diff --git a/docs/usage.md b/docs/usage.md
index e43f262..a22a5f6 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -197,10 +197,17 @@ It establishes escaping only when all of the following hold:
   or an attribute name.
 - No Python file of the project sets `autoescape` to `False`.
 
-Start tags and their attributes are read as a browser's HTML tokenizer reads them, in time
-linear in the size of the template. A tag, or a quoted attribute value, a template leaves
-open at its end is checked too: once the template is included, it runs into the markup
-that follows, the value staying quoted until its quote closes.
+Templates are read as a browser's HTML tokenizer reads them, in time linear in the size
+of the template. What a template leaves open at its end is checked too, since once the
+template is included it runs into the markup that follows: a tag's attributes are
+checked, a quoted value stays quoted until its quote closes, and a variable in a
+`<script>` or `<style>` block or an end tag left open is refused, even where the page
+ends there and the browser would never run it. A template including one that ends inside
+such a block, a tag or an end tag is not established either: the markup after the
+include continues it. A template extending another ends where that one ends. A comment
+hides what it holds only up to its first template tag, since an include there may close
+it and a condition around its `<!--` may leave it out. A `{% block %}` or
+`{% include %}` placed inside a parent's `<script>` is not covered yet (#273).
 
 The analyzer never assumes escaping where it cannot read the template. That covers a
 template file it cannot read, a template named by an expression, a template found
diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index ea54bf9..0607fe5 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -10,9 +10,15 @@
 - no variable where HTML escaping does not protect it: in a ``<script>`` or ``<style>``
   block, an event handler, a ``style`` or ``srcdoc`` attribute, a URL attribute whose
   value does not start with a fixed relative or ``http(s)`` prefix, an unquoted
-  attribute, an attribute or a tag name;
+  attribute, an attribute or a tag name, including in such a block or tag the template
+  leaves open, which once included runs into the markup that follows;
+- no include of a template that ends inside a ``<script>`` or ``<style>`` block, a tag
+  or an end tag, which the markup after the include then continues;
 - no Python file of the project turning autoescaping off.
 
+A comment hides what it holds only up to its first template tag: an include there may
+close it, and a condition around its ``<!--`` may leave it out.
+
 Templates are found under the project's ``templates`` directories, by their path below
 one. A template the engine cannot find — named by an expression, under a ``DIRS`` entry
 of another name, shipped by an installed package — or cannot read is never assumed to
@@ -44,7 +50,7 @@
 from dataclasses import dataclass, field
 from pathlib import Path
 from types import MappingProxyType
-from typing import ClassVar
+from typing import ClassVar, NamedTuple
 
 from coretrace_python.analysis import Analysis, AnalysisContext
 from coretrace_python.frontend import HIRBuildError, ParseError, build_hir
@@ -153,10 +159,17 @@
 _ATTRIBUTE_NAME = r"(?:=[^\s/>=]*+|[^\s/>=]++)"
 _ATTRIBUTE_VALUE = r"(?:\"[^\"]*+(?:\"|\Z)|'[^']*+(?:'|\Z)|[^\s>]*+)"
 _ATTRIBUTE = re.compile(rf"({_ATTRIBUTE_NAME})(?:\s*+=\s*+({_ATTRIBUTE_VALUE}))?")
-_START_TAG = re.compile(rf"<([A-Za-z][^\s/>]*+)((?:[\s/]++|{_ATTRIBUTE_NAME}(?:\s*+=\s*+{_ATTRIBUTE_VALUE})?)*+)>?")
-_RAW_TEXT = re.compile(r"<(script|style)\b[^>]*>(.*?)</\1\s*>", re.DOTALL | re.IGNORECASE)
-_COMMENT = re.compile(r"<!--.*?-->", re.DOTALL)
-_END_TAG = re.compile(r"</[A-Za-z][^>]*>")
+_START_TAG = re.compile(rf"<([A-Za-z][^\s/>]*+)((?:[\s/]++|{_ATTRIBUTE_NAME}(?:\s*+=\s*+{_ATTRIBUTE_VALUE})?)*+)(>)?")
+# A script or style block and an end tag the text leaves open run to its end as well, for
+# the same reason (#272); their last group, like the start tag's, is then empty or None.
+# Only ``script`` and ``style`` themselves: a tag name runs to whitespace, ``/`` or ``>``,
+# so ``<style-switcher>`` is another element, whose content is markup.
+_RAW_TEXT = re.compile(r"<(script|style)(?=[\s/>])[^>]*+>(.*?)(</\1\s*>|\Z)", re.DOTALL | re.IGNORECASE)
+_END_TAG = re.compile(r"</[A-Za-z][^>]*+(>)?")
+# ``-->``, ``--!>``, or the ``>`` that ends ``<!-->`` and ``<!--->`` at once.
+_COMMENT_END = re.compile(r"--!?>")
+# ``<{{ name }}`` or ``</ {{ name }}``: the variable would name a tag.
+_NAMED_BY_OUTPUT = re.compile(rf"<[/ \t\n]*{_OUTPUT}")
 # Django's filter expressions: a constant or a variable, then filters, each with an
 # optional argument, the way ``django.template.base.FilterExpression`` reads them.
 _STRING = r"\"[^\"\\]*(?:\\.[^\"\\]*)*\"|'[^'\\]*(?:\\.[^'\\]*)*'"
@@ -179,7 +192,10 @@
 
