Specs: Tokeniser should return to return state, not data state; &#x; should not emit U+FFFD.

sky/specs/parsing.md

 Parsing
 =======
 
 Parsing in Sky is a strict pipeline consisting of five stages:
 
 - decoding, which converts incoming bytes into Unicode characters
   using UTF-8.
 
 - normalising, which manipulates the sequence of characters.
 
@@ skipping 620 matching lines @@
 If the current character is...
 
 * '``#``': Consume the character, and switch to the **numeric
   character reference** state.
 
 * '``0``'..'``9``', '``a``'..'``f``', '``A``'..'``F``': switch to the
   **named character reference** state without consuming the current
   character.
 
 * Anything else: Run the _emitting operation_ for all but the last
-  character in _raw value_, and switch to the **data state** without
+  character in _raw value_, and switch to the _return state_ without
   consuming the current character.
 
 
 #### **Numeric character reference** state ####
 
 Append the current character to _raw value_.
 
 If the current character is...
 
-* '``x``', '``X``': Let _value_ be zero, consume the character,
-  and switch to the **hexadecimal numeric character reference** state.
+* '``x``', '``X``': Consume the character and switch to the **before
+  hexadecimal numeric character reference** state.
 
 * '``0``'..'``9``': Let _value_ be the numeric value of the
   current character interpreted as a decimal digit, consume the
   character, and switch to the **decimal numeric character reference**
   state.
 
 * Anything else: Run the _emitting operation_ for all but the last
-  character in _raw value_, and switch to the **data state** without
+  character in _raw value_, and switch to the _return state_ without
   consuming the current character.
 
 
+#### **Before hexadecimal numeric character reference** state ####
+
+Append the current character to _raw value_.
+
+If the current character is...
+
+* '``0``'..'``9``', '``a``'..'``f``', '``A``'..'``F``':
+  Let _value_ be the numeric value of the current character
+  interpreted as a hexadecimal digit, consume the character, and
+  switch to the **hexadecimal numeric character reference** state.
+
+* Anything else: Run the _emitting operation_ for all but the last
+  character in _raw value_, and switch to the _return state_ without
+  consuming the current character.
+
+
 #### **Hexadecimal numeric character reference** state ####
 
 Append the current character to _raw value_.
 
 If the current character is...
 
 * '``0``'..'``9``', '``a``'..'``f``', '``A``'..'``F``':
   Let _value_ be sixteen times _value_ plus the numeric value of the
   current character interpreted as a hexadecimal digit.
 
 * '``;``': Consume the character. If _value_ is between 0x0001 and
   0x10FFFF inclusive, but is not between 0xD800 and 0xDFFF inclusive,
   run the _emitting operation_ with a unicode character having the
   scalar value _value_; otherwise, run the _emitting operation_ with
   the character U+FFFD. Then, in either case, switch to the _return
   state_.
 
 * Anything else: Run the _emitting operation_ for all but the last
-  character in _raw value_, and switch to the **data state** without
+  character in _raw value_, and switch to the _return state_ without
   consuming the current character.
 
 
 #### **Decimal numeric character reference** state ####
 
 Append the current character to _raw value_.
 
 If the current character is...
 
 * '``0``'..'``9``': Let _value_ be ten times _value_ plus the
   numeric value of the current character interpreted as a decimal
   digit.
 
 * '``;``': Consume the character. If _value_ is between 0x0001 and
   0x10FFFF inclusive, but is not between 0xD800 and 0xDFFF inclusive,
   run the _emitting operation_ with a unicode character having the
   scalar value _value_; otherwise, run the _emitting operation_ with
   the character U+FFFD. Then, in either case, switch to the _return
   state_.
 
 * Anything else: Run the _emitting operation_ for all but the last
-  character in _raw value_, and switch to the **data state** without
+  character in _raw value_, and switch to the _return state_ without
   consuming the current character.
 
 
 #### **Named character reference** state ####
 
 Append the current character to _raw value_.
 
 If the current character is...
 
 * '``;``': Consume the character.
@@ skipping 13 matching lines @@
 
   - '``"``: Emit Run the _emitting operation_ for the character
     '``"``'.
 
   Then, switch to the _return state_.
 
 * '``0``'..'``9``', '``a``'..'``z``', '``A``'..'``Z``': Consume the
   character and stay in this state.
 
 * Anything else: Run the _emitting operation_ for all but the last
-  character in _raw value_, and switch to the **data state** without
+  character in _raw value_, and switch to the _return state_ without
   consuming the current character.
 
 
 Token cleanup stage
 -------------------
 
 Replace each sequence of character tokens with a single string token
 whose value is the concatenation of all the characters in the
 character tokens.
 
@@ skipping 41 matching lines @@
         there isn't one, skip this token.
      2. If there's a ``template`` element in the _stack of open
         nodes_ above _node_, then skip this token.
      3. Pop nodes from the _stack of open nodes_ until _node_ has been
         popped.
      4. If _node_'s tag name is ``script``, then yield until there
         are no pending import loads, then execute the script given by
         the element's contents.
 3. Yield until there are no pending import loads.
 3. Fire a ``load`` event at the _parsing context_ object.