diff --git a/.agents/skills/webjs/references/components.md b/.agents/skills/webjs/references/components.md
index 2885edeb3..340d8eb5c 100644
--- a/.agents/skills/webjs/references/components.md
+++ b/.agents/skills/webjs/references/components.md
@@ -30,7 +30,7 @@ Most of what follows restates widely held component-model advice, ported. Lit's
 
 **4. ARIA state is a hole in `render()`, derived from the same state that drives behaviour.** `aria-expanded=${this.open ? 'true' : 'false'}` cannot disagree with `this.open`. A second function that re-finds the button and calls `setAttribute` can, and does, the first time someone adds a close path that forgets to call it. The same holds for `class`, `?disabled`, and any `.prop`. Two caveats ride this rule:
 
-- Write the string explicitly for a tri-state ARIA attribute. A plain-attribute hole holding `false` serves `aria-expanded="false"` from the server and hydrates to NO attribute, because the client removes an attribute for `null` / `undefined` / `false` while the server stringifies it. `?attr=${bool}` is not a substitute, since a boolean binding omits the attribute in BOTH renderers.
+- A plain-attribute hole follows one rule on the server and the client (#1573): `null` / `undefined` omit the attribute, `false` omits it except on an `aria-*` name, where it is written as `"false"`. So `aria-expanded=${this.open}` serves `"true"` / `"false"` and hydrates unchanged, and `aria-current=${active ? 'page' : null}` omits the attribute on an inactive link. `?attr=${bool}` is not a substitute for a tri-state ARIA attribute, since a boolean binding omits the attribute when false.
 - A hole commits on the next render, one microtask later. The one place a direct write is still correct is a synchronous snapshot read such as `webjs:before-cache`, where the router reads `outerHTML` in the same task. That is a documented exception, not the normal path.
 
 **5. Behaviour needs an importable surface, or its test is a copy of it.** An inline `<script>` in a layout has no module identity, so a browser test cannot import it. It can only transcribe the listener into the test file and assert against the transcription, which then needs a SECOND test to grep the original for drift. Two tests, neither running shipping code. A component is importable, so its browser test mounts the real element and drives real events. A page or layout may still carry an inline `<script>`, but only for pre-paint boot work no module can do: reading a stored theme before first paint so the wrong palette never flashes, or measuring the header height into a CSS custom property. It must not be interactivity, and WHERE it sits decides how often it runs. The ROOT layout's markup sits OUTSIDE every swap range, so a soft navigation does not re-run its script, which is what makes it the right home for boot work and the wrong home for anything that has to respond to a later navigation. A page or a NESTED layout sits inside the swap range instead, so its script re-executes on every navigation that swaps that range (#1102), which means it has to be idempotent or guard on a flag it sets the first time. Neither shape gives you a listener that simply works, which is what a custom element is for. Under an opt-in CSP the script also needs the nonce from `cspNonce()`. `client-router-and-streaming.md` carries the full re-execution rule.
diff --git a/.agents/skills/webjs/references/muscle-memory-gotchas.md b/.agents/skills/webjs/references/muscle-memory-gotchas.md
index 2318ab373..0893c555f 100644
--- a/.agents/skills/webjs/references/muscle-memory-gotchas.md
+++ b/.agents/skills/webjs/references/muscle-memory-gotchas.md
@@ -174,7 +174,7 @@ html`<form action=${submitFeedback}><input name="email"></form>`;
 html`<form method="post"><input name="email"></form>`;
 ```
 
-A hole that resolves to `null` is NOT the same as omitting the attribute. `method=${null}` renders `method=""`, which cannot submit and is refused; `?method=${false}` emits nothing at all, so WebJs supplies `method="post"` and the form works. Both leave no attribute in the DOM, which is exactly why the check reads your template rather than the rendered element.
+A plain attribute hole that resolves to `null` or `undefined` omits the attribute on both renderers (#1573), so `method=${null}` and `?method=${false}` both emit nothing and WebJs supplies `method="post"`. An EMPTY string is different: `method=${''}` renders `method=""`, which cannot submit and is refused.
 
 A string stays a string: `action="/search"` and `action=${'/search'}` are unchanged, which is what a search form (`<form method="get" action="/search">`) and a `route.ts` endpoint both want. Other attributes keep their existing stringify behaviour; only a FUNCTION under `action` / `formaction` is claimed.
 
diff --git a/AGENTS.md b/AGENTS.md
index b7236f479..d3fc40863 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -289,7 +289,7 @@ lit-html parity: `repeat` (keyed lists), `unsafeHTML(str)` (trusted raw HTML, **
 
 ### `html` expression prefixes
 
-`<div>${x}</div>` text child; `class=${x}` attribute (escaped); `action=${importedAction}` on a `<form>` or `formaction=${importedAction}` on a submitter binds a server action (#1155, #1207, #1307: the function-valued attribute holes where the attribute is omitted/rewritten and a `__webjs_action` identity is emitted, plus `formmethod` / `formenctype` on a bound submitter so it needs no bound form around it; submitters must be actual submit controls and cannot carry their own `name`, `value`, `form`, or static `formaction` attributes; a quoted `action="${fn}"` / `formaction="${fn}"` or `action=${fn}` on un-supported tags is a render error, since stringifying a function would leak a server action's source); `@click=${fn}` event listener (client-only, drops at SSR; the handler is NOT bound to your component (`this` is a framework-internal event part, so a read yields `undefined` and a write lands on internals rather than throwing), so pass an arrow (`@click=${(e) => this.onClick(e)}`) or an arrow class field rather than a bare method); `.value=${v}` DOM property (round-trips through SSR on custom elements via `data-webjs-prop-*`, drops on native elements); `?disabled=${b}` boolean attribute. Event/property/boolean holes **must be unquoted** (invariant 4). Every hole is identical server and client except `@event`, `.prop` on native elements, and a **nullish-or-`false` plain-attribute hole**: the client REMOVES the attribute for `null` / `undefined` / `false`, while the server stringifies, emitting `attr=""` for nullish and `attr="false"` for `false`. So the two renderers disagree, and there is no "omit this attribute" hole value at all. `false` is the subtler half: `aria-expanded=${false}` serves `aria-expanded="false"` and hydrates to no attribute, and for a tri-state ARIA attribute those are NOT the same thing, so `?attr=${bool}` is not a substitute either. To omit an attribute conditionally, BRANCH the template (`cond ? html\`<div a=${v}>\` : html\`<div>\``) rather than passing a nullish value, and use `?attr=${bool}` for a genuine boolean attribute. This matters for ARIA in particular, where an empty `aria-labelledby` is an IDREF list resolving to nothing and an `aria-checked=""` is an attribute the role may not even allow.
