/**
 * Phase-0 GOLDEN CHARACTERIZATION TESTS for the markdown renderer unification.
 *
 * These snapshots capture the CURRENT output of `SimpleMarkdownRenderer` and
 * `RichMarkdownRenderer` over a fixture corpus BEFORE the unified engine
 * refactor. After the refactor the same tests must produce identical
 * snapshots, except for deltas explicitly reviewed in the migration plan
 * (blockquote bg token, ODS `article` typography preset, sanitizer applied
 * to Rich, and the code-block font: the old inline "JetBrains Mono", "SF
 * Mono", Consolas stack is now the ODS `font-mono` class — see the
 * ODS-TOKENS note in ../markdown/base-components.tsx).
 *
 * Leaf embed components (Video, Reddit/Twitter/LinkedIn embeds,
 * OGLinkPreview, FigmaEmbed, MarkdownImage) and `mermaid` are mocked to
 * cheap deterministic stubs — the parity target is the RENDERER PIPELINE
 * (remark/rehype plugins, preprocessing, component map, heading ids,
 * sanitization), not the leaves. The same mocks apply pre- and
 * post-refactor, so snapshots stay comparable.
 */
import React from 'react'
import { describe, it, expect, vi } from 'vitest'
import { render, act } from '@testing-library/react'

// ---------------------------------------------------------------------------
// Leaf mocks (stable across the refactor)
// ---------------------------------------------------------------------------
vi.mock('mermaid', () => ({
  default: {
    initialize: vi.fn(),
    render: vi.fn(async () => ({ svg: '<svg data-mock-mermaid="true" width="100" height="50"></svg>' })),
  },
}))

vi.mock('@/components/features/video', () => ({
  Video: ({ kind, url, poster }: any) => (
    <div data-mock="video" data-kind={kind} data-url={url} data-poster={poster ?? ''} />
  ),
}))

vi.mock('@/components/embeds/reddit-embed-client', () => ({
  RedditEmbedClient: ({ url }: any) => <div data-mock="reddit" data-url={url} />,
}))

vi.mock('@/components/embeds/twitter-embed-client', () => ({
  TwitterEmbedClient: ({ url }: any) => <div data-mock="twitter" data-url={url} />,
}))

vi.mock('@/components/embeds/linkedin-embed-client', () => ({
  LinkedInEmbedClient: ({ url }: any) => <div data-mock="linkedin" data-url={url} />,
}))

vi.mock('@/components/embeds/og-link-preview', () => ({
  OGLinkPreview: ({ url }: any) => <div data-mock="og-preview" data-url={url} />,
  OGLinkErrorBoundary: ({ children }: any) => <>{children}</>,
}))

vi.mock('@/components/embeds/figma-embed', () => ({
  FigmaEmbed: ({ url }: any) => <div data-mock="figma" data-url={url} />,
}))

vi.mock('@/components/embeds/markdown-image', () => ({
  MarkdownImage: ({ src, alt }: any) => <img data-mock="markdown-image" src={src} alt={alt ?? ''} />,
}))

import { SimpleMarkdownRenderer } from '../markdown'
import { RichMarkdownRenderer } from '../markdown'
import { remarkCardLinks } from '../../chat/remark-card-links'
import { remarkMentionChips } from '../../chat/remark-mention-chips'
import { extractSections } from '../../../utils/markdown-section-extractor'
import { scanHeadings } from '../../../utils/markdown-heading-id'
import {
  __buildCloserHaystackForTest,
  __findInlineCodeRangesForTest,
  escapeUnknownHtmlTags,
} from '../markdown/sanitize'
import { splitStreamingBlocks } from '../markdown/streaming'
import { isBlankLine } from '../../../utils/markdown-fences'
import { unified } from 'unified'
import remarkParse from 'remark-parse'

// ---------------------------------------------------------------------------
// Fixture corpus (per migration plan §D1 parity verification)
// ---------------------------------------------------------------------------
const SHARED_FIXTURES: Record<string, string> = {
  'gfm-table': `
| Col A | Col B |
|-------|-------|
| a1    | b1    |
| a2    | b2    |
`,
  'task-list': `
- [x] done item
- [ ] open item
`,
  'nested-lists': `
1. first
   - nested a
   - nested b
2. second
   1. sub one
   2. sub two
`,
  'loose-ordered-list': `
1. first paragraph item

2. second paragraph item

3. third paragraph item
`,
  'fenced-code-js': '```js\nconst x = 1;\nconsole.log(x < 2 && x > 0);\n```',
  'fenced-code-unknown-lang': '```qwerty-lang\nsome text < with > angles\n```',
  'inline-code': 'Use `<their>` and `npm install` inline.',
  mermaid: '```mermaid\ngraph TD;\nA-->B;\n```',
  'headings-with-emoji-and-dupes': `
# 🚀 Getting Started

## Setup

## Setup

### Deep Dive 🔧

#### H4 level

##### H5 level

###### H6 level
`,
  links: `
[external](https://example.com/page) and [anchor](#setup) and plain text.
`,
  'reference-style-link': `
See [the docs][ref] for details.

[ref]: https://example.com/reference
`,
  images: `
![alt text](https://example.com/pic.png)

![](https://example.com/no-alt.png)
`,
  'empty-image': '![empty]()',
  blockquote: `
> A quoted paragraph
> spanning two lines.
`,
  'blockquote-with-blank-line': `
> first quoted para
>
> second quoted para
`,
  hr: 'above\n\n---\n\nbelow',
  'raw-html-safe': `
<details><summary>More</summary>

