diff --git a/AGENTS.md b/AGENTS.md
index ec192f1..032b119 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -31,7 +31,7 @@ Fix root cause. Unsure: read more code; if stuck, ask w/ short options. Unrecogn
 | formats/format-support | Formats, bytes-in API, detection order, DOCX + spreadsheet mapping |
 | integrations/tool-contract | `MarkkitTool` LLM tool (`tool` feature), Everruns toolkit contract |
 | security/security-model | One-page threat/invariant summary |
-| security/threat-model | Threats T1-T9, mitigations, test map, resource limits, invariants S1-S20 |
+| security/threat-model | Threats T1-T9, mitigations, test map, resource limits, invariants S1-S21 |
 | runtimes/python-package | PyO3 `markkit` module, maturin, PyPI |
 | runtimes/wasm-package | wasm-bindgen `@everruns/markkit-wasm`, browser/edge, build + tests |
 | runtimes/node-package | NAPI-RS `@everruns/markkit`, npm, binding parity table |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2ba5047..132f985 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -152,6 +152,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ### Fixed
 
+- HTML: deeply nested input no longer costs quadratic time. 687 KiB of nested `<div>`s took
+  12.6 s and 292 KiB of unclosed nested tables ran past the 60 s timeout; tags nested past
+  `max_nesting_depth` are now dropped (text kept) before html5ever parses, so both take
+  milliseconds.
+- HTML: rows of nested tables are no longer copied into every enclosing table (output grew 4x
+  per nesting level).
+- HTML: text flattened past `max_nesting_depth` no longer includes `<script>`, `<style>`,
+  `<template>` and other non-content element bodies.
 - Spreadsheets: a sheet with a single row now renders that row as data under Excel column letters
   (`| A | B |`) instead of as a header with no rows.
 - Spreadsheets: `Extraction.title` is filled from document properties (XLSX `docProps/core.xml`,
diff --git a/crates/markkit/src/html/mod.rs b/crates/markkit/src/html/mod.rs
index 945aebc..5115fb4 100644
--- a/crates/markkit/src/html/mod.rs
+++ b/crates/markkit/src/html/mod.rs
@@ -3,6 +3,7 @@
 //! Converts HTML input into the canonical IR.
 