+`<div>${x}</div>` text child; `class=${x}` attribute (escaped); `action=${importedAction}` on a `<form>` or `formaction=${importedAction}` on a submitter binds a server action (#1155, #1207, #1307: the function-valued attribute holes where the attribute is omitted/rewritten and a `__webjs_action` identity is emitted, plus `formmethod` / `formenctype` on a bound submitter so it needs no bound form around it; submitters must be actual submit controls and cannot carry their own `name`, `value`, `form`, or static `formaction` attributes; a quoted `action="${fn}"` / `formaction="${fn}"` or `action=${fn}` on un-supported tags is a render error, since stringifying a function would leak a server action's source); `@click=${fn}` event listener (client-only, drops at SSR; the handler is NOT bound to your component (`this` is a framework-internal event part, so a read yields `undefined` and a write lands on internals rather than throwing), so pass an arrow (`@click=${(e) => this.onClick(e)}`) or an arrow class field rather than a bare method); `.value=${v}` DOM property (round-trips through SSR on custom elements via `data-webjs-prop-*`, drops on native elements); `?disabled=${b}` boolean attribute. Event/property/boolean holes **must be unquoted** (invariant 4). Every hole is identical server and client except `@event` and `.prop` on native elements. A plain (unquoted, whole-value) attribute hole follows one rule in both renderers (#1573): `null` / `undefined` OMIT the attribute, `false` omits it too EXCEPT on an `aria-*` name, where it is written as `"false"`, and anything else is `String(value)`. So `aria-current=${active ? 'page' : null}` is the idiom for a conditional attribute, and `aria-expanded=${open}` serves `"true"` / `"false"` from both renderers, which matters because for a tri-state ARIA attribute `"false"` and absent are NOT the same thing. A quoted or mixed hole (`title="${x}"`, `class="a ${x}"`) keeps the attribute the author wrote statically and reads a nullish piece as empty text. Use `?attr=${bool}` for a genuine boolean attribute. (Before #1573 the server stringified `null` to `attr=""` and `false` to `attr="false"` while the client removed both, which is why some kit components still branch their templates.)
 
 ---
 
@@ -551,7 +551,7 @@ The call RETURNS the action's `ActionResult`, so a `{ success: false }` both rol
 
 11. **No em-dashes (U+2014), no hyphen or semicolon used as pause-punctuation in prose, and no colon attached to a code-shaped LHS.** Banned as a pause: U+2014, a space-surrounded hyphen between words, a space-surrounded semicolon between words. Banned colon attachments: a colon-then-prose after `xyz()`, a `<my-tag>`, an `[expr]` subscript, or a `<code>foo()</code>` definition list (rephrase verb-led). Prefer a period, comma, a colon on a plain-noun LHS, parentheses, or a restructure. Plain hyphens stay fine in compound words, flags, filenames, ranges, and semicolons and colons stay fine inside code / TS / CSS and inside JSON SYNTAX. A JSON or front-matter `description`, `title`, or `displayName` VALUE is prose, not code, and is scanned like any other prose. The same hook also enforces brand casing with one simple rule: `WebJs` is a proper noun, so write it capitalized wherever it NAMES the project in prose, at a sentence start AND mid-sentence (`WebJs ships`, `Most WebJs apps`, `the WebJs serializer`). It stays lowercase `webjs` ONLY as a literal code token: a `webjs <subcommand>` CLI command (`webjs dev`, `webjs db migrate`), a `webjs.dev` domain, an `@webjsdev` package, a `"webjs"` config key, a `WEBJS_*` env var, the `webjsdev/webjs` org path, or anything inside a `` `code` `` span or fenced block. If you mean the literal config key or command in prose, wrap it in backticks. Enforced via `.claude/hooks/block-prose-punctuation.sh`, which scans only NEW content (you can still edit an existing line to fix a glyph or casing).
 
-12. **A form that writes binds its action: `<form action=${importedAction}>`, and a form whose buttons run different actions binds each on its submitter, `<button formaction=${importedAction}>`** (#1155, #1207, #1307). Those are the two shapes the renderer reads, and every near-miss throws rather than producing a form that posts nowhere. The submitter identity rides the pressed button's own `name`/`value` pair (the one channel a browser submits for that button alone), so no `formaction` url is emitted, both entries reach the server, and the dispatcher takes the LAST `__webjs_action` in DOM order, which is the submitter's whenever one was pressed. **Refused on a form:** a quoted `action="${fn}"`, `action=${fn}` on any tag other than `<form>`, `method="get"` or an enctype the server cannot parse, a `.method` / `.enctype` / `.encoding` PROPERTY binding (a `.prop` drops at SSR and applies in the browser, so the form would submit differently with JS than without), a second `action` hole, a plain `action="/url"` alongside the bound hole (SSR keeps it and the client drops it), a whitespace-padded `method=" post "` (an enumerated attribute is matched against exact keywords, so a padded value falls to the invalid-value default and submits as a GET), and a function that is not a `'use server'` export. **Refused on a submitter:** a control that is not a submit control, an `<input type="image">` (it submits `name.x` / `name.y` coordinates, so the identity never arrives), an `<input type="submit">` (the identity has to occupy its `value`, which on that control is also its visible label, so it would render captioned with the action id and could never be labelled; a `<button>` has no such conflict), a submitter carrying its own `name`, `value`, `form`, or static `formaction`, a `.prop` spelling of any of those (`.name` / `.value` / `.formAction` / `.formMethod` / `.formEnctype` all REFLECT on a submitter, so the write is dropped at SSR and lands in the attribute in the browser), and a second `formaction` hole. **Refused on a BOUND submitter, as a same-element contradiction:** its own `formmethod` other than post, an unparseable `formenctype` such as `text/plain`, and `formmethod="dialog"` (which dismisses a `<dialog>` instead of submitting, so the bound action could never run). A PLAIN submitter's own `formmethod` / `formenctype` is NOT refused: native HTML says the submitter's override wins, the author typed it deliberately, and the form's action simply does not run, so the renderer honours it and the dev-time client guard reports at submit time when a submission holds an identity it cannot deliver. A plain `formaction="/url"` likewise retargets away from the bound action and is the author's business. WebJs supplies `method` and `enctype` (and, on a bound submitter, `formmethod` and `formenctype`) only where your template supplies neither, judged from the TEMPLATE rather than the rendered element: `?method=${false}` emits nothing so it is supplied, while `method=${null}` emits `method=""` and is refused. An `encoding=` attribute is inert in HTML (only the `.encoding` PROPERTY aliases `enctype`), so both renderers ignore it. A page has no `action` export, so a bare `<form method="post">` is a `405`. **A bound submitter is SELF-SUFFICIENT and asks nothing of the form around it** (#1307). The renderer supplies submission attributes at the level where the action is BOUND, and never overrides what you wrote at that same level: a bound `<form>` gains `method="post"` plus `enctype`, and a bound `<button>` gains `formmethod="post"` plus `formenctype` ON THE BUTTON, which is what React does for a function `formAction`. So a per-button action works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all. That is why the refusal list above contains no rule about a submitter's NEIGHBOURS: the renderer refuses only a SAME-ELEMENT contradiction, which has no correct fallback, and never a cross-element rule, which always has one (whatever native HTML would do). It also removed a question neither renderer could answer honestly, since a COMPONENT renders its own template in a separate pass with no view of the host page and the client may reconcile a submitter whose form is not in the tree yet. One consequence: no `formaction` url is emitted (an empty one is a conformance error), so the submission targets whatever the FORM targets, and a form declaring `action="/x"` sends its buttons there. The action still runs if `/x` is a PAGE route, since the identity travels in the body; against a `route.ts` or another origin the identity is ignored and nothing runs, which the dev-time client guard reports at submit time.
