In Run-In Layout, CSS Display says

If a run-in sequence is immediately followed by a block box that does not establish a new block formatting context, it is inserted as direct children of the block box after its ::marker pseudo-element’s boxes (if any)

This is clear for most cases but not completely for some degenerated ones:

• The ::marker pseudo-element may have display: contents and thus generate no box, but its descendants (created via the content property) may do so. For consistency, I guess the run-in should be inserted after the boxes or text runs generated by these descendants.
• The ::marker pseudo-element may be wrapped inside an anonymous parent box (unless the run-in munging happens first, which I'm not sure in cases other than CSS2§9.2). For consistency, I guess the run-in should be inserted after that anonymous box.

So it could say something like

If a run-in sequence is immediately followed by a block box that does not establish a new block formatting context, it is inserted as direct children of the block box after any box or text run which is or contains any box or text run generated by any node in the subtree rooted at the ::marker pseudo-element.

However, this doesn't seem much natural. That's because ::marker lives in the (pseudo-)element-tree while the run-in munging is done in the box-tree. Would it be bad to simply insert the run-in at the very beginning of the block box?