diff --git a/index.html b/index.html
index cac16c8..5023481 100644
--- a/index.html
+++ b/index.html
@@ -1176,7 +1176,7 @@
 		}
 	}
 </style>
-  <meta content="Bikeshed version 01e1da232fdaa21e9ce8535bfdf8ca7adefa84f8" name="generator">
+  <meta content="Bikeshed version 7e43b56c4e1ede2eed18417e4d8def49e6eb4bd8" name="generator">
 <style>
   ul.toc ul ul ul {
     margin: 0 0 0 2em;
@@ -1453,7 +1453,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2016/logos/W3C" width="72"> </a> </p>
    <h1>Content Security Policy Level 3</h1>
-   <h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2017-03-03">3 March 2017</time></span></h2>
+   <h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2017-03-08">8 March 2017</time></span></h2>
    <div data-fill-with="spec-metadata">
     <dl>
      <dt>This version:
@@ -1502,7 +1502,7 @@ <h2 class="no-num no-toc no-ref heading settled" id="status"><span class="conten
 	W3C maintains a <a href="https://www.w3.org/2004/01/pp-impl/49309/status" rel="disclosure">public list of any patent disclosures</a> made in connection with the deliverables of the group;
 	that page also includes instructions for disclosing a patent.
 	An individual who has actual knowledge of a patent which the individual believes contains <a href="https://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential">Essential Claim(s)</a> must disclose the information in accordance with <a href="https://www.w3.org/Consortium/Patent-Policy-20040205/#sec-Disclosure">section 6 of the W3C Patent Policy</a>. </p>
-   <p> This document is governed by the <a href="https://www.w3.org/2015/Process-20150901/" id="w3c_process_revision">1 September 2015 W3C Process Document</a>. </p>
+   <p> This document is governed by the <a href="https://www.w3.org/2017/Process-20170301/" id="w3c_process_revision">1 March 2017 W3C Process Document</a>. </p>
    <p></p>
   </div>
   <div data-fill-with="at-risk">
@@ -1529,22 +1529,23 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
     <li>
      <a href="#framework"><span class="secno">2</span> <span class="content">Framework</span></a>
      <ol class="toc">
+      <li><a href="#framework-infrastructure"><span class="secno">2.1</span> <span class="content">Infrastructure</span></a>
       <li>
-       <a href="#framework-policy"><span class="secno">2.1</span> <span class="content">Policies</span></a>
+       <a href="#framework-policy"><span class="secno">2.2</span> <span class="content">Policies</span></a>
        <ol class="toc">
-        <li><a href="#parse-serialized-policy"><span class="secno">2.1.1</span> <span class="content"> Parse a <var>serialized CSP</var> as <var>disposition</var> </span></a>
-        <li><a href="#parse-serialized-policy-list"><span class="secno">2.1.2</span> <span class="content"> Parse a serialized CSP <var>list</var> as <var>disposition</var> </span></a>
+        <li><a href="#parse-serialized-policy"><span class="secno">2.2.1</span> <span class="content"> Parse a <var>serialized CSP</var> as <var>disposition</var> </span></a>
+        <li><a href="#parse-serialized-policy-list"><span class="secno">2.2.2</span> <span class="content"> Parse a serialized CSP <var>list</var> as <var>disposition</var> </span></a>
        </ol>
       <li>
-       <a href="#framework-directives"><span class="secno">2.2</span> <span class="content">Directives</span></a>
+       <a href="#framework-directives"><span class="secno">2.3</span> <span class="content">Directives</span></a>
        <ol class="toc">
-        <li><a href="#framework-directive-source-list"><span class="secno">2.2.1</span> <span class="content">Source Lists</span></a>
+        <li><a href="#framework-directive-source-list"><span class="secno">2.3.1</span> <span class="content">Source Lists</span></a>
        </ol>
       <li>
-       <a href="#framework-violation"><span class="secno">2.3</span> <span class="content">Violations</span></a>
+       <a href="#framework-violation"><span class="secno">2.4</span> <span class="content">Violations</span></a>
        <ol class="toc">
-        <li><a href="#create-violation-for-global"><span class="secno">2.3.1</span> <span class="content"> Create a violation object for <var>global</var>, <var>policy</var>, and <var>directive</var> </span></a>
-        <li><a href="#create-violation-for-request"><span class="secno">2.3.2</span> <span class="content"> Create a violation object for <var>request</var>, <var>policy</var>, and <var>directive</var> </span></a>
+        <li><a href="#create-violation-for-global"><span class="secno">2.4.1</span> <span class="content"> Create a violation object for <var>global</var>, <var>policy</var>, and <var>directive</var> </span></a>
+        <li><a href="#create-violation-for-request"><span class="secno">2.4.2</span> <span class="content"> Create a violation object for <var>request</var>, <var>policy</var>, and <var>directive</var> </span></a>
        </ol>
      </ol>
     <li>
@@ -1931,7 +1932,12 @@ <h3 class="heading settled" data-level="1.3" id="changes-from-level-2"><span cla
    </section>
    <section>
     <h2 class="heading settled" data-level="2" id="framework"><span class="secno">2. </span><span class="content">Framework</span><a class="self-link" href="#framework"></a></h2>
-    <h3 class="heading settled" data-level="2.1" id="framework-policy"><span class="secno">2.1. </span><span class="content">Policies</span><a class="self-link" href="#framework-policy"></a></h3>
+    <h3 class="heading settled" data-level="2.1" id="framework-infrastructure"><span class="secno">2.1. </span><span class="content">Infrastructure</span><a class="self-link" href="#framework-infrastructure"></a></h3>
+    <p>This document uses ABNF grammar to specify syntax, as defined in <a data-link-type="biblio" href="#biblio-rfc5234">[RFC5234]</a>. It also relies on
+  the <code>#rule</code> ABNF extension defined in <a href="https://tools.ietf.org/html/rfc7230#section-7">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc7230">[RFC7230]</a>.</p>
+    <p>This document depends on the Infra Standard for a number of foundational concepts used in its
+  algorithms and prose <a data-link-type="biblio" href="#biblio-infra">[INFRA]</a>.</p>
+    <h3 class="heading settled" data-level="2.2" id="framework-policy"><span class="secno">2.2. </span><span class="content">Policies</span><a class="self-link" href="#framework-policy"></a></h3>
     <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-export="" data-local-lt="policy" data-lt="content security policy object" id="content-security-policy-object">policy</dfn> defines allowed
   and restricted behaviors, and may be applied to a <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/browsers.html#window">Window</a></code> or <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/workers.html#workerglobalscope">WorkerGlobalScope</a></code> as described
   in <a href="#initialize-global-object-csp">§4.2.2 Initialize a global object’s CSP list</a>.</p>
@@ -1944,7 +1950,7 @@ <h3 class="heading settled" data-level="2.1" id="framework-policy"><span class="
 <pre><dfn class="dfn-paneled" data-dfn-type="grammar" data-export="" id="grammardef-serialized-policy">serialized-policy</dfn> = <a data-link-type="grammar" href="#grammardef-serialized-directive" id="ref-for-grammardef-serialized-directive-1">serialized-directive</a> *( <a data-link-type="grammar" href="https://tools.ietf.org/html/rfc7230#section-3.2.3">OWS</a> ";" [ <a data-link-type="grammar" href="https://tools.ietf.org/html/rfc7230#section-3.2.3">OWS</a> <a data-link-type="grammar" href="#grammardef-serialized-directive" id="ref-for-grammardef-serialized-directive-2">serialized-directive</a> ] )
                     ; <a data-link-type="grammar" href="https://tools.ietf.org/html/rfc7230#section-3.2.3">OWS</a> is defined in section 3.2.3 of RFC 7230
 </pre>
-    <h4 class="heading settled dfn-paneled algorithm" data-algorithm="Parse a serialized CSP as disposition" data-dfn-type="dfn" data-level="2.1.1" data-lt="parse a serialized CSP" data-noexport="" id="parse-serialized-policy"><span class="secno">2.1.1. </span><span class="content"> Parse a <var>serialized CSP</var> as <var>disposition</var> </span></h4>
+    <h4 class="heading settled dfn-paneled algorithm" data-algorithm="Parse a serialized CSP as disposition" data-dfn-type="dfn" data-level="2.2.1" data-lt="parse a serialized CSP" data-noexport="" id="parse-serialized-policy"><span class="secno">2.2.1. </span><span class="content"> Parse a <var>serialized CSP</var> as <var>disposition</var> </span></h4>
     <p>Given a <a data-link-type="dfn" href="#serialized-csp" id="ref-for-serialized-csp-1">serialized CSP</a> (<var>serialized CSP</var>), and a <a data-link-type="dfn" href="#policy-disposition" id="ref-for-policy-disposition-1">disposition</a> (<var>disposition</var>), this algorithm will return a <a data-link-type="dfn" href="#content-security-policy-object" id="ref-for-content-security-policy-object-1">policy</a> object. If the string cannot be parsed, the resulting <a data-link-type="dfn" href="#content-security-policy-object" id="ref-for-content-security-policy-object-2">policy</a>’s <a data-link-type="dfn" href="#policy-directive-set" id="ref-for-policy-directive-set-1">directive set</a> will be empty.</p>
     <ol>
      <li data-md="">
@@ -1977,7 +1983,7 @@ <h4 class="heading settled dfn-paneled algorithm" data-algorithm="Parse a serial
      <li data-md="">
       <p>Return <var>policy</var>.</p>
     </ol>
-    <h4 class="heading settled algorithm" data-algorithm="Parse a serialized CSP list as disposition" data-level="2.1.2" id="parse-serialized-policy-list"><span class="secno">2.1.2. </span><span class="content"> Parse a serialized CSP <var>list</var> as <var>disposition</var> </span><a class="self-link" href="#parse-serialized-policy-list"></a></h4>
+    <h4 class="heading settled algorithm" data-algorithm="Parse a serialized CSP list as disposition" data-level="2.2.2" id="parse-serialized-policy-list"><span class="secno">2.2.2. </span><span class="content"> Parse a serialized CSP <var>list</var> as <var>disposition</var> </span><a class="self-link" href="#parse-serialized-policy-list"></a></h4>
     <p>Given a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string">string</a> which contains a comma-delimited series of <a data-link-type="dfn" href="#serialized-csp" id="ref-for-serialized-csp-2">serialized CSP</a> strings
   (<var>list</var>) and a <a data-link-type="dfn" href="#policy-disposition" id="ref-for-policy-disposition-3">disposition</a> (<var>disposition</var>), the following algorithm will
   return a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list">list</a> of <a data-link-type="dfn" href="#content-security-policy-object" id="ref-for-content-security-policy-object-4">policy</a> objects:</p>
@@ -1988,7 +1994,7 @@ <h4 class="heading settled algorithm" data-algorithm="Parse a serialized CSP lis
       <p>For each <var>token</var> returned by <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#split-on-commas">splitting <var>list</var> on commas</a>:</p>
       <ol>
        <li data-md="">
-        <p>Let <var>policy</var> be the result of executing <a href="#parse-serialized-policy" id="ref-for-parse-serialized-policy-1">§2.1.1 Parse a serialized CSP as disposition</a> on <var>token</var> with <var>disposition</var>.</p>
+        <p>Let <var>policy</var> be the result of executing <a href="#parse-serialized-policy" id="ref-for-parse-serialized-policy-1">§2.2.1 Parse a serialized CSP as disposition</a> on <var>token</var> with <var>disposition</var>.</p>
        <li data-md="">
         <p>If <var>policy</var>’s <a data-link-type="dfn" href="#policy-directive-set" id="ref-for-policy-directive-set-5">directive set</a> is empty, skip the
   remaining substeps, and continue to the next item.</p>
@@ -1998,7 +2004,7 @@ <h4 class="heading settled algorithm" data-algorithm="Parse a serialized CSP lis
      <li data-md="">
       <p>Return <var>policies</var>.</p>
     </ol>
-    <h3 class="heading settled" data-level="2.2" id="framework-directives"><span class="secno">2.2. </span><span class="content">Directives</span><a class="self-link" href="#framework-directives"></a></h3>
+    <h3 class="heading settled" data-level="2.3" id="framework-directives"><span class="secno">2.3. </span><span class="content">Directives</span><a class="self-link" href="#framework-directives"></a></h3>
     <p>Each <a data-link-type="dfn" href="#content-security-policy-object" id="ref-for-content-security-policy-object-5">policy</a> contains an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set">ordered set</a> of <dfn class="dfn-paneled" data-dfn-type="dfn" data-export="" id="directives">directives</dfn> (its <a data-link-type="dfn" href="#policy-directive-set" id="ref-for-policy-directive-set-6">directive set</a>), each of which controls a specific behavior. The directives
   defined in this document are described in detail in <a href="#csp-directives">§6 Content Security Policy Directives</a>.</p>
     <p>Each <a data-link-type="dfn" href="#directives" id="ref-for-directives-4">directive</a> is a <dfn class="dfn-paneled" data-dfn-for="directive" data-dfn-type="dfn" data-export="" id="directive-name">name</dfn> / <dfn class="dfn-paneled" data-dfn-for="directive" data-dfn-type="dfn" data-export="" id="directive-value">value</dfn> pair. The <a data-link-type="dfn" href="#directive-name" id="ref-for-directive-name-3">name</a> is a
@@ -2048,7 +2054,7 @@ <h3 class="heading settled" data-level="2.2" id="framework-directives"><span cla
     in target be blocked by Content Security Policy?</a>.