+12. **A form that writes binds its action: `<form action=${importedAction}>`, and a form whose buttons run different actions binds each on its submitter, `<button formaction=${importedAction}>`** (#1155, #1207, #1307). Those are the two shapes the renderer reads, and every near-miss throws rather than producing a form that posts nowhere. The submitter identity rides the pressed button's own `name`/`value` pair (the one channel a browser submits for that button alone), so no `formaction` url is emitted, both entries reach the server, and the dispatcher takes the LAST `__webjs_action` in DOM order, which is the submitter's whenever one was pressed. **Refused on a form:** a quoted `action="${fn}"`, `action=${fn}` on any tag other than `<form>`, `method="get"` or an enctype the server cannot parse, a `.method` / `.enctype` / `.encoding` PROPERTY binding (a `.prop` drops at SSR and applies in the browser, so the form would submit differently with JS than without), a second `action` hole, a plain `action="/url"` alongside the bound hole (SSR keeps it and the client drops it), a whitespace-padded `method=" post "` (an enumerated attribute is matched against exact keywords, so a padded value falls to the invalid-value default and submits as a GET), and a function that is not a `'use server'` export. **Refused on a submitter:** a control that is not a submit control, an `<input type="image">` (it submits `name.x` / `name.y` coordinates, so the identity never arrives), an `<input type="submit">` (the identity has to occupy its `value`, which on that control is also its visible label, so it would render captioned with the action id and could never be labelled; a `<button>` has no such conflict), a submitter carrying its own `name`, `value`, `form`, or static `formaction`, a `.prop` spelling of any of those (`.name` / `.value` / `.formAction` / `.formMethod` / `.formEnctype` all REFLECT on a submitter, so the write is dropped at SSR and lands in the attribute in the browser), and a second `formaction` hole. **Refused on a BOUND submitter, as a same-element contradiction:** its own `formmethod` other than post, an unparseable `formenctype` such as `text/plain`, and `formmethod="dialog"` (which dismisses a `<dialog>` instead of submitting, so the bound action could never run). A PLAIN submitter's own `formmethod` / `formenctype` is NOT refused: native HTML says the submitter's override wins, the author typed it deliberately, and the form's action simply does not run, so the renderer honours it and the dev-time client guard reports at submit time when a submission holds an identity it cannot deliver. A plain `formaction="/url"` likewise retargets away from the bound action and is the author's business. WebJs supplies `method` and `enctype` (and, on a bound submitter, `formmethod` and `formenctype`) only where your template supplies neither, judged from the TEMPLATE rather than the rendered element: `?method=${false}` and `method=${null}` both emit nothing (#1573), so the method is supplied, while `method=${''}` emits `method=""` and is refused. An `encoding=` attribute is inert in HTML (only the `.encoding` PROPERTY aliases `enctype`), so both renderers ignore it. A page has no `action` export, so a bare `<form method="post">` is a `405`. **A bound submitter is SELF-SUFFICIENT and asks nothing of the form around it** (#1307). The renderer supplies submission attributes at the level where the action is BOUND, and never overrides what you wrote at that same level: a bound `<form>` gains `method="post"` plus `enctype`, and a bound `<button>` gains `formmethod="post"` plus `formenctype` ON THE BUTTON, which is what React does for a function `formAction`. So a per-button action works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all. That is why the refusal list above contains no rule about a submitter's NEIGHBOURS: the renderer refuses only a SAME-ELEMENT contradiction, which has no correct fallback, and never a cross-element rule, which always has one (whatever native HTML would do). It also removed a question neither renderer could answer honestly, since a COMPONENT renders its own template in a separate pass with no view of the host page and the client may reconcile a submitter whose form is not in the tree yet. One consequence: no `formaction` url is emitted (an empty one is a conformance error), so the submission targets whatever the FORM targets, and a form declaring `action="/x"` sends its buttons there. The action still runs if `/x` is a PAGE route, since the identity travels in the body; against a `route.ts` or another origin the identity is ignored and nothing runs, which the dev-time client guard reports at submit time.
 
 ---
 
diff --git a/packages/core/src/binding-prefixes.js b/packages/core/src/binding-prefixes.js
index 73cecde03..5c101634a 100644
--- a/packages/core/src/binding-prefixes.js
+++ b/packages/core/src/binding-prefixes.js
@@ -40,3 +40,31 @@ export const BINDING_PREFIXES = Object.freeze({
 export function isBindingPrefix(ch) {
   return Object.prototype.hasOwnProperty.call(BINDING_PREFIXES, ch);
 }
+
+/**
+ * What a PLAIN attribute hole (`name=${value}`, unquoted, the whole value)
+ * writes, or `null` when the attribute is omitted. The one rule both renderers
+ * follow, so the server never serves an attribute the client then removes
+ * (#1573):
+ *
+ *   - `null` / `undefined` omit the attribute. This is the "omit" value, so a
+ *     conditional attribute is `aria-current=${active ? 'page' : null}`.
+ *   - `false` omits it too, EXCEPT on an `aria-*` attribute, where it writes
+ *     `"false"`. For a tri-state ARIA attribute (`aria-expanded`,
+ *     `aria-pressed`, `aria-checked`) `"false"` and absent mean different
+ *     things, so the value an author passes is the value the user agent gets.
+ *   - anything else is `String(value)`.
+ *
+ * A quoted or mixed value (`title="${x}"`, `class="a ${x}"`) is not a plain
+ * hole: the author wrote the attribute statically, so it stays and a nullish
+ * piece reads as empty text.
