );
+}
+
+#[test]
+fn cells_sit_side_by_side_when_the_table_is_display_block() {
+    let mut doc = HtmlDocument::from_html(
+        HTML,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+
+    let left = origin(&doc, "#a1");
+    let right = origin(&doc, "#a2");
+
+    assert_eq!(left.1, right.1, "cells in one row share a baseline");
+    assert!(
+        right.0 > left.0,
+        "the second cell is to the right of the first: {left:?} {right:?}"
+    );
+}
diff --git a/tests/blitz-tests/tests/hoisted_child_survives_removal.rs b/tests/blitz-tests/tests/hoisted_child_survives_removal.rs
new file mode 100644
index 00000000..8471a159
--- /dev/null
+++ b/tests/blitz-tests/tests/hoisted_child_survives_removal.rs
@@ -0,0 +1,83 @@
+//! A stacking context must not outlive the nodes it lists.
+//!
+//! `flush_styles_to_layout` returns early on a `display: none` subtree, so a
+//! stacking-context host inside one keeps the child list it was given on the
+//! frame before it was hidden. `resolve_hoisted_positions` walks every node
+//! that has a stacking context, hidden or not, and indexed the slab directly,
+//! so removing one of those listed children panicked with
+//! "invalid SlotMap key used" at resolve.rs:863 on the very next resolve.
+//!
+//! Reported from a signup page whose header menu switched language English,
+//! Spanish, English and then opened a chat launcher: 6 crashes out of 6 runs.
+//! The shape reproduced here is that sequence with the site removed.
+
+use blitz_dom::DocumentConfig;
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use markup5ever::{QualName, local_name, ns};
+use std::sync::Arc;
+
+const HTML: &str = r#"<!DOCTYPE html>
+<html><head><style>
+    body { margin: 0 }
+    #panel { position: relative; z-index: 0; width: 200px; height: 200px }
+    #raised { position: absolute; z-index: 3; top: 10px; left: 10px;
+              width: 40px; height: 40px; background: red }
+</style></head>
+<body>
+    <div id="menu">
+        <div id="panel"><div id="raised"></div></div>
+    </div>
+</body></html>
+"#;
+
+#[test]
+fn removing_a_hoisted_child_of_a_hidden_stacking_context_does_not_panic() {
+    let mut doc = HtmlDocument::from_html(
+        HTML,
+        DocumentConfig {
+            viewport: Some(Viewport::new(600, 400, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+
+    let menu = doc.query_selector("#menu").unwrap().expect("menu");
+    let panel = doc.query_selector("#panel").unwrap().expect("panel");
+    let raised = doc.query_selector("#raised").unwrap().expect("raised");
+
+    assert!(
+        doc.get_node(panel)
+            .unwrap()
+            .stacking_context
+            .as_ref()
+            .is_some_and(|context| context.children.iter().any(|child| child.node_id == raised)),
+        "fixture must hoist #raised into #panel's stacking context"
+    );
+
+    // Hide the menu. The walk stops at it, so #panel keeps the child list it
+    // was handed before it went away.
+    doc.mutate().set_attribute(
+        menu,
+        QualName::new(None, ns!(), local_name!("style")),
+        "display: none",
+    );
+    doc.resolve(0.0);
+
+    // Now drop the hoisted child, exactly as a re-render of the hidden subtree
+    // would.
+    doc.mutate().remove_and_drop_node(raised);
+
+    // Panicked here before: nothing pruned #panel's list.
+    doc.resolve(0.0);
+
+    assert!(
+        doc.get_node(panel)
+            .unwrap()
+            .stacking_context
+            .as_ref()
+            .is_none_or(|context| context.children.iter().all(|child| child.node_id != raised)),
+        "the removed child must not stay in the stacking context"
+    );
+}
diff --git a/tests/blitz-tests/tests/hover_pointer_move_repaint.rs b/tests/blitz-tests/tests/hover_pointer_move_repaint.rs
new file mode 100644
index 00000000..e9f3b597
--- /dev/null
+++ b/tests/blitz-tests/tests/hover_pointer_move_repaint.rs
@@ -0,0 +1,105 @@
+//! Hover driven the way a host drives it: a `UiEvent::PointerMove`, then a
+//! resolve, then a paint.
+//!
+//! `hover_media.rs` already proves `@media (hover: hover)` evaluates true and
+//! that `set_hover_to` restyles. That is not the path a host takes. This is,
+//! including the case a component library actually ships: the hover colour on a
+//! CSS custom property, read by a rule on the element itself.