hidden body

</details>

Line<br>break and <kbd>Ctrl</kbd>+<mark>C</mark>.
`,
  'raw-html-unknown-tag': 'Share <their> settings and the <ticket> element.',
  // The pre-pass must not escape tags the sanitizer keeps: `strike` lives in
  // `defaultSchema.tagNames` but was absent from SAFE_HTML_TAGS, so authored
  // legacy markup regressed into visible `&lt;strike&gt;` source text.
  'legacy-strike-tag': 'A <strike>struck</strike> phrase and <tt>teletype</tt>.',
  // Round-2: `center`/`font`/`big` were in NONE of the three tag lists, so
  // they escaped to visible source text even though both pre-unification
  // renderers rendered them.
  'legacy-center-tag': '<center>centered</center>\n\n<font color="red" size="3">colored</font> and <big>big</big>.',
  // Round-2 SECURITY: `title` (and `text`/`desc`/`g`/…) are SVG element names
  // that are ALSO HTML elements. Unconstrained they let any post or chat
  // message emit a live `<title>`, which React 19 hoists into <head> —
  // rewriting the browser tab + SEO title. They are now pinned to an `svg`
  // ancestor, so a bare one is dropped and only its text remains.
  'bare-title-tag-is-inert': '# Real Post\n\n<title>Buy cheap pills</title>\n\nbody',
  // Round-3 SECURITY/CORRECTNESS: RAWTEXT tokenization runs BEFORE the
  // sanitizer, so an UNCLOSED `<textarea>` / `<iframe>` / `<title>` swallows
  // the whole rest of the message during parsing — the round-2 `ancestors`
  // pin cannot help. Any message that merely MENTIONS these in prose (an LLM
  // explaining HTML forms will) mangled everything after it. The text
  // pre-pass now escapes unclosed openers; the heading after must survive.
  'unclosed-textarea-does-not-swallow': 'Hello\n\n<textarea>\n\n## After heading\n\nmore',
  'unclosed-iframe-does-not-swallow': 'Hello\n\n<iframe>\n\n## After heading\n\nmore',
  'unclosed-title-does-not-swallow': 'Hello\n\n<title>\n\n## After heading\n\nmore',
  // Round-4 SECURITY: the round-3 closer test searched the RAW document, so a
  // `</textarea>` that is only a CODE SAMPLE (fenced or inline) or only
  // ATTRIBUTE TEXT satisfied "is closed later" and left the prose opener LIVE
  // — parse5's RAWTEXT span then swallowed the rest of the message anyway.
  // An LLM answer about HTML forms is exactly a prose mention plus a code
  // sample, so the fix was one realistic message away from being bypassed.
  // The closer search now runs over a length-preserving MASKED copy (code
  // spans + attribute regions blanked), built from the SAME regex that drives
  // the escaping carve. In all three the opener must escape and the heading
  // after it must survive as a real <h1>.
  'rawtext-closer-in-fence-does-not-unescape':
    '<textarea>\n\n# Heading\n\npara2\n\n```html\n</textarea>\n```',
  'rawtext-closer-in-inline-code-does-not-unescape':
    '<textarea>\n\n# Heading\n\npara2 with `</textarea>` inline',
  'rawtext-closer-in-attribute-does-not-unescape':
    '<textarea>\n\n# Heading\n\n<div title="</textarea>">x</div>',
  'rawtext-title-closer-in-fence-does-not-unescape':
    '<title>\n\n# Heading\n\n```html\n</title>\n```',
  // Round-5 SECURITY: the round-4 mask claimed every index matched the
  // original string, but it started with `text.toLowerCase()` — and
  // `toLowerCase()` EXPANDS U+0130 (Turkish dotted capital `İ`, ordinary
  // prose: İstanbul, İzmir) into `i` + U+0307, 1 code unit → 2. Each one
  // before an opener shifted the haystack later than the offset the caller
  // computes from the ORIGINAL text, so `hasLaterCloser` started scanning
  // BEFORE the opener, matched the already-consumed `</textarea>`, and left
  // the prose opener LIVE — the RAWTEXT swallow, reopened. At n≤20 the opener
  // escaped correctly; at n≥25 the heading and list below became the editable
  // value of a live textarea. The mask now folds ASCII only (tag names are
  // ASCII by definition); the length invariant below is the real guard.
  'rawtext-mask-survives-turkish-dotted-i':
    `${'İ'.repeat(25)} <textarea>a</textarea>\n\n<textarea>\n\n## Later heading\n\n- item one\n`,
  // Round-5 LOGIC: the escape pre-pass used to run BEFORE the streaming tail
  // was completed. Mid-stream every partially-emitted fence is unclosed, and
  // both fence notions in the pre-pass only recognize CLOSED fences — so a
  // `</textarea>` inside the still-open fence satisfied "is closed later" and
  // the prose opener above stayed live. The engine now completes the tail
  // first; this AUTHORED (never-closed) shape is covered by the mask's
  // `blankUnclosedFence` pass, and the streaming shape by the test below.
  'rawtext-closer-in-unclosed-fence-does-not-unescape':
    'Explaining <textarea> in HTML.\n\n## Heading\n\n```html\n</textarea>\n',
  // Round-6 SECURITY: the mask understood ONLY column-0..3 ```/~~~ fences,
  // inline code and attribute runs — so a `</textarea>` in ANY other ordinary
  // form of code satisfied "is closed later" and the prose opener stayed live.
  // All five shapes below were reproduced end-to-end as a live editable
  // textarea containing the rest of the message. The mask's block-level code
  // regions are now derived from `createFenceTracker` (plus indented,
  // blockquoted and commented code) instead of from a flat regex.
  //
  // (a) a blockquoted fence — an utterly ordinary chat answer.
  'rawtext-closer-in-blockquoted-fence-does-not-unescape':
    'The <textarea> element is a form control whose closing tag matters.\n\n> ```html\n> <textarea name="bio">hello</textarea>\n> ```\n\n## After heading\n',
  // (b) an indented (4-space / tab) code block. `FENCE_RE` caps fence indent at
  //     3 spaces by design, so the tracker never sees these lines at all.
  'rawtext-closer-in-indented-code-does-not-unescape':
    'Explaining <textarea> in prose.\n\n## After heading\n\n    </textarea>\n\ntail\n',
  'rawtext-closer-in-tab-indented-code-does-not-unescape':
    'Explaining <textarea> in prose.\n\n## After heading\n\n\t</textarea>\n\ntail\n',
  // (c) a fence indented into a list-item content column.
  'rawtext-closer-in-list-indented-fence-does-not-unescape':
    'Explaining <textarea> in prose.\n\n## After heading\n\n- item\n\n      ```html\n      </textarea>\n      ```\n\ntail\n',
  // (c2) Round-17 SECURITY: the SAME fence, one container deeper — a list item
  //      INSIDE A BLOCKQUOTE. `blankQuotedCode`'s flush ran the fence + indented
  //      passes over the quote-stripped run but NOT `blankListItemCode`, while
  //      `blankListItemCode` DID call `blankQuotedCode`; that asymmetry was the
  //      hole. `FENCE_RE` caps fence indent at 3 ABSOLUTE columns, so at a
  //      quote-relative content column of 4 the nested tracker misses the fence,
  //      and `blankIndentedCode`'s list-aware threshold (`contentCol + 4` = 8)
  //      does not reach it either — the fence was seen by NO pass. Reproduced
  //      live: one editable `<textarea>` swallowing the quoted example, with
  //      `escapeUnknownHtmlTags` returning the input BYTE-IDENTICAL. The same
  //      shape reproduced for `<iframe>`, for `> -   ` and `> -\t`, and at
  //      quote depth 2 — all covered by the container × container sweep below.
  'rawtext-closer-in-quoted-list-indented-fence-does-not-unescape':
    'The <textarea> element explained.\n\n> 1.  Example:\n>\n>     ```html\n>     </textarea>\n>     ```\n\n## After heading\n\nsecret tail\n',
  // (c3) Round-18 SECURITY, the EIGHTH instance and the SHALLOWEST yet — ZERO
  //      nesting depth. `blankListItemCode` read the content-column stack BEFORE
  //      pushing the current line's own marker, so the MARKER LINE never entered
  //      a run and a fence opened ON it was invisible to every pass: `FENCE_RE`'s
  //      3-column absolute cap misses it and `blankIndentedCode`'s
  //      `contentCol + 4` threshold overshoots it. The run then began AFTER the
  //      opener, so the item's CLOSING fence read as an `open` to the nested
  //      tracker, which blanked to EOF while leaving the code BODY live.
  //      `escapeUnknownHtmlTags` returned the input BYTE-IDENTICAL and the
  //      renderer emitted a live editable `<textarea>` swallowing the prose.
  //      Reproduced at every marker spelling and for `<iframe>`.
  'rawtext-closer-in-marker-line-fence-does-not-unescape':
    'The <textarea> element explained.\n\n-   ```html\n    </textarea>\n    ```\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-marker-line-ordered-fence-does-not-unescape':
    'The <textarea> element explained.\n\n1.  ```html\n    </textarea>\n    ```\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-marker-line-tab-fence-does-not-unescape':
    'The <textarea> element explained.\n\n-\t```html\n    </textarea>\n    ```\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-quoted-marker-line-fence-does-not-unescape':
    'The <textarea> element explained.\n\n> -   ```html\n>     </textarea>\n>     ```\n\n## After heading\n\nsecret tail\n',
  'rawtext-iframe-closer-in-marker-line-fence-does-not-unescape':
    'The <iframe> element explained.\n\n-   ```html\n    </iframe>\n    ```\n\n## After heading\n\nsecret tail\n',
  // CONTROL for the shape above: the SAME fence one line LOWER (a continuation
  // line) was always masked correctly. It isolates the defect to "a block opened
  // ON the marker line", and it must keep working after the reorder.
  'rawtext-closer-in-continuation-line-fence-does-not-unescape':
    'The <textarea> element explained.\n\n-   item\n\n    ```html\n    </textarea>\n    ```\n\n## After heading\n\nsecret tail\n',
  // Round-18 SECURITY: a CommonMark code span CROSSES LINE BREAKS, and neither
  // the mask's inline scan nor `PROTECTED_SPAN_RE` did — both were strictly
  // per-line. So `` `foo\n</textarea>` `` left its closer visible in the
  // haystack, `hasLaterCloser` returned true and the prose opener stayed LIVE.
  // This is the shape that is not a CONTAINER at all, so no container sweep
  // could reach it; the scan unit is now the paragraph segment. The renderer
  // emitting `<code>foo </textarea></code>` is the proof the closer is a sample.
  'rawtext-closer-in-multiline-code-span-does-not-unescape':
    'The <textarea> element explained.\n\nUse `foo\n</textarea>` today.\n\n## After heading\n\nsecret tail\n',
  'rawtext-iframe-closer-in-multiline-code-span-does-not-unescape':
    'The <iframe> element explained.\n\nUse `foo\n</iframe>` today.\n\n## After heading\n\nsecret tail\n',
  // Round-18 SECURITY: remark consumes a LINK REFERENCE DEFINITION entirely and
  // emits no node, so a `</textarea>` in its destination or title is not a real
  // closer — but it survived into the haystack and kept the prose opener live
  // (byte-identical output in both spellings).
  'rawtext-closer-in-link-definition-title-does-not-unescape':
    'The <textarea> element explained.\n\n[a]: /x "</textarea>"\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-link-definition-destination-does-not-unescape':
    'The <textarea> element explained.\n\n[a]: </textarea>\n\n## After heading\n\nsecret tail\n',
  // ---------------------------------------------------------------------------
  // Round-19 SECURITY. Five findings, all authored here rather than left to the
  // sweep — the sweep is what MISSED them (see `markerLineListWrap`).
  // ---------------------------------------------------------------------------
  // (i) The NINTH instance: `blankListItemCode`'s `top >= 4` gate, justified by
  //     a table entry claiming "below column 4 the top-level passes already cover
  //     the line at the right column". True of a CONTINUATION line (absolute
  //     indent 2-3 is inside `FENCE_RE`'s cap) and FALSE of the MARKER line,
  //     which is examined only at column 0 where the leading `- ` / `1. ` is not
  //     whitespace. So at the two MOST COMMON marker spellings the marker line
  //     got no run at all. The fence is EOF-TERMINATED on purpose: the closed
  //     spelling is rescued only INCIDENTALLY by `findInlineCodeRanges` matching
  //     the two backtick runs, so the live hole is the unclosed one — the state
  //     every fence passes through mid-stream.
  'rawtext-closer-in-narrow-marker-line-fence-does-not-unescape':
    'The <textarea> element explained.\n\n- ```html\n  </textarea>\n',
  'rawtext-closer-in-narrow-ordered-marker-line-fence-does-not-unescape':
    'The <textarea> element explained.\n\n1. ```html\n   </textarea>\n',
  'rawtext-iframe-closer-in-narrow-marker-line-fence-does-not-unescape':
    'The <iframe> element explained.\n\n- ```html\n  </iframe>\n',
  // (ii) The TENTH instance: `LIST_MARKER_RE` matches only the FIRST marker on a
  //      line, so an INNER item's content column was never pushed and the fix
  //      above does not reach these. `blankListItemCode` now recurses into
  //      ITSELF on the stripped run. The link-definition spelling also falsifies
  //      the table's "absorbs … ONE list marker" claim.
  'rawtext-closer-in-nested-marker-line-fence-does-not-unescape':
    'The <textarea> element explained.\n\n- - ```html\n    </textarea>\n',
  'rawtext-closer-in-nested-marker-line-link-definition-does-not-unescape':
    'The <textarea> element explained.\n\n- - [a]: /x "</textarea>"\n',
  // (iii) A whole UNCOVERED SHELTER CLASS: the INLINE link/image destination and
  //       title. remark consumes them into href/title exactly as it consumes a
  //       reference definition's, so the closer is fake — but only the
  //       DEFINITION spelling had a pass. All eight spellings reproduced live.
  'rawtext-closer-in-inline-link-title-does-not-unescape':
    'The <textarea> element explained.\n\n[a](/x "</textarea>")\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-inline-link-single-quoted-title-does-not-unescape':
    "The <textarea> element explained.\n\n[a](/x '</textarea>')\n\n## After heading\n\nsecret tail\n",
  'rawtext-closer-in-inline-link-paren-title-does-not-unescape':
    'The <textarea> element explained.\n\n[a](/x (</textarea>))\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-inline-image-title-does-not-unescape':
    'The <textarea> element explained.\n\n![a](/x "</textarea>")\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-inline-link-angle-destination-does-not-unescape':
    'The <textarea> element explained.\n\n[a](</textarea>)\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-quoted-inline-link-title-does-not-unescape':
    'The <textarea> element explained.\n\n> [a](/x "</textarea>")\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-listed-inline-link-title-does-not-unescape':
    'The <textarea> element explained.\n\n- [a](/x "</textarea>")\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-mid-paragraph-inline-link-title-does-not-unescape':
    'The <textarea> element explained.\n\nSee [a](/x "</textarea>") for more.\n\n## After heading\n\nsecret tail\n',
  'rawtext-iframe-closer-in-inline-link-title-does-not-unescape':
    'The <iframe> element explained.\n\n[a](/x "</iframe>")\n\n## After heading\n\nsecret tail\n',
  // (iv) `blankLinkDefinitions` missed the MULTI-LINE definition spelling —
  //      CommonMark allows destination and/or title on FOLLOWING lines, and the
  //      continuation state only accepted a BARE QUOTED TITLE. The `[a]:` line
  //      blanked; the `destination + title` line stayed fully visible.
  'rawtext-closer-in-multiline-link-definition-does-not-unescape':
    'The <textarea> element explained.\n\n[a]:\n/x "</textarea>"\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-multiline-link-definition-destination-does-not-unescape':
    'The <textarea> element explained.\n\n[a]:\n</textarea>\n\n## After heading\n\nsecret tail\n',
  // (v) ROUND 20 — the BRACKET half of the very class (iii) opened. Round 19
  //     wrote the generalization ("every region CommonMark turns into an
  //     ATTRIBUTE rather than document text is a shelter of the same kind") and
  //     then implemented it for the `(…)` payload only, on a rationale that is
  //     true of an INLINE LINK's `[…]` and false of every other bracket
  //     spelling: an image's alt is a string ATTRIBUTE, and a reference or
  //     footnote label is an IDENTIFIER remark never renders. All seven
  //     reproduced live in BOTH renderers (`escapeUnknownHtmlTags` byte-
  //     identical, a live `<textarea>` swallowing the rest of the paragraph).
  'rawtext-closer-in-inline-image-alt-does-not-unescape':
    'The <textarea> element explained.\n\n![</textarea>](/x)\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-reference-image-alt-does-not-unescape':
    'The <textarea> element explained.\n\n![</textarea>][r]\n\n[r]: /x\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-reference-label-does-not-unescape':
    'The <textarea> element explained.\n\n[a][</textarea>]\n\n[</textarea>]: /x\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-collapsed-reference-label-does-not-unescape':
    'The <textarea> element explained.\n\n[</textarea>][]\n\n[</textarea>]: /x\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-footnote-label-does-not-unescape':
    'The <textarea> element explained.\n\nSee[^</textarea>]\n\n[^</textarea>]: note\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-quoted-image-alt-does-not-unescape':
    'The <textarea> element explained.\n\n> ![</textarea>](/x)\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-listed-image-alt-does-not-unescape':
    'The <textarea> element explained.\n\n- ![</textarea>](/x)\n\n## After heading\n\nsecret tail\n',
  'rawtext-iframe-closer-in-inline-image-alt-does-not-unescape':
    'The <iframe> element explained.\n\n![</iframe>](/x)\n\n## After heading\n\nsecret tail\n',
  // (vi) ROUND 21 — the SAME pass, the SAME round, the OTHER half. Round 20
  //       converted this pass's LENGTH caps to blank-through and left its SHAPE
  //       regexes as fail-open declines. Two dimensions were uncovered:
  //
  //       (a) BACKSLASH-BLINDNESS. `LINK_DEF_TITLE` / `LINK_DEF_DEST` and the
  //           label class `[^\]\n]*` stop at the FIRST delimiter, escaped or
  //           not, while CommonMark permits `\"` in a `"…"` title, `\'` in
  //           `'…'`, `\)` in `(…)` and `\]` in a label. The class stopped early,
  //           the full-line anchor then failed, and the line stayed VISIBLE —
  //           while remark still consumed the definition and emitted NOTHING.
  //           The unescaped CONTROL (`rawtext-closer-in-link-definition-title-…`
  //           above) blanks correctly, which is what makes the ESCAPE the cause.
  'rawtext-closer-in-escaped-quote-definition-title-does-not-unescape':
    'The <textarea> element explained.\n\n[a]: /x "a\\"</textarea>"\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-escaped-apostrophe-definition-title-does-not-unescape':
    "The <textarea> element explained.\n\n[a]: /x 'it\\'s </textarea>'\n\n## After heading\n\nsecret tail\n",
  'rawtext-closer-in-escaped-paren-definition-title-does-not-unescape':
    'The <textarea> element explained.\n\n[a]: /x (a\\)</textarea>)\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-escaped-bracket-definition-label-does-not-unescape':
    'The <textarea> element explained.\n\n[a\\]b]: /x "</textarea>"\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-escaped-bracket-definition-destination-does-not-unescape':
    'The <textarea> element explained.\n\n[a\\]b]: </textarea>\n\n## After heading\n\nsecret tail\n',
  //       (b) A LABEL or TITLE that opens on one line and closes on a LATER one
  //           was examined by NOBODY. The `'none' | 'needDest' | 'needTitle'`
  //           state modelled continuation only AFTER the `]:`, and
  //           `blankBracketLabels` deliberately excludes a bare `[…]`, so the
  //           multi-line label had no pass at all.
  'rawtext-closer-in-multiline-definition-label-does-not-unescape':
    'The <textarea> element explained.\n\n[foo\n</textarea>]: /x\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-multiline-definition-label-first-line-does-not-unescape':
    'The <textarea> element explained.\n\n[</textarea>\nfoo]: /x\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-three-line-definition-label-does-not-unescape':
    'The <textarea> element explained.\n\n[foo\n</textarea>\nbar]: /x\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-quoted-multiline-definition-label-does-not-unescape':
    'The <textarea> element explained.\n\n> [foo\n> </textarea>]: /x\n\n## After heading\n\nsecret tail\n',
  'rawtext-closer-in-multiline-definition-title-does-not-unescape':
    'The <textarea> element explained.\n\n[a]: /x "line1\n</textarea>"\n\n## After heading\n\nsecret tail\n',
  'rawtext-iframe-closer-in-multiline-definition-label-does-not-unescape':
    'The <iframe> element explained.\n\n[foo\n</iframe>]: /x\n\n## After heading\n\nsecret tail\n',
  // (d) an HTML comment. parse5 consumes it as comment data; it is not a closer.
  'rawtext-closer-in-html-comment-does-not-unescape':
    'Explaining <textarea> in prose.\n\n## After heading\n\n<!-- </textarea> -->\n\ntail\n',
  // (e) an INFO-STRING closer. CommonMark forbids an info string on a closing
  //     fence, but `PROTECTED_SPAN_RE`'s closer alternative allowed `[^\n]*` —
  //     so the masked span ended at the ```html line and the real code content
  //     after it went unmasked. `createFenceTracker` gets this right.
  'rawtext-closer-after-info-string-closer-does-not-unescape':
    'Explaining <textarea> in prose.\n\n## After heading\n\n```js\nx\n```html\n</textarea>\n```\n\ntail\n',
  // Round-7 SECURITY (the class-closing one): the carve (`PROTECTED_SPAN_RE`)
  // and the mask (tracker-derived) run DIFFERENT engines, so the carve can
  // protect a region the mask correctly blanked — and a protected span is
  // pushed through VERBATIM, so a live RAWTEXT opener inside it never reaches
  // `escapeOutsideFences` at all. Here the regex's closer alternative accepts an
  // info string, so its first span ends early at the ```js line, it desyncs, and
  // it opens a NEW span at the `~~~` line (ordinary text to CommonMark) that
  // runs past remark's real closer and shelters the `<textarea>`. parse5 then
  // swallowed `hello`, `~~~` and `after`. The carve is now the INTERSECTION of
  // carve and mask, so over-detection by EITHER engine can only cause escaping.
  'mismatched-fence-carve-does-not-shelter-opener':
    '```\n```js\n~~~\n```\n<textarea>\nhello\n~~~\nafter\n',
  // Round-7 REGRESSION: `blankComments` scanned the UNMASKED copy, so a `<!--`
  // written INSIDE code blanked everything after it to EOF. Every other pass
  // scans the unmasked copy on purpose (`INLINE_CODE_RE` would corrupt a fence
  // scan), but for comments that reasoning inverts: a `<!--` inside a code
  // region is not a comment start. Both shapes rendered a REAL `<textarea>`
  // before the round-6 mask work, and must keep doing so.
  'comment-marker-in-inline-code-does-not-blank-to-eof':
    'Use `<!--` to start a comment.\n\n<textarea>hi</textarea>\n',
  'truncated-comment-in-fence-does-not-blank-to-eof':
    '```html\n<!-- todo\n```\n\n<textarea>a</textarea>\n',
  // Round-7: `blankIndentedCode` applied a flat 4-space threshold, so a LIST
  // ITEM's continuation paragraph (content indent 4 under `1.  `, 2 under `- `)
  // was blanked as code — the closer vanished from the haystack and the opener
  // escaped. Under CommonMark these are paragraph lines and the element is real.
  'list-continuation-textarea-stays-live-ordered':
    '1.  Here is a form:\n\n    <textarea>\n    </textarea>\n',
  'list-continuation-textarea-stays-live-bullet': '- item\n\n    <textarea>x</textarea>\n',
  // Round-9 SECURITY (the residual fail-open of the round-7 intersection
  // guard): the guard only reconciles DISAGREEMENT between carve and mask.
  // When BOTH engines over-detect the SAME region it is a no-op —
  // `isMaskedBlank` is true, the span is pushed VERBATIM, and a live RAWTEXT
  // opener inside it never reaches `escapeOutsideFences`. CommonMark says an
  // HTML block (type 1 `<pre>`/`<details>`, type 6 `<div>`) runs to its
  // terminator, so a ``` line inside one is HTML CONTENT, not a fence — and
  // neither engine models HTML blocks. Both opened a bogus fence at the same
  // line, so `<textarea>` was sheltered and the rest of the message became its
  // editable value. The carve now additionally requires that a protected span
  // contain no UNBALANCED RAWTEXT opener (a span is by definition
  // self-contained code, so any opener inside must be balanced within it).
  'rawtext-opener-in-html-block-div-not-sheltered':
    'intro\n\n<div>\n```\n<textarea>\n```\n</div>\n\n## After heading\n\nsecret tail\n',
  'rawtext-opener-in-html-block-pre-not-sheltered':
    'intro\n\n<pre>\n```\n<textarea>\n```\n</pre>\n\n## After heading\n\nsecret tail\n',
  'rawtext-opener-in-html-block-details-not-sheltered':
    'intro\n\n<details>\n```\n<textarea>\n```\n</details>\n\n## After heading\n\nsecret tail\n',
  // Round-12 SECURITY (the round-9 hole, reopened through INLINE CODE): round 11
  // scoped the balance guard to the FENCE alternative on the reasoning that an
  // inline span "can shelter nothing, because remark emits it as an `inlineCode`
  // TEXT node". That invariant is exactly what fails INSIDE AN HTML BLOCK, where
  // remark emits raw HTML and backticks are not code at all — so `` `<textarea>` ``
  // on its own line inside `<div>` / `<pre>` / `<details>` was pushed VERBATIM
  // and swallowed the rest of the message (reproduced end-to-end: textarea 1,
  // `h2` undefined). The guard is now gated on HTML-BLOCK MEMBERSHIP rather than
  // on the span's flavor, which covers both spellings with one property.
  'rawtext-opener-in-inline-code-in-html-block-div-not-sheltered':
    'intro\n\n<div>\n`<textarea>`\n</div>\n\n## After heading\n\nsecret tail\n',
  'rawtext-opener-in-inline-code-in-html-block-pre-not-sheltered':
    'intro\n\n<pre>\n`<textarea>`\n</pre>\n\n## After heading\n\nsecret tail\n',
  'rawtext-opener-in-inline-code-in-html-block-details-not-sheltered':
    'intro\n\n<details>\n`<textarea>`\n</details>\n\n## After heading\n\nsecret tail\n',
  // …and the type-7 start condition (a complete tag ALONE on a line, tag name
  // outside the type-1/type-6 lists) is the same hole with a different opener.
  'rawtext-opener-in-inline-code-in-html-block-span-not-sheltered':
    'intro\n\n<span>\n`<textarea>`\n</span>\n\n## After heading\n\nsecret tail\n',
  // Round-15 SECURITY: the SAME shelter, reopened by ONE INVISIBLE CHARACTER.
  // `computeHtmlBlockRanges` decided "blank line" (which ends a type-6/7 block)
  // with `String.trim()`, and JS `trim()` strips the whole Unicode White_Space
  // set — U+00A0 NBSP, U+000B VT, U+000C FF, U+FEFF BOM — while CommonMark's
  // blank line is spaces and tabs ONLY. So a filler line holding just an NBSP
  // terminated the TRACKED range while remark kept the block open: the
  // inline-code shelter below it was no longer "inside a tracked block", the
  // balance guard went blind, and `escapeUnknownHtmlTags` returned the input
  // BYTE-IDENTICAL with a LIVE `<textarea>` in the DOM swallowing the tail.
  // Fixed by `isBlankLine` (utils/markdown-fences). The whitespace-spelling
  // DIMENSION is swept over the whole corpus below (`EXOTIC_BLANK_WRAPPERS`).
  'rawtext-opener-in-nbsp-filler-html-block-not-sheltered':
    '<div>\n \n`<textarea>`\n\nrest of the answer\n\n## After heading\n\nsecret tail\n',
  'rawtext-iframe-in-nbsp-filler-html-block-not-sheltered':
    '<div>\n \n`<iframe>`\n\nrest of the answer\n',
  // Round-13 SECURITY (the same hole, third spelling): `computeHtmlBlockRanges`
  // matched every start/end condition against the RAW line, anchored `^ {0,3}<`.
  // Inside a CONTAINER (blockquote / list item) the line begins with the
  // container marker, so NO start condition ever fired — yet CommonMark opens
  // the type-6 block INSIDE the container and every following line is HTML
  // content. `spanInsideHtmlBlock` therefore returned false, the balance guard
  // did not fire, and `` `<textarea>` `` was pushed through VERBATIM:
  // `escapeUnknownHtmlTags` returned the input BYTE-IDENTICAL and the heading +
  // tail below became the editable value of a live textarea. Reproduced across
  // the whole cross-product (`>` depth 1 and 2, `-` and `1.` items, div /
  // details shelters, textarea / title / iframe openers). The walk now strips
  // the container prefix before matching.
  'rawtext-opener-in-inline-code-in-blockquoted-html-block-not-sheltered':
    '> intro\n>\n> <div>\n> `<textarea>`\n> </div>\n>\n> ## After heading\n>\n> secret tail\n',
  'rawtext-opener-in-inline-code-in-nested-blockquoted-html-block-not-sheltered':
    '> > intro\n> >\n> > <details>\n> > `<textarea>`\n> > </details>\n> >\n> > ## After heading\n> >\n> > secret tail\n',
  'rawtext-opener-in-inline-code-in-list-item-html-block-not-sheltered':
    '- intro\n\n  <div>\n  `<textarea>`\n  </div>\n\n  ## After heading\n\n  secret tail\n',
  'rawtext-opener-in-inline-code-in-ordered-item-html-block-not-sheltered':
    '1. intro\n\n   <div>\n   `<textarea>`\n   </div>\n\n   ## After heading\n\n   secret tail\n',
  // …and the same shape with an `<iframe>` opener, which puts a LIVE iframe in
  // the DOM rather than merely swallowing the tail.
  'rawtext-iframe-in-inline-code-in-blockquoted-html-block-not-sheltered':
    '> intro\n>\n> <div>\n> `<iframe>`\n> </div>\n>\n> ## After heading\n>\n> secret tail\n',
  // Round-14 SECURITY (the same hole, FOURTH spelling — TAB COLUMNS). The
  // container walk measured the list content column in CHARACTERS, but
  // CommonMark measures COLUMNS and a tab advances to the next multiple of 4.
  // `-\t-\t` is 4 characters and 8 columns, so a continuation line indented 8
  // spaces was stripped by only 4 and still looked indented by 4 — every
  // `^ {0,3}<\u2026` start condition missed, no range was recorded,
  // `spanInsideHtmlBlock` returned false, the balance guard never fired, and the
  // protected span was pushed through VERBATIM (`escapeUnknownHtmlTags`
  // returned the input BYTE-IDENTICAL). Reproduced in BOTH renderers at 2 and 3
  // markers, with the `<textarea>` spelling SWALLOWING the tail and the
  // `<iframe>` spelling putting a LIVE `<iframe src=\u2026>` in the DOM.
  'rawtext-opener-in-inline-code-in-tab-list-item-html-block-not-sheltered':
    '-\t-\tintro\n        <div>\n        `<textarea>`\n        more\n\n## After heading\n\nsecret tail\n',
  'rawtext-opener-in-inline-code-in-deep-tab-list-item-html-block-not-sheltered':
    '-\t-\t-\tintro\n            <div>\n            `<textarea>`\n            more\n\n## After heading\n\nsecret tail\n',
  'rawtext-iframe-in-inline-code-in-tab-list-item-html-block-not-sheltered':
    '-\t-\tintro\n        <div>\n        `<iframe>`\n        more\n\n## After heading\n\nsecret tail\n',
  // Round-14 SECURITY (FIFTH spelling — a FOREIGN container's filler line).
  // A type-6/7 block ends at the first blank line, and inside a container the
  // container's own filler IS that blank line. The termination test used the
  // FULLY-stripped line, and the strip consumes ANY container markers rather
  // than the ones that were open \u2014 so a line holding a DIFFERENT container's
  // opener (`  >` inside a `- <div>` item, `> -` inside a `> <div>` quote)
  // normalized to empty, read as blank, and ENDED the range early, re-opening
  // the shelter. Under CommonMark that line is HTML content and the block
  // continues. The control without the filler line renders 0, so the filler
  // line is the entire difference.
  'rawtext-opener-after-foreign-filler-in-list-item-html-block-not-sheltered':
    '- <div>\n  >\n  `<textarea>`\n\n## After heading\n\nsecret tail\n',
  'rawtext-opener-after-foreign-filler-in-blockquoted-html-block-not-sheltered':
    '> <div>\n> -\n> `<textarea>`\n\n## After heading\n\nsecret tail\n',
  // Round-12 REGRESSION (found independently by both reviewers): the round-11
  // cap-overflow fallback `escapeLeftoverTagStarts` escaped ANY `<tag` start in
  // a gap, including gaps the MASK already knows are code — and entity refs are
  // not decoded inside code, so the reader saw the literal `&lt;`. Ordinary
  // pseudo-code in an indented block is the common shape.
  'indented-code-angle-bracket-not-escaped': 'Para\n\n    if a <b then\n    done\n',
  // Round-12 LATENT COUPLING (safe today, pinned so it stays that way): none of
  // these are matched by `TAG_LIKE_REGEX` or `LEFTOVER_TAG_START_RE`, and none
  // needs to be — CommonMark's open-tag production requires `/` to be
  // IMMEDIATELY followed by `>`, so remark never emits an `html` node for them
  // and parse5 never sees a start tag. That safety rests on remark's tag grammar
  // continuing to agree with the sanitizer's, which is what this fixture pins.
  'rawtext-slash-not-immediately-before-gt-is-inert':
    'Hello\n\n<textarea/ >\n\n<textarea/foo>\n\n<textarea//>\n\n## After heading\n\n- item\n',
  // Round-11 SECURITY (the one that defeated the ENTIRE swallow defense): HTML
  // IGNORES the self-closing flag on non-void, non-foreign elements, so parse5
  // tokenizes `<textarea/>` as a START tag and enters RAWTEXT exactly like
  // `<textarea>`. Both RAWTEXT guards nevertheless keyed on `selfClose === ''`
  // and treated the self-closed spelling as "not an opener", so
  // `escapeUnknownHtmlTags` returned every input below COMPLETELY untouched —
  // no `&lt;` anywhere. Reproduced end-to-end through `SimpleMarkdownRenderer`:
  // `<textarea/>` rendered a live textarea and the `## After heading` below it
  // stopped being a heading; the spaced form swallowed the list too. It also
  // defeated the round-9 HTML-block fix, whose fixtures only ever used the
  // non-self-closing spelling. `RAWTEXT_TAGS` has no void members, so nothing
  // legitimate self-closes — both guards now count the self-closed form as an
  // opener.
  'rawtext-self-closing-textarea-escaped':
    'Hello\n\n<textarea/>\n\n## After heading\n\n- item\n',
  'rawtext-self-closing-spaced-textarea-escaped':
    'Hello\n\n<textarea />\n\n## After heading\n\n- item\n',
  'rawtext-self-closing-iframe-escaped': 'Hello\n\n<iframe/>\n\n## After heading\n\n- item\n',
  'rawtext-self-closing-title-escaped': 'Hello\n\n<title/>\n\n## After heading\n\n- item\n',
  'rawtext-self-closing-textarea-inline-escaped':
    'Hello <textarea/> world\n\n## After heading\n',
  'rawtext-self-closing-opener-in-html-block-div-not-sheltered':
    'intro\n\n<div>\n```\n<textarea/>\n```\n</div>\n\n## After heading\n\nsecret tail\n',
  // Round-11 REGRESSION (user-visible, introduced by round-9): the CARVE
  // BALANCE GUARD was gated on BOTH `PROTECTED_SPAN_RE` alternatives, including
  // INLINE CODE — where it can close no fail-open at all (remark emits an inline
  // span as an `inlineCode` TEXT node, so parse5 never tokenizes it) and does
  // real damage: entity refs are not recognized inside code spans, so the
  // escaped `&lt;title&gt;` is shown to the reader LITERALLY. Naming a RAWTEXT
  // tag in inline code is the single most common way a docs answer mentions one,
  // and it never closes. The guard is now scoped to the FENCE alternative.
  'inline-code-rawtext-title-not-escaped': 'Use the `<title>` element for page titles.',
  'inline-code-rawtext-textarea-not-escaped': 'The `<textarea>` element is a form control.',
  // Round-9 REGRESSION (introduced by round-7's list-aware indent threshold):
  // `blankIndentedCode` walked lines built from the UNMASKED copy, so a `- x`
  // line INSIDE a fence still pushed a list content column. A later top-level
  // indented-code line at column 4 then failed `indent >= top + 4`, was NOT
  // blanked, and its code-sample `</textarea>` satisfied `hasLaterCloser` —
  // leaving the prose opener LIVE. The walk now re-derives its lines from the
  // CURRENT mask, so fence-blanked lines are all-spaces and push nothing.
  'list-marker-inside-fence-does-not-shift-indent-columns':
    'A <textarea>\n\n```\n- x\n  ```\n\n    </textarea>\n',
  'list-marker-inside-fence-html-block-combo':
    '<div>\n<textarea>\n</div>\n\n```\n- x\n  ```\n\n    </textarea>\n\n# Heading after\n\nBody after.\n',
  // Round-9 CORRECTNESS: CommonMark clamps a list item's content column to
  // `markerEnd + 1` when the first block starts MORE than 4 spaces after the
  // marker (the remainder is indented code INSIDE the item). The walk took the
  // literal column, so under `-` + six spaces a column-7 indented-code line
  // was not blanked and its `</textarea>` kept the prose opener live.
  'wide-list-marker-gap-clamps-content-column':
    'Explaining <textarea> in HTML.\n\n-      foo\n\n       </textarea>\n\n## After heading\n',
  // Round-6 CARVE TRADEOFF (pinned, not fixed): the mask's tracker-derived
  // regions are deliberately NOT fed to the escaping carve — the tracker
  // OVER-detects a ``` line inside an open raw-HTML block, which in the carve
  // means "not escaped", a fail-OPEN. So an AUTHORED EOF-terminated fence body
  // is still unprotected and its `<their>` renders as escaped source text. That
  // is cosmetic; the alternative is a swallow. The snapshot makes it visible.
  'unclosed-fence-body-renders-escaped': 'intro\n\n```html\n<their>x</their>\n',
  // Round-4 POLISH: the escaping carve's fence notion was naive triple
  // backticks, so a `~~~`-fenced block's `<textarea>` was NOT protected and
  // rendered as visible escaped text inside the code block.
  'tilde-fence-protects-html-sample': 'intro\n\n~~~html\n<textarea>sample</textarea>\n~~~',
  // …and the PROPERLY CLOSED forms must still render as real elements.
  'closed-textarea-still-renders': 'Hello\n\n<textarea>edit me</textarea>\n\n## After heading\n\nmore',
  'closed-iframe-still-renders':
    'Hello\n\n<iframe src="https://example.com/frame" width="300"></iframe>\n\n## After heading\n\nmore',
  // …while the legitimate in-SVG accessible-name element still renders.
  'svg-title-a11y-label':
    '<svg viewBox="0 0 24 24" role="img"><title>Coverage chart</title><desc>Four quarters</desc><circle cx="12" cy="12" r="10"/></svg>',
  // Round-2: SVG presentation attributes must survive with their hast
  // (camelCase) spellings — `font-size`/`text-anchor`/`stroke-dasharray`/
  // `style` were all being silently stripped.
  'inline-svg-presentation-attrs':
    '<svg viewBox="0 0 40 20"><rect x="0" y="0" width="40" height="20" fill="none" stroke-dasharray="2 2" style="opacity:0.5"/><text x="20" y="12" font-size="9" text-anchor="middle" dominant-baseline="middle">42</text></svg>',
  // Round-2: `required.input` force-rewrote EVERY authored input into a
  // disabled checkbox. Now a text input degrades to a bare <input> and the
  // GFM task-list contract (see `task-list`) is unaffected.
  'authored-text-input': '<form><input type="text" placeholder="email"><button>go</button></form>',
  // Inline SVG renders in published posts; the pre-unification Rich renderer
  // had no pre-pass and no sanitizer, so it always survived.
  'inline-svg': '<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><circle cx="12" cy="12" r="10" fill="none" stroke="currentColor" stroke-width="2"/><path d="M8 12l3 3 5-6"/></svg>',
  'hostile-script': 'before\n\n<script>alert(1)</script>\n\nafter',
  'hostile-onerror': '<img src="https://example.com/x.png" onerror="alert(1)">',
  'hostile-js-href': '<a href="javascript:alert(1)">click</a>',
  'hostile-srcset': '<img src="https://safe.example/a.png" srcset="https://safe.example/a.png 1x, javascript:alert(1) 2x">',
  'hostile-iframe-srcdoc': '<iframe srcdoc="<script>alert(1)</script>" src="https://example.com/frame"></iframe>',
  'hostile-style-block': 'text\n\n<style>body{display:none}</style>\n\nmore',
}

