@@ -32,6 +32,10 @@ internal sealed class PropertyFactory
         // UnknownProperty (Converters.Any) and validated later against the syntax string.
         private readonly Dictionary<string, LonghandCreator> _propertyDescriptors;
 
+        // @font-palette-values descriptors (font-family / base-palette / override-colors). Stored raw via
+        // UnknownProperty and validated later when the palette is resolved.
+        private readonly Dictionary<string, LonghandCreator> _fontPaletteDescriptors;
+
         private readonly Dictionary<string, LonghandCreator> _longhands;
 
         private readonly Dictionary<string, string[]> _mappings;
@@ -230,6 +234,7 @@ private PropertyFactory()
                 PropertyNames.FontWeight,
                 PropertyNames.LineHeight);
             AddLonghand(PropertyNames.FontFamily, () => new FontFamilyProperty(), false, true);
+            AddLonghand(PropertyNames.FontPalette, () => new FontPaletteProperty());
             AddLonghand(PropertyNames.FontSize, () => new FontSizeProperty(), true);
             AddLonghand(PropertyNames.FontSizeAdjust, () => new FontSizeAdjustProperty(), true);
             AddLonghand(PropertyNames.FontStyle, () => new FontStyleProperty(), false, true);
@@ -534,6 +539,13 @@ private PropertyFactory()
                 { PropertyNames.Inherits, () => new UnknownProperty(PropertyNames.Inherits) },
             };
 
+            _fontPaletteDescriptors = new Dictionary<string, LonghandCreator>(StringComparer.OrdinalIgnoreCase)
+            {
+                { PropertyNames.FontFamily, () => new UnknownProperty(PropertyNames.FontFamily) },
+                { PropertyNames.BasePalette, () => new UnknownProperty(PropertyNames.BasePalette) },
+                { PropertyNames.OverrideColors, () => new UnknownProperty(PropertyNames.OverrideColors) },
+            };
+
             _longhands = _longhandsBuilder;
             _mappings = _mappingsBuilder;
             _shorthands = _shorthandsBuilder;
@@ -589,6 +601,11 @@ public Property CreatePropertyDescriptor(string name)
             return _propertyDescriptors.TryGetValue(name, out var propertyCreator) ? propertyCreator() : null;
         }
 
+        public Property CreateFontPaletteDescriptor(string name)
+        {
+            return _fontPaletteDescriptors.TryGetValue(name, out var propertyCreator) ? propertyCreator() : null;
+        }
+
         public Property CreateViewport(string name)
         {
             var feature = MediaFeatureFactory.Instance.Create(name);
 
@@ -27,6 +27,7 @@ public Token Get()
             return Data(current);
         }
 
+
         internal void RaiseErrorOccurred(ParseError error, TextPosition position)
         {
             var handler = Error;
@@ -319,14 +320,44 @@ private Token StringSingleQuote()
         private Token ColorLiteral()
         {
             var current = GetNext();
-            while (current.IsHex())
+
+            // '#' not followed by a name code point or a valid escape is a plain delimiter (CSS Syntax §4.3.4).
+            if (!current.IsName() && !IsValidEscape(current))
             {
-                StringBuffer.Append(current);
-                current = GetNext();
+                Back();
+                return NewDelimiter(Symbols.Num);
             }
 
             Back();
-            return NewColor(FlushBuffer());
+
+            // A '#' always begins a <hash-token>, consuming a whole <name> (CSS Syntax §4.3.4). Classify it as
+            // a color literal only when the name is entirely hex digits (e.g. "#f00"); otherwise keep it as an
+            // id hash-token (e.g. "#hero" — an id-selector inside element()), instead of truncating at the
+            // first non-hex character (which turned "#hero" into an empty color plus a stray "hero" ident).
+            var allHex = true;
+
+            while (true)
+            {
+                current = GetNext();
+
+                if (current.IsName())
+                {
+                    allHex = allHex && current.IsHex();
+                    StringBuffer.Append(current);
+                }
+                else if (IsValidEscape(current))
+                {
+                    current = GetNext();
+                    StringBuffer.Append(ConsumeEscape(current));
+                    allHex = false;
+                }
+                else
+                {
+                    Back();
+                    var text = FlushBuffer();
+                    return allHex ? NewColor(text) : NewHash(text);
+                }
+            }
         }
 
         private Token HashStart()
@@ -910,9 +941,18 @@ private Token UnicodeRange(char current)
                 current = GetNext();
             }
 