   It returns "<code>Allowed</code>" unless otherwise specified.</p>
     </ol>
-    <h4 class="heading settled" data-level="2.2.1" id="framework-directive-source-list"><span class="secno">2.2.1. </span><span class="content">Source Lists</span><a class="self-link" href="#framework-directive-source-list"></a></h4>
+    <h4 class="heading settled" data-level="2.3.1" id="framework-directive-source-list"><span class="secno">2.3.1. </span><span class="content">Source Lists</span><a class="self-link" href="#framework-directive-source-list"></a></h4>
     <p>Many <a data-link-type="dfn" href="#directives" id="ref-for-directives-6">directives</a>' <a data-link-type="dfn" href="#directive-value" id="ref-for-directive-value-4">values</a> consist of <dfn class="dfn-paneled" data-dfn-type="dfn" data-export="" id="source-lists">source lists</dfn>: <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set">sets</a> of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string">strings</a> which identify content that can be fetched and potentially embedded or
   executed. Each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string">string</a> represents one of the following types of <dfn class="dfn-paneled" data-dfn-type="dfn" data-export="" data-lt="source expression" id="source-expression">source
   expression</dfn>:</p>
@@ -2112,7 +2118,7 @@ <h4 class="heading settled" data-level="2.2.1" id="framework-directive-source-li
   expression (see <a href="#match-url-to-source-list">§6.6.1.5 Does url match source list in origin with redirect count?</a> for details). The security
   properties of IP addresses are suspect, and authors ought to prefer hostnames
   whenever possible.</p>
-    <h3 class="heading settled" data-level="2.3" id="framework-violation"><span class="secno">2.3. </span><span class="content">Violations</span><a class="self-link" href="#framework-violation"></a></h3>
+    <h3 class="heading settled" data-level="2.4" id="framework-violation"><span class="secno">2.4. </span><span class="content">Violations</span><a class="self-link" href="#framework-violation"></a></h3>
     <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-export="" id="violation">violation</dfn> represents an action or resource which goes against the
   set of <a data-link-type="dfn" href="#content-security-policy-object" id="ref-for-content-security-policy-object-10">policy</a> objects associated with a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a>.</p>
     <p>Each <a data-link-type="dfn" href="#violation" id="ref-for-violation-1">violation</a> has a <dfn class="dfn-paneled" data-dfn-for="violation" data-dfn-type="dfn" data-export="" id="violation-global-object">global object</dfn>, which
@@ -2142,7 +2148,7 @@ <h3 class="heading settled" data-level="2.3" id="framework-violation"><span clas
     <p class="note" role="note"><span>Note:</span> A <a data-link-type="dfn" href="#violation" id="ref-for-violation-14">violation</a>’s <a data-link-type="dfn" href="#violation-sample" id="ref-for-violation-sample-2">sample</a> will be populated with the first 40
   characters of an inline script, event handler, or style that caused an violation. Violations
   which stem from an external file will not include a sample in the violation report.</p>
-    <h4 class="heading settled algorithm" data-algorithm="Create a violation object for global, policy, and directive" data-level="2.3.1" id="create-violation-for-global"><span class="secno">2.3.1. </span><span class="content"> Create a violation object for <var>global</var>, <var>policy</var>, and <var>directive</var> </span><a class="self-link" href="#create-violation-for-global"></a></h4>
+    <h4 class="heading settled algorithm" data-algorithm="Create a violation object for global, policy, and directive" data-level="2.4.1" id="create-violation-for-global"><span class="secno">2.4.1. </span><span class="content"> Create a violation object for <var>global</var>, <var>policy</var>, and <var>directive</var> </span><a class="self-link" href="#create-violation-for-global"></a></h4>
     <p>Given a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a> (<var>global</var>), a <a data-link-type="dfn" href="#content-security-policy-object" id="ref-for-content-security-policy-object-14">policy</a> (<var>policy</var>), and a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string">string</a> (<var>directive</var>), the following algorithm creates a new <a data-link-type="dfn" href="#violation" id="ref-for-violation-15">violation</a> object, and populates it with an initial set of data:</p>
     <ol>
      <li data-md="">
@@ -2165,13 +2171,13 @@ <h4 class="heading settled algorithm" data-algorithm="Create a violation object
      <li data-md="">
       <p>Return <var>violation</var>.</p>
     </ol>
-    <h4 class="heading settled algorithm" data-algorithm="Create a violation object for request, policy, and directive" data-level="2.3.2" id="create-violation-for-request"><span class="secno">2.3.2. </span><span class="content"> Create a violation object for <var>request</var>, <var>policy</var>, and <var>directive</var> </span><a class="self-link" href="#create-violation-for-request"></a></h4>
+    <h4 class="heading settled algorithm" data-algorithm="Create a violation object for request, policy, and directive" data-level="2.4.2" id="create-violation-for-request"><span class="secno">2.4.2. </span><span class="content"> Create a violation object for <var>request</var>, <var>policy</var>, and <var>directive</var> </span><a class="self-link" href="#create-violation-for-request"></a></h4>
     <p>Given a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request">request</a> (<var>request</var>), a <a data-link-type="dfn" href="#content-security-policy-object" id="ref-for-content-security-policy-object-15">policy</a> (<var>policy</var>), and a string
   (<var>directive</var>), the following algorithm creates a new <a data-link-type="dfn" href="#violation" id="ref-for-violation-17">violation</a> object,
   and populates it with an initial set of data:</p>
     <ol>
      <li data-md="">
-      <p>Let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.3.1 Create a violation object for global, policy, and directive</a> on <var>request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-client">client</a>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global">global object</a>, <var>policy</var>, and <var>directive</var>.</p>
+      <p>Let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.4.1 Create a violation object for global, policy, and directive</a> on <var>request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-client">client</a>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global">global object</a>, <var>policy</var>, and <var>directive</var>.</p>
      <li data-md="">
       <p>Set <var>violation</var>’s <a data-link-type="dfn" href="#violation-resource" id="ref-for-violation-resource-2">resource</a> to <var>request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url">url</a>.</p>
       <p class="note" role="note"><span>Note:</span> We use <var>request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url">url</a>, and <em>not</em> its <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-current-url">current url</a>, as the latter might contain information
@@ -2232,7 +2238,7 @@ <h3 class="heading settled" data-level="3.3" id="meta-element"><span class="secn
   whose <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/semantics.html#attr-meta-http-equiv">http-equiv</a></code> attributes are an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ascii-case-insensitive">ASCII case-insensitive</a> match for the string "<code>Content-Security-Policy</code>". For example:</p>
     <div class="example" id="example-f977fbdb">
      <a class="self-link" href="#example-f977fbdb"></a> 
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">meta</span> <span class="na">http-equiv</span><span class="o">=</span><span class="s">"Content-Security-Policy"</span> <span class="na">content</span><span class="o">=</span><span class="s">"script-src 'self'"</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;meta</span> <span class="na">http-equiv=</span><span class="s">"Content-Security-Policy"</span> <span class="na">content=</span><span class="s">"script-src 'self'"</span><span class="nt">></span>
 </pre>
     </div>
     <p>Implementation details can be found in HTML’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/semantics.html#attr-meta-http-equiv-content-security-policy">Content Security Policy
@@ -2298,9 +2304,9 @@ <h4 class="heading settled algorithm" data-algorithm="Set response’s CSP list"
       <p>Set <var>response</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response-csp-list">CSP list</a> to the
   empty list.</p>
      <li data-md="">
-      <p>Let <var>policies</var> be the result of executing <a href="#parse-serialized-policy-list">§2.1.2 Parse a serialized CSP list as disposition</a> on the result of <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#extract-header-list-values">extracting header list values</a> given <code>Content-Security-Policy</code> and <var>response</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response-header-list">header list</a>, with a disposition of "<code>enforce</code>".</p>
+      <p>Let <var>policies</var> be the result of executing <a href="#parse-serialized-policy-list">§2.2.2 Parse a serialized CSP list as disposition</a> on the result of <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#extract-header-list-values">extracting header list values</a> given <code>Content-Security-Policy</code> and <var>response</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response-header-list">header list</a>, with a disposition of "<code>enforce</code>".</p>
      <li data-md="">
-      <p>Append to <var>policies</var> the result of executing <a href="#parse-serialized-policy-list">§2.1.2 Parse a serialized CSP list as disposition</a> on the result
+      <p>Append to <var>policies</var> the result of executing <a href="#parse-serialized-policy-list">§2.2.2 Parse a serialized CSP list as disposition</a> on the result
   of <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#extract-header-list-values">extracting header list values</a> given <code>Content-Security-Policy-Report-Only</code> and <var>response</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response-header-list">header list</a>, with a disposition of "<code>report</code>".</p>
      <li data-md="">
       <p>For each <var>policy</var> in <var>policies</var>:</p>
@@ -2324,7 +2330,7 @@ <h4 class="heading settled algorithm" data-algorithm="Report Content Security Po
        <li data-md="">
         <p>Let <var>violates</var> be the result of executing <a href="#does-request-violate-policy">§6.6.1.1 Does request violate policy?</a> on <var>request</var> and <var>policy</var>.</p>
        <li data-md="">
-        <p>If <var>violates</var> is not "<code>Does Not Violate</code>", then execute <a href="#report-violation">§5.3 Report a violation</a> on the result of executing <a href="#create-violation-for-request">§2.3.2 Create a violation object for request, policy, and directive</a> on <var>request</var>, <var>policy</var>, and <var>violates</var>.</p>
+        <p>If <var>violates</var> is not "<code>Does Not Violate</code>", then execute <a href="#report-violation">§5.3 Report a violation</a> on the result of executing <a href="#create-violation-for-request">§2.4.2 Create a violation object for request, policy, and directive</a> on <var>request</var>, <var>policy</var>, and <var>violates</var>.</p>
       </ol>
     </ol>
     <h4 class="heading settled algorithm" data-algorithm="Should request be blocked by Content Security Policy?" data-level="4.1.3" id="should-block-request"><span class="secno">4.1.3. </span><span class="content"> Should <var>request</var> be blocked by Content Security Policy? </span><a class="self-link" href="#should-block-request"></a></h4>
@@ -2346,7 +2352,7 @@ <h4 class="heading settled algorithm" data-algorithm="Should request be blocked
         <p>If <var>violates</var> is not "<code>Does Not Violate</code>", then:</p>
         <ol>
          <li data-md="">
-          <p>Execute <a href="#report-violation">§5.3 Report a violation</a> on the result of executing <a href="#create-violation-for-request">§2.3.2 Create a violation object for request, policy, and directive</a> on <var>request</var>, <var>policy</var>, and <var>violates</var>.</p>
+          <p>Execute <a href="#report-violation">§5.3 Report a violation</a> on the result of executing <a href="#create-violation-for-request">§2.4.2 Create a violation object for request, policy, and directive</a> on <var>request</var>, <var>policy</var>, and <var>violates</var>.</p>
          <li data-md="">
           <p>Set <var>result</var> to "<code>Blocked</code>".</p>
         </ol>
@@ -2373,7 +2379,7 @@ <h4 class="heading settled algorithm" data-algorithm="Should request be blocked
           <p>If the result of executing <var>directive</var>’s <a data-link-type="dfn" href="#directive-post-request-check" id="ref-for-directive-post-request-check-2">post-request check</a> is "<code>Blocked</code>", then:</p>
           <ol>
            <li data-md="">
-            <p>Execute <a href="#report-violation">§5.3 Report a violation</a> on the result of executing <a href="#create-violation-for-request">§2.3.2 Create a violation object for request, policy, and directive</a> on <var>request</var>, <var>policy</var>, and <var>directive</var>.</p>
+            <p>Execute <a href="#report-violation">§5.3 Report a violation</a> on the result of executing <a href="#create-violation-for-request">§2.4.2 Create a violation object for request, policy, and directive</a> on <var>request</var>, <var>policy</var>, and <var>directive</var>.</p>
            <li data-md="">
             <p>If <var>policy</var>’s <a data-link-type="dfn" href="#policy-disposition" id="ref-for-policy-disposition-7">disposition</a> is "<code>enforce</code>",
   then set <var>result</var> to "<code>Blocked</code>".</p>
@@ -2394,7 +2400,7 @@ <h4 class="heading settled algorithm" data-algorithm="Should request be blocked
   and <var>policy</var> is "<code>Blocked</code>", then:</p>
           <ol>
            <li data-md="">
-            <p>Execute <a href="#report-violation">§5.3 Report a violation</a> on the result of executing <a href="#create-violation-for-request">§2.3.2 Create a violation object for request, policy, and directive</a> on <var>request</var>, <var>policy</var>, and <var>directive</var>.</p>
