diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a8c9b0..cc8376c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,15 @@
   instead of repeating its id (#270), and each result carries its confidence as the
   `confidence` property (#271). A flow reaching its sink inside a project function points at
   that sink as a related location, which the result's message links to (#271).
+- Django templates are also read as each page is put together (#273): a variable a
+  child's `{% block %}` prints inside its parent's `<script>`, an `{% include %}` that ends
+  the attribute value it stands in, or one of a name several files have outside HTML data,
+  is reported as `xss` where it was not, as is the variable `block` named anywhere but in
+  a bare `{{ block.super }}`. So is a template that includes Django's
+  `django/forms/widgets/attrs.html` inside a tag, which prints attribute names, and a
+  template including itself inside a tag or a script. A page beyond 8 MiB once put
+  together, or a template with more than 64 pages, or 16 MiB in all, through names
+  several files have, is not established and is listed in `Coverage.unread_templates`.
 - Plugin API, additive: `Plugin.rules` maps the rules a plugin reports to their
   `RuleDescription`, optional, so that third-party plugins describe their own rules;
   `Finding.related` lists `RelatedLocation`s (a span and a message). `Report.rules` carries the
diff --git a/docs/usage.md b/docs/usage.md
index ee1bf1b..ae8281d 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -213,8 +213,25 @@ ends there and the browser would never run it. A template including one that end
 such a block, a tag or an end tag is not established either: the markup after the
 include continues it. A template extending another ends where that one ends. A comment
 hides what it holds only up to its first template tag, since an include there may close
-it and a condition around its `<!--` may leave it out. A `{% block %}` or
-`{% include %}` placed inside a parent's `<script>` is not covered yet (#273).
+it and a condition around its `<!--` may leave it out.
+
+Each page is also put together as Django renders it, and read once more (#273): the
+templates it extends, each block taking the definition of the most derived one and `{{
+block.super }}` the next one up, and each template it includes in place. What a child's
+block prints inside its parent's `<script>`, or what an include puts inside an
+attribute, is read where it lands. `{{ block.super }}` is put in place only bare: the
+variable `block` named anywhere else, through a filter, a tag or an alias (`{% with
+parent=block %}{{ parent.super }}`), may still print the parent's markup, marked safe,
+and the template is not established. A name several files have, which Django resolves
+through loaders the analyzer does not read, counts as each of them: a page extending it
+must escape with each file, except those already in its chain, which Django leaves out,
+so that a template extending its own name extends another file of it; an include of it
+is accepted only in HTML data, never inside an attribute, a tag, a `<script>` or
+`<style>` block or a comment, and only when each file ends in HTML data, nothing of it
+left open. A template including itself is read the same way. A page beyond 8 MiB once
+put together, or a template with more than 64 pages, or 16 MiB in all, through the files
+the templates it extends may be, is not established, and is listed among the templates
+the analyzer could not read.
 
 The analyzer never assumes escaping where it cannot read the template. That covers a
 template file it cannot read, a template named by an expression, a template found
diff --git a/src/coretrace_python/engine.py b/src/coretrace_python/engine.py
index 63830e7..92bf25a 100644
--- a/src/coretrace_python/engine.py
+++ b/src/coretrace_python/engine.py
@@ -135,10 +135,10 @@
     SecurityModelRegistry,
     TaintAnalysis,
     TaintKind,
-    escaped_templates,
     project_templates,
     registered_routes,
     request_processor,
+    template_escaping,
     unread_renders,
 )
 from coretrace_python.taint.urls import flow_url
@@ -532,7 +532,8 @@ def analyze_project(
     for name in sorted(analysable):
         for symbol, registered in _routes_of(analysable[name]).items():
             routes.setdefault(symbol, registered)
-    escaped = escaped_templates(root)
+    escaping = template_escaping(root)
+    escaped = escaping.escaped
     templates = project_templates(root)
     clearing = models.clearing(escaped)
     template_calls = models.template_calls(
@@ -678,7 +679,7 @@ def analyze_project(
     findings = [_sourced(finding, origins) for finding in findings]
     accepted = tuple(f for f in findings if policy.accepts(f))
     kept, suppressed = partition(apply_policy(policy, findings), _text_of(sources))
-    unread = list(templates.unread)
+    unread = [*templates.unread, *escaping.unread]
     for name in sorted(call_graphs):
         unread.extend(unread_renders(name, call_graphs[name], models, templates.names))
     return ProjectAnalysis(
diff --git a/src/coretrace_python/taint/__init__.py b/src/coretrace_python/taint/__init__.py
index 81bb361..c00f379 100644
--- a/src/coretrace_python/taint/__init__.py
+++ b/src/coretrace_python/taint/__init__.py
@@ -42,6 +42,7 @@
     escaped_templates,
     project_templates,
     request_processor,
+    template_escaping,
     unread_renders,
 )
 
@@ -85,5 +86,6 @@
     "propagate_taint",
     "registered_routes",
     "request_processor",
+    "template_escaping",
     "unread_renders",
 ]
diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index 0607fe5..e18312b 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -14,6 +14,9 @@
   leaves open, which once included runs into the markup that follows;
 - no include of a template that ends inside a ``<script>`` or ``<style>`` block, a tag
   or an end tag, which the markup after the include then continues;
+- none of this either once the page is put together as Django renders it, its blocks
+  and includes in place (``_Composition``): what a block or an include puts inside a
+  construct of another file is read there (#273);
 - no Python file of the project turning autoescaping off.
 
 A comment hides what it holds only up to its first template tag: an include there may
@@ -46,11 +49,11 @@
 from __future__ import annotations
 
 import re
-from collections.abc import Container, Iterable, Iterator, Mapping
+from collections.abc import Container, Iterable, Iterator, Mapping, Sequence
 from dataclasses import dataclass, field
 from pathlib import Path
 from types import MappingProxyType
-from typing import ClassVar, NamedTuple
+from typing import ClassVar, NamedTuple, TypeAlias
 
 from coretrace_python.analysis import Analysis, AnalysisContext
 from coretrace_python.frontend import HIRBuildError, ParseError, build_hir
@@ -79,6 +82,9 @@
 TEMPLATETAGS_DIRECTORY = "templatetags"
 
 _OUTPUT, _TAG, _URL = "\x00", "\x01", "/u"
+# Where a page puts the markup of an include it cannot put in place: a name several files
+# have, which Django resolves through loaders the engine does not read.
+_INSERTED = "\x02"
 _SYNTAX = re.compile(r"{{(.*?)}}|{%(.*?)%}|{#.*?#}", re.DOTALL)
 _AUTOESCAPE_OFF = re.compile(r"""["']autoescape["']\s*:\s*False|\bautoescape\s*=\s*False""")
 
