The URL serializer doesn't add the query string for URLs with non-relative schemes (those with scheme data instead of paths), even though the "scheme data" state switches to the query state and parses the query string as appropriate for those URLs.  This affects mailto URLs in particular; the query string containing the subject and so on is parsed, but the query string doesn't appear when it's serialized.

Also, what's the purpose of the relative flag?  Since, it seems to me, the flag is set only "if url's scheme is a relative scheme", and isn't set otherwise, I think it may serve to simplify implementations if those words ("if url's scheme is a relative scheme") appear instead of "if url's relative flag is set", etc. whenever possible. Although doing so may also complicate how setting the "protocol" attribute works, since the path, host, and so on may need to be converted to scheme data or vice versa, so I'll let you decide.