Claude Opus 5andbdeshi
f721cbf645
Since Arc 1 the latent list has carried "raw HTML is omitted only because goldmark's default omits it". Shortcodes were the trigger, and they came and went without needing unsafe mode — a call renders a theme template (ADR-0036). So the right close is not a note saying we got away with it, but a gate: verify.sh now fails on WithUnsafe in any non-comment line under cmd/ or internal/. Proved both directions before keeping it. The first version also failed on the comment in render.go that explains the rule — a gate that fires on its own documentation is one nobody keeps, so it now skips comment lines. That is the seventh gate defect found by running against real code rather than reasoning about it. The latent row is gone rather than reworded, and the untrusted-boundary row says which half is now mechanism and which half still isn't.