@@ -170,6 +176,11 @@
 _COMMENT_END = re.compile(r"--!?>")
 # ``<{{ name }}`` or ``</ {{ name }}``: the variable would name a tag.
 _NAMED_BY_OUTPUT = re.compile(rf"<[/ \t\n]*{_OUTPUT}")
+# What an inserted markup could complete into a tag, an end tag or a comment: ``<``,
+# ``</`` or ``<!`` and ``<!-``; before a marker, or at the end of a text.
+_OPENER = r"<(?:[/ \t\n]*|!-?)"
+_OPENED_BY_INSERTION = re.compile(rf"{_OPENER}{_INSERTED}")
+_ENDING_OPENER = re.compile(rf"{_OPENER}\Z")
 # Django's filter expressions: a constant or a variable, then filters, each with an
 # optional argument, the way ``django.template.base.FilterExpression`` reads them.
 _STRING = r"\"[^\"\\]*(?:\\.[^\"\\]*)*\"|'[^'\\]*(?:\\.[^'\\]*)*'"
@@ -184,6 +195,12 @@
 _LITERALS = frozenset({"True", "False", "None"})
 # The variable a block renders to keep the parent's content, as ``_chain`` reads it.
 _BLOCK_SUPER = "block.super"
+# The variable ``block``, which Django binds inside a block to the block itself: named
+# anywhere else than in a bare ``{{ block.super }}``, it may give the parent's markup,
+# marked safe, through a filter such as ``escape`` or ``default`` or through an alias
+# (``{% with parent=block %}{{ parent.super }}``). A name such as Handlebars'
+# ``@partial-block`` is not it.
+_BLOCK_VARIABLE = re.compile(r"(?<![\w.@-])block(?![\w-])")
 
 REQUEST_PROCESSOR = "django.template.context_processors.request"
 _DJANGO_ENGINE = "django.template.backends.django.DjangoTemplates"
@@ -191,26 +208,56 @@
 
 
 def escaped_templates(root: Path) -> frozenset[str]:
+    """The names of the templates under ``root`` that escape every variable they render
+    (``template_escaping``)."""
+
+    return template_escaping(root).escaped
+
+
+class TemplateEscaping(NamedTuple):
+    """The names of the templates established to escape, and the pages the engine could
+    not put together to establish it, as entries of the templates it could not read."""
+
+    escaped: frozenset[str]
+    unread: tuple[str, ...] = ()
+
+
+def template_escaping(root: Path) -> TemplateEscaping:
     """The names of the templates under ``root`` that escape every variable they render,
     as ``render_to_string`` names them (their path below a ``templates`` directory). A
     template including one that ends inside a script or style block, a tag or an end tag
     is not among them: the markup after its include continues that construct. A
-    template extending another renders it, and ends where it ends."""
+    template extending another renders it, and ends where it ends. Each file is read on
+    its own, then the page it renders is put together and read too (``_Composition``):
+    what a block or an include puts inside a construct of another file is read there."""
 
     found: dict[str, list[Path]] = {}
     for path in discover_files(root):
         if path.suffix == ".py" and _AUTOESCAPE_OFF.search(_read(path)):
-            return frozenset()
+            return TemplateEscaping(frozenset())
         for name in _names(path.relative_to(root).parts):
             found.setdefault(name, []).append(path)
+    parsed = {path: _parse_file(path) for paths in found.values() for path in paths}
+    composition = _Composition(found, parsed)
     local: dict[str, bool] = {}
     requires: dict[str, set[str]] = {}
     extends: dict[str, set[str]] = {}
     includes: dict[str, set[str]] = {}
     open_ended: set[str] = set()
+    # The names a page inserts (``_INSERTED``), and those whose every file renders a page
+    # ending in HTML data, as an inserted markup must.
+    inserting: dict[str, set[str]] = {}
+    settled: set[str] = set()
     for name, paths in found.items():
-        verdicts = [_verdict(path) for path in paths]
-        local[name] = all(verdict.escapes for verdict in verdicts)
+        verdicts = [_verdict(parsed[path]) for path in paths]
+        pages = [composition.page(path) for path in paths]
+        readings = [
+            [_read_markup(markup) for markup in page.markups] if page is not None else [_NOT_READ] for page in pages
+        ]
+        local[name] = all(verdict.escapes for verdict in verdicts) and all(r.escapes for rs in readings for r in rs)
+        inserting[name] = {inserted for page in pages if page is not None for inserted in page.inserted}
+        if all(r.settled for rs in readings for r in rs):
+            settled.add(name)
         requires[name] = {needed for verdict in verdicts for needed in verdict.extends | verdict.includes}
         extends[name] = {extended for verdict in verdicts for extended in verdict.extends}
         includes[name] = {included for verdict in verdicts for included in verdict.includes}
@@ -218,13 +265,19 @@ def escaped_templates(root: Path) -> frozenset[str]:
             open_ended.add(name)
     while grown := {name for name, extended in extends.items() if extended & open_ended} - open_ended:
         open_ended |= grown
-    escaped = {name for name, safe in local.items() if safe and not includes[name] & open_ended}
+    escaped = {
+        name for name, safe in local.items() if safe and not includes[name] & open_ended and inserting[name] <= settled
+    }
     changed = True
     while changed:
         kept = {name for name in escaped if requires[name] <= escaped}
         changed = kept != escaped
         escaped = kept
-    return frozenset(escaped)
+    unread = [
+        *(f"{path.relative_to(root).as_posix()}, {_TOO_LARGE}" for path in composition.too_large),
+        *(f"{path.relative_to(root).as_posix()}, {_TOO_MANY}" for path in composition.too_many),
+    ]
+    return TemplateEscaping(frozenset(escaped), tuple(sorted(unread)))
 
 
 def _names(parts: tuple[str, ...]) -> Iterator[str]:
@@ -251,12 +304,21 @@ class _Verdict(NamedTuple):
 _REFUSED = _Verdict(escapes=False, extends=frozenset(), includes=frozenset(), open_end=False)
 
 
-def _verdict(path: Path) -> _Verdict:
-    """What one template file establishes: a file the engine cannot read is not
-    established to escape, like a template it cannot find."""
+def _verdict(parsed: _Parsed) -> _Verdict:
+    """What one template file establishes, read on its own."""
+
+    if not parsed.ok:
+        return _REFUSED
+    reading = _read_markup(_flattened(parsed.nodes))
+    return _Verdict(reading.escapes, parsed.extends, parsed.includes, reading.open_end)
+
+
+def _parse_file(path: Path) -> _Parsed:
+    """The template file ``path``: one the engine cannot read is not established to
+    escape, like a template it cannot find."""
 
     text = _text(path)
-    return _REFUSED if text is None else _inspect(text)
+    return _NOT_ESCAPING if text is None else _parse(text)
 
 
 def _text(path: Path) -> str | None:
@@ -268,55 +330,406 @@ def _text(path: Path) -> str | None:
         return None
 
 
-def _inspect(text: str) -> _Verdict:
-    """What the template of ``text`` establishes (``_Verdict``)."""
+_Node: TypeAlias = "str | _Block | _Include | _Super"
+
+
+class _Block(NamedTuple):
+    """A ``{% block %}``: its name, what it holds, and whether its ``{% endblock %}``
+    closes it."""
+
+    name: str
+    nodes: tuple[_Node, ...]
+    closed: bool
+
+
+class _Include(NamedTuple):
+    """An ``{% include %}`` of the template ``name``."""
+
+    name: str
+
+
+class _Super(NamedTuple):
+    """``{{ block.super }}``, which renders the parent's definition of its block."""
+
+
+@dataclass(frozen=True)
+class _Parsed:
+    """One template file as its syntax gives it: whether that syntax lets it escape
+    (``ok``: Django's own tags, libraries and escaping filters only); the templates it
+    extends and those it includes; and its ``nodes``, markup in which a variable is
+    ``_OUTPUT``, a ``url`` or ``static`` tag ``_URL`` and any other tag ``_TAG``, with its
+    blocks, includes and ``{{ block.super }}`` kept apart, and its blocks by name."""
+
+    ok: bool
+    extends: frozenset[str] = frozenset()
+    includes: frozenset[str] = frozenset()
+    nodes: tuple[_Node, ...] = ()
+    blocks: Mapping[str, tuple[_Node, ...]] = field(default_factory=dict)
+
+
+_NOT_ESCAPING = _Parsed(ok=False)
+
+
+def _parse(text: str) -> _Parsed:
+    """The template of ``text`` (``_Parsed``)."""
 
