diff --git a/source/basic.tex b/source/basic.tex
index 78a03978cd..e861d9af98 100644
--- a/source/basic.tex
+++ b/source/basic.tex
@@ -405,8 +405,9 @@
 an array operand, the set contains the potential results of that operand.
 \item If $E$ is a class member access
 expression\iref{expr.ref} of the form
-$E_1$ \tcode{.} \opt{\keyword{template}} $E_2$
-naming a non-static data member,
+$E_1$ \tcode{.} \opt{\keyword{template}} $E_2$,
+where $E_2$ designates a a non-static data member or
+a direct base class relationship,
 the set contains the potential results of $E_1$.
 \item If $E$ is a class member access expression
 naming a static data member,
@@ -1136,7 +1137,7 @@
 if its name is \tcode{_} (\unicode{005f}{low line}) and it declares
 \begin{itemize}
 \item
-a variable with automatic storage duration,
+a variable, other than a function parameter, with automatic storage duration,
 \item
 a structured binding
 %FIXME: "and" is strange below; maybe reword to something like:
@@ -1439,8 +1440,8 @@
 \grammarterm{compound-statement} of a \grammarterm{lambda-expression},
 \grammarterm{function-body}, or \grammarterm{function-try-block},
 \item
-substatement of a selection or iteration statement
-that is not itself a selection or iteration statement, or
+substatement of a selection, iteration, or expansion statement
+that is not itself a selection, iteration, or expansion statement, or
 \item
 \grammarterm{handler} of a \grammarterm{function-try-block}
 \end{itemize}
@@ -3271,6 +3272,8 @@
 \item
 an entity, value, or object that is TU-local,
 \item
+an annotation\iref{dcl.attr.annotation},
+\item
 a direct base class relationship $(D, B)$\iref{class.derived.general}
 for which either $D$ or $B$ is TU-local, or
 \item
@@ -3663,6 +3666,24 @@
 the address of an unspecified byte of storage
 occupied by the complete object of that subobject.
 
+\pnum
+The \defnx{constituent values}{constituent value} of an object $o$ are
+\begin{itemize}
+\item
+if $o$ has scalar type, the value of $o$;
+\item
+otherwise, the constituent values of any direct subobjects of $o$
+other than inactive union members.
+\end{itemize}
+The \defnx{constituent references}{constituent reference} of an object $o$ are
+\begin{itemize}
+\item
+any direct members of $o$ that have reference type, and
+\item
+the constituent references of any direct subobjects of $o$
+other than inactive union members.
+\end{itemize}
+
 \pnum
 Some operations are described as
 \defnx{implicitly creating objects}{object!implicit creation}
@@ -4900,24 +4921,32 @@
 \pnum
 The fourth context is when a temporary object
 is created in the \grammarterm{for-range-initializer} of
-either a range-based \keyword{for} statement
-or an enumerating expansion statement\iref{stmt.expand}.
+a range-based \keyword{for} statement.
 If such a temporary object would otherwise be destroyed
 at the end of the \grammarterm{for-range-initializer} full-expression,
 the object persists for the lifetime of the reference
 initialized by the \grammarterm{for-range-initializer}.
 
 \pnum
-The fifth context is when a temporary object is created
+The fifth context is when a temporary object is created in an element $E$
+of the \grammarterm{expansion-init-list}
+of an enumerating expansion statement\iref{stmt.expand}.
+If such a temporary object would otherwise be destroyed
+at the end of the full-expression of $E$,
+the object persists for the lifetime of the \grammarterm{for-range-declaration}
+initialized from $E$.
+
+\pnum
+The sixth context is when a temporary object is created
 in the \grammarterm{expansion-initializer}
-of an iterating or destructuring expansion statement.
+of a destructuring expansion statement.
 If such a temporary object would otherwise be destroyed
 at the end of that \grammarterm{expansion-initializer},
 the object persists for the lifetime of the reference
 initialized by the \grammarterm{expansion-initializer}, if any.
 
