EscapeMarkdown treated block-level meaning as "the line's first
character is in blockStart", which missed two constructs. An ordered
list opens with a digit run followed by ".", and the digit cleared the
leading flag before the "." was reached. A bullet list and a thematic
break open with "*" or "_", which were left unescaped as emphasis.

A display name of "Eve\n\n1. malicious" therefore rendered <ol> into a
notification body, and "***", "___", "* * *" or "_ _ _" rendered <hr>.
Those are the same structural tags the package already asserts against.

Escape "*" and "_" in leading position, and escape the "." that closes
an ordered-list marker when a leading digit run precedes it and a space
or the line end follows it. That following-space condition is
CommonMark's rule for a list marker, and it keeps "1.5" and "10.0.0.1"
out of the escaped set: body templates compare numeric label values
with `eq`. Both renderers honor these escapes, so the rendered text and
the notification golden files are unchanged.

NeutralisesStructure now renders every value twice, once with its line
breaks doubled. The existing OrderedList row passed only because a list
cannot interrupt a paragraph without a blank line, so it exercised a
shape that could never fire.

NeutralisesStructure rows are regression guards only if their value
produces document structure without escaping. "Eve\n1. one" did not: a
list cannot interrupt a paragraph without a blank line, so the digit-dot
never reached a line-start position and the row passed whether or not
EscapeMarkdown ran.

Render each value a second time with escaping removed and require a
structural tag, so a row that guards nothing fails at authoring time.
Five values are inert by construction and carry inertRaw with the
reason: two rely on the renderer having autolinking disabled, one on the
safelink policy, one on a link reference definition not being recognized
mid-paragraph, and one on its own backslashes.

Reverting the doubled-line-break shape now fails six list rows instead
of passing silently.

The rendered-template goldens embed the body of every stored notification
template, and one of those bodies carries an emdash predating this check
(migration 000324, "workspace startup...even when claiming a prebuilt
environment"). The text lives in an applied migration, so it cannot be
edited in place, and any change that regenerates the goldens fails the
check on a character it did not introduce.

Same rationale as the existing cli/testdata exclusions: generated files
whose content comes from somewhere the author does not control.

Five gaps found by re-probing the escaper against the real render pipeline.

Backtick moves to inlineCritical. A fenced block's info string is an HTML
sink: gomarkdown writes it into class="language-..." unescaped, and
html.SkipHTML does not apply because the node is a CodeBlock rather than an
HTMLBlock. A display name that closes the attribute and the tag put a live
anchor in mail to every user admin, reachable by any member via
PUT /users/me/profile.

Colon joins foldStart. It opens a definition list, and also a GFM table
delimiter row such as ":-- | --:" that escaping "|" cannot reach, because a
delimiter row's pipes are mid-line. Folded rather than escaped because
glamour does not honor "\:" and would leak a backslash into the plaintext
part.

Leading indentation is capped at three spaces. Four open an indented code
block and a space has no escape, so the run is truncated instead.

escapeValue now escapes nested map keys. It walked a decoded JSON value and
escaped its string leaves, copying keys verbatim, but a key is content
whenever a template ranges over the map with two variables:

  {{range $resource, $paths := .Data.replacements}}

Those keys are Terraform resource addresses from provisioner output, so an
unescaped one rendered a live anchor to every template admin.

renderHTML guards Safelink. parser.IsSafeURL slices a destination to each
candidate prefix length before checking the destination is that long, so
"[docs]()" panicked. That reached HTMLFromMarkdown as well, making it live
outside notifications via OIDCConfig.SignupsDisabledText. A length-safe
override plus a recover, mirroring InnerTextFromMarkdown.

encodeHeaderValue handles two cases mime.WordEncoder cannot. It only encodes
a value holding a byte outside printable ASCII, and an RFC 2047 encoded-word
is nothing but printable ASCII, so a forged one reached the recipient's mail
client and was decoded there. It also joins words with a space rather than
folding, leaving long headers past RFC 5322's 998-octet limit.

notificationExtensions becomes an allowlist of the grammar templates use
rather than CommonExtensions minus Autolink. That drops Tables,
DefinitionLists and MathJax, each reachable from an untrusted value and used
by no shipped template, with no change to any template's rendering.

Three residuals stay open and are pinned by tests that fail if they close:
escapes are inert inside a template-supplied code span, a value's own first
line cannot be folded, and a title beginning "~~~" still renders an empty
subject. All three depend on where the value lands rather than what it
contains, which is what a pre-render escaper cannot see. They close under
placeholder substitution, not under another character class.

One golden moves, contradicting the current PR description: the resource
replacements body_markdown now reads docker_container\[0\].

…r.prepare

The comment claimed the dispatcher "escapes at its own sinks". It does not.
smtp/html.gotmpl renders through text/template, and its _subject, UserName,
_body and action URL interpolations have no escaping, while logo_url and
app_name do. _subject has also been through PlaintextFromMarkdown by then,
which strips the escaping applied here back out.

State the real reason the dispatcher gets the unescaped payload, which is
that the webhook contract surfaces enqueued values verbatim, and name the
sinks that are still bare so nobody reads this as a guarantee.

