Markdown extensions

CommonMark prose supports GFM tables, strikethrough, disabled task-list checkboxes and definition lists. Footnote references link to numbered endnotes at the end of the body, with links back to their references. A wikilink renders as its label and warns; links between reports use ordinary Markdown links. Quotations use a Markdown block quote with attribution on its last line. The [!quote] marker stays text and warns.

Prose uses typographic punctuation: straight quotes become curly quotes and apostrophes, -- an en dash, --- an em dash and ... an ellipsis. Code spans and blocks, math, URLs (link targets, autolinks and bare http(s):// or www. addresses), command-line flags such as --style and ASCII arrows such as --> keep their characters. Table column alignment (:--, :-:, --:) is kept as the center and num cell classes; right-aligned columns use tabular figures.

Raw HTML in Markdown never renders, and source text never yields executable content:

Each HTML tag is removed with a security.html warning at its line that names the Markdown alternative. The text inside the tag stays as text. HTML comments are dropped without a diagnostic and never reach the output. Entities such as   still work; write sub- and superscripts with Unicode (m², CO₂, 10⁻³), whose digits and plus and minus signs every bundled font draws; a character outside the style’s faces warns style.glyph-missing.
A link target is http, https, mailto, tel, a # anchor or a file in the report folder. Any other target (javascript:, data:, vbscript:, //host, a backslash) is not linked: the text stays and security.link (warning) is reported.
A Markdown image is a report file or a base64 data:image/ URI. A remote one is a report.asset.remote error at its line and column, from validate and the render alike; the image is dropped and its alt text shows. Any other source is dropped with security.image.
An explicit heading {#id} is kept only when a tab panel names it in its start anchor; other authored heading ids warn and are ignored, leaving the heading’s generated anchor. A generated anchor alone cannot start a panel.
Source never sets an id or class in the runtime’s namespace. A heading {#id} or a footnote label that starts with rv, richview, tab- or panel- is dropped (headings) or renamed fn-<label> (footnotes) with a security.id warning; heading classes and attributes are dropped with security.class.
Every text and attribute value is escaped where it is written, and an allowlist sanitizer runs as a second layer over the generated HTML. The only scripts in a report are its own JSON data elements and the report runtime.
tests/hostile/ holds a corpus of hostile sources that renders in every builtin style, in its own screen scheme and on paper, and fails when the output carries a script, an event handler, a script or remote URL, a runtime id or an unescaped marker.

A paragraph that directly follows a rich block (chart, table, metric, callout or media), is wholly emphasised and starts with Source:, Sources:, Note: or Notes: is that block’s source note. It renders as <p class="rv-source"> without the emphasis: roman, at the small size and directly under the block, with its label in a <span class="rv-source__label"> that a style can letter (components.source-label). Every other paragraph, including one that only begins with emphasis, is unchanged. richview check warns when a chart or table has no such note; synthetic data identifies itself in the note.

richview check also notes unnamed tables, Markdown emphasis or link syntax in inline table cells, video without captions, audio or video without a transcript, and header images without a caption or credit. These findings return as structured diagnostics alongside the chart checks.

$inline$ and $$display$$ LaTeX become native MathML, with visible diagnostics for unsupported expressions. Financial currency spans remain literal; the flagship’s dollar amounts are covered by a regression test. Code and ordinary Markdown links are not rewritten as wikilinks. Raw HTML is sanitized rather than evaluated; report source cannot execute JavaScript/JSX.