     extends: set[str] = set()
     includes: set[str] = set()
-    html: list[str] = []
+    blocks: dict[str, tuple[_Node, ...]] = {}
+    # The blocks open around the position read, each with what it holds so far, under
+    # the nodes the template holds outside them.
+    nodes: list[_Node] = []
+    opened: list[tuple[str, list[_Node]]] = []
     skipping: str | None = None
     position = 0
-    text = text.replace(_OUTPUT, "").replace(_TAG, "")
+    text = text.replace(_OUTPUT, "").replace(_TAG, "").replace(_INSERTED, "")
+
+    def held() -> list[_Node]:
+        return opened[-1][1] if opened else nodes
+
+    def close() -> None:
+        name, inside = opened.pop()
+        block = _Block(name, tuple(inside), closed=True)
+        blocks.setdefault(name, block.nodes)
+        held().append(block)
+
     for match in _SYNTAX.finditer(text):
         variable, tag = match.group(1), match.group(2)
         words = tag.split() if tag is not None else []
         if skipping is not None:
             if words[:1] == [skipping]:
                 if skipping == "endverbatim":
-                    html.append(text[position : match.start()])
+                    held().append(text[position : match.start()])
                 skipping, position = None, match.end()
             continue
-        html.append(text[position : match.start()])
+        held().append(text[position : match.start()])
         position = match.end()
         if variable is not None:
-            if not _escaping_filters(variable):
-                return _REFUSED
-            html.append(_OUTPUT)
+            if variable.strip() == _BLOCK_SUPER:
+                held().append(_Super())
+                continue
+            if not _escaping_filters(variable) or _names_block(variable):
+                return _NOT_ESCAPING
+            held().append(_OUTPUT)
         elif words and words[0] in ("comment", "verbatim"):
             skipping = f"end{words[0]}"
             if words[0] == "verbatim":
                 position = match.end()
         elif words:
             name = words[0]
-            if name not in _TAGS:
-                return _REFUSED
+            if name not in _TAGS or name not in ("block", "endblock") and _names_block(tag):
+                return _NOT_ESCAPING
             if name == "load" and not set(_loaded(words[1:])) <= _LIBRARIES:
-                return _REFUSED
+                return _NOT_ESCAPING
             if name == "autoescape" and words[1:] != ["on"]:
-                return _REFUSED
+                return _NOT_ESCAPING
             if name == "filter" and not _escaping_filters(tag.split(None, 1)[1] if len(words) > 1 else ""):
-                return _REFUSED
+                return _NOT_ESCAPING
             if name in ("extends", "include"):
                 needed = _constant(words[1] if len(words) > 1 else "")
                 if needed is None:
-                    return _REFUSED
-                (extends if name == "extends" else includes).add(needed)
-            html.append(_OUTPUT if name in _PRINTING else _URL if name in ("url", "static") else _TAG)
+                    return _NOT_ESCAPING
+                if name == "extends":
+                    extends.add(needed)
+                    held().append(_TAG)
+                else:
+                    includes.add(needed)
+                    held().append(_Include(needed))
+            elif name == "block" and len(words) > 1:
+                opened.append((words[1], []))
+            elif name == "endblock" and opened:
+                close()
+            else:
+                held().append(_OUTPUT if name in _PRINTING else _URL if name in ("url", "static") else _TAG)
     if skipping is not None:
-        return _REFUSED
-    html.append(text[position:])
-    reading = _read_markup("".join(html))
-    return _Verdict(reading.escapes, frozenset(extends), frozenset(includes), reading.open_end)
+        return _NOT_ESCAPING
+    held().append(text[position:])
+    while opened:
+        name, inside = opened.pop()
+        block = _Block(name, tuple(inside), closed=False)
+        blocks.setdefault(name, block.nodes)
+        held().append(block)
+    return _Parsed(True, frozenset(extends), frozenset(includes), tuple(nodes), MappingProxyType(blocks))
+
+
+def _names_block(expression: str) -> bool:
+    """Whether ``expression`` names the variable ``block`` outside its string literals."""
+
+    return _BLOCK_VARIABLE.search(re.sub(_STRING, "", expression)) is not None
+
+
+def _flattened(nodes: Iterable[_Node]) -> str:
+    """``nodes`` as one markup, each block, include and ``{{ block.super }}`` marked where
+    it stands as the tag or variable it is."""
+
+    parts: list[str] = []
+    for node in nodes:
+        if isinstance(node, str):
+            parts.append(node)
+        elif isinstance(node, _Block):
+            parts.extend((_TAG, _flattened(node.nodes), _TAG if node.closed else ""))
+        elif isinstance(node, _Include):
+            parts.append(_TAG)
+        else:
+            parts.append(_OUTPUT)
+    return "".join(parts)
+
+
+# The size a page put together may reach, in characters, checked as it grows: nested
+# includes can multiply a page beyond any size.
+_PAGE_LIMIT = 8 * 1024 * 1024
+# The pages one template may render with the files each template it extends may be, and
+# their size together: many small pages never reach the bound of one.
+_VARIANT_LIMIT = 64
+_VARIANTS_SIZE_LIMIT = 16 * 1024 * 1024
+_TOO_LARGE = "beyond 8 MiB once its blocks and includes are put together"
+_TOO_MANY = "more than 64 pages, or 16 MiB in all, with each file the templates it extends may be"
+
+
+class _Unrenderable(Exception):
+    """A page Django could not render: a block holding a block of its own name."""
+
+
+class _Page(NamedTuple):
+    """The markups a template renders, one for each file each template its extends chain
+    names may be, and the names of the includes it inserts there (``_INSERTED``), its
+    own and those of the pages it includes."""
+
+    markups: tuple[str, ...]
+    inserted: frozenset[str] = frozenset()
+
+
+class _Composition:
+    """The page each template file renders, put together as Django renders it (#273):
+    its extends chain from the root, each block taking the definition of the most derived
+    template defining it and ``{{ block.super }}`` the next definition up, each include
+    the page of the included template, or, for a name several files have, a template
+    rendering several pages or one on the way to itself, an inserted markup standing for
+    each (``_INSERTED``): a page inserted in HTML data reads as the markup it stands for
+    there, nested to any depth, provided that markup is accepted and ends in data. A
+    name several files have in the chain gives a page for each, up to ``_VARIANT_LIMIT``
+    and ``_VARIANTS_SIZE_LIMIT`` together, beyond which ``too_many`` lists the template.
+    A child's text outside its blocks is not part of a page. A page that cannot be put
+    together is not established: a template it needs is missing or refused by its own
+    syntax, it extends itself, a block of it holds itself, or it grows beyond
+    ``_PAGE_LIMIT``, which ``too_large`` then lists."""
+
+    def __init__(self, found: Mapping[str, Sequence[Path]], parsed: Mapping[Path, _Parsed]) -> None:
+        self._found = found
+        self._parsed = parsed
+        # Only the pages another one includes are kept: a page is read once, and its
+        # markup is needed again only where it is included.
+        self._included = {
+            paths[0]
+            for p in parsed.values()
+            for name in p.includes
+            if len(paths := found.get(name, ())) == 1
+        }
+        self._pages: dict[Path, _Page | None] = {}
+        self.too_large: set[Path] = set()
+        self.too_many: set[Path] = set()
+
+    def page(self, path: Path) -> _Page | None:
+        """The page ``path`` renders, put together; None when it cannot be."""
+
+        if path in self._pages:
+            return self._pages[path]
+        # Depth first over the includes each page renders, without recursion: a page is
+        # put together once the pages it includes are.
+        stack = [path]
+        waiting: set[Path] = set()
