fix(rendering): refuse unsupported markup as an error and keep large documents linear

Element nesting is bounded before any library walks the parsed tree: a
count kept while tokens arrive stops runaway input early, and an exact
measurement of the parsed tree applies the limit of 256 levels. The
renderer parses once with the sanitizer's own settings and sanitizes that
tree, so the bound is enforced between the parse and the sanitizer's
passes. Deeper markup is an ArgumentException, which the reader already
reports as an unsupported document.

An unterminated script or comment can report a text run past the end of
its block, and malformed markup can report one that starts inside
another; both are handled instead of failing the open. Raw-text
formatting is applied in one forward pass, and repeated heading titles
continue from the last anchor suffix used, so neither grows with the
square of the document. DocumentOutline accepts a cancellation token that
is honoured between its phases.

The threat model states that nesting is bounded and parse time is not.

Closes #50

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

.gitea/workflows/build.yaml

@@ -0,0 +1,50 @@
+name: build
+on:
+  push:
+    branches: ['**']
+    tags: ['v*']
+jobs:
+  windows:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/windows.yaml@v1
+    secrets: inherit
+    with:
+      commands: |
+        dotnet restore MarkdownViewr.Windows.slnx -p:Platform=x64 --locked-mode
+        dotnet build MarkdownViewr.Windows.slnx -p:Platform=x64 -warnaserror --no-restore
+        # The WinUI app project is built directly so the format workspace can load its generated XAML code.
+        dotnet build src/MarkdownViewr.Windows/MarkdownViewr.Windows.csproj -p:Platform=x64 -warnaserror --no-restore
+        $env:Platform = 'x64'
+        dotnet format MarkdownViewr.Windows.slnx --verify-no-changes --severity warn --no-restore
+        Remove-Item Env:Platform
+        dotnet test tests/MarkdownViewr.Windows.Core.Tests --no-build --settings coverage.runsettings --collect:"XPlat Code Coverage" --logger trx --results-directory TestResults
+        pwsh -NoProfile -File ./build/Assert-Coverage.ps1 -ResultsDirectory TestResults -Packages MarkdownViewr.Windows.Core
+        # PowerShell build scripts: analyzer and Pester boundary tests with pinned modules saved to the job's temp directory.
+        $modules = Join-Path ($env:RUNNER_TEMP ?? [IO.Path]::GetTempPath()) "psmodules-$env:GITHUB_RUN_ID"
+        New-Item -ItemType Directory -Force -Path $modules | Out-Null
+        Save-PSResource -Name PSScriptAnalyzer -Version 1.25.0 -Repository PSGallery -TrustRepository -Path $modules
+        Save-PSResource -Name Pester -Version 5.7.1 -Repository PSGallery -TrustRepository -Path $modules
+        Import-Module (Join-Path $modules PSScriptAnalyzer/1.25.0/PSScriptAnalyzer.psd1)
+        Import-Module (Join-Path $modules Pester/5.7.1/Pester.psd1)
+        foreach ($file in Get-ChildItem -LiteralPath build -Recurse -File | Where-Object Extension -In '.ps1', '.psm1', '.psd1') {
+          # Casing runs in its own pass: command metadata races other rules in 1.25.0 (PSScriptAnalyzer#1708).
+          $findings = @(
+            Invoke-ScriptAnalyzer -Path $file.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -IncludeRule PSUseCorrectCasing
+            Invoke-ScriptAnalyzer -Path $file.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -ExcludeRule PSUseCorrectCasing
+          )
+          if ($findings.Count -gt 0) { $findings | Format-Table; throw "Script analysis failed: $($file.Name)" }
+        }
+        # The Pester suites assert on child processes' exit codes themselves.
+        $PSNativeCommandUseErrorActionPreference = $false
+        $pester = New-PesterConfiguration
+        $pester.Run.Path = @('build/Assert-Coverage.Tests.ps1', 'build/GitHubRepository.Tests.ps1', 'build/Distribution.Tests.ps1', 'build/InstalledUpdates.Tests.ps1', 'build/PackageBytes.Tests.ps1', 'build/ReleaseSigning.Tests.ps1')
+        $pester.Run.PassThru = $true
+        if ((Invoke-Pester -Configuration $pester).Result -ne 'Passed') { throw 'Pester tests failed' }
+  scripts:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/node.yaml@v1
+    with:
+      node-version: '24'
+      install: npm ci --ignore-scripts
+      commands: |
+        npm run lint
+        npm test
+        npm audit signatures

.github/scripts/assert-release-source.cjs

@@ -0,0 +1,55 @@
+// Copyright (c) 2026 James Maes (KofTwentyTwo)
+// SPDX-License-Identifier: MIT
+
+"use strict";
+
+/** Requires genuine passing CI on the exact complete tree merged for this release. */
+async function run({ github, context, core })
+{
+   const repository = context.repo;
+   const { data: source } = await github.rest.repos.getCommit({ ...repository, ref: context.sha });
+   if(!source.commit.verification.verified)
+   {
+      throw new Error("The release commit signature is not verified.");
+   }
+   const pulls = await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit,
+      { ...repository, commit_sha: context.sha, per_page: 100 });
+   const merged = pulls.filter(pull => pull.merged_at && pull.state === "closed"
+      && pull.base.ref === "main" && pull.merge_commit_sha === context.sha);
+   if(merged.length !== 1)
+   {
+      throw new Error("Expected one merged main PR for the tagged release commit.");
+   }
+   const pull = merged[0];
+   const { data: tested } = await github.rest.repos.getCommit({ ...repository, ref: pull.head.sha });
+   if(tested.commit.tree.sha !== source.commit.tree.sha)
+   {
+      throw new Error("The release tree differs from the tested PR tree.");
+   }
+   const { data: rules } = await github.request("GET /repos/{owner}/{repo}/rules/branches/{branch}",
+      { ...repository, branch: "main" });
+   // Personal acknowledgement is enforced at merge; technical validation is reused here.
+   const required = rules.filter(rule => rule.type === "required_status_checks")
+      .flatMap(rule => rule.parameters.required_status_checks)
+      .filter(check => check.context !== "review / automated");
+   if(required.length === 0)
+   {
+      throw new Error("No required technical checks were found.");
+   }
+   const checks = await github.paginate(github.rest.checks.listForRef,
+      { ...repository, ref: pull.head.sha, per_page: 100 });
+   for(const requirement of required)
+   {
+      const records = checks.filter(check => check.name === requirement.context
+         && check.app?.id === (requirement.integration_id ?? 15368));
+      records.sort((left, right) => right.id - left.id);
+      if(records[0]?.status !== "completed" || records[0]?.conclusion !== "success")
+      {
+         throw new Error(`Required tested-source check is not successful: ${requirement.context}`);
+      }
+   }
+   core.info(`Reused ${required.length} genuine passing checks from PR #${pull.number} at ${pull.head.sha}; exact release tree ${source.commit.tree.sha}.`);
+   return { head: pull.head.sha, tree: source.commit.tree.sha, checks: required.length };
+}
+
+module.exports = { run };