+            <p>Execute <a href="#report-violation">§5.3 Report a violation</a> on the result of executing <a href="#create-violation-for-request">§2.4.2 Create a violation object for request, policy, and directive</a> on <var>request</var>, <var>policy</var>, and <var>directive</var>.</p>
            <li data-md="">
             <p>If <var>policy</var>’s <a data-link-type="dfn" href="#policy-disposition" id="ref-for-policy-disposition-8">disposition</a> is "<code>enforce</code>",
   then set <var>result</var> to "<code>Blocked</code>".</p>
@@ -2556,7 +2562,7 @@ <h4 class="heading settled algorithm" data-algorithm="Should element’s inline
   "<code>Allowed</code>" when executed upon <var>element</var>, <var>type</var>, and <var>source</var>,
   skip to the next <var>directive</var>.</p>
          <li data-md="">
-          <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.3.1 Create a violation object for global, policy, and directive</a> on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object">current settings
+          <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.4.1 Create a violation object for global, policy, and directive</a> on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object">current settings
   object</a>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global">global object</a>, <var>policy</var>,
   and "<code>style-src</code>" if <var>type</var> is "<code>style</code>" or "<code>style-attribute</code>",
   or "<code>script-src</code>" otherwise.</p>
@@ -2596,7 +2602,7 @@ <h4 class="heading settled algorithm" data-algorithm="Should element’s inline
          <li data-md="">
           <p>If <var>directive</var>’s <a data-link-type="dfn" href="#directive-pre-navigation-check" id="ref-for-directive-pre-navigation-check-1">pre-navigation check</a> returns "<code>Allowed</code>" when executed upon <var>navigation request</var>, <var>type</var>, <var>source</var>, and <var>target</var>, skip to the next <var>directive</var>.</p>
          <li data-md="">
-          <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.3.1 Create a violation object for global, policy, and directive</a> on <var>source</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global">relevant global
+          <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.4.1 Create a violation object for global, policy, and directive</a> on <var>source</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global">relevant global
   object</a>, <var>policy</var>, and <var>directive</var>’s <a data-link-type="dfn" href="#directive-name" id="ref-for-directive-name-4">name</a>.</p>
          <li data-md="">
           <p>Set <var>violation</var>’s <a data-link-type="dfn" href="#violation-resource" id="ref-for-violation-resource-4">resource</a> to <var>navigation
@@ -2621,7 +2627,7 @@ <h4 class="heading settled algorithm" data-algorithm="Should element’s inline
             <p>If <var>directive</var>’s <a data-link-type="dfn" href="#directive-inline-check" id="ref-for-directive-inline-check-2">inline check</a> returns "<code>Allowed</code>" when executed upon <var>navigation request</var>, <var>type</var>, <var>source</var>, and <var>target</var>, skip to the next <var>directive</var>.</p>
           </ol>
          <li data-md="">
-          <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.3.1 Create a violation object for global, policy, and directive</a> on <var>source</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global">relevant global
+          <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.4.1 Create a violation object for global, policy, and directive</a> on <var>source</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global">relevant global
   object</a>, <var>policy</var>, and <var>directive</var>’s <a data-link-type="dfn" href="#directive-name" id="ref-for-directive-name-5">name</a>.</p>
          <li data-md="">
           <p>Set <var>violation</var>’s <a data-link-type="dfn" href="#violation-resource" id="ref-for-violation-resource-5">resource</a> to <var>navigation
@@ -2655,7 +2661,7 @@ <h4 class="heading settled algorithm" data-algorithm="Should element’s inline
          <li data-md="">
           <p>If <var>directive</var>’s <a data-link-type="dfn" href="#directive-navigation-response-check" id="ref-for-directive-navigation-response-check-1">navigation response check</a> returns "<code>Allowed</code>" when executed upon <var>navigation request</var>, <var>type</var>, <var>navigation response</var>, <var>source</var>, and <var>target</var>, skip to the next <var>directive</var>.</p>
          <li data-md="">
-          <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.3.1 Create a violation object for global, policy, and directive</a> on <code>null</code>, <var>policy</var>, and <var>directive</var>’s <a data-link-type="dfn" href="#directive-name" id="ref-for-directive-name-6">name</a>.</p>
+          <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.4.1 Create a violation object for global, policy, and directive</a> on <code>null</code>, <var>policy</var>, and <var>directive</var>’s <a data-link-type="dfn" href="#directive-name" id="ref-for-directive-name-6">name</a>.</p>
           <p class="note" role="note"><span>Note:</span> We use <code>null</code> for the global object, as no global exists:
   we haven’t processed the navigation to create a Document yet.</p>
          <li data-md="">
@@ -3036,10 +3042,10 @@ <h4 class="heading settled" data-level="6.1.1" id="directive-child-src"><span cl
 </pre>
      <p>Fetches for the following code will all return network errors, as the URLs
     provided do not match <code>child-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-1">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">iframe</span> <span class="na">src</span><span class="o">=</span><span class="s">"https://not-example.com"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">iframe</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">script</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;iframe</span> <span class="na">src=</span><span class="s">"https://not-example.com"</span><span class="nt">></span><span class="nt">&lt;/iframe></span>
+<span class="nt">&lt;script</span><span class="nt">></span>
   <span class="kd">var</span> blockedWorker <span class="o">=</span> <span class="k">new</span> Worker<span class="p">(</span><span class="s2">"data:application/javascript,..."</span><span class="p">)</span><span class="p">;</span>
-<span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+<span class="nt">&lt;/script></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="child-src Pre-request check" data-level="6.1.1.1" id="child-src-pre-request"><span class="secno">6.1.1.1. </span><span class="content"> <code>child-src</code> Pre-request check </span><a class="self-link" href="#child-src-pre-request"></a></h5>
@@ -3096,8 +3102,8 @@ <h4 class="heading settled" data-level="6.1.2" id="directive-connect-src"><span
 </pre>
      <p>Fetches for the following code will all return network errors, as the URLs
     provided do not match <code>connect-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-2">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">a</span> <span class="na">ping</span><span class="o">=</span><span class="s">"https://not-example.com"</span><span class="p">></span>...
-<span class="p">&lt;</span><span class="nt">script</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;a</span> <span class="na">ping=</span><span class="s">"https://not-example.com"</span><span class="nt">></span>...
+<span class="nt">&lt;script</span><span class="nt">></span>
   <span class="kd">var</span> xhr <span class="o">=</span> <span class="k">new</span> XMLHttpRequest<span class="p">(</span><span class="p">)</span><span class="p">;</span>
   xhr<span class="p">.</span>open<span class="p">(</span><span class="s1">'GET'</span><span class="p">,</span> <span class="s1">'https://not-example.com/'</span><span class="p">)</span><span class="p">;</span>
   xhr<span class="p">.</span>send<span class="p">(</span><span class="p">)</span><span class="p">;</span>
@@ -3106,8 +3112,8 @@ <h4 class="heading settled" data-level="6.1.2" id="directive-connect-src"><span
 
   <span class="kd">var</span> es <span class="o">=</span> <span class="k">new</span> EventSource<span class="p">(</span><span class="s2">"https://not-example.com/"</span><span class="p">)</span><span class="p">;</span>
 
-  navigator<span class="p">.</span>sendBeacon<span class="p">(</span><span class="s2">"https://not-example.com/"</span><span class="p">,</span> <span class="p">{</span> <span class="p">...</span> <span class="p">}</span><span class="p">)</span><span class="p">;</span>
-<span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+  navigator<span class="p">.</span>sendBeacon<span class="p">(</span><span class="s2">"https://not-example.com/"</span><span class="p">,</span> <span class="p">{</span> <span class="p">.</span><span class="p">.</span><span class="p">.</span> <span class="p">}</span><span class="p">)</span><span class="p">;</span>
+<span class="nt">&lt;/script></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="connect-src Pre-request check" data-level="6.1.2.1" id="connect-src-pre-request"><span class="secno">6.1.2.1. </span><span class="content"> <code>connect-src</code> Pre-request check </span><a class="self-link" href="#connect-src-pre-request"></a></h5>
@@ -3246,15 +3252,15 @@ <h4 class="heading settled" data-level="6.1.4" id="directive-font-src"><span cla
 </pre>
      <p>Fetches for the following code will return a network errors, as the URL
     provided do not match <code>font-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-4">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">style</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;style</span><span class="nt">></span>
   <span class="k">@font-face</span> <span class="p">{</span>
     <span class="nt">font-family</span><span class="o">:</span> <span class="s2">"Example Font"</span><span class="o">;</span>
     <span class="nt">src</span><span class="o">:</span> <span class="nt">url</span><span class="o">(</span><span class="s2">"https://not-example.com/font"</span><span class="o">)</span><span class="o">;</span>
   <span class="p">}</span>
   <span class="nt">body</span> <span class="p">{</span>
-    font-family<span class="o">:</span> <span class="s2">"Example Font"</span><span class="p">;</span>
+    <span class="k">font-family</span><span class="o">:</span> <span class="s2">"Example Font"</span><span class="p">;</span>
   <span class="p">}</span>
-<span class="p">&lt;</span><span class="p">/</span><span class="nt">style</span><span class="p">></span>
+<span class="nt">&lt;/style></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="font-src Pre-request check" data-level="6.1.4.1" id="font-src-pre-request"><span class="secno">6.1.4.1. </span><span class="content"> <code>font-src</code> Pre-request check </span><a class="self-link" href="#font-src-pre-request"></a></h5>
@@ -3301,8 +3307,8 @@ <h4 class="heading settled" data-level="6.1.5" id="directive-frame-src"><span cl
 </pre>
      <p>Fetches for the following code will return a network errors, as the URL
     provided do not match <code>frame-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-5">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">iframe</span> <span class="na">src</span><span class="o">=</span><span class="s">"https://not-example.com/"</span><span class="p">></span>
-<span class="p">&lt;</span><span class="p">/</span><span class="nt">iframe</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;iframe</span> <span class="na">src=</span><span class="s">"https://not-example.com/"</span><span class="nt">></span>
+<span class="nt">&lt;/iframe></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="frame-src Pre-request check" data-level="6.1.5.1" id="frame-src-pre-request"><span class="secno">6.1.5.1. </span><span class="content"> <code>frame-src</code> Pre-request check </span><a class="self-link" href="#frame-src-pre-request"></a></h5>
@@ -3354,7 +3360,7 @@ <h4 class="heading settled" data-level="6.1.6" id="directive-img-src"><span clas
 </pre>
      <p>Fetches for the following code will return a network errors, as the URL
     provided do not match <code>img-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-6">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">img</span> <span class="na">src</span><span class="o">=</span><span class="s">"https://not-example.com/img"</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;img</span> <span class="na">src=</span><span class="s">"https://not-example.com/img"</span><span class="nt">></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="img-src Pre-request check" data-level="6.1.6.1" id="img-src-pre-request"><span class="secno">6.1.6.1. </span><span class="content"> <code>img-src</code> Pre-request check </span><a class="self-link" href="#img-src-pre-request"></a></h5>
@@ -3402,7 +3408,7 @@ <h4 class="heading settled" data-level="6.1.7" id="directive-manifest-src"><span
 </pre>
      <p>Fetches for the following code will return a network errors, as the URL
     provided do not match <code>manifest-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-7">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">link</span> <span class="na">rel</span><span class="o">=</span><span class="s">"manifest"</span> <span class="na">href</span><span class="o">=</span><span class="s">"https://not-example.com/manifest"</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;link</span> <span class="na">rel=</span><span class="s">"manifest"</span> <span class="na">href=</span><span class="s">"https://not-example.com/manifest"</span><span class="nt">></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="manifest-src Pre-request check" data-level="6.1.7.1" id="manifest-src-pre-request"><span class="secno">6.1.7.1. </span><span class="content"> <code>manifest-src</code> Pre-request check </span><a class="self-link" href="#manifest-src-pre-request"></a></h5>
@@ -3450,10 +3456,10 @@ <h4 class="heading settled" data-level="6.1.8" id="directive-media-src"><span cl
 </pre>
      <p>Fetches for the following code will return a network errors, as the URL
     provided do not match <code>media-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-8">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">audio</span> <span class="na">src</span><span class="o">=</span><span class="s">"https://not-example.com/audio"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">audio</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">video</span> <span class="na">src</span><span class="o">=</span><span class="s">"https://not-example.com/video"</span><span class="p">></span>