+        result: _Page | None = None
+        while stack:
+            current = stack[-1]
+            if current in self._pages:
+                stack.pop()
+                continue
+            chains = self._chains(current)
+            targets = None if chains is None else self._targets(chains)
+            if targets is None:
+                page = None
+            elif pending := [target for target in targets if target not in self._pages and target not in waiting]:
+                waiting.add(current)
+                stack.extend(pending)
+                continue
+            else:
+                assert chains is not None
+                page = self._render(current, chains, waiting)
+            waiting.discard(current)
+            stack.pop()
+            if current == path:
+                result = page
+            if current in self._included or current != path:
+                self._pages[current] = page
+        return result
+
+    def _chains(self, path: Path) -> list[list[_Parsed]] | None:
+        """``path``, then what it extends, up to the root: one chain for each file each
+        name it extends may be. As Django's loaders do, the files already in the chain
+        are left out: a template extending its own name extends another file of it."""
+
+        chains: list[list[_Parsed]] = []
+        pending: list[tuple[list[_Parsed], frozenset[Path]]] = [([self._parsed[path]], frozenset({path}))]
+        while pending:
+            chain, seen = pending.pop()
+            if not chain[-1].ok:
+                return None
+            if not chain[-1].extends:
+                chains.append(chain)
+                continue
+            if len(chain[-1].extends) != 1:
+                return None
+            (name,) = chain[-1].extends
+            parents = [parent for parent in self._found.get(name, ()) if parent not in seen]
+            if not parents:
+                return None
+            pending.extend(([*chain, self._parsed[parent]], seen | {parent}) for parent in parents)
+            if len(chains) + len(pending) > _VARIANT_LIMIT:
+                self.too_many.add(path)
+                return None
+        return chains
+
+    def _targets(self, chains: Iterable[Sequence[_Parsed]]) -> list[Path] | None:
+        """The files the pages of ``chains`` include, those of a name one file has; None
+        when a name they include has none, or a page cannot be rendered."""
+
+        targets: list[Path] = []
+        try:
+            for chain in chains:
+                for name in _includes(chain):
+                    paths = self._found.get(name, ())
+                    if not paths:
+                        return None
+                    if len(paths) == 1:
+                        targets.append(paths[0])
+        except _Unrenderable:
+            return None
+        return targets
+
+    def _render(self, path: Path, chains: Iterable[Sequence[_Parsed]], waiting: Container[Path]) -> _Page | None:
+        """The pages ``chains`` render; an include of a page being put together, on the
+        way to itself, inserted (``_INSERTED``)."""
+
+        markups: list[str] = []
+        inserted: set[str] = set()
+        together = 0
+        for chain in chains:
+            markup = self._markup(path, chain, waiting, inserted)
+            if markup is None:
+                return None
+            together += len(markup)
+            if together > _VARIANTS_SIZE_LIMIT:
+                self.too_many.add(path)
+                return None
+            markups.append(markup)
+        return _Page(tuple(markups), frozenset(inserted))
+
+    def _markup(self, path: Path, chain: Sequence[_Parsed], waiting: Container[Path], inserted: set[str]) -> str | None:
+        """The page of ``chain``, each definition put together once however many times
+        the page renders it, and each bounded as it grows: a block rendering its parent
+        twice at every level doubles the page, not the work."""
+
+        made: dict[_Key, str] = {}
+        root = _root(chain)
+        # The definitions being put together, each with what it renders so far and its size.
+        stack: list[tuple[_Key, Iterator[_Node], list[str], list[int]]] = [(root, iter(_definition(chain, root)), [], [0])]
+        while stack:
+            key, nodes, parts, size = stack[-1]
+            node = next(nodes, None)
+            if node is None:
+                stack.pop()
+                made[key] = piece = "".join(parts)
+                if not stack:
+                    return piece
+            elif isinstance(node, str):
+                piece = node
+            elif isinstance(node, _Include):
+                included = self._include_markup(node.name, waiting, inserted)
+                if included is None:
+                    return None
+                piece = included
+            else:
+                inner = _resolved(chain, key, node)
+                if inner is None:
+                    continue
+                if inner not in made:
+                    stack.append((inner, iter(_definition(chain, inner)), [], [0]))
+                    continue
+                piece = made[inner]
+            _, _, parts, size = stack[-1]
+            parts.append(piece)
+            size[0] += len(piece)
+            if size[0] > _PAGE_LIMIT:
+                self.too_large.add(path)
+                return None
+        return None
+
+    def _include_markup(self, name: str, waiting: Container[Path], inserted: set[str]) -> str | None:
+        """What an include of ``name`` puts in a page: the page of its one file, or an
+        inserted markup; None when that page cannot be put together."""
+
+        paths = self._found[name]
+        recursive = len(paths) == 1 and paths[0] in waiting
+        included = self._pages[paths[0]] if len(paths) == 1 and not recursive else None
+        if included is not None and len(included.markups) == 1:
+            inserted |= included.inserted
+            return included.markups[0]
+        if len(paths) == 1 and included is None and not recursive:
+            return None
+        inserted.add(name)
+        return _INSERTED
+
+
+# A definition a page renders: a block's, in the template of ``chain`` at that level, or,
+# with no name, the root's nodes outside its blocks.
+_Key = tuple[str | None, int]
+
+
+def _root(chain: Sequence[_Parsed]) -> _Key:
+    return None, len(chain) - 1
+
+
+def _definition(chain: Sequence[_Parsed], key: _Key) -> tuple[_Node, ...]:
+    name, level = key
+    return chain[level].nodes if name is None else chain[level].blocks[name]
+
+
+def _resolved(chain: Sequence[_Parsed], key: _Key, node: _Block | _Super) -> _Key | None:
+    """The definition ``node`` renders, standing in the definition ``key``: for a block,
+    that of the most derived template defining it; for ``{{ block.super }}``, the next
+    one up, if any."""
+
+    name, level = key
+    if isinstance(node, _Block):
+        return node.name, next(index for index, parsed in enumerate(chain) if node.name in parsed.blocks)
+    if name is None:
+        return None
+    parent = next((index for index in range(level + 1, len(chain)) if name in chain[index].blocks), None)
+    return None if parent is None else (name, parent)
+
+
+def _includes(chain: Sequence[_Parsed]) -> list[str]:
+    """The names the page of ``chain`` includes, each definition it renders visited once
+    however many times it is rendered: a block holding itself, which Django cannot
+    render, raises ``_Unrenderable``."""
+
+    found: list[str] = []
+    visited = {_root(chain)}
+    stack: list[tuple[_Key, Iterator[_Node]]] = [(_root(chain), iter(_definition(chain, _root(chain))))]
+    while stack:
+        key, nodes = stack[-1]
+        node = next(nodes, None)
+        if node is None:
+            stack.pop()
+        elif isinstance(node, _Include):
+            found.append(node.name)
+        elif not isinstance(node, str) and (inner := _resolved(chain, key, node)) is not None:
+            if any(inner == open_key for open_key, _ in stack):
+                raise _Unrenderable(inner[0])
+            if inner not in visited:
+                visited.add(inner)
+                stack.append((inner, iter(_definition(chain, inner))))
+    return found
 
