Yes, sorry -- basically, if you could run user code by resolving a promise, the promise is latched, but then the actual resolution (where the user code is run) is deferred to another microtask.

The end goal here is to kill the litany of security bugs caused by creating then on Object.prototype

I would like reconsider whether to use <link type=module> for https://github.com/whatwg/html/pull/12860 at next week's sync. Last time it was discussed, annevk was against this because type is already used on <link> for MIME type enforcement.

I updated the PR to instead use a new attribute as the trigger (<link rel=stylesheet import=foo>), which would also allow for fallback on unsupported browsers via href, which I think is pretty nice. It also semantically indicates that it's a declarative version of a Javascript import.

However, there have been some comments in support of <link type=module> since I made the move away from it: https://github.com/whatwg/html/pull/12860#issuecomment-6064803258

The argument is essentially that type=module brings in more in sync with <script type=module>, and <script> has a carve-out for this, but <script> only allows "text/javascript" MIME types, while <link> supports many MIME types, so it's a higher bar for a carve-out.

We might want to use a new attribute instead of href anyways (since it behaves differently). If we do, type=module becomes redundant.

Curious what everyone's thoughts are - this was discussed briefly a few weeks ago, but members wanted some more time to think about introducing a new attribute.