-    <span class="p">&lt;</span><span class="nt">track</span> <span class="na">kind</span><span class="o">=</span><span class="s">"subtitles"</span> <span class="na">src</span><span class="o">=</span><span class="s">"https://not-example.com/subtitles"</span><span class="p">></span>
-<span class="p">&lt;</span><span class="p">/</span><span class="nt">video</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;audio</span> <span class="na">src=</span><span class="s">"https://not-example.com/audio"</span><span class="nt">></span><span class="nt">&lt;/audio></span>
+<span class="nt">&lt;video</span> <span class="na">src=</span><span class="s">"https://not-example.com/video"</span><span class="nt">></span>
+    <span class="nt">&lt;track</span> <span class="na">kind=</span><span class="s">"subtitles"</span> <span class="na">src=</span><span class="s">"https://not-example.com/subtitles"</span><span class="nt">></span>
+<span class="nt">&lt;/video></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="media-src Pre-request check" data-level="6.1.8.1" id="media-src-pre-request"><span class="secno">6.1.8.1. </span><span class="content"> <code>media-src</code> Pre-request check </span><a class="self-link" href="#media-src-pre-request"></a></h5>
@@ -3503,9 +3509,9 @@ <h4 class="heading settled" data-level="6.1.9" id="directive-object-src"><span c
 </pre>
      <p>Fetches for the following code will return a network errors, as the URL
     provided do not match <code>object-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-9">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">embed</span> <span class="na">src</span><span class="o">=</span><span class="s">"https://not-example.com/flash"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">embed</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">object</span> <span class="na">data</span><span class="o">=</span><span class="s">"https://not-example.com/flash"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">object</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">applet</span> <span class="na">archive</span><span class="o">=</span><span class="s">"https://not-example.com/flash"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">applet</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;embed</span> <span class="na">src=</span><span class="s">"https://not-example.com/flash"</span><span class="nt">></span><span class="nt">&lt;/embed></span>
+<span class="nt">&lt;object</span> <span class="na">data=</span><span class="s">"https://not-example.com/flash"</span><span class="nt">></span><span class="nt">&lt;/object></span>
+<span class="nt">&lt;applet</span> <span class="na">archive=</span><span class="s">"https://not-example.com/flash"</span><span class="nt">></span><span class="nt">&lt;/applet></span>
 </pre>
     </div>
     <p>If plugin content is loaded without an associated URL (perhaps an <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/embedded-content.html#the-object-element">object</a></code> element lacks a <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/embedded-content.html#attr-object-data">data</a></code> attribute, but loads some default plugin based
@@ -3833,11 +3839,11 @@ <h4 class="heading settled" data-level="6.1.12" id="directive-worker-src"><span
 </pre>
      <p>Fetches for the following code will return a network errors, as the URL
     provided do not match <code>worker-src</code>'s <a data-link-type="dfn" href="#source-lists" id="ref-for-source-lists-10">source list</a>:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">script</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;script</span><span class="nt">></span>
   <span class="kd">var</span> blockedWorker <span class="o">=</span> <span class="k">new</span> Worker<span class="p">(</span><span class="s2">"data:application/javascript,..."</span><span class="p">)</span><span class="p">;</span>
   blockedWorker <span class="o">=</span> <span class="k">new</span> SharedWorker<span class="p">(</span><span class="s2">"https://not-example.com/"</span><span class="p">)</span><span class="p">;</span>
   navigator<span class="p">.</span>serviceWorker<span class="p">.</span>register<span class="p">(</span><span class="s1">'https://not-example.com/sw.js'</span><span class="p">)</span><span class="p">;</span>
-<span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+<span class="nt">&lt;/script></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="worker-src Pre-request Check" data-level="6.1.12.1" id="worker-src-pre-request"><span class="secno">6.1.12.1. </span><span class="content"> <code>worker-src</code> Pre-request Check </span><a class="self-link" href="#worker-src-pre-request"></a></h5>
@@ -3904,7 +3910,7 @@ <h5 class="heading settled algorithm" data-algorithm="Is base allowed for docume
         <p>If the result of executing <a href="#match-url-to-source-list">§6.6.1.5 Does url match source list in origin with redirect count?</a> on <var>base</var>, <var>source list</var>, <var>document</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#fallback-base-url">fallback base URL</a>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-origin">origin</a>, and <code>0</code> is "<code>Does Not Match</code>":</p>
         <ol>
          <li data-md="">
-          <p>Let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.3.1 Create a violation object for global, policy, and directive</a> on <var>document</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global
+          <p>Let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§2.4.1 Create a violation object for global, policy, and directive</a> on <var>document</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global
   object</a>, <var>policy</var>, and "<a data-link-type="dfn" href="#base-uri" id="ref-for-base-uri-1"><code>base-uri</code></a>".</p>
          <li data-md="">
           <p>Set <var>violation</var>’s <a data-link-type="dfn" href="#violation-resource" id="ref-for-violation-resource-9">resource</a> to "<code>inline</code>".</p>
@@ -3946,20 +3952,20 @@ <h4 class="heading settled" data-level="6.2.2" id="directive-plugin-types"><span
 </pre>
      <p>Fetches for the following code will all return network errors:</p>
 <pre class="highlight"><span class="c">&lt;!--</span><span class="c"> No 'type' declaration </span><span class="c">--></span>
-<span class="p">&lt;</span><span class="nt">object</span> <span class="na">data</span><span class="o">=</span><span class="s">"https://example.com/flash"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">object</span><span class="p">></span>
+<span class="nt">&lt;object</span> <span class="na">data=</span><span class="s">"https://example.com/flash"</span><span class="nt">></span><span class="nt">&lt;/object></span>
 
 <span class="c">&lt;!--</span><span class="c"> Non</span><span class="c">-</span><span class="c">matching 'type' declaration </span><span class="c">--></span>
-<span class="p">&lt;</span><span class="nt">object</span> <span class="na">data</span><span class="o">=</span><span class="s">"https://example.com/flash"</span> <span class="na">type</span><span class="o">=</span><span class="s">"application/x-shockwave-flash"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">object</span><span class="p">></span>
+<span class="nt">&lt;object</span> <span class="na">data=</span><span class="s">"https://example.com/flash"</span> <span class="na">type=</span><span class="s">"application/x-shockwave-flash"</span><span class="nt">></span><span class="nt">&lt;/object></span>
 
 <span class="c">&lt;!--</span><span class="c"> Non</span><span class="c">-</span><span class="c">matching resource </span><span class="c">--></span>
-<span class="p">&lt;</span><span class="nt">object</span> <span class="na">data</span><span class="o">=</span><span class="s">"https://example.com/flash"</span> <span class="na">type</span><span class="o">=</span><span class="s">"application/pdf"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">object</span><span class="p">></span>
+<span class="nt">&lt;object</span> <span class="na">data=</span><span class="s">"https://example.com/flash"</span> <span class="na">type=</span><span class="s">"application/pdf"</span><span class="nt">></span><span class="nt">&lt;/object></span>
 </pre>
      <p>If the page allowed Flash content by sending the following header:</p>
 <pre>Content-Security-Policy: <a data-link-type="dfn" href="#plugin-types" id="ref-for-plugin-types-2">plugin-types</a> application/x-shockwave-flash
 </pre>
      <p>Then the second item above would load successfully:</p>
 <pre class="highlight"><span class="c">&lt;!--</span><span class="c"> Matching 'type' declaration and resource </span><span class="c">--></span>
-<span class="p">&lt;</span><span class="nt">object</span> <span class="na">data</span><span class="o">=</span><span class="s">"https://example.com/flash"</span> <span class="na">type</span><span class="o">=</span><span class="s">"application/x-shockwave-flash"</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">object</span><span class="p">></span>
+<span class="nt">&lt;object</span> <span class="na">data=</span><span class="s">"https://example.com/flash"</span> <span class="na">type=</span><span class="s">"application/x-shockwave-flash"</span><span class="nt">></span><span class="nt">&lt;/object></span>
 </pre>
     </div>
     <h5 class="heading settled algorithm" data-algorithm="plugin-types Post-Request Check" data-dfn-type="dfn" data-level="6.2.2.1" data-lt="plugin-types Post-Request Check" data-noexport="" id="plugin-types-post-request-check"><span class="secno">6.2.2.1. </span><span class="content"> <code>plugin-types</code> Post-Request Check </span><a class="self-link" href="#plugin-types-post-request-check"></a></h5>
@@ -4206,7 +4212,7 @@ <h5 class="heading settled algorithm" data-algorithm="navigation-to Pre-Navigati
     </ol>
     <h3 class="heading settled" data-level="6.4" id="directives-reporting"><span class="secno">6.4. </span><span class="content"> Reporting Directives </span><a class="self-link" href="#directives-reporting"></a></h3>
     <p>Various algorithms in this document hook into the reporting process by
-  constructing a <a data-link-type="dfn" href="#violation" id="ref-for-violation-20">violation</a> object via <a href="#create-violation-for-request">§2.3.2 Create a violation object for request, policy, and directive</a> or <a href="#create-violation-for-global">§2.3.1 Create a violation object for global, policy, and directive</a>, and passing that object to <a href="#report-violation">§5.3 Report a violation</a> to deliver the report.</p>
+  constructing a <a data-link-type="dfn" href="#violation" id="ref-for-violation-20">violation</a> object via <a href="#create-violation-for-request">§2.4.2 Create a violation object for request, policy, and directive</a> or <a href="#create-violation-for-global">§2.4.1 Create a violation object for global, policy, and directive</a>, and passing that object to <a href="#report-violation">§5.3 Report a violation</a> to deliver the report.</p>
     <h4 class="heading settled" data-level="6.4.1" id="directive-report-uri"><span class="secno">6.4.1. </span><span class="content"><code>report-uri</code></span><a class="self-link" href="#directive-report-uri"></a></h4>
     <div class="note" role="note">
       Note: The <a data-link-type="dfn" href="#report-uri" id="ref-for-report-uri-3"><code>report-uri</code></a> directive is deprecated. Please use the <a data-link-type="dfn" href="#report-to" id="ref-for-report-to-3"><code>report-to</code></a> directive instead. If the latter directive is present,
@@ -4779,13 +4785,13 @@ <h3 class="heading settled" data-level="7.1" id="security-nonces"><span class="s
     <h3 class="heading settled" data-level="7.2" id="security-nonce-stealing"><span class="secno">7.2. </span><span class="content">Nonce Stealing</span><a class="self-link" href="#security-nonce-stealing"></a></h3>
     <p>Dangling markup attacks such as those discussed in <a data-link-type="biblio" href="#biblio-filedescriptor-2015">[FILEDESCRIPTOR-2015]</a> can be used to repurpose a page’s legitimate nonces for injections. For
   example, given an injection point before a <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/scripting.html#script">script</a></code> element:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">p</span><span class="p">></span>Hello, [INJECTION POINT]<span class="p">&lt;</span><span class="p">/</span><span class="nt">p</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">script</span> <span class="na">nonce</span><span class="o">=</span><span class="s">abc</span> <span class="na">src</span><span class="o">=</span><span class="s">/good.js</span><span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;p</span><span class="nt">></span>Hello, [INJECTION POINT]<span class="nt">&lt;/p></span>
+<span class="nt">&lt;script </span><span class="na">nonce=</span><span class="s">abc</span> <span class="na">src=</span><span class="s">/good.js</span><span class="nt">></span><span class="nt">&lt;/script></span>
 </pre>
     <p>If an attacker injects the string "<code>&lt;script src='https://evil.com/evil.js' </code>",
   then the browser will receive the following:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">p</span><span class="p">></span>Hello, <span class="p">&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">'https://evil.com/evil.js'</span> &lt;/<span class="na">p</span><span class="p">></span>
-<span class="o">&lt;</span>script nonce<span class="o">=</span>abc src<span class="o">=</span>/good.js><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;p</span><span class="nt">></span>Hello, <span class="nt">&lt;script </span><span class="na">src=</span><span class="s">'https://evil.com/evil.js'</span> &lt;/<span class="na">p</span><span class="nt">></span>
+<span class="o">&lt;</span>script nonce<span class="o">=</span>abc src<span class="o">=</span>/good.js><span class="nt">&lt;/script></span>
 </pre>
     <p>It will then parse that code, ending up with a <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/scripting.html#script">script</a></code> element with a <code>src</code> attribute pointing to a malicious payload, an attribute named <code>&lt;/p></code>,
   an attribute named "<code>&lt;script</code>", a <code>nonce</code> attribute, and a
@@ -4876,7 +4882,7 @@ <h3 class="heading settled" data-level="8.2" id="strict-dynamic-usage"><span cla
 </pre>
      <p>And serves the following HTML with that policy active:</p>
 <pre class="highlight">...