.github/scripts/assert-release-source.test.cjs

@@ -0,0 +1,43 @@
+// Copyright (c) 2026 James Maes (KofTwentyTwo)
+// SPDX-License-Identifier: MIT
+
+"use strict";
+
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { run } = require("./assert-release-source.cjs");
+
+/** Exercises release-tree, check-provider and latest-result boundaries. */
+test("reuses only verified identical-source passing CI", async () =>
+{
+   for(const failure of [null, "signature", "tree", "merge", "provider", "pending", "failed", "missing", "latest", "rules"])
+   {
+      const check = { id: 1, name: "ci / ui-tests", app: { id: failure === "provider" ? 7 : 15368 },
+         status: failure === "pending" ? "in_progress" : "completed",
+         conclusion: failure === "failed" ? "failure" : "success" };
+      const github = {
+         rest: {
+            repos: { getCommit: async ({ ref }) => ({ data: { commit: {
+               verification: { verified: failure !== "signature" },
+               tree: { sha: failure === "tree" && ref === "head" ? "other" : "tree" },
+            } } }), listPullRequestsAssociatedWithCommit: "pulls" },
+            checks: { listForRef: "checks" },
+         },
+         request: async () => ({ data: failure === "rules" ? [] : [{ type: "required_status_checks",
+            parameters: { required_status_checks: [{ context: "ci / ui-tests", integration_id: 15368 }, { context: "review / automated" }] } }] }),
+         paginate: async method => method === "pulls" ? (failure === "merge" ? [] : [{ number: 1, state: "closed",
+            merged_at: "today", base: { ref: "main" }, merge_commit_sha: "release", head: { sha: "head" } }])
+            : failure === "missing" ? [] : failure === "latest" ? [check, { ...check, id: 2, conclusion: "failure" }] : [check],
+      };
+      const operation = run({ github, context: { repo: { owner: "owner", repo: "repo" }, sha: "release" }, core: { info: () =>
+      {} } });
+      if(failure)
+      {
+         await assert.rejects(operation);
+      }
+      else
+      {
+         assert.deepEqual(await operation, { head: "head", tree: "tree", checks: 1 });
+      }
+   }
+});

.github/workflows/release.yml

@@ -38,6 +38,8 @@ jobs:
     environment: release
     permissions:
       contents: read
+      checks: read
+      pull-requests: read
     steps:
       - name: Checkout main and tag history
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -61,41 +63,16 @@ jobs:
           ARTIFACT_SIGNING_SUBJECT: ${{ vars.ARTIFACT_SIGNING_SUBJECT || vars.TRUSTED_SIGNING_SUBJECT }}
         run: ./build/Assert-ReleaseSigning.ps1
 
-  gates:
-    needs: verify
-    uses: ./.github/workflows/ci.yml
-    permissions:
-      contents: read
-
-  security:
-    needs: verify
-    uses: ./.github/workflows/security.yml
-    permissions:
-      contents: read
-      security-events: write
-
-  codeql:
-    needs: verify
-    uses: ./.github/workflows/codeql.yml
-    permissions:
-      contents: read
-      security-events: write
-
-  scripts:
-    needs: verify
-    uses: ./.github/workflows/scripts.yml
-    permissions:
-      contents: read
-
-  fuzzing:
-    needs: verify
-    uses: ./.github/workflows/fuzz.yml
-    permissions:
-      contents: read
+      - name: Require passing CI for the exact merged release tree
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            const { run } = require('./.github/scripts/assert-release-source.cjs');
+            await run({ github, context, core });
 
   release:
-    needs: [verify, gates, security, codeql, scripts, fuzzing]
-    uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@083d90326a8f3b750d840b6180e00870ee1342f5 # v1.1.2
+    needs: verify
+    uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@70b555bd5658273090769991bfc4c9b6681dde18 # v1.2.1
     permissions:
       contents: write      # create and publish the GitHub release
       id-token: write      # sign attestations; Azure OIDC when signing
@@ -113,6 +90,7 @@ jobs:
       test-projects: |
         tests/MarkdownViewr.Windows.Core.Tests
       sign: true
+      msi: true
       signing-files: |
         app/MarkdownViewr.Windows.exe
         app/MarkdownViewr.Windows.dll

Directory.Build.props

@@ -54,7 +54,7 @@
         commit as "+<sha>" on AssemblyInformationalVersion, which the About dialog and the
         CLI's version output show as a short hash. -->
    <PropertyGroup>
-      <VersionPrefix>1.0.3</VersionPrefix>
+      <VersionPrefix>1.0.4</VersionPrefix>
       <VersionSuffix>dev</VersionSuffix>
    </PropertyGroup>
 

README.md

@@ -31,8 +31,8 @@ Windows packages support **Windows 10 version 1809 or later and Windows 11, x64*
 
 | Edition | Choose it for | Package |
 | --- | --- | --- |
-| Stable | Everyday reading | [Download EXE installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/latest/download/markdownviewr-windows-stable-Setup.exe) |
-| Development preview | Trying upcoming changes | [Download dev EXE installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/download/v1.0.2-beta.1/markdownviewr-windows-dev-dev-Setup.exe) |
+| Stable | Everyday reading | [Download EXE installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/latest/download/markdownviewr-windows-stable-Setup.exe) · [MSI installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/latest/download/markdownviewr-windows-stable.msi) |
+| Development preview | Trying upcoming changes | [Download dev EXE installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/download/v1.0.3-beta.1/markdownviewr-windows-dev-dev-Setup.exe) · [MSI installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/download/v1.0.3-beta.1/markdownviewr-windows-dev-dev.msi) |
 | Portable | Running without installation | [Download portable ZIP](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/latest/download/markdownviewr-windows-stable-Portable.zip) |
 
 Download a package from [Releases](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases). Run Setup for a per-user installation without administrator rights, or extract the portable ZIP before launching the app.

docs/SESSION-STATE.md

@@ -4,31 +4,30 @@ Updated: 2026-10-13
 
 ## Release source and verification
 
-Application behavior remains the owner-reviewed PR37 source at main4c0ccc7.
-Actual focused30, native111, published111 and installed stable/dev110 reports
-have zero failures/skips. Unchanged-source main validation38325540268 attempt2
-also passes published111 and installed stable/dev110 each. Update/restart,
-channel coexistence, registration and preservation of defaults are verified.
+Stable1.0.2 and dev1.0.2-beta.1 EXE/ZIP releases are public and immutable at
+source18d8ae950cab445672d216d387a956b964d2c6c1, builder083d903. Actual downloaded
+signatures/publisher/trust/timestamps, package payloads, checksums, CycloneDX
+SBOM attestations, source/builder provenance and updater feeds verify.
+Production runs38392743207 and38392743312 succeeded. Failed older refs remain.
 
