From 78c6e77a0b98332a62f755c64ddb85b1fa0ac77f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Thu, 7 May 2026 12:23:18 +0200
Subject: [PATCH 1/5] fix: inject placeholder src/alt on `<img ...attributes>`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a thin wrapper component renders `<img ...attributes>` and the
consumer supplies src/alt via the splat, the blanker erased
`...attributes` and html-validate then saw an attribute-less <img>,
FP-firing `element-required-attributes` (src) and `wcag/h37` (alt).
At runtime the splat provides them.

Symmetric to the existing `tryInjectInputType` (blank.ts:670) for
`<input type=' '>`: when `<img>` has `...attributes`, inject
whitespace-valued `src='   '` and `alt='   '` placeholders into
Glimmer-only blank regions in the open tag. processAttribute's
DynamicValue conversion (length>=3 + all-whitespace) then surfaces
them as "present, value unknowable".

Trade-off on slot space: minimal `<img ...attributes>` has only one
13-char Glimmer-only slot (the splat) which fits one 9-char
placeholder. Real-world usually has additional Glimmer-only
attrs/modifiers (an @arg, a {{on …}}) that provide enough room for
both src and alt. Tests cover both cases.

Surfaced by ecosystem CI on super-rentals (rental/image.gjs).
---
 blank.ts           | 54 ++++++++++++++++++++++++++++++++++++++++++++++
 test/blank.test.ts | 32 +++++++++++++++++++++++++++
 2 files changed, 86 insertions(+)