 
 def _loaded(words: list[str]) -> list[str]:
@@ -336,11 +749,17 @@ def _constant(word: str) -> str | None:
 
 class _Reading(NamedTuple):
     """What one pass over a template's markup establishes: whether every output marker
-    stands where HTML escaping protects it, and whether the text ends inside a script or
-    style block, a tag or an end tag, which the markup after its include continues."""
+    stands where HTML escaping protects it; whether the text ends inside a script or
+    style block, a tag or an end tag, which the markup after its include continues; and
+    whether it ends in HTML data, ``settled``: nothing of it left open, comment included,
+    and no ``<``, ``</``, ``<!`` or ``<!-`` at its end for what follows to complete."""
 
     escapes: bool
     open_end: bool
+    settled: bool = False
+
+
+_NOT_READ = _Reading(escapes=False, open_end=False)
 
 
 def _read_markup(html: str) -> _Reading:
@@ -354,7 +773,12 @@ def _read_markup(html: str) -> _Reading:
     include there may close the comment, a condition around its ``<!--`` leave it out.
     A variable cannot close it, escaped. A comment left open, with no tag after it,
     hides the rest of the text, and hands nothing on: what follows its include stays
-    inside it."""
+    inside it.
+
+    An inserted markup (``_INSERTED``) may hold anything a file of its name holds: it is
+    accepted only in HTML data, never in a comment, a script or style block, a tag or
+    an end tag, nor after what it could complete into one. In data it is as if the
+    markup were there, provided that markup is accepted and ends in data (#273)."""
 
     position = 0
     open_end = False
@@ -370,30 +794,33 @@ def _read_markup(html: str) -> _Reading:
                 close = _COMMENT_END.search(html, start + 2)
                 if close is None:
                     unclosed_from = start
-            first_tag = html.find(_TAG, start + 4, len(html) if close is None else close.start())
+            hidden_to = len(html) if close is None else close.start()
+            first_tag = html.find(_TAG, start + 4, hidden_to)
+            if html.find(_INSERTED, start + 4, hidden_to if first_tag == -1 else first_tag) != -1:
+                return _NOT_READ
             if first_tag != -1:
-                position = first_tag + 1
+                position, open_end = first_tag + 1, False
             elif close is not None:
-                position = close.end()
+                position, open_end = close.end(), False
             else:
-                break
+                return _Reading(escapes=True, open_end=False)
         elif raw := _RAW_TEXT.match(html, start):
-            if _OUTPUT in raw.group(2) or not _attributes_escape(html[start : raw.start(2)]):
-                return _Reading(escapes=False, open_end=False)
+            if _OUTPUT in raw.group(2) or _INSERTED in raw.group(0) or not _attributes_escape(html[start : raw.start(2)]):
+                return _NOT_READ
             position, open_end = raw.end(), not raw.group(3)
         elif tag := _START_TAG.match(html, start):
-            if _OUTPUT in tag.group(1) or not _attributes_escape(tag.group(2)):
-                return _Reading(escapes=False, open_end=False)
+            if _OUTPUT in tag.group(1) or _INSERTED in tag.group(0) or not _attributes_escape(tag.group(2)):
+                return _NOT_READ
             position, open_end = tag.end(), tag.group(3) is None
         elif end := _END_TAG.match(html, start):
-            if _OUTPUT in end.group(0):
-                return _Reading(escapes=False, open_end=False)
+            if _OUTPUT in end.group(0) or _INSERTED in end.group(0):
+                return _NOT_READ
             position, open_end = end.end(), end.group(1) is None
-        elif _NAMED_BY_OUTPUT.match(html, start):
-            return _Reading(escapes=False, open_end=False)
+        elif _NAMED_BY_OUTPUT.match(html, start) or _OPENED_BY_INSERTION.match(html, start):
+            return _NOT_READ
         else:
             position = start + 1
-    return _Reading(escapes=True, open_end=open_end)
+    return _Reading(escapes=True, open_end=open_end, settled=not open_end and not _ENDING_OPENER.search(html))
 