+
+use anyrender::render_to_buffer;
+use anyrender_vello_cpu::VelloCpuImageRenderer;
+use blitz_dom::{Document, DocumentConfig};
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_paint::paint_scene;
+use blitz_traits::events::{
+    BlitzPointerEvent, BlitzPointerId, MouseEventButton, MouseEventButtons, Point, PointerCoords,
+    PointerDetails, UiEvent,
+};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use std::sync::Arc;
+
+fn pixel(doc: &mut HtmlDocument) -> [u8; 3] {
+    let buffer = render_to_buffer::<VelloCpuImageRenderer, _>(
+        |scene| paint_scene(scene, doc, 1.0, 200, 100, 0, 0),
+        200,
+        100,
+    );
+    let offset = 40 * 200 * 4 + 40 * 4;
+    [buffer[offset], buffer[offset + 1], buffer[offset + 2]]
+}
+
+fn pointer_move(x: f32, y: f32) -> UiEvent {
+    UiEvent::PointerMove(BlitzPointerEvent {
+        id: BlitzPointerId::Mouse,
+        is_primary: true,
+        coords: PointerCoords {
+            page_x: x,
+            page_y: y,
+            screen_x: x,
+            screen_y: y,
+            client_x: x,
+            client_y: y,
+        },
+        button: MouseEventButton::Main,
+        buttons: MouseEventButtons::empty(),
+        mods: Default::default(),
+        details: PointerDetails::default(),
+        element: Point::default(),
+        active_pointers: Default::default(),
+    })
+}
+
+fn doc_from(html: &str) -> HtmlDocument {
+    HtmlDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(Viewport::new(200, 100, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    )
+}
+
+#[test]
+fn a_pointer_move_repaints_a_hover_rule() {
+    let mut doc = doc_from(
+        r#"<html><head><style>
+          body { margin: 0; background: white }
+          button { width: 80px; height: 80px; background: #0000ff }
+          @media (hover: hover) { button:hover { background: #ff0000 } }
+        </style></head><body><button><span>close</span></button></body></html>"#,
+    );
+    doc.resolve(0.0);
+    assert_eq!(pixel(&mut doc), [0, 0, 255]);
+
+    doc.handle_ui_event(pointer_move(40.0, 40.0));
+    doc.resolve(0.0);
+    assert_eq!(
+        pixel(&mut doc),
+        [255, 0, 0],
+        "a pointer move must leave the hover rule in the next painted frame"
+    );
+}
+
+#[test]
+fn a_pointer_move_repaints_a_hover_rule_written_through_a_custom_property() {
+    let mut doc = doc_from(
+        r#"<html><head><style>
+          body { margin: 0; background: white }
+          :root { --button-bg: #0000ff; --button-bg-hover: #0000ff }
+          @media (hover: hover) { :root { --button-bg-hover: #ff0000 } }
+          button { width: 80px; height: 80px; background: var(--button-bg) }
+          button:hover { background: var(--button-bg-hover) }
+        </style></head><body><button><span>close</span></button></body></html>"#,
+    );
+    doc.resolve(0.0);
+    assert_eq!(pixel(&mut doc), [0, 0, 255]);
+
+    doc.handle_ui_event(pointer_move(40.0, 40.0));
+    doc.resolve(0.0);
+    assert_eq!(
+        pixel(&mut doc),
+        [255, 0, 0],
+        "the hover colour arrives through a custom property gated on (hover: hover)"
+    );
+}
diff --git a/tests/blitz-tests/tests/implicit_form_submission.rs b/tests/blitz-tests/tests/implicit_form_submission.rs
new file mode 100644
index 00000000..2d327867
--- /dev/null
+++ b/tests/blitz-tests/tests/implicit_form_submission.rs
@@ -0,0 +1,154 @@
+//! Pressing Enter in a form control must not dereference a control that has
+//! been removed, and must submit when the form has a submit button.
+//!
+//! Two separate defects, both on the same walk of `controls_to_form`:
+//!
+//! 1. Setting a field's value re-creates its input node. The old id stayed in
+//!    `controls_to_form`, and `implicit_form_submission` indexed the slab for
+//!    every control it found there, so the second value-set followed by Enter
+//!    panicked with "invalid SlotMap key used" and took the host down with it.
+//!
+//! 2. The "more than one field that blocks implicit submission" rule is gated
+//!    on the form having no submit button
+//!    (<https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#implicit-submission>).
+//!    Applying it unconditionally meant Enter never submitted any form with two
+//!    explicitly typed fields, submit button or not. Three sites hit this.