diff --git a/blank.ts b/blank.ts
index d161cc2..ef3d960 100644
--- a/blank.ts
+++ b/blank.ts
@@ -667,6 +667,54 @@ function substituteSelfClosingVoidComponent(
 //
 // No-op when no suitable attr area is found — `no-implicit-input-type`
 // will still fire in that case, but the user can silence per-site.
+
+// Symmetric to tryInjectInputType but for void natives whose required attrs
+// can be supplied by the consumer via `...attributes`. Without injection,
+// `<img ...attributes>` blanks to an attribute-less `<img>` and html-validate
+// FP-fires `element-required-attributes` (src) and `wcag/h37` (alt) even
+// though both come from the splat at runtime.
+//
+// Injects whitespace-valued placeholders (`src='   '` / `alt='   '`) into
+// Glimmer-only blank regions in the open tag; `processAttribute`'s
+// DynamicValue conversion (>=3-char whitespace threshold) then surfaces them
+// as "present, value unknowable". Skipped when the consumer already wrote
+// `src=` / `alt=` explicitly.
+//
+// Currently scoped to <img>; the same shape applies to
+// <source>/<track>/<area>/<iframe> if real-world FPs surface there.
+function tryInjectImgRequiredAttrs(node: AST.ElementNode, ctx: Context): void {
+  const hasSplat = (node.attributes ?? []).some((a) => a.name === '...attributes');
+  if (!hasSplat) return;
+  const present = new Set((node.attributes ?? []).map((a) => a.name));
+  const wanted: string[] = [];
+  if (!present.has('src')) wanted.push("src='   '");
+  if (!present.has('alt')) wanted.push("alt='   '");
+  if (wanted.length === 0) return;
+  const candidates: Range[] = [];
+  for (const attr of node.attributes ?? []) {
+    if (isGlimmerOnlyAttr(attr.name)) {
+      candidates.push([startOffset(attr), endOffset(attr)]);
+    }
+  }
+  for (const m of node.modifiers ?? []) {
+    candidates.push([startOffset(m), endOffset(m)]);
+  }
+  // Sort wider candidates first so the longest replacement gets the longest
+  // slot — matches tryInjectComponentAttrs's anti-starvation ordering.
+  candidates.sort((a, b) => b[1] - b[0] - (a[1] - a[0]));
+  for (const text of wanted) {
+    for (let i = 0; i < candidates.length; i++) {
+      const [s, e] = candidates[i]!;
+      if (e - s < text.length) continue;
+      const slice = ctx.content.slice(s, s + text.length);
+      if (/[\n\r]/.test(slice)) continue;
+      ctx.renames.push([s, s + text.length, text]);
+      candidates.splice(i, 1);
+      break;
+    }
+  }
+}
+
 function tryInjectInputType(node: AST.ElementNode, ctx: Context): void {
   const literalType = lookupComponentAttr(node, ctx, 'type');
   // Build the injected text. Prefer a literal value when known and
@@ -1018,6 +1066,12 @@ function handleElementNode(node: AST.ElementNode, ctx: Context): void {
   if (elementHasDynamicContent(node)) {
     ctx.dynamicContentOffsets.push(start);
   }
+  // For void natives whose required attrs can come from `...attributes`,
+  // inject placeholders before the splat is blanked. Currently <img>; see
+  // tryInjectImgRequiredAttrs for the rationale and scope.
+  if (effectiveTag === 'img') {
+    tryInjectImgRequiredAttrs(node, ctx);
+  }
   for (const attr of node.attributes ?? []) {
     emitAttribute(attr, ctx, effectiveTag);
   }
diff --git a/test/blank.test.ts b/test/blank.test.ts
index 939fc6c..ffa494f 100644
--- a/test/blank.test.ts
+++ b/test/blank.test.ts
@@ -91,6 +91,38 @@ describe('mustache blanking', () => {
     expect(out.content).toHaveLength(src.length);
     expect(out.content).not.toContain('...attributes');
   });
+
+  it('injects placeholder src on minimal `<img ...attributes>` (single slot fits one attr)', () => {
+    // `<img ...attributes>` in a thin wrapper component (parent supplies
+    // src via splat) was FP-firing `element-required-attributes` (src).
+    // The blanker erases `...attributes`, leaving an attr-less `<img>`.
+    // Inject a whitespace-valued `src='   '` placeholder (≥3 chars
+    // triggers `processAttribute`'s DynamicValue conversion) so
+    // html-validate sees src as "present, value unknowable".
+    //
+    // The minimal `...attributes` slot is 13 chars; a placeholder attr
+    // (`src='   '`) is 9 chars. Only one attr fits per slot — alt
+    // gets injected when a second Glimmer-only slot exists (test below).
+    const src = '<img ...attributes>';
+    const out = blank(src);
+    expect(out.content).toHaveLength(src.length);
+    expect(
+      out.content,
+      `expected blanked output to contain a placeholder src= attribute; got: ${JSON.stringify(out.content)}`,
+    ).toMatch(/src='\s+'/);
+  });
+
+  it('injects both src and alt on `<img>` when there are multiple Glimmer-only slots', () => {
+    // Real-world `<img>` invocations usually have multiple Glimmer-only
+    // attrs/modifiers alongside `...attributes` (an `@arg` for typing,
+    // a `{{on "load" …}}` for lazy-loaded images, etc.) — enough total
+    // space for both `src='   '` and `alt='   '` placeholders.
+    const src = '<img @loading="lazy" {{on "load" this.h}} ...attributes>';
+    const out = blank(src);
+    expect(out.content).toHaveLength(src.length);
+    expect(out.content).toMatch(/src='\s+'/);
+    expect(out.content).toMatch(/alt='\s+'/);
+  });
 });
 
