diff --git a/.github/workflows/qwen-triage.yml b/.github/workflows/qwen-triage.yml
index 6804f51f10c..4d18da33feb 100644
--- a/.github/workflows/qwen-triage.yml
+++ b/.github/workflows/qwen-triage.yml
@@ -3325,6 +3325,240 @@ jobs:
             printf '%s%s\n' "$esc" "$truncated"
             printf '</code></pre>\n\n</details>\n\n'
           }
+          # Render report.md as MARKDOWN instead of an escaped <pre> dump.
+          # The report is a curated bilingual document (tables, nested
+          # <details>, headings); the pre/code embedding displayed it as a
+          # wall of raw source (#8140's comment was the exhibit). The section
+          # is wrapped in a collapsed <details> so it still costs one line in
+          # the conversation but renders as real markdown when opened.
+          #
+          # A node sanitizer (not sed) does the escaping so it can tell code
+          # regions apart from prose. CommonMark does NOT decode entities in
+          # code spans or fenced blocks — they render literally there — so
+          # escaping & < > @ unconditionally showed the reader &amp;&amp;,
+          # &lt;T&gt;, &#64;pkg inside the very commands, generic types, and
+          # scoped-package paths a verification report is read to copy (the
+          # #8140 symptom, relocated into code). The security floor now rests
+          # on four line-independent guarantees:
+          #   1. in PROSE every < is escaped, then only the structural tags
+          #      the report uses as raw HTML (details/summary) are un-escaped
+          #      back to live tags — no other tag can form in ordinary
+          #      prose, so <img>/<script>/onerror never render there. A
+          #      line-level inHtml flag tracks raw-HTML blocks opened by
+          #      details/summary (at any indent, so list-nested folds
+          #      enter the state too): inside one, neither fence lines
+          #      NOR code spans are code — CommonMark/GitHub reads both
+          #      as literal text in a raw-HTML block — so the sanitizer
+          #      prose-escapes the whole line instead of splitting it
+          #      through proseLine, closing the divergence where GitHub
+          #      saw live HTML the sanitizer treated as inert code.
+          #      & and > are left alone in prose (a decoded entity
+          #      yields text, never markup, and an unescaped > cannot
+          #      open a tag once < is escaped), which keeps &&, ->, and
+          #      blockquotes readable. Code-span parity is a paragraph
+          #      property in CommonMark but a line property here, so a prose
+          #      line carrying an unmatched backtick run makes the rest of the
+          #      paragraph's code/prose split unknowable; the scanner fails
+          #      closed and prose-escapes every line until the next blank line
+          #      (over-escaping is the safe direction — a multi-line code span
+          #      shows its entities literally, inert not live). Outside HTML
+          #      blocks, inside code spans/fences < & @ are left alone: <img>
+          #      and @mentions are inert under a code/pre ancestor, and
+          #      escaping them there only mangles the rendered text;
+          #   2. the comment-open token is broken EVERYWHERE, prose and code
+          #      alike (<!-- becomes an escaped no-op, the autofix-proven
+          #      neutralizer). The break must stay global: the upsert greps
+          #      the RAW body for the running marker and a fence prints
+          #      verbatim, so a forged marker inside a fence must not survive;
+          #   3. in prose @ gains a zero-width space (@&#8203;) — renders
+          #      identically, never fires a mention (GitHub decodes &#64;
+          #      back to @ before the mention filter runs, so the entity
+          #      alone was inert; the ZWSP breaks the mention token). A
+          #      mention cannot fire under a code/pre ancestor, so code
+          #      keeps a literal @;
+          #   4. <details> folds are balanced over PROSE only — a </details>
+          #      quoted in a code span/fence is inert text and is no longer
+          #      counted — surplus closers are dropped (they would otherwise
+          #      close the wrapping fold early) and unclosed opens are closed
+          #      at the end, so a malformed report can neither swallow the
+          #      footer nor escape its wrapper. The flat scanner diverges
+          #      from GitHub's container-aware parser whenever a fence it
+          #      holds open cannot exist in GitHub's view, so two signals
+          #      exit non-zero (emit_report then degrades to the escaped
+          #      fallback rather than guessing): a fence still open at EOF
+          #      (GitHub closes a list-nested fence at the container's end,
+          #      not at EOF), and a non-blank line that dedents below the
+          #      fence opener's indent while it is open — the container
+          #      boundary moved, so GitHub already closed the fence and a
+          #      balancing closer later in the file would otherwise let the
+          #      scanner pass unescaped prose through escCode.
+          # Accepted tradeoff (named, not accidental): rendering promotes the
+          # report from inert text to parsed markdown, so [links](…) and
+          # ![images](…) now render live where emit_block showed them literal.