+
+use blitz_dom::{Document, DocumentConfig};
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_traits::{
+    navigation::{NavigationOptions, NavigationProvider},
+    shell::{ColorScheme, Viewport},
+};
+use keyboard_types::{Code, Key, Location, Modifiers};
+
+use std::sync::{Arc, Mutex};
+
+#[derive(Default)]
+struct RecordingNavigation {
+    navigations: Mutex<Vec<String>>,
+}
+
+impl NavigationProvider for RecordingNavigation {
+    fn navigate_to(&self, options: NavigationOptions) {
+        self.navigations
+            .lock()
+            .unwrap()
+            .push(options.url.to_string());
+    }
+}
+
+fn doc_with(html: &str, navigation: Arc<RecordingNavigation>) -> HtmlDocument {
+    HtmlDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            navigation_provider: Some(navigation),
+            base_url: Some("https://example.test/page".to_string()),
+            ..Default::default()
+        },
+    )
+}
+
+fn press_enter(doc: &mut HtmlDocument, node_id: blitz_traits::node_id::NodeId) {
+    doc.set_focus_to(node_id);
+    doc.handle_ui_event(blitz_traits::events::UiEvent::KeyDown(
+        blitz_traits::events::BlitzKeyEvent {
+            key: Key::Enter,
+            code: Code::Enter,
+            modifiers: Modifiers::empty(),
+            location: Location::Standard,
+            is_auto_repeating: false,
+            is_composing: false,
+            state: blitz_traits::events::KeyState::Pressed,
+            text: None,
+        },
+    ));
+}
+
+const REBUILT: &str = r#"<!DOCTYPE html>
+<html><body>
+    <form id="form" action="/search" method="get">
+        <input id="q" name="q">
+    </form>
+</body></html>
+"#;
+
+#[test]
+fn enter_after_two_value_sets_does_not_panic_on_a_recreated_control() {
+    let navigation = Arc::new(RecordingNavigation::default());
+    let mut doc = doc_with(REBUILT, Arc::clone(&navigation));
+    doc.resolve(0.0);
+
+    let form = doc.query_selector("#form").unwrap().expect("form");
+
+    // Setting the field's value through a framework re-renders the form and
+    // gives the input a new node. Twice, because the first pass is what leaves
+    // the dead id behind and the second is what walks past it.
+    for value in ["one", "two"] {
+        let mut mutator = doc.mutate();
+        mutator.set_inner_html(form, &format!(r#"<input id="q" name="q" value="{value}">"#));
+        drop(mutator);
+        doc.resolve(0.0);
+    }
+
+    let input = doc.query_selector("#q").unwrap().expect("input");
+    press_enter(&mut doc, input);
+
+    assert_eq!(
+        navigation.navigations.lock().unwrap().len(),
+        1,
+        "Enter in a single-field form must still submit it"
+    );
+}
+
+const TWO_TYPED_FIELDS_WITH_SUBMIT: &str = r#"<!DOCTYPE html>
+<html><body>
+    <form id="form" action="/login" method="get">
+        <input id="user" name="user" type="text">
+        <input id="pass" name="pass" type="password">
+        <button type="submit">Sign in</button>
+    </form>
+</body></html>
+"#;
+
+#[test]
+fn enter_submits_a_multi_field_form_that_has_a_submit_button() {
+    let navigation = Arc::new(RecordingNavigation::default());
+    let mut doc = doc_with(TWO_TYPED_FIELDS_WITH_SUBMIT, Arc::clone(&navigation));
+    doc.resolve(0.0);
+
+    let user = doc.query_selector("#user").unwrap().expect("user field");
+    press_enter(&mut doc, user);
+
+    assert_eq!(
+        navigation.navigations.lock().unwrap().len(),
+        1,
+        "the spec gates the multi-field rule on the form having no submit button"
+    );
+}
+
+const TWO_TYPED_FIELDS_NO_SUBMIT: &str = r#"<!DOCTYPE html>
+<html><body>
+    <form id="form" action="/login" method="get">
+        <input id="user" name="user" type="text">
+        <input id="pass" name="pass" type="password">
+    </form>
+</body></html>
+"#;
+
+#[test]
+fn enter_does_not_submit_a_multi_field_form_with_no_submit_button() {
+    let navigation = Arc::new(RecordingNavigation::default());
+    let mut doc = doc_with(TWO_TYPED_FIELDS_NO_SUBMIT, Arc::clone(&navigation));
+    doc.resolve(0.0);
+
+    let user = doc.query_selector("#user").unwrap().expect("user field");
+    press_enter(&mut doc, user);
+
+    assert!(
+        navigation.navigations.lock().unwrap().is_empty(),
+        "with no submit button, more than one blocking field must block submission"
+    );
+}
diff --git a/tests/blitz-tests/tests/number_input_sizing.rs b/tests/blitz-tests/tests/number_input_sizing.rs
new file mode 100644
index 00000000..6a41e285
--- /dev/null
+++ b/tests/blitz-tests/tests/number_input_sizing.rs
@@ -0,0 +1,46 @@
+//! `input[type=number]` gets a text editor like every other text-like input, so
+//! it has to get the same intrinsic content box. It did not: the type list in
+//! `layout::construct` included `number` and the one in `layout::mod` did not,
+//! so a bare number input measured its padding and border and nothing else.