-The signing caller pins standards1.1.2 at
-083d90326a8f3b750d840b6180e00870ee1342f5. Personally approved PR45 corrects the
-GitHub pwsh bootstrap wrapper; all hosted signing checks pass. Caller NuGet
-mapping, Azure trust scopes and strict publisher/signature gates are unchanged.
-No new Azure administration is required.
+The maintainer renewed the MSI request on2026-10-13; earlier MSI deferral is
+superseded. Prepare signed per-user MSI alongside EXE/ZIP for stable/dev1.0.3.
+MSI payload verification and focused native install/launch/uninstall must pass
+before publication. Source behaviors, dependencies and Azure trust are unchanged.
 
-Preserve the failed1.0.0 and1.0.1 stable/dev tags. New candidates are
-1.0.2/stable and1.0.2-beta.1/dev. Production status and exact shipped-artifact
-proof belong in [release checklist](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/issues/33)
-and [GitHub Releases](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases).
-Require successful signing and verification of exact downloaded bytes before
-claiming a signed public release.
+Prevent duplicate release test passes by requiring the exact complete Git tree
+of a genuinely merged main PR whose latest required technical checks all passed
+under their required provider identities. Reject unverified source signatures,
+different trees, missing/failed/pending checks and API failures. Reuse real CI
+proof; do not post fabricated results or weaken branch protection. Fresh release
+build/core coverage, signing and installer/distribution checks remain required.
 
-The maintainer authorized release without further human-review requests on
-2026-10-13. Record this as an explicit release-specific waiver, never as a claim
-that an unseen change was personally read. Automated review and technical CI
-remain required. The next development prefix is1.0.3. EXE/ZIP publication comes
-first; MSI is tracked for the following release in issue36. OpenSSF15417 remains
-70%, not passing. Preserve original owner previews/profiles and unrelated work.
+The owner explicitly authorized finishing releases without further human-review
+requests. Record the release-specific waiver truthfully; restore the original
+manual-review requirement immediately after each authorized merge. The next
+development prefix is1.0.4. OpenSSF15417 remains70%, not passing. Preserve owner
+previews/profiles and unrelated worktrees. Track actual publication/proof in
+[release checklist](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/issues/33).
 
 ## Historical release snapshots
 

docs/TODO.md

@@ -2,16 +2,12 @@
 
 ## Release and follow-up work
 
-- [x] Merge reviewed PR37 at4c0ccc7; focused30/native111/published111/stable110/dev110 pass with no failures/skips.
-- [x] Merge personally approved signing-wrapper PR45 and metadata-only standards1.1.2 proposal; pin083d903 without changing NuGet mapping or Azure trust scopes.
-- [x] Preserve failed1.0.0 and1.0.1 stable/dev tags and prepare new1.0.2 candidates.
-- [x] Prepare direct download links, portable-update guidance and developer verification links.
-- [x] Set next development VersionPrefix to1.0.3.
-- [ ] Verify published standards1.1.2 bundle hashes/provenance and exact builder bytes.
-- [ ] Pass final exact-head CI, record automated review and the maintainer's explicit release-specific review waiver, and merge normally.
-- [ ] Publish signed stable/dev EXE installers and portable ZIPs; verify exact shipped signatures, publisher, trust, timestamps, checksums, SBOMs and provenance (#33).
-- Deliver signed, installed-acceptance-tested MSI installers next release (#36).
-- Reduce repeated validation while preserving trust and complete acceptance (#38).
+- [x] Publish/verify signed stable1.0.2 and dev1.0.2-beta.1 EXE/ZIP releases (#33).
+- [x] Prepare exact-tree/provider-bound reuse of genuine source CI; boundary tests and real17-check source proof pass (#38).
+- [ ] Publish the native MSI builder, pin it and enable signed MSI in the caller (#36).
+- [ ] Pass exact-head CI, record the existing release waiver, merge and restore all original branch checks.
+- [ ] Publish1.0.3 stable/dev MSI+EXE+ZIP; verify actual MSI install/launch/uninstall and all final payload signatures, hashes, SBOMs and provenance.
+- [x] Set next development prefix to1.0.4 and prepare user download links.
 - Complete remaining OpenSSF evidence; saved70% is not a passing badge (#31).
 
 ## Prior release checklist

docs/security/threat-model.md

@@ -46,7 +46,7 @@ physical directory. It does not authorize native commands or remote resource acc
 | Image traversal, device/ADS paths or encoded separators | Core path-policy tests pass; denied before filesystem access |
 | Junction/symlink escape or check/reopen race | Check normalized physical path on opened image handle; read same handle; real junction rejection test passes |
 | Remote image tracking / resource exfiltration | No-referrer header, no document networking; actual listening-server browser denial passed on 77dd04d |
-| Oversized input / image denial of service | Pre-parse character bound and image byte bound; native limit tests pass; performance acceptance remains |
+| Oversized input / image denial of service | Pre-parse character bound and image byte bound; native limit tests pass. Element nesting is bounded at 256 levels before any library walks the parsed tree recursively, with an early count that stops runaway nesting while it is still being parsed; deeper markup is refused as an unsupported document. Parse time is not bounded: it grows with document size, runs off the window thread, and can be cancelled between the render, the parse and each heading |
 | Settings corruption / UI exception | AppKit shell sanitation and crash handling; inherited foundation tests |
 | Tampered installer/update | Fail-closed signing/provenance/checksum release pipeline; real Azure CI authorization and signed artifacts remain unverified |
 | Privileged repository review abuse | Trusted review workflow only; current-SHA human acknowledgement remains required |
@@ -426,3 +426,7 @@ actual parsers. Independent properties detect unsafe acceptance as well as crash
 Synthetic inputs never execute scripts, start native processes or touch real profiles.
 The record in [assurance.json](assurance.json) does not claim coverage-guided
 instrumentation, Best Practices enrollment or verified production signatures.
+
+## Release validation reuse
+
+Release tags must be on main and have a verified commit signature. Reused source CI must belong to the genuinely merged main PR, match the entire tagged Git tree and have successful latest required technical checks from the configured provider identities. Missing, stale, failed or pending proof fails publication. This avoids repeating identical UI tests; it does not trust arbitrary PR artifacts or remove branch checks. Fresh build/coverage, Azure signing, MSI installation and exact distributed-payload verification remain release gates.

docs/user-guide.md

@@ -75,3 +75,7 @@ Documents are rendered locally. Authored scripts and remote images are blocked;
 - **The app does not start:** confirm Microsoft Edge WebView2 Runtime is installed and inspect the activity logs if available.
 
 For help, use [Discussions](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/discussions). Report reproducible problems through [Issues](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/issues/new/choose), including **Help → About** version, Windows version, and relevant sanitized logs. Report vulnerabilities privately using [SECURITY.md](../SECURITY.md).
+
+## MSI installation
+
+The MSI installs for the current Windows user, alongside the EXE and portable download options. Stable and dev have separate package identities. Use the same installer format for an existing edition; install the other channel separately to try previews. Uninstall an MSI installation through Windows Settings → Apps → Installed apps. The installer registers supported Markdown types and preserves your existing default choices.