-            if (StringBuffer.Length != 6)
+            // Fewer than 6 hex digits may be followed by '?' wildcards (which pad the value and are
+            // mutually exclusive with the start-end range form) OR - like a full 6-digit start - by a
+            // '-<hex>' range end (e.g. U+41-5A). Only the wildcard form is handled here; a '-' falls
+            // through to the shared range handling below.
+            if (StringBuffer.Length != 6 && current == Symbols.QuestionMark)
             {
-                for (var i = 0; i < 6 - StringBuffer.Length; i++)
+                // The wildcard budget must be captured up front: appending to StringBuffer inside the loop
+                // would otherwise shrink a "6 - StringBuffer.Length" bound on every iteration, so only half
+                // the available wildcards were ever consumed (U+?????? stopped after three).
+                var wildcards = 6 - StringBuffer.Length;
+
+                for (var i = 0; i < wildcards; i++)
                 {
                     if (current != Symbols.QuestionMark)
                     {
 
@@ -42,6 +42,22 @@ public TextPosition GetCurrentPosition()
             return new TextPosition(Line, Column, Position);
         }
 
+        /// <summary>
+        /// Repositions the lexer so the next token is re-lexed from character index
+        /// <paramref name="sourceIndex"/> (a raw <see cref="Source"/> index, as returned by
+        /// <see cref="InsertionPoint"/>). Unlike setting <see cref="InsertionPoint"/> (whose
+        /// <c>BackNative</c> loop is not a faithful inverse across <c>\r\n</c> normalization), this
+        /// restores the character stream exactly — line/column tracking is not rewound (it only affects
+        /// reported positions, never token content). Used by <see cref="StylesheetComposer"/> to rewind a
+        /// CSS-Nesting classification look-ahead so a declaration re-lexes cleanly in value mode.
+        /// </summary>
+        public void RewindTo(int sourceIndex)
+        {
+            Source.Index = sourceIndex;
+            // Non-EOF so the next Advance() actually reads Source[sourceIndex] rather than short-circuiting.
+            Current = Symbols.Null;
+        }
+
         protected char SkipSpaces()
         {
             var c = GetNext();
 
@@ -56,6 +56,7 @@ private enum State : byte
                 {PseudoClassNames.Has, ctx => new HasFunctionState(ctx)},
                 {PseudoClassNames.Matches, ctx => new MatchesFunctionState(ctx, PseudoClassNames.Matches)},
                 {PseudoClassNames.Is, ctx => new MatchesFunctionState(ctx, PseudoClassNames.Is)},
+                {PseudoClassNames.Where, ctx => new MatchesFunctionState(ctx, PseudoClassNames.Where)},
                 {PseudoClassNames.HostContext, ctx => new HostContextFunctionState(ctx)}
             };
 
@@ -375,7 +376,7 @@ private void Insert(ISelector selector)
 
                     var combinator = GetCombinator();
                     _complex.AppendSelector(_temp, combinator);
-                    _temp = selector;
+                    _temp = WrapPseudoElement(selector);
                 }
             }
             else
@@ -385,6 +386,27 @@ private void Insert(ISelector selector)
             }
         }
 
+        // CssData.DoesSelectorMatch(CompoundSelector, box) is the only place that synthesizes
+        // ::before/::after (and ::marker) child boxes as a match side effect, and it only runs for a
+        // pseudo-element that's the last member of a CompoundSelector. A pseudo-element preceded by a
+        // combinator (e.g. "E :after", with whitespace) would otherwise become a bare, unwrapped _temp
+        // here - which CssData's ComplexSelector subject-match dispatches straight to the plain
+        // DoesSelectorMatch(PseudoElementSelector, box) overload (which only checks whether the flag is
+        // already set, never sets it), so the pseudo-element box would never actually get created.
+        // Wrapping it in a single-member CompoundSelector as soon as it becomes a standalone selector
+        // routes it through the one, already-correct synthesis path instead of needing a second
+        // implementation of the same logic in CssData.
+        //
+        // Deliberately NOT applied in the other "_temp == null" branch above (a pseudo-element with no
+        // combinator at all, i.e. it's the entire selector - "*:before" written as bare ":before"): that
+        // shape has no ancestor restriction, so synthesizing on every match would mean synthesizing on
+        // literally every element in the document. The UA stylesheet's own
+        // ":before, :after { white-space: pre-line }" rule (CssDefaults.cs) is exactly this shape and
+        // relies on the existing non-synthesizing behavior - it exists to style already-synthesized
+        // pseudo-element boxes, not to create one on every element.
+        private static ISelector WrapPseudoElement(ISelector selector) =>
+            selector is PseudoElementSelector ? new CompoundSelector { selector } : selector;
+
         private Combinator GetCombinator()
         {
             while (_combinators.Count > 1 && _combinators.Peek() == Combinator.Descendent) _combinators.Pop();
@@ -478,7 +500,6 @@ private ISelector GetPseudoFunction(FunctionToken arguments)
             }
 