+
+use blitz_dom::DocumentConfig;
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use std::sync::Arc;
+
+fn size_of(doc: &HtmlDocument, selector: &str) -> (f32, f32) {
+    let node_id = doc
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    let layout = doc.get_node(node_id).unwrap().final_layout();
+    (layout.size.width, layout.size.height)
+}
+
+#[test]
+fn a_number_input_is_sized_like_the_other_text_inputs() {
+    let mut doc = HtmlDocument::from_html(
+        r#"<html><body style="margin:0; line-height:normal">
+            <div><input id="text" type="text"></div>
+            <div><input id="number" type="number"></div>
+        </body></html>"#,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+
+    let text = size_of(&doc, "#text");
+    let number = size_of(&doc, "#number");
+
+    assert!(
+        number.0 > 100.0 && number.1 > 10.0,
+        "a number input collapsed to its padding and border: {number:?}"
+    );
+    assert_eq!(
+        number, text,
+        "a number input must measure the same as a text input"
+    );
+}
diff --git a/tests/blitz-tests/tests/select_accessibility.rs b/tests/blitz-tests/tests/select_accessibility.rs
new file mode 100644
index 00000000..6fc5308c
--- /dev/null
+++ b/tests/blitz-tests/tests/select_accessibility.rs
@@ -0,0 +1,167 @@
+//! A `<select>` reports what it offers and what is chosen.
+//!
+//! The options were already in the accessibility tree, because the traversal
+//! walks raw children and `option { display: none }` therefore does not hide
+//! them, but they carried a role and nothing else. No label, no selectedness,
+//! and no value on the select itself, so a harness could see that a combo box
+//! existed and learn nothing further about it. worktables.dev's schema designer
+//! could not be driven at all for exactly this reason.
+
+use accesskit::{Node as AccessKitNode, NodeId, Role};
+use blitz_dom::DocumentConfig;
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use std::collections::HashMap;
+use std::sync::Arc;
+
+const PICKER: &str = r#"<html><body style="margin:0">
+    <select id="country">
+        <option id="us" value="us">United States</option>
+        <option id="fr" value="fr" selected>France</option>
+        <option id="jp" value="jp">Japan</option>
+    </select>
+</body></html>"#;
+
+/// The accessibility node of each element named by `ids`, in the order asked
+/// for.
+///
+/// Looked up by element id rather than read off the tree in order, because
+/// `build_accessibility_tree` collects through a `HashMap` and the nodes come
+/// back in whatever order that iterates.
+fn nodes_for(html: &str, ids: &[&str]) -> Vec<AccessKitNode> {
+    let mut doc = HtmlDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+
+    let by_id: HashMap<NodeId, AccessKitNode> =
+        doc.build_accessibility_tree().nodes.into_iter().collect();
+
+    ids.iter()
+        .map(|id| {
+            let node_id = doc
+                .get_element_by_id(id)
+                .unwrap_or_else(|| panic!("no element with id {id}"));
+            by_id
+                .get(&NodeId(node_id.as_u64()))
+                .unwrap_or_else(|| panic!("{id} is not in the accessibility tree"))
+                .clone()
+        })
+        .collect()
+}
+
+fn labels_and_selectedness(html: &str, ids: &[&str]) -> Vec<(String, Option<bool>)> {
+    nodes_for(html, ids)
+        .into_iter()
+        .map(|node| {
+            assert_eq!(node.role(), Role::ListBoxOption);
+            (
+                node.label().unwrap_or_default().to_string(),
+                node.is_selected(),
+            )
+        })
+        .collect()
+}
+
+#[test]
+fn options_reach_the_semantic_tree_with_their_labels() {
+    let labels: Vec<String> = labels_and_selectedness(PICKER, &["us", "fr", "jp"])
+        .into_iter()
+        .map(|(label, _)| label)
+        .collect();
+
+    assert_eq!(
+        labels,
+        vec![
+            "United States".to_string(),
+            "France".to_string(),
+            "Japan".to_string()
+        ],
+        "an option's accessible name must be its label, or a harness cannot tell what the select offers"
+    );
+}
+
+#[test]
+fn an_options_label_attribute_wins_over_its_text() {
+    let labels: Vec<String> = labels_and_selectedness(
+        r#"<html><body>
+            <select id="s"><option id="one" value="1" label="One">ignored</option></select>
+        </body></html>"#,
+        &["one"],
+    )
+    .into_iter()
+    .map(|(label, _)| label)
+    .collect();
+
+    assert_eq!(labels, vec!["One".to_string()]);
+}
+
+#[test]
+fn the_selected_option_is_marked_selected() {
+    assert_eq!(
+        labels_and_selectedness(PICKER, &["us", "fr", "jp"])
+            .into_iter()
+            .map(|(_, selected)| selected)
+            .collect::<Vec<_>>(),
+        vec![Some(false), Some(true), Some(false)],