 \pnum
-The sixth context is when a temporary object
+The seventh context is when a temporary object
 is created in a structured binding declaration\iref{dcl.struct.bind}.
 Any temporary objects introduced by
 the \grammarterm{initializer}{s} for the variables
@@ -5295,9 +5324,17 @@
 layout-compatible standard-layout class types\iref{class.mem}.
 
 \pnum
-A type is \defn{consteval-only} if it is either
-\tcode{std::meta::info} or
-a type compounded from a consteval-only type\iref{basic.compound}.
+A type is \defn{consteval-only} if it is
+\begin{itemize}
+\item \tcode{std::meta::info},
+\item \cv{}~\tcode{T}, where \tcode{T} is a consteval-only type,
+\item a pointer or reference to a consteval-only type,
+\item an array of consteval-only type,
+\item a function type having a return type or any parameter type that is consteval-only,
+\item a class type with any non-static data member having consteval-only type, or
+\item a type ``pointer to member of class \tcode{C} of type \tcode{T}'',
+where at least one of \tcode{C} or \tcode{T} is a consteval-only type.
+\end{itemize}
 Every object of consteval-only type shall be
 \begin{itemize}
 \item
@@ -5308,6 +5345,8 @@
 an object whose lifetime begins and ends
 during the evaluation of a core constant expression.
 \end{itemize}
+Every function of consteval-only type shall be
+an immediate function\iref{expr.const}.
 
 \rSec2[basic.fundamental]{Fundamental types}
 
@@ -7012,13 +7051,6 @@
 observable behavior of the abstract machine.
 \end{example}
 
-\pnum
-\begin{note}
-Because of this and the preceding requirement regarding what threads of execution
-have to perform eventually, it follows that no thread of execution can execute
-forever without an execution step occurring.
-\end{note}
-
 \pnum
 A thread of execution \defnx{makes progress}{make progress!thread}
 when an execution step occurs or a
diff --git a/source/classes.tex b/source/classes.tex
index 742e3c6493..d208d0217f 100644
--- a/source/classes.tex
+++ b/source/classes.tex
@@ -4185,8 +4185,9 @@
 \indextext{function!virtual|)}
 
 \pnum
-A \keyword{consteval} virtual function shall not override
-a virtual function that is not \keyword{consteval}.
+A class with a \keyword{consteval} virtual function that overrides
+a virtual function that is not \keyword{consteval}
+shall have consteval-only type\iref{basic.types.general}.
 A \keyword{consteval} virtual function shall not be overridden by
 a virtual function that is not \keyword{consteval}.
 
@@ -5177,7 +5178,8 @@
 \pnum
 An additional access check beyond those described earlier in \ref{class.access}
 is applied when a non-static data member or non-static member function is a
-protected member of its designating class\iref{class.access.base}.
+protected member of its designating class\iref{class.access.base}
+and is not designated by a \grammarterm{splice-expression}.
 \begin{footnote}
 This
 additional check does not apply to other members,
@@ -5186,9 +5188,11 @@
 As described earlier, access to a protected member is granted because the
 reference occurs in a friend or direct member of some class \tcode{C}. If the access is
 to form a pointer to member\iref{expr.unary.op}, the
-\grammarterm{nested-name-specifier} shall denote \tcode{C} or a class derived from
-\tcode{C}. All other accesses involve a (possibly implicit) object
-expression\iref{expr.ref}. In this case, the class of the object expression shall be
+\grammarterm{nested-name-specifier} shall designate \tcode{C} or a class derived from
+\tcode{C}.
+Otherwise, if the access involves a (possibly implicit)
+object expression\iref{expr.prim.id.general,expr.ref},
+the class of the object expression shall be
 \tcode{C} or a class derived from \tcode{C}.
 \begin{example}
 \begin{codeblock}
diff --git a/source/declarations.tex b/source/declarations.tex
index 31f91c4c9b..2faba44031 100644
--- a/source/declarations.tex
+++ b/source/declarations.tex
@@ -5094,32 +5094,38 @@
 \end{itemize}
 