-<span class="p">&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">"https://cdn.example.com/script.js"</span> <span class="na">nonce</span><span class="o">=</span><span class="s">"DhcnhD3khTMePgXwdayK9BsMqXjhguVV"</span> <span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+<span class="nt">&lt;script </span><span class="na">src=</span><span class="s">"https://cdn.example.com/script.js"</span> <span class="na">nonce=</span><span class="s">"DhcnhD3khTMePgXwdayK9BsMqXjhguVV"</span> <span class="nt">></span><span class="nt">&lt;/script></span>
 ...
 </pre>
      <p>This will generate a request for <code>https://cdn.example.com/script.js</code>, which
@@ -4905,7 +4911,7 @@ <h3 class="heading settled" data-level="8.3" id="unsafe-hashed-attributes-usage"
      <div class="example" id="example-58b9ab8c">
       <a class="self-link" href="#example-58b9ab8c"></a> MegaCorp, Inc. can’t quite get rid of the following HTML on anything
       resembling a reasonable schedule: 
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">button</span> <span class="na">id</span><span class="o">=</span><span class="s">"action"</span> <span class="na">onclick</span><span class="o">=</span><span class="s">"doSubmit()"</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;button</span> <span class="na">id=</span><span class="s">"action"</span> <span class="na">onclick=</span><span class="s">"doSubmit()"</span><span class="nt">></span>
 </pre>
       <p>Rather than reducing security by specifying "<code>'unsafe-inline'</code>", they decide to use
       "<code>'unsafe-hashed-attributes'</code>" along with a hash source expression, as follows:</p>
@@ -4929,16 +4935,16 @@ <h3 class="heading settled" data-level="8.4" id="external-hash"><span class="sec
       <p>In the presence of that policy, the following <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/scripting.html#script">script</a></code> elements would be
       allowed to execute because they contain only integrity metadata that matches
       the policy:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"sha256-abc123"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"sha512-321cba"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"sha256-abc123 sha512-321cba"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"sha256-abc123"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
+<span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"sha512-321cba"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
+<span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"sha256-abc123 sha512-321cba"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
 </pre>
       <p>While the following <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/scripting.html#script">script</a></code> elements would not execute because they
       contain valid metadata that does not match the policy (even though other
       metadata does match):</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"</span><b><span class="s">sha384-xyz789</span></b><span class="s">"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"</span><b><span class="s">sha384-xyz789</span></b><span class="s"> sha512-321cba"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"sha256-abc123 </span><b><span class="s">sha384-xyz789</span></b><span class="s"> sha512-321cba"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"</span><b><span class="s">sha384-xyz789</span></b><span class="s">"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
+<span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"</span><b><span class="s">sha384-xyz789</span></b><span class="s"> sha512-321cba"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
+<span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"sha256-abc123 </span><b><span class="s">sha384-xyz789</span></b><span class="s"> sha512-321cba"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
 </pre>
       <p>Metadata that is not recognized (either because it’s entirely invalid, or
       because it specifies a not-yet-supported hashing algorithm) does not affect
@@ -4946,9 +4952,9 @@ <h3 class="heading settled" data-level="8.4" id="external-hash"><span class="sec
       allowed to execute in the presence of the above policy, as the additional
       metadata is invalid and therefore wouldn’t allow a script whose content
       wasn’t listed explicitly in the policy to execute:</p>
-<pre class="highlight"><span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"sha256-abc123 </span><b><span class="s">sha1024-abcd</span></b><span class="s">"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"sha512-321cba </span><b><span class="s">entirely-invalid</span></b><span class="s">"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
-<span class="p">&lt;</span><span class="nt">script</span> <span class="na">integrity</span><span class="o">=</span><span class="s">"sha256-abc123 </span><b><span class="s">not-a-hash-at-all</span></b><span class="s"> sha512-321cba"</span> ...<span class="p">></span><span class="p">&lt;</span><span class="p">/</span><span class="nt">script</span><span class="p">></span>
+<pre class="highlight"><span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"sha256-abc123 </span><b><span class="s">sha1024-abcd</span></b><span class="s">"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
+<span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"sha512-321cba </span><b><span class="s">entirely-invalid</span></b><span class="s">"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
+<span class="nt">&lt;script </span><span class="na">integrity=</span><span class="s">"sha256-abc123 </span><b><span class="s">not-a-hash-at-all</span></b><span class="s"> sha512-321cba"</span> ...<span class="nt">></span><span class="nt">&lt;/script></span>
 </pre>
      </div>
     </section>
@@ -5115,7 +5121,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#source-list-allows-all-inline-behavior">allows all inline behavior</a><span>, in §6.6.2.2</span>
    <li><a href="#grammardef-ancestor-source">ancestor-source</a><span>, in §6.3.2</span>
    <li><a href="#grammardef-ancestor-source-list">ancestor-source-list</a><span>, in §6.3.2</span>
-   <li><a href="#grammardef-base64-value">base64-value</a><span>, in §2.2.1</span>
+   <li><a href="#grammardef-base64-value">base64-value</a><span>, in §2.3.1</span>
    <li><a href="#base-uri">base-uri</a><span>, in §6.2.1</span>
    <li>
     blockedURI
@@ -5124,7 +5130,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-securitypolicyviolationeventinit-blockeduri">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
    <li><a href="#child-src">child-src</a><span>, in §6.1.1</span>
-   <li><a href="#violation-column-number">column number</a><span>, in §2.3</span>
+   <li><a href="#violation-column-number">column number</a><span>, in §2.4</span>
    <li>
     columnNumber
     <ul>
@@ -5134,20 +5140,20 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#connect-src">connect-src</a><span>, in §6.1.2</span>
    <li><a href="#header-content-security-policy">Content-Security-Policy</a><span>, in §3.1</span>
    <li><a href="#content-security-policy">Content Security Policy</a><span>, in §1</span>
-   <li><a href="#content-security-policy-object">content security policy object</a><span>, in §2.1</span>
+   <li><a href="#content-security-policy-object">content security policy object</a><span>, in §2.2</span>
    <li><a href="#header-content-security-policy-report-only">Content-Security-Policy-Report-Only</a><span>, in §3.2</span>
    <li><a href="#global-object-csp-list">CSP list</a><span>, in §4.2</span>
    <li><a href="#default-src">default-src</a><span>, in §6.1.3</span>
-   <li><a href="#grammardef-directive-name">directive-name</a><span>, in §2.2</span>
-   <li><a href="#directives">directives</a><span>, in §2.2</span>
-   <li><a href="#policy-directive-set">directive set</a><span>, in §2.1</span>
-   <li><a href="#grammardef-directive-value">directive-value</a><span>, in §2.2</span>
+   <li><a href="#grammardef-directive-name">directive-name</a><span>, in §2.3</span>
+   <li><a href="#directives">directives</a><span>, in §2.3</span>
+   <li><a href="#policy-directive-set">directive set</a><span>, in §2.2</span>
+   <li><a href="#grammardef-directive-value">directive-value</a><span>, in §2.3</span>
    <li><a href="#disown-opener">disown-opener</a><span>, in §6.2.4</span>
    <li>
     disposition
     <ul>
-     <li><a href="#policy-disposition">dfn for policy</a><span>, in §2.1</span>
-     <li><a href="#violation-disposition">dfn for violation</a><span>, in §2.3</span>
+     <li><a href="#policy-disposition">dfn for policy</a><span>, in §2.2</span>
+     <li><a href="#violation-disposition">dfn for violation</a><span>, in §2.4</span>
      <li><a href="#dom-securitypolicyviolationevent-disposition">attribute for SecurityPolicyViolationEvent</a><span>, in §5.1</span>
      <li><a href="#dom-securitypolicyviolationeventinit-disposition">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
@@ -5160,7 +5166,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     effective directive
     <ul>
-     <li><a href="#violation-effective-directive">dfn for violation</a><span>, in §2.3</span>
+     <li><a href="#violation-effective-directive">dfn for violation</a><span>, in §2.4</span>
      <li><a href="#request-effective-directive">dfn for request</a><span>, in §6.6.1.11</span>
     </ul>
    <li>
@@ -5169,7 +5175,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-securitypolicyviolationevent-effectivedirective">attribute for SecurityPolicyViolationEvent</a><span>, in §5.1</span>
      <li><a href="#dom-securitypolicyviolationeventinit-effectivedirective">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
-   <li><a href="#violation-element">element</a><span>, in §2.3</span>
+   <li><a href="#violation-element">element</a><span>, in §2.4</span>
    <li><a href="#embedding-document">embedding document</a><span>, in §4.2</span>
    <li><a href="#dom-securitypolicyviolationeventdisposition-enforce">enforce</a><span>, in §5.1</span>
    <li><a href="#dom-securitypolicyviolationeventdisposition-enforce">"enforce"</a><span>, in §5.1</span>
@@ -5180,17 +5186,17 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#form-action">form-action</a><span>, in §6.3.1</span>
    <li><a href="#frame-ancestors">frame-ancestors</a><span>, in §6.3.2</span>
    <li><a href="#frame-src">frame-src</a><span>, in §6.1.5</span>
-   <li><a href="#violation-global-object">global object</a><span>, in §2.3</span>
-   <li><a href="#grammardef-hash-algorithm">hash-algorithm</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-hash-source">hash-source</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-host-char">host-char</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-host-part">host-part</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-host-source">host-source</a><span>, in §2.2.1</span>
+   <li><a href="#violation-global-object">global object</a><span>, in §2.4</span>
+   <li><a href="#grammardef-hash-algorithm">hash-algorithm</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-hash-source">hash-source</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-host-char">host-char</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-host-part">host-part</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-host-source">host-source</a><span>, in §2.3.1</span>
    <li><a href="#img-src">img-src</a><span>, in §6.1.6</span>
-   <li><a href="#directive-initialization">initialization</a><span>, in §2.2</span>
-   <li><a href="#directive-inline-check">inline check</a><span>, in §2.2</span>
-   <li><a href="#grammardef-keyword-source">keyword-source</a><span>, in §2.2.1</span>
-   <li><a href="#violation-line-number">line number</a><span>, in §2.3</span>