 mod metadata;
+mod nesting;
 mod parser;
 mod readability;
 mod urls;
diff --git a/crates/markkit/src/html/nesting.rs b/crates/markkit/src/html/nesting.rs
new file mode 100644
index 0000000..9e4b050
--- /dev/null
+++ b/crates/markkit/src/html/nesting.rs
@@ -0,0 +1,488 @@
+//! Nesting cap applied to raw HTML before html5ever sees it.
+//!
+//! Decisions:
+//! - html5ever's tree builder is quadratic in nesting depth: most start tags
+//!   scan the stack of open elements ("has a `p` in button scope", table
+//!   context resets), so N nested `<div>`s cost O(N²). Measured before this
+//!   cap: 687 KiB of nested divs took 12.6 s, 292 KiB of nested tables passed
+//!   the 60 s timeout, and html5ever cannot be interrupted. THREAT[T2c].
+//! - The walker flattens everything deeper than `max_nesting_depth` to text
+//!   anyway, so tags past the cap carry no structure we keep. This pass drops
+//!   start tags that would open past `cap` (and as many following end tags),
+//!   keeping all text. The tree builder's stack then stays near `cap`, and
+//!   cost is O(input × cap): linear in input.
+//! - Approximate HTML tokenizing, single pass, bounded state: comments,
+//!   `<!...>`/`<?...>`, quoted attribute values and raw-text elements
+//!   (`script`, `style`, ...) are skipped so `<` inside them never counts.
+//!   Void elements and elements with optional end tags (`p`, `li`, `td`, ...)
+//!   do not count as nesting, except table structure, which closes implicitly
+//!   the way the HTML spec does. `/>` self-closes only inside `svg`/`math`.
+//!   Under-counting only lets more depth through (bounded by `cap` per
+//!   counted level); the input is returned unchanged unless the cap is hit.
+//! - The stack holds at most `cap` names, so end-tag matching is O(cap).
+
+use std::borrow::Cow;
+
+/// Elements whose content never reaches the output (the walker skips them).
+pub(crate) const NON_CONTENT: &[&str] = &[
+    "script", "style", "noscript", "iframe", "object", "embed", "form", "input", "button",
+    "select", "textarea", "svg", "canvas", "video", "audio", "source", "track", "map", "area",
+    "template",
+];
+
+const FOREIGN: &[&str] = &["svg", "math"];
+
+/// Elements whose content is raw text up to their end tag.
+const RAW_TEXT: &[&str] = &[
+    "script", "style", "textarea", "title", "xmp", "iframe", "noembed", "noframes", "noscript",
+];
+
+/// Elements that never have content.
+const VOID: &[&str] = &[
+    "area", "base", "basefont", "bgsound", "br", "col", "embed", "frame", "hr", "image", "img",
+    "input", "keygen", "link", "meta", "param", "source", "track", "wbr",
+];
+
+/// Optional end tag, cannot nest in itself: not counted.
+const UNCOUNTED: &[&str] = &[
+    "p", "li", "dt", "dd", "option", "optgroup", "rb", "rt", "rtc", "rp", "html", "head", "body",
+    "colgroup", "caption",
+];
+
+/// Drop start tags that would nest deeper than `cap` (and matching end tags).
+/// Returns the input unchanged when the cap is never reached.
+pub(crate) fn cap_nesting(html: &str, cap: usize, skip_hidden: bool) -> Cow<'_, str> {
+    let b = html.as_bytes();
+    let mut stack: Vec<&[u8]> = Vec::new();
+    let mut foreign = 0usize; // open svg/math elements on the stack
+    let mut overflow = 0usize; // dropped start tags awaiting an end tag
+    let mut out: Option<String> = None;
+    let mut copied = 0usize; // input[..copied] already in `out`
+    let mut i = 0usize;
+
+    let drop_range = |out: &mut Option<String>, copied: &mut usize, start: usize, end: usize| {
+        let o = out.get_or_insert_with(|| String::with_capacity(html.len()));
+        o.push_str(&html[*copied..start]);
+        *copied = end;
+    };
+
+    while let Some(off) = memchr(b'<', &b[i..]) {
+        let lt = i + off;
+        let rest = &b[lt + 1..];
+        if rest.starts_with(b"!--") {
+            i = find(b, lt + 4, b"-->").map_or(b.len(), |p| p + 3);
+            continue;
+        }
+        if matches!(rest.first(), Some(b'!' | b'?')) {
+            i = memchr(b'>', &b[lt..]).map_or(b.len(), |p| lt + p + 1);
+            continue;
+        }
+        let (is_end, name_start) = match rest.first() {
+            Some(b'/') => (true, lt + 2),
+            _ => (false, lt + 1),
+        };
+        if !b.get(name_start).is_some_and(u8::is_ascii_alphabetic) {
+            i = lt + 1;
+            continue;
+        }
+        let name_end = name_start
+            + b[name_start..]
+                .iter()
+                .position(|c| c.is_ascii_whitespace() || *c == b'/' || *c == b'>')
+                .unwrap_or(b.len() - name_start);
+        let name = &b[name_start..name_end];
+        let (end, self_closing) = tag_end(b, name_end);
+        i = end;
+
+        if is_end {
+            let counted = !one_of(name, VOID) && !one_of(name, UNCOUNTED);
+            if overflow > 0 {
+                // Inside the dropped region every end tag goes; only counted
+                // ones pair with a dropped start tag.
+                overflow -= usize::from(counted);
+                drop_range(&mut out, &mut copied, lt, end);
+            } else if let Some(pos) = stack.iter().rposition(|n| n.eq_ignore_ascii_case(name)) {
+                foreign -= stack[pos..].iter().filter(|n| one_of(n, FOREIGN)).count();
+                stack.truncate(pos);
+            }
+            continue;
+        }
+
+        if one_of(name, RAW_TEXT) && foreign == 0 {
+            // Skip the content and the end tag itself: it must reach
+            // html5ever even while dropping, or the raw text never ends.
+            i = find_end_tag(b, i, name).map_or(b.len(), |p| tag_end(b, p + 2 + name.len()).0);
+            continue;
+        }
+        if name.eq_ignore_ascii_case(b"plaintext") && foreign == 0 {
+            break;
+        }
+        let void = one_of(name, VOID) || (self_closing && (foreign > 0 || one_of(name, FOREIGN)));
+        let uncounted = void || one_of(name, UNCOUNTED);
+        if overflow == 0 {
+            if uncounted {
+                continue;
+            }
+            // Table structure closes implicitly (spec "clear the stack back to
+            // a table / row context"); pop to the enclosing level first.
+            let closes: &[&str] = if one_of(name, &["tbody", "thead", "tfoot"]) {
+                &["tbody", "thead", "tfoot", "tr", "td", "th"]
+            } else if one_of(name, &["tr"]) {
+                &["tr", "td", "th"]
+            } else if one_of(name, &["td", "th"]) {
+                &["td", "th"]
+            } else {
+                &[]
+            };
+            while stack.last().is_some_and(|n| one_of(n, closes)) {
+                stack.pop();
+            }
+        }
+        if overflow > 0 || stack.len() >= cap {
+            // Past the cap every start tag goes (the walker would flatten it
+            // anyway), so html5ever's stack stays at the cap.
+            let mut drop_to = end;
+            if !void
+                && (one_of(name, NON_CONTENT) || (skip_hidden && hidden_tag(&html[name_end..end])))
+            {
+                // Dropping only the tag would expose content the walker
+                // skips (non-content, or hidden under the T9 default); drop
+                // the whole subtree instead (same output).
+                drop_to = skip_subtree(b, end, name);
+                i = drop_to;
+            } else if !uncounted {
+                overflow += 1;
+            }
+            drop_range(&mut out, &mut copied, lt, drop_to);
+            continue;
+        }
+        if one_of(name, FOREIGN) {
+            foreign += 1;
+        }
+        stack.push(name);
+    }
+
+    match out {
+        None => Cow::Borrowed(html),
+        Some(mut o) => {
+            o.push_str(&html[copied..]);
+            Cow::Owned(o)
+        }
+    }
+}
+
+/// Index just past the `>` closing a tag whose attributes start at `from`,
+/// skipping quoted values; and whether it ends in `/>`.
+/// Whether a raw start tag's attribute text (after the name) marks the element
+/// hidden, with the walker's rules (`parser::hidden_by`). Entities in values
+/// are not decoded.
+fn hidden_tag(attrs: &str) -> bool {
+    let pairs = raw_attrs(attrs);
+    super::parser::hidden_by(|want| {
+        pairs
+            .iter()
+            .find(|(n, _)| n.eq_ignore_ascii_case(want))
+            .map(|&(_, v)| v)
+    })
+}
+
+/// `(name, value)` pairs of raw attribute text; valueless attributes get "".
+fn raw_attrs(s: &str) -> Vec<(&str, &str)> {
+    let b = s.as_bytes();
+    let mut out = Vec::new();
+    let mut i = 0;
+    loop {
+        while i < b.len() && (b[i].is_ascii_whitespace() || b[i] == b'/') {
+            i += 1;
+        }
+        if i >= b.len() || b[i] == b'>' {
+            return out;
+        }
+        let start = i;
+        while i < b.len() && !(b[i].is_ascii_whitespace() || matches!(b[i], b'=' | b'>' | b'/')) {
+            i += 1;
+        }
+        let name = &s[start..i];
+        while i < b.len() && b[i].is_ascii_whitespace() {
+            i += 1;
+        }
+        if i >= b.len() || b[i] != b'=' {
+            out.push((name, ""));
+            continue;
+        }
+        i += 1;
+        while i < b.len() && b[i].is_ascii_whitespace() {
+            i += 1;
+        }
+        let value = match b.get(i) {
+            Some(&q @ (b'"' | b'\'')) => {
+                let vstart = i + 1;
+                let vend = memchr(q, &b[vstart..]).map_or(b.len(), |p| vstart + p);
+                i = (vend + 1).min(b.len());
+                &s[vstart..vend]
+            }
