diff --git a/crates/html/src/lib.rs b/crates/html/src/lib.rs
index a425f3d..69bda58 100644
--- a/crates/html/src/lib.rs
+++ b/crates/html/src/lib.rs
@@ -4,6 +4,7 @@
 //! and a simplified tree builder for constructing DOM trees from tokens.
 
 mod entities;
+pub mod speculative;
 mod tokenizer;
 mod tree_builder;
 
diff --git a/crates/html/src/speculative.rs b/crates/html/src/speculative.rs
new file mode 100644
index 0000000..d6c57aa
--- /dev/null
+++ b/crates/html/src/speculative.rs
@@ -0,0 +1,1016 @@
+//! Speculative HTML parsing: off-main-thread preload scanning.
+//!
+//! When the main parser blocks on script execution, a speculative tokenizer
+//! runs on a background thread to discover preloadable resources (`<link>`,
+//! `<script src>`, `<img>`, `<link rel="preload">`). Discovered URLs are
+//! sent back so the resource loader can start fetching them early.
+//!
+//! The speculative tokenizer also buffers the tokens it produces. If
+//! `document.write` does not inject content, the main parser can reuse
+//! those tokens instead of re-tokenizing. If `document.write` *does*
+//! inject content, speculative results from that point forward are
+//! discarded and the main parser re-tokenizes.
+
+use crate::Token;
+use std::sync::mpsc;
+use std::thread;
+
+/// The kind of resource discovered by speculative scanning.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ResourceType {
+    /// `<link rel="stylesheet" href="...">`
+    Stylesheet,
+    /// `<script src="...">`
+    Script,
+    /// `<img src="...">`
+    Image,
+    /// `<link rel="preload" href="..." as="...">`
+    Preload,
+}
+
+/// A preloadable resource URL discovered by the speculative scanner.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PreloadUrl {
+    /// The URL to preload.
+    pub url: String,
+    /// The type of resource.
+    pub resource_type: ResourceType,
+    /// For preload hints, the `as` attribute value (e.g. "script", "style").
+    pub as_attr: Option<String>,
+}
+
+/// State machine for the simplified preload scanner.
+///
+/// This is much simpler than the full HTML5 tokenizer: it only needs to
+/// recognise opening tags and extract `src`, `href`, `rel`, and `as`
+/// attributes from resource-bearing elements.
+#[derive(Debug, Clone, Copy, PartialEq)]
+enum ScanState {
+    /// Scanning text content, looking for `<`.
+    Data,
+    /// Just saw `<`, deciding what kind of tag.
+    TagOpen,
+    /// Inside `</...>` end tag — skip until `>`.
+    EndTag,
+    /// Accumulating a tag name.
+    TagName,
+    /// Between attributes, waiting for name or `>`.
+    BeforeAttr,
+    /// Accumulating an attribute name.
+    AttrName,
+    /// After attribute name, before `=` or next attribute.
+    AfterAttrName,
+    /// After `=`, before attribute value.
+    BeforeAttrValue,
+    /// Inside a double-quoted attribute value.
+    AttrValueDQ,
+    /// Inside a single-quoted attribute value.
+    AttrValueSQ,
+    /// Inside an unquoted attribute value.
+    AttrValueUQ,
+    /// After a quoted attribute value (before whitespace/`>`).
+    AfterAttrValue,
+    /// Inside `<!--` comment, waiting for `-->`.
+    Comment,
+    /// Saw `-` inside comment.
+    CommentDash,
+    /// Saw `--` inside comment.
+    CommentDashDash,
+    /// Inside `<script>` raw text — skip until `</script>`.
+    ScriptData,
+    /// Saw `<` inside script data.
+    ScriptDataLt,
+    /// Accumulating potential `/script>` end tag inside script data.
+    ScriptDataEndTag,
+}
+
+/// Lightweight preload scanner that extracts resource URLs from HTML.
+///
+/// This is intentionally simplified: it does not handle all the edge cases
+/// of the full HTML5 tokenizer. It is conservative — it may miss some
+/// resources, but it will not produce false positives that cause incorrect
+/// behaviour.
+pub struct PreloadScanner {
+    input: Vec<char>,
+    pos: usize,
+    state: ScanState,
+    /// The tag name being accumulated.