 def escaped_templates(root: Path) -> frozenset[str]:
     """The names of the templates under ``root`` that escape every variable they render,
-    as ``render_to_string`` names them (their path below a ``templates`` directory)."""
+    as ``render_to_string`` names them (their path below a ``templates`` directory). A
+    template including one that ends inside a script or style block, a tag or an end tag
+    is not among them: the markup after its include continues that construct. A
+    template extending another renders it, and ends where it ends."""
 
     found: dict[str, list[Path]] = {}
     for path in discover_files(root):
@@ -189,11 +205,20 @@ def escaped_templates(root: Path) -> frozenset[str]:
             found.setdefault(name, []).append(path)
     local: dict[str, bool] = {}
     requires: dict[str, set[str]] = {}
+    extends: dict[str, set[str]] = {}
+    includes: dict[str, set[str]] = {}
+    open_ended: set[str] = set()
     for name, paths in found.items():
         verdicts = [_verdict(path) for path in paths]
-        local[name] = all(safe for safe, _ in verdicts)
-        requires[name] = {needed for _, needs in verdicts for needed in needs}
-    escaped = {name for name, safe in local.items() if safe}
+        local[name] = all(verdict.escapes for verdict in verdicts)
+        requires[name] = {needed for verdict in verdicts for needed in verdict.extends | verdict.includes}
+        extends[name] = {extended for verdict in verdicts for extended in verdict.extends}
+        includes[name] = {included for verdict in verdicts for included in verdict.includes}
+        if any(verdict.open_end for verdict in verdicts):
+            open_ended.add(name)
+    while grown := {name for name, extended in extends.items() if extended & open_ended} - open_ended:
+        open_ended |= grown
+    escaped = {name for name, safe in local.items() if safe and not includes[name] & open_ended}
     changed = True
     while changed:
         kept = {name for name in escaped if requires[name] <= escaped}
@@ -212,12 +237,26 @@ def _read(path: Path) -> str:
     return _text(path) or ""
 
 
-def _verdict(path: Path) -> tuple[bool, set[str]]:
-    """Whether one template file escapes all it prints, and what it needs: a file the
-    engine cannot read is not established to escape, like a template it cannot find."""
+class _Verdict(NamedTuple):
+    """Whether a template escapes all it prints itself; the templates it extends and
+    those it includes, which must escape too; and whether its text ends inside a
+    construct, which the markup after its include continues."""
+
+    escapes: bool
+    extends: frozenset[str]
+    includes: frozenset[str]
+    open_end: bool
+
+
+_REFUSED = _Verdict(escapes=False, extends=frozenset(), includes=frozenset(), open_end=False)
+
+
+def _verdict(path: Path) -> _Verdict:
+    """What one template file establishes: a file the engine cannot read is not
+    established to escape, like a template it cannot find."""
 
     text = _text(path)
-    return (False, set()) if text is None else _inspect(text)
+    return _REFUSED if text is None else _inspect(text)
 
 
 def _text(path: Path) -> str | None:
@@ -229,11 +268,11 @@ def _text(path: Path) -> str | None:
         return None
 
 
-def _inspect(text: str) -> tuple[bool, set[str]]:
-    """Whether the template escapes all it prints itself, and the templates it extends
-    or includes, which must escape too."""
+def _inspect(text: str) -> _Verdict:
+    """What the template of ``text`` establishes (``_Verdict``)."""
 