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.100",
+    "version": "10.0.403",
     "rollForward": "latestFeature"
   }
 }

package.json

@@ -7,7 +7,7 @@
    },
    "scripts": {
       "lint": "eslint .github/scripts eslint.config.mjs --max-warnings 0",
-      "test": "node --test .github/scripts/review-gate.test.cjs"
+      "test": "node --test .github/scripts/review-gate.test.cjs .github/scripts/assert-release-source.test.cjs"
    },
    "devDependencies": {
       "@eslint/js": "10.0.1",

src/MarkdownViewr.Windows.Core/Documents/DocumentOutline.cs

@@ -18,16 +18,25 @@ public sealed class DocumentOutline
 
 
 
-   /// <summary>Sanitizes first; authored identifiers cannot impersonate the generated navigation targets.</summary>
-   public DocumentOutline(string markdown, FrontmatterMode frontmatter = FrontmatterMode.Hide, MarkdownExtensions? extensions = null)
+   /// <summary>
+   /// Sanitizes first; authored identifiers cannot impersonate the generated navigation targets.
+   /// A large document takes time that grows with its size: cancellation is honoured between the
+   /// render, the parse and each heading, so a closed window or a newer load does not wait for it.
+   /// </summary>
+   public DocumentOutline(string markdown, FrontmatterMode frontmatter = FrontmatterMode.Hide, MarkdownExtensions? extensions = null, CancellationToken cancellation = default)
    {
       var sources = new DocumentSourceMap(markdown);
       var sourceHeadings = new List<DocumentSourceHeading>();
-      using AngleSharp.Html.Dom.IHtmlDocument document = new HtmlParser().ParseDocument(new MarkdownRenderer(extensions).RenderWithSources(markdown, frontmatter, sources));
+      cancellation.ThrowIfCancellationRequested();
+      string rendered = new MarkdownRenderer(extensions).RenderWithSources(markdown, frontmatter, sources);
+      cancellation.ThrowIfCancellationRequested();
+      using AngleSharp.Html.Dom.IHtmlDocument document = new HtmlParser().ParseDocument(rendered);
       IElement body = document.Body!;
       var fragments = new Dictionary<string, string>(StringComparer.Ordinal);
+      var nextSuffix = new Dictionary<string, int>(StringComparer.Ordinal);
       foreach(IElement element in body.QuerySelectorAll("h1,h2,h3,h4,h5,h6"))
       {
+         cancellation.ThrowIfCancellationRequested();
          var heading = new DocumentHeading(_headings.Count, element.LocalName[1] - '0', element.TextContent.Trim());
          _headings.Add(heading);
          if(element.GetAttribute(sources.AttributeName) is { } identity && sources.TryGetPosition(identity, out (int Start, int End) position))
@@ -37,11 +46,15 @@ public sealed class DocumentOutline
          _elements.Add(element, heading);
          element.Id = "mv-heading-" + heading.Index.ToString(CultureInfo.InvariantCulture);
          string slug = Markdig.Helpers.LinkHelper.UrilizeAsGfm(heading.Title);
+         // Repeated titles continue from the last suffix used for that title instead of rescanning from one.
          string fragment = slug;
-         for(int suffix = 1; fragments.ContainsKey(fragment); suffix++)
+         int suffix = nextSuffix.GetValueOrDefault(slug, 1);
+         while(fragments.ContainsKey(fragment))
          {
             fragment = slug + "-" + suffix.ToString(CultureInfo.InvariantCulture);
+            suffix++;
          }
+         nextSuffix[slug] = suffix;
          fragments.Add(fragment, element.Id);
       }
       foreach(IElement element in body.QuerySelectorAll("[" + sources.AttributeName + "]"))
@@ -56,6 +69,7 @@ public sealed class DocumentOutline
             link.SetAttribute("href", "#" + target);
          }
       }
+      cancellation.ThrowIfCancellationRequested();
       foreach(IElement element in body.QuerySelectorAll("*").Reverse())
       {
          if(!_elements.ContainsKey(element))

src/MarkdownViewr.Windows.Core/Documents/DocumentSourceMap.cs

@@ -142,10 +142,12 @@ internal sealed class DocumentSourceMap
       string html = string.Join('\n', lines.Take(block.Lines.Count).Select(line => line.Slice.ToString()));
       int? close = null;
       bool seenTag = false;
+      var nesting = new HtmlNesting();
       var parser = new HtmlParser(new HtmlParserOptions
       {
          OnToken = (token, range) =>
          {
+            nesting.Observe(token);
             if(!seenTag && token.Type is HtmlTokenType.StartTag or HtmlTokenType.EndTag
                && token.Name.Length == 2 && token.Name[0] == 'h' && token.Name[1] is >= '1' and <= '6')
             {
@@ -209,11 +211,13 @@ internal sealed class DocumentSourceMap
    private static HtmlParser CreateSourceParser(Dictionary<int, int> headingEnds)
    {
       int pendingHeading = -1;
+      var nesting = new HtmlNesting();
       return new HtmlParser(new HtmlParserOptions
       {
          IsKeepingSourceReferences = true,
          OnToken = (token, range) =>
          {
+            nesting.Observe(token);
             if(token.Name.Length == 2 && token.Name[0] == 'h' && token.Name[1] is >= '1' and <= '6')
             {
                if(token.Type == HtmlTokenType.StartTag)