+ *
+ * @param {string} name the attribute name as written
+ * @param {unknown} value the hole's value (`live()` already unwrapped)
+ * @returns {string | null}
+ */
+export function attrHoleValue(name, value) {
+  if (value == null) return null;
+  if (value === false) return /^aria-/i.test(name) ? 'false' : null;
+  return String(value);
+}
diff --git a/packages/core/src/render-client/parts.js b/packages/core/src/render-client/parts.js
index 76fbf2543..65f90b533 100644
--- a/packages/core/src/render-client/parts.js
+++ b/packages/core/src/render-client/parts.js
@@ -11,6 +11,7 @@ import {
   SLOT_FALLBACK_FRAG, SLOT_STATE, SLOT_OWNER, applySlotAssignments, withRendererWrites,
 } from '../slot.js';
 import { compile, templateCache } from './template-compiler.js';
+import { attrHoleValue } from '../binding-prefixes.js';
 
 /**
  * The container the in-progress `render()` is committing into, or null
@@ -203,7 +204,10 @@ export function applyPart(part, value, _prev, allValues, reconcileFormActionsCb)
       applyChild(part, value, reconcileFormActionsCb);
       break;
     case 'attr': {
-      if (value == null || value === false) part.el.removeAttribute(part.name);
+      // #1573: the shared rule, so this agrees with SSR. `null` / `undefined`
+      // remove, `false` removes except on aria-*, where it writes "false".
+      const written = attrHoleValue(part.name, value);
+      if (written === null) part.el.removeAttribute(part.name);
       else if (isBoundFormAction(value, part.name, part.el.localName)) {
         // #1155: the ONE supported form-action binding, applied to the live
         // form exactly as SSR wrote it. A component that ships re-renders its
@@ -220,7 +224,7 @@ export function applyPart(part, value, _prev, allValues, reconcileFormActionsCb)
         // (mirrors the SSR guard, so a client re-render cannot write a
         // server action's source into the live DOM).
         assertNotFunctionActionAttr(value, part.name, part.el.localName);
-        part.el.setAttribute(part.name, String(value));
+        part.el.setAttribute(part.name, written);
       }
       break;
     }
diff --git a/packages/core/src/render-client/reconciler.js b/packages/core/src/render-client/reconciler.js
index e5781f757..93c63711d 100644
--- a/packages/core/src/render-client/reconciler.js
+++ b/packages/core/src/render-client/reconciler.js
@@ -7,6 +7,7 @@ import {
   assertIdentifiableAction, FORM_ACTION_FIELD,
 } from '../form-action.js';
 import { isLive } from '../directives.js';
+import { attrHoleValue } from '../binding-prefixes.js';
 import { RENDERING, SLOT_OWNER, SLOT_STATE, drainRendererBackstop, rescueAssignedNodes } from '../slot.js';
 import { compile, submitterActionBindings, INSTANCE } from './template-compiler.js';
 import {
@@ -132,13 +133,17 @@ function reconcileFormActions(formActions, bound, values) {
           rec,
         );
       } else {
-        // What SSR would have emitted for this pass. An attribute hole always
-        // emits (even `name=${null}`, as `name=""`); a boolean hole emits only
-        // when truthy. Both identity channels ask the same question, through
-        // one predicate, so they cannot drift apart again.
+        // What SSR would have emitted for this pass. A plain attribute hole
+        // emits unless `attrHoleValue` omits it (`null` / `undefined` /
+        // `false`, since `name` and `value` are not aria-*, #1573), a mixed
+        // one always emits, and a boolean hole emits only when truthy. Both
+        // identity channels ask the same question, through one predicate, so
+        // they cannot drift apart again.
         const emits = (parts) => parts.some((np) => (np.kind === 'bool'
           ? !!resolveHoleValue(values[np.i])
-          : true));
+          : np.kind === 'attr'
+            ? attrHoleValue('name', resolveHoleValue(values[np.i])) !== null
+            : true));
         reconcileSubmitterAction(
           /** @type any */ (part.el), val, rec,
           emits(rec.nameParts), emits(rec.valueParts),
@@ -267,8 +272,10 @@ function effectiveFormAttr(attrParts, staticValue, values) {
   for (const p of attrParts) {
     if (p.kind === 'bool') return resolveHoleValue(values[p.i]) ? '' : ABSENT;
     if (p.kind === 'attr') {
-      const v = resolveHoleValue(values[p.i]);
-      return v == null ? '' : String(v);
+      // #1573: an omitted plain hole is ABSENT, exactly as SSR emits it, so
+      // `method=${null}` leaves the framework to supply `method="post"`.
+      const w = attrHoleValue('method', resolveHoleValue(values[p.i]));
+      return w === null ? ABSENT : w;
     }
     // A mixed attribute is the concatenation of its static pieces and EVERY one
     // of its holes, so the anchor's own value is only part of the answer.
diff --git a/packages/core/src/render-client/template-compiler.js b/packages/core/src/render-client/template-compiler.js
index c8f34d404..fb65477a3 100644
--- a/packages/core/src/render-client/template-compiler.js
+++ b/packages/core/src/render-client/template-compiler.js
@@ -440,9 +440,9 @@ function buildFormActionRecord(el, onEl, parts) {
   /** Prop bindings that cannot converge with SSR; refused when actually bound. */
   const propAttrs = [];
   // `name` holes on a submitter, recorded WITH their kind. Whether one occupies
-  // the identity's channel is not a property of the hole alone: SSR emits
-  // `name=""` for an attribute hole whatever it resolved to, but emits nothing
-  // at all for a FALSY boolean hole and nothing for an `@name` listener. Asking
+  // the identity's channel is not a property of the hole alone: SSR omits an
+  // attribute hole that resolved to `null` / `undefined` / `false` (#1573),
+  // emits nothing for a FALSY boolean hole, and nothing for an `@name` listener. Asking
   // only "is there a part called name" therefore refused templates SSR renders
   // happily, which is the render-on-the-server-throw-on-hydration direction.
   // The kinds travel with the record and `reconcileFormActions` resolves them.
diff --git a/packages/core/src/render-server/template-renderer.js b/packages/core/src/render-server/template-renderer.js
index fe83b428f..2d315b26c 100644
--- a/packages/core/src/render-server/template-renderer.js
+++ b/packages/core/src/render-server/template-renderer.js
@@ -1,5 +1,5 @@
 import { html, isTemplate } from '../html.js';
-import { BINDING_PREFIXES } from '../binding-prefixes.js';
+import { BINDING_PREFIXES, attrHoleValue } from '../binding-prefixes.js';
 import { escapeText, escapeAttr } from '../escape.js';
 import {
   assertNotFunctionActionAttr, assertNotFunctionReflectedActionProp,
@@ -542,7 +542,12 @@ export async function renderTemplate(tr, ctx) {
           // #1154: never stringify a function into action=/formaction= (it
           // would serialize a server action's source into the served HTML).
           assertNotFunctionActionAttr(val, attrName, currentTag);
-          out += `"${escapeAttr(String(val ?? ''))}"`;
+          // #1573: the client's rule, not a stringify. `null` / `undefined`
+          // (and `false` off an aria-* name) omit the attribute, which is
+          // already in `out` from `attrStart`, so slice it back off.