+   <li><a href="#directive-initialization">initialization</a><span>, in §2.3</span>
+   <li><a href="#directive-inline-check">inline check</a><span>, in §2.3</span>
+   <li><a href="#grammardef-keyword-source">keyword-source</a><span>, in §2.3.1</span>
+   <li><a href="#violation-line-number">line number</a><span>, in §2.4</span>
    <li>
     lineNumber
     <ul>
@@ -5202,11 +5208,11 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#grammardef-media-type">media-type</a><span>, in §6.2.2</span>
    <li><a href="#grammardef-media-type-list">media-type-list</a><span>, in §6.2.2</span>
    <li><a href="#monitored">monitored</a><span>, in §4.2</span>
-   <li><a href="#directive-name">name</a><span>, in §2.2</span>
-   <li><a href="#directive-navigation-response-check">navigation response check</a><span>, in §2.2</span>
+   <li><a href="#directive-name">name</a><span>, in §2.3</span>
+   <li><a href="#directive-navigation-response-check">navigation response check</a><span>, in §2.3</span>
    <li><a href="#navigation-to">navigation-to</a><span>, in §6.3.3</span>
-   <li><a href="#grammardef-nonce-source">nonce-source</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-none">'none'</a><span>, in §2.2.1</span>
+   <li><a href="#grammardef-nonce-source">nonce-source</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-none">'none'</a><span>, in §2.3.1</span>
    <li><a href="#object-src">object-src</a><span>, in §6.1.9</span>
    <li>
     originalPolicy
@@ -5214,89 +5220,89 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-securitypolicyviolationevent-originalpolicy">attribute for SecurityPolicyViolationEvent</a><span>, in §5.1</span>
      <li><a href="#dom-securitypolicyviolationeventinit-originalpolicy">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
-   <li><a href="#parse-serialized-policy">parse a serialized CSP</a><span>, in §2.1</span>
-   <li><a href="#grammardef-path-part">path-part</a><span>, in §2.2.1</span>
+   <li><a href="#parse-serialized-policy">parse a serialized CSP</a><span>, in §2.2</span>
+   <li><a href="#grammardef-path-part">path-part</a><span>, in §2.3.1</span>
    <li><a href="#plugin-types">plugin-types</a><span>, in §6.2.2</span>
    <li><a href="#plugin-types-post-request-check">plugin-types Post-Request Check</a><span>, in §6.2.2</span>
    <li>
     policy
     <ul>
-     <li><a href="#content-security-policy-object">definition of</a><span>, in §2.1</span>
-     <li><a href="#violation-policy">dfn for violation</a><span>, in §2.3</span>
+     <li><a href="#content-security-policy-object">definition of</a><span>, in §2.2</span>
+     <li><a href="#violation-policy">dfn for violation</a><span>, in §2.4</span>
     </ul>
-   <li><a href="#grammardef-port-part">port-part</a><span>, in §2.2.1</span>
-   <li><a href="#directive-post-request-check">post-request check</a><span>, in §2.2</span>
-   <li><a href="#directive-pre-navigation-check">pre-navigation check</a><span>, in §2.2</span>
-   <li><a href="#directive-pre-request-check">pre-request check</a><span>, in §2.2</span>
+   <li><a href="#grammardef-port-part">port-part</a><span>, in §2.3.1</span>
+   <li><a href="#directive-post-request-check">post-request check</a><span>, in §2.3</span>
+   <li><a href="#directive-pre-navigation-check">pre-navigation check</a><span>, in §2.3</span>
+   <li><a href="#directive-pre-request-check">pre-request check</a><span>, in §2.3</span>
    <li>
     referrer
     <ul>
-     <li><a href="#violation-referrer">dfn for violation</a><span>, in §2.3</span>
+     <li><a href="#violation-referrer">dfn for violation</a><span>, in §2.4</span>
      <li><a href="#dom-securitypolicyviolationevent-referrer">attribute for SecurityPolicyViolationEvent</a><span>, in §5.1</span>
      <li><a href="#dom-securitypolicyviolationeventinit-referrer">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
    <li><a href="#dom-securitypolicyviolationeventdisposition-report">report</a><span>, in §5.1</span>
    <li><a href="#dom-securitypolicyviolationeventdisposition-report">"report"</a><span>, in §5.1</span>
-   <li><a href="#grammardef-report-sample">'report-sample'</a><span>, in §2.2.1</span>
+   <li><a href="#grammardef-report-sample">'report-sample'</a><span>, in §2.3.1</span>
    <li><a href="#report-to">report-to</a><span>, in §6.4.2</span>
    <li><a href="#report-uri">report-uri</a><span>, in §6.4.1</span>
-   <li><a href="#violation-resource">resource</a><span>, in §2.3</span>
-   <li><a href="#directive-response-check">response check</a><span>, in §2.2</span>
+   <li><a href="#violation-resource">resource</a><span>, in §2.4</span>
+   <li><a href="#directive-response-check">response check</a><span>, in §2.3</span>
    <li>
     sample
     <ul>
-     <li><a href="#violation-sample">dfn for violation</a><span>, in §2.3</span>
+     <li><a href="#violation-sample">dfn for violation</a><span>, in §2.4</span>
      <li><a href="#dom-securitypolicyviolationevent-sample">attribute for SecurityPolicyViolationEvent</a><span>, in §5.1</span>
      <li><a href="#dom-securitypolicyviolationeventinit-sample">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
    <li><a href="#sandbox">sandbox</a><span>, in §6.2.3</span>
-   <li><a href="#grammardef-scheme-part">scheme-part</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-scheme-source">scheme-source</a><span>, in §2.2.1</span>
+   <li><a href="#grammardef-scheme-part">scheme-part</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-scheme-source">scheme-source</a><span>, in §2.3.1</span>
    <li><a href="#script-src">script-src</a><span>, in §6.1.10</span>
    <li><a href="#securitypolicyviolationevent">SecurityPolicyViolationEvent</a><span>, in §5.1</span>
    <li><a href="#enumdef-securitypolicyviolationeventdisposition">SecurityPolicyViolationEventDisposition</a><span>, in §5.1</span>
    <li><a href="#dictdef-securitypolicyviolationeventinit">SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
    <li><a href="#dom-securitypolicyviolationevent-securitypolicyviolationevent">SecurityPolicyViolationEvent(type)</a><span>, in §5.1</span>
    <li><a href="#dom-securitypolicyviolationevent-securitypolicyviolationevent">SecurityPolicyViolationEvent(type, eventInitDict)</a><span>, in §5.1</span>
-   <li><a href="#grammardef-self">'self'</a><span>, in §2.2.1</span>
-   <li><a href="#serialized-csp">serialized CSP</a><span>, in §2.1</span>
-   <li><a href="#serialized-directive">serialized directive</a><span>, in §2.2</span>
-   <li><a href="#grammardef-serialized-directive">serialized-directive</a><span>, in §2.2</span>
-   <li><a href="#grammardef-serialized-policy">serialized-policy</a><span>, in §2.1</span>
-   <li><a href="#serialized-source-list">serialized source list</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-serialized-source-list">serialized-source-list</a><span>, in §2.2.1</span>
+   <li><a href="#grammardef-self">'self'</a><span>, in §2.3.1</span>
+   <li><a href="#serialized-csp">serialized CSP</a><span>, in §2.2</span>
+   <li><a href="#serialized-directive">serialized directive</a><span>, in §2.3</span>
+   <li><a href="#grammardef-serialized-directive">serialized-directive</a><span>, in §2.3</span>
+   <li><a href="#grammardef-serialized-policy">serialized-policy</a><span>, in §2.2</span>
+   <li><a href="#serialized-source-list">serialized source list</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-serialized-source-list">serialized-source-list</a><span>, in §2.3.1</span>
    <li><a href="#should-plugin-element-be-blocked-a-priori-by-content-security-policy">Should plugin element be blocked a priori by Content Security Policy?:</a><span>, in §6.2.2.1</span>
-   <li><a href="#grammardef-source-expression">source-expression</a><span>, in §2.2.1</span>
-   <li><a href="#source-expression">source expression</a><span>, in §2.2.1</span>
-   <li><a href="#violation-source-file">source file</a><span>, in §2.3</span>
+   <li><a href="#grammardef-source-expression">source-expression</a><span>, in §2.3.1</span>
+   <li><a href="#source-expression">source expression</a><span>, in §2.3.1</span>
+   <li><a href="#violation-source-file">source file</a><span>, in §2.4</span>
    <li>
     sourceFile
     <ul>
      <li><a href="#dom-securitypolicyviolationevent-sourcefile">attribute for SecurityPolicyViolationEvent</a><span>, in §5.1</span>
      <li><a href="#dom-securitypolicyviolationeventinit-sourcefile">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
-   <li><a href="#source-lists">source lists</a><span>, in §2.2.1</span>
-   <li><a href="#violation-status">status</a><span>, in §2.3</span>
+   <li><a href="#source-lists">source lists</a><span>, in §2.3.1</span>
+   <li><a href="#violation-status">status</a><span>, in §2.4</span>
    <li>
     statusCode
     <ul>
      <li><a href="#dom-securitypolicyviolationevent-statuscode">attribute for SecurityPolicyViolationEvent</a><span>, in §5.1</span>
      <li><a href="#dom-securitypolicyviolationeventinit-statuscode">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
-   <li><a href="#grammardef-strict-dynamic">'strict-dynamic'</a><span>, in §2.2.1</span>
+   <li><a href="#grammardef-strict-dynamic">'strict-dynamic'</a><span>, in §2.3.1</span>
    <li><a href="#style-src">style-src</a><span>, in §6.1.11</span>
-   <li><a href="#grammardef-unsafe-eval">'unsafe-eval'</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-unsafe-hashed-attributes">'unsafe-hashed-attributes'</a><span>, in §2.2.1</span>
-   <li><a href="#grammardef-unsafe-inline">'unsafe-inline'</a><span>, in §2.2.1</span>
-   <li><a href="#violation-url">url</a><span>, in §2.3</span>
-   <li><a href="#directive-value">value</a><span>, in §2.2</span>
+   <li><a href="#grammardef-unsafe-eval">'unsafe-eval'</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-unsafe-hashed-attributes">'unsafe-hashed-attributes'</a><span>, in §2.3.1</span>
+   <li><a href="#grammardef-unsafe-inline">'unsafe-inline'</a><span>, in §2.3.1</span>
+   <li><a href="#violation-url">url</a><span>, in §2.4</span>
+   <li><a href="#directive-value">value</a><span>, in §2.3</span>
    <li>
     violatedDirective
     <ul>
      <li><a href="#dom-securitypolicyviolationevent-violateddirective">attribute for SecurityPolicyViolationEvent</a><span>, in §5.1</span>
      <li><a href="#dom-securitypolicyviolationeventinit-violateddirective">dict-member for SecurityPolicyViolationEventInit</a><span>, in §5.1</span>
     </ul>
-   <li><a href="#violation">violation</a><span>, in §2.3</span>
+   <li><a href="#violation">violation</a><span>, in §2.4</span>
    <li><a href="#violation-report">violation report</a><span>, in §5</span>
    <li><a href="#worker-src">worker-src</a><span>, in §6.1.12</span>
   </ul>
@@ -5516,7 +5522,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><a href="https://tools.ietf.org/html/rfc5234#appendix-B.1">vchar</a>
     </ul>
    <li>
-    <a data-link-type="biblio">[rfc7230]</a> defines the following terms:
+    <a data-link-type="biblio">[RFC7230]</a> defines the following terms:
     <ul>
      <li><a href="https://tools.ietf.org/html/rfc7230#section-3.2.3">ows</a>
      <li><a href="https://tools.ietf.org/html/rfc7230#section-3.2.3">rws</a>
@@ -5742,15 +5748,15 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="content-security-policy-object">
    <b><a href="#content-security-policy-object">#content-security-policy-object</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-content-security-policy-object-1">2.1.1. 
+    <li><a href="#ref-for-content-security-policy-object-1">2.2.1. 
     Parse a serialized CSP as disposition </a> <a href="#ref-for-content-security-policy-object-2">(2)</a> <a href="#ref-for-content-security-policy-object-3">(3)</a>
-    <li><a href="#ref-for-content-security-policy-object-4">2.1.2. 
+    <li><a href="#ref-for-content-security-policy-object-4">2.2.2. 