+          # report.md is agent output from a sandbox that ran PR code; images
+          # are camo-proxied (mostly noise) and a phishing link under the bot
+          # identity is the residual surface. That surface exists only while
+          # the four guarantees hold, so the fail-closed bails above are what
+          # keep deferring link defusing defensible; defusing link targets is
+          # a deliberate follow-up, not done here. Two safe-but-ugly display
+          # costs are named, not bugs: a code span that opens on one line and
+          # closes on the next is prose-escaped (the reader sees &lt;T&gt;
+          # inside it — the #8140 symptom relocated but inert), and escCode
+          # breaks <!-- to &lt;!\-\- which renders LITERALLY in a fence
+          # (entities do not decode there), so a fenced comment example shows
+          # as &lt;!\-\-.
+          # An OVERSIZED report falls back to emit_block wholesale (cut
+          # markdown dangles fences/folds), as does any sanitizer failure.
+          emit_report() {
+            local file="$1" max="$2"
+            [ -n "$file" ] && [ -f "$file" ] || return 0
+            if [ "$(wc -c < "$file")" -gt "$max" ]; then
+              echo "::warning::emit_report fell back to escaped embedding (report exceeds size cap) for $file" >&2
+              emit_block 'Verification report (report.md, truncated)' "$file" "$max"
+              return 0
+            fi
+            local san_file
+            san_file="$(mktemp)"
+            # Node is present on every runner that runs this job (emit_block
+            # already shells out to it for the UTF-8-safe cut). The script
+            # rides inside a single-quoted shell string, so it uses double
+            # quotes throughout and carries no single quotes of its own.
+            local node_status=0
+            node -e '
+              const fs = require("node:fs");
+              const text = fs.readFileSync(process.argv[1], "utf8").replace(/[\u0000\u0001]/g, "");
+              function escProse(s) {
+                // Allowlisted tags are stashed behind a \u0001 sentinel (stripped
+                // from input) BEFORE the < pass and restored from it, so a literal
+                // &lt;details> the author typed stays escaped text instead of being
+                // promoted back to a live tag by the un-escape step.
+                return s
+                  .replace(/<(\/?)(details|summary)>/g, "\u0001$1$2>")
+                  .replace(/</g, "&lt;")
+                  .replace(/\u0001(\/?)(details|summary)>/g, "<$1$2>")
+                  .replace(/&lt;!--/g, "&lt;!\\-\\-")
+                  .replace(/@/g, "@&#8203;");
+              }
+              function escCode(s) {
+                return s.replace(/<!--/g, "&lt;!\\-\\-");
+              }
+              let depth = 0;
+              function balance(s) {
+                return s.replace(/<\/?details>/g, function (t) {
+                  if (t === "<details>") { depth += 1; return t; }
+                  if (depth > 0) { depth -= 1; return t; }
+                  return "";
+                });
+              }
+              function proseLine(line) {
+                let out = "";
+                let buf = "";
+                let i = 0;
+                const flush = function () {
+                  if (buf) { out += balance(escProse(buf)); buf = ""; }
+                };
+                while (i < line.length) {
+                  if (line[i] !== "`") { buf += line[i]; i += 1; continue; }
+                  // A backslash-escaped backtick does not OPEN a code span (the
+                  // CommonMark escape rule consumes it first) but still CLOSES one
+                  // — an asymmetry a line-scoped scanner cannot model. Fail closed
+                  // like an unmatched run so the whole line is prose-escaped.