src/MarkdownViewr.Windows.Core/Documents/HtmlNesting.cs

@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2026 James Maes
+ * SPDX-License-Identifier: MIT
+ */
+
+using AngleSharp.Dom;
+using AngleSharp.Html.Parser;
+using AngleSharp.Html.Parser.Tokens;
+
+
+namespace MarkdownViewr.Windows.Core.Documents;
+
+/// <summary>
+/// Bounds how deeply authored HTML may nest. Libraries that walk the parsed tree recursively
+/// overflow the stack on a few thousand levels, and a stack overflow cannot be caught, so the
+/// bound is enforced before any such walk: a cheap count while tokens arrive stops runaway
+/// input early, and an exact measurement of the parsed tree applies the real limit.
+/// </summary>
+internal sealed class HtmlNesting
+{
+   /// <summary>The deepest element nesting a document may have; ordinary documents use a few dozen levels.</summary>
+   public const int MaximumDepth = 256;
+
+   /// <summary>Start tags left open before parsing stops; an upper bound on depth that keeps the parser's work small.</summary>
+   public const int MaximumOpenTags = 4096;
+
+   private const string Message = "The document nests HTML more deeply than the supported limit.";
+
+   private static readonly HashSet<string> s_neverOpen = new(StringComparer.Ordinal)
+   {
+      // Void elements have no content.
+      "area", "base", "br", "col", "embed", "hr", "img", "input", "link", "meta", "source", "track", "wbr",
+      // A new one of these closes the previous one, so siblings left unclosed do not nest.
+      "caption", "colgroup", "dd", "dt", "li", "optgroup", "option", "p", "tbody", "td", "tfoot", "th", "thead", "tr",
+   };
+
+   private readonly Stack<string> _open = new();
+
+
+
+   /// <summary>
+   /// Counts start tags that are still open. An end tag closes only the tag on top, so the count
+   /// can exceed the real depth for carelessly closed markup but never falls below it.
+   /// </summary>
+   public void Observe(HtmlToken token)
+   {
+      if(token.Type == HtmlTokenType.StartTag && !s_neverOpen.Contains(token.Name))
+      {
+         _open.Push(token.Name);
+         if(_open.Count > MaximumOpenTags)
+         {
+            throw new ArgumentException(Message, nameof(token));
+         }
+      }
+      else if(token.Type == HtmlTokenType.EndTag && _open.TryPeek(out string? top) && string.Equals(top, token.Name, StringComparison.Ordinal))
+      {
+         _open.Pop();
+      }
+   }
+
+
+
+   /// <summary>Measures the parsed tree without recursion and rejects one deeper than <see cref="MaximumDepth"/>.</summary>
+   public static void ThrowIfTooDeep(INode root)
+   {
+      int depth = 0;
+      INode? node = root;
+      while(node is not null)
+      {
+         if(node.FirstChild is { } child)
+         {
+            node = child;
+            if(++depth > MaximumDepth)
+            {
+               throw new ArgumentException(Message, nameof(root));
+            }
+         }
+         else
+         {
+            // A leaf: climb to the nearest ancestor that has a sibling still to visit.
+            while(node != root && node!.NextSibling is null)
+            {
+               node = node.Parent;
+               depth--;
+            }
+            node = node == root ? null : node!.NextSibling;
+         }
+      }
+   }
+}

src/MarkdownViewr.Windows.Core/Documents/MarkdownRenderer.cs

@@ -6,6 +6,8 @@
 
 using System.Text;
 using System.Text.RegularExpressions;
+using AngleSharp;
+using AngleSharp.Css.Parser;
 using AngleSharp.Dom;
 using AngleSharp.Html.Dom;
 using AngleSharp.Html.Parser;
@@ -24,6 +26,14 @@ public sealed class MarkdownRenderer
    /// <summary>Bounds parser work before an opened document can consume unbounded memory.</summary>
    public const int MaximumCharacters = 16 * 1024 * 1024;
 
+   // The sanitizer's own parser settings: scripting on, so noscript content stays text, and its CSS-aware context.
+   private static readonly IBrowsingContext s_sanitizerContext = BrowsingContext.New(Configuration.Default.WithCss(new CssParserOptions
+   {
+      IsIncludingUnknownDeclarations = true,
+      IsIncludingUnknownRules = true,
+      IsToleratingInvalidSelectors = true,
+   }));
+
    private readonly MarkdownPipeline _pipeline;
 
    private readonly MarkdownExtensions _extensions;
@@ -100,7 +110,23 @@ public sealed class MarkdownRenderer
          _ => "",
       } : "";
       string html = sources is null ? RenderDocument(Markdown.Parse(body, _pipeline)) : sources.Render(body, _pipeline, markdown.Length - body.Length, RenderDocument);
-      return _sanitizer.Sanitize(prefix + html);
+      return Sanitize(prefix + html);
+   }
+
+
+
+   /// <summary>
+   /// Parses once with the sanitizer's own settings, proves the tree is shallow enough for the
+   /// sanitizer's recursive passes, and only then sanitizes and serializes it.
+   /// </summary>
+   private string Sanitize(string html)
+   {
+      var nesting = new HtmlNesting();
+      var parser = new HtmlParser(new HtmlParserOptions { IsScripting = true, OnToken = (token, _) => nesting.Observe(token) }, s_sanitizerContext);
+      using IHtmlDocument document = parser.ParseDocument("<!doctype html><html><body>" + html);
+      HtmlNesting.ThrowIfTooDeep(document.Body!);
+      _sanitizer.SanitizeDom(document, document.Body!);
+      return document.Body!.ChildNodes.ToHtml(_sanitizer.OutputFormatter);
    }
 
 
@@ -124,21 +150,26 @@ public sealed class MarkdownRenderer
          var block = (HtmlBlock)node;
          string html = string.Join('\n', block.Lines.Lines.Take(block.Lines.Count).Select(line => line.Slice.ToString()));
          var changes = new List<(int Start, int End, string Value)>();
+         var nesting = new HtmlNesting();
          var parser = new HtmlParser(new HtmlParserOptions
          {
             OnToken = (token, range) =>
             {
+               nesting.Observe(token);
                if(token.Type is HtmlTokenType.StartTag or HtmlTokenType.EndTag && token.Name is "code" or "pre")
                {
                   codeDepth = Math.Max(0, codeDepth + (token.Type == HtmlTokenType.StartTag ? 1 : -1));
                }
                else if(token.Type == HtmlTokenType.Character && codeDepth == 0)
                {
-                  string text = html[range.Start.Index..range.End.Index];
+                  // An unterminated script or comment reports a range past the end of the block.
+                  int start = Math.Min(range.Start.Index, html.Length);
+                  int end = Math.Clamp(range.End.Index, start, html.Length);
+                  string text = html[start..end];
                   string formatted = FormatRawText(text, extendSubscript);
                   if(!string.Equals(text, formatted, StringComparison.Ordinal))
                   {
-                     changes.Add((range.Start.Index, range.End.Index, formatted));
+                     changes.Add((start, end, formatted));
                   }
                }
             },
@@ -148,13 +179,7 @@ public sealed class MarkdownRenderer
          {
             continue;
          }
-         var rewritten = new StringBuilder(html);
-         for(int index = changes.Count - 1; index >= 0; index--)
-         {
-            (int start, int end, string value) = changes[index];
-            rewritten.Remove(start, end - start).Insert(start, value);
-         }
-         string[] lines = rewritten.ToString().Split('\n');
+         string[] lines = Rewrite(html, changes).Split('\n');
          for(int index = 0; index < block.Lines.Count; index++)
          {
             block.Lines.Lines[index].Slice = new Markdig.Helpers.StringSlice(lines[index]);
@@ -165,6 +190,28 @@ public sealed class MarkdownRenderer
 
 
 
