fix(629): strip raw HTML blocks, and state where the hardening stops

Round 5: raw HTML is the third code-block form. `<pre>`, `<code>` and HTML comments all render their
contents literally, so a verdict inside one is an example, not an approval:

  <pre> / <code> / <!-- ... -->  containing a verdict  ->  positive

Now stripped, tracked as a marker count rather than parsed — the direction of error is to strip MORE,
which can only ever withhold approval. Mutation-verified: removing the stripper fails all five cases.

AND THE HARDENING STOPS HERE, deliberately. The record now says so, because otherwise the next
session re-derives it: this is a best-effort heuristic, not a markdown parser. It covers the three
code-block forms markdown has (fenced; indented, via the column-0 rule; raw HTML) and is not proof
against every way to render text as non-prose.

Stopping is safe because the comment is NOT the load-bearing gate. Since #622 the authoritative
signal is the `review-verdict/h10` commit status, written only by post-review-verdict.sh from
explicit arguments — a comment cannot forge it. This classifier is condition (c) of the PreToolUse
hook: defense in depth on an agent's merge call. A residual false-open means the hook does not
object; it does not mean a merge happens.

Five rounds found five code-block forms, four of them introduced while fixing the previous round.
The generalisable rule, now in the record: when a heuristic keeps failing at the edges, check whether
it is actually the thing enforcing the invariant before spending another round on it.

Also measured, against the real corpus: a "verdict must be the first line" rule would have killed
every code-block form at once, but 14 of 18 verdict markers ever posted in this repo are NOT on the
first line — so it was rejected as a retroactive break, not deferred.

178 tests. refs #629

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Decisions-Edit: yes

docs/decisions/records/release/review-verdict-gate.md

@@ -77,6 +77,25 @@ a bounded left side but not the right; state reset per comment but via a delimit
 controls). For attacker-writable text, budget several rounds and prefer eliminating a class over
 enumerating its members.
 
+A fifth round found raw HTML — `<pre>`, `<code>`, HTML comments — the third code-block form. It is
+stripped too, and **hardening stopped there, deliberately.**
+
+**Scope limit, stated so nobody re-derives it: the comment scanner is a best-effort heuristic, not a
+markdown parser.** It handles the three code-block forms markdown actually has (fenced, indented via
+the column-0 rule, raw HTML) and errs toward stripping more, because every error in that direction can
+only *withhold* approval. It is not proof against every conceivable way to render text as non-prose,
+and chasing that was demonstrably not converging: five review rounds, five code-block forms, four of
+them introduced while fixing the previous one.
+
+Stopping is safe because **the comment is not the load-bearing gate.** Since #622 the authoritative
+signal is the `review-verdict/h10` commit status, written only by `scripts/post-review-verdict.sh`
+from explicit arguments — **a comment cannot forge it**, whatever it contains. The comment classifier
+is condition (c) of the PreToolUse hook, i.e. defense in depth on an agent's merge call. A residual
+false-open there means the hook does not object; it does not mean a merge happens.
+
+The rule that generalises: *when a heuristic keeps failing at the edges, check whether it is actually
+the thing enforcing the invariant before spending another round on it.*
+
 The lesson is about where a grammar lives, not about any one regex: this record described the intended
 behaviour accurately, the code did something looser, and nothing compared them. The grammar now lives
 in `scripts/check-review-verdict.sh` — one implementation, called by the hook and by

scripts/check-review-verdict.sh

@@ -118,6 +118,20 @@ verdicts=$(printf '%s\n' "$encoded" | while IFS= read -r encoded_body; do
   # A shorter or different marker while a fence is open is content, so it neither closes nor prints.
   outside=$(printf '%s\n' "$body" | awk '
     {
+      # Raw HTML blocks are the third code-block form (#629 round 5): <pre>, <code> and HTML
+      # comments all render their contents literally, so a verdict inside one is an example, not an
+      # approval. Tracked as a simple depth/marker count rather than parsed — the direction of error
+      # is to strip MORE, which can only ever withhold approval.
+      low = tolower($0)
+      if (low ~ /<!--/) { html = 1 }
+      if (low ~ /<(pre|code)[ >]/ || low ~ /<(pre|code)>/) { html = 1 }
+      if (html) {
+        closed = 0
+        if (low ~ /-->/)                 { closed = 1 }
+        if (low ~ /<\/(pre|code)>/)      { closed = 1 }
+        if (closed) { html = 0 }
+        next
+      }
       if (match($0, /^[[:space:]]*(`{3,}|~{3,})/)) {
         m = substr($0, RSTART, RLENGTH); gsub(/[[:space:]]/, "", m)
         ch = substr(m, 1, 1); len = length(m)

scripts/tests/test_check_review_verdict.py

@@ -180,6 +180,33 @@ def test_a_fenced_example_alongside_a_real_blocked_verdict_still_blocks():
     assert classify([fenced, verdict("BLOCKED", HEAD)]) == ("negative", 0)
 
 
+# --- found by a fifth review round: raw HTML is the third code-block form ------------------------
+
+
+@pytest.mark.parametrize(
+    "wrapper",
+    [
+        "<pre>\n{v}\n</pre>",
+        "<code>\n{v}\n</code>",
+        "<!--\n{v}\n-->",
+        '<pre lang="text">\n{v}\n</pre>',
+        "<PRE>\n{v}\n</PRE>",
+    ],
+)
+def test_falseopen_raw_html_blocks_are_not_verdicts(wrapper):
+    """`<pre>`, `<code>` and HTML comments render their contents literally.
+
+    A verdict inside one is an example, not an approval. Markdown's three code-block forms — fenced,
+    indented, and raw HTML — each had to be handled; indentation was closed by the column-0 rule.
+    """
+    assert classify([wrapper.format(v=verdict("MERGEABLE", HEAD))]) == ("absent", 0)
+
+
+def test_an_html_example_does_not_eat_a_real_verdict_in_another_comment():
+    html = f"<pre>\n{verdict('MERGEABLE', HEAD)}\n</pre>"
+    assert classify([html, verdict("BLOCKED", HEAD)]) == ("negative", 0)
+
+
 # --- the happy paths -------------------------------------------------------------------------