-    requires: set[str] = set()
+    extends: set[str] = set()
+    includes: set[str] = set()
     html: list[str] = []
     skipping: str | None = None
     position = 0
@@ -251,7 +290,7 @@ def _inspect(text: str) -> tuple[bool, set[str]]:
         position = match.end()
         if variable is not None:
             if not _escaping_filters(variable):
-                return False, requires
+                return _REFUSED
             html.append(_OUTPUT)
         elif words and words[0] in ("comment", "verbatim"):
             skipping = f"end{words[0]}"
@@ -260,23 +299,24 @@ def _inspect(text: str) -> tuple[bool, set[str]]:
         elif words:
             name = words[0]
             if name not in _TAGS:
-                return False, requires
+                return _REFUSED
             if name == "load" and not set(_loaded(words[1:])) <= _LIBRARIES:
-                return False, requires
+                return _REFUSED
             if name == "autoescape" and words[1:] != ["on"]:
-                return False, requires
+                return _REFUSED
             if name == "filter" and not _escaping_filters(tag.split(None, 1)[1] if len(words) > 1 else ""):
-                return False, requires
+                return _REFUSED
             if name in ("extends", "include"):
                 needed = _constant(words[1] if len(words) > 1 else "")
                 if needed is None:
-                    return False, requires
-                requires.add(needed)
+                    return _REFUSED
+                (extends if name == "extends" else includes).add(needed)
             html.append(_OUTPUT if name in _PRINTING else _URL if name in ("url", "static") else _TAG)
     if skipping is not None:
-        return False, requires
+        return _REFUSED
     html.append(text[position:])
-    return _escapes_where_printed("".join(html)), requires
+    reading = _read_markup("".join(html))
+    return _Verdict(reading.escapes, frozenset(extends), frozenset(includes), reading.open_end)
 
 
 def _loaded(words: list[str]) -> list[str]:
@@ -294,36 +334,66 @@ def _constant(word: str) -> str | None:
     return word[1:-1] if len(word) >= 2 and word[0] == word[-1] and word[0] in "\"'" else None
 
 
-def _escapes_where_printed(html: str) -> bool:
-    """Whether every output marker of ``html`` stands where HTML escaping protects it."""
+class _Reading(NamedTuple):
+    """What one pass over a template's markup establishes: whether every output marker
+    stands where HTML escaping protects it, and whether the text ends inside a script or
+    style block, a tag or an end tag, which the markup after its include continues."""
+
+    escapes: bool
+    open_end: bool
+
+
+def _read_markup(html: str) -> _Reading:
+    """Read ``html`` once, as the HTML tokenizer reads the page it is part of. Each
+    construct is matched where it starts and one the text leaves open runs to its end,
+    so every character is read once, where copying the rest of the text at each ``<``
+    and rescanning what never closed took quadratic time (#272).
+
+    A comment ends at its close, as a browser closes it, or at the first template tag
+    inside it, whichever comes first, and what follows the tag is read as markup: an
+    include there may close the comment, a condition around its ``<!--`` leave it out.
+    A variable cannot close it, escaped. A comment left open, with no tag after it,
+    hides the rest of the text, and hands nothing on: what follows its include stays
+    inside it."""
 