+            _ => {
+                let vstart = i;
+                while i < b.len() && !(b[i].is_ascii_whitespace() || b[i] == b'>') {
+                    i += 1;
+                }
+                &s[vstart..i]
+            }
+        };
+        out.push((name, value));
+    }
+}
+
+fn tag_end(b: &[u8], from: usize) -> (usize, bool) {
+    let mut i = from;
+    let mut quote = None;
+    let mut prev = 0u8;
+    while i < b.len() {
+        let c = b[i];
+        match quote {
+            Some(q) if c == q => quote = None,
+            Some(_) => {}
+            None if c == b'"' || c == b'\'' => quote = Some(c),
+            None if c == b'>' => return (i + 1, prev == b'/'),
+            None => {}
+        }
+        if !c.is_ascii_whitespace() {
+            prev = c;
+        }
+        i += 1;
+    }
+    (b.len(), false)
+}
+
+/// Index past the end tag matching an open `name` element whose content
+/// starts at `from`, counting same-name nesting; input end if unclosed.
+fn skip_subtree(b: &[u8], from: usize, name: &[u8]) -> usize {
+    let mut depth = 1usize;
+    let mut i = from;
+    while let Some(off) = memchr(b'<', &b[i..]) {
+        let lt = i + off;
+        let (is_end, start) = match b.get(lt + 1) {
+            Some(b'/') => (true, lt + 2),
+            _ => (false, lt + 1),
+        };
+        let after = start + name.len();
+        let matches = b.len() > after
+            && b[start..after].eq_ignore_ascii_case(name)
+            && (b[after].is_ascii_whitespace() || b[after] == b'/' || b[after] == b'>');
+        if !matches {
+            i = lt + 1;
+            continue;
+        }
+        let (end, self_closing) = tag_end(b, after);
+        i = end;
+        if is_end {
+            depth -= 1;
+            if depth == 0 {
+                return end;
+            }
+        } else if !self_closing {
+            depth += 1;
+        }
+    }
+    b.len()
+}
+
+/// Start of `</name` (ASCII case-insensitive) at or after `from`.
+fn find_end_tag(b: &[u8], from: usize, name: &[u8]) -> Option<usize> {
+    let mut i = from;
+    while let Some(off) = memchr(b'<', &b[i..]) {
+        let p = i + off;
+        let tail = &b[p + 1..];
+        if tail.first() == Some(&b'/')
+            && tail.len() > name.len()
+            && tail[1..=name.len()].eq_ignore_ascii_case(name)
+        {
+            return Some(p);
+        }
+        i = p + 1;
+    }
+    None
+}
+
+/// ASCII case-insensitive membership; no allocation per tag.
+fn one_of(name: &[u8], list: &[&str]) -> bool {
+    list.iter().any(|n| n.as_bytes().eq_ignore_ascii_case(name))
+}
+
+fn find(b: &[u8], from: usize, needle: &[u8]) -> Option<usize> {
+    b.get(from..)?
+        .windows(needle.len())
+        .position(|w| w == needle)
+        .map(|p| from + p)
+}
+
+fn memchr(c: u8, b: &[u8]) -> Option<usize> {
+    b.iter().position(|&x| x == c)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn depth_of(html: &str) -> usize {
+        // Max element depth of html5ever's DOM, iteratively.
+        let dom = scraper::Html::parse_document(html);
+        let mut max = 0;
+        let mut stack = vec![(dom.tree.root(), 0usize)];
+        while let Some((n, d)) = stack.pop() {
+            max = max.max(d);
+            stack.extend(n.children().map(|c| (c, d + 1)));
+        }
+        max
+    }
+
+    #[test]
+    fn shallow_input_is_borrowed_unchanged() {
+        let html = "<html><body><div><p>a<p>b<ul><li>x<li>y</ul><table><tr><td>1<td>2<tr><td>3</table></div></body></html>";
+        assert!(matches!(cap_nesting(html, 8, true), Cow::Borrowed(_)));
+    }
+
+    #[test]
+    fn deep_divs_are_capped_and_text_kept() {
+        let html = format!("{}deep text{}", "<div>".repeat(5000), "</div>".repeat(5000));
+        let capped = cap_nesting(&html, 100, true);
+        assert!(capped.contains("deep text"));
+        assert_eq!(capped.matches("<div>").count(), 100);
+        assert_eq!(capped.matches("</div>").count(), 100);
+        assert!(depth_of(&capped) <= 105);
+    }
+
+    #[test]
+    fn unclosed_divs_are_capped() {
+        let html = "<div>x".repeat(3000);
+        let capped = cap_nesting(&html, 50, true);
+        assert_eq!(capped.matches("<div>").count(), 50);
+        assert_eq!(capped.matches('x').count(), 3000);
+    }
+
+    #[test]
+    fn nested_tables_are_capped() {
+        let html = "<table><tr><td>".repeat(3000);
+        let capped = cap_nesting(&html, 60, true);
+        assert!(depth_of(&capped) < 300);
+    }
+
+    #[test]
+    fn self_closing_div_still_counts_outside_svg() {
+        // html5ever opens `<div/>`; only foreign content self-closes.
+        let html = "<div/>".repeat(1000);
+        let capped = cap_nesting(&html, 10, true);
+        assert_eq!(capped.matches("<div/>").count(), 10);
+        let svg = format!("<svg>{}</svg>", "<g/>".repeat(1000));
+        assert!(matches!(cap_nesting(&svg, 10, true), Cow::Borrowed(_)));
+    }
+
+    #[test]
+    fn markup_in_comments_attributes_and_raw_text_is_ignored() {
+        let divs = "<div>".repeat(100);
+        let html = format!(
+            "<!-- {divs} --><a title='{divs}' href=\"x>y\">a</a><script>{divs}</script><style>{divs}</style><textarea>{divs}</TEXTAREA>"
+        );
+        assert!(matches!(cap_nesting(&html, 5, true), Cow::Borrowed(_)));
+    }
+
+    #[test]
+    fn optional_end_tags_and_voids_do_not_count() {
+        let html = "<p>a<li>b<br><img src=x><td>c<option>d".repeat(1000);
+        assert!(matches!(cap_nesting(&html, 5, true), Cow::Borrowed(_)));
+    }
+
+    #[test]
+    fn implied_close_by_ancestor_end_tag() {
+        // `</div>` closes the unclosed spans inside it; depth must not drift.
+        let html = "<div><span><b>x</div>".repeat(1000);
+        assert!(matches!(cap_nesting(&html, 10, true), Cow::Borrowed(_)));
+    }
+
+    #[test]
+    fn raw_text_end_tags_survive_while_dropping() {
+        // Dropping `</script>` would turn the rest of the page into script.
+        let html = format!(
+            "{}<script>x()</script><style>.a{{}}</style><p>after</p>{}",
+            "<div>".repeat(50),
+            "</div>".repeat(50)
+        );
+        let capped = cap_nesting(&html, 10, true);
+        assert!(capped.contains("<script>x()</script><style>.a{}</style>"));
+        assert!(capped.contains("after"));
+    }
+
+    #[test]
+    fn uncounted_end_tags_do_not_consume_overflow() {
+        let html = format!(
+            "{}<p>a</p><li>b</li>{}",
+            "<div>".repeat(20),
+            "</div>".repeat(20)
+        );
+        let capped = cap_nesting(&html, 10, true);
+        // Past the cap the p/li tags go too, their text stays, and their end
+        // tags do not close dropped divs.
+        assert!(capped.contains("ab"));
+        assert_eq!(capped.matches("<div>").count(), 10);
+        assert_eq!(capped.matches("</div>").count(), 10);
+    }
+
+    #[test]
+    fn non_content_past_the_cap_is_dropped_whole() {
+        let html = format!(
+            "{}<template>tpl<template>in</template></template><form><b>f</b></form><p>after</p>",
+            "<div>".repeat(20)
+        );
+        let capped = cap_nesting(&html, 10, true);
+        assert!(!capped.contains("tpl") && !capped.contains("in<") && !capped.contains("f</b>"));
+        assert!(capped.contains("after"));
+        let objects = "<object>".repeat(100_000) + "x";
+        assert!(!cap_nesting(&objects, 10, true).contains('x'));
+    }
+
+    #[test]
+    fn hidden_tags_past_the_cap_are_dropped_whole() {
+        // 11 divs: the last is dropped, so even optional-end tags (`p`) are
+        // in the dropped region (at the cap they would stay in the DOM, where
+        // the walker's flattener checks them).
+        let deep = "<div>".repeat(11);
+        for tag in [
+            r#"<span hidden>S</span>"#,
+            r#"<div aria-hidden = 'TRUE'>S</div>"#,
+            r#"<p class=x style="color:red; display : none !important">S</p>"#,
+            r#"<SPAN STYLE=visibility:hidden>S</SPAN>"#,
+        ] {
+            let html = format!("{deep}a{tag}b");
+            let html = html.as_str();
+            let capped = cap_nesting(html, 10, true);
+            assert!(
+                capped.contains("ab") && !capped.contains('S'),
+                "{tag}: {capped}"
+            );
+            // Opted in: only the tag goes, the text stays.
+            assert!(cap_nesting(html, 10, false).contains('S'), "{tag}");
+        }
+        let shown = format!("{deep}<span hidden=until-found>S</span><b title='x>y'>T</b>");
+        let capped = cap_nesting(&shown, 10, true);
+        assert!(capped.contains('S') && capped.contains('T'), "{capped}");
+    }
+
+    #[test]
+    fn raw_attrs_parse_quotes_and_bare_values() {
+        assert_eq!(
+            raw_attrs(r#" a b=1 c = "x y" d='z>' /"#),
+            [("a", ""), ("b", "1"), ("c", "x y"), ("d", "z>")]
+        );
+        assert_eq!(raw_attrs(r#" e="unterminated"#), [("e", "unterminated")]);
+    }
+
+    #[test]
+    fn malformed_tails_do_not_panic() {
+        for s in [
+            "<", "</", "<div", "<div a='", "<!--", "<!", "<script>", "</>", "<1>", "<\u{e9}>",
+        ] {
+            let _ = cap_nesting(s, 1, true);
+            let _ = cap_nesting(&format!("<div>{s}"), 0, true);
+        }
+    }
+}
diff --git a/crates/markkit/src/html/parser.rs b/crates/markkit/src/html/parser.rs
index f6c385c..2ffd2e8 100644
--- a/crates/markkit/src/html/parser.rs
+++ b/crates/markkit/src/html/parser.rs
@@ -37,26 +37,32 @@ use crate::rules::ElementAction;
 use url::Url;
 
