a < b
'\n```\n\nText and attribute values are escaped, void elements render without end tags, `key` and `on` produce no markup. On the client, `hydrate: true` adopts matching server DOM on the first trusted render, repairs local mismatches and gives widgets fresh hosts. Safe mode rebuilds existing DOM.\n\n### With JavaScript in the middle\n\n`h(tag, props, ...children)` builds the same JSON a stylesheet would, for hand-written views and tests. The shape helpers (`isTextNode`, `isElementNode`, `propsOf`, `keyOf`, `childrenOf`, `isSameNode`) are exported for anyone building another renderer over the format.\n\n### Widgets — the imperative escape hatch\n\nSome islands are irreducibly imperative: a virtualized grid, a canvas, a map, a third-party control. The reserved tag `jaren-widget` mounts a **registered widget** into a host element the patcher owns but never descends into ([VIEW-FORMAT §7](docs/VIEW-FORMAT.md)):\n\n```json\n[\"jaren-widget\", {\n \"name\": \"virtual-list\", \"key\": \"list\", \"class\": \"viewport\",\n \"props\": { \"rows\": \"$.rows\", \"rowHeight\": 28 }\n}]\n```\n\n```javascript\nconst render = createDomRenderer(container, {\n onEvent: (binding, event) => dispatch(binding, event),\n widgets: {\n 'virtual-list': {\n mount(host, props, emit) { /* build DOM, measure, listen */ return state; },\n update(handle, props, prevProps) { /* re-window the visible rows */ },\n unmount(handle) { /* timers, listeners and observers die here */ },\n ssr: (props) => ['ul', { class: 'list' }], // declarative fallback\n },\n },\n});\n```\n\n`name`/`props`/`tag` configure the widget (the host tag defaults to `div`); every other prop — `key`, `class`, `on`, ... — applies to the host element as usual, and the widget node has no vnode children (the widget owns the host's subtree). `props` is compared **by reference**: with the JSLT memo option, unchanged state yields reference-equal props, so an untouched widget is never called. `mount` runs after the host is connected (grids can measure) and returns a handle threaded to `update`/`unmount`; `unmount` runs exactly once when the widget leaves the tree, even when an ancestor subtree is replaced. A throwing `mount` or `update` **poisons** the widget instead of corrupting it: siblings and the frame still complete, the first error surfaces after the frame settles, and the next render that revisits the widget replaces it with a fresh lifecycle (`unmount` runs on the old instance only when its `mount` had succeeded). `emit(binding, event)` delivers ordinary event bindings to `onEvent` — a widget composes runtime data (the clicked row id) into the binding its props carry instead of inventing an action vocabulary. `renderToString(vnode, { widgets })` serializes the host around the widget's `ssr(props)` vnode — still pure, nothing mounts.\n\n## Untrusted views: the safe profile\n\nThe default renderers **trust** their input. A vnode is plain JSON, and the\ndefault `createDomRenderer`/`renderToString` write whatever it says — including\n`innerHTML`, inline `on*` handlers and `javascript:` URLs. For a\nsource-authored view that is exactly right; it is the equivalent of writing the\nDOM by hand, and it is why the grammar's guarantee is *structural*, not a\nsanitizer. Validating a document against the vnode schema proves it is\nwell-formed, **not** that it is safe to render.\n\nWhen a view arrives from somewhere you do not control — a tenant, a remote\nservice, a language model — pass `{ safe: true }`:\n\n```js\nrenderToString(untrustedVnode, { safe: true });\ncreateDomRenderer(container, { safe: true, onUnsafe: (i) => log(i) });\n```\n\nBoth build the **same** policy ([`createSafePolicy`](src/safe.js)), so the\nclient and the server neutralize an attack identically. In safe mode:\n\n- **tags** are restricted to an allow-list of inert HTML and SVG elements —\n `script`, `iframe`, `object`, `style`, `link`, `foreignObject` and the rest\n are dropped, and so is any tag whose *name* is not a bare identifier (which\n closes structural injection through a tag like `div>