 describe('component substitution (transparent fallback)', () => {

From 22e1e2b2c4799cf0c928ebfd0c57e1c1d3d61b8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Thu, 7 May 2026 14:36:22 +0200
Subject: [PATCH 2/5] Address review: clarify slot-sort comment in
 tryInjectImgRequiredAttrs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per Copilot review on #13: the comment claimed parity with
tryInjectComponentAttrs's anti-starvation strategy, but the code only
sorted the candidate slots, not the wanted attrs. Adjusted the comment
to describe what the code actually does — slot-side widest-first.
The wanted-side sort isn't needed because src/alt placeholders are
both 9 chars, so neither attr can starve the other.
---
 blank.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/blank.ts b/blank.ts
index ef3d960..a61c9e2 100644
--- a/blank.ts
+++ b/blank.ts
@@ -699,8 +699,12 @@ function tryInjectImgRequiredAttrs(node: AST.ElementNode, ctx: Context): void {
   for (const m of node.modifiers ?? []) {
     candidates.push([startOffset(m), endOffset(m)]);
   }
-  // Sort wider candidates first so the longest replacement gets the longest
-  // slot — matches tryInjectComponentAttrs's anti-starvation ordering.
+  // Sort candidates widest first. Both injected attrs (`src='   '` and
+  // `alt='   '`) are 9 chars, so picking the widest candidate first
+  // doesn't starve a later attr. This is a slot-side ordering only;
+  // tryInjectComponentAttrs additionally sorts the *attrs* by descending
+  // text length to prevent starvation when attrs have varying widths —
+  // not needed here because both wanted attrs are the same length.
   candidates.sort((a, b) => b[1] - b[0] - (a[1] - a[0]));
   for (const text of wanted) {
     for (let i = 0; i < candidates.length; i++) {

From 0daf3fd9d66f5527be15af5f74b9633b443c0950 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Thu, 7 May 2026 15:12:27 +0200
Subject: [PATCH 3/5] Address review: regression test for
 skip-when-already-present

Per Copilot review on #13: the no-injection-when-already-present
behavior was implemented but only positive cases were tested. Added
a test asserting that <img src="..." alt="..." ...attributes> keeps
the consumer's explicit values and produces no injected placeholders.
Guards against a regression that would emit duplicate attributes.
---
 test/blank.test.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/test/blank.test.ts b/test/blank.test.ts
index ffa494f..7bfa25e 100644
--- a/test/blank.test.ts
+++ b/test/blank.test.ts
@@ -123,6 +123,23 @@ describe('mustache blanking', () => {
     expect(out.content).toMatch(/src='\s+'/);
     expect(out.content).toMatch(/alt='\s+'/);
   });
+
+  it('does not inject placeholder src/alt when the consumer wrote them explicitly', () => {
+    // When the consumer's invocation already specifies src/alt (statically
+    // or via a bare-mustache value), the injection must skip — duplicate
+    // attributes are an error, and the consumer's value is what we want
+    // html-validate to see.
+    const src = '<img src="/foo.png" alt="bar" {{on "load" this.h}} ...attributes>';
+    const out = blank(src);
+    expect(out.content).toHaveLength(src.length);
+    // Original literal values survive.
+    expect(out.content).toContain('src="/foo.png"');
+    expect(out.content).toContain('alt="bar"');
+    // No injected `src='   '` / `alt='   '` placeholder anywhere — the
+    // splat slot stays blanked instead.
+    expect(out.content).not.toMatch(/src='\s+'/);
+    expect(out.content).not.toMatch(/alt='\s+'/);
+  });
 });
 
 describe('component substitution (transparent fallback)', () => {

From e453e5ac4f35f2ed4e4aad7bff477c7a56e3aba9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Thu, 7 May 2026 15:44:38 +0200
Subject: [PATCH 4/5] Address review: tighten img placeholder regexes to match
 DynamicValue threshold

Per Copilot review on #13: \\s+ would pass with 1-2 spaces, but
processAttribute requires >= 3 whitespace chars to convert to
DynamicValue. Tightened all five toMatch/.not.toMatch checks for
src/alt placeholders to \\s{3,} so a regression to a shorter
placeholder fails the test instead of silently breaking the
DynamicValue conversion.
---
 test/blank.test.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/test/blank.test.ts b/test/blank.test.ts
index 7bfa25e..c82cffd 100644
--- a/test/blank.test.ts
+++ b/test/blank.test.ts
@@ -109,7 +109,7 @@ describe('mustache blanking', () => {
     expect(
       out.content,
       `expected blanked output to contain a placeholder src= attribute; got: ${JSON.stringify(out.content)}`,
-    ).toMatch(/src='\s+'/);
+    ).toMatch(/src='\s{3,}'/);
   });
 