 use super::metadata::PageInfo;
+use super::nesting::{self, NON_CONTENT};
 use super::{readability, urls};
 
+/// Extra levels kept above `max_nesting_depth` before raw tags are dropped:
+/// the walker flattens there anyway, the slack covers `html`/`body` and
+/// implied elements the pre-scan does not count.
+const NESTING_SLACK: usize = 8;
+
 /// Hidden-content policy (threat model T9): an element a reader never sees is
 /// skipped unless `include_hidden_content(true)`. Only signals on the element
 /// itself count (`hidden`, `aria-hidden="true"`, inline `style`); stylesheet and
 /// class-based hiding (`.sr-only`, off-screen positioning) is not detected.
 fn is_hidden(el: &scraper::node::Element) -> bool {
-    if el
-        .attr("hidden")
-        .is_some_and(|v| !v.eq_ignore_ascii_case("until-found"))
-    {
+    hidden_by(|name| el.attr(name))
+}
+
+/// [`is_hidden`] over any attribute lookup (also used by the nesting pre-scan,
+/// which sees raw tags).
+pub(crate) fn hidden_by<'v>(attr: impl Fn(&str) -> Option<&'v str>) -> bool {
+    if attr("hidden").is_some_and(|v| !v.eq_ignore_ascii_case("until-found")) {
         return true;
     }
-    if el
-        .attr("aria-hidden")
-        .is_some_and(|v| v.trim().eq_ignore_ascii_case("true"))
-    {
+    if attr("aria-hidden").is_some_and(|v| v.trim().eq_ignore_ascii_case("true")) {
         return true;
     }
-    let Some(style) = el.attr("style") else {
+    let Some(style) = attr("style") else {
         return false;
     };
     style.split(';').any(|decl| {
@@ -173,12 +179,21 @@ impl<'a> HtmlParser<'a> {
 