const RICH_ONLY_FIXTURES: Record<string, string> = {
  'shortcode-youtube': 'Intro\n\n{{youtube:abc123XYZ_-}}\n\nOutro',
  'shortcode-youtube-markdoc': '{% youtube id="vid42" /%}',
  'shortcode-youtube-thumbnail-link':
    '[![Demo](https://img.youtube.com/vi/awc-yAnkhIo/maxresdefault.jpg)](https://www.youtube.com/watch?v=awc-yAnkhIo)',
  'shortcode-reddit': '{{reddit:https://reddit.com/r/msp/comments/1/post}}',
  'shortcode-tweet': '{{tweet:https://twitter.com/user/status/12345}}',
  'shortcode-figma': '{{figma:https://www.figma.com/design/abc/My-File}}',
  'shortcode-linkedin': '{{linkedin:https://www.linkedin.com/posts/someone_activity-1}}',
  'shortcode-link-preview': '{{link:https://example.com/article}}',
  'auto-url-youtube': 'watch this https://www.youtube.com/watch?v=dQw4w9WgXcQ now',
  'auto-url-reddit': 'thread https://www.reddit.com/r/msp/comments/9/thread here',
  'auto-url-tweet': 'see https://x.com/user/status/999888 today',
  'auto-url-figma': 'design https://www.figma.com/proto/xyz/Proto-File end',
  'auto-url-generic-link-preview': 'read https://blog.example.com/post-1 tonight',
  'auto-url-inside-md-link-not-embedded': 'already [a link](https://blog.example.com/post-2) inline',
  'auto-url-inside-code-not-embedded': 'code `https://blog.example.com/post-3` inline\n\n```\nhttps://blog.example.com/post-4\n```',
  'auto-url-inside-table-not-embedded': `
| Site |
|------|
| https://blog.example.com/post-5 |
`,
  'fence-youtube-embed': '```youtube-embed\nvidFENCE1\n```',
  'fence-reddit-embed': '```reddit-embed\nhttps://reddit.com/r/x/comments/2/y\n```',
  'fence-tweet-embed': '```tweet-embed\nhttps://twitter.com/a/status/777\n```',
  'fence-link-preview': '```link-preview\nhttps://example.com/fenced\n```',
  'fence-figma-embed': '```figma-embed\nhttps://www.figma.com/deck/q/Deck\n```',
  'fence-linkedin-embed': '```linkedin-embed\nhttps://www.linkedin.com/posts/p_activity-2\n```',
  'raw-video-tag': '<video src="https://stream.example.com/v.mp4" poster="https://example.com/p.jpg" controls class="w-full my-8 rounded-lg"></video>',
  // 2026-07 content-store audit: real blog posts carry inline style attrs
  // (div.takeaway, table styling) — must survive the sanitize schema.
  'audit-style-attrs': '<div class="takeaway" style="padding:8px">Key point</div>\n\n<p style="color:red">styled para</p>',
  // 2026-07 content-store audit: 58 posts use Reddit's own embed markup
  // (script stripped by sanitize; blockquote rehydrated to RedditEmbedClient).
  'audit-reddit-embed-bq':
    '<blockquote class="reddit-embed-bq" data-embed-height="500"><p>Post title</p><a href="https://www.reddit.com/r/msp/comments/abc/post/">view</a></blockquote>\n<script async src="https://embed.reddit.com/widgets.js" charset="UTF-8"></script>',
}

const CHAT_FIXTURES: Record<string, string> = {
  'card-marker': 'Here is the record: [card://blog:hello-world] inline.',
  'mention-chip': 'Check @device:router-9 status.',
  'card-and-mention-mixed': 'See [card://vendor:acme] and @ticket:T-100 together.',
}

const SECTION_IDS = [
  { id: 'getting-started', title: '🚀 Getting Started', level: 1 },
  { id: 'setup', title: 'Setup', level: 2 },
]

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------
async function renderStable(ui: React.ReactElement): Promise<HTMLElement> {
  let container: HTMLElement
  await act(async () => {
    const result = render(ui)
    container = result.container
  })
  // Settle the mermaid mount → dynamic-import → setSvg chain by polling for a
  // STABLE DOM rather than spending a fixed number of ticks. How many turns
  // `await import('mermaid')` needs is Node/vitest-version dependent, so the
  // old two-macrotask budget snapshotted the LOADING SKELETON instead of the
  // rendered diagram on newer Node (the `mermaid` fixture's golden mismatched
  // on Node 25 while passing on 22). Two consecutive identical reads mean no
  // further state update is queued.
  let previous = ''
  for (let i = 0; i < 20; i++) {
    await act(async () => {
      await new Promise((r) => setTimeout(r, 0))
    })
    const html = container!.innerHTML
    if (html === previous) break
    previous = html
  }
  return container!
}

function normalize(html: string): string {
  // The mermaid <style> block is a constant — collapse whitespace only.
  return html.replace(/\s+\n/g, '\n')
}

// ---------------------------------------------------------------------------
// SimpleMarkdownRenderer parity
// ---------------------------------------------------------------------------
describe('SimpleMarkdownRenderer golden parity', () => {
  for (const [name, md] of Object.entries(SHARED_FIXTURES)) {
    it(`renders fixture: ${name}`, async () => {
      const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
      expect(normalize(container.innerHTML)).toMatchSnapshot()
    })
  }

  it('renders headings with backend sectionIds + demoteMarkdownH1ToH2', async () => {
    const container = await renderStable(
      <SimpleMarkdownRenderer
        content={SHARED_FIXTURES['headings-with-emoji-and-dupes']}
        sectionIds={SECTION_IDS}
        demoteMarkdownH1ToH2
      />,
    )
    expect(normalize(container.innerHTML)).toMatchSnapshot()
  })

  it('renders broken links with badge', async () => {
    const container = await renderStable(
      <SimpleMarkdownRenderer
        content={'[good](./ok.md) and [bad](./missing.md)'}
        brokenLinks={['./missing.md']}
        currentPath="docs/index.md"
        onInternalLinkClick={() => {}}
      />,
    )
    expect(normalize(container.innerHTML)).toMatchSnapshot()
  })

  it('renders each text-size preset', async () => {
    for (const preset of ['default', 'compact', 'large'] as const) {
      const container = await renderStable(
        <SimpleMarkdownRenderer content={'# H\n\npara\n\n- li'} textSize={preset} />,
      )
      expect(normalize(container.innerHTML)).toMatchSnapshot(`textSize-${preset}`)
    }
  })

  for (const [name, md] of Object.entries(CHAT_FIXTURES)) {
    it(`renders chat fixture with card/mention plugins: ${name}`, async () => {
      const container = await renderStable(
        <SimpleMarkdownRenderer
          content={md}
          textSize="compact"
          additionalRemarkPlugins={[remarkCardLinks, remarkMentionChips]}
        />,
      )
      expect(normalize(container.innerHTML)).toMatchSnapshot()
    })
  }
})

// ---------------------------------------------------------------------------
// RAWTEXT mask invariants (round-5)
// ---------------------------------------------------------------------------
describe('closer-search mask', () => {
  // THE invariant the whole RAWTEXT guard rests on. `escapeOutsideFences`
  // computes `segmentOffset + index + match.length` from the ORIGINAL text and
  // indexes into the mask with it, so any length drift makes `hasLaterCloser`
  // search the wrong window — silently, and in the fail-OPEN direction.
  it('is LENGTH-PRESERVING over the whole fixture corpus', () => {
    for (const [name, md] of Object.entries({
      ...SHARED_FIXTURES,
      ...RICH_ONLY_FIXTURES,
      ...CHAT_FIXTURES,
    })) {
      expect(__buildCloserHaystackForTest(md).length, name).toBe(md.length)
    }
  })

  it('is LENGTH-PRESERVING for U+0130 (the one BMP char toLowerCase expands)', () => {
    // `'İ'.toLowerCase()` is 'i' + U+0307 — 1 code unit becomes 2. This is the
    // only such BMP character, and it is ordinary Turkish prose.
    expect('İ'.toLowerCase().length).toBe(2)
    for (const src of ['İ', 'İstanbul', `${'İ'.repeat(25)} <textarea>`, 'İ<TEXTAREA>İ</TEXTAREA>']) {
      expect(__buildCloserHaystackForTest(src).length, JSON.stringify(src)).toBe(src.length)
    }
  })

  it('still folds ASCII case, so an UPPERCASE closer is found', () => {
    expect(__buildCloserHaystackForTest('<TEXTAREA>x</TEXTAREA>')).toContain('</textarea>')
  })