+    tag_name: String,
+    /// Current attribute name being accumulated.
+    attr_name: String,
+    /// Current attribute value being accumulated.
+    attr_value: String,
+    /// Collected attributes for the current tag.
+    attrs: Vec<(String, String)>,
+    /// Buffer for script end tag detection.
+    end_tag_buf: String,
+    /// Discovered preload URLs.
+    preloads: Vec<PreloadUrl>,
+}
+
+impl PreloadScanner {
+    /// Create a new preload scanner for the given input.
+    pub fn new(input: &str) -> Self {
+        PreloadScanner {
+            input: input.chars().collect(),
+            pos: 0,
+            state: ScanState::Data,
+            tag_name: String::new(),
+            attr_name: String::new(),
+            attr_value: String::new(),
+            attrs: Vec::new(),
+            end_tag_buf: String::new(),
+            preloads: Vec::new(),
+        }
+    }
+
+    /// Run the scanner to completion, returning discovered preload URLs.
+    pub fn scan(&mut self) -> Vec<PreloadUrl> {
+        while self.pos < self.input.len() {
+            self.step();
+        }
+        std::mem::take(&mut self.preloads)
+    }
+
+    /// Also produce a buffered token stream using the full tokenizer.
+    ///
+    /// This runs the full HTML5 tokenizer on the same input in addition to
+    /// the preload scan, buffering all tokens for potential reuse.
+    pub fn scan_with_tokens(&mut self) -> (Vec<PreloadUrl>, Vec<Token>) {
+        // Run the preload scan.
+        let preloads = self.scan();
+
+        // Run the full tokenizer to buffer tokens.
+        let input_str: String = self.input.iter().collect();
+        let mut tokenizer = crate::Tokenizer::new(&input_str);
+        let mut tokens = Vec::new();
+        loop {
+            let token = tokenizer.next_token();
+            if token == Token::Eof {
+                break;
+            }
+            tokens.push(token);
+        }
+
+        (preloads, tokens)
+    }
+
+    /// Advance the scanner by one character.
+    fn step(&mut self) {
+        let ch = self.input[self.pos];
+        match self.state {
+            ScanState::Data => self.scan_data(ch),
+            ScanState::TagOpen => self.scan_tag_open(ch),
+            ScanState::EndTag => self.scan_end_tag(ch),
+            ScanState::TagName => self.scan_tag_name(ch),
+            ScanState::BeforeAttr => self.scan_before_attr(ch),
+            ScanState::AttrName => self.scan_attr_name(ch),
+            ScanState::AfterAttrName => self.scan_after_attr_name(ch),
+            ScanState::BeforeAttrValue => self.scan_before_attr_value(ch),
+            ScanState::AttrValueDQ => self.scan_attr_value_dq(ch),
+            ScanState::AttrValueSQ => self.scan_attr_value_sq(ch),
+            ScanState::AttrValueUQ => self.scan_attr_value_uq(ch),
+            ScanState::AfterAttrValue => self.scan_after_attr_value(ch),
+            ScanState::Comment => self.scan_comment(ch),
+            ScanState::CommentDash => self.scan_comment_dash(ch),
+            ScanState::CommentDashDash => self.scan_comment_dash_dash(ch),
+            ScanState::ScriptData => self.scan_script_data(ch),
+            ScanState::ScriptDataLt => self.scan_script_data_lt(ch),
+            ScanState::ScriptDataEndTag => self.scan_script_data_end_tag(ch),
+        }
+    }
+
+    fn scan_data(&mut self, ch: char) {
+        if ch == '<' {
+            self.state = ScanState::TagOpen;
+        }
+        self.pos += 1;
+    }
+
+    fn scan_tag_open(&mut self, ch: char) {
+        if ch == '/' {
+            self.state = ScanState::EndTag;
+            self.end_tag_buf.clear();
+            self.pos += 1;
+        } else if ch == '!' {
+            // Could be comment: `<!--`
+            if self.pos + 2 < self.input.len()
+                && self.input[self.pos + 1] == '-'
+                && self.input[self.pos + 2] == '-'
+            {
+                self.state = ScanState::Comment;
+                self.pos += 3;
+            } else {
+                // DOCTYPE or other — skip back to data.
