B-S2FC-obsidian-md-review-findings
The high review of the package (run at carve time, findings posted on merged PR #1225) confirmed 15 correctness bugs empirically, spanning: block-id stripping that deletes author text mid-line; block %%comments%% leaking private content when multi-paragraph or unclosed; shiki highlighting dropping block-reference anchors from code fences; wikilink/tag tokenization inside markdown links corrupting the outer link; Vue component routing forgeable from note-authored raw HTML (mermaid/wikilink/callout via class names surviving sanitize); CRLF sources killing all partial transclusion; string-domain heading slicing diverging from the parser (fences, setext, decorated headings); an unbound resolveLink detaching class-based NoteSources; embed renders swallowing events and dropping host options/sanitize schema; inline markup in aliases breaking tokenization; a poisoned shiki highlighter cache; escaped syntax being wrongly activated; media embeds rendering as broken images; index-keyed vnodes migrating state. Below-cap verified items and a new DOM-clobbering detail are listed in the PR comment. Some overlap the notes stack’s planned #1166 sanitize pass — triage against it before fixing piecemeal. ReDoS was fixed separately in #1228.