     position = 0
+    open_end = False
+    # The first comment close after the comment being read, searched once for all the
+    # comments that open before it; and the position after which none closes.
+    close: re.Match[str] | None = None
+    unclosed_from = len(html) + 1
     while (start := html.find("<", position)) != -1:
-        rest = html[start:]
-        comment = _COMMENT.match(rest)
-        raw = _RAW_TEXT.match(rest)
-        tag = _START_TAG.match(rest)
-        end = _END_TAG.match(rest)
-        if comment:
-            position = start + comment.end()
-        elif raw:
-            if _OUTPUT in raw.group(2) or not _attributes_escape(raw.group(0)[: raw.start(2)]):
-                return False
-            position = start + raw.end()
-        elif tag:
+        if html.startswith("<!--", start):
+            if start >= unclosed_from:
+                close = None
+            elif close is None or close.start() < start + 2:
+                close = _COMMENT_END.search(html, start + 2)
+                if close is None:
+                    unclosed_from = start
+            first_tag = html.find(_TAG, start + 4, len(html) if close is None else close.start())
+            if first_tag != -1:
+                position = first_tag + 1
+            elif close is not None:
+                position = close.end()
+            else:
+                break
+        elif raw := _RAW_TEXT.match(html, start):
+            if _OUTPUT in raw.group(2) or not _attributes_escape(html[start : raw.start(2)]):
+                return _Reading(escapes=False, open_end=False)
+            position, open_end = raw.end(), not raw.group(3)
+        elif tag := _START_TAG.match(html, start):
             if _OUTPUT in tag.group(1) or not _attributes_escape(tag.group(2)):
-                return False
-            position = start + tag.end()
-        elif end:
+                return _Reading(escapes=False, open_end=False)
+            position, open_end = tag.end(), tag.group(3) is None
+        elif end := _END_TAG.match(html, start):
             if _OUTPUT in end.group(0):
-                return False
-            position = start + end.end()
+                return _Reading(escapes=False, open_end=False)
+            position, open_end = end.end(), end.group(1) is None
+        elif _NAMED_BY_OUTPUT.match(html, start):
+            return _Reading(escapes=False, open_end=False)
         else:
-            # ``<{{ name }}``: the variable would name a tag, escaping cannot stop it.
-            if rest[1:].lstrip("/ \t\n").startswith(_OUTPUT):
-                return False
             position = start + 1
-    return True
+    return _Reading(escapes=True, open_end=open_end)
 