+                  let bs = 0, b = i - 1;
+                  while (b >= 0 && line[b] === "\\") { bs += 1; b -= 1; }
+                  if (bs % 2 === 1) { unmatched = true; buf += line[i]; i += 1; continue; }
+                  let j = i;
+                  while (j < line.length && line[j] === "`") j += 1;
+                  const run = j - i;
+                  let k = j, cs = -1, ce = -1;
+                  while (k < line.length) {
+                    if (line[k] === "`") {
+                      let m = k;
+                      while (m < line.length && line[m] === "`") m += 1;
+                      if (m - k === run) { cs = k; ce = m; break; }
+                      k = m;
+                    } else k += 1;
+                  }
+                  if (cs === -1) { unmatched = true; buf += line.slice(i, j); i = j; }
+                  else { flush(); out += escCode(line.slice(i, ce)); i = ce; }
+                }
+                flush();
+                return out;
+              }
+              const lines = text.split("\n");
+              const out = [];
+              let inFence = false, fc = "", fl = 0, fi = 0, inHtml = false;
+              let spanUnknown = false, unmatched = false;
+              for (const line of lines) {
+                if (!inFence) {
+                  const blank = /^\s*$/.test(line);
+                  if (inHtml && blank) inHtml = false;
+                  if (blank) spanUnknown = false;
+                  const m = inHtml ? null : line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+                  if (m && !(m[1][0] === "`" && m[2].indexOf("`") !== -1)) {
+                    inFence = true; fc = m[1][0]; fl = m[1].length; fi = line.match(/^ */)[0].length;
+                    out.push(escCode(line));
+                    continue;
+                  }
+                  let rendered;
+                  if (inHtml || spanUnknown) {
+                    rendered = balance(escProse(line));
+                  } else {
+                    unmatched = false;
+                    rendered = proseLine(line);
+                    if (unmatched) { spanUnknown = true; rendered = balance(escProse(line)); }
+                  }
+                  if (/^\s*<\/?(details|summary)\b/.test(rendered)) inHtml = true;
+                  out.push(rendered);
+                } else {
+                  if (/\S/.test(line) && line.match(/^ */)[0].length < fi) process.exit(3);
+                  const cm = line.match(/^ {0,3}(`{3,}|~{3,})[ \t]*$/);
+                  if (cm && cm[1][0] === fc && cm[1].length >= fl) inFence = false;
+                  out.push(escCode(line));
+                }
+              }
+              if (inFence) process.exit(3);
+              let result = out.join("\n");
+              if (depth > 0) {
+                if (result && !result.endsWith("\n")) result += "\n";
+                result += "</details>\n".repeat(depth);
+              }
+              process.stdout.write(result);
+            ' "$file" > "$san_file" || node_status=$?
+            if [ "$node_status" -ne 0 ]; then
+              if [ "$node_status" -eq 3 ]; then
+                echo "::warning::emit_report fell back to escaped embedding (report ended inside an open code fence) for $file" >&2
+              else
+                echo "::warning::emit_report fell back to escaped embedding (sanitize failed) for $file" >&2
+              fi
+              rm -f "$san_file"
+              emit_block 'Verification report (report.md, escaped fallback)' "$file" "$max"
+              return 0
+            fi
+            # Wrap in a collapsed <details> (one-line footprint, markdown when
+            # opened) and bound the WHOLE emitted section — wrapper, balanced
+            # report, appended closers — so the cap is a true bound on what
+            # lands in the comment. The old normal path skipped the header
+            # bytes the deficit branch did budget; folding the wrapper into
+            # the measured output removes that asymmetry and the separate
+            # fold-closer gate (closers now land in san_file before this gate).
+            local out_file
+            out_file="$(mktemp)"
+            {
+              printf '<details>\n<summary>Verification report</summary>\n\n'
+              cat "$san_file"
+              printf '\n</details>\n'
+            } > "$out_file"
+            rm -f "$san_file"
+            if [ "$(wc -c < "$out_file")" -gt "$max" ]; then
+              echo "::warning::emit_report fell back to escaped embedding (sanitized output exceeds size cap) for $file" >&2
+              rm -f "$out_file"
+              emit_block 'Verification report (report.md, truncated)' "$file" "$max"
+              return 0
+            fi
+            cat "$out_file"
+            rm -f "$out_file"
+            printf '\n'
+          }
 
           # Host the agent's evidence images (if any) on a per-PR branch
           # (pr-assets/<N>-verify, matching hand-run convention) and build
@@ -3695,7 +3929,7 @@ jobs:
               if [ -n "${MISSING_REPORT_NOTE:-}" ]; then
                 printf '%s\n\n' "$MISSING_REPORT_NOTE"
               fi
-              emit_block 'Verification report (report.md)' "$REPORT" 45000
+              emit_report "$REPORT" 45000
               if [ -n "$EVIDENCE_SECTION" ]; then
                 printf '%s' "$EVIDENCE_SECTION"
               fi
diff --git a/scripts/tests/qwen-triage-workflow.test.js b/scripts/tests/qwen-triage-workflow.test.js
index f7818381258..95b597d4869 100644
--- a/scripts/tests/qwen-triage-workflow.test.js
+++ b/scripts/tests/qwen-triage-workflow.test.js
@@ -1549,6 +1549,496 @@ describe('qwen-triage verify hardening', () => {
   // tests do not cover it. Execute it: hostile content must stay literal,
   // and the escaped body must land under GitHub's 65,536-char comment cap
   // (the cap is applied AFTER escaping for exactly this reason).