     Parse a serialized CSP list as disposition </a>
-    <li><a href="#ref-for-content-security-policy-object-5">2.2. Directives</a> <a href="#ref-for-content-security-policy-object-6">(2)</a> <a href="#ref-for-content-security-policy-object-7">(3)</a> <a href="#ref-for-content-security-policy-object-8">(4)</a> <a href="#ref-for-content-security-policy-object-9">(5)</a>
-    <li><a href="#ref-for-content-security-policy-object-10">2.3. Violations</a> <a href="#ref-for-content-security-policy-object-11">(2)</a> <a href="#ref-for-content-security-policy-object-12">(3)</a> <a href="#ref-for-content-security-policy-object-13">(4)</a>
-    <li><a href="#ref-for-content-security-policy-object-14">2.3.1. 
+    <li><a href="#ref-for-content-security-policy-object-5">2.3. Directives</a> <a href="#ref-for-content-security-policy-object-6">(2)</a> <a href="#ref-for-content-security-policy-object-7">(3)</a> <a href="#ref-for-content-security-policy-object-8">(4)</a> <a href="#ref-for-content-security-policy-object-9">(5)</a>
+    <li><a href="#ref-for-content-security-policy-object-10">2.4. Violations</a> <a href="#ref-for-content-security-policy-object-11">(2)</a> <a href="#ref-for-content-security-policy-object-12">(3)</a> <a href="#ref-for-content-security-policy-object-13">(4)</a>
+    <li><a href="#ref-for-content-security-policy-object-14">2.4.1. 
     Create a violation object for global, policy, and directive </a>
-    <li><a href="#ref-for-content-security-policy-object-15">2.3.2. 
+    <li><a href="#ref-for-content-security-policy-object-15">2.4.2. 
     Create a violation object for request, policy, and directive </a>
     <li><a href="#ref-for-content-security-policy-object-16">3. 
     Policy Delivery </a> <a href="#ref-for-content-security-policy-object-17">(2)</a>
@@ -5830,11 +5836,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="policy-directive-set">
    <b><a href="#policy-directive-set">#policy-directive-set</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-policy-directive-set-1">2.1.1. 
+    <li><a href="#ref-for-policy-directive-set-1">2.2.1. 
     Parse a serialized CSP as disposition </a> <a href="#ref-for-policy-directive-set-2">(2)</a> <a href="#ref-for-policy-directive-set-3">(3)</a> <a href="#ref-for-policy-directive-set-4">(4)</a>
-    <li><a href="#ref-for-policy-directive-set-5">2.1.2. 
+    <li><a href="#ref-for-policy-directive-set-5">2.2.2. 
     Parse a serialized CSP list as disposition </a>
-    <li><a href="#ref-for-policy-directive-set-6">2.2. Directives</a>
+    <li><a href="#ref-for-policy-directive-set-6">2.3. Directives</a>
     <li><a href="#ref-for-policy-directive-set-7">4.2.3. 
     Should element’s inline type behavior be blocked by Content Security Policy? </a>
     <li><a href="#ref-for-policy-directive-set-8">5.3. 
@@ -5846,11 +5852,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="policy-disposition">
    <b><a href="#policy-disposition">#policy-disposition</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-policy-disposition-1">2.1.1. 
+    <li><a href="#ref-for-policy-disposition-1">2.2.1. 
     Parse a serialized CSP as disposition </a> <a href="#ref-for-policy-disposition-2">(2)</a>
-    <li><a href="#ref-for-policy-disposition-3">2.1.2. 
+    <li><a href="#ref-for-policy-disposition-3">2.2.2. 
     Parse a serialized CSP list as disposition </a>
-    <li><a href="#ref-for-policy-disposition-4">2.3. Violations</a>
+    <li><a href="#ref-for-policy-disposition-4">2.4. Violations</a>
     <li><a href="#ref-for-policy-disposition-5">4.1.2. 
     Report Content Security Policy violations for request </a>
     <li><a href="#ref-for-policy-disposition-6">4.1.3. 
@@ -5881,11 +5887,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="serialized-csp">
    <b><a href="#serialized-csp">#serialized-csp</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-serialized-csp-1">2.1.1. 
+    <li><a href="#ref-for-serialized-csp-1">2.2.1. 
     Parse a serialized CSP as disposition </a>
-    <li><a href="#ref-for-serialized-csp-2">2.1.2. 
+    <li><a href="#ref-for-serialized-csp-2">2.2.2. 
     Parse a serialized CSP list as disposition </a>
-    <li><a href="#ref-for-serialized-csp-3">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-serialized-csp-3">2.3.1. Source Lists</a>
     <li><a href="#ref-for-serialized-csp-4">3. 
     Policy Delivery </a>
     <li><a href="#ref-for-serialized-csp-5">3.1. 
@@ -5910,7 +5916,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="parse-serialized-policy">
    <b><a href="#parse-serialized-policy">#parse-serialized-policy</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-parse-serialized-policy-1">2.1.2. 
+    <li><a href="#ref-for-parse-serialized-policy-1">2.2.2. 
     Parse a serialized CSP list as disposition </a>
     <li><a href="#ref-for-parse-serialized-policy-2">3.1. 
     The Content-Security-Policy HTTP Response Header Field </a>
@@ -5923,12 +5929,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="directives">
    <b><a href="#directives">#directives</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-directives-1">2.1. Policies</a>
-    <li><a href="#ref-for-directives-2">2.1.1. 
+    <li><a href="#ref-for-directives-1">2.2. Policies</a>
+    <li><a href="#ref-for-directives-2">2.2.1. 
     Parse a serialized CSP as disposition </a> <a href="#ref-for-directives-3">(2)</a>
-    <li><a href="#ref-for-directives-4">2.2. Directives</a> <a href="#ref-for-directives-5">(2)</a>
-    <li><a href="#ref-for-directives-6">2.2.1. Source Lists</a>
-    <li><a href="#ref-for-directives-7">2.3. Violations</a>
+    <li><a href="#ref-for-directives-4">2.3. Directives</a> <a href="#ref-for-directives-5">(2)</a>
+    <li><a href="#ref-for-directives-6">2.3.1. Source Lists</a>
+    <li><a href="#ref-for-directives-7">2.4. Violations</a>
     <li><a href="#ref-for-directives-8">4.1. 
     Integration with Fetch </a>
     <li><a href="#ref-for-directives-9">4.3.1. 
@@ -5967,9 +5973,9 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="directive-name">
    <b><a href="#directive-name">#directive-name</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-directive-name-1">2.1.1. 
+    <li><a href="#ref-for-directive-name-1">2.2.1. 
     Parse a serialized CSP as disposition </a> <a href="#ref-for-directive-name-2">(2)</a>
-    <li><a href="#ref-for-directive-name-3">2.2. Directives</a>
+    <li><a href="#ref-for-directive-name-3">2.3. Directives</a>
     <li><a href="#ref-for-directive-name-4">4.2.4. 
     Should navigation request of type from source in target be blocked
     by Content Security Policy? </a> <a href="#ref-for-directive-name-5">(2)</a>
@@ -5999,10 +6005,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="directive-value">
    <b><a href="#directive-value">#directive-value</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-directive-value-1">2.1.1. 
+    <li><a href="#ref-for-directive-value-1">2.2.1. 
     Parse a serialized CSP as disposition </a>
-    <li><a href="#ref-for-directive-value-2">2.2. Directives</a> <a href="#ref-for-directive-value-3">(2)</a>
-    <li><a href="#ref-for-directive-value-4">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-directive-value-2">2.3. Directives</a> <a href="#ref-for-directive-value-3">(2)</a>
+    <li><a href="#ref-for-directive-value-4">2.3.1. Source Lists</a>
     <li><a href="#ref-for-directive-value-5">4.2.3. 
     Should element’s inline type behavior be blocked by Content Security Policy? </a>
     <li><a href="#ref-for-directive-value-6">4.3.1. 
@@ -6083,25 +6089,25 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="serialized-directive">
    <b><a href="#serialized-directive">#serialized-directive</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-serialized-directive-1">2.1. Policies</a>
+    <li><a href="#ref-for-serialized-directive-1">2.2. Policies</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="grammardef-serialized-directive">
    <b><a href="#grammardef-serialized-directive">#grammardef-serialized-directive</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-serialized-directive-1">2.1. Policies</a> <a href="#ref-for-grammardef-serialized-directive-2">(2)</a>
+    <li><a href="#ref-for-grammardef-serialized-directive-1">2.2. Policies</a> <a href="#ref-for-grammardef-serialized-directive-2">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="grammardef-directive-name">
    <b><a href="#grammardef-directive-name">#grammardef-directive-name</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-directive-name-1">2.2. Directives</a>
+    <li><a href="#ref-for-grammardef-directive-name-1">2.3. Directives</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="grammardef-directive-value">
    <b><a href="#grammardef-directive-value">#grammardef-directive-value</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-directive-value-1">2.2. Directives</a>
+    <li><a href="#ref-for-grammardef-directive-value-1">2.3. Directives</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="directive-pre-request-check">
@@ -6278,7 +6284,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#source-expression">#source-expression</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-source-expression-1">1.3. Changes from Level 2</a>
-    <li><a href="#ref-for-source-expression-2">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-source-expression-2">2.3.1. Source Lists</a>
     <li><a href="#ref-for-source-expression-3">4.3.1. 
     EnsureCSPDoesNotBlockStringCompilation(callerRealm, calleeRealm) </a>
     <li><a href="#ref-for-source-expression-4">6.1.10.1. 
@@ -6312,20 +6318,20 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-none">
    <b><a href="#grammardef-none">#grammardef-none</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-none-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-none-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-none-2">6.3.2. frame-ancestors</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="grammardef-source-expression">
    <b><a href="#grammardef-source-expression">#grammardef-source-expression</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-source-expression-1">2.2.1. Source Lists</a> <a href="#ref-for-grammardef-source-expression-2">(2)</a>
+    <li><a href="#ref-for-grammardef-source-expression-1">2.3.1. Source Lists</a> <a href="#ref-for-grammardef-source-expression-2">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="grammardef-scheme-source">
    <b><a href="#grammardef-scheme-source">#grammardef-scheme-source</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-scheme-source-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-scheme-source-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-scheme-source-2">6.3.2. frame-ancestors</a>
     <li><a href="#ref-for-grammardef-scheme-source-3">6.6.1.6. 
     Does url match expression in origin with redirect count? </a> <a href="#ref-for-grammardef-scheme-source-4">(2)</a>
@@ -6336,7 +6342,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-host-source">
    <b><a href="#grammardef-host-source">#grammardef-host-source</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-host-source-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-host-source-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-host-source-2">6.3.2. frame-ancestors</a>
     <li><a href="#ref-for-grammardef-host-source-3">6.6.1.6. 
     Does url match expression in origin with redirect count? </a> <a href="#ref-for-grammardef-host-source-4">(2)</a> <a href="#ref-for-grammardef-host-source-5">(3)</a>
@@ -6347,7 +6353,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-scheme-part">
    <b><a href="#grammardef-scheme-part">#grammardef-scheme-part</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-scheme-part-1">2.2.1. Source Lists</a> <a href="#ref-for-grammardef-scheme-part-2">(2)</a>
+    <li><a href="#ref-for-grammardef-scheme-part-1">2.3.1. Source Lists</a> <a href="#ref-for-grammardef-scheme-part-2">(2)</a>
     <li><a href="#ref-for-grammardef-scheme-part-3">6.6.1.6. 
     Does url match expression in origin with redirect count? </a> <a href="#ref-for-grammardef-scheme-part-4">(2)</a> <a href="#ref-for-grammardef-scheme-part-5">(3)</a> <a href="#ref-for-grammardef-scheme-part-6">(4)</a> <a href="#ref-for-grammardef-scheme-part-7">(5)</a>
    </ul>
@@ -6355,7 +6361,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-host-part">
    <b><a href="#grammardef-host-part">#grammardef-host-part</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-host-part-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-host-part-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-host-part-2">6.6.1.6. 
     Does url match expression in origin with redirect count? </a>
    </ul>
@@ -6363,13 +6369,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-host-char">
    <b><a href="#grammardef-host-char">#grammardef-host-char</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-host-char-1">2.2.1. Source Lists</a> <a href="#ref-for-grammardef-host-char-2">(2)</a> <a href="#ref-for-grammardef-host-char-3">(3)</a>
+    <li><a href="#ref-for-grammardef-host-char-1">2.3.1. Source Lists</a> <a href="#ref-for-grammardef-host-char-2">(2)</a> <a href="#ref-for-grammardef-host-char-3">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="grammardef-port-part">
    <b><a href="#grammardef-port-part">#grammardef-port-part</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-port-part-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-port-part-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-port-part-2">6.6.1.6. 