 
 def _attributes_escape(attributes: str) -> bool:
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
new file mode 100644
index 0000000..3588de3
--- /dev/null
+++ b/tests/test_template_page_composition.py
@@ -0,0 +1,510 @@
+"""Acceptance tests for issue #273: a page is read as Django puts it together.
+
+A ``{% block %}`` takes the definition the rendered page gives it, which may stand in the
+parent's ``<script>``; an ``{% include %}`` puts the included template's markup where it
+stands, which may be inside an attribute value and end it. Each template file read on
+its own sees neither, so each page is also put together, its blocks and includes in
+place, and read once. Each inspection and analysis runs in a subprocess with a timeout,
+so that one that does not end fails instead of hanging the suite.
+"""
+
+from __future__ import annotations
+
+import itertools
+import json
+import random
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+TIMEOUT = 60
+
+ESCAPED_TEMPLATES = (
+    "import json, sys\n"
+    "from pathlib import Path\n"
+    "from coretrace_python.taint.templates import escaped_templates\n"
+    "print(json.dumps(sorted(escaped_templates(Path(sys.argv[1])))))\n"
+)
+
+VIEW = (
+    "from django.http import HttpRequest, HttpResponse\n"
+    "from django.template.loader import render_to_string\n\n"
+    "def page(request: HttpRequest):\n"
+    "    return HttpResponse(render_to_string('page.html', {'name': request.GET['name']}))\n"
+)
+
+
+def run(command: list[str]) -> subprocess.CompletedProcess[str]:
+    try:
+        return subprocess.run(command, capture_output=True, text=True, check=False, timeout=TIMEOUT)
+    except subprocess.TimeoutExpired:
+        pytest.fail(f"{command[1:3]} did not end within {TIMEOUT} s")
+
+
+def project(tmp_path: Path, templates: dict[str, str]) -> Path:
+    """A project rendering ``page.html`` with the request's ``name``; a template given by
+    its name lies under ``app/templates``, one given by a path under that path."""
+
+    root = tmp_path / "project"
+    (root / "app" / "templates").mkdir(parents=True, exist_ok=True)
+    (root / "app" / "views.py").write_text(VIEW, encoding="utf-8")
+    for name, content in templates.items():
+        path = root / name if "/templates/" in name else root / "app" / "templates" / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(content, encoding="utf-8")
+    return root
+
+
+def escaped(tmp_path: Path, templates: dict[str, str]) -> list[str]:
+    completed = run([sys.executable, "-c", ESCAPED_TEMPLATES, str(project(tmp_path, templates))])
+    assert completed.returncode == 0, completed.stderr
+    names: list[str] = json.loads(completed.stdout)
+    return names
+
+
+UNREAD_TEMPLATES = (
+    "import json, sys\n"
+    "from pathlib import Path\n"
+    "from coretrace_python import engine\n"
+    "analysis = engine.analyze_project(Path(sys.argv[1]), [engine.BUNDLED_PLUGINS])\n"
+    "print(json.dumps(sorted(analysis.coverage.unread_templates)))\n"
+)
+
+
+def unread(tmp_path: Path, templates: dict[str, str]) -> list[str]:
+    completed = run([sys.executable, "-c", UNREAD_TEMPLATES, str(project(tmp_path, templates))])
+    assert completed.returncode == 0, completed.stderr
+    entries: list[str] = json.loads(completed.stdout)
+    return entries
+
+
+def xss(tmp_path: Path, templates: dict[str, str]) -> list[tuple[str, int]]:
+    root = project(tmp_path, templates)
+    completed = run([sys.executable, "-m", "coretrace_python", "--check", str(root), "--format", "json"])
+    findings = json.loads(completed.stdout)["findings"]
+    return [(f["location"]["path"], f["location"]["line"]) for f in findings if f["rule_id"] == "xss"]
+
+
+BASE_WITH_SCRIPT_BLOCK = "<html><head><script>{% block js %}{% endblock %}</script></head><body>{% block body %}{% endblock %}</body></html>\n"
+
+
+# The reproductions of #273, rendered with Django 5.1.15: the variable runs as script in
+# F, as an event handler in H, and in H's variant when other/templates comes first.
+@pytest.mark.parametrize(
+    "templates",
+    [
+        {
+            "base.html": "<html><head><script>{% block js %}{% endblock %}</script></head><body></body></html>\n",
+            "page.html": "{% extends 'base.html' %}{% block js %}var name = {{ name }};{% endblock %}\n",
+        },
+        {"page.html": '<a title="{% include "q.html" %}{{ name }}">x</a>\n', "q.html": '" onclick="\n'},
+        {
+            "page.html": '<a title="{% include "q.html" %}{{ name }}">x</a>\n',
+            "q.html": "quote: \n",
+            "other/templates/q.html": '" onclick="\n',
+        },
+    ],
+    ids=["F-block-inside-parent-script", "H-include-inside-attribute-value", "H-include-of-a-name-two-files-have"],
+)
+def test_markup_a_block_or_an_include_puts_inside_a_construct_is_read_there(
+    tmp_path: Path, templates: dict[str, str]
+) -> None:
+    assert xss(tmp_path, templates) == [("app/views.py", 5)]
+
+
+
+# Only a bare {{ block.super }} is put in place. Through a filter, a tag or an alias of the
+# block, Django still prints the parent's markup, marked safe, which escape and default
+# keep as it is: what it does there is not established, so the alert stays.
+@pytest.mark.parametrize(
+    "printed",
+    [
+        "{{ block.super|escape }}",
+        '{{ block.super|default:"" }}',
+        "{% with parent=block.super %}{{ parent }}{% endwith %}",
+        "{% with parent=block %}{{ parent.super }}{% endwith %}",
+        "{% with parent=block %}{{ parent.super|escape }}{% endwith %}",
+    ],
+    ids=["through-escape", "through-default", "through-with", "alias-of-the-block", "alias-through-escape"],
+)
+def test_the_block_used_otherwise_than_in_a_bare_block_super_keeps_the_alert(tmp_path: Path, printed: str) -> None:
+    templates = {
+        "base.html": '<a title="{% block attr %}" onclick="{% endblock %}">x</a>\n',
+        "page.html": "{% extends 'base.html' %}{% block attr %}" + printed + "{{ name }}{% endblock %}\n",
+    }
+
+    assert xss(tmp_path, templates) == [("app/views.py", 5)]
+
+
+def test_block_super_in_an_included_template_renders_nothing_there(tmp_path: Path) -> None:
+    # Django renders an include apart from the blocks around it: block.super gives "" there.
+    templates = {
+        "base.html": '<a title="{% block attr %}" onclick="{% endblock %}">x</a>\n',
+        "parent.html": "{{ block.super }}",
+        "page.html": "{% extends 'base.html' %}{% block attr %}{% include 'parent.html' %}{{ name }}{% endblock %}\n",
+    }
+
+    assert escaped(tmp_path, templates) == ["base.html", "page.html", "parent.html"]
+
+def test_only_the_page_printing_inside_the_parent_script_is_refused(tmp_path: Path) -> None:
+    templates = {
+        "base.html": BASE_WITH_SCRIPT_BLOCK,
+        "page.html": "{% extends 'base.html' %}{% block body %}<p>{{ name }}</p>{% endblock %}\n",
+        "inert.html": "{% extends 'base.html' %}{% block js %}var count = 1;{% endblock %}\n",
+        "script.html": "{% extends 'base.html' %}{% block js %}var name = {{ name }};{% endblock %}\n",
+    }
+
+    assert escaped(tmp_path, templates) == ["base.html", "inert.html", "page.html"]
+
+
+@pytest.mark.parametrize(
+    "templates",
+    [
+        {
+            "base.html": '<body class="{% block bodyclass %}{% endblock %}">{% block content %}{% endblock %}</body>\n',
+            "page.html": "{% extends 'base.html' %}{% block bodyclass %}{{ name }} change-form{% endblock %}\n",
+        },
+        {
+            "base.html": "<script>{% block js %}var count = 1;{% endblock %}</script>\n",
+            "page.html": "{% extends 'base.html' %}{% block js %}{{ block.super }} var total = 2;{% endblock %}\n",
+        },
+        {"page.html": '<a title="{% include "q.html" %}{{ name }}">x</a>\n', "q.html": "prefix \n"},
+        {
+            "base.html": "<p>{% block body %}{% endblock %}</p>\n",