+                self.state = ScanState::Data;
+                self.pos += 1;
+            }
+        } else if ch.is_ascii_alphabetic() {
+            self.tag_name.clear();
+            self.attrs.clear();
+            self.tag_name.push(ch.to_ascii_lowercase());
+            self.state = ScanState::TagName;
+            self.pos += 1;
+        } else {
+            self.state = ScanState::Data;
+            self.pos += 1;
+        }
+    }
+
+    fn scan_end_tag(&mut self, ch: char) {
+        if ch == '>' {
+            self.state = ScanState::Data;
+        }
+        self.pos += 1;
+    }
+
+    fn scan_tag_name(&mut self, ch: char) {
+        if ch.is_ascii_whitespace() {
+            self.state = ScanState::BeforeAttr;
+            self.pos += 1;
+        } else if ch == '/' || ch == '>' {
+            if ch == '>' {
+                self.state = ScanState::Data;
+            } else {
+                // Self-closing `/>`; wait for `>`.
+                self.state = ScanState::BeforeAttr;
+            }
+            // emit_tag may override state (e.g. to ScriptData for <script>).
+            self.emit_tag();
+            self.pos += 1;
+        } else {
+            self.tag_name.push(ch.to_ascii_lowercase());
+            self.pos += 1;
+        }
+    }
+
+    fn scan_before_attr(&mut self, ch: char) {
+        if ch == '>' {
+            self.state = ScanState::Data;
+            self.emit_tag();
+            self.pos += 1;
+        } else if ch == '/' {
+            // Self-closing; stay in BeforeAttr.
+            self.pos += 1;
+        } else if !ch.is_ascii_whitespace() {
+            self.attr_name.clear();
+            self.attr_value.clear();
+            self.attr_name.push(ch.to_ascii_lowercase());
+            self.state = ScanState::AttrName;
+            self.pos += 1;
+        } else {
+            self.pos += 1;
+        }
+    }
+
+    fn scan_attr_name(&mut self, ch: char) {
+        if ch == '=' {
+            self.state = ScanState::BeforeAttrValue;
+            self.pos += 1;
+        } else if ch.is_ascii_whitespace() {
+            self.state = ScanState::AfterAttrName;
+            self.pos += 1;
+        } else if ch == '>' || ch == '/' {
+            // Attribute with no value.
+            self.attrs
+                .push((std::mem::take(&mut self.attr_name), String::new()));
+            if ch == '>' {
+                self.state = ScanState::Data;
+                self.emit_tag();
+            } else {
+                self.state = ScanState::BeforeAttr;
+            }
+            self.pos += 1;
+        } else {
+            self.attr_name.push(ch.to_ascii_lowercase());
+            self.pos += 1;
+        }
+    }
+
+    fn scan_after_attr_name(&mut self, ch: char) {
+        if ch == '=' {
+            self.state = ScanState::BeforeAttrValue;
+            self.pos += 1;
+        } else if ch == '>' {
+            self.attrs
+                .push((std::mem::take(&mut self.attr_name), String::new()));
+            self.state = ScanState::Data;
+            self.emit_tag();
+            self.pos += 1;
+        } else if ch == '/' {
+            self.attrs
+                .push((std::mem::take(&mut self.attr_name), String::new()));
+            self.state = ScanState::BeforeAttr;
+            self.pos += 1;
+        } else if !ch.is_ascii_whitespace() {
+            // New attribute started without value for the previous one.