 \pnum
-A class type \tcode{T} is \defn{const-default-constructible} if
+A type \cv{}~\tcode{T} is \defn{const-default-constructible} if
+\begin{itemize}
+\item
+\tcode{T} is \tcode{std::meta::info};
+\item
+\tcode{T} is \tcode{std::nullptr_t};
+\item
 default-initialization of \tcode{T} would invoke
-a user-provided constructor of \tcode{T} (not inherited from a base class)
-or if
+a user-provided constructor of \tcode{T} (not inherited from a base class);
+\item
+\tcode{T} is a class type where
 \begin{itemize}
 \item
-each direct non-variant non-static data member \tcode{M} of \tcode{T}
-has a default member initializer
-or, if \tcode{M} is of class type \tcode{X} (or array thereof),
-\tcode{X} is const-default-constructible,
+each direct non-variant non-static data member of \tcode{T}
+has a default member initializer or
+is of const-default-constructible type,
 \item
 if \tcode{T} is a union with at least one non-static data member,
 exactly one variant member has a default member initializer,
 \item
 if \tcode{T} is not a union,
-for each anonymous union member with at least one non-static data member (if any),
-exactly one non-static data member has a default member initializer, and
+the type of each anonymous union member is const-default-constructible, and
+\item
+each potentially constructed base class of \tcode{T} is const-default-constructible; or
+\end{itemize}
 \item
-each potentially constructed base class of \tcode{T} is const-default-constructible.
+\tcode{T} is an array of const-default-constructible type.
 \end{itemize}
 
 If a program calls for the default-initialization of an object of a
 const-qualified type \tcode{T},
-\tcode{T} shall be \tcode{std::meta::\linebreak info}
-or a const-default-constructible class type,
-or array thereof.
+\tcode{T} shall be a const-default-constructible type.
 
 \pnum
 To
@@ -9791,6 +9797,9 @@
 the next statement shall be part of the same execution of
 the substatement of the innermost enclosing iteration statement.
 The program is ill-formed if there is no such statement.
+The innermost enclosing \tcode{switch} statement
+of a fallthrough statement $S$ shall be contained in
+the innermost enclosing expansion statement\iref{stmt.expand} of $S$, if any.
 
 \pnum
 \recommended
@@ -10196,14 +10205,15 @@
 \indextext{attribute!annotations}
 
 \pnum
-An annotation may be applied to any declaration of a
+An annotation may be applied
+to a \grammarterm{base-specifier} or
+to any declaration of a
 type,
 type alias,
 variable,
 function,
 namespace,
-enumerator,
-\grammarterm{base-specifier}, or
+enumerator, or
 non-static data member.
 
 \pnum
diff --git a/source/expressions.tex b/source/expressions.tex
index 2bfc4057de..38f0d83b65 100644
--- a/source/expressions.tex
+++ b/source/expressions.tex
@@ -147,7 +147,10 @@
 \end{importgraphic}
 
 \begin{itemize}
-\item A \defn{glvalue} is an expression whose evaluation determines the identity of an object, function, or non-static data member.
+\item A \defn{glvalue} is an expression
+whose evaluation determines the identity of
+an object, function, non-static data member, or
+a direct base class relationship.
 \item A \defn{prvalue} is an expression whose evaluation initializes an object
 or computes the value of an operand of an operator,
 as specified by the context in which it appears,
@@ -1482,6 +1485,10 @@
 \end{example}
 \end{itemize}
 
+\pnum
+A \grammarterm{splice-expression} that designates a direct base class relationship
+shall appear only as the second operand of a class member access.
+
 \pnum
 For an \grammarterm{id-expression} that denotes an overload set,
 overload resolution is performed
@@ -3589,6 +3596,10 @@
 does not apply to a \grammarterm{splice-expression}.
 \end{note}
 \item
+Otherwise, if $S$ is a direct base class relationship $(\tcode{D}, \tcode{B})$,
+the expression is an lvalue designating $S$.
+The expression has the type \tcode{B}.
+\item
 Otherwise, if $S$ is a variable or a structured binding,
 $S$ shall either have static or thread storage duration or
 shall inhabit a scope enclosing the expression.
@@ -4300,17 +4311,18 @@
 whose value is the value of the enumerator.
 