+          const written = attrHoleValue(attrName, val);
+          if (written === null) out = out.slice(0, attrStart);
+          else out += `"${escapeAttr(written)}"`;
           state = 'in-tag';
           attrName = '';
         }
@@ -922,7 +927,10 @@ export async function streamTemplate(tr, ctx, controller) {
           // `renderToStream(v, { ssr: false })`, which no page render uses, so
           // this covers the public API surface rather than a page leak.
           assertNotFunctionActionAttr(val, attrName, currentTag);
-          buf += `"${escapeAttr(String(val ?? ''))}"`;
+          // #1573: the same omission rule as the buffered renderer above.
+          const written = attrHoleValue(attrName, val);
+          if (written === null) buf = buf.slice(0, attrStart);
+          else buf += `"${escapeAttr(written)}"`;
           state = 'in-tag';
           attrName = '';
         }
diff --git a/packages/core/test/rendering/attr-hole-omission.test.js b/packages/core/test/rendering/attr-hole-omission.test.js
new file mode 100644
index 000000000..deda9324f
--- /dev/null
+++ b/packages/core/test/rendering/attr-hole-omission.test.js
@@ -0,0 +1,115 @@
+/**
+ * A plain attribute hole that holds `null` / `undefined` / `false` (#1573).
+ *
+ * The server used to stringify it (`attr=""`, `attr="false"`) while the client
+ * removed it, so a layout's `aria-current=${active ? 'page' : null}` served an
+ * empty `aria-current` on every inactive link, and layouts never hydrate to
+ * repair it. Both renderers now follow `attrHoleValue` in binding-prefixes.js:
+ * nullish omits, `false` omits except on an aria-* name, where it is "false".
+ *
+ * Every server case runs through BOTH machines (the buffered `renderToString`
+ * and the streaming `renderToStream(v, { ssr: false })`), since they are
+ * independent hole dispatchers. The client half runs the real client renderer
+ * over linkedom. Flat tests, no nested subtests: this file runs in the Bun
+ * parity matrix, whose node:test shim refuses a nested subtest.
+ */
+import { test, before } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseHTML } from 'linkedom';
+import { html } from '../../src/html.js';
+import { renderToString, renderToStream } from '../../src/render-server.js';
+import { attrHoleValue } from '../../src/binding-prefixes.js';
+
+async function drain(stream) {
+  let out = '';
+  const reader = stream.getReader();
+  const dec = new TextDecoder();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    out += typeof value === 'string' ? value : dec.decode(value);
+  }
+  return out;
+}
+
+async function bothServers(mk, assertOn) {
+  assertOn(await renderToString(mk()), 'buffered');
+  assertOn(await drain(renderToStream(mk(), { ssr: false })), 'streamed');
+}
+
+let render;
+before(async () => {
+  const { window } = parseHTML('<!doctype html><html><body></body></html>');
+  globalThis.document = window.document;
+  globalThis.DocumentFragment = window.DocumentFragment;
+  globalThis.Node = window.Node;
+  globalThis.Element = window.Element;
+  globalThis.Comment = window.Comment;
+  globalThis.Text = window.Text;
+  globalThis.NodeFilter = window.NodeFilter;
+  globalThis.HTMLElement = window.HTMLElement;
+  ({ render } = await import('../../src/render-client.js'));
+});
+
+function clientEl(tpl) {
+  const host = document.createElement('div');
+  render(tpl, host);
+  return host.firstElementChild;
+}
+
+test('attrHoleValue: the shared rule (#1573)', () => {
+  assert.equal(attrHoleValue('title', null), null);
+  assert.equal(attrHoleValue('title', undefined), null);
+  assert.equal(attrHoleValue('hidden', false), null);
+  assert.equal(attrHoleValue('aria-expanded', false), 'false');
+  assert.equal(attrHoleValue('ARIA-Pressed', false), 'false');
+  assert.equal(attrHoleValue('aria-current', null), null);
+  assert.equal(attrHoleValue('title', 0), '0');
+  assert.equal(attrHoleValue('title', ''), '');
+  assert.equal(attrHoleValue('aria-expanded', true), 'true');
+});
+
+test('server: a null or undefined plain hole omits the attribute (#1573)', async () => {
+  for (const v of [null, undefined]) {
+    await bothServers(() => html`<a href="/x" aria-current=${v} title=${v}>x</a>`, (out, who) => {
+      assert.doesNotMatch(out, /aria-current/, `${who}: aria-current=\${${v}} must be omitted, got ${out}`);
+      assert.doesNotMatch(out, /title/, `${who}: title=\${${v}} must be omitted, got ${out}`);
+      assert.match(out, /<a href="\/x"\s*>x<\/a>/, `${who}: the rest of the tag is intact, got ${out}`);
+    });
+  }
+});
+
+test('server: false omits a plain attribute but writes "false" on aria-* (#1573)', async () => {
+  await bothServers(() => html`<button data-on=${false} aria-expanded=${false} aria-pressed=${true}>x</button>`, (out, who) => {
+    assert.doesNotMatch(out, /data-on/, `${who}: data-on=\${false} must be omitted, got ${out}`);
+    assert.match(out, /aria-expanded="false"/, `${who}: aria-expanded=\${false} must be "false", got ${out}`);
+    assert.match(out, /aria-pressed="true"/, `${who}: got ${out}`);
+  });
+});
+
+test('server: a present value, and a quoted or mixed hole, are unchanged (#1573)', async () => {
+  await bothServers(() => html`<a aria-current=${'page'} title="${null}" class="a ${null}">x</a>`, (out, who) => {
+    assert.match(out, /aria-current="page"/, `${who}: got ${out}`);
+    assert.match(out, /title=""/, `${who}: a QUOTED hole keeps its statically written attribute, got ${out}`);
+    assert.match(out, /class="a "/, `${who}: a mixed hole keeps the attribute, got ${out}`);
+  });
+});
+
+test('client: the same rule, so hydration changes nothing (#1573)', () => {
+  const a = clientEl(html`<a aria-current=${null} title=${undefined} data-on=${false} aria-expanded=${false}>x</a>`);
+  assert.equal(a.hasAttribute('aria-current'), false);
+  assert.equal(a.hasAttribute('title'), false);
+  assert.equal(a.hasAttribute('data-on'), false);
+  assert.equal(a.getAttribute('aria-expanded'), 'false', 'aria-* false is written, not removed');
+});
+
+test('client: an aria-* hole flipping true -> false keeps the attribute as "false" (#1573)', () => {
+  const host = document.createElement('div');
+  const tpl = (v) => html`<button aria-pressed=${v}>x</button>`;
+  render(tpl(true), host);
+  assert.equal(host.firstElementChild.getAttribute('aria-pressed'), 'true');
+  render(tpl(false), host);
+  assert.equal(host.firstElementChild.getAttribute('aria-pressed'), 'false');