The fold that handles "=" and "~" can only remove a line break EscapeMarkdown
itself emitted, so it never reaches the value's first line, where the template
decides the position. Two consequences:

A title template beginning with a label puts the value at the start of the
document. A display name of "~~~" made the whole title an unterminated tilde
fence whose info string was the trusted text, and glamour renders an empty
code block, so the Subject, <title> and heading all came out blank. Reachable
by any member via PUT /users/me/profile.

A body template placing a value at a line start beneath a text line let "==="
underline the trusted line into an <h1>. No shipped template does this, but
nothing recorded the dependency either.

Escape the character instead of folding it. Neither renderer honors "\=" or
"\~", so the backslash reaches the reader, which is why isLeadingFoldConstruct
is exact where opensFoldConstruct is approximate: folding a line that was not
going to open anything is free, escaping one is not. "=> next" and a display
name of "~tilde" keep rendering clean; "~~~" does not. A visible "\~~~" beats a
Subject line that renders empty.

":" stays out of it. It is in foldStart for the definition list and table
cases, both of which need a preceding line that a first line does not have.

Around a hundred comment lines across the escaper, the renderer and the SMTP
header work restated what the code already says or re-explained CommonMark.
Cut those, along with the placeholder-substitution asides that belong in the
design doc rather than repeated across five function comments.

Kept what a reader cannot derive from the code: that gomarkdown writes a
fence info string into class="language-..." unescaped and SkipHTML does not
apply to a CodeBlock node; that glamour honors neither "\:" nor "\=" nor "\~",
which is why those fold instead of escaping; that parser.IsSafeURL slices
before bounds-checking; that mime.WordEncoder passes printable ASCII through
untouched; and why opensFoldConstruct may be approximate where
isLeadingFoldConstruct has to be exact.

Test comments keep their notes on how a case could go vacuous, since that is
what stops someone deleting a row that looks redundant.

Enabling Safelink also stopped fragment and bare relative destinations from
linking, so [a](#x) and [a](docs/x.md) now render without an anchor while
/path, ./path, mailto: and http(s):// keep working. No shipped template is
affected, but a future template author gets silent link loss with no error.

Pinned by two rows in TestEscapeMarkdownEmptyLinkDestination so the comment
cannot drift away from the behavior.

The subject is produced by PlaintextFromMarkdown, which strips Markdown
and decodes HTML entities, and html.gotmpl then interpolated it raw into
<title> and <h1>. An entity-encoded payload in a label therefore arrived
as live markup: a template_display_name of
"&lt;a href=...&gt;Re-authenticate now&lt;/a&gt;" rendered an anchor in
the email. UserName reached the same template raw from the unescaped
payload the dispatcher is handed.

Markdown escaping cannot close this. "&" is not backslash-escapable in
either renderer, and the subject never enters gomarkdown, so SkipHTML
and Safelink do not see it. The fix belongs at the template sink.

Add "| html" to .Labels._subject at both sites, .UserName, $action.URL
and $action.Label. .Labels._body stays raw: it is gomarkdown output.

The 36 golden files change by entity encoding only. Verified by
quoted-printable decoding both sides and confirming they are identical
once entities are decoded, which also covers the one action URL whose
"&" became "&amp;".

…scape

The comment on notifier.prepare listed _subject, UserName, _body and the
action URL as bare, which was true before this change and is not after it.
Four of those five now escape with `| html`; only _body is still interpolated
raw, which is correct, since it is already-rendered HTML.

Test names and require messages carry this already. Dropped the godoc
block, the struct field comments and the case comment, and kept only the
two facts a reader cannot recover from the code: that appearanceHelpers
is benign by design, and that PlaintextFromMarkdown is what turns the
encoded title into live markup.

The test was named for the values the fix escapes but exercised only
_subject and UserName. Actions was left nil, so the range block never
iterated and neither action value reached the template. Dropping
| html from $action.Label changed no golden file and failed no test;
dropping it from $action.URL moved one character in one golden, which
a regenerate loop absorbs.

Adds a case per action value and renames the test to match what it
covers. Each of the four | html pipes now fails a named subtest when
removed.

Also folds the duplicated helper map into templateHelpers, renamed
from appearanceHelpers: it returns all four helpers, and only logo_url
and app_name are appearance settings. Not named helpers(), which
already exists in dispatch_test with different values.

base_url reached three href attributes and one visible-text position
raw, while logo_url and app_name beside them were already escaped.
net/url preserves a quote in a query and --access-url is validated for
its scheme only, so an operator can land a quote inside href="...",
where it closes the attribute and the rest becomes live markup. A raw
& in an attribute is also invalid HTML for any multi-parameter URL.

current_year and .NotificationTemplateID are escaped in the same pass.
Neither can carry markup in production, but leaving them raw meant the
rule for this file was "escaped, except two", which is the ambiguity
that let base_url sit unescaped through the previous round.

Escaping these costs no golden churn, so nothing already in the tree
fails if it is removed again. TestSMTPHTMLTemplateEscapesTrustedValues
injects a quote into each of the three. Every value the template
interpolates now fails a named test when its escaping is dropped, with
_body the one deliberate exception: it is trusted rendered Markdown.