  // Round-6: every ordinary form of CODE must hide a `</textarea>` from the
  // closer search. Each of these rendered a LIVE editable textarea containing
  // the rest of the message before the mask became tracker-derived.
  it.each([
    'rawtext-closer-in-blockquoted-fence-does-not-unescape',
    'rawtext-closer-in-indented-code-does-not-unescape',
    'rawtext-closer-in-tab-indented-code-does-not-unescape',
    'rawtext-closer-in-list-indented-fence-does-not-unescape',
    'rawtext-closer-in-quoted-list-indented-fence-does-not-unescape',
    'rawtext-closer-in-html-comment-does-not-unescape',
    'rawtext-closer-after-info-string-closer-does-not-unescape',
  ])('escapes the prose opener when the only closer is code: %s', async (name) => {
    const md = SHARED_FIXTURES[name]
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('textarea').length, name).toBe(0)
    // …and the document after the opener is still structured markdown.
    expect(container.querySelector('h2')?.textContent, name).toBe('After heading')
  })

  // Round-7: the carve must never shelter an opener the mask blanked. The
  // protected set is the INTERSECTION of carve and mask, so a span the mask
  // disagrees with is routed through `escapeOutsideFences` instead of being
  // pushed verbatim.
  it('does not shelter a live opener inside a mismatched carve span', async () => {
    const md = SHARED_FIXTURES['mismatched-fence-carve-does-not-shelter-opener']
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('textarea').length).toBe(0)
    // The text after the opener survives instead of becoming a textarea value.
    expect(container.textContent).toContain('after')
  })

  // Round-9: BOTH engines over-detect a fence inside an HTML block, so the
  // intersection guard is a no-op there. A protected span is self-contained
  // code by definition, so an UNBALANCED RAWTEXT opener inside one means the
  // span is not really code — route it through the escaper.
  it.each([
    'rawtext-opener-in-html-block-div-not-sheltered',
    'rawtext-opener-in-html-block-pre-not-sheltered',
    'rawtext-opener-in-html-block-details-not-sheltered',
  ])('does not shelter an opener inside an HTML block: %s', async (name) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={SHARED_FIXTURES[name]} />)
    expect(container.querySelectorAll('textarea').length, name).toBe(0)
    expect(container.querySelector('h2')?.textContent, name).toBe('After heading')
    expect(container.textContent, name).toContain('secret tail')
  })

  // Round-12: the SAME hole, sheltered by INLINE CODE instead of a fence. Round
  // 11 scoped the balance guard to fences because an inline span "cannot shelter
  // anything" — true in ordinary prose, false inside an HTML block, where remark
  // emits raw HTML and the backticks are not code. The guard is now gated on
  // HTML-BLOCK MEMBERSHIP, which is the property BOTH spellings share.
  it.each([
    'rawtext-opener-in-inline-code-in-html-block-div-not-sheltered',
    'rawtext-opener-in-inline-code-in-html-block-pre-not-sheltered',
    'rawtext-opener-in-inline-code-in-html-block-details-not-sheltered',
    'rawtext-opener-in-inline-code-in-html-block-span-not-sheltered',
  ])('does not shelter an opener in INLINE CODE inside an HTML block: %s', async (name) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={SHARED_FIXTURES[name]} />)
    expect(container.querySelectorAll('textarea').length, name).toBe(0)
    expect(container.querySelector('h2')?.textContent, name).toBe('After heading')
    expect(container.textContent, name).toContain('secret tail')
  })

  // Round-12: `/` not IMMEDIATELY followed by `>` is not a valid open tag under
  // CommonMark, so remark emits no `html` node and neither sanitizer regex needs
  // to match. Pinned because that safety is a coupling, not a local property.
  it('is inert for a slash not immediately before the closing bracket', async () => {
    const container = await renderStable(
      <SimpleMarkdownRenderer
        content={SHARED_FIXTURES['rawtext-slash-not-immediately-before-gt-is-inert']}
      />,
    )
    expect(container.querySelectorAll('textarea').length).toBe(0)
    expect(container.querySelector('h2')?.textContent).toBe('After heading')
    expect(container.querySelectorAll('li').length).toBe(1)
  })

  // Round-12 REGRESSION: the cap-overflow fallback must not escape inside code.
  // Entity refs are not decoded there, so the reader sees a literal `&lt;`.
  it('does not escape a bare `<` inside an indented code block', async () => {
    const md = SHARED_FIXTURES['indented-code-angle-bracket-not-escaped']
    expect(escapeUnknownHtmlTags(md)).toBe(md)
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelector('code')?.textContent).toBe('if a <b then\ndone\n')
  })

  // …including an over-long tag, which is what the fallback was written for: in
  // a region the MASK calls code it is a code sample, not a live opener. (Kept
  // out of SHARED_FIXTURES to spare the snapshots ~15KB of filler.)
  it.each([
    ['indented', 'Para\n\n    <div ' + 'b'.repeat(5000) + '>\n'],
    ['fenced', 'Para\n\n```\n<div ' + 'b'.repeat(5000) + '>\n```\n'],
    ['inline', 'Hi `<div ' + 'b'.repeat(3000) + '>` there'],
  ])('leaves an over-long tag inside code unescaped: %s', (_name, md) => {
    expect(escapeUnknownHtmlTags(md)).not.toContain('&lt;div')
  })

  // …while the SAME shape in PROSE still fails closed (the round-11 fix).
  it('still escapes an over-long tag written in prose', () => {
    const md = 'Hello\n\n<iframe src="' + 'b'.repeat(5000) + '">\n\n## After heading\n'
    expect(escapeUnknownHtmlTags(md)).toContain('&lt;iframe')
  })

  // Round-11: HTML ignores the self-closing flag on non-void, non-foreign
  // elements, so `<textarea/>` is a START tag and enters RAWTEXT exactly like
  // `<textarea>`. Every RAWTEXT fixture must therefore hold in BOTH spellings.
  it.each([
    'rawtext-self-closing-textarea-escaped',
    'rawtext-self-closing-spaced-textarea-escaped',
    'rawtext-self-closing-iframe-escaped',
    'rawtext-self-closing-title-escaped',
  ])('escapes a SELF-CLOSING rawtext opener: %s', async (name) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={SHARED_FIXTURES[name]} />)
    expect(container.querySelectorAll('textarea').length, name).toBe(0)
    expect(container.querySelectorAll('iframe').length, name).toBe(0)
    expect(container.querySelector('h2')?.textContent, name).toBe('After heading')
    expect(container.querySelectorAll('li').length, name).toBe(1)
  })

  it('escapes a self-closing rawtext opener written INLINE in prose', async () => {
    const container = await renderStable(
      <SimpleMarkdownRenderer content={SHARED_FIXTURES['rawtext-self-closing-textarea-inline-escaped']} />,
    )
    expect(container.querySelectorAll('textarea').length).toBe(0)
    expect(container.textContent).toContain('<textarea/>')
    expect(container.querySelector('h2')?.textContent).toBe('After heading')
  })

  it('does not shelter a SELF-CLOSING opener inside an HTML block', async () => {
    const container = await renderStable(
      <SimpleMarkdownRenderer
        content={SHARED_FIXTURES['rawtext-self-closing-opener-in-html-block-div-not-sheltered']}
      />,
    )
    expect(container.querySelectorAll('textarea').length).toBe(0)
    expect(container.querySelector('h2')?.textContent).toBe('After heading')
    expect(container.textContent).toContain('secret tail')
  })

  // Round-13: an HTML block opened INSIDE a container (blockquote / list item).
  // `computeHtmlBlockRanges` matched `^ {0,3}<…` against the RAW line, so the
  // container marker made every start condition miss and the balance guard went
  // blind — `escapeUnknownHtmlTags` returned these inputs BYTE-IDENTICAL.
  it.each([
    ['rawtext-opener-in-inline-code-in-blockquoted-html-block-not-sheltered', 'textarea'],
    ['rawtext-opener-in-inline-code-in-nested-blockquoted-html-block-not-sheltered', 'textarea'],
    ['rawtext-opener-in-inline-code-in-list-item-html-block-not-sheltered', 'textarea'],
    ['rawtext-opener-in-inline-code-in-ordered-item-html-block-not-sheltered', 'textarea'],
    ['rawtext-iframe-in-inline-code-in-blockquoted-html-block-not-sheltered', 'iframe'],
  ])('does not shelter an opener inside a CONTAINER-nested HTML block: %s', async (name, tag) => {
    const md = SHARED_FIXTURES[name]
    // The sanitizer must actually act on it (the round-13 symptom was a no-op).
    expect(escapeUnknownHtmlTags(md), name).not.toBe(md)
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll(tag).length, name).toBe(0)
    expect(container.querySelector('h2')?.textContent, name).toBe('After heading')
    expect(container.textContent, name).toContain('secret tail')
  })

  // Round-14: the container walk measured the list content column in CHARACTERS
  // where CommonMark measures COLUMNS, so a TAB-spelled list prefix
  // under-consumed the continuation indent and every start condition missed.
  // `escapeUnknownHtmlTags` was a total no-op on these and the DOM carried a
  // live RAWTEXT element. Asserted in BOTH renderers: the hole was in the
  // shared sanitizer, so a Simple-only test would have pinned half of it.
  it.each([
    ['rawtext-opener-in-inline-code-in-tab-list-item-html-block-not-sheltered', 'textarea'],
    ['rawtext-opener-in-inline-code-in-deep-tab-list-item-html-block-not-sheltered', 'textarea'],
    ['rawtext-iframe-in-inline-code-in-tab-list-item-html-block-not-sheltered', 'iframe'],
    // …and the FOREIGN-FILLER shape: a line that a greedy container strip reads
    // as blank (so the block terminated early) but CommonMark reads as HTML
    // content. Termination is now scoped to the OPENING line's prefix width.
    ['rawtext-opener-after-foreign-filler-in-list-item-html-block-not-sheltered', 'textarea'],
    ['rawtext-opener-after-foreign-filler-in-blockquoted-html-block-not-sheltered', 'textarea'],
  ])('does not shelter an opener behind a column-miscounted container: %s', async (name, tag) => {
    const md = SHARED_FIXTURES[name]
    // The sanitizer must actually act on it (the symptom was a byte-identical no-op).
    expect(escapeUnknownHtmlTags(md), name).not.toBe(md)
    for (const [label, Renderer] of [
      ['simple', SimpleMarkdownRenderer],
      ['rich', RichMarkdownRenderer],
    ] as const) {
      const container = await renderStable(<Renderer content={md} />)
      expect(container.querySelectorAll(tag).length, `${name} / ${label}`).toBe(0)
      expect(container.textContent, `${name} / ${label}`).toContain('secret tail')
    }
  })

  // Round-14 CONTROL: the foreign-filler fixtures must differ from their
  // filler-less twins ONLY by that line — otherwise they would prove nothing.
  it.each([
    ['- <div>\n  `<textarea>`\n\n## After heading\n\nsecret tail\n'],
    ['> <div>\n> `<textarea>`\n\n## After heading\n\nsecret tail\n'],
  ])('the filler-less control was already safe: %#', async (md) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('textarea').length).toBe(0)
  })

  // Round-14: a GENUINE filler (the opening container's own) must still
  // TERMINATE the block — the fix scopes termination, it must not disable it.
  it.each([
    ['blockquote', '> <div>\n>\n> after\n'],
    ['nested-blockquote', '> > <div>\n> >\n> > after\n'],
    ['list-item', '- <div>\n\n  after\n'],
  ])('still terminates an HTML block at its OWN container filler: %s', (_n, md) => {
    // The line after the filler is outside the block, so a protected span there
    // is ordinary inline code and is left verbatim.
    const withSpan = md.replace('after', '`<textarea>`')
    expect(escapeUnknownHtmlTags(withSpan)).toBe(withSpan)
  })

  // Round-11: the WHOLE swallow corpus, re-run in the SELF-CLOSING spelling.
  // Every fixture below is one whose defense is "the prose opener must escape";
  // rewriting each bare RAWTEXT opener to `<tag/>` must not change that, since
  // parse5 treats the two spellings identically. This is the sweep that would
  // have caught the round-9 HTML-block fixtures passing for the wrong reason.
  const SWALLOW_CORPUS = [
    'rawtext-closer-in-fence-does-not-unescape',
    'rawtext-closer-in-inline-code-does-not-unescape',
    'rawtext-closer-in-attribute-does-not-unescape',
    'rawtext-title-closer-in-fence-does-not-unescape',
    'rawtext-mask-survives-turkish-dotted-i',
    'rawtext-closer-in-unclosed-fence-does-not-unescape',
    'rawtext-closer-in-blockquoted-fence-does-not-unescape',
    'rawtext-closer-in-indented-code-does-not-unescape',
    'rawtext-closer-in-tab-indented-code-does-not-unescape',
    'rawtext-closer-in-list-indented-fence-does-not-unescape',
    'rawtext-closer-in-quoted-list-indented-fence-does-not-unescape',
    'rawtext-closer-in-html-comment-does-not-unescape',
    'rawtext-closer-after-info-string-closer-does-not-unescape',
    'mismatched-fence-carve-does-not-shelter-opener',
    'rawtext-opener-in-html-block-div-not-sheltered',
    'rawtext-opener-in-html-block-pre-not-sheltered',
    'rawtext-opener-in-html-block-details-not-sheltered',
    // …and the same four shapes in the INLINE-CODE shelter spelling (round 12),
    // so the sweep covers BOTH shelter spellings × BOTH tag spellings.
    'rawtext-opener-in-inline-code-in-html-block-div-not-sheltered',
    'rawtext-opener-in-inline-code-in-html-block-pre-not-sheltered',
    'rawtext-opener-in-inline-code-in-html-block-details-not-sheltered',
    'rawtext-opener-in-inline-code-in-html-block-span-not-sheltered',
    // …and the same hole in the CONTAINER-NESTED spelling (round 13).
    'rawtext-opener-in-inline-code-in-blockquoted-html-block-not-sheltered',
    'rawtext-opener-in-inline-code-in-nested-blockquoted-html-block-not-sheltered',
    'rawtext-opener-in-inline-code-in-list-item-html-block-not-sheltered',
    'rawtext-opener-in-inline-code-in-ordered-item-html-block-not-sheltered',
    'rawtext-iframe-in-inline-code-in-blockquoted-html-block-not-sheltered',
    'list-marker-inside-fence-does-not-shift-indent-columns',
    'list-marker-inside-fence-html-block-combo',
    'wide-list-marker-gap-clamps-content-column',
    // …and the round-15 blank-line-semantics shelter.
    'rawtext-opener-in-nbsp-filler-html-block-not-sheltered',
    'rawtext-iframe-in-nbsp-filler-html-block-not-sheltered',
    // …and the round-18 shapes: a block opened ON the list-marker line, a code
    // span crossing a line break, and a link reference definition.
    'rawtext-closer-in-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-marker-line-ordered-fence-does-not-unescape',
    'rawtext-closer-in-marker-line-tab-fence-does-not-unescape',
    'rawtext-closer-in-quoted-marker-line-fence-does-not-unescape',
    'rawtext-iframe-closer-in-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-continuation-line-fence-does-not-unescape',
    'rawtext-closer-in-multiline-code-span-does-not-unescape',
    'rawtext-iframe-closer-in-multiline-code-span-does-not-unescape',
    'rawtext-closer-in-link-definition-title-does-not-unescape',
    'rawtext-closer-in-link-definition-destination-does-not-unescape',
    // …and the round-19 shapes: NARROW and NESTED list-marker lines, the whole
    // INLINE link/image payload shelter class, and multi-line definitions.
    'rawtext-closer-in-narrow-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-narrow-ordered-marker-line-fence-does-not-unescape',
    'rawtext-iframe-closer-in-narrow-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-nested-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-nested-marker-line-link-definition-does-not-unescape',
    'rawtext-closer-in-inline-link-title-does-not-unescape',
    'rawtext-closer-in-inline-link-single-quoted-title-does-not-unescape',
    'rawtext-closer-in-inline-link-paren-title-does-not-unescape',
    'rawtext-closer-in-inline-image-title-does-not-unescape',
    'rawtext-closer-in-inline-link-angle-destination-does-not-unescape',
    'rawtext-closer-in-quoted-inline-link-title-does-not-unescape',
    'rawtext-closer-in-listed-inline-link-title-does-not-unescape',
    'rawtext-closer-in-mid-paragraph-inline-link-title-does-not-unescape',
    'rawtext-iframe-closer-in-inline-link-title-does-not-unescape',
    'rawtext-closer-in-multiline-link-definition-does-not-unescape',
    'rawtext-closer-in-multiline-link-definition-destination-does-not-unescape',
    // …and the round-21 shapes: BACKSLASH-ESCAPED delimiters in a definition's
    // label/destination/title, and a label or title that spans LINES.
    'rawtext-closer-in-escaped-quote-definition-title-does-not-unescape',
    'rawtext-closer-in-escaped-apostrophe-definition-title-does-not-unescape',
    'rawtext-closer-in-escaped-paren-definition-title-does-not-unescape',
    'rawtext-closer-in-escaped-bracket-definition-label-does-not-unescape',
    'rawtext-closer-in-escaped-bracket-definition-destination-does-not-unescape',
    'rawtext-closer-in-multiline-definition-label-does-not-unescape',
    'rawtext-closer-in-multiline-definition-label-first-line-does-not-unescape',
    'rawtext-closer-in-three-line-definition-label-does-not-unescape',
    'rawtext-closer-in-quoted-multiline-definition-label-does-not-unescape',
    'rawtext-closer-in-multiline-definition-title-does-not-unescape',
    'rawtext-iframe-closer-in-multiline-definition-label-does-not-unescape',
  ]
  // Bare opener → self-closed opener. Closers (`</tag>`), openers that already
  // carry attributes, and openers whose closer sits on the SAME line (a paired
  // inline element, as in the Turkish-`İ` fixture) are left alone — rewriting
  // those would change what the fixture is about rather than its spelling.
  const selfClose = (md: string) =>
    md.replace(
      /<(title|textarea|iframe|xmp|noembed|noframes|plaintext)>(?![^\n]*<\/\1>)/gi,
      '<$1/>',
    )

  const RAWTEXT_SELECTORS = ['textarea', 'iframe', 'title', 'xmp', 'noembed', 'noframes', 'plaintext']
  const rawtextCounts = (el: HTMLElement) =>
    RAWTEXT_SELECTORS.map((t) => `${t}:${el.querySelectorAll(t).length}`).join(' ')

  // Round-12: the sweep's invariant used to be purely DIFFERENTIAL (`selfEl`
  // counts === `bareEl` counts), so a common-mode regression that broke BOTH
  // spellings passed it — two entries were pinned by snapshot alone. Every
  // corpus entry is a "the prose opener must escape" shape, so the ABSOLUTE
  // truth is zero live RAWTEXT elements, with one deliberate exception: the
  // Turkish-`İ` fixture opens with a PROPERLY CLOSED `<textarea>a</textarea>`
  // before its bare opener, and that one must keep rendering.
  const LIVE_RAWTEXT_EXPECTED: Record<string, number> = {
    'rawtext-mask-survives-turkish-dotted-i': 1,
  }