 \item
-Otherwise, if \tcode{E2} designates a direct base class relationship $(D, B)$
-and the type of \tcode{E1} is \cv{} \tcode{T},
+Otherwise, if \tcode{E2} designates a direct base class relationship $(D, B)$ and
+$D$ is either the cv-unqualified class type of \tcode{E1} or a base class thereof,
+let \cv{} be the cv-qualification of the type of \tcode{E1}.
+\tcode{E1} is implicitly converted to the type ``reference to \cv{}~\tcode{$D$}''
+(where the reference is an lvalue reference if \tcode{E1} is an lvalue
+and an rvalue reference otherwise) and
 the expression designates the direct base class subobject of type $B$
-of the object designated by \tcode{E1}.
+of the object designated by the converted \tcode{E1}.
 If \tcode{E1} is an lvalue,
 then \tcode{E1.E2} is an lvalue;
 otherwise, \tcode{E1.E2} is an xvalue.
-The type of \tcode{E1.E2} is ``\cv{} \tcode{$B$}''.
-\begin{note}
-This can only occur in an expression of the form \tcode{e1.[:e2:]}.
-\end{note}
+The type of \tcode{E1.E2} is \cv{}~\tcode{$B$}.
 \begin{example}
 \begin{codeblock}
 struct B {
@@ -4351,7 +4363,8 @@
 
 \pnum
 If \tcode{E2} designates a non-static member
-(possibly after overload resolution) and
+(possibly after overload resolution)
+or direct base class relationship and
 the result of \tcode{E1} is an object whose type
 is not similar\iref{conv.qual} to the type of \tcode{E1},
 the behavior is undefined.
@@ -4951,17 +4964,13 @@
 \indextext{cast!undefined pointer-to-function}%
 A function pointer can be explicitly converted
 to a function pointer of a different type.
+The function pointer value is unchanged by the conversion.
 \indextext{function call!undefined}%
 \begin{note}
 The effect of calling a function through a pointer to a function
-type\iref{dcl.fct} that is not the same as the type used in the
+type\iref{dcl.fct} that is not call-compatible with the type used in the
 definition of the function is undefined\iref{expr.call}.
 \end{note}
-Except that converting
-a prvalue of type ``pointer to \tcode{T1}'' to the type ``pointer to
-\tcode{T2}'' (where \tcode{T1} and \tcode{T2} are function types) and
-back to its original type yields the original pointer value, the result
-of such a pointer conversion is unspecified.
 
 \pnum
 An object pointer
@@ -6785,9 +6794,11 @@
 a placeholder type\iref{dcl.spec.auto.general},
 $R$ is ill-formed.
 \item
-Otherwise, if the \grammarterm{type-id} names a type alias
-that is a specialization of an alias template\iref{temp.alias},
-$R$ represents that type alias.
+Otherwise, if the \grammarterm{type-id} is of the form
+\opt{\grammarterm{nested-name-specifier}} \opt{\keyword{template}} \grammarterm{simple-template-id}
+and whose terminal name is a \grammarterm{template-name}
+that names an alias template\iref{temp.alias},
+$R$ represents the type alias so named.
 \item
 Otherwise, $R$ represents the type denoted by the \grammarterm{type-id}.
 \end{itemize}
@@ -8277,31 +8288,13 @@
     conditional-expression
 \end{bnf}
 
-\pnum
-The \defnx{constituent values}{constituent value} of an object $o$ are
-\begin{itemize}
-\item
-if $o$ has scalar type, the value of $o$;
-\item
-otherwise, the constituent values of any direct subobjects of $o$
-other than inactive union members.
-\end{itemize}
-The \defnx{constituent references}{constituent reference} of an object $o$ are
-\begin{itemize}
-\item
-any direct members of $o$ that have reference type, and
-\item
-the constituent references of any direct subobjects of $o$
-other than inactive union members.
-\end{itemize}
-
 \pnum
 The constituent values and constituent references of
 a variable \tcode{x} are defined as follows:
 \begin{itemize}
 \item
 If \tcode{x} declares an object,
-the constituent values and references of that object are
+the constituent values and references of that object\iref{intro.object} are
 constituent values and references of \tcode{x}.
 \item
 If \tcode{x} declares a reference,
@@ -8790,8 +8783,7 @@
 For the purposes of determining
 whether an expression $E$ is a core constant expression,
 the evaluation of the body of a member function of \tcode{std::allocator<T>}
-as defined in \ref{allocator.members}, where \tcode{T} is a literal type,
-is ignored.
+as defined in \ref{allocator.members}, is ignored.
 