     Does url match expression in origin with redirect count? </a> <a href="#ref-for-grammardef-port-part-3">(2)</a>
    </ul>
@@ -6377,7 +6383,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-path-part">
    <b><a href="#grammardef-path-part">#grammardef-path-part</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-path-part-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-path-part-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-path-part-2">6.6.1.6. 
     Does url match expression in origin with redirect count? </a> <a href="#ref-for-grammardef-path-part-3">(2)</a>
    </ul>
@@ -6385,7 +6391,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-keyword-source">
    <b><a href="#grammardef-keyword-source">#grammardef-keyword-source</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-keyword-source-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-keyword-source-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-keyword-source-2">6.1.10.1. 
     script-src Pre-request check </a>
     <li><a href="#ref-for-grammardef-keyword-source-3">6.1.10.3. 
@@ -6401,7 +6407,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-self">
    <b><a href="#grammardef-self">#grammardef-self</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-self-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-self-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-self-2">6.1.3. default-src</a> <a href="#ref-for-grammardef-self-3">(2)</a> <a href="#ref-for-grammardef-self-4">(3)</a> <a href="#ref-for-grammardef-self-5">(4)</a> <a href="#ref-for-grammardef-self-6">(5)</a> <a href="#ref-for-grammardef-self-7">(6)</a> <a href="#ref-for-grammardef-self-8">(7)</a> <a href="#ref-for-grammardef-self-9">(8)</a> <a href="#ref-for-grammardef-self-10">(9)</a> <a href="#ref-for-grammardef-self-11">(10)</a> <a href="#ref-for-grammardef-self-12">(11)</a> <a href="#ref-for-grammardef-self-13">(12)</a> <a href="#ref-for-grammardef-self-14">(13)</a> <a href="#ref-for-grammardef-self-15">(14)</a> <a href="#ref-for-grammardef-self-16">(15)</a> <a href="#ref-for-grammardef-self-17">(16)</a> <a href="#ref-for-grammardef-self-18">(17)</a> <a href="#ref-for-grammardef-self-19">(18)</a> <a href="#ref-for-grammardef-self-20">(19)</a> <a href="#ref-for-grammardef-self-21">(20)</a> <a href="#ref-for-grammardef-self-22">(21)</a>
     <li><a href="#ref-for-grammardef-self-23">6.3.2. frame-ancestors</a>
     <li><a href="#ref-for-grammardef-self-24">8.2. 
@@ -6464,7 +6470,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-nonce-source">
    <b><a href="#grammardef-nonce-source">#grammardef-nonce-source</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-nonce-source-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-nonce-source-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-nonce-source-2">6.1.10. script-src</a>
     <li><a href="#ref-for-grammardef-nonce-source-3">6.1.10.3. 
     script-src Inline Check </a>
@@ -6485,7 +6491,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-base64-value">
    <b><a href="#grammardef-base64-value">#grammardef-base64-value</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-base64-value-1">2.2.1. Source Lists</a> <a href="#ref-for-grammardef-base64-value-2">(2)</a>
+    <li><a href="#ref-for-grammardef-base64-value-1">2.3.1. Source Lists</a> <a href="#ref-for-grammardef-base64-value-2">(2)</a>
     <li><a href="#ref-for-grammardef-base64-value-3">6.1.10.1. 
     script-src Pre-request check </a>
     <li><a href="#ref-for-grammardef-base64-value-4">6.6.1.2. 
@@ -6497,7 +6503,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-hash-source">
    <b><a href="#grammardef-hash-source">#grammardef-hash-source</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-hash-source-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-hash-source-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-hash-source-2">6.1.10. script-src</a>
     <li><a href="#ref-for-grammardef-hash-source-3">6.1.10.1. 
     script-src Pre-request check </a> <a href="#ref-for-grammardef-hash-source-4">(2)</a>
@@ -6517,7 +6523,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="grammardef-hash-algorithm">
    <b><a href="#grammardef-hash-algorithm">#grammardef-hash-algorithm</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-grammardef-hash-algorithm-1">2.2.1. Source Lists</a>
+    <li><a href="#ref-for-grammardef-hash-algorithm-1">2.3.1. Source Lists</a>
     <li><a href="#ref-for-grammardef-hash-algorithm-2">6.1.10.1. 
     script-src Pre-request check </a>
     <li><a href="#ref-for-grammardef-hash-algorithm-3">6.6.2.3. 
@@ -6527,10 +6533,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation">
    <b><a href="#violation">#violation</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-1">2.3. Violations</a> <a href="#ref-for-violation-2">(2)</a> <a href="#ref-for-violation-3">(3)</a> <a href="#ref-for-violation-4">(4)</a> <a href="#ref-for-violation-5">(5)</a> <a href="#ref-for-violation-6">(6)</a> <a href="#ref-for-violation-7">(7)</a> <a href="#ref-for-violation-8">(8)</a> <a href="#ref-for-violation-9">(9)</a> <a href="#ref-for-violation-10">(10)</a> <a href="#ref-for-violation-11">(11)</a> <a href="#ref-for-violation-12">(12)</a> <a href="#ref-for-violation-13">(13)</a> <a href="#ref-for-violation-14">(14)</a>
-    <li><a href="#ref-for-violation-15">2.3.1. 
+    <li><a href="#ref-for-violation-1">2.4. Violations</a> <a href="#ref-for-violation-2">(2)</a> <a href="#ref-for-violation-3">(3)</a> <a href="#ref-for-violation-4">(4)</a> <a href="#ref-for-violation-5">(5)</a> <a href="#ref-for-violation-6">(6)</a> <a href="#ref-for-violation-7">(7)</a> <a href="#ref-for-violation-8">(8)</a> <a href="#ref-for-violation-9">(9)</a> <a href="#ref-for-violation-10">(10)</a> <a href="#ref-for-violation-11">(11)</a> <a href="#ref-for-violation-12">(12)</a> <a href="#ref-for-violation-13">(13)</a> <a href="#ref-for-violation-14">(14)</a>
+    <li><a href="#ref-for-violation-15">2.4.1. 
     Create a violation object for global, policy, and directive </a> <a href="#ref-for-violation-16">(2)</a>
-    <li><a href="#ref-for-violation-17">2.3.2. 
+    <li><a href="#ref-for-violation-17">2.4.2. 
     Create a violation object for request, policy, and directive </a>
     <li><a href="#ref-for-violation-18">5.2. 
     Obtain the deprecated serialization of violation </a>
@@ -6543,8 +6549,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-global-object">
    <b><a href="#violation-global-object">#violation-global-object</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-global-object-1">2.3. Violations</a>
-    <li><a href="#ref-for-violation-global-object-2">2.3.1. 
+    <li><a href="#ref-for-violation-global-object-1">2.4. Violations</a>
+    <li><a href="#ref-for-violation-global-object-2">2.4.1. 
     Create a violation object for global, policy, and directive </a> <a href="#ref-for-violation-global-object-3">(2)</a>
     <li><a href="#ref-for-violation-global-object-4">5.3. 
     Report a violation </a> <a href="#ref-for-violation-global-object-5">(2)</a> <a href="#ref-for-violation-global-object-6">(3)</a> <a href="#ref-for-violation-global-object-7">(4)</a> <a href="#ref-for-violation-global-object-8">(5)</a> <a href="#ref-for-violation-global-object-9">(6)</a>
@@ -6562,7 +6568,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-status">
    <b><a href="#violation-status">#violation-status</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-status-1">2.3.1. 
+    <li><a href="#ref-for-violation-status-1">2.4.1. 
     Create a violation object for global, policy, and directive </a>
     <li><a href="#ref-for-violation-status-2">5.2. 
     Obtain the deprecated serialization of violation </a>
@@ -6573,9 +6579,9 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-resource">
    <b><a href="#violation-resource">#violation-resource</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-resource-1">2.3.1. 
+    <li><a href="#ref-for-violation-resource-1">2.4.1. 
     Create a violation object for global, policy, and directive </a>
-    <li><a href="#ref-for-violation-resource-2">2.3.2. 
+    <li><a href="#ref-for-violation-resource-2">2.4.2. 
     Create a violation object for request, policy, and directive </a>
     <li><a href="#ref-for-violation-resource-3">4.2.3. 
     Should element’s inline type behavior be blocked by Content Security Policy? </a>
@@ -6596,7 +6602,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-referrer">
    <b><a href="#violation-referrer">#violation-referrer</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-referrer-1">2.3.1. 
+    <li><a href="#ref-for-violation-referrer-1">2.4.1. 
     Create a violation object for global, policy, and directive </a>
     <li><a href="#ref-for-violation-referrer-2">5.2. 
     Obtain the deprecated serialization of violation </a>
@@ -6607,7 +6613,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-policy">
    <b><a href="#violation-policy">#violation-policy</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-policy-1">2.3.1. 
+    <li><a href="#ref-for-violation-policy-1">2.4.1. 
     Create a violation object for global, policy, and directive </a>
     <li><a href="#ref-for-violation-policy-2">5.2. 
     Obtain the deprecated serialization of violation </a> <a href="#ref-for-violation-policy-3">(2)</a>
@@ -6625,7 +6631,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-effective-directive">
    <b><a href="#violation-effective-directive">#violation-effective-directive</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-effective-directive-1">2.3.1. 
+    <li><a href="#ref-for-violation-effective-directive-1">2.4.1. 
     Create a violation object for global, policy, and directive </a>
     <li><a href="#ref-for-violation-effective-directive-2">5.2. 
     Obtain the deprecated serialization of violation </a> <a href="#ref-for-violation-effective-directive-3">(2)</a>
@@ -6636,7 +6642,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-source-file">
    <b><a href="#violation-source-file">#violation-source-file</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-source-file-1">2.3.1. 
+    <li><a href="#ref-for-violation-source-file-1">2.4.1. 
     Create a violation object for global, policy, and directive </a>
     <li><a href="#ref-for-violation-source-file-2">5.2. 
     Obtain the deprecated serialization of violation </a> <a href="#ref-for-violation-source-file-3">(2)</a>
@@ -6647,7 +6653,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-line-number">
    <b><a href="#violation-line-number">#violation-line-number</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-line-number-1">2.3.1. 
+    <li><a href="#ref-for-violation-line-number-1">2.4.1. 
     Create a violation object for global, policy, and directive </a>
     <li><a href="#ref-for-violation-line-number-2">5.2. 
     Obtain the deprecated serialization of violation </a>
@@ -6658,7 +6664,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="violation-column-number">
    <b><a href="#violation-column-number">#violation-column-number</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-violation-column-number-1">2.3.1. 
+    <li><a href="#ref-for-violation-column-number-1">2.4.1. 
     Create a violation object for global, policy, and directive </a>
     <li><a href="#ref-for-violation-column-number-2">5.2. 
     Obtain the deprecated serialization of violation </a>
@@ -6679,7 +6685,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#violation-sample">#violation-sample</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-violation-sample-1">1.3. Changes from Level 2</a>
-    <li><a href="#ref-for-violation-sample-2">2.3. Violations</a>
+    <li><a href="#ref-for-violation-sample-2">2.4. Violations</a>
     <li><a href="#ref-for-violation-sample-3">4.2.3. 
     Should element’s inline type behavior be blocked by Content Security Policy? </a>
     <li><a href="#ref-for-violation-sample-4">5.2. 
diff --git a/index.src.html b/index.src.html
index 6034e8e..6c949eb 100644
--- a/index.src.html
+++ b/index.src.html
@@ -364,6 +364,15 @@ <h3 id="changes-from-level-2">Changes from Level 2</h3>
 <section>
   <h2 id="framework">Framework</h2>
 
+  <h3 id="framework-infrastructure">Infrastructure</h3>
+
+  This document uses ABNF grammar to specify syntax, as defined in [[!RFC5234]]. It also relies on
+  the `#rule` ABNF extension defined in
+  <a href="https://tools.ietf.org/html/rfc7230#section-7">Section 7</a> of [[!RFC7230]].
+
+  This document depends on the Infra Standard for a number of foundational concepts used in its
+  algorithms and prose [[!INFRA]].
+
   <h3 id="framework-policy">Policies</h3>
 
   A <dfn export lt="content security policy object" local-lt="policy">policy</dfn> defines allowed