+            self.attrs
+                .push((std::mem::take(&mut self.attr_name), String::new()));
+            self.attr_name.clear();
+            self.attr_value.clear();
+            self.attr_name.push(ch.to_ascii_lowercase());
+            self.state = ScanState::AttrName;
+            self.pos += 1;
+        } else {
+            self.pos += 1;
+        }
+    }
+
+    fn scan_before_attr_value(&mut self, ch: char) {
+        if ch == '"' {
+            self.state = ScanState::AttrValueDQ;
+            self.pos += 1;
+        } else if ch == '\'' {
+            self.state = ScanState::AttrValueSQ;
+            self.pos += 1;
+        } else if ch == '>' {
+            self.attrs.push((
+                std::mem::take(&mut self.attr_name),
+                std::mem::take(&mut self.attr_value),
+            ));
+            self.state = ScanState::Data;
+            self.emit_tag();
+            self.pos += 1;
+        } else if !ch.is_ascii_whitespace() {
+            self.attr_value.push(ch);
+            self.state = ScanState::AttrValueUQ;
+            self.pos += 1;
+        } else {
+            self.pos += 1;
+        }
+    }
+
+    fn scan_attr_value_dq(&mut self, ch: char) {
+        if ch == '"' {
+            self.attrs.push((
+                std::mem::take(&mut self.attr_name),
+                std::mem::take(&mut self.attr_value),
+            ));
+            self.state = ScanState::AfterAttrValue;
+            self.pos += 1;
+        } else {
+            self.attr_value.push(ch);
+            self.pos += 1;
+        }
+    }
+
+    fn scan_attr_value_sq(&mut self, ch: char) {
+        if ch == '\'' {
+            self.attrs.push((
+                std::mem::take(&mut self.attr_name),
+                std::mem::take(&mut self.attr_value),
+            ));
+            self.state = ScanState::AfterAttrValue;
+            self.pos += 1;
+        } else {
+            self.attr_value.push(ch);
+            self.pos += 1;
+        }
+    }
+
+    fn scan_attr_value_uq(&mut self, ch: char) {
+        if ch.is_ascii_whitespace() {
+            self.attrs.push((
+                std::mem::take(&mut self.attr_name),
+                std::mem::take(&mut self.attr_value),
+            ));
+            self.state = ScanState::BeforeAttr;
+            self.pos += 1;
+        } else if ch == '>' {
+            self.attrs.push((
+                std::mem::take(&mut self.attr_name),
+                std::mem::take(&mut self.attr_value),
+            ));
+            self.state = ScanState::Data;
+            self.emit_tag();
+            self.pos += 1;
+        } else {
+            self.attr_value.push(ch);
+            self.pos += 1;
+        }
+    }
+
+    fn scan_after_attr_value(&mut self, ch: char) {
+        if ch.is_ascii_whitespace() {
+            self.state = ScanState::BeforeAttr;
+            self.pos += 1;
+        } else if ch == '>' {
+            self.state = ScanState::Data;
+            self.emit_tag();
+            self.pos += 1;
+        } else if ch == '/' {
+            self.state = ScanState::BeforeAttr;
+            self.pos += 1;
+        } else {
+            // Error recovery: treat as new attribute.
+            self.attr_name.clear();
+            self.attr_value.clear();
+            self.attr_name.push(ch.to_ascii_lowercase());
+            self.state = ScanState::AttrName;
+            self.pos += 1;
+        }
+    }
+
+    fn scan_comment(&mut self, ch: char) {
+        if ch == '-' {
+            self.state = ScanState::CommentDash;
+        }
+        self.pos += 1;
+    }
+
+    fn scan_comment_dash(&mut self, ch: char) {
+        if ch == '-' {
+            self.state = ScanState::CommentDashDash;
+        } else {
+            self.state = ScanState::Comment;
+        }
+        self.pos += 1;
+    }
+
+    fn scan_comment_dash_dash(&mut self, ch: char) {
+        if ch == '>' {
+            self.state = ScanState::Data;
+        } else if ch != '-' {
+            self.state = ScanState::Comment;
+        }
+        self.pos += 1;
+    }
+
+    fn scan_script_data(&mut self, ch: char) {
+        if ch == '<' {
+            self.state = ScanState::ScriptDataLt;
+        }
+        self.pos += 1;
+    }
+
+    fn scan_script_data_lt(&mut self, ch: char) {
+        if ch == '/' {
+            self.end_tag_buf.clear();
+            self.state = ScanState::ScriptDataEndTag;
+            self.pos += 1;
+        } else {
+            self.state = ScanState::ScriptData;
+            self.pos += 1;
+        }
+    }
+
+    fn scan_script_data_end_tag(&mut self, ch: char) {
+        if ch.is_ascii_alphabetic() {
+            self.end_tag_buf.push(ch.to_ascii_lowercase());
+            self.pos += 1;
+        } else if ch == '>' && self.end_tag_buf == "script" {
+            self.state = ScanState::Data;
+            self.pos += 1;
+        } else {
+            // Not `</script>` — go back to script data.