+  render(tpl(null), host);
+  assert.equal(host.firstElementChild.hasAttribute('aria-pressed'), false, 'null is still the omit value on aria-*');
+});
diff --git a/packages/core/test/rendering/browser/ssr-client-parity.test.js b/packages/core/test/rendering/browser/ssr-client-parity.test.js
index 4aefb7767..7b4465de3 100644
--- a/packages/core/test/rendering/browser/ssr-client-parity.test.js
+++ b/packages/core/test/rendering/browser/ssr-client-parity.test.js
@@ -386,6 +386,24 @@ async function bothWays(tpl) {
   return { ssr, ssrErr, client, clientErr };
 }
 
+suite('SSR/client parity: nullish and false plain attribute holes (#1573)', () => {
+  test('null / undefined omit, false omits off aria-*, aria-* false is "false"', async () => {
+    const tpl = () => html`<a href="/x" aria-current=${null} title=${undefined} data-on=${false} aria-expanded=${false} aria-pressed=${'true'}>x</a>`;
+    const attrsOf = (markup) => {
+      const t = document.createElement('template');
+      t.innerHTML = normalize(markup);
+      const a = t.content.querySelector('a');
+      return [...a.attributes].map((x) => `${x.name}="${x.value}"`).sort().join(' ');
+    };
+    const ssr = attrsOf(await renderToString(tpl(), { ssr: true }));
+    const host = document.createElement('div');
+    render(tpl(), host);
+    const client = attrsOf(host.innerHTML);
+    assert.equal(client, ssr, 'client and SSR serve the same attribute set');
+    assert.equal(ssr, 'aria-expanded="false" aria-pressed="true" href="/x"');
+  });
+});
+
 suite('SSR/client parity: form actions (#1155)', () => {
   setup(() => { setFormActionResolver((fn) => (fn[FORM_ACTION_ID_KEY] ? ACTION_ID : null)); });
   teardown(() => { setFormActionResolver(() => null); });
@@ -400,6 +418,11 @@ suite('SSR/client parity: form actions (#1155)', () => {
     'quoted hole-provided method': () => html`<form action=${boundAction()} method="${'post'}"></form>`,
     'mixed attribute with NON-EMPTY statics': () => html`<form action=${boundAction()} method="pos${'t'}"></form>`,
     'falsy boolean hole leaves it to the framework': () => html`<form action=${boundAction()} ?method=${false}></form>`,
+    // #1573: a nullish plain hole is omitted by BOTH renderers, so it leaves the
+    // method to the framework exactly as the falsy boolean hole above does.
+    'null method hole leaves it to the framework': () => html`<form action=${boundAction()} method=${null}></form>`,
+    'undefined enctype hole leaves it to the framework': () => html`<form action=${boundAction()} enctype=${undefined}></form>`,
+    'null name hole on a bound submitter': () => html`<form action=${boundAction()}><button name=${null} formaction=${boundAction()}>Save</button></form>`,
     'case-folded ACTION still binds': () => html`<form ACTION=${boundAction()}></form>`,
     'a plain url action is an ordinary form': () => html`<form action=${'/legacy'}></form>`,
     'an unbound form keeps its own method': () => html`<form action=${'/search'} method=${'get'}></form>`,
@@ -461,7 +484,6 @@ suite('SSR/client parity: form actions (#1155)', () => {
     'method=get': [() => html`<form method="get" action=${boundAction()}></form>`, /cannot work/],
     'hole-provided method=get after the hole': [() => html`<form action=${boundAction()} method=${'get'}></form>`, /cannot work/],
     'quoted hole-provided method=get': [() => html`<form action=${boundAction()} method="${'get'}"></form>`, /cannot work/],
-    'null method hole renders an empty value': [() => html`<form action=${boundAction()} method=${null}></form>`, /cannot work/],
     'truthy boolean hole renders an empty value': [() => html`<form action=${boundAction()} ?enctype=${true}></form>`, /cannot work/],
     'unparseable enctype': [() => html`<form action=${boundAction()} enctype="text/plain"></form>`, /cannot work/],
     'quoted action hole is a stringify': [() => html`<form action="${boundAction()}"></form>`, /interpolated into/],
diff --git a/packages/core/test/rendering/form-action-binding-client.test.js b/packages/core/test/rendering/form-action-binding-client.test.js
index 5a778160f..bc26cfa06 100644
--- a/packages/core/test/rendering/form-action-binding-client.test.js
+++ b/packages/core/test/rendering/form-action-binding-client.test.js
@@ -174,12 +174,11 @@ test('a re-render that breaks an already-bound form is refused (QUOTED hole)', (
   assert.throws(() => render(tpl('get'), host), /cannot work/);
 });
 
-test('a hole resolving to null is refused, with SSR\'s own message', () => {
-  // An attribute hole emits an EMPTY value for null (SSR: `String(val ?? '')`),
-  // and an empty method cannot submit. What matters is not just that it throws
-  // but that it throws the SAME thing SSR does: an earlier design invented a
-  // "lost its method attribute" message here, which no server render could ever
-  // produce.
+test('a hole resolving to null omits the attribute, so the binding supplies it (#1573)', () => {
+  // A plain attribute hole holding null is the "omit" value in BOTH renderers
+  // now. An omitted method on a bound form is what `?method=${false}` already
+  // produced, so WebJs supplies `method="post"` exactly as SSR does, rather
+  // than refusing an empty method that neither renderer emits any more.
   for (const attr of ['method', 'enctype']) {
     const fn = HOISTED();
     const host = document.createElement('div');
@@ -187,23 +186,18 @@ test('a hole resolving to null is refused, with SSR\'s own message', () => {
       ? (v) => html`<form action=${fn} method=${v}></form>`
       : (v) => html`<form action=${fn} enctype=${v}></form>`;
     render(tpl(attr === 'method' ? 'post' : 'multipart/form-data'), host);
-    assert.throws(
-      () => render(tpl(null), host),
-      new RegExp(`<form ${attr}="" action=\\$\\{action\\}> cannot work`),
-      `a null ${attr} hole must be refused the way SSR refuses it`,
-    );
+    render(tpl(null), host);
+    const form = host.querySelector('form');
+    assert.equal(form.getAttribute('method'), 'post', `a null ${attr} hole leaves the supplied method`);
+    if (attr === 'enctype') assert.notEqual(form.getAttribute('enctype'), '', 'no empty enctype is left behind');
   }
 });
 
-test('a null hole is refused on the FIRST render too, not only a re-render', () => {
-  // The old write-tracking design only noticed this on a re-render, because its
-  // check ran before the form was registered as bound. SSR always threw.