   it('injects both src and alt on `<img>` when there are multiple Glimmer-only slots', () => {
@@ -120,8 +120,8 @@ describe('mustache blanking', () => {
     const src = '<img @loading="lazy" {{on "load" this.h}} ...attributes>';
     const out = blank(src);
     expect(out.content).toHaveLength(src.length);
-    expect(out.content).toMatch(/src='\s+'/);
-    expect(out.content).toMatch(/alt='\s+'/);
+    expect(out.content).toMatch(/src='\s{3,}'/);
+    expect(out.content).toMatch(/alt='\s{3,}'/);
   });
 
   it('does not inject placeholder src/alt when the consumer wrote them explicitly', () => {
@@ -137,8 +137,8 @@ describe('mustache blanking', () => {
     expect(out.content).toContain('alt="bar"');
     // No injected `src='   '` / `alt='   '` placeholder anywhere — the
     // splat slot stays blanked instead.
-    expect(out.content).not.toMatch(/src='\s+'/);
-    expect(out.content).not.toMatch(/alt='\s+'/);
+    expect(out.content).not.toMatch(/src='\s{3,}'/);
+    expect(out.content).not.toMatch(/alt='\s{3,}'/);
   });
 });
 

From 145b19c63ddb9e7bbc81891369b680bc7dbd9626 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Thu, 7 May 2026 22:12:20 +0200
Subject: [PATCH 5/5] Inject required <img ...attributes> attrs via
 processElement hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous source-rewrite approach in `tryInjectImgRequiredAttrs`
could only inject ONE 9-char `attr='   '` placeholder per
Glimmer-only slot. For the minimal pattern `<img ...attributes>`
(only one slot, 13 chars wide) that meant `src='   '` was injected
but `alt` was not — and wcag/h37 FP-fired on the missing alt.
Surfaced by ecosystem CI on super-rentals' `rental/image.gjs`.

No two-attr form fits in 13 chars that html-validate accepts:
- bare `src alt` triggers attribute-allowed-values-missing-value
- empty quoted `src=''` triggers attribute-allowed-values-invalid
- the wide whitespace form `src='   ' alt='   '` is 19+ chars

Switched to hook-time injection. The blanker now records each
`<img ...attributes>` element's start offset (when src or alt is
not consumer-written) on a new `BlankResult.imgSplatOffsets` field.
The transformer's `processElement` hook reads that set and calls
`setAttribute('src'/'alt', new DynamicValue(''), location, location)`
on the parsed element, sidestepping source-side slot widths
entirely. Per-attr presence is checked in the hook so a partially
consumer-written invocation (e.g. only `src=` written) still
synthesizes the missing one.

New regression fixture `examples/img-splat-thin-wrapper.gjs`
mirrors the super-rentals pattern; integration test asserts neither
wcag/h37 nor element-required-attributes fires.

Existing unit tests rewritten to assert the offset-recording
behavior (instead of the old source-rewrite output).

132/132 pass.
---
 blank.ts                            | 61 ++++++++++++----------------
 examples/img-splat-thin-wrapper.gjs | 13 ++++++
 test/blank.test.ts                  | 62 ++++++++++++++++-------------
 test/integration.test.ts            | 18 +++++++++
 transform.ts                        | 44 ++++++++++++++++++--
 5 files changed, 131 insertions(+), 67 deletions(-)
 create mode 100644 examples/img-splat-thin-wrapper.gjs