+   /// <summary>
+   /// Applies replacements in one forward pass, so the work is linear in the block. Malformed markup
+   /// can report a text run that starts inside an earlier one; that run is left as authored.
+   /// </summary>
+   private static string Rewrite(string html, List<(int Start, int End, string Value)> changes)
+   {
+      var rewritten = new StringBuilder(html.Length + 64);
+      int copied = 0;
+      foreach((int start, int end, string value) in changes)
+      {
+         if(start < copied)
+         {
+            continue;
+         }
+         rewritten.Append(html, copied, start - copied).Append(value);
+         copied = end;
+      }
+      return rewritten.Append(html, copied, html.Length - copied).ToString();
+   }
+
+
+
    /// <summary>Reference extension syntax applies only to tokenized visible text, with bounded regex work and unchanged entity spelling.</summary>
    private string FormatRawText(string text, bool extendSubscript)
    {
@@ -198,10 +245,12 @@ public sealed class MarkdownRenderer
          }
          else if(node is HtmlBlock block)
          {
+            var nesting = new HtmlNesting();
             var parser = new HtmlParser(new HtmlParserOptions
             {
                OnToken = (token, _) =>
                {
+                  nesting.Observe(token);
                   if(token.Type is HtmlTokenType.StartTag or HtmlTokenType.EndTag && token.Name is "code" or "pre")
                   {
                      codeDepth = Math.Max(0, codeDepth + (token.Type == HtmlTokenType.StartTag ? 1 : -1));

src/MarkdownViewr.Windows.Core/packages.lock.json

@@ -32,9 +32,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.12, )",
-        "resolved": "10.0.12",
-        "contentHash": "xi+BDjFpW+Sb+MHFHaH6Y/gV9I8BluFwRXc1QyCdoZbIK26eNiBeFuMTe/FMwc33G1wdHCyDg7CVTmb8OdQrMQ=="
+        "requested": "[10.0.14, )",
+        "resolved": "10.0.14",
+        "contentHash": "YlTamXppEQls6DYWt7RdUuwWDb0lyw/vXCaGeQpLCpsLmfwGuCkOz/vIGgMTV7ECsJcavkCOkxZXv9s8rdAHkQ=="
       },
       "AngleSharp": {
         "type": "Transitive",

tests/MarkdownViewr.Windows.Core.Tests/HtmlNestingTests.cs

@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 2026 James Maes
+ * SPDX-License-Identifier: MIT
+ */
+
+using AngleSharp.Html.Dom;
+using AngleSharp.Html.Parser;
+using MarkdownViewr.Windows.Core.Documents;
+
+
+namespace MarkdownViewr.Windows.Core.Tests;
+
+/// <summary>
+/// Deeply nested markup must be refused as an ordinary error. The renders here run on a thread
+/// with a quarter of the default stack, so a recursive walk that the bound failed to stop would
+/// end the test run instead of passing by luck.
+/// </summary>
+public sealed class HtmlNestingTests
+{
+   private const int SmallStackBytes = 256 * 1024;
+
+
+
+   /// <summary>The deepest markup the bound allows renders completely, with stack to spare.</summary>
+   [Fact]
+   public void Render_NestingAtTheLimit_RendersOnASmallStack()
+   {
+      int levels = HtmlNesting.MaximumDepth - 1;
+      string markup = Repeat("<div>", levels) + "deepest" + Repeat("</div>", levels);
+      string? html = null;
+      Assert.Null(OnSmallStack(() => html = new MarkdownRenderer().Render(markup)));
+      using IHtmlDocument parsed = new HtmlParser().ParseDocument(html!);
+      Assert.Equal(levels, parsed.QuerySelectorAll("div").Length);
+      Assert.Contains("deepest", html, StringComparison.Ordinal);
+      Assert.Equal(256, HtmlNesting.MaximumDepth);
+   }
+
+
+
+   /// <summary>One level past the limit is an argument error, the failure the reader already reports for an unsupported document.</summary>
+   [Fact]
+   public void Render_NestingOnePastTheLimit_IsRejected()
+   {
+      string markup = Repeat("<div>", HtmlNesting.MaximumDepth) + "too deep";
+      Assert.IsType<ArgumentException>(OnSmallStack(() => new MarkdownRenderer().Render(markup)));
+   }
+
+
+
+   /// <summary>
+   /// A few kilobytes of nested elements, in every shape that nests, are refused before any
+   /// library walks the tree recursively.
+   /// </summary>
+   [Theory]
+   [InlineData("<div>", 3000)]
+   [InlineData("<b>", 3000)]
+   [InlineData("<span><i>", 1500)]
+   [InlineData("<table><tr><td>", 3000)]
+   [InlineData("<blockquote>", 2000)]
+   [InlineData("<ul><li>", 2000)]
+   [InlineData("<details><summary>s</summary>", 1500)]
+   [InlineData("<div></section>", 3000)]
+   public void Render_DeeplyNestedMarkup_IsRejectedBeforeAnyRecursiveWalk(string unit, int count)
+   {
+      string markup = Repeat(unit, count) + "x";
+      Assert.IsType<ArgumentException>(OnSmallStack(() => new MarkdownRenderer().Render(markup)));
+      Assert.IsType<ArgumentException>(OnSmallStack(() => _ = new DocumentOutline(markup)));
+   }
+
+
+
+   /// <summary>
+   /// Nesting far past the limit is stopped by the count kept while tokens arrive, not after the
+   /// whole input has been parsed: parsing it to the end takes time that grows with its square.
+   /// </summary>
+   [Fact]
+   public void Render_RunawayNesting_IsStoppedWhileParsing()
+   {
+      string block = Repeat("<div>", 100000) + "x";
+      ArgumentException stoppedInBlock = Assert.IsType<ArgumentException>(OnSmallStack(() => new MarkdownRenderer().Render(block)));
+      Assert.Equal("token", stoppedInBlock.ParamName);
+      string inline = "Paragraph " + Repeat("<b>", 100000) + "x";
+      ArgumentException stoppedInline = Assert.IsType<ArgumentException>(OnSmallStack(() => new MarkdownRenderer().Render(inline)));
+      Assert.Equal("token", stoppedInline.ParamName);
+      ArgumentException measured = Assert.IsType<ArgumentException>(OnSmallStack(() => new MarkdownRenderer().Render(Repeat("<div>", 300) + "x")));