+        "the `selected` content attribute must seed selectedness, and the others must read as not selected"
+    );
+}
+
+#[test]
+fn a_select_with_no_selected_attribute_falls_back_to_its_first_option() {
+    assert_eq!(
+        labels_and_selectedness(
+            r#"<html><body>
+                <select id="s">
+                    <option id="a" value="a">Alpha</option>
+                    <option id="b" value="b">Beta</option>
+                </select>
+            </body></html>"#,
+            &["a", "b"],
+        )
+        .into_iter()
+        .map(|(_, selected)| selected)
+        .collect::<Vec<_>>(),
+        vec![Some(true), Some(false)],
+        "a drop-down always displays something, so it must select its first option when nothing else does"
+    );
+}
+
+#[test]
+fn a_select_reports_its_current_label_as_its_value() {
+    let select = nodes_for(PICKER, &["country"]).remove(0);
+    assert_eq!(select.role(), Role::ComboBox);
+    assert_eq!(
+        select.value().map(str::to_string),
+        Some("France".to_string()),
+        "the combo box's value is what it displays, which is the selected option's label"
+    );
+}
+
+#[test]
+fn options_inside_an_optgroup_are_still_reached() {
+    assert_eq!(
+        labels_and_selectedness(
+            r#"<html><body>
+                <select id="s">
+                    <optgroup label="Europe">
+                        <option id="fr" value="fr">France</option>
+                        <option id="de" value="de">Germany</option>
+                    </optgroup>
+                </select>
+            </body></html>"#,
+            &["fr", "de"],
+        ),
+        vec![
+            ("France".to_string(), Some(true)),
+            ("Germany".to_string(), Some(false))
+        ],
+        "an <optgroup> nests its options one level down, and the flattened order is what selectedIndex counts"
+    );
+}
diff --git a/tests/blitz-tests/tests/select_keyboard.rs b/tests/blitz-tests/tests/select_keyboard.rs
new file mode 100644
index 00000000..a3a1c281
--- /dev/null
+++ b/tests/blitz-tests/tests/select_keyboard.rs
@@ -0,0 +1,133 @@
+//! Keyboard selection in a `<select>`.
+//!
+//! There was no keyboard activation for anything but a text input, so a
+//! focussed picker could not be driven at all. Worse, the arrows never even
+//! reached the keyboard handler: the KeyDown arm scrolls the page on
+//! ArrowUp/Down/Home/End and returns, and the predicate that lets a key through
+//! only knew about text inputs. A press on a select therefore scrolled the
+//! document instead of choosing anything.
+
+use blitz_test_harness::Harness;
+use keyboard_types::Key;
+
+const PICKER: &str = r#"<html><body style="margin:0; height:4000px">
+    <select id="country" style="width:150px; height:30px">
+        <option value="us">United States</option>
+        <option value="fr">France</option>
+        <option value="jp">Japan</option>
+    </select>
+</body></html>"#;
+
+fn value_of(harness: &Harness<blitz_html::HtmlDocument>, selector: &str) -> String {
+    let node_id = harness.node(selector);
+    harness.base().select_value(node_id)
+}
+
+fn focussed_picker(html: &str) -> Harness<blitz_html::HtmlDocument> {
+    let mut harness = Harness::from_html(html);
+    harness.click("#country");
+    assert_eq!(harness.focused(), Some(harness.node("#country")));
+    harness
+}
+
+#[test]
+fn arrow_down_moves_the_selection_forwards() {
+    let mut harness = focussed_picker(PICKER);
+    assert_eq!(value_of(&harness, "#country"), "us");
+
+    harness.press(Key::ArrowDown);
+    assert_eq!(
+        value_of(&harness, "#country"),
+        "fr",
+        "ArrowDown must move the selection on, not scroll the page"
+    );
+
+    harness.press(Key::ArrowDown);
+    assert_eq!(value_of(&harness, "#country"), "jp");
+}
+
+#[test]
+fn arrow_up_moves_the_selection_backwards() {
+    let mut harness = focussed_picker(PICKER);
+    harness.press(Key::End);
+    assert_eq!(value_of(&harness, "#country"), "jp");
+
+    harness.press(Key::ArrowUp);
+    assert_eq!(value_of(&harness, "#country"), "fr");
+}
+
+#[test]
+fn the_selection_does_not_wrap_past_either_end() {
+    let mut harness = focussed_picker(PICKER);
+    harness.press(Key::ArrowUp);
+    assert_eq!(
+        value_of(&harness, "#country"),
+        "us",
+        "at the first option ArrowUp must do nothing rather than wrap"
+    );
+
+    harness.press(Key::End);
+    harness.press(Key::ArrowDown);
+    assert_eq!(value_of(&harness, "#country"), "jp");
+}
+
+#[test]
+fn home_and_end_jump_to_the_first_and_last_option() {
+    let mut harness = focussed_picker(PICKER);
+    harness.press(Key::End);
+    assert_eq!(value_of(&harness, "#country"), "jp");
+
+    harness.press(Key::Home);
+    assert_eq!(value_of(&harness, "#country"), "us");
+}
+
+#[test]
+fn a_disabled_option_is_stepped_over() {
+    let mut harness = focussed_picker(
