diff --git a/.changeset/loud-attr-html-comments.md b/.changeset/loud-attr-html-comments.md
new file mode 100644
index 00000000000..6c2595b84ed
--- /dev/null
+++ b/.changeset/loud-attr-html-comments.md
@@ -0,0 +1,5 @@
+---
+"@marko/runtime-tags": patch
+---
+
+Add a cheat sheet `DON'T` row for an HTML comment written inside a tag's attributes, pointing at `/* … */` instead.
diff --git a/agent-feedback/dx.md b/agent-feedback/dx.md
index 1739b89431f..295a9a5cb7f 100644
--- a/agent-feedback/dx.md
+++ b/agent-feedback/dx.md
@@ -85,3 +85,9 @@ After resume `$global` holds only `{runtimeId, renderId}` unless a key is enable
 `packages/runtime-tags/src/translator/core/script.ts` › default export | 2026-08-10 | impact:high | effort:med
 
 A `<script>` re-runs when any binding it references changes, and an assignment like `items = items.filter(...)` inside that same script produces a new array identity on every run — so the script re-triggers itself forever. In a real app the loop sat inside a data loader (`openIds = openIds.filter(id => list.some(...))` after a fetch), yielding an unbounded three-requests-per-cycle fetch loop that only surfaced as the browser's `ERR_INSUFFICIENT_RESOURCES`, far from the cause; the fix was guarding the assignment behind a length comparison to preserve identity. The hazard is statically visible: the script's body both reads a binding and unconditionally assigns it an expression guaranteed to be a fresh object identity (array/object literal, `.filter`/`.map`/`.concat`/spread). Warn on that shape, pointing at identity-preserving guards or `<const>`. Re-verify: mount `<let/items=[[]]>` with `<script>items = items.filter(Boolean); console.count("run")</script>` in jsdom — the counter never stops.
+
+## Flatten `.mocharc.json`'s `node-option` array so serial runs get `--experimental-vm-modules`
+
+`.mocharc.json` › `node-option` | 2026-08-14 | impact:med | effort:low
+
+The documented scoped-run command (root `CLAUDE.md`, `pnpm test -- --grep "runtime-tags/translator <fixture> "`) drops every entry in `.mocharc.json`'s `node-option` array on Node 26 + mocha 11, so any fixture with an `ssr` case fails with `TypeError: vm.SourceTextModule is not a constructor` and the suppressed `MODULE_TYPELESS_PACKAGE_JSON` warnings reappear. `.mocharc.parallel.json` spells the same flags as top-level booleans (`"experimental-vm-modules": true`) and is honored, which is why `pnpm run test:parallel` and CI pass and only the serial path breaks — an agent iterating on one fixture sees a failure that has nothing to do with its change. Rewrite the array as top-level keys to match the parallel config. Re-verify: `pnpm exec mocha --config .mocharc.all.json --grep "runtime-tags/translator html-comment-counter"` fails, and the same command under `NODE_OPTIONS="--experimental-vm-modules"` passes.
diff --git a/packages/runtime-tags/cheatsheet.md b/packages/runtime-tags/cheatsheet.md
index 517a6c1fac7..b2139649dc9 100644
--- a/packages/runtime-tags/cheatsheet.md
+++ b/packages/runtime-tags/cheatsheet.md
@@ -196,6 +196,7 @@ Each left-hand habit is an error or silently wrong.
 | ----------------------------------------------------------- | ------------------------------------------------------------------------------------ |
 | `disabled=n>=8` (hugging `>` in a value)                    | `disabled=n >= 8` or `disabled=(n >= 8)`; a hugging `>` silently closes the tag      |
 | `<let/s=new Set<string>()>` (type argument in a value)      | `<let/s=(new Set<string>())>`; a tag-var annotation fails type-check                 |
+| `<div <!-- note --> class="a">` (comment in the attributes) | `<div /* note */ class="a">`; `<!-- … -->` is markup, so it only belongs in a body   |
 | `{expr}` in markup, `className`, `key=`, `style={{...}}`    | `${expr}`, `class`, `by=` on `<for>`, `style={...}`                                  |
 | `onClick={() => ...}` / `@click` / `on-click("name")`       | `onClick() { ... }`                                                                  |
 | `const [x, setX] = useState()` / `state` / `class {}` block | `<let/x=0>` then `x = 1`                                                             |