  // -------------------------------------------------------------------------
  // Round-15: LINE ENDINGS as a first-class corpus DIMENSION.
  // -------------------------------------------------------------------------
  // The corpus is authored LF-only, so every `$`-anchored line regex in the
  // pipeline was swept in exactly one spelling. `FENCE_RE` ended `(.*)$` — `.`
  // excludes `\r` and `$` (no `m` flag) anchors at end of INPUT — so on a CRLF
  // document the shared fence tracker matched NOTHING and was completely
  // fence-blind: `rawtext-closer-in-fence-does-not-unescape`, respelled CRLF,
  // left a LIVE `<textarea>` while its LF twin escaped correctly. CRLF composes
  // with every wrapper below for free, so it is applied LAST (after the
  // container wrap and the tag-spelling rewrite).
  const LINE_ENDINGS = {
    lf: (md: string) => md,
    crlf: (md: string) => md.replace(/\n/g, '\r\n'),
  } as const
  const LINE_ENDING_NAMES = Object.keys(LINE_ENDINGS) as (keyof typeof LINE_ENDINGS)[]

  const SELF_CLOSING_CASES: [string, keyof typeof LINE_ENDINGS][] = []
  for (const name of SWALLOW_CORPUS)
    for (const eol of LINE_ENDING_NAMES) SELF_CLOSING_CASES.push([name, eol])

  it.each(SELF_CLOSING_CASES)(
    'swallow corpus holds in the self-closing spelling: %s / %s',
    async (name, eol) => {
    const eolize = LINE_ENDINGS[eol]
    const bare = eolize(SHARED_FIXTURES[name])
    const md = eolize(selfClose(SHARED_FIXTURES[name]))
    expect(md, name).not.toBe(bare) // the rewrite actually applied
    const bareEl = await renderStable(<SimpleMarkdownRenderer content={bare} />)
    const selfEl = await renderStable(<SimpleMarkdownRenderer content={md} />)
    // ABSOLUTE: no swallow in EITHER spelling, independent of the comparison.
    const expected = LIVE_RAWTEXT_EXPECTED[name] ?? 0
    for (const [label, el] of [
      ['bare', bareEl],
      ['self-closing', selfEl],
    ] as const) {
      expect(el.querySelectorAll(RAWTEXT_SELECTORS.join(',')).length, `${name} ${label}`).toBe(
        expected,
      )
    }
    // Spelling-independence: parse5 treats `<tag/>` as a start tag, so the two
    // spellings must yield the same live RAWTEXT elements…
    expect(rawtextCounts(selfEl), name).toBe(rawtextCounts(bareEl))
    // …and the same document structure below the opener (no swallow).
    expect(selfEl.querySelectorAll('h1,h2,h3,li,p').length, name).toBe(
      bareEl.querySelectorAll('h1,h2,h3,li,p').length,
    )
    },
  )

  // -------------------------------------------------------------------------
  // Round-13: CONTAINER NESTING as a first-class corpus DIMENSION.
  // -------------------------------------------------------------------------
  // The 294-case round-12 matrix missed the container hole entirely because
  // EVERY case was authored at column 0. Container nesting is now swept exactly
  // like the bare-vs-`<tag/>` spelling dimension: each corpus entry is also
  // rendered inside a blockquote (depth 1 and 2) and inside a bullet / ordered
  // list item, in BOTH tag spellings, and must satisfy the SAME absolute
  // invariant (zero live RAWTEXT elements, per-entry `LIVE_RAWTEXT_EXPECTED`)
  // plus the spelling-differential one. Any future shelter shape is therefore
  // caught in every container spelling automatically.
  const perLine = (f: (line: string) => string) => (md: string) =>
    md.split('\n').map(f).join('\n')

  /** Tabs to 4-column stops \u2014 mirrors the sanitizer's `expandTabs`, so a
   *  TAB-spelled marker's continuation pad lands on the real content column. */
  const expandTabs = (str: string) => {
    let out = ''
    for (const ch of str) out += ch === '\t' ? ' '.repeat(4 - (out.length % 4)) : ch
    return out
  }

  /** A list item: the marker on the first line, the content column on the rest. */
  const listWrap = (marker: string) => (md: string) => {
    const pad = ' '.repeat(expandTabs(marker).length)
    let seen = false
    return md
      .split('\n')
      .map((l) => {
        if (l === '') return ''
        if (!seen) {
          seen = true
          return marker + l
        }
        return pad + l
      })
      .join('\n')
  }

  /**
   * ROUND-18 — THE MARKER-LINE VARIANT, the dimension 1032 container cases
   * missed. `listWrap` puts the marker on the FIRST non-blank line, and every
   * corpus fixture BEGINS WITH PROSE, so every container case placed its block
   * on a CONTINUATION line — the one position `blankListItemCode` handled. A
   * block opened ON the marker line itself was never swept, and that is exactly
   * where the eighth instance of the fail-open class lived.
   *
   * This wrapper leaves the fixture's leading prose at top level (so the prose
   * RAWTEXT opener still sits outside the item) and starts the list item at the
   * line that OPENS A BLOCK. Everything below is padded to the content column
   * exactly as in `listWrap`, so the item's shape is otherwise identical.
   *
   * ROUND-19 — THE WRAPPER WAS GREEN FOR THE WRONG REASON, WHICH IS WHY 2855
   * TESTS MISSED THREE LIVE INSTANCES. It used to mark the first non-blank line
   * AFTER the first prose line. In every `SWALLOW_CORPUS` fixture that line is
   * MORE PROSE or a `## heading`, never the fence — so the construct always
   * landed on a padded CONTINUATION line at absolute indent 2-3, INSIDE
   * `FENCE_RE`'s 0..3 cap, i.e. the one position that was already covered. The
   * narrow-marker wrappers (`- ` / `1. `) were added specifically to sweep the
   * marker-line position independently of the column and STRUCTURALLY COULD NOT
   * land a block construct there. It now targets the first line that actually
   * opens a block — a code fence or a link reference definition — falling back
   * to the old rule for fixtures whose shelter is not a block construct (inline
   * code spans, attribute strings, HTML blocks), which keeps their coverage
   * unchanged. `wrapper marks a block-opening line` below pins the targeting.
   */
  /** A line that OPENS A BLOCK: a code fence or a link reference definition. */
  const BLOCK_OPENER_RE = /^[ \t]{0,3}(?:```|~~~|\[[^\]\n]{0,99}\]:)/
  /** Index of the line `markerLineListWrap` puts the marker on, or -1. */
  const markerLineTarget = (lines: string[]) => {
    const opener = lines.findIndex((l, i) => i > 0 && l !== '' && BLOCK_OPENER_RE.test(l))
    if (opener > 0) return opener
    const first = lines.findIndex((l) => l !== '')
    return first === -1 ? -1 : lines.findIndex((l, i) => i > first && l !== '')
  }
  const markerLineListWrap = (marker: string) => (md: string) => {
    const pad = ' '.repeat(expandTabs(marker).length)
    const lines = md.split('\n')
    const target = markerLineTarget(lines)
    if (target <= 0) return md
    return lines
      .map((l, i) => (l === '' ? '' : i < target ? l : i === target ? marker + l : pad + l))
      .join('\n')
  }

  /** A list item whose BLANK separators carry a FOREIGN container's opener at
   *  the content column. Those lines look blank to a greedy container strip but
   *  are HTML content under CommonMark \u2014 the round-14 early-termination shape. */
  const foreignFillerListWrap = (marker: string, filler: string) => (md: string) => {
    const pad = ' '.repeat(expandTabs(marker).length)
    let seen = false
    return md
      .split('\n')
      .map((l) => {
        if (l === '') return pad + filler
        if (!seen) {
          seen = true
          return marker + l
        }
        return pad + l
      })
      .join('\n')
  }

  /**
   * `preservesColumns` says whether the wrapper keeps each line's indentation
   * RELATIVE to its container's content column. Only the SPACE blockquotes do:
   * `> ` is exactly the two columns the block-quote parser consumes, so the
   * remainder is byte-for-byte the original line. Every list wrapper shifts by
   * its content column, and the TAB blockquote (`>\t`) consumes `>` plus ONE
   * column of the tab and leaves the other two as indentation \u2014 both re-parse a
   * shape whose MEANING is a column into something else (see
   * `COLUMN_SENSITIVE_ENTRIES`). The round-13 sweep decided this with a
   * `wrapper.startsWith('blockquote')` string test, which would have silently
   * (and wrongly) admitted `blockquote-tab`.
   *
   * ROUND-17: CONTAINER NESTING IS NOW SWEPT TO DEPTH 2+. Every wrapper above is
   * a SINGLE container, so the round-13 axis only ever swept one level deep:
   * every quoted case put its fence at quote-relative column 0, and every
   * list-nested case was at top level. The PRODUCT of two containers was never
   * tested — and that product is exactly where the seventh instance of the
   * fail-open class lived (a fenced sample in a list item INSIDE a blockquote
   * was masked by NO pass, because `blankQuotedCode` did not call
   * `blankListItemCode` while `blankListItemCode` did call `blankQuotedCode`).
   * The `nest()` compositions below add that dimension: quote⊗list,
   * quote⊗quote⊗list and list⊗quote, each in the three content-column spellings
   * (`1.  ` / `-   ` / `-\t`) that clear the 3-column `FENCE_RE` indent cap.
   * They compose with the tag-spelling, line-ending and exotic-blank dimensions
   * for free, exactly like the single-container wrappers.
   */
  /** Compose two wrappers: `nest(outer, inner)` puts `inner` INSIDE `outer`.
   *  Columns survive only when BOTH layers preserve them — one list layer
   *  anywhere in the stack shifts every line by its content column. */
  const nest = (
    outer: { wrap: (md: string) => string; preservesColumns: boolean },
    inner: { wrap: (md: string) => string; preservesColumns: boolean },
  ) => ({
    wrap: (md: string) => outer.wrap(inner.wrap(md)),
    preservesColumns: outer.preservesColumns && inner.preservesColumns,
  })
  const BQ1 = {
    wrap: perLine((l: string) => (l === '' ? '>' : `> ${l}`)),
    preservesColumns: true,
  }
  const BQ2 = {
    wrap: perLine((l: string) => (l === '' ? '> >' : `> > ${l}`)),
    preservesColumns: true,
  }
  /** List markers whose CONTENT COLUMN is 4 — past `FENCE_RE`'s absolute
   *  3-column indent cap, which is what makes the nested fence invisible. */
  const WIDE_LIST_MARKERS = { ordered: '1.  ', bullet: '-   ', tab: '-\t' } as const
  const CONTAINER_WRAPPERS = {
    'blockquote-depth-1': {
      wrap: perLine((l: string) => (l === '' ? '>' : `> ${l}`)),
      preservesColumns: true,
    },
    'blockquote-depth-2': {
      wrap: perLine((l: string) => (l === '' ? '> >' : `> > ${l}`)),
      preservesColumns: true,
    },
    'bullet-item': { wrap: listWrap('- '), preservesColumns: false },
    'ordered-item': { wrap: listWrap('1. '), preservesColumns: false },
    // Round-14: the WHITESPACE SPELLING is its own dimension. Every wrapper
    // above is space-built, so the sweep covered exactly one spelling and a
    // tab-spelled container prefix \u2014 whose content column is a tab STOP, not a
    // character count \u2014 was invisible to it.
    'bullet-item-tab': { wrap: listWrap('-\t'), preservesColumns: false },
    'blockquote-tab': {
      wrap: perLine((l: string) => (l === '' ? '>' : `>\t${l}`)),
      preservesColumns: false,
    },
    // Round-14: a filler line that a greedy strip reads as blank but CommonMark
    // reads as HTML content, which used to TERMINATE the block early.
    'bullet-item-foreign-filler': {
      wrap: foreignFillerListWrap('- ', '>'),
      preservesColumns: false,
    },
    'blockquote-foreign-filler': {
      wrap: perLine((l: string) => (l === '' ? '> -' : `> ${l}`)),
      preservesColumns: false,
    },
    // Round-15: the EXOTIC-WHITESPACE spelling of a blank line is its own
    // dimension. Every separator in the corpus is a truly empty line, so the
    // sweep only ever exercised one spelling of "blank" — and the pipeline
    // decided blankness with `String.trim()`, which strips U+00A0 / U+000B /
    // U+000C / U+FEFF while CommonMark's blank line is spaces and tabs only.
    // A filler line holding one of those is CONTENT to remark and BLANK to the
    // tracked-range walk, which is exactly how the HTML-block shelter reopened
    // (see `rawtext-opener-in-nbsp-filler-html-block-not-sheltered`). These
    // wrappers preserve every non-blank line verbatim, so column-sensitive
    // entries are safe to sweep in them.
    ...(Object.fromEntries(
      (
        [
          ['nbsp', '\u00a0'],
          ['vertical-tab', '\u000b'],
          ['form-feed', '\u000c'],
          ['bom', '\ufeff'],
        ] as const
      ).map(([label, ch]) => [
        `exotic-blank-${label}`,
        { wrap: perLine((l: string) => (l === '' ? ch : l)), preservesColumns: true },
      ]),
    ) as Record<string, { wrap: (md: string) => string; preservesColumns: boolean }>),
    // Round-17: CONTAINER × CONTAINER. `quote-x-*` is a wide list item inside a
    // blockquote (the reported hole), `nested-quote-x-*` the same at quote depth
    // 2, and `list-x-quote` the MIRROR direction (a blockquote inside a list
    // item) so neither leg of the mutual recursion is swept alone.
    ...(Object.fromEntries(
      Object.entries(WIDE_LIST_MARKERS).flatMap(([label, marker]) => {
        const item = { wrap: listWrap(marker), preservesColumns: false }
        return [
          [`quote-x-${label}-item`, nest(BQ1, item)],
          [`nested-quote-x-${label}-item`, nest(BQ2, item)],
          [`${label}-item-x-quote`, nest(item, BQ1)],
        ]
      }),
    ) as Record<string, { wrap: (md: string) => string; preservesColumns: boolean }>),
    // Round-18: the MARKER-LINE variant of every list-bearing wrapper above —
    // the block opened ON the marker line rather than on a continuation line.
    ...(Object.fromEntries(
      Object.entries(WIDE_LIST_MARKERS).flatMap(([label, marker]) => {
        const item = { wrap: markerLineListWrap(marker), preservesColumns: false }
        return [
          [`marker-line-${label}-item`, item],
          [`quote-x-marker-line-${label}-item`, nest(BQ1, item)],
          [`nested-quote-x-marker-line-${label}-item`, nest(BQ2, item)],
          [`marker-line-${label}-item-x-quote`, nest(item, BQ1)],
        ]
      }),
    ) as Record<string, { wrap: (md: string) => string; preservesColumns: boolean }>),
    // …and the NARROW markers too (content column 2/3, under the `FENCE_RE`
    // cap), so the marker-line position is swept independently of the column.
    'marker-line-bullet-item': { wrap: markerLineListWrap('- '), preservesColumns: false },
    'marker-line-ordered-item': { wrap: markerLineListWrap('1. '), preservesColumns: false },
  } as const

  // Entries whose MEANING is a column: an indented-code block at exactly 4, a
  // fence indented into a list content column, a marker-gap clamp. A list
  // wrapper shifts every line right by the content column, which re-parses those
  // shapes as something else (the indented code stops being at +4 relative to
  // the item, the clamp fixture gets a SECOND marker). They are swept in the
  // blockquote wrappers only — a `> ` prefix is consumed by the block-quote
  // parser and RESETS the content column, so relative indentation is preserved.
  const COLUMN_SENSITIVE_ENTRIES = new Set([
    'rawtext-closer-in-indented-code-does-not-unescape',
    'rawtext-closer-in-tab-indented-code-does-not-unescape',
    'rawtext-closer-in-list-indented-fence-does-not-unescape',
    'rawtext-closer-in-quoted-list-indented-fence-does-not-unescape',
    'list-marker-inside-fence-does-not-shift-indent-columns',
    'list-marker-inside-fence-html-block-combo',
    'wide-list-marker-gap-clamps-content-column',
    // Already authored INSIDE a list item; re-wrapping in another one only
    // re-tests the wrapper.
    'rawtext-opener-in-inline-code-in-list-item-html-block-not-sheltered',
    'rawtext-opener-in-inline-code-in-ordered-item-html-block-not-sheltered',
    // Round-18: the marker-line shapes ARE a list-item column by construction —
    // a list wrapper pads them into a different one and re-parses the fence.
    'rawtext-closer-in-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-marker-line-ordered-fence-does-not-unescape',
    'rawtext-closer-in-marker-line-tab-fence-does-not-unescape',
    'rawtext-closer-in-quoted-marker-line-fence-does-not-unescape',
    'rawtext-iframe-closer-in-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-continuation-line-fence-does-not-unescape',
    // Round-19: same reason — these ARE list-item columns by construction.
    'rawtext-closer-in-narrow-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-narrow-ordered-marker-line-fence-does-not-unescape',
    'rawtext-iframe-closer-in-narrow-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-nested-marker-line-fence-does-not-unescape',
    'rawtext-closer-in-nested-marker-line-link-definition-does-not-unescape',
    'rawtext-closer-in-listed-inline-link-title-does-not-unescape',
  ])

  const CONTAINER_CASES: [string, string, keyof typeof LINE_ENDINGS][] = []
  for (const name of SWALLOW_CORPUS)
    for (const [wrapper, spec] of Object.entries(CONTAINER_WRAPPERS))
      if (!COLUMN_SENSITIVE_ENTRIES.has(name) || spec.preservesColumns)
        // …and every (entry × wrapper) pair in BOTH line-ending spellings, so
        // the CRLF dimension composes with the container one for free.
        for (const eol of LINE_ENDING_NAMES) CONTAINER_CASES.push([name, wrapper, eol])

  it.each(CONTAINER_CASES)(
    'swallow corpus holds inside a container: %s / %s / %s',
    async (name, wrapper, eol) => {
      const { wrap } = CONTAINER_WRAPPERS[wrapper as keyof typeof CONTAINER_WRAPPERS]
      const eolize = LINE_ENDINGS[eol]
      const bare = eolize(wrap(SHARED_FIXTURES[name]))
      const md = eolize(selfClose(wrap(SHARED_FIXTURES[name])))
      const bareEl = await renderStable(<SimpleMarkdownRenderer content={bare} />)
      const selfEl = await renderStable(<SimpleMarkdownRenderer content={md} />)
      const expected = LIVE_RAWTEXT_EXPECTED[name] ?? 0
      for (const [label, el] of [
        ['bare', bareEl],
        ['self-closing', selfEl],
      ] as const) {
        expect(
          el.querySelectorAll(RAWTEXT_SELECTORS.join(',')).length,
          `${name} / ${wrapper} / ${eol} / ${label}`,
        ).toBe(expected)
      }
      expect(rawtextCounts(selfEl), `${name} / ${wrapper} / ${eol}`).toBe(rawtextCounts(bareEl))
      expect(
        selfEl.querySelectorAll('h1,h2,h3,li,p').length,
        `${name} / ${wrapper} / ${eol}`,
      ).toBe(bareEl.querySelectorAll('h1,h2,h3,li,p').length)
    },
  )