+  it('renders report.md as sanitized markdown with an escaped-pre fallback', () => {
+    // #8140's verify comment displayed the whole curated bilingual report
+    // as a wall of raw markdown source inside <pre><code>. report.md now
+    // renders as MARKDOWN, wrapped in a collapsed <details> so it still
+    // costs one line in the conversation. A code-region-aware node sanitizer
+    // holds the security floor: CommonMark does NOT decode entities in code
+    // spans/fences, so escaping there would show &amp;&amp; / &lt;T&gt; in
+    // the very commands and types the report is read to copy — prose is
+    // escaped, code is left alone (inert under a code/pre ancestor), the
+    // comment-open token is broken EVERYWHERE so no forged qwen-triage:*
+    // marker survives in the RAW body the upsert greps, prose @ cannot fire
+    // mentions, and folds are balanced over prose only (a </details> quoted
+    // in code is inert) so a malformed report cannot swallow the footer or
+    // escape its wrapper. Oversized reports fall back to the escaped <pre>
+    // wholesale (cut markdown dangles fences).
+    const publishStep = step('Post verification report comment');
+    const body = publishStep.match(/run: \|-\n([\s\S]*)$/)?.[1];
+    const script = body.replace(/^ {10}/gm, '');
+    const helpers = script.slice(
+      script.indexOf('html_escape()'),
+      script.indexOf('EVIDENCE_SECTION='),
+    );
+    expect(helpers).toContain('emit_report()');
+    // Each fallback branch announces itself in the Actions log (mirroring
+    // emit_block's failure warning) so a degradation to the escaped pre dump
+    // is attributable, not silent. The fold-closer overhead is now budgeted
+    // inside the sanitized-size gate (closers land before it), so four
+    // warnings cover every degradation.
+    expect(helpers).toContain(
+      '::warning::emit_report fell back to escaped embedding (report exceeds size cap)',
+    );
+    expect(helpers).toContain(
+      '::warning::emit_report fell back to escaped embedding (sanitize failed)',
+    );
+    expect(helpers).toContain(
+      '::warning::emit_report fell back to escaped embedding (report ended inside an open code fence)',
+    );
+    expect(helpers).toContain(
+      '::warning::emit_report fell back to escaped embedding (sanitized output exceeds size cap)',
+    );
+    // The report call site uses the rendering path; the tmux lane keeps
+    // its escaped embedding.
+    expect(script).toContain('emit_report "$REPORT" 45000');
+    expect(step('Post tmux result comment')).not.toContain('emit_report');
+
+    // Mirror the sanitizer's code-region model so security assertions test
+    // PROSE only: a live-looking tag inside a fence is inert code text, not
+    // a hole, so grepping the raw output would give false positives.
+    const stripCode = (s) => {
+      const kept = [];
+      let inFence = false;
+      let fc = '';
+      let fl = 0;
+      let inHtml = false;
+      for (const line of s.split('\n')) {
+        if (!inFence) {
+          if (inHtml && /^\s*$/.test(line)) inHtml = false;
+          const wasHtml = inHtml;
+          const m = inHtml ? null : line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+          if (m && !(m[1][0] === '`' && m[2].includes('`'))) {
+            inFence = true;
+            fc = m[1][0];
+            fl = m[1].length;
+            continue;
+          }
+          if (/^\s*<\/?(details|summary)\b/.test(line)) inHtml = true;
+          kept.push(wasHtml ? line : line.replace(/`[^`]*`/g, ''));
+        } else {
+          const cm = line.match(/^ {0,3}(`{3,}|~{3,})\s*$/);
+          if (cm && cm[1][0] === fc && cm[1].length >= fl) inFence = false;
+        }
+      }
+      return kept.join('\n');
+    };
+
+    const dir = mkdtempSync(join(tmpdir(), 'verify-render-'));
+    try {
+      const report = join(dir, 'report.md');
+      writeFileSync(
+        report,
+        [
+          '# Deep Verification — `merge-ready`',
+          '',
+          '**Verdict:** pass && <T<U>> ok',
+          '',
+          'Run `npm test && Map<string> @pkg` then check `a -> b`.',
+          '',
+          '```bash',
+          'npm run build && node probe.mjs --pkg @qwen-code/core',
+          '<img src=x onerror=alert(1)>',
+          'marker: <!-- qwen-triage:verify-state=running -->',
+          'fold-quote: </details>',
+          '```',
+          '',
+          '> a blockquote && more',
+          '',
+          '| scenario | match |',
+          '| --- | --- |',
+          '| success | ✅ |',
+          '',
+          '<details>',
+          '<summary>中文摘要</summary>',
+          '',
+          '- 结论：通过 @everyone <img src=x onerror=alert(1)>',
+          '- marker: <!-- qwen-triage:verify -->',
+          '',
+          '</details>',
+          '',
+          '<details>',
+          '<summary>unclosed fold</summary>',
+          'tail',
+          '',
+        ].join('\n'),
+      );
+      const emit = (file, max) => {
+        const proc = spawnSync(
+          'bash',
+          ['-c', `${helpers}\nemit_report "$1" ${max}`, '_', file],
+          { encoding: 'utf8', maxBuffer: 10 * 1024 * 1024 },
+        );
+        expect(proc.status).toBe(0);
+        return proc.stdout;
+      };
+
+      const out = emit(report, 45000);
+      // Wrapped in a collapsed <details>; markdown structure survives inside.