     /// Parse an HTML string into a [`Document`].
     pub fn parse(&self, html: &str) -> Result<Document, Error> {
-        self.parse_dom(&Html::parse_document(html))
+        self.parse_dom(&self.parse_html5ever(html))
+    }
+
+    /// html5ever parse of `html` with nesting capped first (see `nesting`).
+    fn parse_html5ever(&self, html: &str) -> Html {
+        Html::parse_document(&nesting::cap_nesting(
+            html,
+            self.max_depth + NESTING_SLACK,
+            !self.config.include_hidden_content,
+        ))
     }
 
     /// Parse an HTML string into a [`Document`] plus page title and metadata.
     pub(crate) fn parse_page(&self, html: &str) -> Result<(Document, PageInfo), Error> {
-        let dom = Html::parse_document(html);
+        let dom = self.parse_html5ever(html);
         let this = self.for_document(&dom);
         Ok((
             this.convert_dom(&dom)?,
@@ -325,7 +340,7 @@ impl<'a> HtmlParser<'a> {
         }
         if depth >= self.max_depth {
             // At max depth, just extract text
-            let text: String = parent.text().collect();
+            let text = flat_text(parent, !self.config.include_hidden_content);
             let trimmed = text.trim();
             if !trimmed.is_empty() {
                 out.push(Node::Text(trimmed.to_string()));
@@ -410,7 +425,7 @@ impl<'a> HtmlParser<'a> {
             return None;
         }
         if depth >= self.max_depth {
-            let text: String = el.text().collect();
+            let text = flat_text(el, !self.config.include_hidden_content);
             let trimmed = text.trim();
             if trimmed.is_empty() {
                 return None;
@@ -609,9 +624,7 @@ impl<'a> HtmlParser<'a> {
             "hr" => Some(Node::ThematicBreak),
 
             // Skip non-content elements
-            "script" | "style" | "noscript" | "template" | "iframe" | "object" | "embed"
-            | "form" | "input" | "button" | "select" | "textarea" | "svg" | "canvas" | "video"
-            | "audio" | "source" | "track" | "map" | "area" => None,
+            name if NON_CONTENT.contains(&name) => None,
 
             // Unknown element: try to extract inline content
             _ => {
@@ -927,7 +940,7 @@ impl<'a> HtmlParser<'a> {
     /// `<a>` that is a footnote reference: record target and build the node.
     fn footnote_reference(&self, el: scraper::ElementRef<'_>) -> Option<Node> {
         let target = el.value().attr("href")?.strip_prefix('#')?;
-        let text: String = el.text().collect();
+        let text = flat_text(el, !self.config.include_hidden_content);
         let text = text
             .trim()
             .trim_start_matches('[')
@@ -951,7 +964,7 @@ impl<'a> HtmlParser<'a> {
             return nodes;
         }
         if depth >= self.max_depth {
-            let text: String = el.text().collect();
+            let text = flat_text(el, !self.config.include_hidden_content);
             let trimmed = text.trim();
             if !trimmed.is_empty() {
                 nodes.push(Node::Text(trimmed.to_string()));
@@ -1040,17 +1053,15 @@ impl<'a> HtmlParser<'a> {
         exclude: &[Selector],
         depth: usize,
     ) -> Option<Node> {
-        let thead_sel = Selector::parse("thead").unwrap();
-        let tbody_sel = Selector::parse("tbody").unwrap();
-        let tr_sel = Selector::parse("tr").unwrap();
-
         let mut headers: Vec<TableCell> = Vec::new();
         let mut alignments: Vec<Alignment> = Vec::new();
         let mut rows: Vec<Vec<TableCell>> = Vec::new();
 