             return null;
-
         }
 
         private SelectorConstructor CreateChild()
@@ -682,7 +703,7 @@ private sealed class ContainsFunctionState : FunctionState
 
             protected override bool OnToken(Token token)
             {
-                if (token.Type == TokenType.Ident || token.Type == TokenType.String)
+                if ((token.Type == TokenType.Ident || token.Type == TokenType.String))
                 {
                     _value = token.Data;
                 }
@@ -787,16 +808,12 @@ protected override bool OnToken(Token token)
             {
                 switch (_state)
                 {
-                    case ParseState.Initial:
-                        return OnInitial(token);
-                    case ParseState.AfterInitialSign:
-                        return OnAfterInitialSign(token);
-                    case ParseState.Offset:
-                        return OnOffset(token);
-                    case ParseState.BeforeOf:
-                        return OnBeforeOf(token);
-                    default:
-                        return OnAfter(token);
+                    case ParseState.Initial: return OnInitial(token);
+                    case ParseState.AfterInitialSign: return OnAfterInitialSign(token);
+                    case ParseState.Offset: return OnOffset(token);
+                    case ParseState.AfterOffsetSign: return OnAfterOffsetSign(token);
+                    case ParseState.BeforeOf: return OnBeforeOf(token);
+                    default: return OnAfter(token);
                 }
             }
 
@@ -866,6 +883,16 @@ private bool OnOffset(Token token)
                 {
                     case TokenType.Whitespace:
                         return false;
+                    case TokenType.Delim when token.Data.IsOneOf("+", "-"):
+                        // The An+B offset's sign is a standalone delim token when whitespace separates it
+                        // from B - the "<n-dimension> ['+' | '-'] <signless-integer>" production of
+                        // <a-n-plus-b> (CSS Syntax 3 §6.2); §6.1 gives `3n + 1` as a valid example. The
+                        // compact form `10n+1` instead arrives as a single signed <number>, handled by the
+                        // Number case below. Without this branch a spaced sign fell through to OnBeforeOf
+                        // and invalidated the selector.
+                        _sign = token.Data == "-" ? -1 : 1;
+                        _state = ParseState.AfterOffsetSign;
+                        return false;
                     case TokenType.Number:
                         _valid = _valid && ((NumberToken)token).IsInteger && int.TryParse(token.Data, out _offset);
                         _offset *= _sign;
@@ -876,6 +903,26 @@ private bool OnOffset(Token token)
                 }
             }
 
+            private bool OnAfterOffsetSign(Token token)
+            {
+                switch (token.Type)
+                {
+                    case TokenType.Whitespace:
+                        return false;
+                    case TokenType.Number when !token.Data.StartsWith("+", StringComparison.Ordinal) && !token.Data.StartsWith("-", StringComparison.Ordinal):
+                        // The production requires a <signless-integer> here, defined as "a <number-token>
+                        // with its type flag set to integer, and no sign character" (CSS Syntax 3 §6.2), so
+                        // `10n + -1` and `10n + +1` are invalid - §6.1 lists `3n + -6` as an invalid example.
+                        _valid = _valid && ((NumberToken)token).IsInteger && int.TryParse(token.Data, out _offset);
+                        _offset *= _sign;
+                        _state = ParseState.BeforeOf;
+                        return false;
+                    default:
+                        _valid = false;
+                        return token.Type == TokenType.RoundBracketClose;
+                }
+            }
+
             private bool OnInitial(Token token)
             {
                 if (token.Type == TokenType.Whitespace) return false;
@@ -910,6 +957,7 @@ private enum ParseState : byte
                 Initial,
                 AfterInitialSign,
                 Offset,
+                AfterOffsetSign,
                 BeforeOf,
                 AfterOf
             }