+      expect(out).toContain(
+        '<details>\n<summary>Verification report</summary>',
+      );
+      expect(out).toContain('| scenario | match |');
+      expect(out).toContain('**Verdict:**');
+      expect(out).toContain('<summary>中文摘要</summary>');
+      expect(out).not.toContain('<pre><code>');
+      // Prose fidelity: && and blockquotes survive; a prose < is escaped
+      // (renders back to <), > is left alone.
+      expect(out).toContain('pass && &lt;T&lt;U>> ok');
+      expect(out).toContain('> a blockquote && more');
+      expect(out).not.toContain('&amp;&amp;');
+      // Code fidelity: spans and fences are untouched — no entity mangling
+      // of the commands/types/paths a reader copies, and a fenced <img> or
+      // </details> stays inert code text.
+      expect(out).toContain('`npm test && Map<string> @pkg`');
+      expect(out).toContain(
+        'npm run build && node probe.mjs --pkg @qwen-code/core',
+      );
+      expect(out).toContain('<img src=x onerror=alert(1)>');
+      // Security floor over the WHOLE raw body: no live comment-open token
+      // anywhere (broken globally, prose AND code), so the upsert grep for
+      // the running marker cannot be forged from a fenced quote.
+      expect(out).not.toContain('<!--');
+      // Security floor over PROSE: the mention is neutralized by a ZWSP
+      // (GitHub decodes &#64; before the mention filter, so the entity alone
+      // was inert), no live non-allowlisted tag, and prose folds balance
+      // (the fenced </details> is NOT counted, so the genuinely unclosed
+      // fold still gets closed).
+      const prose = stripCode(out);
+      expect(prose).not.toContain('@everyone');
+      expect(prose).toContain('@&#8203;everyone');
+      expect(prose).not.toContain('<img');
+      expect(prose.match(/<(?!\/?(details|summary)\b)[A-Za-z]/g)).toBe(null);
+      const opens = prose.split('<details>').length - 1;
+      const closes = prose.split('</details>').length - 1;
+      expect(opens).toBe(closes);
+
+      // Guarantee 4, the hole the review reproduced: one genuinely unclosed
+      // fold plus a fenced block quoting </details>. The fenced closer is
+      // inert code and must NOT balance the live fold — the prose folds
+      // still net to zero only because a closer is appended for the open.
+      const hole = join(dir, 'hole.md');
+      writeFileSync(
+        hole,
+        '<details>\n<summary>fold that never closes</summary>\n\n```html\n</details>\n```\n',
+      );
+      const holeOut = emit(hole, 45000);
+      const holeProse = stripCode(holeOut);
+      expect(holeProse.split('<details>').length).toBe(
+        holeProse.split('</details>').length,
+      );
+
+      // HTML-block divergence: a fence opener inside a <details> HTML
+      // block is literal text per CommonMark/GitHub, not a fence. The
+      // sanitizer must prose-escape the content (neutralizing <img>)
+      // rather than passing it through escCode as inert code.
+      const htmlblk = join(dir, 'htmlblk.md');
+      writeFileSync(
+        htmlblk,
+        [
+          '<details>',
+          '<summary>fold</summary>',
+          '```',
+          '<img src=x onerror=alert(1)>',
+          '```',
+          '</details>',
+          '',
+        ].join('\n'),
+      );
+      const htmlOut = emit(htmlblk, 45000);
+      // The <img> is prose-escaped, not passed through as inert code.
+      expect(htmlOut).toContain('&lt;img src=x onerror=alert(1)>');
+      expect(htmlOut).not.toContain('<img');
+      // The fold balances: wrapper 1 open / 1 close, report fold balanced.
+      expect(htmlOut.split('<details>').length - 1).toBe(
+        htmlOut.split('</details>').length - 1,
+      );
+
+      // Code-span divergence: a backtick code span inside a <details>
+      // HTML block is literal text per CommonMark/GitHub, not code.