-        if let Some(thead) = table_el.select(&thead_sel).next()
-            && let Some(tr) = thead.select(&tr_sel).next()
-        {
+        // Direct structure only: a descendant query would also pick up the
+        // rows of nested tables, duplicating them into every enclosing table
+        // (output and work grew 4x per nesting level). THREAT[T2c].
+        let (head_row, body_rows) = table_rows(table_el);
+        if let Some(tr) = head_row {
             let ths = row_cells(tr, &["th", "td"]);
             alignments = column_alignments(&ths);
             headers = ths
@@ -1059,13 +1070,6 @@ impl<'a> HtmlParser<'a> {
                 .collect();
         }
 
-        let body_rows: Vec<scraper::ElementRef<'_>> =
-            if let Some(tbody) = table_el.select(&tbody_sel).next() {
-                tbody.select(&tr_sel).collect()
-            } else {
-                table_el.select(&tr_sel).collect()
-            };
-
         for tr in body_rows {
             if self.is_excluded(&tr, exclude) {
                 continue;
@@ -1135,6 +1139,64 @@ impl<'a> HtmlParser<'a> {
     }
 }
 
+/// Text of a subtree flattened at `max_nesting_depth`, without the content of
+/// [`NON_CONTENT`] elements (`el.text()` leaked `<script>`/`<style>` bodies) and,
+/// with `skip_hidden`, of hidden elements (T9). Iterative, so depth costs no stack.
+fn flat_text(el: scraper::ElementRef<'_>, skip_hidden: bool) -> String {
+    let mut out = String::new();
+    let mut skipping = 0usize;
+    for edge in el.traverse() {
+        match edge {
+            ego_tree::iter::Edge::Open(n) => match n.value() {
+                HtmlNode::Element(e)
+                    if skipping > 0
+                        || NON_CONTENT.contains(&e.name())
+                        || (skip_hidden && is_hidden(e)) =>
+                {
+                    skipping += 1;
+                }
+                HtmlNode::Text(t) if skipping == 0 => out.push_str(t),
+                _ => {}
+            },
+            ego_tree::iter::Edge::Close(n) => {
+                if skipping > 0 && n.value().is_element() {
+                    skipping -= 1;
+                }
+            }
+        }
+    }
+    out
+}
+
+/// First row of the first direct `<thead>`, and the body rows: `<tr>`
+/// children of the table and of its direct `<tbody>` sections, in order.
+fn table_rows<'a>(
+    table: scraper::ElementRef<'a>,
+) -> (
+    Option<scraper::ElementRef<'a>>,
+    Vec<scraper::ElementRef<'a>>,
+) {
+    let head = child_elements(table, "thead").find_map(|thead| child_elements(thead, "tr").next());
+    let mut body = Vec::new();
+    for child in table.children().filter_map(scraper::ElementRef::wrap) {
+        match child.value().name() {
+            "tbody" => body.extend(child_elements(child, "tr")),
+            "tr" => body.push(child),
+            _ => {}
+        }
+    }
+    (head, body)
+}
+
+fn child_elements<'a>(
+    el: scraper::ElementRef<'a>,
+    name: &'static str,
+) -> impl Iterator<Item = scraper::ElementRef<'a>> {
+    el.children()
+        .filter_map(scraper::ElementRef::wrap)
+        .filter(move |c| c.value().name() == name)
+}
+
 /// Direct `th`/`td` children of a row (nested tables' cells excluded).
 fn row_cells<'a>(tr: scraper::ElementRef<'a>, names: &[&str]) -> Vec<scraper::ElementRef<'a>> {
     tr.children()
diff --git a/crates/markkit/tests/html_security.rs b/crates/markkit/tests/html_security.rs
index c2b50fc..cc55f76 100644
--- a/crates/markkit/tests/html_security.rs
+++ b/crates/markkit/tests/html_security.rs
@@ -80,6 +80,105 @@ fn deeply_nested_elements() {
     assert!(md.contains("Deep"));
 }
 