+test('a null method hole is accepted on the FIRST render too (#1573)', () => {
   const fn = HOISTED();
   const host = document.createElement('div');
-  assert.throws(
-    () => render(html`<form action=${fn} method=${null}></form>`, host),
-    /cannot work/,
-  );
+  render(html`<form action=${fn} method=${null}></form>`, host);
+  assert.equal(host.querySelector('form').getAttribute('method'), 'post');
 });
 
 test('an action hole that resolves to a URL releases the binding', () => {
@@ -765,21 +759,22 @@ test('a .name / .value on a NON-binding submitter is left alone', () => {
 });
 
 test('an empty name PART on a bound submitter is refused, matching SSR', () => {
-  // Judged on the part, not on what it resolved to. `name=${null}` leaves no
-  // attribute on the client while SSR emits `name=""` beside the identity, so
-  // reading the live value back returned '' and the client waved through a
-  // template SSR hard-refuses.
+  // `name=${''}` emits `name=""` beside the identity on both renderers, so it
+  // is refused. `null` / `undefined` omit the attribute on both (#1573), so the
+  // identity's channel is free and the template is accepted.
   const formAction = HOISTED();
   const buttonAction = HOISTED();
-  for (const value of [null, '', undefined]) {
-    assert.throws(
-      () => render(
-        html`<form action=${formAction}><button name=${value} formaction=${buttonAction}>x</button></form>`,
-        document.createElement('div'),
-      ),
-      /already carries a "name" attribute/,
-      `name=\${${String(value)}}`,
-    );
+  assert.throws(
+    () => render(
+      html`<form action=${formAction}><button name=${''} formaction=${buttonAction}>x</button></form>`,
+      document.createElement('div'),
+    ),
+    /already carries a "name" attribute/,
+  );
+  for (const value of [null, undefined]) {
+    const host = document.createElement('div');
+    render(html`<form action=${formAction}><button name=${value} formaction=${buttonAction}>x</button></form>`, host);
+    assert.equal(host.querySelector('button').getAttribute('name'), '__webjs_action', `name=\${${String(value)}} leaves the identity's channel free`);
   }
 });
 
diff --git a/packages/core/test/rendering/form-action-binding.test.js b/packages/core/test/rendering/form-action-binding.test.js
index b4a7f9643..c9cac51bd 100644
--- a/packages/core/test/rendering/form-action-binding.test.js
+++ b/packages/core/test/rendering/form-action-binding.test.js
@@ -895,19 +895,37 @@ test('the submitter .prop refusal does not fire on ordinary controls', async ()
 });
 
 test('an empty author name after the hole is refused, not shipped as a duplicate', async () => {
-  // `name=${null}` emits `name=""`. The parse keeps the LAST duplicate, so
+  // `name=${''}` emits `name=""`. The parse keeps the LAST duplicate, so
   // reading the value back found `''` and waved through a tag carrying TWO
   // `name` attributes. A browser keeps the FIRST, so whichever came first would
   // silently win, and SSR would ship markup the client never produces.
   withResolver();
   for (const tpl of [
-    html`<form action=${submitFeedback}><button formaction=${submitFeedback} name=${null}>x</button></form>`,
-    html`<form action=${submitFeedback}><button name=${null} formaction=${submitFeedback}>x</button></form>`,
+    html`<form action=${submitFeedback}><button formaction=${submitFeedback} name=${''}>x</button></form>`,
+    html`<form action=${submitFeedback}><button name=${''} formaction=${submitFeedback}>x</button></form>`,
   ]) {
     await assert.rejects(() => renderToString(tpl, { ssr: true }), /already carries a "name" attribute/);
   }
 });
 
+test('a null name hole on a bound submitter is omitted, so the identity is the only name (#1573)', async () => {
+  withResolver();
+  for (const tpl of [
+    html`<form action=${submitFeedback}><button formaction=${submitFeedback} name=${null}>x</button></form>`,
+    html`<form action=${submitFeedback}><button name=${undefined} formaction=${submitFeedback}>x</button></form>`,
+  ]) {
+    const out = await renderToString(tpl, { ssr: true });
+    assert.equal((out.match(/<button[^>]*>/)[0].match(/\bname=/g) || []).length, 1, out);
+  }
+});
+
+test('a null method hole on a bound form gets the supplied method="post" (#1573)', async () => {
+  withResolver();
+  const out = await renderToString(html`<form action=${submitFeedback} method=${null}></form>`, { ssr: true });
+  assert.match(out, /<form[^>]*method="post"/);
+  assert.doesNotMatch(out, /method=""/);
+});
+
 test('a .prop on a submitter that binds NOTHING is an ordinary native property', async () => {
   // #1307 narrowed this. `.formMethod` / `.formEnctype` / `.formAction` on a
   // button that binds no action used to be refused, on the grounds that they
diff --git a/packages/core/test/rendering/live-in-attribute-hole.test.js b/packages/core/test/rendering/live-in-attribute-hole.test.js
index 5355961e3..68c718852 100644
--- a/packages/core/test/rendering/live-in-attribute-hole.test.js
+++ b/packages/core/test/rendering/live-in-attribute-hole.test.js
@@ -105,12 +105,11 @@ test('a mixed attribute hole resolves live() in every position (#1443)', async (
   });
 });
 
-test('a null attribute hole keeps the documented empty-string emit through live() (#1443)', async () => {
-  // AGENTS.md: the server STRINGIFIES a nullish plain-attribute hole to
-  // `attr=""` (only the client removes it). Unwrapping must not quietly change
-  // that documented asymmetry into an omission.
+test('a null attribute hole is omitted through live() exactly like a bare null (#1443, #1573)', async () => {
+  // A nullish plain-attribute hole omits the attribute on both renderers
+  // (#1573). Unwrapping live() must reach that rule, not stringify the wrapper.
   await bothRenderers(() => html`<div title=${live(null)}></div>`, (out, who) => {
-    assert.match(out, /title=""/, `${who}: live(null) must emit title="" like a bare null, got ${out}`);
+    assert.doesNotMatch(out, /title=/, `${who}: live(null) must omit title like a bare null, got ${out}`);
   });
 });
 
diff --git a/packages/ui/AGENTS.md b/packages/ui/AGENTS.md
index cab957c26..edd1ce3ab 100644
--- a/packages/ui/AGENTS.md
+++ b/packages/ui/AGENTS.md
@@ -740,11 +740,13 @@ their stylesheets key on).
 **`test/ssr-aria.test.js` is the SSR layer, and it is not optional for an ARIA
 change.** It renders Tier-2 components through `renderToString` and asserts the
 ARIA in the SERVED markup. It exists because the browser suite runs only the
-CLIENT renderer, which removes a nullish attribute hole while the server
-stringifies it to `attr=""`. So a component that "omits" ARIA via a null hole
-passes every browser assertion while serving the empty attribute, and SSR then
-disagrees with the hydrated DOM. Three real defects shipped that way before this
-layer existed. Any conditional ARIA needs an assertion here, not just in the
+CLIENT renderer. Before #1573 the client removed a nullish attribute hole while
+the server stringified it to `attr=""`, so a component that "omitted" ARIA via a
+null hole passed every browser assertion while serving the empty attribute.