  // Round-19 META-TEST: `markerLineListWrap` must actually put the marker on a
  // line that OPENS A BLOCK. Its predecessor could not, and that is the whole
  // reason the narrow-marker wrappers passed while three live instances sat
  // uncovered. Every corpus entry carrying a fence or a link definition is
  // checked; a wrapper that regresses to "first non-blank after the prose"
  // fails here rather than passing silently for the wrong reason.
  it('markerLineListWrap marks a block-opening line', () => {
    const blockBearing = SWALLOW_CORPUS.filter((name) =>
      SHARED_FIXTURES[name]
        .split('\n')
        .some((l, i) => i > 0 && l !== '' && BLOCK_OPENER_RE.test(l)),
    )
    // The corpus must actually contain such entries, or the assertion is vacuous.
    expect(blockBearing.length).toBeGreaterThan(10)
    for (const name of blockBearing)
      for (const marker of ['- ', '1. ', '-   ', '1.  ', '-\t']) {
        const wrapped = markerLineListWrap(marker)(SHARED_FIXTURES[name])
        const markerLine = wrapped.split('\n').find((l) => l.startsWith(marker))
        expect(markerLine, `${name} / ${JSON.stringify(marker)}`).toBeDefined()
        // The marker is IMMEDIATELY followed by the block opener — the construct
        // is ON the marker line, not on a padded continuation line below it.
        expect(
          BLOCK_OPENER_RE.test(markerLine!.slice(marker.length)),
          `${name} / ${JSON.stringify(marker)} / ${JSON.stringify(markerLine)}`,
        ).toBe(true)
      }
  })

  // Round-19: CONTAINER NESTING DEPTH. The round-17 termination note claimed
  // `> -   ` alternation at 8000 levels ran with "no throw, ≤4 ms"; it did not —
  // HEAD raises `RangeError: Maximum call stack size exceeded` from ~2000 levels
  // up, i.e. a 24 KB message crashes the renderer. The recursion is finite but
  // its DEPTH is bounded only by input length. `CONTAINER_NEST_LIMIT` blanks an
  // over-deep run WHOLE (fail-closed) instead of recursing, so the mask stays
  // total, length-preserving and closer-free at every depth.
  it.each([
    ['alternation', (d: number) => '> -   '.repeat(d) + '```html\n' + '> -   '.repeat(d) + '</textarea>\n'],
    // The closer is padded to the INNERMOST item's content column, so it really
    // is fence content. (Padded to a SHALLOWER column it would close the inner
    // items and be a genuine top-level closer, which must stay visible.)
    ['list-markers', (d: number) => '- '.repeat(d) + '```html\n' + ' '.repeat(2 * d) + '</textarea>\n'],
  ])('masks arbitrarily deep container nesting without throwing: %s', (_label, mk) => {
    for (const depth of [1, 63, 64, 65, 2000, 8000, 40000]) {
      const doc = mk(depth)
      const masked = __buildCloserHaystackForTest(doc)
      expect(masked.length, `depth ${depth}`).toBe(doc.length)
      // Fail-CLOSED: the sheltered closer is gone from the haystack.
      expect(masked.includes('</textarea>'), `depth ${depth}`).toBe(false)
    }
  })

  // Round-19 ESCALATION: the inline-title shelter with an ATTRIBUTE-BEARING
  // opener. Not privilege escalation (`iframe`/`src` are allowlisted) but
  // exactly the content-swallow this module prevents — a live iframe retaining
  // both attributes, with the document below it consumed.
  it('does not shelter an attribute-bearing opener behind an inline link title', async () => {
    const md =
      'Embedding <iframe src="https://evil.example/x" width="600"> explained.\n\n' +
      '[a](/x "</iframe>")\n\n## After heading\n\nsecret tail\n'
    expect(escapeUnknownHtmlTags(md)).not.toBe(md)
    const el = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(el.querySelectorAll('iframe').length).toBe(0)
    expect(el.textContent).toContain('secret tail')
  })

  // -------------------------------------------------------------------------
  // Round-20: the BRACKET half of the attribute-shelter class.
  // -------------------------------------------------------------------------
  // ESCALATION, the same shape round 19 pinned for the payload: an
  // attribute-bearing opener behind an IMAGE ALT shelter kept `src`, `width` and
  // `height` on a LIVE iframe, with the paragraph below it consumed.
  it('does not shelter an attribute-bearing opener behind an image alt', async () => {
    const md =
      'Embed: <iframe src="https://evil.example/x" width="600" height="400">\n\n' +
      '![</iframe>](/x)\n\n## After heading\n\nsecret tail\n'
    expect(escapeUnknownHtmlTags(md)).not.toBe(md)
    const el = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(el.querySelectorAll('iframe').length).toBe(0)
    expect(el.textContent).toContain('secret tail')
  })

  // The COMPLEMENT of the same rule, and the reason the pass may not simply
  // blank every `[…]`: remark EMITS an inline link's text and a bare SHORTCUT
  // reference's text as HTML, so a closer written there is REAL and the opener
  // above it is correctly left live. Blanking these would only over-escape, but
  // the boundary is the whole point of the pass — pin it.
  it.each([
    ['inline link text', 'The <textarea> element.\n\n[<textarea>hi</textarea>](/x)\n'],
    ['shortcut reference', 'The <textarea> element.\n\n[</textarea>]\n\n[</textarea>]: /x\n'],
  ])('leaves REMARK-EMITTED bracket text visible: %s', (_label, md) => {
    expect(escapeUnknownHtmlTags(md)).toBe(md)
  })

  // -------------------------------------------------------------------------
  // Round-20: the length caps must BLANK, not SKIP.
  // -------------------------------------------------------------------------
  // `INLINE_LINK_PAYLOAD_MAX` and the link-definition regexes' `{0,999}` bounds
  // each spent an over-limit exit as "not a link, leave visible" — the same
  // fail-OPEN shape `ba4a526b` closed for over-cap inline code spans, in code
  // written after that fix. CommonMark bounds neither a destination nor a title,
  // so these are ordinary documents. Every row was a byte-identical no-op with a
  // live RAWTEXT element before the fix; the 900-char controls below already
  // escaped correctly, which is what makes the cap (not the shape) the cause.
  const capFiller = 'y'.repeat(1100)
  const okFiller = 'y'.repeat(900)
  it.each([
    ['inline title', `[a](/x "${capFiller}</textarea>")`],
    ['inline destination', `[a](/${capFiller}</textarea>)`],
    ['inline angle destination', `[a](</${capFiller}</textarea>>)`],
    ['definition title', `[a]: /x "${capFiller}</textarea>"`],
    ['definition destination', `[a]: /${capFiller}</textarea>`],
    ['definition label', `[${capFiller}]: /x "</textarea>"`],
  ])('an OVER-CAP shelter still blanks: %s', async (_label, shelter) => {
    const md =
      'The <textarea> element explained.\n\n' +
      shelter +
      '\n\n## After heading\n\nsecret tail\n'
    expect(escapeUnknownHtmlTags(md)).toContain('&lt;textarea&gt;')
    const el = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(el.querySelectorAll('textarea').length).toBe(0)
    expect(el.textContent).toContain('secret tail')
  })

  it.each([
    ['inline title', `[a](/x "${okFiller}</textarea>")`],
    ['definition title', `[a]: /x "${okFiller}</textarea>"`],
  ])('…and the UNDER-cap control behaves identically: %s', (_label, shelter) => {
    const md =
      'The <textarea> element explained.\n\n' +
      shelter +
      '\n\n## After heading\n\nsecret tail\n'
    expect(escapeUnknownHtmlTags(md)).toContain('&lt;textarea&gt;')
  })

  // The over-cap escalation, with attributes.
  it('does not shelter an attribute-bearing opener behind an over-cap title', async () => {
    const md =
      'Embed: <iframe src="https://evil.example/x" width="600">\n\n' +
      `[a](/x "${capFiller}</iframe>")\n\n## After heading\n\nsecret tail\n`
    expect(escapeUnknownHtmlTags(md)).not.toBe(md)
    const el = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(el.querySelectorAll('iframe').length).toBe(0)
  })

  // …and a stray `](` still blanks NOTHING: the cap decides when to stop
  // parsing, never how little to blank, so an unparseable shape declines and
  // ordinary prose containing `](` is untouched.
  it('a stray `](` in prose blanks nothing', () => {
    const md = 'The <textarea> element.\n\nsee foo](bar baz and then </textarea> later\n'
    const masked = __buildCloserHaystackForTest(md)
    expect(masked.length).toBe(md.length)
    expect(masked).toContain('</textarea>')
  })

  // -------------------------------------------------------------------------
  // Round-21: the definition parser is ESCAPE-AWARE, and its exits are
  // CLASSIFIED — consumption blanks, recognition declines.
  // -------------------------------------------------------------------------
  // ESCALATION, same shape rounds 19/20 pinned: a multi-line LABEL shelter kept
  // `src`, `width` and `height` on a LIVE iframe with the paragraph consumed.
  it('does not shelter an attribute-bearing opener behind a multi-line label', async () => {
    const md =
      'See <iframe src="https://evil.example/x" width="600" height="400">.\n\n' +
      '[foo\n</iframe>]: /x\n\n## After heading\n\nsecret tail\n'
    expect(escapeUnknownHtmlTags(md)).not.toBe(md)
    const el = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(el.querySelectorAll('iframe').length).toBe(0)
    expect(el.textContent).toContain('secret tail')
  })

  // THE RECOGNITION BOUNDARY — the controls that keep the multi-line label from
  // swallowing ordinary prose. In each of these remark EMITS the text (no `]:`
  // arrives; the `]` is not followed by `:`; the label holds an unescaped `[`;
  // the line carries trailing content so it is not a definition), so the closer
  // written there is REAL and the mask must leave it VISIBLE. A pass that
  // blanked here would over-escape genuine elements — this is the same boundary
  // `blankBracketLabels` draws around an inline link's `[…]`.
  it.each([
    ['no `]:` in the paragraph', 'The <textarea> element.\n\n[foo\n</textarea> bar\n'],
    ['`]` without `:`', 'The <textarea> element.\n\n[foo\n</textarea>] bar\n'],
    ['unescaped `[` in the label', 'The <textarea> element.\n\n[foo[bar\n</textarea>]: /x\n'],
    ['trailing content after a title', 'The <textarea> element.\n\n[a]: /x "t" </textarea>\n'],
    ['trailing content after a destination', 'The <textarea> element.\n\n[a]: /x </textarea>\n'],
    ['continuation line that is not a title', 'The <textarea> element.\n\n[a]: /x\n</textarea> is real\n'],
  ])('leaves a NON-definition visible: %s', (_label, md) => {
    const masked = __buildCloserHaystackForTest(md)
    expect(masked.length).toBe(md.length)
    expect(masked).toContain('</textarea>')
    expect(escapeUnknownHtmlTags(md)).toBe(md)
  })

  // …and the consumption side of the same boundary: a title that OPENS and
  // never closes is blanked TO THE PARAGRAPH BOUND rather than declined, and the
  // blanking stops there (the heading below it stays visible in the haystack).
  it('blanks an unterminated definition title to the paragraph bound', () => {
    const md =
      'The <textarea> element explained.\n\n[a]: /x "never closes\n</textarea>\nstill inside\n\n## After heading\n'
    const masked = __buildCloserHaystackForTest(md)
    expect(masked.length).toBe(md.length)
    expect(masked).not.toContain('</textarea>')
    expect(masked).toContain('## after heading') // the haystack is case-folded
  })

  // Round-19 (LOW, cosmetic): `blankLinkDefinitions`' label pattern also matched
  // a GFM FOOTNOTE definition, whose content is BLOCK-parsed and may hold REAL
  // html. The pair below rendered as escaped visible source while the
  // byte-identical pair in plain prose rendered correctly. Fail-closed, so not a
  // security defect — but the two must now agree.
  it('does not blank a GFM footnote definition', async () => {
    const md = 'Body[^a].\n\n[^a]: <textarea>hi</textarea>\n'
    expect(escapeUnknownHtmlTags(md)).toBe(md)
    const el = await renderStable(<SimpleMarkdownRenderer content={md} />)
    const plain = await renderStable(
      <SimpleMarkdownRenderer content={'Body.\n\nSee <textarea>hi</textarea>\n'} />,
    )
    expect(el.querySelectorAll('textarea').length).toBe(
      plain.querySelectorAll('textarea').length,
    )
    expect(el.textContent).not.toContain('<textarea>')
  })

  // …while a real link reference definition next to it is STILL blanked — the
  // footnote carve-out must not reopen the round-18 shelter.
  it('still blanks a link definition sharing the document with a footnote', () => {
    const md =
      'The <textarea> element[^a] explained.\n\n[^a]: note\n\n[a]: /x "</textarea>"\n\n' +
      '## After heading\n\nsecret tail\n'
    expect(escapeUnknownHtmlTags(md)).toContain('&lt;textarea&gt;')
  })

  // -------------------------------------------------------------------------
  // Round-16: INLINE-SPAN LENGTH as a first-class corpus DIMENSION.
  // -------------------------------------------------------------------------
  // Every inline-code shelter in the corpus above is a SHORT span, so the whole
  // six-dimension matrix only ever exercised spans the mask's 4096-char regex
  // cap could match. Above the cap the span matched NEITHER the mask regex nor
  // the carve regex, the mask left the sheltered `</textarea>` VISIBLE in the
  // closer haystack, `hasLaterCloser` returned true, the prose opener stayed
  // LIVE and parse5 swallowed the rest of the message as the textarea's value.
  // A clean cliff with padding as the only variable — span content ≤4094 chars:
  // 0 live textareas; ≥4099: 1. The mask no longer uses a capped regex
  // (`findInlineCodeRanges`), and this axis pins the dimension: every shelter
  // spelling is now swept at cap−k AND cap+k.
  const INLINE_SPAN_PADS = { 'under-cap': 4080, 'over-cap': 4085 } as const

  /** Shelter spellings, parameterized by RAWTEXT tag and inline-span padding. */
  const SPAN_LENGTH_SHAPES: Record<string, (tag: string, pad: number) => string> = {
    // The reported hole: the CLOSER hides inside an over-long span, so the
    // prose opener above it must still be escaped.
    'closer-in-inline-code': (tag, pad) =>
      `intro\n\n<${tag}>\n\n\`${'x'.repeat(pad)} </${tag}> \`\n\n## After heading\n\nsecret tail\n`,
    // …and the mirror shape: the OPENER hides inside an over-long span that
    // sits inside an HTML block, where the span is not really code.
    'opener-in-inline-code-in-html-block-div': (tag, pad) =>
      `intro\n\n<div>\n\`${'x'.repeat(pad)} <${tag}> \`\n</div>\n\n## After heading\n\nsecret tail\n`,
    'opener-in-inline-code-in-html-block-pre': (tag, pad) =>
      `intro\n\n<pre>\n\`${'x'.repeat(pad)} <${tag}> \`\n</pre>\n\n## After heading\n\nsecret tail\n`,
    'opener-in-inline-code-in-html-block-details': (tag, pad) =>
      `intro\n\n<details>\n\`${'x'.repeat(pad)} <${tag}> \`\n</details>\n\n## After heading\n\nsecret tail\n`,
    'opener-in-inline-code-in-blockquoted-html-block': (tag, pad) =>
      `> intro\n>\n> <div>\n> \`${'x'.repeat(pad)} <${tag}> \`\n> </div>\n>\n> ## After heading\n>\n> secret tail\n`,
  }

  const SPAN_LENGTH_CASES: [string, string, keyof typeof INLINE_SPAN_PADS][] = []
  for (const shape of Object.keys(SPAN_LENGTH_SHAPES))
    for (const tag of ['textarea', 'iframe'])
      for (const len of Object.keys(INLINE_SPAN_PADS) as (keyof typeof INLINE_SPAN_PADS)[])
        SPAN_LENGTH_CASES.push([shape, tag, len])

  it.each(SPAN_LENGTH_CASES)(
    'shelter holds at every inline-span length: %s / %s / %s',
    async (shape, tag, len) => {
      const build = SPAN_LENGTH_SHAPES[shape]
      const bare = build(tag, INLINE_SPAN_PADS[len])
      const md = selfClose(bare)
      const label = `${shape} / ${tag} / ${len}`
      for (const [spelling, src] of [
        ['bare', bare],
        ['self-closing', md],
      ] as const) {
        const el = await renderStable(<SimpleMarkdownRenderer content={src} />)
        // Nothing RAWTEXT may be live, in EITHER tag spelling and at EITHER
        // side of the retired cap.
        expect(
          el.querySelectorAll(RAWTEXT_SELECTORS.join(',')).length,
          `${label} / ${spelling}`,
        ).toBe(0)
        // …and the document below the shelter must survive intact: a swallow
        // leaves the tail alive only as a textarea VALUE, invisible to the
        // element count above.
        expect(el.textContent, `${label} / ${spelling}`).toContain('secret tail')
      }
    },
  )