 
 def _attributes_escape(attributes: str) -> bool:
diff --git a/tests/test_template_open_constructs.py b/tests/test_template_open_constructs.py
new file mode 100644
index 0000000..2977f67
--- /dev/null
+++ b/tests/test_template_open_constructs.py
@@ -0,0 +1,239 @@
+"""Acceptance tests for issue #272: what a template leaves open, and a template tag inside a
+comment, are read as the browser receives the rendered page.
+
+A template is often a fragment: once included, what it leaves open continues into the
+markup that follows. A ``<script>``, a ``<style>`` or an end tag it leaves open runs to
+its end, so a variable inside is refused, even when the document ends there (the browser
+then never runs the script: a prudent false positive).
+
+A comment in the source is not necessarily one in the rendered page: a template tag
+inside it can close it (an include) or leave out its ``<!--`` (a condition). A comment
+therefore ends at its close, or at the first template tag inside it; a variable,
+escaped, cannot close it. A comment left open, with no tag after it, hides the rest.
+
+A template that ends inside a script or style block, a tag or an end tag hands that
+construct to the markup following its include, so the templates including it are not
+established as escaping.
+
+Every construct is read once, so the inspection is linear in the size of the template.
+Each inspection and analysis runs in a subprocess with a timeout, so that one that does
+not end fails instead of hanging the suite.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+TIMEOUT = 60
+# Far beyond what a quadratic inspection reads within the timeout; a linear one takes
+# well under a second.
+SIZE = 3_000_000
+
+ESCAPED_TEMPLATES = (
+    "import json, sys\n"
+    "from pathlib import Path\n"
+    "from coretrace_python.taint.templates import escaped_templates\n"
+    "print(json.dumps(sorted(escaped_templates(Path(sys.argv[1])))))\n"
+)
+
+VIEW = (
+    "from django.http import HttpRequest, HttpResponse\n"
+    "from django.template.loader import render_to_string\n\n"
+    "def page(request: HttpRequest):\n"
+    "    return HttpResponse(render_to_string('page.html', {'name': request.GET['name']}))\n"
+)
+
+
+def run(command: list[str]) -> subprocess.CompletedProcess[str]:
+    try:
+        return subprocess.run(command, capture_output=True, text=True, check=False, timeout=TIMEOUT)
+    except subprocess.TimeoutExpired:
+        pytest.fail(f"{command[1:3]} did not end within {TIMEOUT} s")
+
+
+def project(tmp_path: Path, templates: dict[str, str]) -> Path:
+    root = tmp_path / "project"
+    (root / "app" / "templates").mkdir(parents=True, exist_ok=True)
+    (root / "app" / "views.py").write_text(VIEW, encoding="utf-8")
+    for name, content in templates.items():
+        (root / "app" / "templates" / name).write_text(content, encoding="utf-8")
+    return root
+
+
+def escaped(tmp_path: Path, templates: dict[str, str]) -> list[str]:
+    completed = run([sys.executable, "-c", ESCAPED_TEMPLATES, str(project(tmp_path, templates))])
+    assert completed.returncode == 0, completed.stderr
+    names: list[str] = json.loads(completed.stdout)
+    return names
+
+
+def xss(tmp_path: Path, templates: dict[str, str]) -> list[tuple[str, int]]:
+    root = project(tmp_path, templates)
+    completed = run([sys.executable, "-m", "coretrace_python", "--check", str(root), "--format", "json"])
+    findings = json.loads(completed.stdout)["findings"]
+    return [(f["location"]["path"], f["location"]["line"]) for f in findings if f["rule_id"] == "xss"]
+
+
+# The reproductions of #272, rendered with Django and run in a browser: the variable runs
+# as script in each (in C, the browser never runs a script left open at the end of the
+# document, but a template cannot tell whether it is rendered alone).
+@pytest.mark.parametrize(
+    "templates",
+    [
+        {"fragment.html": "<script>var name = {{ name }};\n", "page.html": "{% include 'fragment.html' %}</script>\n"},
+        {"page.html": "<script>var name = {{ name }};</script>\n"},
+        {"page.html": "<script>var name = {{ name }};\n<p>after</p>\n"},
+        {"page.html": '<!-- {% include "close.html" %}<script>var name = {{ name }};</script>\n', "close.html": "-->"},
+        {"open.html": "<script>\n", "page.html": "{% include 'open.html' %}var name = {{ name }};</script>\n"},
+        {"page.html": '<!-- {% include "close.html" %} <script>var name = {{ name }};</script> -->\n', "close.html": "-->"},
+    ],
+    ids=[
+        "A-fragment-closed-by-includer",
+        "B-closed-in-same-template",
+        "C-open-to-end-of-document",
+        "D-comment-closed-by-include",
+        "E-includer-continues-open-script",
+        "G-closed-comment-holding-include",
+    ],
+)
+def test_a_variable_the_rendered_page_runs_as_script_is_cross_site_scripting(
+    tmp_path: Path, templates: dict[str, str]
+) -> None:
+    assert xss(tmp_path, templates) == [("app/views.py", 5)]
+
+
+def test_a_variable_in_a_comment_holding_no_template_tag_stays_escaped(tmp_path: Path) -> None:
+    templates = {"page.html": "<p>hello</p><!-- {{ name }} -->\n"}
+
+    assert escaped(tmp_path, templates) == ["page.html"]
+    assert xss(tmp_path, templates) == []
+
+
+@pytest.mark.parametrize(
+    "template",
+    [