+      Assert.Equal("root", measured.ParamName);
+   }
+
+
+
+   /// <summary>Nesting assembled from inline tags in a paragraph, or from many separate blocks, is measured as a whole.</summary>
+   [Theory]
+   [InlineData("Paragraph ", "<b>", "")]
+   [InlineData("", "<div>", "\n\n")]
+   [InlineData("- item ", "<span>", "")]
+   [InlineData("> quoted ", "<i>", "")]
+   public void Render_NestingAcrossInlineTagsAndBlocks_IsRejected(string prefix, string unit, string separator)
+   {
+      string markup = prefix + string.Concat(Enumerable.Repeat(unit + separator, 400)) + "x";
+      Assert.IsType<ArgumentException>(OnSmallStack(() => new MarkdownRenderer().Render(markup)));
+   }
+
+
+
+   /// <summary>Nesting hidden in frontmatter rendered as Markdown is bounded like the body.</summary>
+   [Fact]
+   public void Render_DeepNestingInMarkdownFrontmatter_IsRejected()
+   {
+      string markup = "---\n" + Repeat("<div>", 3000) + "\n---\nBody";
+      Assert.IsType<ArgumentException>(OnSmallStack(() => new MarkdownRenderer().Render(markup, FrontmatterMode.Markdown)));
+      Assert.Null(OnSmallStack(() => new MarkdownRenderer().Render(markup, FrontmatterMode.Hide)));
+   }
+
+
+
+   /// <summary>Wide documents are not deep: thousands of siblings, unclosed paragraphs, list items and cells render normally.</summary>
+   [Theory]
+   [InlineData("<div>x</div>")]
+   [InlineData("<p>x")]
+   [InlineData("x<br>")]
+   [InlineData("<span>x</span><b>y</b>")]
+   public void Render_ManySiblings_AreNotMistakenForNesting(string unit)
+   {
+      string markup = "<div>" + Repeat(unit, HtmlNesting.MaximumOpenTags + 500) + "</div>";
+      string? html = null;
+      Assert.Null(OnSmallStack(() => html = new MarkdownRenderer().Render(markup)));
+      Assert.Contains("x", html, StringComparison.Ordinal);
+   }
+
+
+
+   /// <summary>List items and table cells left unclosed are siblings, however many there are.</summary>
+   [Fact]
+   public void Render_ManyUnclosedItemsAndCells_AreNotMistakenForNesting()
+   {
+      string markup = "<ul>" + Repeat("<li>item", 5000) + "</ul>\n\n<table>" + Repeat("<tr><td>a<td>b", 5000) + "</table>";
+      string? html = null;
+      Assert.Null(OnSmallStack(() => html = new MarkdownRenderer().Render(markup)));
+      using IHtmlDocument parsed = new HtmlParser().ParseDocument(html!);
+      Assert.Equal(5000, parsed.QuerySelectorAll("li").Length);
+      Assert.Equal(10000, parsed.QuerySelectorAll("td").Length);
+   }
+
+
+
+   /// <summary>The early count allows exactly its bound of open tags and stops at the next one.</summary>
+   [Theory]
+   [InlineData(HtmlNesting.MaximumOpenTags, false)]
+   [InlineData(HtmlNesting.MaximumOpenTags + 1, true)]
+   public void Observe_OpenTagsAtAndPastTheBound_StopsExactlyPastIt(int count, bool stopped)
+   {
+      Assert.Equal(stopped, Record.Exception(() => Tokenize(Repeat("<div>", count))) is ArgumentException);
+      Assert.Equal(4096, HtmlNesting.MaximumOpenTags);
+   }
+
+
+
+   /// <summary>
+   /// The early count never falls below the real depth: an end tag closes only the tag on top,
+   /// so an end tag the parser would ignore cannot be used to hide nesting from the count.
+   /// </summary>
+   [Theory]
+   [InlineData("<div></span>")]
+   [InlineData("<div><table><tr><td></div>")]
+   [InlineData("<section><p></article>")]
+   public void Observe_EndTagThatDoesNotCloseTheOpenTag_DoesNotReduceTheCount(string unit)
+      => Assert.IsType<ArgumentException>(Record.Exception(() => Tokenize(Repeat(unit, HtmlNesting.MaximumOpenTags + 1))));
+
+
+
+   /// <summary>Properly closed elements, void elements and self-closing siblings never accumulate.</summary>
+   [Theory]
+   [InlineData("<div><span>x</span></div>")]
+   [InlineData("<img src=x><br><hr><input>")]
+   [InlineData("<p>x<li>y<td>z<option>o")]
+   public void Observe_ClosedVoidAndImplicitlyClosedTags_DoNotAccumulate(string unit)
+      => Assert.Null(Record.Exception(() => Tokenize(Repeat(unit, HtmlNesting.MaximumOpenTags + 1))));
+
+
+
+   /// <summary>The exact measurement walks every branch and counts from the root it is given.</summary>
+   [Fact]
+   public void ThrowIfTooDeep_ShallowWideAndBranchingTrees_AreAccepted()
+   {
+      using IHtmlDocument empty = new HtmlParser().ParseDocument("");
+      HtmlNesting.ThrowIfTooDeep(empty.Body!);
+      using IHtmlDocument branching = new HtmlParser().ParseDocument(Repeat("<div>", 200) + "a" + Repeat("</div>", 200) + "<p>b</p>" + Repeat("<span>c</span>", 2000) + Repeat("<div>", 254) + "d");
+      HtmlNesting.ThrowIfTooDeep(branching.Body!);
+      using IHtmlDocument late = new HtmlParser().ParseDocument("<p>first</p><p>second</p>" + Repeat("<div>", 256) + "deep");
+      Assert.Throws<ArgumentException>(() => HtmlNesting.ThrowIfTooDeep(late.Body!));
+   }
+
+
+
+   /// <summary>Feeds markup through a parser whose tokens go to a fresh count, as the renderer does.</summary>
+   private static void Tokenize(string html)
+   {
+      var nesting = new HtmlNesting();
+      using IHtmlDocument document = new HtmlParser(new HtmlParserOptions { OnToken = (token, _) => nesting.Observe(token) }).ParseDocument(html);
+   }
+
+
+
+   /// <summary>Runs on a thread with a quarter of the default stack and returns what it threw, if anything.</summary>
+   private static Exception? OnSmallStack(Action action)
+   {
+      Exception? failure = null;
+      var thread = new Thread(() => failure = Record.Exception(action), SmallStackBytes);
+      thread.Start();
+      thread.Join();
+      return failure;
+   }
+
+
+
+   /// <summary>The unit repeated without separators.</summary>
+   private static string Repeat(string unit, int count) => string.Concat(Enumerable.Repeat(unit, count));
+}