+      // The sanitizer must prose-escape the whole line (neutralizing
+      // <img>) rather than splitting it through proseLine and passing
+      // the span through escCode as inert code.
+      const codespan = join(dir, 'codespan.md');
+      writeFileSync(
+        codespan,
+        [
+          '<details>',
+          '<summary>fold</summary>',
+          'text `<img src=x onerror=alert(1)>` more',
+          '</details>',
+          '',
+        ].join('\n'),
+      );
+      const csOut = emit(codespan, 45000);
+      expect(csOut).toContain('&lt;img src=x onerror=alert(1)>');
+      expect(csOut).not.toContain('<img');
+      expect(csOut.split('<details>').length - 1).toBe(
+        csOut.split('</details>').length - 1,
+      );
+      const csProse = stripCode(csOut);
+      expect(csProse).not.toContain('<img');
+
+      // Indented fold: a <details> nested in a list (indent >= 4) must
+      // enter the inHtml state too — GitHub opens HTML blocks relative
+      // to the list-item content column, not just at column 0-3.
+      const indented = join(dir, 'indented.md');
+      writeFileSync(
+        indented,
+        [
+          '- list item',
+          '    <details>',
+          '    <summary>fold</summary>',
+          '    text `<img src=x>` more',
+          '    </details>',
+          '',
+        ].join('\n'),
+      );
+      const indOut = emit(indented, 45000);
+      expect(indOut).toContain('&lt;img src=x>');
+      expect(indOut).not.toContain('<img');
+
+      // Mirror case: a surplus </details> with no open is dropped so it
+      // cannot close the wrapping fold early — the wrapper stays 1 open /
+      // 1 close even though the report shipped an orphan closer.
+      const surplus = join(dir, 'surplus.md');
+      writeFileSync(surplus, 'text </details> more\n');
+      const surplusOut = emit(surplus, 45000);
+      expect(surplusOut).toContain('text  more');
+      expect(surplusOut.split('<details>').length - 1).toBe(1);
+      expect(surplusOut.split('</details>').length - 1).toBe(1);
+
+      // A report ending inside an open code fence: a fence still open at
+      // EOF means the flat scanner diverged from GitHub's container-aware
+      // parser (which closes a list-nested fence at the container's end,
+      // not at EOF). Rather than guess and ship prose GitHub parses as
+      // live, emit_report degrades to the escaped-pre fallback through its
+      // non-zero-exit branch, announcing the cause with its own warning.
+      const fence = join(dir, 'fence.md');
+      writeFileSync(fence, '# Title\n\n```bash\ncode here\n');
+      const fenceProc = spawnSync(
+        'bash',
+        ['-c', `${helpers}\nemit_report "$1" 45000`, '_', fence],
+        { encoding: 'utf8', maxBuffer: 10 * 1024 * 1024 },
+      );
+      expect(fenceProc.status).toBe(0);
+      expect(fenceProc.stdout).toContain('<pre><code>');
+      expect(fenceProc.stdout).toContain(
+        'Verification report (report.md, escaped fallback)',
+      );
+      expect(fenceProc.stderr).toContain(
+        '::warning::emit_report fell back to escaped embedding (report ended inside an open code fence)',
+      );
+
+      // Container-axis hole the review reproduced: a fence nested in a list
+      // item, never explicitly closed. CommonMark closes it at the
+      // container's end but the flat scanner stays inFence to EOF, so before
+      // the fix the trailing unindented line shipped as prose GitHub parsed
+      // as live (mention, <img>, raw <a href>). The EOF-open fence now
+      // degrades to the escaped fallback. Red before the fix (output was
+      // sanitized markdown carrying a literal <img>/<a>, not the escaped
+      // pre), green after; the @mention is inert under the pre/code ancestor.
+      const listFence = join(dir, 'list-fence.md');
+      writeFileSync(
+        listFence,
+        [
+          '- step one:',
+          '',
+          '  ```bash',
+          '  npm test',
+          '',
+          'Back at top level: @everyone <img src=x onerror=alert(1)> <a href="https://evil.example/phish">click</a>',
+          '',
+        ].join('\n'),
+      );
+      const listOut = emit(listFence, 45000);
+      expect(listOut).toContain('<pre><code>');
+      expect(listOut).toContain(
+        'Verification report (report.md, escaped fallback)',
+      );
+      expect(listOut).not.toContain('<img');
+      expect(listOut).not.toContain('<a href');
+
+      // Container-axis hole with a BALANCING closer (review hole #2 / the
+      // inline Critical): the list-nested fence opens indented, column-0
+      // prose follows, then a column-0 fence marker balances the flat
+      // scanner so it reaches EOF with inFence false — the old EOF guard
+      // never fired and the unescaped prose (mention, <img>, raw <a href>)
+      // shipped. The dedent guard now exits non-zero the moment a non-blank
+      // line dedents below the fence opener's indent. Asserted on the RAW
+      // output (parser-independent): the fallback is the escaped pre, so no
+      // live <img>/<a href> reaches the body and the @mention is inert under
+      // the pre/code ancestor.