+// THREAT[T2c]: html5ever's tree builder is quadratic in nesting depth; the
+// pre-scan nesting cap keeps it linear. Before the cap these took 12.6 s and
+// >60 s in release; a generous budget catches a regression without flaking.
+fn assert_fast(html: &str, what: &str) {
+    let m = Markkit::builder()
+        .timeout(std::time::Duration::from_secs(20))
+        .build();
+    let start = std::time::Instant::now();
+    m.extract_html_sync(html)
+        .unwrap_or_else(|e| panic!("{what}: {e}"));
+    assert!(
+        start.elapsed() < std::time::Duration::from_secs(20),
+        "{what} took {:?}",
+        start.elapsed()
+    );
+}
+
+#[test]
+fn deep_div_nesting_is_linear() {
+    let n = 64_000;
+    let html = format!("{}<p>Deep</p>{}", "<div>".repeat(n), "</div>".repeat(n));
+    assert_fast(&html, "64k nested divs");
+    assert!(convert(&html).contains("Deep"));
+}
+
+#[test]
+fn deep_unclosed_table_nesting_is_linear() {
+    assert_fast(&"<table><tr><td>".repeat(20_000), "20k nested tables");
+}
+
+#[test]
+fn nested_table_rows_are_not_duplicated() {
+    // Rows of an inner table belong to the inner table only. Selecting rows
+    // with a descendant query duplicated them into every enclosing table:
+    // output (and work) grew 4x per nesting level.
+    let html = "<table><tr><td>".repeat(4) + "needle";
+    let md = convert(&html);
+    assert_eq!(md.matches("needle").count(), 1, "{md}");
+    let two = convert(
+        "<table><tr><td>outer<table><tr><td>inner1</td></tr><tr><td>inner2</td></tr></table></td></tr></table>",
+    );
+    assert_eq!(two.matches("inner1").count(), 1, "{two}");
+    assert_eq!(two.matches("inner2").count(), 1, "{two}");
+}
+
+#[test]
+fn deep_nested_tables_output_is_bounded() {
+    let html = "<table><tr><td>".repeat(30) + "x";
+    let md = convert(&html);
+    assert!(md.len() < 64 * 1024, "output {} bytes", md.len());
+}
+
+#[test]
+fn script_and_style_bodies_do_not_leak_past_max_depth() {
+    // Past max_nesting_depth the subtree is flattened to text; that text must
+    // still skip non-content elements (S1/S2/S7).
+    for depth in [300, 5000] {
+        let html = format!(
+            "{}<p>ok</p><script>SECRET_JS()</script><style>.x{{color:red}}</style><template>tpl</template><p>after</p>{}",
+            "<div>".repeat(depth),
+            "</div>".repeat(depth)
+        );
+        let md = convert(&html);
+        assert!(md.contains("ok") && md.contains("after"), "{depth}: {md}");
+        for bad in [
+            "SECRET_JS",
+            "color:red",
+            "tpl",
+            "<style",
+            "<script",
+            "</div>",
+        ] {
+            assert!(!md.contains(bad), "{depth}: {bad} leaked: {md}");
+        }
+    }
+}
+
+#[test]
+fn hidden_content_does_not_leak_past_max_depth() {
+    // Flattened deep subtrees honour the hidden-content default (S20).
+    let html = format!(
+        "{}<p>ok</p><span hidden>SECRET_A</span><div aria-hidden=\"true\">SECRET_B</div><p style=\"display:none\">SECRET_C</p>{}",
+        "<div>".repeat(300),
+        "</div>".repeat(300)
+    );
+    let md = convert(&html);
+    assert!(md.contains("ok"), "{md}");
+    assert!(!md.contains("SECRET"), "{md}");
+    let shown = markkit::Markkit::builder()
+        .include_hidden_content(true)
+        .build()
+        .extract_html_sync(&html)
+        .unwrap();
+    assert!(
+        shown.contains("SECRET_A") && shown.contains("SECRET_C"),
+        "{shown}"
+    );
+}
+
 #[test]
 fn very_long_text_node() {
     let text = "a".repeat(100_000);
diff --git a/knowledge/formats/html-extraction.md b/knowledge/formats/html-extraction.md
index f770e9d..8033ace 100644
--- a/knowledge/formats/html-extraction.md
+++ b/knowledge/formats/html-extraction.md
@@ -134,12 +134,28 @@ Trimming at render time:
 Limit: `limits.max_nesting_depth` (default 256, clamped to `HARD_MAX_NESTING_DEPTH` = 512)
 
 Behavior at depth limit:
-- `convert_children`: extracts all descendant text via `.text().collect()`, trims, emits as single `Text` node
-- `convert_element`: same -- flattens subtree to trimmed text
-- `collect_inline`: same -- flattens subtree to trimmed text
+- `convert_children`: flattens the subtree to its text (`flat_text`: iterative, skips the
+  content of non-content elements such as `script`, `style`, `template`, `form`, and of
+  hidden elements unless `include_hidden_content`), trims,
+  emits a single `Text` node
+- `convert_element`, `collect_inline`: same
 - Empty text at depth limit -> elided
 
-Prevents stack overflow on adversarial nesting. Tested with 1000 nested `<div>` elements.
+Before html5ever runs, `html::nesting::cap_nesting` pre-scans the raw HTML and drops start
+tags (and paired end tags) that would nest deeper than `max_nesting_depth + 8`, keeping their
+text; non-content elements past the cap, and hidden ones (raw-attribute check with the
+walker's T9 rules, entities not decoded) unless `include_hidden_content`, are dropped whole. html5ever's tree builder is
+quadratic in depth (most start tags scan the open-element stack), so this keeps parsing
+linear. Comments, quoted attributes and raw-text elements are skipped; void and optional-end
+elements (`p`, `li`, `td`, ...) are not counted; table parts close implicitly. Input that
+never reaches the cap is passed through unchanged (no copy).
+
+Tables use direct structure only: header = first `<tr>` of the first direct `<thead>`; body
+= direct `<tr>` children and `<tr>` children of direct `<tbody>` sections. Rows of nested
+tables stay in the nested table.
+
+Prevents stack overflow and super-linear time on adversarial nesting. Tested with 64 000
+nested `<div>`s, 20 000 unclosed nested tables, and script/style past the limit.
 