diff --git a/blank.ts b/blank.ts
index a61c9e2..88a4018 100644
--- a/blank.ts
+++ b/blank.ts
@@ -477,6 +477,7 @@ interface Context {
   renames: Array<[number, number, string]>;
   fullyBlankedRanges: Range[];
   dynamicContentOffsets: number[];
+  imgSplatOffsets: number[];
   effectiveComponentAttrMap?: Map<string, ComponentAttrs>;
   // When set, `handleBlockStatement` uses the selection from this map
   // (keyed by the BlockStatement's source-start offset) instead of the
@@ -674,11 +675,17 @@ function substituteSelfClosingVoidComponent(
 // FP-fires `element-required-attributes` (src) and `wcag/h37` (alt) even
 // though both come from the splat at runtime.
 //
-// Injects whitespace-valued placeholders (`src='   '` / `alt='   '`) into
-// Glimmer-only blank regions in the open tag; `processAttribute`'s
-// DynamicValue conversion (>=3-char whitespace threshold) then surfaces them
-// as "present, value unknowable". Skipped when the consumer already wrote
-// `src=` / `alt=` explicitly.
+// We don't rewrite the source — the minimal `...attributes` slot is 13
+// chars and html-validate accepts no two-attr form that fits (bare
+// `src alt` triggers `attribute-allowed-values`-missing-value, empty
+// quoted `src=''` triggers `attribute-allowed-values`-invalid-value,
+// and the wide whitespace form `src='   ' alt='   '` is 19+ chars).
+//
+// Instead, record the element's start offset; the transformer's
+// `processElement` hook reads this list and calls `setAttribute` with
+// a DynamicValue at parse time, sidestepping source-side slot width
+// entirely. Skipped when the consumer already wrote `src=` / `alt=`
+// explicitly (no FP to suppress).
 //
 // Currently scoped to <img>; the same shape applies to
 // <source>/<track>/<area>/<iframe> if real-world FPs surface there.
@@ -686,37 +693,8 @@ function tryInjectImgRequiredAttrs(node: AST.ElementNode, ctx: Context): void {
   const hasSplat = (node.attributes ?? []).some((a) => a.name === '...attributes');
   if (!hasSplat) return;
   const present = new Set((node.attributes ?? []).map((a) => a.name));
-  const wanted: string[] = [];
-  if (!present.has('src')) wanted.push("src='   '");
-  if (!present.has('alt')) wanted.push("alt='   '");
-  if (wanted.length === 0) return;
-  const candidates: Range[] = [];
-  for (const attr of node.attributes ?? []) {
-    if (isGlimmerOnlyAttr(attr.name)) {
-      candidates.push([startOffset(attr), endOffset(attr)]);
-    }
-  }
-  for (const m of node.modifiers ?? []) {
-    candidates.push([startOffset(m), endOffset(m)]);
-  }
-  // Sort candidates widest first. Both injected attrs (`src='   '` and
-  // `alt='   '`) are 9 chars, so picking the widest candidate first
-  // doesn't starve a later attr. This is a slot-side ordering only;
-  // tryInjectComponentAttrs additionally sorts the *attrs* by descending
-  // text length to prevent starvation when attrs have varying widths —
-  // not needed here because both wanted attrs are the same length.
-  candidates.sort((a, b) => b[1] - b[0] - (a[1] - a[0]));
-  for (const text of wanted) {
-    for (let i = 0; i < candidates.length; i++) {
-      const [s, e] = candidates[i]!;
-      if (e - s < text.length) continue;
-      const slice = ctx.content.slice(s, s + text.length);
-      if (/[\n\r]/.test(slice)) continue;
-      ctx.renames.push([s, s + text.length, text]);
-      candidates.splice(i, 1);
-      break;
-    }
-  }
+  if (present.has('src') && present.has('alt')) return;
+  ctx.imgSplatOffsets.push(startOffset(node));
 }
 