+      const listFenceClosed = join(dir, 'list-fence-closed.md');
+      writeFileSync(
+        listFenceClosed,
+        [
+          '- step one:',
+          '',
+          '  ```bash',
+          '  npm test',
+          '',
+          'Back at top level: @everyone <img src=x onerror=alert(1)> <a href="https://evil.example/phish">click</a>',
+          '',
+          '```',
+          'after',
+          '',
+        ].join('\n'),
+      );
+      const lfcOut = emit(listFenceClosed, 45000);
+      expect(lfcOut).toContain('<pre><code>');
+      expect(lfcOut).toContain(
+        'Verification report (report.md, escaped fallback)',
+      );
+      expect(lfcOut).not.toContain('<img');
+      expect(lfcOut).not.toContain('<a href');
+
+      // Paragraph-spanning code span (review hole #1): CommonMark matches a
+      // code span across the lines of a paragraph, but proseLine matches per
+      // line. An unmatched backtick run on one line flips the parity for the
+      // rest of the paragraph, so the span the sanitizer classified as code
+      // was prose to GitHub — a live <img>/@everyone shipped before the fix.
+      // The scanner now fails closed: an unmatched run prose-escapes the rest
+      // of the paragraph. Asserted on the RAW output (parser-independent)
+      // rather than through stripCode, which mirrors the sanitizer's own
+      // line-scoped model and so cannot see this divergence.
+      const paraSpan = join(dir, 'para-span.md');
+      writeFileSync(
+        paraSpan,
+        ['A `hint about --flag', 'See `<img src=x> @everyone` here', ''].join(
+          '\n',
+        ),
+      );
+      const psOut = emit(paraSpan, 45000);
+      expect(psOut).toContain('&lt;img src=x>');
+      expect(psOut).not.toContain('<img');
+      expect(psOut).toContain('@&#8203;everyone');
+      expect(psOut).not.toContain('@everyone');
+
+      // Backslash-escaped opening backtick (review Critical): CommonMark's
+      // escape rule consumes \` before the backticks rule runs, so it does
+      // NOT open a code span — but the raw-text backtick scanner still lets it
+      // CLOSE one. Before the fix proseLine paired the escaped backtick with a
+      // later one and shipped the gap as inert code, so GitHub rendered prose:
+      // a live <a href>, an un-defused @everyone, and a </details> that
+      // balance() never saw (it went through escCode), closing the wrapper
+      // early. The scanner now fails closed on an odd backslash run. Asserted
+      // on the RAW output (parser-independent): no live <a href>/<img>, the
+      // mention is ZWSP-defused, and the injected closer is dropped so the
+      // wrapper stays 1 open / 1 close.
+      const escBt = join(dir, 'esc-bt.md');
+      writeFileSync(
+        escBt,
+        'see \\` opts </details> @everyone <a href="https://evil.example/phish">Merge instructions</a> ` end\n',
+      );
+      const escBtOut = emit(escBt, 45000);
+      expect(escBtOut).not.toContain('<a href');
+      expect(escBtOut).not.toContain('<img');
+      expect(escBtOut).toContain('@&#8203;everyone');
+      expect(escBtOut).not.toContain('@everyone');
+      expect(escBtOut.split('<details>').length - 1).toBe(1);
+      expect(escBtOut.split('</details>').length - 1).toBe(1);
+
+      // Pre-escaped entities (review Medium): escProse restores the allowlist
+      // by round-tripping through &lt;, so before the fix it could not tell a
+      // &lt; it just produced from one the author typed — a literal
+      // &lt;details> in the report was promoted to a LIVE fold and a literal
+      // &lt;/details> was silently deleted by the surplus-closer drop. The
+      // sentinel now protects only the source's OWN raw tags, so author-typed
+      // entities stay escaped text: no forged fold, nothing deleted, wrapper
+      // stays 1 open / 1 close.
+      const ent = join(dir, 'entity.md');
+      writeFileSync(
+        ent,
+        'pre-escaped: &lt;/details> and &lt;details> and &lt;img src=x>\n',
+      );
+      const entOut = emit(ent, 45000);
+      expect(entOut).toContain('&lt;/details>');
+      expect(entOut).toContain('&lt;details>');
+      expect(entOut).toContain('&lt;img src=x>');
+      expect(entOut.split('<details>').length - 1).toBe(1);
+      expect(entOut.split('</details>').length - 1).toBe(1);
+
+      // A NUL byte in the report is stripped (parity with emit_block's
+      // tr -d '\000'); it must not reach the comment body.
