Table content models impose implicit tree fixups via 'foster parenting'. For the malformed table below, where does the stray text "oops" end up in the constructed DOM, per the tree-construction algorithm?