 function tryInjectInputType(node: AST.ElementNode, ctx: Context): void {
@@ -1228,12 +1206,21 @@ export interface BlankResult {
   content: string;
   error: Error | null;
   dynamicContentOffsets: number[];
+  // Offsets of `<img ...attributes>` elements (start of `<` byte) where
+  // the consumer-side `...attributes` is expected to provide required
+  // attrs (src/alt) at runtime. The transformer's processElement hook
+  // synthesizes these attrs as DynamicValue at parse-time so html-
+  // validate sees them as "present, value unknowable" — sidesteps the
+  // narrow-slot problem where source-side rewrite can't fit two 9-char
+  // `attr='   '` placeholders into a 13-char `...attributes` slot.
+  imgSplatOffsets: number[];
 }
 
 export interface BlankErrorResult {
   content: string;
   error: Error;
   dynamicContentOffsets?: undefined;
+  imgSplatOffsets?: undefined;
 }
 
 function blankTemplateContent(
@@ -1271,6 +1258,7 @@ function blankTemplateContent(
     renames: [],
     fullyBlankedRanges: [],
     dynamicContentOffsets: [],
+    imgSplatOffsets: [],
     branchSelections,
     inFullyBlankedRange(offset: number): boolean {
       for (const [s, e] of ctx.fullyBlankedRanges) {
@@ -1333,6 +1321,7 @@ function blankTemplateContent(
     content: buf.join(''),
     error: null,
     dynamicContentOffsets: ctx.dynamicContentOffsets,
+    imgSplatOffsets: ctx.imgSplatOffsets,
   };
 }
 
diff --git a/examples/img-splat-thin-wrapper.gjs b/examples/img-splat-thin-wrapper.gjs
new file mode 100644
index 0000000..14e1cfc
--- /dev/null
+++ b/examples/img-splat-thin-wrapper.gjs
@@ -0,0 +1,13 @@
+// Thin <img> wrapper: parent provides src + alt via `...attributes`.
+// Mirrors the super-rentals `rental/image.gjs` pattern that surfaced
+// the narrow-slot FP — a single `...attributes` slot can't fit two
+// 9-char `attr='   '` placeholders, so prior versions only synthesized
+// `src` source-side and wcag/h37 / element-required-attributes (alt)
+// FP-fired. The hook-time injection sidesteps the slot-width problem.
+import Component from '@glimmer/component';
+
+export default class ThinImg extends Component {
+  <template>
+    <img ...attributes>
+  </template>
+}
diff --git a/test/blank.test.ts b/test/blank.test.ts
index c82cffd..591b1a3 100644
--- a/test/blank.test.ts
+++ b/test/blank.test.ts
@@ -92,53 +92,59 @@ describe('mustache blanking', () => {
     expect(out.content).not.toContain('...attributes');
   });
 
-  it('injects placeholder src on minimal `<img ...attributes>` (single slot fits one attr)', () => {
+  it('records `<img ...attributes>` start offset for hook-time src/alt injection', () => {
     // `<img ...attributes>` in a thin wrapper component (parent supplies
-    // src via splat) was FP-firing `element-required-attributes` (src).
-    // The blanker erases `...attributes`, leaving an attr-less `<img>`.
-    // Inject a whitespace-valued `src='   '` placeholder (≥3 chars
-    // triggers `processAttribute`'s DynamicValue conversion) so
-    // html-validate sees src as "present, value unknowable".
+    // src AND alt via splat). The blanker erases `...attributes` to
+    // whitespace; the transformer's `processElement` hook is responsible
+    // for synthesizing src and alt as DynamicValue at parse time. Here
+    // we just assert that the offset is recorded so the hook knows
+    // which `<img>` to augment.
     //
-    // The minimal `...attributes` slot is 13 chars; a placeholder attr
-    // (`src='   '`) is 9 chars. Only one attr fits per slot — alt
-    // gets injected when a second Glimmer-only slot exists (test below).
+    // Why hook-time (not source-rewrite): the minimal `...attributes`
+    // slot is 13 chars, but no two-attr form html-validate accepts fits
+    // (bare `src alt` triggers attribute-allowed-values-missing-value;
+    // empty quoted `src=''` triggers attribute-allowed-values-invalid;
+    // wide `src='   ' alt='   '` is 19+ chars). Hook-time setAttribute
+    // bypasses the slot-width problem.
     const src = '<img ...attributes>';
     const out = blank(src);
     expect(out.content).toHaveLength(src.length);
+    expect(out.content).not.toContain('...attributes');
     expect(
-      out.content,
-      `expected blanked output to contain a placeholder src= attribute; got: ${JSON.stringify(out.content)}`,
-    ).toMatch(/src='\s{3,}'/);
+      out.imgSplatOffsets,
+      `expected the <img ...attributes> offset to be recorded for hook-time injection`,
+    ).toEqual([0]);
   });
 