+      const nul = join(dir, 'nul.md');
+      writeFileSync(nul, 'before\u0000after\n');
+      const nulOut = emit(nul, 45000);
+      expect(nulOut).toContain('beforeafter');
+      expect(nulOut).not.toContain('\u0000');
+
+      // Oversize → wholesale fallback to the escaped pre embedding.
+      const big = join(dir, 'big.md');
+      writeFileSync(big, `x${'y'.repeat(46000)}`);
+      const fb = emit(big, 45000);
+      expect(fb).toContain('<pre><code>');
+      expect(fb).toContain('Verification report (report.md, truncated)');
+
+      // Inflation: raw under the cap but sanitized over it. & is no longer
+      // escaped (it is not a security control), so < drives the inflation —
+      // each < becomes the 4-byte &lt;.
+      const dense = join(dir, 'dense.md');
+      writeFileSync(dense, '<'.repeat(12000));
+      const inflated = emit(dense, 45000);
+      expect(inflated).toContain('<pre><code>');
+      expect(inflated).toContain('Verification report (report.md, truncated)');
+
+      // The sanitizer runs under the step's real `set -euo pipefail`; a
+      // fold-free report must still exit 0 and render (no grep whose
+      // zero-match exit could abort the composer).
+      const nofolds = join(dir, 'nofolds.md');
+      writeFileSync(nofolds, '## heading\nbody text\n');
+      const pf = spawnSync(
+        'bash',
+        [
+          '-c',
+          `set -o pipefail\n${helpers}\nemit_report "$1" 45000`,
+          '_',
+          nofolds,
+        ],
+        { encoding: 'utf8' },
+      );
+      expect(pf.status).toBe(0);
+      expect(pf.stdout).toContain('<summary>Verification report</summary>');
+      expect(pf.stdout).toContain('## heading');
+
+      // Appended fold closers land in the sanitized output BEFORE the size
+      // gate, so a report dense in unbalanced <details> opens falls back to
+      // the capped pre dump once the closers push the wrapped section over
+      // the budget — rather than shipping a section over the cap.
+      // 100 opens: raw ~900 B clears max=2000, but 900 + 100*11 closers +
+      // the ~61 B wrapper > 2000 forces the fallback.
+      const folds = join(dir, 'folds.md');
+      writeFileSync(folds, '<details>\n'.repeat(100));
+      const over = emit(folds, 2000);
+      expect(over).toContain('<pre><code>');
+      expect(over).toContain('Verification report (report.md, truncated)');
+
+      // Sanitizer crash → escaped-pre fallback. Override node so the
+      // sanitizer's `node -e` fails; emit_block's own node call has a
+      // head -c fallback so the escaped output still renders.
+      const crash = join(dir, 'crash.md');
+      writeFileSync(crash, '# crash report\n\nbody text\n');
+      const crashProc = spawnSync(
+        'bash',
+        [
+          '-c',
+          `node() { return 1; }\n${helpers}\nemit_report "$1" 45000`,
+          '_',
+          crash,
+        ],
+        { encoding: 'utf8' },
+      );
+      expect(crashProc.status).toBe(0);
+      expect(crashProc.stdout).toContain('<pre><code>');
+      expect(crashProc.stdout).toContain(
+        'Verification report (report.md, escaped fallback)',
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it('escapes and size-caps the verify report body', () => {
     const publishStep = step('Post verification report comment');
     const body = publishStep.match(/run: \|-\n([\s\S]*)$/)?.[1];
@@ -2663,10 +3153,13 @@ describe('qwen-triage verify publish fidelity', () => {
           expect(assertZh).toBeGreaterThan(details);
           expect(assertZh).toBeLessThan(detailsEnd);
         }
-        // The report block stays outside the Chinese fold.
-        expect(body.indexOf('Verification report (report.md)')).toBeGreaterThan(
-          detailsEnd,
-        );
+        // The report section stays outside the Chinese fold — now rendered
+        // as markdown inside its own collapsed <details>, not an escaped
+        // <pre> dump and not a 45 KB wall in the conversation.
+        expect(
+          body.indexOf('<summary>Verification report</summary>'),
+        ).toBeGreaterThan(detailsEnd);
+        expect(body).toContain('## real report');
       } finally {
         rmSync(dir, { recursive: true, force: true });
       }