+        r#"<html><body style="margin:0; height:4000px">
+            <select id="country" style="width:150px; height:30px">
+                <option value="us">United States</option>
+                <option value="fr" disabled>France</option>
+                <option value="jp">Japan</option>
+            </select>
+        </body></html>"#,
+    );
+    assert_eq!(value_of(&harness, "#country"), "us");
+
+    harness.press(Key::ArrowDown);
+    assert_eq!(
+        value_of(&harness, "#country"),
+        "jp",
+        "a disabled option cannot be chosen, so the arrow steps over it"
+    );
+}
+
+#[test]
+fn arrows_move_the_selection_rather_than_scrolling_the_page() {
+    let mut harness = focussed_picker(PICKER);
+    let before = harness.base().viewport_scroll().y;
+
+    harness.press(Key::ArrowDown);
+
+    assert_eq!(
+        harness.base().viewport_scroll().y,
+        before,
+        "a focussed select claims the arrow keys; the page must not scroll under it"
+    );
+    assert_eq!(value_of(&harness, "#country"), "fr");
+}
+
+#[test]
+fn an_unfocussed_select_does_not_claim_the_arrows() {
+    let mut harness = Harness::from_html(PICKER);
+    let before = harness.base().viewport_scroll().y;
+
+    harness.press(Key::ArrowDown);
+
+    assert_ne!(
+        harness.base().viewport_scroll().y,
+        before,
+        "with nothing focussed the arrows must still scroll the document"
+    );
+    assert_eq!(value_of(&harness, "#country"), "us");
+}
diff --git a/tests/blitz-tests/tests/select_layout.rs b/tests/blitz-tests/tests/select_layout.rs
new file mode 100644
index 00000000..e500e4b4
--- /dev/null
+++ b/tests/blitz-tests/tests/select_layout.rs
@@ -0,0 +1,107 @@
+//! A `<select>` has to get a layout box.
+//!
+//! There was no `select` rule in the user-agent stylesheet, so a select
+//! computed `display: inline`, and `option { display: none }` left it with no
+//! in-flow content. Height on a non-replaced inline is ignored, so even
+//! `<select style="height:34px">` reported 0x0 and nothing on the page could
+//! find it, let alone press it.
+
+use blitz_dom::DocumentConfig;
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use std::sync::Arc;
+
+fn doc(html: &str) -> HtmlDocument {
+    let mut doc = HtmlDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+    doc
+}
+
+fn size_of(doc: &HtmlDocument, selector: &str) -> (f32, f32) {
+    let node_id = doc
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    let layout = doc.get_node(node_id).unwrap().final_layout();
+    (layout.size.width, layout.size.height)
+}
+
+#[test]
+fn an_authored_select_size_is_honoured() {
+    let doc = doc(r#"<html><body style="margin:0">
+            <select id="country" style="box-sizing:border-box; width:120px; height:34px">
+                <option value="us">United States</option>
+                <option value="fr" selected>France</option>
+            </select>
+        </body></html>"#);
+
+    assert_eq!(
+        size_of(&doc, "#country"),
+        (120.0, 34.0),
+        "a select must take an authored width and height, which needs a block-level box"
+    );
+}
+
+#[test]
+fn a_bare_select_still_gets_a_box() {
+    let doc = doc(r#"<html><body style="margin:0; line-height:normal">
+            <select id="country">
+                <option value="us">United States</option>
+                <option value="fr">France</option>
+            </select>
+        </body></html>"#);
+
+    let (width, height) = size_of(&doc, "#country");
+    assert!(
+        width > 0.0 && height > 0.0,
+        "a select with no authored size must still be hittable, got {width}x{height}"
+    );
+}
+
+#[test]
+fn a_labelled_option_is_measured_by_its_label() {
+    // The `label` attribute is what the control shows; the element's text is
+    // not displayed at all. Measuring the text sized the box to a string the
+    // reader never sees.
+    let doc = doc(r#"<html><body style="margin:0; line-height:normal">
+            <select id="short"><option label="X">A considerably longer hidden string</option></select>
+            <select id="long"><option>A considerably longer hidden string</option></select>
+        </body></html>"#);
+
+    let (short_width, _) = size_of(&doc, "#short");
+    let (long_width, _) = size_of(&doc, "#long");
+    assert!(
+        short_width < long_width / 4.0,
+        "the labelled select must be sized from its one-character label, got {short_width} against {long_width}"
+    );
+}
+
+#[test]
+fn an_option_written_across_several_lines_is_not_measured_wider_for_it() {
+    // The whitespace inside the label is collapsed away when it is rendered,
+    // so it must not be counted. `trim()` only strips the ends: a label whose
+    // own words are split across lines kept the newline and the run of leading
+    // spaces before the next word, and the control came out that much wider.