 \pnum
 For the purposes of determining whether $E$ is a core constant expression,
@@ -9154,10 +9146,13 @@
 in an immediate-escalating function.
 
 \pnum
-An \defnadj{immediate}{function} is a function that is either
+An \defnadj{immediate}{function} is a function that is
 \begin{itemize}
 \item
-declared with the \keyword{consteval} specifier, or
+declared with the \keyword{consteval} specifier,
+\item
+an immediate-escalating function
+whose type is consteval-only\iref{basic.types.general}, or
 \item
 an immediate-escalating function \tcode{\placeholder{F}}
 whose function body contains either
diff --git a/source/lex.tex b/source/lex.tex
index 8005b33374..49305fba49 100644
--- a/source/lex.tex
+++ b/source/lex.tex
@@ -165,14 +165,14 @@
 as specified in \ref{lex.string}.
 Each such \grammarterm{string-literal} preprocessing token is then considered to have
 that common \grammarterm{encoding-prefix}.
-
-\item
 \indextext{concatenation!string}%
-Adjacent \grammarterm{string-literal} preprocessing tokens are concatenated\iref{lex.string}.
+Then, adjacent \grammarterm{string-literal} preprocessing tokens are concatenated\iref{lex.string}.
 
 \item
 Each preprocessing token is converted into a token\iref{lex.token}.
-The resulting tokens constitute a \defn{translation unit} and
+
+\item
+The tokens constitute a \defn{translation unit} and
 are syntactically and
 semantically analyzed as a \grammarterm{translation-unit}\iref{basic.link} and
 translated.
@@ -548,7 +548,7 @@
 
 \pnum
 A preprocessing token is the minimal lexical element of the language in translation
-phases 3 through 6.
+phases 3 through 5.
 In this document,
 glyphs are used to identify
 elements of the basic character set\iref{lex.charset}.
@@ -808,7 +808,7 @@
 \end{bnf}
 
 Each \grammarterm{operator-or-punctuator} is converted to a single token
-in translation phase 7\iref{lex.phases}.%
+in translation phase 6\iref{lex.phases}.%
 \indextext{punctuator|)}%
 \indextext{operator|)}
 
@@ -1972,7 +1972,7 @@
 \end{note}
 
 \pnum
-In translation phase 6\iref{lex.phases},
+In translation phase 5\iref{lex.phases},
 adjacent \grammarterm{string-literal}s are concatenated.
 The lexical structure and grouping of
 the contents of the individual \grammarterm{string-literal}s is retained.
@@ -2321,11 +2321,11 @@
 \end{example}
 