  // Round-16: the mask's inline-code pass stopped being a regex, so the claim
  // "same match semantics, minus the cap and the backtracking" needs a proof.
  // Differential fuzz against the retired regex in its UNCAPPED spelling over a
  // backtick-dense alphabet — the shapes that exercise every branch (opener run
  // giving back backticks, a closer inside the SAME run, a resume landing
  // MID-RUN, and no-closer-at-all).
  //
  // ROUND-18 — THE ORACLE'S UNIT CHANGED FROM A LINE TO A PARAGRAPH SEGMENT.
  // A CommonMark code span crosses line breaks, so the retired per-line regex
  // was not merely slow, it was WRONG in the fail-OPEN direction (`` `foo\n
  // </textarea>` `` left the closer visible in the haystack — see
  // `findInlineCodeRanges`). The oracle therefore changes shape with the scan:
  // the SAME regex — greedy opener run, lazy body, backreference closer — with
  // its body class widened from `[^\n]` to `[\s\S]`, applied INDEPENDENTLY to
  // each maximal run of non-blank lines and offset back into the document.
  //
  // WHY IT IS STILL A VALID ORACLE: it is derived from the specification, not
  // from the implementation. CommonMark's code-span rule is exactly "matching
  // backtick strings within one paragraph", so the regex expresses the closer
  // semantics and the segmentation expresses the paragraph bound; the two are
  // written here with completely different machinery (regex backtracking +
  // `split`) from the scan's suffix-max index walk. `isBlankLine` is shared on
  // purpose — the definition of a paragraph break is one fact, not two — and it
  // is itself pinned by the exotic-blank dimension of the sweep. The alphabet
  // already contains `\n` and ' ', so blank lines, one-line segments and
  // multi-line segments are all generated.
  it('the inline-code scan matches the retired regex, per paragraph segment', () => {
    const TICK = String.fromCharCode(96)
    const RE = new RegExp('(' + TICK + '+)[\\s\\S]*?\\1', 'g')
    const alphabet = [TICK, TICK, TICK, 'a', 'b', '\n', ' ', '<', '>']
    let seed = 12345
    const rnd = () => ((seed = (seed * 1103515245 + 12345) & 0x7fffffff) / 0x7fffffff)
    /** Maximal runs of non-blank lines, as `[start, end)` offsets. */
    const segments = (src: string): [number, number][] => {
      const out: [number, number][] = []
      let offset = 0
      let start = -1
      let end = -1
      for (const line of src.split('\n')) {
        if (isBlankLine(line)) {
          if (start !== -1) out.push([start, end])
          start = -1
        } else {
          if (start === -1) start = offset
          end = offset + line.length
        }
        offset += line.length + 1
      }
      if (start !== -1) out.push([start, end])
      return out
    }
    for (let iter = 0; iter < 20000; iter++) {
      let src = ''
      const n = 1 + Math.floor(rnd() * 24)
      for (let i = 0; i < n; i++) src += alphabet[Math.floor(rnd() * alphabet.length)]
      const want: [number, number][] = []
      for (const [from, to] of segments(src)) {
        const seg = src.slice(from, to)
        RE.lastIndex = 0
        let m: RegExpExecArray | null
        while ((m = RE.exec(seg)) !== null)
          want.push([from + m.index, from + m.index + m[0].length])
      }
      expect(__findInlineCodeRangesForTest(src), JSON.stringify(src)).toEqual(want)
    }
  })

  // -------------------------------------------------------------------------
  // Round-16: the sweep also drives `splitStreamingBlocks`.
  // -------------------------------------------------------------------------
  // Every arm above renders through `SimpleMarkdownRenderer`, so NEITHER the
  // exotic-blank NOR the CRLF dimension ever touched the streaming splitter —
  // which is exactly how four hand-rolled `line.trim() === ''` tests survived
  // in `streaming.ts` after `isBlankLine` was minted as THE blank-line SSOT.
  // `trim()` strips U+00A0 / U+000B / U+000C / U+FEFF, none of which CommonMark
  // calls blank, so one such line cut a paragraph into two `ReactMarkdown`
  // units on the streaming path (two `<p>` where the non-streaming and SEO
  // twins render one). The control is the SAME document with the exotic filler
  // replaced by an ordinary non-blank character: both are non-blank under
  // CommonMark, so both must split identically.
  it('the splitter is swept across the corpus x containers x line endings', () => {
    const EXOTIC_FILLERS: Record<string, string> = {
      'exotic-blank-nbsp': '\u00a0',
      'exotic-blank-vertical-tab': '\u000b',
      'exotic-blank-form-feed': '\u000c',
      'exotic-blank-bom': '\ufeff',
    }
    let checked = 0
    let controls = 0
    for (const name of SWALLOW_CORPUS) {
      for (const [wrapper, spec] of Object.entries(CONTAINER_WRAPPERS)) {
        if (COLUMN_SENSITIVE_ENTRIES.has(name) && !spec.preservesColumns) continue
        const wrapped = spec.wrap(SHARED_FIXTURES[name])
        const lfBlocks = splitStreamingBlocks(wrapped)
        for (const eol of LINE_ENDING_NAMES) {
          const md = LINE_ENDINGS[eol](wrapped)
          const blocks = splitStreamingBlocks(md)
          const label = `${name} / ${wrapper} / ${eol}`
          // LOSSLESS: the units are a partition of the source, so the engine's
          // per-unit parses cover the document exactly once.
          expect(blocks.map((b) => b.text).join('\n'), label).toBe(md)
          // …and `startLine` stays a running line count over that partition.
          let line = 1
          for (const b of blocks) {
            expect(b.startLine, `${label} #${b.index}`).toBe(line)
            line += b.text.split('\n').length
          }
          // The line ending is not a block boundary: CRLF must split exactly
          // like its LF twin.
          expect(blocks.length, label).toBe(lfBlocks.length)
          checked++
        }
        // EXOTIC BLANKS ARE NOT BLANK. Compare against the non-blank control.
        const filler = EXOTIC_FILLERS[wrapper]
        if (filler !== undefined) {
          const control = SHARED_FIXTURES[name]
            .split('\n')
            .map((l) => (l === '' ? 'x' : l))
            .join('\n')
          expect(
            splitStreamingBlocks(wrapped).length,
            `${name} / ${wrapper} vs non-blank control`,
          ).toBe(splitStreamingBlocks(control).length)
          controls++
        }
      }
    }
    // Pinned, not "greater than": the splitter arm must stay in lockstep with
    // the renderer arm's (entry x wrapper x line-ending) matrix above.
    expect(checked).toBe(CONTAINER_CASES.length)
    expect(controls).toBe(SWALLOW_CORPUS.length * 4)
  })

  // Round-11: the balance guard must NOT touch inline code. An inline span can
  // shelter nothing (remark emits it as an `inlineCode` text node), and entity
  // refs are not recognized inside code spans — so escaping there is always
  // visible to the reader as the literal text `&lt;title&gt;`.
  it.each([
    ['inline-code-rawtext-title-not-escaped', '<title>'],
    ['inline-code-rawtext-textarea-not-escaped', '<textarea>'],
  ])('keeps a rawtext tag named in inline code verbatim: %s', async (name, tag) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={SHARED_FIXTURES[name]} />)
    const code = container.querySelector('code')
    expect(code?.textContent, name).toBe(tag)
    expect(container.textContent, name).not.toContain('&lt;')
    // …and the inline span still shelters nothing live.
    expect(container.querySelectorAll('textarea').length, name).toBe(0)
  })

  // Round-11 SECURITY: `TAG_LIKE_REGEX` hard-bounds its attribute run at 4096
  // chars (ReDoS hardening). An attribute run LONGER than that made the tag
  // fail to match AT ALL, so neither the allowlist nor the RAWTEXT closer check
  // ever ran and a live opener reached the DOM verbatim. Kept out of
  // SHARED_FIXTURES only to spare the snapshots ~20KB of filler.
  it.each([
    ['iframe', `Hello\n\n<iframe src="${'b'.repeat(5000)}">\n\n## After heading\n\n- item\n`],
    ['textarea', `Hello\n\n<textarea ${'a'.repeat(5000)}>\n\n## After heading\n\n- item\n`],
    ['unknown', `Hello\n\n<their ${'a'.repeat(5000)}>\n\n## After heading\n\n- item\n`],
  ])('escapes a tag whose attribute run exceeds the regex cap: %s', async (tag, md) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll(tag).length, tag).toBe(0)
    expect(container.querySelector('h2')?.textContent, tag).toBe('After heading')
    expect(container.querySelectorAll('li').length, tag).toBe(1)
  })

  // …and the fallback must not double-escape what the main pass already handled.
  it('the over-long-tag fallback does not double-escape ordinary tags', () => {
    for (const src of [
      'a <their>b</their> c',
      'a <textarea>b</textarea> c',
      '<div class="x">y</div>',
      'Hello <textarea/> world',
      'plain text with no tags at all',
      '`<title>` in code',
    ]) {
      expect(escapeUnknownHtmlTags(src), src).not.toContain('&amp;lt;')
    }
  })

  // Round-9: the indented-code walk must see the CURRENT mask, so a list marker
  // written inside a fence cannot shift the content-column stack.
  it('a list marker inside a fence does not unblank later indented code', async () => {
    const container = await renderStable(
      <SimpleMarkdownRenderer
        content={SHARED_FIXTURES['list-marker-inside-fence-does-not-shift-indent-columns']}
      />,
    )
    expect(container.querySelectorAll('textarea').length).toBe(0)
  })

  it('survives the HTML-block + in-fence-list-marker combination', async () => {
    const container = await renderStable(
      <SimpleMarkdownRenderer content={SHARED_FIXTURES['list-marker-inside-fence-html-block-combo']} />,
    )
    expect(container.querySelectorAll('textarea').length).toBe(0)
    expect(container.querySelector('h1')?.textContent).toBe('Heading after')
    expect(container.textContent).toContain('Body after.')
  })

  // Round-9: CommonMark clamps the item content column when the marker is
  // followed by more than 4 spaces.
  it('clamps a list content column when the marker gap exceeds 4 spaces', async () => {
    const container = await renderStable(
      <SimpleMarkdownRenderer content={SHARED_FIXTURES['wide-list-marker-gap-clamps-content-column']} />,
    )
    expect(container.querySelectorAll('textarea').length).toBe(0)
    expect(container.querySelector('h2')?.textContent).toBe('After heading')
  })

  // Round-7: a `<!--` inside code is not a comment start. Both of these blanked
  // the rest of the document (and escaped a perfectly valid element) when
  // `blankComments` scanned the unmasked copy.
  it.each([
    'comment-marker-in-inline-code-does-not-blank-to-eof',
    'truncated-comment-in-fence-does-not-blank-to-eof',
  ])('a `<!--` inside code does not disable later closers: %s', async (name) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={SHARED_FIXTURES[name]} />)
    expect(container.querySelectorAll('textarea').length, name).toBe(1)
  })

  // Round-7: list-item continuation lines are paragraphs, not indented code.
  it.each([
    'list-continuation-textarea-stays-live-ordered',
    'list-continuation-textarea-stays-live-bullet',
  ])('keeps a list-continuation <textarea> live: %s', async (name) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={SHARED_FIXTURES[name]} />)
    expect(container.querySelectorAll('textarea').length, name).toBe(1)
  })

  // The blockquote pass strips the `>` prefix and runs a NESTED tracker rather
  // than blanking every quoted line, precisely so a legitimately PAIRED
  // `<textarea>` inside a blockquote keeps rendering as a real element.
  it('keeps a properly paired <textarea> inside a blockquote live', async () => {
    const md = '> quoted intro\n>\n> <textarea>edit me</textarea>\n\n## After heading\n'
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('textarea').length).toBe(1)
    expect(container.querySelector('h2')?.textContent).toBe('After heading')
  })

  it('leaves the opener live when a REAL closer follows, regardless of İ count', async () => {
    for (const n of [0, 20, 25, 60]) {
      const md = `${'İ'.repeat(n)} <textarea>a</textarea>\n\n<textarea>\n\n## Later heading\n\n- item one\n`
      const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
      // Exactly ONE textarea: the properly closed one. The bare opener must be
      // escaped, so the heading and the list below survive as real elements.
      expect(container.querySelectorAll('textarea').length, `n=${n}`).toBe(1)
      expect(container.querySelectorAll('h2').length, `n=${n}`).toBe(1)
      expect(container.querySelectorAll('li').length, `n=${n}`).toBe(1)
    }
  })

  // Round-22 (SECURITY): the GFM-footnote RECOGNITION decline was fail-OPEN for
  // an UNREFERENCED definition. The decline's justification — "a footnote body
  // is BLOCK-parsed and may hold REAL html" — holds only when the footnote is
  // REFERENCED. `remark-gfm` DROPS an unreferenced definition entirely, so
  // nothing in its body reaches the document, yet the whole line stayed live in
  // the closer haystack and the prose opener above it was left unescaped.
  // Reproduced end-to-end: a LIVE `<iframe>` keeping `src` and `width`,
  // swallowing the prose above it.
  it.each([
    ['plain', 'Secret prose.\n\n<iframe src="https://evil.example/x" width="600">\n\nvisible text\n\n[^f]: note body </iframe>\n'],
    ['textarea', 'Secret prose.\n\n<textarea>\n\nvisible text\n\n[^f]: note body </textarea>\n'],
    ['blockquoted', 'Secret prose.\n\n<textarea>\n\nvisible text\n\n> [^f]: note body </textarea>\n'],
    ['list-marker', 'Secret prose.\n\n<textarea>\n\nvisible text\n\n- [^f]: note body </textarea>\n'],
    ['lazy-continuation', 'Secret prose.\n\n<textarea>\n\nvisible text\n\n[^f]: note body\nstill the note </textarea>\n'],
    ['second-paragraph', 'Secret prose.\n\n<textarea>\n\nvisible text\n\n[^f]: note body\n\n    second para </textarea>\n'],
    ['other-label-referenced', 'Secret prose.\n\n<textarea>\n\nvisible text [^Other]\n\n[^f]: note body </textarea>\n'],
  ])('escapes the opener when the only closer is an UNREFERENCED footnote body: %s', async (name, md) => {
    expect(escapeUnknownHtmlTags(md), name).toContain('&lt;')
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('iframe').length, name).toBe(0)
    expect(container.querySelectorAll('textarea').length, name).toBe(0)
    expect(container.textContent, name).toContain('visible text')
  })

  // …and the decline is KEPT where its justification actually holds: a
  // REFERENCED footnote's body IS block-parsed and reaches the document, so a
  // closer written there is REAL and blanking it would over-escape.
  it('keeps a REFERENCED footnote body live (the round-19 decline, narrowed not dropped)', async () => {
    const md = 'See [^f] here.\n\n[^f]: note <textarea>edit me</textarea>\n'
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('textarea').length).toBe(1)
  })

  // Label matching follows micromark's `normalizeIdentifier`: whitespace runs
  // collapse to one space, the label is trimmed, and case is folded. A
  // reference spelled differently but NORMALIZING to the definition's label
  // still counts as a reference (so the body stays live).
  it.each([
    ['case', 'See [^Foo] here.\n\n[^foo]: note <textarea>edit me</textarea>\n'],
    ['whitespace', 'See [^a  b] here.\n\n[^a b]: note <textarea>edit me</textarea>\n'],
  ])('normalizes footnote labels when matching reference to definition: %s', async (name, md) => {
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('textarea').length, name).toBe(1)
  })

  // Round-23 (SECURITY): the round-22 pass above counted PHANTOM references.
  // Its reference collection ran over the current mask, which at that point in
  // the pipeline has NOT yet had inline link payloads, bracket labels, HTML
  // comments, HTML blocks, tag attributes or autolinks blanked. Every `[^…]`
  // remark consumes into an ATTRIBUTE or drops therefore counted as a live
  // reference, the definition it pointed at was treated as REFERENCED, its
  // `</textarea>` stayed in the closer haystack and the prose opener above it
  // was left LIVE — the very fail-open round 22 existed to close, reopened in
  // ten spellings. Phantom-ness is independently checkable: with remark alone,
  // `visible text ![x [^f] y](/i.png)` + `[^f]: body` emits NO `data-footnotes`
  // section, while a real reference does.
  it.each([
    ['image alt', 'S.\n\n<textarea>\n\nvisible text ![[^f]](/i.png) t\n\n[^f]: b </textarea>\n'],
    ['full-reference label', 'S.\n\n<textarea>\n\nvisible text [txt][[^f]] t\n\n[^f]: b </textarea>\n'],
    ['raw HTML block', 'S.\n\n<textarea>\n\nvisible text\n\n<div>\n[^f]\n</div>\n\n[^f]: b </textarea>\n'],
    ['inline link title', 'S.\n\n<textarea>\n\nvisible text [a](/x "[^f]") t\n\n[^f]: b </textarea>\n'],
    ['image title', "S.\n\n<textarea>\n\nvisible text ![a](/x '[^f]') t\n\n[^f]: b </textarea>\n"],
    ['angle destination', 'S.\n\n<textarea>\n\nvisible text [a](<[^f]>) t\n\n[^f]: b </textarea>\n'],
    ['HTML comment', 'S.\n\n<textarea>\n\nvisible text\n\n<!-- [^f] -->\n\n[^f]: b </textarea>\n'],
    ['inline tag attribute', 'S.\n\n<textarea>\n\nvisible text <span title="[^f]">x</span>\n\n[^f]: b </textarea>\n'],
    ['angle autolink', 'S.\n\n<textarea>\n\nvisible text <https://e.example/[^f]>\n\n[^f]: b </textarea>\n'],
    ['literal autolink', 'S.\n\n<textarea>\n\nvisible text https://e.example/x[^f]y\n\n[^f]: b </textarea>\n'],
  ])('escapes the opener when the only "reference" is a PHANTOM: %s', async (name, md) => {
    expect(escapeUnknownHtmlTags(md), name).toContain('&lt;')
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('textarea').length, name).toBe(0)
    expect(container.textContent, name).toContain('visible text')
  })

  // …and the same escalation, with an ATTRIBUTE-BEARING opener: the phantom used
  // to leave a live third-party iframe keeping `src` and `width`.
  it('escapes an attribute-bearing iframe opener behind a phantom reference', async () => {
    const md =
      'S.\n\n<iframe src="https://evil.example/x" width="600">\n\nvisible text ![[^f]](/i.png)\n\n[^f]: b </iframe>\n'
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('iframe').length).toBe(0)
    expect(container.textContent).toContain('visible text')
  })

  // THE OVER-BLANK DIRECTION, which the narrowing must NOT cross: where remark
  // really does resolve the reference, the definition body is document text and
  // its closer is REAL, so the element must keep rendering. The opener here is
  // `<iframe …>` (a CommonMark type-6 block that ends at the blank line) rather
  // than `<textarea>` (type 1, which would run to `</textarea>` and make the
  // whole middle raw HTML — that shape is confounded, not a control).
  it.each([
    ['plain reference', 'v [^f] t'],
    ['inline link text', 'v [[^f]](/x) t'],
    ['shortcut reference text', 'v [[^f]] t'],
    ['table cell', '| h |\n| - |\n| [^f] |'],
    ['after an autolink', 'v https://e.example/x [^f] t'],
    ['email autolink (the `[` voids it)', 'v <a[^f]b@e.example> t'],
  ])('keeps the element live for a GENUINE reference: %s', async (name, body) => {
    const md = `S.\n\n<iframe src="https://evil.example/x" width="600">\n\n${body}\n\n[^f]: b </iframe>\n`
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('iframe').length, name).toBe(1)
  })