+    let indented = doc(r#"<html><body style="margin:0; line-height:normal">
+            <select id="country">
+                <option value="us">United
+                    States</option>
+            </select>
+        </body></html>"#);
+    let inline = doc(r#"<html><body style="margin:0; line-height:normal">
+            <select id="country"><option value="us">United States</option></select>
+        </body></html>"#);
+
+    assert_eq!(
+        size_of(&indented, "#country").0,
+        size_of(&inline, "#country").0,
+        "how the markup is formatted must not change how wide the control is"
+    );
+}
diff --git a/tests/blitz-tests/tests/select_selection.rs b/tests/blitz-tests/tests/select_selection.rs
new file mode 100644
index 00000000..1077e9cc
--- /dev/null
+++ b/tests/blitz-tests/tests/select_selection.rs
@@ -0,0 +1,155 @@
+//! A `<select>` can be focussed and its selection is what the form submits.
+//!
+//! `handle_click` had no arm for a select, so the walk fell through to the
+//! no-match tail, which calls `clear_focus()`. Pressing a select therefore
+//! actively unfocused the page, and since the keyboard handler is gated on
+//! focus, the arrows could not drive a control the user had just pressed.
+//!
+//! Form submission had a standing TODO exactly where a select's serialization
+//! belongs, so a select fell through to the generic tail and submitted its own
+//! literal `value` attribute, which a select does not have.
+
+use blitz_dom::DocumentConfig;
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_test_harness::Harness;
+use blitz_traits::navigation::{NavigationOptions, NavigationProvider};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use std::sync::{Arc, Mutex};
+
+const PICKER: &str = r#"<html><body style="margin:0">
+    <select id="country" style="width:150px; height:30px">
+        <option value="us">United States</option>
+        <option value="fr" selected>France</option>
+    </select>
+</body></html>"#;
+
+#[test]
+fn clicking_a_select_focuses_it() {
+    let mut harness = Harness::from_html(PICKER);
+    let select = harness.node("#country");
+    harness.click("#country");
+
+    assert_eq!(
+        harness.focused(),
+        Some(select),
+        "a press must focus the select; without it the keyboard handler, which is gated on focus, can never reach it"
+    );
+}
+
+#[test]
+fn clicking_a_select_does_not_clear_an_existing_focus() {
+    let mut harness = Harness::from_html(
+        r#"<html><body style="margin:0">
+            <input id="name" type="text" style="width:100px; height:20px">
+            <select id="country" style="width:150px; height:30px">
+                <option value="us">United States</option>
+            </select>
+        </body></html>"#,
+    );
+    harness.click("#name");
+    assert_eq!(harness.focused(), Some(harness.node("#name")));
+
+    harness.click("#country");
+    assert_eq!(
+        harness.focused(),
+        Some(harness.node("#country")),
+        "the press must move focus to the select rather than clearing it"
+    );
+}
+
+#[derive(Default)]
+struct RecordingNavigation {
+    urls: Mutex<Vec<String>>,
+}
+
+impl NavigationProvider for RecordingNavigation {
+    fn navigate_to(&self, options: NavigationOptions) {
+        self.urls
+            .lock()
+            .unwrap()
+            .push(options.url.as_str().to_string());
+    }
+}
+
+/// Submit the form and return the URL the navigation provider was handed.
+fn submitted_url(html: &str) -> String {
+    let navigation = Arc::new(RecordingNavigation::default());
+    let mut doc = HtmlDocument::from_html(
+        html,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            navigation_provider: Some(navigation.clone()),
+            base_url: Some("https://example.test/page".to_string()),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+    let form = doc.query_selector("#form").unwrap().unwrap();
+    let submitter = doc.query_selector("#go").unwrap().unwrap();
+    doc.submit_form(form, submitter);
+
+    let urls = navigation.urls.lock().unwrap();
+    assert_eq!(urls.len(), 1, "expected exactly one navigation");
+    urls[0].clone()
+}
+
+#[test]
+fn a_form_submits_the_selected_options_value() {
+    let url = submitted_url(
+        r#"<html><body>
+            <form id="form" action="/search" method="get">
+                <select id="country" name="country">
+                    <option value="us">United States</option>
+                    <option value="fr" selected>France</option>
+                </select>
+                <button id="go" type="submit">Go</button>
+            </form>
+        </body></html>"#,
+    );
+
+    assert_eq!(
+        url, "https://example.test/search?country=fr",
+        "the entry must be the selected option's value, not the select's own (absent) value attribute"
+    );
+}
+
+#[test]
+fn an_option_with_no_value_attribute_submits_its_label() {
+    let url = submitted_url(
+        r#"<html><body>
+            <form id="form" action="/search" method="get">
+                <select id="size" name="size">
+                    <option>Small</option>
+                    <option selected>Large</option>
+                </select>
+                <button id="go" type="submit">Go</button>
+            </form>
+        </body></html>"#,
+    );
+
+    assert_eq!(url, "https://example.test/search?size=Large");
+}
+
+#[test]
+fn a_disabled_option_is_never_submitted() {
+    // `multiple` so that both options can carry `selected` at once: the point
+    // of the case is that the disabled one is dropped while the other is kept,
+    // which a single select could not express.