+            self.state = ScanState::ScriptData;
+            self.pos += 1;
+        }
+    }
+
+    /// Called when a complete start tag has been scanned.
+    /// Checks whether it's a resource-bearing tag and records any preload URLs.
+    fn emit_tag(&mut self) {
+        match self.tag_name.as_str() {
+            "script" => {
+                let src = self.get_attr("src");
+                if let Some(url) = src {
+                    // External script: record preload and enter script data state
+                    // to skip the (presumably empty) content.
+                    self.preloads.push(PreloadUrl {
+                        url,
+                        resource_type: ResourceType::Script,
+                        as_attr: None,
+                    });
+                    self.state = ScanState::ScriptData;
+                } else {
+                    // Inline script: per the issue spec, we stop speculating here
+                    // because the inline script could call `document.write`.
+                    // We enter ScriptData state and continue scanning after it ends
+                    // (conservative approach: we still find resources after the
+                    // inline script's closing tag).
+                    self.state = ScanState::ScriptData;
+                }
+            }
+            "link" => {
+                let rel = self.get_attr("rel").unwrap_or_default();
+                let href = self.get_attr("href");
+                if let Some(url) = href {
+                    let rel_lower = rel.to_ascii_lowercase();
+                    if rel_lower == "stylesheet" {
+                        self.preloads.push(PreloadUrl {
+                            url,
+                            resource_type: ResourceType::Stylesheet,
+                            as_attr: None,
+                        });
+                    } else if rel_lower == "preload" {
+                        let as_val = self.get_attr("as");
+                        self.preloads.push(PreloadUrl {
+                            url,
+                            resource_type: ResourceType::Preload,
+                            as_attr: as_val,
+                        });
+                    }
+                }
+            }
+            "img" => {
+                if let Some(url) = self.get_attr("src") {
+                    self.preloads.push(PreloadUrl {
+                        url,
+                        resource_type: ResourceType::Image,
+                        as_attr: None,
+                    });
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// Get an attribute value by name from the current tag's collected attributes.
+    fn get_attr(&self, name: &str) -> Option<String> {
+        self.attrs
+            .iter()
+            .find(|(k, _)| k == name)
+            .map(|(_, v)| v.clone())
+    }
+}
+
+/// Message sent from the main thread to the speculative parser thread.
+#[derive(Debug)]
+pub enum SpeculativeRequest {
+    /// Scan this HTML chunk starting at the given byte offset.
+    Scan {
+        /// The HTML content to scan (from offset to end of known input).
+        html: String,
+        /// The byte offset in the original document.
+        offset: usize,
+    },
+    /// Shut down the speculative parser thread.
+    Shutdown,
+}
+
+/// Message sent from the speculative parser thread back to the main thread.
+#[derive(Debug)]
+pub enum SpeculativeResponse {
+    /// Discovered preload URLs and buffered tokens.
+    Results {
+        /// Discovered preloadable resource URLs.
+        preloads: Vec<PreloadUrl>,
+        /// Speculatively tokenized tokens for potential reuse.
+        tokens: Vec<Token>,
+        /// The byte offset where scanning started.
+        offset: usize,
+    },
+}
+
+/// Manages speculative parsing on a background thread.
+///
+/// The main parser creates a `SpeculativeParser`, which spawns a background
+/// thread. When the main parser blocks on script execution, it sends the
+/// remaining HTML to the background thread for preload scanning.
+pub struct SpeculativeParser {
+    /// Channel to send requests to the background thread.
+    request_tx: mpsc::Sender<SpeculativeRequest>,
+    /// Channel to receive responses from the background thread.
+    response_rx: mpsc::Receiver<SpeculativeResponse>,
+    /// Join handle for the background thread.
+    handle: Option<thread::JoinHandle<()>>,
+    /// Whether speculation results have been invalidated (e.g. by document.write).
+    invalidated: bool,
+    /// The offset at which the last speculation started.
+    speculation_offset: Option<usize>,
+    /// Buffered tokens from the last successful speculation.
+    buffered_tokens: Vec<Token>,
+    /// Index into buffered_tokens for replay.
+    replay_index: usize,
+}
+
+impl Default for SpeculativeParser {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl SpeculativeParser {
+    /// Create and start a new speculative parser with its background thread.