 \pnum
-In translation phase 6\iref{lex.phases}, adjacent \grammarterm{string-literal}s are concatenated and
+In translation phase 5\iref{lex.phases}, adjacent \grammarterm{string-literal}s are concatenated and
 \grammarterm{user-defined-string-literal}{s} are considered \grammarterm{string-literal}s for that
 purpose. During concatenation, \grammarterm{ud-suffix}{es} are removed and ignored and
 the concatenation process occurs as described in~\ref{lex.string}. At the end of phase
-6, if a \grammarterm{string-literal} is the result of a concatenation involving at least one
+5, if a \grammarterm{string-literal} is the result of a concatenation involving at least one
 \grammarterm{user-defined-string-literal}, all the participating
 \grammarterm{user-defined-string-literal}{s} shall have the same \grammarterm{ud-suffix}
 and that suffix is applied to the result of the concatenation.
diff --git a/source/meta.tex b/source/meta.tex
index f0bd37f53d..a4920d5294 100644
--- a/source/meta.tex
+++ b/source/meta.tex
@@ -6548,22 +6548,19 @@
   \item
     \tcode{holds_alternative<u8string>(options.name->\exposid{contents})} is \tcode{true}
     and \tcode{get<u8string>(\brk{}options.name->\exposid{contents})}
-    contains a valid identifier\iref{lex.name}
-    that is not a keyword\iref{lex.key}
+    contains the spelling of a valid \grammarterm{token}
+    that is an \grammarterm{identifier}\iref{lex.name}
     when interpreted with UTF-8, or
   \item
     \tcode{holds_alternative<string>(options.name->\exposid{contents})} is \tcode{true}
     and \tcode{get<string>(opt\-ions.name->\exposid{contents})}
-    contains a valid identifier\iref{lex.name}
-    that is not a keyword\iref{lex.key}
+    contains the spelling of a valid \grammarterm{token}
+    that is an \grammarterm{identifier}\iref{lex.name}
     when interpreted with the ordinary literal encoding;
   \end{itemize}
   \begin{note}
-  The name corresponds to the spelling of an identifier~token
-  after phase~6 of translation\iref{lex.phases}.
   Lexical constructs like
-  \grammarterm{universal-character-name}s\iref{lex.universal.char} are not processed
-  and will cause evaluation to fail.
+  \grammarterm{universal-character-name}s\iref{lex.universal.char} are not processed.
   For example, \tcode{R"(\textbackslash u03B1)"} is an invalid identifier
   and is not interpreted as \tcode{"$\alpha$"}.
   \end{note}
diff --git a/source/overloading.tex b/source/overloading.tex
index 7b882855b9..eda98e262d 100644
--- a/source/overloading.tex
+++ b/source/overloading.tex
@@ -3708,6 +3708,15 @@
 \begin{ncsimplebnf}
 \terminal{(} postfix-expression . \keyword{operator} \terminal{->} \terminal{(}\terminal{)} \terminal{)} \terminal{->} \opt{\keyword{template}} id-expression
 \end{ncsimplebnf}
+Analogously, for an expression of the form
+\begin{ncsimplebnf}
+postfix-expression \terminal{->} splice-expression
+\end{ncsimplebnf}
+the operator function is selected by overload resolution,
+and the expression is interpreted as
+\begin{ncsimplebnf}
+\terminal{(} postfix-expression . \keyword{operator} \terminal{->} \terminal{(}\terminal{)} \terminal{)} \terminal{->} splice-expression
+\end{ncsimplebnf}
 
 \rSec2[over.inc]{Increment and decrement}
 \indextext{increment operator!overloaded|see{overloading, increment operator}}%
diff --git a/source/preprocessor.tex b/source/preprocessor.tex
index 43b2c6a484..ec7bb176c5 100644
--- a/source/preprocessor.tex
+++ b/source/preprocessor.tex
@@ -1219,12 +1219,6 @@
     \opt{\keyword{export}} \keyword{module} \opt{pp-tokens} \terminal{;} new-line
 \end{bnf}
 
-\pnum
-A \grammarterm{pp-module} shall not
-appear in a context where \tcode{module}
-or (if it is the first preprocessing token of the \grammarterm{pp-module}) \tcode{export}
-is an identifier defined as an object-like macro.
-
 \pnum
 The \grammarterm{pp-tokens}, if any, of a \grammarterm{pp-module}
 shall be of the form:
@@ -1280,12 +1274,6 @@
     \opt{\keyword{export}} \keyword{import} pp-tokens \terminal{;} new-line
 \end{bnf}
 
-\pnum
-A \grammarterm{pp-import} shall not
-appear in a context where \tcode{import}
-or (if it is the first preprocessing token of the \grammarterm{pp-import}) \tcode{export}
-is an identifier defined as an object-like macro.
-
 \pnum
 The preprocessing tokens after the \tcode{import} preprocessing token
 in the \tcode{import} \grammarterm{control-line}
@@ -1537,7 +1525,7 @@
 to the identifiers listed in \tref{lex.name.special}, or
 to the \grammarterm{attribute-token}{s} described in~\ref{dcl.attr},
 except that the macro names \tcode{likely} and \tcode{unlikely} may be
-defined as function-like macros.
+defined as function-like macros and may be undefined.
 
