Claim titles and bodies, disposition rationale and fix refs go through
neutralizeHtml, a copy of j4k/review's module. The rationale moves to its own
quoted block. Claim, superseded and disposition markers count only at the
start of a comment, so one quoted in untrusted text is ignored.

@@ -0,0 +73,4 @@
+
+  it("leaves code without a live `<` as markdown", () => {
+    expect(neutralizeHtml("`a<b` and ``a ` <b``", "block")).toBe("`a<b` and ``a ` <b``");
+    expect(neutralizeHtml("```ts\nconst a = 1;\n```", "block")).toBe("```ts\nconst a = 1;\n```");

@@ -0,0 +151,5 @@
+  });
+});
+
+// Each case reproduced a bypass of the hand-rolled tokenizer through Forgejo's renderer.
+describe("neutralizeHtml closes the reported bypasses", () => {

@@ -0,0 +7,5 @@
+ *  run of blocks (a quoted body). */
+export type MarkdownContext = "inline" | "block";
+
+// Emphasis cannot move a code or destination boundary, and micromark resolves it in
+// quadratic time: a 64 KiB body of `*a_` took 8.7 s with it and 15 ms without.

@@ -0,0 +46,5 @@
+  ["definitionDestinationLiteral", "destination"],
+]);
+
+/** Source CommonMark + GFM tables keep literal: a code span or block with the text it
+ *  displays, or an angle-bracket link destination with the text between its brackets. */

@@ -0,0 +36,5 @@
+  return rawHtmlNodes(markdown).filter((value) => !EMITTED.test(value));
+}
+
+/** Inputs whose neutralized form still holds raw HTML a parser sees, or any `<` that could
+ *  open a tag outside the HTML `neutralizeHtml` reports it emitted. */

@@ -0,0 +3,8 @@
+import { parseLiteralRanges } from "./parse-literal-ranges.ts";
+
+/** A `<` that can open raw HTML in a CommonMark renderer: `</`, `<!`, `<?`, or a tag name
+ *  followed by whatever may continue a tag (whitespace, `/`, `>`, end of text). Every other
+ *  `<` — `a < b`, `<https://x>`, `<user@example.com>` — is text in every dialect, so
+ *  autolinks survive untouched. Names take any letter, not just ASCII: goldmark matches
+ *  `<script` case-insensitively, and Go folds `ſ` to `s`. `\s` is the Unicode class, a
+ *  superset of what any renderer counts as whitespace. */

@@ -18,3 +17,3 @@
     claimMarker(claim.id),
-    `**${claim.severity}** — ${claim.title}`,
+    `**${claim.severity}** — ${neutralizeHtml(claim.title, "inline")}`,
     `lens \`${claim.lens}\` · arm \`${claim.arm}\` · ${tally}${wavering}`,

@@ -0,0 +1,21 @@
+import { PIECES } from "./markdown-pieces.fixture.ts";
+
+/** Deterministic random markdown built from those fragments. */

@@ -0,0 +238,5 @@
+  });
+});
+
+// Forgejo's math, definition lists, and heading attributes read code boundaries differently
+// from CommonMark; each input put a live tag on Forgejo while CommonMark saw it as code.

@@ -0,0 +54,6 @@
+
+/** A literal range that would carry a live `<`, rewritten so it no longer does. Code is
+ *  re-emitted as HTML with its content escaped, so it still shows verbatim but stays text
+ *  however the renderer reads the surrounding markdown. A block is one line: an HTML block
+ *  opened by `<pre` ends at the line holding `</pre>`, so no container prefix or blank line
+ *  inside it can matter. */

@@ -0,0 +130,7 @@
+  return segments;
+}
+
+/** Untrusted markdown with no `<` left that could open raw HTML, in prose, code, or link
+ *  destinations, so it holds whatever the renderer decides is code: Forgejo's math,
+ *  definition lists, and heading attributes draw code boundaries where CommonMark does not.
+ *  The parser only keeps code and destinations intact where the two agree. */

@@ -0,0 +6,4 @@
+import { neutralizeSegments } from "./neutralize-html.ts";
+
+/** The only HTML `neutralizeHtml` emits: a re-emitted code span or one-line code block. */
+// The parser already decided the block's indentation stays under four columns.

@@ -9,4 +11,5 @@
-// The claim ids carried by claimMarker(); a conversation with no match is a
+// Markers count only where the wrapper writes them, at the start of a comment:
+// one quoted further down a body is text, not a claim on the thread.
+// The claim id carried by claimMarker(); a conversation with no match is a
 // human thread and stays untouched. Two claims can share one conversation when
-// their anchors map to the same display line, so every marker counts.
-const CLAIM_MARKER_PATTERN = /<!-- review:claim:(?<claimId>\S+) -->/gu;
+// their anchors map to the same display line, so every comment's marker counts.

@@ -11,2 +15,2 @@
-// their anchors map to the same display line, so every marker counts.
-const CLAIM_MARKER_PATTERN = /<!-- review:claim:(?<claimId>\S+) -->/gu;
+// their anchors map to the same display line, so every comment's marker counts.
+const CLAIM_MARKER_PATTERN = /^<!-- review:claim:(?<claimId>\S+) -->/u;

@@ -0,0 +130,5 @@
+  return segments;
+}
+
+/** Untrusted markdown rewritten so no `<` can open raw HTML, whether it sits in prose, code,
+ *  or a link destination. The guarantee holds wherever the renderer draws code boundaries,

@@ -162,0 +203,4 @@
+    });
+    const bodies = (fake.posted[0] ?? []).map((comment) => comment.body);
+    expect(bodies).toHaveLength(400);
+    expect(htmlBeyondMarker(bodies)).toStrictEqual([]);

@@ -18,3 +17,3 @@
     claimMarker(claim.id),
-    `**${claim.severity}** — ${claim.title}`,
+    `**${claim.severity}** — ${neutralizeHtml(claim.title, "inline")}`,
     `lens \`${claim.lens}\` · arm \`${claim.arm}\` · ${tally}${wavering}`,

@@ -0,0 +137,7 @@
+  return segments;
+}
+
+/** Untrusted markdown rewritten so no `<` can open raw HTML, whether it sits in prose, code,
+ *  or a link destination. The guarantee holds wherever the renderer draws code boundaries,
+ *  including where Forgejo's math, definition lists, and heading attributes diverge from
+ *  CommonMark; code and destinations display verbatim only where the two agree. */

@@ -17,3 +16,3 @@
   return [
     claimMarker(claim.id),
-    `**${claim.severity}** — ${claim.title}`,
+    `**${claim.severity}** — ${neutralizeHtml(claim.title, "inline")}`,

@@ -24,3 +27,1 @@
-      if (claimId !== undefined && !ids.includes(claimId)) {
-        ids.push(claimId);
-      }
+    const claimId = CLAIM_MARKER_PATTERN.exec(comment.body)?.groups?.claimId;

@@ -162,0 +201,6 @@
+        ),
+      ),
+    });
+    const bodies = (fake.posted[0] ?? []).map((comment) => comment.body);
+    expect(bodies).toHaveLength(400);
+    expect(htmlBeyondMarker(bodies)).toStrictEqual([]);

@@ -48,3 +47,3 @@
         const { claim } = item;
         const marker = claimMarker(claim.id);
-        if (bodies.some((body) => body.includes(marker))) {
+        // Only a leading marker is one this wrapper wrote; a quoted one is text.