+    let url = submitted_url(
+        r#"<html><body>
+            <form id="form" action="/search" method="get">
+                <select id="country" name="country" multiple>
+                    <option value="us" selected disabled>United States</option>
+                    <option value="fr" selected>France</option>
+                </select>
+                <button id="go" type="submit">Go</button>
+            </form>
+        </body></html>"#,
+    );
+
+    assert_eq!(
+        url, "https://example.test/search?country=fr",
+        "a disabled option is skipped by the entry construction steps even when it is selected"
+    );
+}
diff --git a/tests/blitz-tests/tests/table_row_boxes.rs b/tests/blitz-tests/tests/table_row_boxes.rs
new file mode 100644
index 00000000..87e0a950
--- /dev/null
+++ b/tests/blitz-tests/tests/table_row_boxes.rs
@@ -0,0 +1,115 @@
+//! `<tr>`, `<thead>` and `<tbody>` must report a box.
+//!
+//! Table layout flattens the rows into a CSS grid of cells: the row and
+//! row-group nodes have their box construction damage cleared and never reach
+//! Taffy, so every one of them reported 0x0 and "not displayed". Anything that
+//! walks a table by row, a QA check included, had nothing to walk.
+
+use blitz_dom::DocumentConfig;
+use blitz_html::{HtmlDocument, HtmlProvider};
+use blitz_traits::shell::{ColorScheme, Viewport};
+use std::sync::Arc;
+
+const HTML: &str = r#"<!DOCTYPE html>
+<html><head><style>
+    body { margin: 0 }
+    table { border-collapse: collapse; width: 400px }
+    td, th { padding: 0; height: 20px; width: 200px }
+</style></head>
+<body>
+    <table>
+        <thead><tr id="head"><th>Name</th><th>Size</th></tr></thead>
+        <tbody id="body">
+            <tr id="first"><td>alpha</td><td>1</td></tr>
+            <tr id="second"><td>beta</td><td>2</td></tr>
+        </tbody>
+    </table>
+</body></html>
+"#;
+
+fn rect(doc: &HtmlDocument, selector: &str) -> (f32, f32, f32, f32) {
+    let node_id = doc
+        .query_selector(selector)
+        .unwrap()
+        .unwrap_or_else(|| panic!("no node matching {selector}"));
+    let node = doc.get_node(node_id).unwrap();
+    let position = node.absolute_position(0.0, 0.0);
+    let layout = node.final_layout();
+    (
+        position.x,
+        position.y,
+        layout.size.width,
+        layout.size.height,
+    )
+}
+
+#[test]
+fn every_row_reports_the_box_its_cells_occupy() {
+    let mut doc = HtmlDocument::from_html(
+        HTML,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+
+    let head = rect(&doc, "#head");
+    let first = rect(&doc, "#first");
+    let second = rect(&doc, "#second");
+
+    for (name, row) in [("head", head), ("first", first), ("second", second)] {
+        assert!(
+            row.2 > 0.0 && row.3 > 0.0,
+            "row #{name} has no box: {row:?}"
+        );
+    }
+
+    assert_eq!(
+        (head.0, head.2),
+        (first.0, first.2),
+        "every row spans the same horizontal extent, the table's"
+    );
+    assert_eq!((first.0, first.2), (second.0, second.2));
+    assert_eq!(head.3, 20.0, "a row is as tall as its cells");
+
+    assert!(
+        head.1 < first.1 && first.1 < second.1,
+        "rows stack in tree order: {head:?} {first:?} {second:?}"
+    );
+    assert!(
+        head.1 + head.3 <= first.1 && first.1 + first.3 <= second.1,
+        "rows do not overlap: {head:?} {first:?} {second:?}"
+    );
+}
+
+#[test]
+fn a_row_group_spans_the_rows_it_holds() {
+    let mut doc = HtmlDocument::from_html(
+        HTML,
+        DocumentConfig {
+            viewport: Some(Viewport::new(800, 600, 1.0, ColorScheme::Light)),
+            html_parser_provider: Some(Arc::new(HtmlProvider) as _),
+            ..Default::default()
+        },
+    );
+    doc.resolve(0.0);
+
+    let body = rect(&doc, "#body");
+    let first = rect(&doc, "#first");
+    let second = rect(&doc, "#second");
+
+    assert_eq!(
+        (body.0, body.2),
+        (first.0, first.2),
+        "a row group spans the table horizontally"
+    );
+    assert_eq!(body.1, first.1, "tbody starts at its first row");
+    assert_eq!(
+        body.1 + body.3,
+        second.1 + second.3,
+        "tbody ends at its last row"
+    );
+    assert!(body.3 > first.3, "tbody covers both of its rows");
+}