 \pnum
 If a
diff --git a/source/statements.tex b/source/statements.tex
index 34018bd618..19925f6c3e 100644
--- a/source/statements.tex
+++ b/source/statements.tex
@@ -807,7 +807,8 @@
 
 \begin{bnf}
 \nontermdef{expansion-init-list}\br
-    \terminal{\{} \opt{expression-list} \terminal{\}}
+    \terminal{\{} expression-list \opt{\terminal{,}} \terminal{\}}
+    \terminal{\{} \terminal{\}}
 \end{bnf}
 
 \pnum
@@ -871,9 +872,9 @@
 \begin{codeblock}
 {
   @\grammarterm{init-statement}@
-  static constexpr auto&& @\exposidnc{range}@ = @\grammarterm{expansion-initializer}@;
-  static constexpr auto @\exposidnc{begin}@ = @\exposidnc{begin-expr}@;     // see \ref{stmt.ranged}
-  static constexpr auto @\exposidnc{end}@ = @\exposidnc{end-expr}@;         // see \ref{stmt.ranged}
+  constexpr auto&& @\exposidnc{range}@ = @\grammarterm{expansion-initializer}@;
+  constexpr auto @\exposidnc{begin}@ = @\exposidnc{begin-expr}@;     // see \ref{stmt.ranged}
+  constexpr auto @\exposidnc{end}@ = @\exposidnc{end-expr}@;         // see \ref{stmt.ranged}
 
   @$S_{0}$@
   @\vdots@
@@ -884,27 +885,39 @@
 \begin{codeblock}
 [] consteval {
   std::ptrdiff_t result = 0;
-  for (auto i = @\exposid{begin}@; i != @\exposid{end}@; ++i, ++result);
+  for (auto i = @\exposid{begin}@; i != @\exposid{end}@; ++i) ++result;
   return result;                                // distance from \exposid{begin} to \exposid{end}
 }()
 \end{codeblock}
 and $S_{i}$ is
 \begin{codeblock}
 {
-  static constexpr auto @\exposid{iter}@ = @\exposid{begin}@ + i;
+  constexpr auto @\exposid{iter}@ = @\exposid{begin}@ + decltype(begin - begin){\placeholder{i}};
   @\grammarterm{for-range-declaration}@ = *@\exposid{iter}@;
   @\grammarterm{compound-statement}@
 }
 \end{codeblock}
 The variables \exposid{range}, \exposid{begin}, \exposid{end}, and \exposid{iter}
 are defined for exposition only.
+The identifier \tcode{\placeholder{i}} is considered to be
+a prvalue of type \tcode{std::ptrdiff_t};
+the program is ill-formed if
+\tcode{\placeholder{i}} is not representable as such a value.
 \begin{note}
 The instantiation is ill-formed if \exposid{range}
 is not a constant expression\iref{expr.const}.
 \end{note}
 
 \item
-Otherwise, $S$ is a destructuring expansion statement and $S$ is equivalent to:
+Otherwise, $S$ is a destructuring expansion statement and,
+if $N$ is 0, $S$ is equivalent to:
+\begin{codeblock}
+{
+  @\grammarterm{init-statement}@
+  @\opt{\keyword{constexpr}}@ auto&& range = @\grammarterm{expansion-initializer}@;
+}
+\end{codeblock}
+otherwise, $S$ is equivalent to:
 \begin{codeblock}
 {
   @\grammarterm{init-statement}@
@@ -1052,8 +1065,7 @@
 If the innermost enclosing such statement $X$
 is an \grammarterm{iteration-statement}\iref{stmt.iter},
 the \keyword{continue} statement
-causes control to pass to the end of the \grammarterm{statement}
-or \grammarterm{compound-statement} of $X$.
+causes control to pass to the end of the \grammarterm{statement} of $X$.
 Otherwise, control passes to the end of the \grammarterm{compound-statement}
 of the current $S_{i}$\iref{stmt.expand}.
 
