From e58fb64bf2c6c0aa6557ba66b64c81d86f28aaa5 Mon Sep 17 00:00:00 2001
From: dormouse-bot <287024035+dormouse-bot@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:51:10 +0000
Subject: [PATCH] Keep an audit BLOCKER that an unindented code fence follows

parseFragment reset the open finding on a column-0 fence without closing
it, so the BLOCKER never reached parsed.findings and the domain's verdict
was computed as if it had not been written.
---
 scripts/security-audit-report.mjs | 3 ++-
 scripts/security-audit.test.mjs   | 5 +++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/security-audit-report.mjs b/scripts/security-audit-report.mjs
index f104ce795..e040d8728 100644
--- a/scripts/security-audit-report.mjs
+++ b/scripts/security-audit-report.mjs
@@ -192,7 +192,8 @@ export function parseFragment(text, { evidence = true } = {}) {
       if (FENCE_RE.test(line)) fenced = !fenced;
       continue;
     }
-    if (FENCE_RE.test(line)) { fenced = !fenced; finding = null; continue; }
+    // An unindented fence ends the open finding: its evidence was the lines above.
+    if (FENCE_RE.test(line)) { if (finding) closeFinding(parsed, finding, evidence); fenced = !fenced; finding = null; continue; }
     if (fenced) continue;
     if (finding) closeFinding(parsed, finding, evidence);
     finding = null;
diff --git a/scripts/security-audit.test.mjs b/scripts/security-audit.test.mjs
index c32ec9873..547ce6531 100644
--- a/scripts/security-audit.test.mjs
+++ b/scripts/security-audit.test.mjs
@@ -342,6 +342,11 @@ const cases = [
   { name: 'a BLOCKER fails the run', status: 'PASS',
     frags: only({ [REMOTE]: { stated: 'FAIL', lines: finding('BLOCKER', 'deploy/local/install-windows.ps1:88', 'Install-Service', 'a file name reaches Invoke-Expression') } }),
     expected: 'FAIL', publicRows: [`| \`${REMOTE}\` | FAIL | 0 | 0 | 0 | 1 | 0 |`] },
+  // An unindented code fence after a BLOCKER's evidence once dropped the
+  // BLOCKER, so the run passed on the domain's lines alone.
+  { name: 'a BLOCKER followed by an unindented fence still fails the run', status: 'PASS',
+    frags: only({ [REMOTE]: { stated: 'FAIL', lines: [...finding('BLOCKER', 'deploy/local/install-windows.ps1:88', 'Install-Service', 'a file name reaches Invoke-Expression'), '```', 'Invoke-Expression "& $name"', '```'] } }),
+    expected: 'FAIL', publicRows: [`| \`${REMOTE}\` | FAIL | 0 | 0 | 0 | 1 | 0 |`] },
   { name: 'a BLOCKER without its evidence still fails, and is malformed', status: 'PASS',
     frags: only({ [LOCAL]: { stated: 'FAIL', lines: ['- BLOCKER: `lib/x.ts:4` `run` — something'] } }),
     expected: 'FAIL', notes: ['BLOCKER without its Code, Path, Reproduction evidence'] },