+Three real defects shipped that way before this layer existed, and the
+components still branch those templates so they render right on an older
+`@webjsdev/core`. Both renderers now omit a nullish hole, but the served markup
+is still what a screen reader meets first. Any conditional ARIA needs an assertion here, not just in the
 browser suite.
 
 Real-browser tests for the kit live under
diff --git a/website/app/docs/components/page.ts b/website/app/docs/components/page.ts
index dc02aff31..783bf24d2 100644
--- a/website/app/docs/components/page.ts
+++ b/website/app/docs/components/page.ts
@@ -13,7 +13,7 @@ export default function Components() {
       <li><strong>Markup and the code that drives it live in the same component.</strong> A class selector is not an interface. <code>document.querySelector('.nav-toggle')</code> keeps type-checking after someone renames the class in the other file, and starts returning <code>null</code> at runtime.</li>
       <li><strong>Reach your own rendered node with a ref.</strong> <code>render()</code> already owns the node, so let the handle flow out of the template with <code>ref()</code> and <code>createRef()</code>. A ref cannot match another component's node, and it goes undefined once the node is no longer rendered.</li>
       <li><strong>State lives on the component, never on the document shell.</strong> The client router's swap range never covers <code>&lt;body&gt;</code>, so an open flag parked there survives the navigation that removed the markup it described. A reactive property or an instance signal dies with the element, while a module-scope signal deliberately outlives it and is for state genuinely shared between components. Two things are the exception: a document-wide setting such as the theme, which describes the document rather than one component, and a transient document-level effect such as a scroll lock, which the element that opened it releases in <code>disconnectedCallback</code>.</li>
-      <li><strong>ARIA state is a hole in <code>render()</code>.</strong> An <code>aria-expanded</code> bound to the same state that drives behaviour cannot drift. A second function calling <code>setAttribute</code> can. Write the string explicitly for a tri-state attribute, since a plain-attribute hole holding <code>false</code> serves <code>false</code> from the server and no attribute at all on the client.</li>
+      <li><strong>ARIA state is a hole in <code>render()</code>.</strong> An <code>aria-expanded</code> bound to the same state that drives behaviour cannot drift. A second function calling <code>setAttribute</code> can. A plain-attribute hole holding <code>false</code> on an <code>aria-*</code> attribute is written as <code>"false"</code> by the server and the client alike, so <code>aria-expanded=\${this.open}</code> stays correct through hydration.</li>
       <li><strong>Behaviour needs an importable surface.</strong> A browser test can import a component and drive the real element. An inline script in a layout has no module identity, so its test can only transcribe it and assert against the copy.</li>
       <li><strong>Listening on the document is fine. Querying it usually is not.</strong> An outside-click handler has to listen globally, then reads its own subtree with <code>this.contains(event.target)</code>. Add the listener in <code>connectedCallback</code> and remove it in <code>disconnectedCallback</code>.</li>
       <li><strong>Talk to an ancestor with a bubbling event, and to a stranger with a module-scope signal.</strong> A made-up event name on <code>document</code> is a global variable with extra steps.</li>
@@ -688,7 +688,7 @@ render() {
     <p><strong>One carve-out applies to all three below: a function under <code>action=</code> or <code>formaction=</code> is never stringified.</strong> Stringifying a function writes its source into the HTML, and during SSR an imported <code>'use server'</code> action is the real function, so that source is the action's whole body. An unquoted <code>action=\${fn}</code> on a <code>&lt;form&gt;</code> BINDS the action instead (see <a href="/docs/server-actions">Server Actions</a>); every other shape under those two names is refused (quoted, mixed, array-wrapped, <code>action=\${fn}</code> off a <code>&lt;form&gt;</code>, and <code>.action=\${fn}</code> on a native form, which reflects into the live DOM). A function stays legal on an unquoted <code>@action=\${fn}</code> listener and on a custom element's own <code>.action</code> property, because neither stringifies it. So where the rules below say a value is stringified, that a native property binding drops at SSR, or that a boolean hole emits the attribute when truthy, read them as holding for every attribute except these two. See <a href="/docs/troubleshooting">Troubleshooting</a>.</p>
 
     <h3>Regular Attributes: <code>attr=\${value}</code></h3>
-    <p>Sets an HTML attribute. The value is stringified. If the value is <code>null</code>, <code>undefined</code>, or <code>false</code>, the attribute is removed.</p>
+    <p>Sets an HTML attribute. The value is stringified. If the value is <code>null</code> or <code>undefined</code> the attribute is omitted, and <code>false</code> omits it too except on an <code>aria-*</code> attribute, where it is written as <code>"false"</code> (a tri-state ARIA attribute set to <code>"false"</code> means something different from an absent one). The server and the client follow the same rule, so <code>aria-current=\${active ? 'page' : null}</code> serves no attribute on an inactive link and hydrates unchanged.</p>
 
     <code-block>html\`&lt;input type="text" value=\${this.name} class=\${this.active ? 'on' : 'off'} /&gt;\`</code-block>
 
diff --git a/website/app/docs/ssr/page.ts b/website/app/docs/ssr/page.ts
index 1ff0f35e4..06f5f8a64 100644
--- a/website/app/docs/ssr/page.ts
+++ b/website/app/docs/ssr/page.ts
@@ -156,7 +156,7 @@ async function loadExpensiveItems() {
       </thead>
       <tbody>
         <tr><td><code>&lt;div&gt;\${x}&lt;/div&gt;</code> (text)</td><td>Rendered with HTML escaping</td><td>Same</td></tr>
-        <tr><td><code>class=\${x}</code> (attribute)</td><td>Serialized as <code>class="x"</code></td><td>Same</td></tr>
+        <tr><td><code>class=\${x}</code> (attribute)</td><td>Serialized as <code>class="x"</code>. <code>null</code> / <code>undefined</code> omit the attribute, and so does <code>false</code> except on <code>aria-*</code>, where it is <code>"false"</code></td><td>Same</td></tr>
         <tr><td><code>?disabled=\${b}</code> (boolean)</td><td>Emits <code>disabled=""</code> iff truthy</td><td>Same</td></tr>
         <tr><td><code>.prop=\${v}</code> on a <strong>custom element</strong></td><td>Round-trips via <code>data-webjs-prop-*</code> attribute carrying the wire-encoded value; consumed by the SSR walker before <code>render()</code></td><td>Applied + stripped on <code>connectedCallback</code></td></tr>
         <tr><td><code>.prop=\${v}</code> on a <strong>native element</strong></td><td>Dropped (no SSR walker for native tags). Use the attribute form for SSR-visible values.</td><td>Applied directly as <code>el[prop] = v</code> when the template runs in the browser</td></tr>