 ## Exclude Selector Defaults
 
diff --git a/knowledge/log.md b/knowledge/log.md
index 1f1eb5e..17f7637 100644
--- a/knowledge/log.md
+++ b/knowledge/log.md
@@ -5,6 +5,7 @@
 * **XLSB support (#11)**: Excel binary workbooks are read by a new bounds-checked BIFF12 reader (`spreadsheet/xlsb.rs`) instead of being rejected; calamine's XLSB reader was not used because it panics on malformed records. Same caps, hidden-sheet and macro rules as XLSX. See [Format Support](formats/format-support.md) and [Threat Model](security/threat-model.md) T6c.
 * **Over-escaping fix**: line-start `#`, `+` and ordered markers are escaped only when followed by whitespace or the end of the text run, so `4.6 out of 5` no longer renders `4\.6` (eval gap). `> - =` stay always escaped. See [Threat Model](security/threat-model.md) T1, [Evaluation Harness](operations/eval.md).
 * **MCP server**: `markkit mcp` serves `MarkkitTool` over MCP stdio (initialize, ping, tools/list, tools/call); line size capped from `--max-size`, tool failures as `isError` results. New [MCP Server](integrations/mcp-server.md) concept; MCP messages row in the [Threat Model](security/threat-model.md).
+* **Nesting cost**: HTML parsing was quadratic in nesting depth (html5ever) and exponential in nested tables (descendant row selection duplicated inner rows); text flattened past `max_nesting_depth` leaked `<script>`/`<style>` bodies. Fixed with a pre-scan nesting cap, direct-structure table rows and a non-content-aware flattener; new invariant S21. Found by `markkit-bench`. See [HTML Extraction](formats/html-extraction.md) and [Threat Model](security/threat-model.md) T2c.
 * **Spreadsheet follow-ups (#11)**: single-row sheets render as data under column letters; XLSX/ODS/XLS titles come from document properties; XLSB content type no longer maps to XLSX; XLSX without `_rels/.rels` parses; trailing-newline output documented as intended; release profile switched to `panic = "unwind"` so `catch_unwind` is effective in markkit's own binaries. See [Format Support](formats/format-support.md) and [Threat Model](security/threat-model.md) T6c.
 * **Plain text and Markdown input**: text is always on and goes through the IR; Markdown (`markdown` feature) is re-parsed with pulldown-cmark rather than passed through, so raw HTML never reaches output. Neither is sniffed from bytes. Shares the call's `Limits` budget (timeout, nodes, nesting depth). New threat T7 and invariant S18. See [Format Support](formats/format-support.md) and [Threat Model](security/threat-model.md).
 * **Eval harness on mira**: `markkit-eval` is now a mira study (modeled on bashkit-eval). `markkit_extract` scores markkit's HTML output on ten realistic pages with typed deterministic checks and one scorer per metric; a `mode` axis compares defaults with `main_content` (73.0% vs 86.8% mean, noise 34% vs 82%); dated results committed in `crates/markkit-eval/results/`; gaps recorded (`main_content` drops the forum question, `4.6` over-escaped as `4\.6`, `tfoot`/`caption` dropped, edit links in headings). See [Evaluation Harness](operations/eval.md).
diff --git a/knowledge/security/threat-model.md b/knowledge/security/threat-model.md
index 56aa6d3..27b2c72 100644
--- a/knowledge/security/threat-model.md
+++ b/knowledge/security/threat-model.md
@@ -113,6 +113,15 @@ All limits live in one `Limits` struct (`crates/markkit/src/limits.rs`,
   conversion, spreadsheet cell loops and renderer. html5ever tokenizing and calamine
   sheet decoding are not interruptible; they are linear in the (capped) input and the
   deadline is checked right after them
+- html5ever's tree builder is quadratic in nesting depth (687 KiB of nested `<div>`s took
+  12.6 s, 292 KiB of nested tables passed 60 s, uninterruptibly). `html::nesting::cap_nesting`
+  drops tags past `max_nesting_depth + 8` before html5ever runs, so parse cost is
+  O(input x cap); 45 MiB of hostile nesting now parses in under 0.5 s
+- Nested tables: rows are taken from the table's direct structure only. A descendant query
+  copied inner rows into every enclosing table, growing output and work 4x per level
+- Tests: `html_security::deep_div_nesting_is_linear`, `deep_unclosed_table_nesting_is_linear`,
+  `nested_table_rows_are_not_duplicated`, `deep_nested_tables_output_is_bounded`,
+  `html::nesting::tests::*`
 - `max_nodes` (default 5 000 000) caps HTML DOM nodes and DOCX XML nodes (summed over parts)
 - wasm32-unknown-unknown has no clock, so `timeout` is not enforced in `@everruns/markkit-wasm`;
   hosts bound time themselves (e.g. terminate the Worker). All other limits apply
@@ -422,7 +431,9 @@ at an LLM that consumes the extracted Markdown.
 - HTML: elements with `hidden` (not `until-found`), `aria-hidden="true"`, or an
   inline `style` declaring `display:none`, `visibility:hidden|collapse`,
   `opacity:0` or `font-size:0`; `<template>` always. Applies to list items, table
-  rows and cells too (a hidden cell stays empty to keep column alignment).
+  rows and cells too (a hidden cell stays empty to keep column alignment), and to
+  subtrees flattened past `max_nesting_depth` (the nesting pre-scan checks raw
+  attributes of tags it drops; entity-encoded values there are not decoded).
 - DOCX: runs with direct `w:vanish`; `hidden_content_skipped` warning with a count.
 - Spreadsheets: hidden sheets already skipped (T6e).
 
@@ -431,6 +442,7 @@ positioning, white-on-white via CSS), and `w:vanish` inherited from a character
 style, is not detected.
 
 **Test Coverage**: `hidden_content::*`,
+`html_security::hidden_content_does_not_leak_past_max_depth`,
 `html_integration::exclude_selector_applies_to_list_items_and_table_parts`
 
 ## Resource Limits
@@ -503,6 +515,7 @@ style, is not detected.
 | S18 | Text and Markdown output never contains C0 controls (except tab/newline); Markdown raw HTML (blocks, inline tags) is never copied | `text_integration::security_*` |
 | S19 | No PDF stream is decoded past `max_pdf_stream_size`, by markkit or hayro | `pdf_security::*bomb*`, `pdf_security::chained_filters_are_measured_after_every_stage` |
 | S20 | Hidden content is not rendered by default | `hidden_content::*` |
+| S21 | HTML parse time is linear in input whatever the nesting; flattened deep subtrees never emit non-content (script/style/template) text | `html_security::deep_*_is_linear`, `script_and_style_bodies_do_not_leak_past_max_depth` |
 
 ## See also