@@ -1132,10 +1144,14 @@
 \end{note}
 
 \pnum
-In a function whose return type is a reference,
+In a function
 other than an invented function for \tcode{std::is_convertible}\iref{meta.rel},
-a \tcode{return} statement that binds the returned reference to
-a temporary expression\iref{class.temporary} is ill-formed.
+a \tcode{return} statement that binds
+\begin{itemize}
+\item a returned reference or
+\item a constituent reference\iref{intro.object} of a returned object
+\end{itemize}
+to a temporary expression\iref{class.temporary} is ill-formed.
 \begin{example}
 \begin{codeblock}
 auto&& f1() {
diff --git a/source/templates.tex b/source/templates.tex
index b917ed37eb..d6492f1030 100644
--- a/source/templates.tex
+++ b/source/templates.tex
@@ -126,6 +126,27 @@
 in the declaration shall contain at most one declarator.
 When such a declaration is used to declare a class template,
 no declarator is permitted.
+In a \grammarterm{template-declaration}
+whose \grammarterm{declaration} is a \grammarterm{friend-type-declaration},
+the \grammarterm{friend-type-declaration} shall be of the form
+\begin{ncsimplebnf}
+\keyword{friend} friend-type-specifier \terminal{;}
+\end{ncsimplebnf}
+\begin{example}
+\begin{codeblock}
+template<class ...>
+struct C {
+  struct Nested { };
+};
+
+template<class ... Us>
+struct S {
+  template <typename ...Ts>
+  friend class C<Ts>::Nested...;        // error: pack expansion is not a \grammarterm{friend-type-specifier}
+  friend class C<Us>::Nested...;        // OK, not a \grammarterm{template-declaration}
+};
+\end{codeblock}
+\end{example}
 
 \pnum
 \indextext{template name!linkage of}%
@@ -918,7 +939,7 @@
 \grammarterm{splice-specialization-specifier}
 shall be valid unless its respective
 \grammarterm{template-name} or \grammarterm{splice-specifier}
-names or designates a function template\iref{temp.deduct}.
+designates a function template\iref{temp.deduct}.
 \begin{example}
 \begin{codeblock}
 template<class T, T::type n = 0> class X;
@@ -4626,7 +4647,9 @@
 the alias template.
 Any other \grammarterm{template-id}
 that names a specialization of an alias template is
-a \grammarterm{typedef-name} for a type alias.
+a \grammarterm{typedef-name} for a type alias;
+such a \grammarterm{template-id} is ill-formed if
+forming the associated type results in substitution failure.
 \begin{note}
 An alias template name is never deduced.
 \end{note}
@@ -5709,7 +5732,7 @@
 a structured binding declaration\iref{dcl.struct.bind} whose
 \grammarterm{brace-or-equal-initializer} is type-dependent,
 \item
-associated by name lookup with a pack,
+associated by name lookup with a structured binding pack,
 \begin{example}
 \begin{codeblock}
 struct C { };
@@ -5751,8 +5774,8 @@
 of an \grammarterm{expansion-statement} $S$
 if the type specified for $N$ contains a placeholder type and either
 \begin{itemize}
-\item the \grammarterm{expansion-initializer} of $S$ is type-dependent or
-\item $S$ is not an iterating expansion statement, or
+\item $S$ is not an iterating expansion statement or
+\item the \grammarterm{expansion-initializer} of $S$ is type-dependent, or
 \end{itemize}
 \item
 dependent
@@ -5811,9 +5834,15 @@
 \pnum
 A class member access expression\iref{expr.ref} is
 type-dependent if
-the terminal name of its \grammarterm{id-expression}, if any, is dependent or
+\begin{itemize}
+\item
+the terminal name of its \grammarterm{id-expression}, if any, is dependent,
+\item
+its \grammarterm{splice-expression}, if any, is type-dependent, or
+\item
 the expression refers to a member of the current instantiation and
 the type of the referenced member is dependent.
+\end{itemize}
 \begin{note}
 In an expression of the form
 \tcode{x.y}