-  it('injects both src and alt on `<img>` when there are multiple Glimmer-only slots', () => {
-    // Real-world `<img>` invocations usually have multiple Glimmer-only
-    // attrs/modifiers alongside `...attributes` (an `@arg` for typing,
-    // a `{{on "load" …}}` for lazy-loaded images, etc.) — enough total
-    // space for both `src='   '` and `alt='   '` placeholders.
+  it('records the offset even when there are multiple Glimmer-only slots', () => {
+    // Real-world `<img>` invocations often have @args / {{on …}} alongside
+    // `...attributes`. The hook still needs to know about this img so it
+    // can synthesize src/alt — same mechanism regardless of slot count.
     const src = '<img @loading="lazy" {{on "load" this.h}} ...attributes>';
     const out = blank(src);
     expect(out.content).toHaveLength(src.length);
-    expect(out.content).toMatch(/src='\s{3,}'/);
-    expect(out.content).toMatch(/alt='\s{3,}'/);
+    expect(out.imgSplatOffsets).toEqual([0]);
   });
 
-  it('does not inject placeholder src/alt when the consumer wrote them explicitly', () => {
-    // When the consumer's invocation already specifies src/alt (statically
-    // or via a bare-mustache value), the injection must skip — duplicate
-    // attributes are an error, and the consumer's value is what we want
-    // html-validate to see.
+  it('does not record offset when the consumer wrote both src and alt explicitly', () => {
+    // When src AND alt are both already on the element, no injection is
+    // needed — leave the offset out of the set so the hook skips it.
     const src = '<img src="/foo.png" alt="bar" {{on "load" this.h}} ...attributes>';
     const out = blank(src);
     expect(out.content).toHaveLength(src.length);
     // Original literal values survive.
     expect(out.content).toContain('src="/foo.png"');
     expect(out.content).toContain('alt="bar"');
-    // No injected `src='   '` / `alt='   '` placeholder anywhere — the
-    // splat slot stays blanked instead.
-    expect(out.content).not.toMatch(/src='\s{3,}'/);
-    expect(out.content).not.toMatch(/alt='\s{3,}'/);
+    expect(out.imgSplatOffsets).toEqual([]);
+  });
+
+  it('records offset when only ONE of src/alt is consumer-written (other still synthesized)', () => {
+    // When the consumer wrote only `src=` but not `alt=`, alt still needs
+    // synthesis — record the offset; the hook checks per-attr presence
+    // and synthesizes only the missing one.
+    const src = '<img src="/foo.png" {{on "load" this.h}} ...attributes>';
+    const out = blank(src);
+    expect(out.imgSplatOffsets).toEqual([0]);
   });
 });
 
diff --git a/test/integration.test.ts b/test/integration.test.ts
index e69143b..0d76cf1 100644
--- a/test/integration.test.ts
+++ b/test/integration.test.ts
@@ -156,6 +156,24 @@ describe('end-to-end fixtures', () => {
     expect(r.valid).toBe(true);
   });
 