+        '{% if debug %}<!--{% endif %}<a onclick="{{ name }}">',
+        '<!-- {% include "x.html" %} <a onclick="{{ name }}"> -->',
+        '<!--><a onclick="{{ name }}">',
+        '<!---><a onclick="{{ name }}">',
+        '<!-- note --!><a onclick="{{ name }}">',
+    ],
+    ids=["condition-around-the-opener", "include-inside", "abrupt-empty", "abrupt-dash", "bang-close"],
+)
+def test_a_comment_ends_at_its_close_or_at_a_template_tag_inside_it(tmp_path: Path, template: str) -> None:
+    assert escaped(tmp_path, {"page.html": template, "x.html": ""}) == ["x.html"]
+
+
+@pytest.mark.parametrize(
+    "template",
+    ['<!--><a onclick="{{ name }}">-->', '<!-- note --!><a onclick="{{ name }}"> -->'],
+    ids=["abrupt-before-a-later-close", "bang-before-a-later-close"],
+)
+def test_a_comment_closes_where_a_browser_closes_it(tmp_path: Path, template: str) -> None:
+    # Read to the later ``-->``, the handler was taken for part of the comment.
+    assert escaped(tmp_path, {"page.html": template}) == []
+
+
+def test_a_comment_left_open_without_a_template_tag_is_inert_to_the_end(tmp_path: Path) -> None:
+    # Rendered alone, the comment runs to the end; included, it holds the markup that
+    # follows until a ``-->`` there: either way, nothing after its ``<!--`` is shown.
+    assert escaped(tmp_path, {"page.html": '<p>{{ name }}</p><!-- <a onclick="{{ name }}">'}) == ["page.html"]
+
+
+@pytest.mark.parametrize(
+    "template",
+    ["<style>body { color: {{ name }} }", "<script>var name = {{ name }};", "</a {{ name }}"],
+    ids=["style", "script", "end-tag"],
+)
+def test_a_variable_in_a_construct_left_open_is_refused(tmp_path: Path, template: str) -> None:
+    assert escaped(tmp_path, {"page.html": template}) == []
+
+
+@pytest.mark.parametrize(
+    "template",
+    ["<style-switcher><p>{{ name }}</p></style-switcher>\n", "<script-editor><p>{{ name }}</p></script-editor>\n"],
+    ids=["style-switcher", "script-editor"],
+)
+def test_an_element_whose_name_only_starts_like_script_or_style_is_markup(tmp_path: Path, template: str) -> None:
+    # Only ``script`` and ``style`` themselves hold raw text: the tag name runs to
+    # whitespace, ``/`` or ``>``.
+    assert escaped(tmp_path, {"page.html": template}) == ["page.html"]
+    assert xss(tmp_path, {"page.html": template}) == []
+
+
+@pytest.mark.parametrize(
+    "fragment",
+    ["<script>\n", "<style>\n", '<a href="/x"', '<a title="x', "</a"],
+    ids=["script", "style", "start-tag", "quoted-value", "end-tag"],
+)
+def test_including_a_template_that_ends_inside_a_construct_is_not_established(tmp_path: Path, fragment: str) -> None:
+    # The fragment prints nothing and is established; the markup after its include
+    # continues what it leaves open.
+    templates = {"fragment.html": fragment, "page.html": "{% include 'fragment.html' %}<p>{{ name }}</p>\n"}
+
+    assert escaped(tmp_path, templates) == ["fragment.html"]
+
+
+def test_including_a_template_that_ends_inside_a_comment_stays_established(tmp_path: Path) -> None:
+    templates = {"fragment.html": "<!-- note", "page.html": "{% include 'fragment.html' %} -->\n<p>{{ name }}</p>\n"}
+
+    assert escaped(tmp_path, templates) == ["fragment.html", "page.html"]
+
+
+@pytest.mark.parametrize(
+    "chain",
+    [
+        {"child.html": '{% extends "base.html" %}{% block body %}hello{% endblock %}'},
+        {
+            "middle.html": '{% extends "base.html" %}',
+            "child.html": '{% extends "middle.html" %}{% block body %}hello{% endblock %}',
+        },
+    ],
+    ids=["extends", "extends-twice"],
+)
+def test_a_template_extending_one_that_ends_inside_a_construct_ends_inside_it_too(
+    tmp_path: Path, chain: dict[str, str]
+) -> None:
+    # Rendered, child.html is base.html with its block filled: it ends inside base.html's
+    # script, which the markup after its include continues.
+    templates = {
+        "base.html": "<p>{% block body %}{% endblock %}</p><script>",
+        **chain,
+        "page.html": '{% include "child.html" %}var name = {{ name }};</script>',
+    }
+
+    assert escaped(tmp_path, templates) == sorted(set(templates) - {"page.html"})
+    assert xss(tmp_path, templates) == [("app/views.py", 5)]
+
+
+def test_extending_a_template_that_ends_inside_a_script_stays_established(tmp_path: Path) -> None:
+    # A child's blocks stand where the parent places them, before the parent's end.
+    templates = {
+        "base.html": "<p>{% block body %}{% endblock %}</p><script>\n",
+        "page.html": "{% extends 'base.html' %}{% block body %}{{ name }}{% endblock %}\n",
+    }
+
+    assert escaped(tmp_path, templates) == ["base.html", "page.html"]
+
+
+@pytest.mark.parametrize(
+    "template",
+    [
+        "<" * SIZE,
+        "</a" * (SIZE // 3),
+        "<!--" * (SIZE // 4),
+        "<!--{% if x %}" * (SIZE // 14),
+        "<script>" * (SIZE // 8),
+        "<style>" * (SIZE // 7),
+        "<p>x</p>" * (SIZE // 8),
+        "<!--{% include 'empty.html' %}" * (SIZE // 10) + "-->",
+    ],
+    ids=["lt", "end-tag", "comment", "comment-and-tag", "script", "style", "well-formed", "comments-before-one-close"],
+)
+def test_the_inspection_reads_each_construct_once(tmp_path: Path, template: str) -> None:
+    escaped(tmp_path, {"page.html": template})