tests/MarkdownViewr.Windows.Core.Tests/RendererRobustnessTests.cs

@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2026 James Maes
+ * SPDX-License-Identifier: MIT
+ */
+
+using AngleSharp.Html.Dom;
+using AngleSharp.Html.Parser;
+using MarkdownViewr.Windows.Core.Documents;
+
+
+namespace MarkdownViewr.Windows.Core.Tests;
+
+/// <summary>Malformed and very repetitive documents render, with work that grows in step with their size.</summary>
+public sealed class RendererRobustnessTests
+{
+   /// <summary>An unterminated script followed by a comment opener reports a text run past the end of its block; the document still opens and stays passive.</summary>
+   [Theory]
+   [InlineData("<script>x<!--")]
+   [InlineData("<script><!--")]
+   [InlineData("<script>==a==\n<!--")]
+   [InlineData("<script>*<!--")]
+   [InlineData("<div>==kept==</div><script>\n<!--\n")]
+   public void Render_UnterminatedScriptAndComment_OpensAsPassiveMarkup(string markdown)
+   {
+      string html = new MarkdownRenderer().Render(markdown + "\n\nAfter the block.");
+      Assert.DoesNotContain("<script", html, StringComparison.OrdinalIgnoreCase);
+      var outline = new DocumentOutline("# Title\n\n" + markdown);
+      Assert.Equal("Title", Assert.Single(outline.Headings).Title);
+      Assert.DoesNotContain("<script", outline.Html, StringComparison.OrdinalIgnoreCase);
+   }
+
+
+
+   /// <summary>
+   /// Markup is parsed with scripting on, as the sanitizer library parses it: the content of a
+   /// noscript element is text that ends at the first closing tag, wherever that tag appears.
+   /// </summary>
+   [Fact]
+   public void Render_NoscriptContent_IsParsedAsTextEndingAtItsFirstClosingTag()
+   {
+      const string Markdown = "<noscript><p title=\"</noscript><img src=x onerror=execute() alt=after>\"></noscript>";
+      using IHtmlDocument parsed = new HtmlParser().ParseDocument(new MarkdownRenderer().Render(Markdown));
+      AngleSharp.Dom.IElement image = Assert.Single(parsed.QuerySelectorAll("img"));
+      Assert.Equal(["alt", "src"], image.Attributes.Select(attribute => attribute.Name).Order(StringComparer.Ordinal), StringComparer.Ordinal);
+      Assert.Empty(parsed.QuerySelectorAll("noscript,p[title]"));
+   }
+
+
+
+   /// <summary>Markup broken so that one text run starts inside another is left as authored there, formatted elsewhere, and still sanitized.</summary>
+   [Fact]
+   public void Render_OverlappingTextRuns_RendersWithoutRewritingTheOverlap()
+   {
+      const string Markdown = "<iframe srcdoc='<script>execute()</scr<pre><code>==literal== ^literal^ ++literal++</code></pre>\nipt>'></iframe></style><script>execute()</script>";
+      string html = new MarkdownRenderer().Render(Markdown);
+      using IHtmlDocument parsed = new HtmlParser().ParseDocument(html);
+      Assert.Empty(parsed.QuerySelectorAll("script,iframe,style"));
+      Assert.DoesNotContain("execute()</script>", html, StringComparison.Ordinal);
+   }
+
+
+
+   /// <summary>Every text run in a long raw block is formatted once, in place, in document order.</summary>
+   [Fact]
+   public void Render_ManyFormattedRunsInOneBlock_FormatsEachInOrder()
+   {
+      const int Runs = 3000;
+      string block = "<div>" + string.Concat(Enumerable.Range(0, Runs).Select(index => $"<span>==m{index}== and ^s{index}^</span>")) + "</div>";
+      using IHtmlDocument parsed = new HtmlParser().ParseDocument(new MarkdownRenderer().Render(block));
+      Assert.Equal(Enumerable.Range(0, Runs).Select(index => "m" + index.ToString(System.Globalization.CultureInfo.InvariantCulture)), parsed.QuerySelectorAll("mark").Select(mark => mark.TextContent), StringComparer.Ordinal);
+      Assert.Equal(Enumerable.Range(0, Runs).Select(index => "s" + index.ToString(System.Globalization.CultureInfo.InvariantCulture)), parsed.QuerySelectorAll("sup").Select(sup => sup.TextContent), StringComparer.Ordinal);
+      Assert.Equal(Runs, parsed.QuerySelectorAll("span").Length);
+   }
+
+
+
+   /// <summary>A raw block whose text needs no formatting is passed through unchanged between its neighbours.</summary>
+   [Fact]
+   public void Render_FormattedRunsBetweenUnchangedText_KeepsTheTextAroundThem()
+   {
+      using IHtmlDocument parsed = new HtmlParser().ParseDocument(new MarkdownRenderer().Render("<div>before <b>==first==</b> middle <i>plain</i> ++last++ after</div>"));
+      Assert.Equal("before first middle plain last after", parsed.Body!.TextContent.Trim());
+      Assert.Equal("first", Assert.Single(parsed.QuerySelectorAll("mark")).TextContent);
+      Assert.Equal("last", Assert.Single(parsed.QuerySelectorAll("ins")).TextContent);
+   }
+
+
+
+   /// <summary>Thousands of headings with one title get distinct anchors, and a link to any of them finds its heading.</summary>
+   [Fact]
+   public void Outline_ManyHeadingsWithTheSameTitle_AnchorEachOne()
+   {
+      const int Count = 4000;
+      string markdown = string.Concat(Enumerable.Repeat("# Same\n\n", Count)) + "[first](#same) [second](#same-1) [last](#same-3999) [none](#same-4000)\n";
+      var outline = new DocumentOutline(markdown);
+      Assert.Equal(Count, outline.Headings.Count);
+      using IHtmlDocument parsed = new HtmlParser().ParseDocument(outline.Html);
+      Assert.Equal(["#mv-heading-0", "#mv-heading-1", "#mv-heading-3999", "#same-4000"], parsed.QuerySelectorAll("a").Select(link => link.GetAttribute("href")!), StringComparer.Ordinal);
+   }
+
+
+
+   /// <summary>A heading that is literally named like a generated anchor keeps its own anchor; repeats step past it.</summary>
+   [Theory]
+   [InlineData("# Same\n\n# Same-1\n\n# Same\n\n# Same\n\n", new[] { "#same", "#same-1", "#same-2", "#same-3" })]
+   [InlineData("# Same-1\n\n# Same\n\n# Same\n\n# Same-1\n\n", new[] { "#same-1", "#same", "#same-2", "#same-1-1" })]
+   [InlineData("# A\n\n# B\n\n# A\n\n# B\n\n", new[] { "#a", "#b", "#a-1", "#b-1" })]
+   public void Outline_RepeatedAndLiteralSuffixTitles_AnchorInDocumentOrder(string headings, string[] anchors)
+   {
+      string markdown = headings + string.Concat(anchors.Select(anchor => $"[link]({anchor}) "));
+      using IHtmlDocument parsed = new HtmlParser().ParseDocument(new DocumentOutline(markdown).Html);
+      Assert.Equal(["#mv-heading-0", "#mv-heading-1", "#mv-heading-2", "#mv-heading-3"], parsed.QuerySelectorAll("a").Select(link => link.GetAttribute("href")!), StringComparer.Ordinal);
+   }
+
+
+
+   /// <summary>A load that is no longer wanted stops instead of building its outline.</summary>
+   [Fact]
+   public void Outline_CancelledBeforeItStarts_StopsWithoutBuilding()
+   {
+      using var cancellation = new CancellationTokenSource();
+      cancellation.Cancel();
+      Assert.Throws<OperationCanceledException>(() => new DocumentOutline("# Title\n\nBody", cancellation: cancellation.Token));
+      Assert.Equal("Title", Assert.Single(new DocumentOutline("# Title\n\nBody", cancellation: CancellationToken.None).Headings).Title);
+   }
+}

tests/MarkdownViewr.Windows.UiTests/AppTests.Settings.cs

@@ -150,6 +150,12 @@ public partial class AppTests
       CloseSettings(session);
       InvokeDocumentMenu(session, sibling, "SourceToggle", menuName: "View");
       AssertSavedPrintingDefaults(session, options);
+      session.WaitFor(() =>
+      {
+         string settings = session.ReadSettings();
+         using var saved = JsonDocument.Parse(settings);
+         return saved.RootElement.GetProperty("ShowSource").GetBoolean() ? sibling : null;
+      }, "the sibling source toggle to finish saving before the print-cancel snapshot");
       string savedSettings = session.ReadSettings();
       InvokeDocumentMenu(session, primary, "PrintMenuItem");
       AssertPrintOptionControls(session, options);