+            "middle.html": "{% extends 'base.html' %}{% block body %}<b>{% block inner %}{% endblock %}</b>{% endblock %}\n",
+            "page.html": "{% extends 'middle.html' %}{% block inner %}{{ name }}{% endblock %}\n",
+        },
+    ],
+    ids=["variable-in-a-quoted-class", "block-super-in-a-script", "include-without-a-quote-in-a-title", "nested-blocks"],
+)
+def test_a_page_whose_parts_stay_escaped_once_put_together_is_established(
+    tmp_path: Path, templates: dict[str, str]
+) -> None:
+    assert escaped(tmp_path, templates) == sorted(templates)
+
+
+@pytest.mark.parametrize(
+    "templates",
+    [
+        {
+            "page.html": "{% include 'self.html' %}",
+            "self.html": '<a title="{% if more %}{% include \'self.html\' %}{% endif %}{{ name }}">x</a>',
+        },
+        {
+            "page.html": "{% include 'a.html' %}",
+            "a.html": "<script>{% if more %}{% include 'b.html' %}{% endif %}</script>",
+            "b.html": "{{ name }}{% include 'a.html' %}",
+        },
+    ],
+    ids=["itself-inside-an-attribute", "through-another-inside-a-script"],
+)
+def test_a_template_including_itself_inside_a_construct_is_not_established(
+    tmp_path: Path, templates: dict[str, str]
+) -> None:
+    # Rendered twice, self.html puts an <a title="…"> inside the title it is in, whose quote
+    # ends that title before the variable; b.html's variable lands inside a.html's script.
+    assert escaped(tmp_path, templates) == []
+
+
+def doubling_includes() -> dict[str, str]:
+    # level{n}.html holds 2 ** n KiB once put together: level13.html is 8 MiB,
+    # level14.html beyond, and the page including it is put together no further.
+    templates = {"level0.html": "x" * 1024}
+    for level in range(1, 15):
+        templates[f"level{level}.html"] = f"{{% include 'level{level - 1}.html' %}}" * 2
+    templates["page.html"] = "{% include 'level14.html' %}"
+    return templates
+
+
+def test_a_page_beyond_eight_mebibytes_is_not_established(tmp_path: Path) -> None:
+    assert escaped(tmp_path, doubling_includes()) == sorted(f"level{level}.html" for level in range(14))
+
+
+
+def chain_doubling_block_super(levels: int, root: str) -> dict[str, str]:
+    # level{n}.html renders its parent's block twice: its page holds the root's block
+    # content 2 ** n times.
+    templates = {"level0.html": f"{{% block body %}}{root}{{% endblock %}}"}
+    for level in range(1, levels + 1):
+        templates[f"level{level}.html"] = (
+            f"{{% extends 'level{level - 1}.html' %}}{{% block body %}}{{{{ block.super }}}}{{{{ block.super }}}}{{% endblock %}}"
+        )
+    return templates
+
+
+def test_a_block_rendering_its_parent_twice_at_every_level_is_put_together_once(tmp_path: Path) -> None:
+    # The page stays empty however deep the chain: each definition is put together once.
+    assert escaped(tmp_path, chain_doubling_block_super(30, "")) == sorted(f"level{level}.html" for level in range(31))
+
+
+def test_a_block_rendering_its_parent_twice_stops_at_eight_mebibytes(tmp_path: Path) -> None:
+    # level13.html holds 8 MiB of the root's content, level14.html beyond.
+    assert escaped(tmp_path, chain_doubling_block_super(16, "x" * 1024)) == sorted(f"level{level}.html" for level in range(14))
+
+def test_a_page_beyond_eight_mebibytes_is_listed_among_the_templates_not_read(tmp_path: Path) -> None:
+    assert unread(tmp_path, doubling_includes()) == [
+        "app/templates/level14.html, beyond 8 MiB once its blocks and includes are put together"
+    ]
+
+
+# Two files give part.html. Django renders the first its loaders find, which the analyzer
+# does not know: the include stands for each of them.
+def test_an_include_of_a_name_two_files_have_is_established_in_html_data(tmp_path: Path) -> None:
+    templates = {
+        "part.html": "<p>{{ name }}</p>\n",
+        "other/templates/part.html": "<span>x</span>\n",
+        "page.html": "<div>{% include 'part.html' %}</div>\n",
+    }
+
+    assert escaped(tmp_path, templates) == ["page.html", "part.html"]
+
+
+@pytest.mark.parametrize(
+    "page",
+    [
+        '<a title="{% include "part.html" %}">x</a>',
+        "<a {% include 'part.html' %}>x</a>",
+        "<{% include 'part.html' %}>",
+        "</{% include 'part.html' %}>",
+        "<script>{% include 'part.html' %}</script>",
+        "<style>{% include 'part.html' %}</style>",
+        "<!-- {% include 'part.html' %} -->",
+        "<!{% include 'part.html' %}",
+        "<!-{% include 'part.html' %}",
+    ],
+    ids=["attribute-value", "attribute", "tag-name", "end-tag", "script", "style", "comment", "after-bang", "after-bang-dash"],
+)
+def test_an_include_of_a_name_two_files_have_is_refused_outside_html_data(tmp_path: Path, page: str) -> None:
+    # Both files are harmless here: what matters is that either could end the construct.
+    templates = {"part.html": "x\n", "other/templates/part.html": "y\n", "page.html": page}
+
+    assert escaped(tmp_path, templates) == ["part.html"]
+
+
+@pytest.mark.parametrize(
+    "other",
+    ["<script>\n", "<!-- note", "x <", "<!-", "</"],
+    ids=["construct", "comment", "less-than", "comment-opener", "end-tag-opener"],
+)
+def test_an_include_of_a_name_two_files_have_needs_each_to_end_in_html_data(tmp_path: Path, other: str) -> None:
+    templates = {"part.html": "x\n", "other/templates/part.html": other, "page.html": "<div>{% include 'part.html' %}</div>\n"}
+
+    assert escaped(tmp_path, templates) == ["part.html"]
+
+
+
+# Two files give base.html: the page is put together with each.
+@pytest.mark.parametrize(
+    ("other", "expected"),
+    [
+        ("<div>{% block body %}{% endblock %}</div>\n", ["base.html", "page.html"]),
+        ("<script>{% block body %}{% endblock %}</script>\n", ["base.html"]),
+    ],
+    ids=["each-escapes", "one-runs-the-block-as-script"],
+)
+def test_a_page_extending_a_name_two_files_have_must_escape_with_each(
+    tmp_path: Path, other: str, expected: list[str]
+) -> None:
+    templates = {
+        "base.html": "<p>{% block body %}{% endblock %}</p>\n",
+        "other/templates/base.html": other,
+        "page.html": "{% extends 'base.html' %}{% block body %}{{ name }}{% endblock %}\n",
+    }
+
+    assert escaped(tmp_path, templates) == expected
+
+
+
+# A template extending its own name: Django leaves out the files already in the chain and
+# takes one of the others, rendering the user's data escaped here.
+@pytest.mark.parametrize(
+    ("other", "expected_xss"),
+    [
+        ("<p>{% block body %}{% endblock %}</p>\n", []),
+        ("<script>{% block body %}{% endblock %}</script>\n", [("app/views.py", 5)]),
+    ],
+    ids=["the-other-file-escapes", "the-other-file-runs-the-block-as-script"],
+)
+def test_a_template_extending_its_own_name_extends_another_file_of_it(
+    tmp_path: Path, other: str, expected_xss: list[tuple[str, int]]
+) -> None:
+    templates = {
+        "page.html": "{% extends 'page.html' %}{% block body %}<b>{{ name }}</b>{% endblock %}\n",
+        "other/templates/page.html": other,
+    }
+
+    assert xss(tmp_path, templates) == expected_xss
+
+
+def test_a_template_extending_its_own_name_with_no_other_file_is_not_established(tmp_path: Path) -> None:
+    templates = {"page.html": "{% extends 'page.html' %}{% block body %}<b>{{ name }}</b>{% endblock %}\n"}
+
+    assert escaped(tmp_path, templates) == []
+
+@pytest.mark.parametrize(
+    ("page", "expected"),
+    [
+        ("<div>{% include 'widget.html' %}</div>\n", ["base.html", "page.html", "widget.html"]),
+        ('<a title="{% include \'widget.html\' %}">x</a>\n', ["base.html", "widget.html"]),
+    ],
+    ids=["in-html-data", "in-an-attribute"],
+)
+def test_an_include_of_a_template_with_several_pages_stands_for_each(
+    tmp_path: Path, page: str, expected: list[str]
+) -> None:
+    templates = {
+        "base.html": "<p>{% block body %}{% endblock %}</p>\n",
+        "other/templates/base.html": "<div>{% block body %}{% endblock %}</div>\n",
+        "widget.html": "{% extends 'base.html' %}{% block body %}x{% endblock %}",
+        "page.html": page,
+    }
+
+    assert escaped(tmp_path, templates) == expected
+
+
+def chain_of_names_two_files_have(levels: int, root: str = "x") -> dict[str, str]:
+    # level{n}.html, given by two files, extends level{n - 1}.html: each file of level n
+    # renders 2 ** n pages, one for each file each level below it may be.
+    templates: dict[str, str] = {}
+    for directory in ("app", "other"):
+        templates[f"{directory}/templates/level0.html"] = f"{root}{{% block body %}}{{% endblock %}}"
+        for level in range(1, levels + 1):
+            templates[f"{directory}/templates/level{level}.html"] = (
+                f"{{% extends 'level{level - 1}.html' %}}{{% block body %}}{{{{ name }}}}{{% endblock %}}"
+            )
+    return templates
+
+
+def test_a_template_rendering_more_than_64_pages_is_not_established(tmp_path: Path) -> None:
+    assert escaped(tmp_path, chain_of_names_two_files_have(7)) == [f"level{level}.html" for level in range(7)]
+
+
+def test_pages_of_a_template_beyond_sixteen_mebibytes_together_are_not_established(tmp_path: Path) -> None:
+    # Each of the 64 pages of level6.html holds 300,000 characters: 19.2 million together.
+    templates = chain_of_names_two_files_have(6, root="x" * 300_000)
+
+    assert escaped(tmp_path, templates) == [f"level{level}.html" for level in range(6)]
+
+
+@pytest.mark.parametrize(("levels", "root"), [(7, "x"), (6, "x" * 300_000)], ids=["more-than-64", "beyond-16-mib"])
+def test_a_template_with_too_many_pages_is_listed_among_the_templates_not_read(
+    tmp_path: Path, levels: int, root: str
+) -> None:
+    reason = "more than 64 pages, or 16 MiB in all, with each file the templates it extends may be"
+
+    assert unread(tmp_path, {**chain_of_names_two_files_have(levels, root), "page.html": "x"}) == [
+        f"app/templates/level{levels}.html, {reason}",
+        f"other/templates/level{levels}.html, {reason}",
+    ]
+
+
+
+def test_a_template_including_itself_in_html_data_is_established(tmp_path: Path) -> None:
+    templates = {
+        "page.html": "{% include 'tree.html' %}",
+        "tree.html": "<li>{{ name }}<ul>{% if more %}{% include 'tree.html' %}{% endif %}</ul></li>",
+    }
+
+    assert escaped(tmp_path, templates) == ["page.html", "tree.html"]
+
+
+def test_a_template_including_itself_must_end_in_html_data(tmp_path: Path) -> None:
+    # Rendered twice, the comment it leaves open runs to the "-->" in the next title, and
+    # the variable after it names a tag.
+    templates = {"self.html": '{% if more %}{% include \'self.html\' %}{% endif %}<a title="--><{{ name }}"><!--'}
+
+    assert escaped(tmp_path, templates) == []
+
+# Markup, a variable and a template tag, as the reader sees a page.
+PIECES = ["x", " ", "<p>", "</p>", "<script>", "</script>", '<a title="', '<a onclick="', '"', ">", "<!--", "-->", "<", "</", "<!", "<!-", "-"]
+
+
+def test_text_accepted_in_place_of_the_marker_keeps_the_page_accepted() -> None:
+    """The marker stands for a text the reader accepts and that ends in HTML data. Where
+    the reader accepts the marker, any such text in its place keeps the page accepted,
+    and ending in HTML data: a page made of such texts, nested to any depth, is accepted
+    whatever the texts, which is why one marker may stand for several files. Checked on
+    every text of up to two pieces around the marker, and on random longer ones."""
+
+    from coretrace_python.taint import templates
+
+    pieces = [*PIECES, templates._OUTPUT, templates._TAG]
+    rng = random.Random(273)
+
+    def text(low: int, high: int) -> str:
+        return "".join(rng.choice(pieces) for _ in range(rng.randint(low, high)))
+
+    def accepted(candidate: str) -> bool:
+        reading = templates._read_markup(candidate)
+        return reading.escapes and reading.settled
+
+    short = ["", *pieces, *("".join(pair) for pair in itertools.product(pieces, repeat=2))]
+    contents = [candidate for candidate in short + [text(3, 6) for _ in range(2_000)] if accepted(candidate)]
+    around = [*itertools.product(short, repeat=2), *((text(2, 8), text(2, 8)) for _ in range(20_000))]
+    for prefix, suffix in around:
+        marked = templates._read_markup(prefix + templates._INSERTED + suffix)
+        if not marked.escapes:
+            continue
+        for content in rng.sample(contents, 8):
+            spliced = templates._read_markup(prefix + content + suffix)
+            assert spliced.escapes, (prefix, content, suffix)
+            assert spliced.settled or not marked.settled, (prefix, content, suffix)
+
+
+def test_a_text_inserting_itself_is_accepted_only_if_its_unfoldings_are() -> None:
+    """A text holding the marker where it inserts itself, accepted and ending in HTML
+    data, stays accepted unfolded: the marker replaced by the text's own unfolding, level
+    after level, down to the text without it. Checked on every text of up to two pieces
+    around the marker."""
+
+    from coretrace_python.taint import templates
+
+    pieces = [*PIECES, templates._OUTPUT, templates._TAG]
+    short = ["", *pieces, *("".join(pair) for pair in itertools.product(pieces, repeat=2))]
+    for before, after in itertools.product(short, repeat=2):
+        reading = templates._read_markup(before + templates._INSERTED + after)
+        if not (reading.escapes and reading.settled):
+            continue
+        unfolded = before + after
+        for _ in range(3):
+            assert templates._read_markup(unfolded).escapes, (before, after)
+            unfolded = before + unfolded + after
+
+
+# Template pieces around a self-include: unfolded, the include gives way to the template's
+# own text, level after level, until the condition around it, if any, no longer holds.
+TEMPLATE_PIECES = ["x", " ", "{{ name }}", "<", "<!--", "-->", '<a title="', '"', ">", "</a>", "<script>", "</script>", "{% if c %}", "{% endif %}"]
+
+
+def test_a_template_including_itself_is_established_only_if_its_unfoldings_are(tmp_path: Path) -> None:
+    """For generated templates including themselves, established means every unfolding
+    of the recursion, written out as templates including each other down to one that
+    includes nothing, is established too."""
+
+    from coretrace_python.taint.templates import escaped_templates
+
+    rng = random.Random(273)
+    root = tmp_path / "project"
+    directory = root / "app" / "templates"
+    directory.mkdir(parents=True)
+    count, depth = 3_000, 4
+    for index in range(count):
+        before = "".join(rng.choice(TEMPLATE_PIECES) for _ in range(rng.randint(0, 3)))
+        after = "".join(rng.choice(TEMPLATE_PIECES) for _ in range(rng.randint(0, 3)))
+        # Half of them include themselves under a condition, the others without one: a
+        # tag after the include would end a comment its markup leaves open.
+        opening, closing = ("{% if more %}", "{% endif %}") if index % 2 else ("", "")
+        written = {
+            f"t{index}.html": f"{{% include 't{index}.html' %}}",
+            f"t{index}-0.html": "",
+            **{f"t{index}-{level}.html": f"{{% include 't{index}-{level - 1}.html' %}}" for level in range(1, depth)},
+        }
+        for name, included in written.items():
+            (directory / name).write_text(f"{before}{opening}{included}{closing}{after}", encoding="utf-8")
+    established = escaped_templates(root)
+    recursive = [index for index in range(count) if f"t{index}.html" in established]
+    assert recursive
+    for index in recursive:
+        assert all(f"t{index}-{level}.html" in established for level in range(depth)), index