+    pub fn new() -> Self {
+        let (req_tx, req_rx) = mpsc::channel::<SpeculativeRequest>();
+        let (resp_tx, resp_rx) = mpsc::channel::<SpeculativeResponse>();
+
+        let handle = thread::spawn(move || {
+            Self::background_loop(req_rx, resp_tx);
+        });
+
+        SpeculativeParser {
+            request_tx: req_tx,
+            response_rx: resp_rx,
+            handle: Some(handle),
+            invalidated: false,
+            speculation_offset: None,
+            buffered_tokens: Vec::new(),
+            replay_index: 0,
+        }
+    }
+
+    /// The background thread's main loop.
+    fn background_loop(
+        rx: mpsc::Receiver<SpeculativeRequest>,
+        tx: mpsc::Sender<SpeculativeResponse>,
+    ) {
+        while let Ok(request) = rx.recv() {
+            match request {
+                SpeculativeRequest::Scan { html, offset } => {
+                    let mut scanner = PreloadScanner::new(&html);
+                    let (preloads, tokens) = scanner.scan_with_tokens();
+                    let _ = tx.send(SpeculativeResponse::Results {
+                        preloads,
+                        tokens,
+                        offset,
+                    });
+                }
+                SpeculativeRequest::Shutdown => break,
+            }
+        }
+    }
+
+    /// Start speculative scanning of HTML content.
+    ///
+    /// Called when the main parser blocks on script execution.
+    /// `html` is the remaining un-parsed HTML, `offset` is its position
+    /// in the original document.
+    pub fn speculate(&mut self, html: &str, offset: usize) {
+        self.invalidated = false;
+        self.speculation_offset = Some(offset);
+        self.buffered_tokens.clear();
+        self.replay_index = 0;
+        let _ = self.request_tx.send(SpeculativeRequest::Scan {
+            html: html.to_string(),
+            offset,
+        });
+    }
+
+    /// Collect speculation results (blocking until the background thread responds).
+    ///
+    /// Returns the discovered preload URLs if speculation was not invalidated.
+    pub fn collect_results(&mut self) -> Option<Vec<PreloadUrl>> {
+        match self.response_rx.recv() {
+            Ok(SpeculativeResponse::Results {
+                preloads,
+                tokens,
+                offset,
+            }) => {
+                if self.invalidated {
+                    // Results are stale — discard.
+                    return None;
+                }
+                if self.speculation_offset == Some(offset) {
+                    self.buffered_tokens = tokens;
+                    self.replay_index = 0;
+                    Some(preloads)
+                } else {
+                    None
+                }
+            }
+            Err(_) => None,
+        }
+    }
+
+    /// Try to collect results without blocking.
+    ///
+    /// Returns `Some(preloads)` if results are ready and valid,
+    /// `None` if not ready or invalidated.
+    pub fn try_collect_results(&mut self) -> Option<Vec<PreloadUrl>> {
+        match self.response_rx.try_recv() {
+            Ok(SpeculativeResponse::Results {
+                preloads,
+                tokens,
+                offset,
+            }) => {
+                if self.invalidated {
+                    return None;
+                }
+                if self.speculation_offset == Some(offset) {
+                    self.buffered_tokens = tokens;
+                    self.replay_index = 0;
+                    Some(preloads)
+                } else {
+                    None
+                }
+            }
+            Err(_) => None,
+        }
+    }
+
+    /// Invalidate speculation results due to `document.write`.
+    ///
+    /// All buffered tokens are discarded, and the main parser must
+    /// re-tokenize from the current position.
+    pub fn invalidate(&mut self) {
+        self.invalidated = true;
+        self.buffered_tokens.clear();
+        self.replay_index = 0;
+        self.speculation_offset = None;
+    }
+
+    /// Returns true if there are buffered tokens available for replay.
+    pub fn has_buffered_tokens(&self) -> bool {
+        !self.invalidated && self.replay_index < self.buffered_tokens.len()
+    }
+
+    /// Get the next buffered token if available.
+    ///
+    /// Returns `Some(token)` if speculation succeeded and there are tokens
+    /// to replay. Returns `None` if no buffered tokens are available or
+    /// speculation was invalidated.