  // THE ONE NAMED RESIDUAL, pinned so it stays visible rather than becoming the
  // next round's surprise: a reference living ONLY inside another, itself
  // UNREFERENCED, definition's body. remark drops both, so this is a phantom
  // too, but seeing it needs a FIXPOINT (blank, rebuild the ref-mask, recount)
  // rather than one pass. Deliberately not built — see the pass docblock.
  it('KNOWN RESIDUAL: a reference inside another dead definition still counts', async () => {
    const md =
      'S.\n\n<iframe src="https://evil.example/x" width="600">\n\nvisible text\n\n[^a]: see [^f]\n\n[^f]: b </iframe>\n'
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelectorAll('iframe').length).toBe(1)
  })

  // Round-22: a payload that RUNS OUT OF INPUT is a SHAPE decline, not a cap
  // exit — the common streaming shape (`see [a](/x` as the last token). It used
  // to return `limit`, which the caller widened to `paragraphEnd`, blanking the
  // paragraph tail and escaping an earlier opener mid-stream that unescaped
  // again on completion (a visible flicker).
  it('does not blank the paragraph tail for a link payload cut off at end of input', () => {
    expect(__buildCloserHaystackForTest('see [a](/x')).toBe('see [a](/x')
    expect(__buildCloserHaystackForTest('see [a](/x "t')).toBe('see [a](/x "t')
  })

  // …while the CAP path must still BLANK THROUGH (the round-20 fix).
  it('still blanks through the cap for an over-long payload', () => {
    const md = `[a](/x "<${'y'.repeat(1100)}></textarea>")\n\ntail\n`
    expect(__buildCloserHaystackForTest(md)).not.toContain('</textarea>')
  })
})

// ---------------------------------------------------------------------------
// Streaming pre-pass ordering (round-5)
// ---------------------------------------------------------------------------
describe('streaming completes the tail BEFORE escaping', () => {
  it('a `</textarea>` inside a still-open fence does not unescape the prose opener', async () => {
    // The canonical shape: an LLM explains `<textarea>`, then streams a fenced
    // HTML sample. Mid-emission the fence is unclosed, so escaping first left
    // the prose opener live and parse5 swallowed the rest of the message.
    const md = 'Explaining <textarea> in HTML.\n\n## Heading\n\n```html\n</textarea>\n'
    const container = await renderStable(<SimpleMarkdownRenderer content={md} streaming />)
    expect(container.querySelectorAll('textarea').length).toBe(0)
    expect(container.querySelector('h2')?.textContent).toBe('Heading')
    expect(container.textContent).toContain('Explaining <textarea> in HTML.')
  })

  it('does NOT escape an unknown tag inside a mid-emission fence', async () => {
    // The carve's "unclosed fence body is unprotected" tradeoff used to fire on
    // EVERY streaming frame: a `<their>` mid-fence rendered as literal
    // `&lt;their&gt;` until the closer arrived, then snapped back.
    const md = 'intro\n\n```html\n<their>x</their>\n'
    const container = await renderStable(<SimpleMarkdownRenderer content={md} streaming />)
    expect(container.textContent).toContain('<their>x</their>')
    expect(container.textContent).not.toContain('&lt;their&gt;')
  })

  it('token-by-token growth through an open fence never swallows the document', async () => {
    const full = 'Explaining <textarea> in HTML.\n\n## Heading\n\n```html\n<textarea>v</textarea>\n```\n'
    // Start once `## Heading\n` has fully arrived (earlier cuts legitimately
    // show a partial title) and walk the rest of the fence in small steps.
    const from = full.indexOf('## Heading') + '## Heading\n'.length
    for (let cut = from; cut <= full.length; cut += 3) {
      const container = await renderStable(
        <SimpleMarkdownRenderer content={full.slice(0, cut)} streaming />,
      )
      expect(container.querySelector('h2')?.textContent, `cut=${cut}`).toBe('Heading')
      // The h2 assertion alone is NOT enough: a swallow that starts after the
      // heading leaves the <h2> intact while the rest of the message becomes a
      // live textarea value. Pin the absence of the swallow itself.
      const textareas = Array.from(container.querySelectorAll('textarea'))
      expect(textareas.length, `cut=${cut}`).toBe(0)
    }
  })
})

// ---------------------------------------------------------------------------
// RichMarkdownRenderer parity
// ---------------------------------------------------------------------------
describe('RichMarkdownRenderer golden parity', () => {
  for (const [name, md] of Object.entries({ ...SHARED_FIXTURES, ...RICH_ONLY_FIXTURES })) {
    it(`renders fixture: ${name}`, async () => {
      const container = await renderStable(<RichMarkdownRenderer content={md} />)
      expect(normalize(container.innerHTML)).toMatchSnapshot()
    })
  }

  it('renders headings with backend sectionIds + demoteMarkdownH1ToH2', async () => {
    const container = await renderStable(
      <RichMarkdownRenderer
        content={SHARED_FIXTURES['headings-with-emoji-and-dupes']}
        sectionIds={SECTION_IDS}
        demoteMarkdownH1ToH2
      />,
    )
    expect(normalize(container.innerHTML)).toMatchSnapshot()
  })
})

// ---------------------------------------------------------------------------
// Heading-id ↔ section-extractor agreement (three slug copies today —
// this pins the CURRENT agreement so the Phase-1 shared helper can prove
// it changed nothing)
// ---------------------------------------------------------------------------
describe('heading-id and section-extractor slug agreement', () => {
  // Includes a THIRD duplicate (`setup-3` — the suffix counter must keep
  // counting, not reset per pair) and a SYMBOL-ONLY heading (`## !!!`, whose
  // slug collapses to '' and hits the `section-N` fallback, where the two
  // implementations previously used different counters).
  const AGREEMENT_MD =
    `# 🚀 Getting Started\n\n## Setup\n\n## Setup\n\n## Setup\n\n## !!!\n\n## Weird — punct!, chars?\n`

  it('renderer-generated heading ids equal extractSections ids for the same markdown', async () => {
    const sections = extractSections(AGREEMENT_MD, { maxLevel: 2 })
    const container = await renderStable(<SimpleMarkdownRenderer content={AGREEMENT_MD} />)
    const renderedIds = Array.from(container.querySelectorAll('h1, h2')).map((el) => el.id)
    expect(renderedIds).toEqual(sections.map((s) => s.id))
    expect(sections).toMatchSnapshot('extracted-sections')
  })

  // --- round-15 REGRESSION vs `main`: CRLF documents ------------------------
  // `main`'s extractor pattern was `^(#{1,N})\\s+(.+)` — no end anchor at all,
  // so the trailing `\\r` of a CRLF line landed in the title and was trimmed off
  // afterwards. The unified `ATX_HEADING_RE` ends `[ \\t]*$`, which `\\r` does not
  // satisfy, so a CRLF document produced ZERO sections and ZERO heading anchors
  // where `main` produced them: every CRLF-stored doc / blog / release body
  // silently lost its TOC, its in-page anchors and its doc-SEO heading links.
  // (Direct A/B over this fixture: `main` → ["Real","Second"], branch → [].)
  const CRLF_HEADINGS_MD =
    '# Real\r\n\r\nbody\r\n\r\n## Second\r\n\r\n```\r\n# In fence\r\n```\r\n'

  it('CRLF documents scan the same headings as their LF twin', () => {
    const lf = CRLF_HEADINGS_MD.replace(/\r/g, '')
    expect(scanHeadings(CRLF_HEADINGS_MD)).toEqual(scanHeadings(lf))
    expect(extractSections(CRLF_HEADINGS_MD, { maxLevel: 2 }).map((sec) => sec.title)).toEqual([
      'Real',
      'Second',
    ])
    // …and the `# In fence` line is still fence content in BOTH spellings —
    // the fence tracker used to match no CRLF line at all.
    expect(extractSections(CRLF_HEADINGS_MD, { maxLevel: 2 })).toEqual(
      extractSections(lf, { maxLevel: 2 }),
    )
  })

  it('CRLF renderer heading ids equal extractSections ids', async () => {
    const sections = extractSections(CRLF_HEADINGS_MD, { maxLevel: 2 })
    const container = await renderStable(<SimpleMarkdownRenderer content={CRLF_HEADINGS_MD} />)
    const renderedIds = Array.from(container.querySelectorAll('h1, h2')).map((el) => el.id)
    expect(renderedIds).toEqual(sections.map((sec) => sec.id))
    expect(renderedIds).toEqual(['real', 'second'])
  })

  it('heading ids are STABLE across re-renders of the same content', async () => {
    const idsOf = (c: HTMLElement) =>
      Array.from(c.querySelectorAll('h1, h2')).map((el) => el.id)

    // Two independent mounts must agree…
    const first = await renderStable(<SimpleMarkdownRenderer content={AGREEMENT_MD} />)
    const firstIds = idsOf(first)
    const second = await renderStable(<SimpleMarkdownRenderer content={AGREEMENT_MD} />)
    expect(idsOf(second)).toEqual(firstIds)

    // …and so must repeated render passes of the SAME instance. Before the
    // per-pass counter reset this produced `setup-4`, `setup-5`, … on every
    // re-render, silently breaking every `#anchor` deep link.
    let container!: HTMLElement
    let rerender!: (ui: React.ReactElement) => void
    await act(async () => {
      const result = render(<SimpleMarkdownRenderer content={AGREEMENT_MD} />)
      container = result.container
      rerender = result.rerender
      await new Promise((r) => setTimeout(r, 0))
    })
    expect(idsOf(container)).toEqual(firstIds)

    for (let pass = 0; pass < 3; pass++) {
      await act(async () => {
        // A fresh `brokenLinks` array each time is exactly what a parent
        // re-render looks like — it must not renumber anything.
        rerender(<SimpleMarkdownRenderer content={AGREEMENT_MD} brokenLinks={[]} />)
        await new Promise((r) => setTimeout(r, 0))
      })
      expect(idsOf(container), `pass ${pass}`).toEqual(firstIds)
    }
  })

  // --- round-2: the ids must be PURE ---------------------------------------
  it('ids are identical under a StrictMode double render', async () => {
    // Heading renderers are element types, re-rendered INDEPENDENTLY of the
    // parent that used to `reset()` the counter — so StrictMode's second
    // invocation suffixed every id with `-2` in dev and broke
    // extractor↔renderer parity. The pure line-keyed map is immune.
    const plain = await renderStable(<SimpleMarkdownRenderer content={AGREEMENT_MD} />)
    const plainIds = Array.from(plain.querySelectorAll('h1, h2')).map((el) => el.id)

    const strict = await renderStable(
      <React.StrictMode>
        <SimpleMarkdownRenderer content={AGREEMENT_MD} />
      </React.StrictMode>,
    )
    const strictIds = Array.from(strict.querySelectorAll('h1, h2')).map((el) => el.id)
    expect(strictIds).toEqual(plainIds)
  })

  it('emits NO duplicate ids mid-stream, where completed blocks are memoized', async () => {
    // A memoized completed block does NOT re-render on the pass that used to
    // reset the counter, so block 0 kept `id="setup"` while the re-rendered
    // tail re-derived `setup` from an empty counter — two live `id="setup"`
    // in the DOM, and `#setup` resolving to the wrong node for the whole
    // stream.
    const STREAM_MD = '## Setup\n\nfirst body\n\n## Setup\n\nsecond body\n\ntail text'

    let container!: HTMLElement
    let rerender!: (ui: React.ReactElement) => void
    await act(async () => {
      const result = render(<SimpleMarkdownRenderer content={STREAM_MD} streaming />)
      container = result.container
      rerender = result.rerender
      await new Promise((r) => setTimeout(r, 0))
    })

    const idsOf = () => Array.from(container.querySelectorAll('h1, h2, h3')).map((el) => el.id)
    expect(idsOf()).toEqual(['setup', 'setup-2'])

    // Grow the tail token-by-token; the completed blocks stay memoized.
    for (const suffix of [' and', ' and more', ' and more words']) {
      await act(async () => {
        rerender(<SimpleMarkdownRenderer content={`${STREAM_MD}${suffix}`} streaming />)
        await new Promise((r) => setTimeout(r, 0))
      })
      const ids = idsOf()
      expect(ids, `after "${suffix}"`).toEqual(['setup', 'setup-2'])
      expect(new Set(ids).size, 'no duplicate DOM ids').toBe(ids.length)
    }

    // …and the settled whole-document parse agrees with the extractor.
    const done = await renderStable(<SimpleMarkdownRenderer content={STREAM_MD} />)
    expect(Array.from(done.querySelectorAll('h1, h2')).map((el) => el.id)).toEqual(
      extractSections(STREAM_MD, { maxLevel: 2 }).map((s) => s.id),
    )
  })

  // --- round-3: producer/consumer scanner parity -------------------------
  it('agrees with the extractor across fence, container and setext shapes', async () => {
    // Every line here was a DRIFT between the two implementations:
    //  - a `~~~` fence: the extractor toggled only on '```', so `## Fenced`
    //    became a phantom section with no matching renderer id;
    //  - an indented / longer-run fence: same class;
    //  - `> ## Quoted` and `- ## Listed`: real <h2>s in mdast that the
    //    renderer's column-0..3 scan missed entirely, so BOTH of two
    //    identical ones fell to the suffix-free fallback and emitted
    //    DUPLICATE DOM ids;
    //  - `Setext Title\n---`: a real <h2> the renderer never scanned AND
    //    which flipped the extractor into a phantom "YAML block" that
    //    swallowed every heading after it.
    const DRIFT_MD = [
      '# Top',
      '',
      '~~~text',
      '## Fenced Not A Heading',
      '~~~',
      '',
      '   ```',
      '## Also Fenced',
      '   ```',
      '',
      'Setext Title',
      '---',
      '',
      '> ## Quoted',
      '',
      '- ## Listed',
      '',
      '> ## Quoted',
      '',
      '## Tail',
      '',
    ].join('\n')

    const sections = extractSections(DRIFT_MD, { maxLevel: 2 })
    const container = await renderStable(<SimpleMarkdownRenderer content={DRIFT_MD} />)
    const renderedIds = Array.from(container.querySelectorAll('h1, h2')).map((el) => el.id)

    expect(renderedIds).toEqual(sections.map((s) => s.id))
    expect(new Set(renderedIds).size, 'no duplicate DOM ids').toBe(renderedIds.length)
    expect(renderedIds, 'fenced headings contribute NO id').not.toContain('fenced-not-a-heading')
    expect(sections).toMatchSnapshot('drift-sections')
  })

  // --- round-4: the setext scan must match mdast EXACTLY ------------------
  // The scanner is a line-based approximation of what remark will parse. Where
  // it diverges, the renderer's line-keyed id lookup misses (dead deep link)
  // or the extractor publishes a phantom TOC entry. These pin the three
  // divergences against remark itself rather than against a hand-written
  // expectation.
  describe('setext scanning matches mdast', () => {
    const mdastHeadings = (md: string) => {
      const tree = unified().use(remarkParse).parse(md) as any
      const out: Array<{ line: number; level: number }> = []
      const walk = (n: any) => {
        if (n.type === 'heading') out.push({ line: n.position.start.line, level: n.depth })
        for (const child of n.children ?? []) walk(child)
      }
      walk(tree)
      return out
    }
    const scanned = (md: string) =>
      scanHeadings(md).map((h) => ({ line: h.line, level: h.level }))

    it('multi-line setext is ONE heading at the run\'s FIRST line', () => {
      const md = 'Foo\nbar\n===\n'
      // mdast: {line:1, depth:1, text:"Foo\nbar"}. The scanner used to record
      // only the LAST paragraph line ({line:2, text:"bar"}), so the renderer's
      // lookup missed and fell back to a slug of the rendered children
      // (`foo-bar`) while the extractor published `bar`.
      expect(scanned(md)).toEqual(mdastHeadings(md))
      expect(scanHeadings(md)[0].text).toBe('Foo\nbar')
      expect(extractSections(md).map((s) => s.id)).toEqual(['foo-bar'])
    })

    it('container-nested setext IS a heading', () => {
      const md = '> Quote title\n> ---\n'
      // A real h2 in mdast; the container-prefix guard used to kill the
      // candidate, so it was invisible to the TOC.
      expect(scanned(md)).toEqual(mdastHeadings(md))
      expect(extractSections(md).map((s) => s.id)).toEqual(['quote-title'])
    })

    it('a `---` inside a raw HTML block is NOT a setext underline', () => {
      const md = '<div>\nText\n---\n</div>\n'
      // mdast emits nothing (the whole thing is one HTML block); the scanner
      // used to publish a phantom `Text` h2.
      expect(mdastHeadings(md)).toEqual([])
      expect(scanned(md)).toEqual([])
      expect(extractSections(md)).toEqual([])
    })

    it('an underline with a DIFFERENT container prefix is a thematic break', () => {
      const md = '> Quote\n\n---\n'
      expect(scanned(md)).toEqual(mdastHeadings(md))
      expect(scanned(md)).toEqual([])
    })

    it('renderer ids agree with the extractor for multi-line setext', async () => {
      const md = 'Foo\nbar\n===\n\nbody\n'
      const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
      expect(Array.from(container.querySelectorAll('h1, h2')).map((el) => el.id)).toEqual(
        extractSections(md, { maxLevel: 2 }).map((s) => s.id),
      )
    })
  })

  it('honors an AUTHORED anchor on a raw-HTML heading', async () => {
    // The sanitize schema allows `id` and disables clobbering precisely so
    // hand-picked anchors survive; the renderer then overwrote them with the
    // slug of the heading text, silently breaking every deep link to them.
    const md = '<h2 id="pricing-faq">Pricing</h2>\n\nbody'
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(container.querySelector('h2')?.id).toBe('pricing-faq')
  })

  it('strips inline markdown from heading text before slugifying (extractor parity)', async () => {
    const md = '## **Bold** Setup\n\n## `code` Heading\n'
    const container = await renderStable(<SimpleMarkdownRenderer content={md} />)
    expect(Array.from(container.querySelectorAll('h2')).map((el) => el.id)).toEqual(
      extractSections(md, { maxLevel: 2 }).map((s) => s.id),
    )
  })
})