+  it('img-splat-thin-wrapper: `<img ...attributes>` does not FP-fire wcag/h37 or element-required-attributes', async () => {
+    // Thin <img> wrapper component — parent provides src + alt via the
+    // splat. The `...attributes` slot is 13 chars, too narrow to source-
+    // rewrite both 9-char `attr='   '` placeholders. Hook-time setAttribute
+    // synthesizes src + alt as DynamicValue at parse time so wcag/h37
+    // (missing alt) and element-required-attributes (missing src) don't
+    // fire on what the consumer actually fills in. Mirrors super-rentals'
+    // `rental/image.gjs`.
+    const r = await validate('img-splat-thin-wrapper.gjs', { 'void-style': 'off' });
+    const offenders = r.messages.filter(
+      (m) => m.rule === 'wcag/h37' || m.rule === 'element-required-attributes',
+    );
+    expect(
+      offenders,
+      `wcag/h37 / element-required-attributes must not fire on <img ...attributes>; got: ${JSON.stringify(r.messages)}`,
+    ).toHaveLength(0);
+  });
+
   it('linkto-aria-label: aria-label on <LinkTo> does not fire aria-label-misuse', async () => {
     // <LinkTo> is substituted to <a> via the built-in components map,
     // and block-form substitution injects an href placeholder so the
diff --git a/transform.ts b/transform.ts
index 5daa548..cc7a4de 100644
--- a/transform.ts
+++ b/transform.ts
@@ -118,7 +118,11 @@ function offsetToLineCol(source: string, offset: number): { line: number; column
   return { line, column };
 }
 
-function makeHooks(dynamicSet: ReadonlySet<number>, startOffset: number): SourceHooks {
+function makeHooks(
+  dynamicSet: ReadonlySet<number>,
+  imgSplatSet: ReadonlySet<number>,
+  startOffset: number,
+): SourceHooks {
   const processAttribute: ProcessAttributeCallback = (attr: AttributeData) => {
     // Bare-mustache attribute values (`id={{x}}`) are emitted as
     // `id="<spaces>"` (see blank.ts). Detect that pattern and replace
@@ -150,6 +154,32 @@ function makeHooks(dynamicSet: ReadonlySet<number>, startOffset: number): Source
         location,
       );
     }
+    // Inject required attrs synthetically for `<img ...attributes>`.
+    // The blanker erases `...attributes` from the source but records
+    // the element's start offset; we honor that here by adding a
+    // DynamicValue-backed `src` and/or `alt` if the consumer didn't
+    // already write them. Sidesteps the source-side slot-width
+    // problem (a 13-char `...attributes` slot can't fit two valid
+    // `attr=value` placeholders that html-validate accepts).
+    if (
+      imgSplatSet.has(templateRelativeOffset) &&
+      (el as unknown as { tagName?: string }).tagName === 'img'
+    ) {
+      const elWithAttrs = el as unknown as {
+        hasAttribute(name: string): boolean;
+        setAttribute(
+          name: string,
+          value: unknown,
+          keyLocation: unknown,
+          valueLocation: unknown,
+        ): void;
+      };
+      for (const name of ['src', 'alt']) {
+        if (!elWithAttrs.hasAttribute(name)) {
+          elWithAttrs.setAttribute(name, new DynamicValue(''), location, location);
+        }
+      }
+    }
   };
 
   return { processAttribute, processElement };
@@ -192,7 +222,11 @@ function* transformGlimmer(source: Source): Generator<Source, void, unknown> {
       column: 1,
       offset: 0,
       originalData,
-      hooks: makeHooks(new Set(result.dynamicContentOffsets ?? []), 0),
+      hooks: makeHooks(
+        new Set(result.dynamicContentOffsets ?? []),
+        new Set(result.imgSplatOffsets ?? []),
+        0,
+      ),
     };
     return;
   }
@@ -311,7 +345,11 @@ function* transformGlimmer(source: Source): Generator<Source, void, unknown> {
         column: sourceColumn,
         offset: sourceOffset,
         originalData,
-        hooks: makeHooks(new Set(result.dynamicContentOffsets ?? []), startOffset),
+        hooks: makeHooks(
+          new Set(result.dynamicContentOffsets ?? []),
+          new Set(result.imgSplatOffsets ?? []),
+          startOffset,
+        ),
       };
     }
   }