+    pub fn next_buffered_token(&mut self) -> Option<Token> {
+        if self.invalidated || self.replay_index >= self.buffered_tokens.len() {
+            return None;
+        }
+        let token = self.buffered_tokens[self.replay_index].clone();
+        self.replay_index += 1;
+        Some(token)
+    }
+
+    /// Returns whether speculation was invalidated.
+    pub fn is_invalidated(&self) -> bool {
+        self.invalidated
+    }
+
+    /// Shut down the background thread.
+    pub fn shutdown(&mut self) {
+        let _ = self.request_tx.send(SpeculativeRequest::Shutdown);
+        if let Some(handle) = self.handle.take() {
+            let _ = handle.join();
+        }
+    }
+}
+
+impl Drop for SpeculativeParser {
+    fn drop(&mut self) {
+        self.shutdown();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn scan_finds_stylesheet() {
+        let html = r#"<html><head><link rel="stylesheet" href="/style.css"></head></html>"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/style.css");
+        assert_eq!(preloads[0].resource_type, ResourceType::Stylesheet);
+    }
+
+    #[test]
+    fn scan_finds_script_src() {
+        let html = r#"<script src="/app.js"></script><p>text</p>"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/app.js");
+        assert_eq!(preloads[0].resource_type, ResourceType::Script);
+    }
+
+    #[test]
+    fn scan_finds_image() {
+        let html = r#"<body><img src="/logo.png"><p>Hello</p></body>"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/logo.png");
+        assert_eq!(preloads[0].resource_type, ResourceType::Image);
+    }
+
+    #[test]
+    fn scan_finds_preload_hint() {
+        let html = r#"<link rel="preload" href="/font.woff2" as="font">"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/font.woff2");
+        assert_eq!(preloads[0].resource_type, ResourceType::Preload);
+        assert_eq!(preloads[0].as_attr.as_deref(), Some("font"));
+    }
+
+    #[test]
+    fn scan_finds_multiple_resources() {
+        let html = r#"
+            <head>
+                <link rel="stylesheet" href="/a.css">
+                <link rel="stylesheet" href="/b.css">
+                <script src="/app.js"></script>
+            </head>
+            <body>
+                <img src="/hero.jpg">
+                <img src="/logo.png">
+            </body>
+        "#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 5);
+        assert_eq!(preloads[0].resource_type, ResourceType::Stylesheet);
+        assert_eq!(preloads[1].resource_type, ResourceType::Stylesheet);
+        assert_eq!(preloads[2].resource_type, ResourceType::Script);
+        assert_eq!(preloads[3].resource_type, ResourceType::Image);
+        assert_eq!(preloads[4].resource_type, ResourceType::Image);
+    }
+
+    #[test]
+    fn scan_skips_inline_script_content() {
+        let html = r#"<script>var x = "<img src='fake.png'>";</script><img src="/real.png">"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        // Should only find the real image, not the one inside the script string.
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/real.png");
+    }
+
+    #[test]
+    fn scan_skips_comments() {
+        let html = r#"<!-- <img src="/hidden.png"> --><img src="/visible.png">"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/visible.png");
+    }
+
+    #[test]
+    fn scan_ignores_link_without_stylesheet_rel() {
+        let html = r#"<link rel="icon" href="/favicon.ico">"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 0);
+    }
+
+    #[test]
+    fn scan_handles_single_quoted_attrs() {
+        let html = "<img src='/photo.jpg'>";
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/photo.jpg");
+    }
+
+    #[test]
+    fn scan_handles_unquoted_attrs() {
+        let html = "<img src=/photo.jpg>";
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/photo.jpg");
+    }
+
+    #[test]
+    fn scan_handles_self_closing_tags() {
+        let html = r#"<img src="/photo.jpg" />"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 1);
+        assert_eq!(preloads[0].url, "/photo.jpg");
+    }
+
+    #[test]
+    fn scan_case_insensitive_tag_names() {
+        let html = r#"<IMG SRC="/photo.jpg"><LINK REL="stylesheet" HREF="/style.css">"#;
+        let mut scanner = PreloadScanner::new(html);
+        let preloads = scanner.scan();
+        assert_eq!(preloads.len(), 2);
+    }
+
+    #[test]
+    fn scan_with_tokens_produces_valid_tokens() {
+        let html = r#"<p>Hello</p>"#;
+        let mut scanner = PreloadScanner::new(html);
+        let (preloads, tokens) = scanner.scan_with_tokens();
+        assert_eq!(preloads.len(), 0);
+        // Should have StartTag(p), Character(Hello), EndTag(p)
+        assert!(tokens.len() >= 3);
+    }
+
+    #[test]
+    fn speculative_parser_basic_flow() {
+        let mut spec = SpeculativeParser::new();
+
+        let html = r#"<link rel="stylesheet" href="/main.css"><img src="/hero.jpg">"#;
+        spec.speculate(html, 100);
+
+        let results = spec.collect_results();
+        assert!(results.is_some());
+        let preloads = results.unwrap();
+        assert_eq!(preloads.len(), 2);
+        assert_eq!(preloads[0].url, "/main.css");
+        assert_eq!(preloads[1].url, "/hero.jpg");
+
+        // Should have buffered tokens.
+        assert!(spec.has_buffered_tokens());
+
+        spec.shutdown();
+    }
+
+    #[test]
+    fn speculative_parser_invalidation() {
+        let mut spec = SpeculativeParser::new();
+
+        let html = r#"<img src="/photo.jpg">"#;
+        spec.speculate(html, 0);
+
+        // Simulate document.write invalidating speculation.
+        spec.invalidate();
+        assert!(spec.is_invalidated());
+        assert!(!spec.has_buffered_tokens());
+
+        // Results should be discarded.
+        let results = spec.collect_results();
+        assert!(results.is_none());
+
+        spec.shutdown();
+    }
+
+    #[test]
+    fn speculative_parser_token_replay() {
+        let mut spec = SpeculativeParser::new();
+
+        let html = r#"<p>Hello</p>"#;
+        spec.speculate(html, 0);
+        let _ = spec.collect_results();
+
+        // Replay buffered tokens.
+        let mut replayed = Vec::new();
+        while let Some(token) = spec.next_buffered_token() {
+            replayed.push(token);
+        }
+        assert!(!replayed.is_empty());
+
+        spec.shutdown();
+    }
+
+    #[test]
+    fn speculative_parser_no_tokens_after_invalidation() {
+        let mut spec = SpeculativeParser::new();
+
+        let html = r#"<p>Hello</p>"#;
+        spec.speculate(html, 0);
+        let _ = spec.collect_results();
+
+        spec.invalidate();
+        assert!(spec.next_buffered_token().is_none());
+
+        spec.shutdown();
+    }
+
+    #[test]
+    fn speculation_hit_no_document_write() {
+        // Simulates: main parser encounters <script>, blocks, speculative parser
+        // scans ahead and finds resources. No document.write happens, so
+        // speculation is valid.
+        let remaining_html = r#"
+            <link rel="stylesheet" href="/after-script.css">
+            <img src="/image.png">
+            <p>Content after script</p>
+        "#;
+
+        let mut spec = SpeculativeParser::new();
+        spec.speculate(remaining_html, 500);
+
+        let preloads = spec.collect_results().unwrap();
+        assert_eq!(preloads.len(), 2);
+        assert_eq!(preloads[0].url, "/after-script.css");
+        assert_eq!(preloads[0].resource_type, ResourceType::Stylesheet);
+        assert_eq!(preloads[1].url, "/image.png");
+        assert_eq!(preloads[1].resource_type, ResourceType::Image);
+
+        // Buffered tokens should be usable.
+        assert!(spec.has_buffered_tokens());
+        assert!(!spec.is_invalidated());
+
+        spec.shutdown();
+    }
+
+    #[test]
+    fn speculation_miss_document_write_invalidates() {
+        // Simulates: main parser encounters <script>, blocks, speculative parser
+        // scans ahead. Then document.write injects content, invalidating speculation.
+        let remaining_html = r#"
+            <link rel="stylesheet" href="/after-script.css">
+            <img src="/image.png">
+        "#;
+
+        let mut spec = SpeculativeParser::new();
+        spec.speculate(remaining_html, 500);
+
+        // Before collecting results, simulate document.write.
+        spec.invalidate();
+
+        // Results should be discarded.
+        let preloads = spec.collect_results();
+        assert!(preloads.is_none());
+        assert!(!spec.has_buffered_tokens());
+        assert!(spec.is_invalidated());
+
+        spec.shutdown();
+    }
+}