fix(formula): the hole placement scan follows the tokenizer at tag open and fails closed in a script's escape states (#25189)

A character that opens no tag is reconsumed in the data state, and a
script's text stays raw from a comment opener until an end tag that
follows a comment closer. The inert-type-writes header now says the
email_template wiring is also read by the hole placement rule's door
test, and the docs' refused list names SVG and MathML content.

Claude-Session: https://claude.ai/code/session_01Fg7vNwYgyAmHMTJm8rAYsD
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

content/docs/automation/email-templates.mdx

@@ -86,8 +86,8 @@ never needs triple braces.
 element text and for a quoted attribute value that holds plain text, so those
 are the supported placements for `{{path}}`. A hole anywhere else — inside a
 `script` or `style` element, a comment, a tag outside any attribute value, an
-unquoted attribute value, or an attribute read as a URL (`href`, `src`, …), an
-event handler, a style or markup — is refused by `os validate`, `os build`,
+unquoted attribute value, an attribute read as a URL (`href`, `src`, …), an
+event handler, a style or markup, or SVG or MathML content — is refused by `os validate`, `os build`,
 `os lint` and the metadata publish door, and so is a `{{{path}}}` hole outside
 the `href` shape above. The refusal (`email-template-hole-placement`, a
 `422 INVALID_METADATA` at the publish door) names the placement and the

packages/formula/src/mail-html-hole-placement.ts

@@ -278,6 +278,8 @@ function classifyHolePositions(html: string, holes: ReadonlyArray<{ start: numbe
   let attrValueStart = -1;
   let declaration = '';
   let textElement = '';
+  /** Inside a script's text, past a comment opener and not yet past a closer. */
+  let scriptEscaped = false;
   let foreignDepth = 0;
 
   const emitTag = (selfClosing: boolean) => {
@@ -291,6 +293,7 @@ function classifyHolePositions(html: string, holes: ReadonlyArray<{ start: numbe
     }
     if (foreignDepth > 0) return 'data' as State;
     textElement = tagName;
+    scriptEscaped = false;
     if (tagName === 'plaintext') return 'plaintext' as State;
     if (RAW_TEXT_ELEMENTS.has(tagName)) return 'raw-text' as State;
     if (ESCAPABLE_TEXT_ELEMENTS.has(tagName)) return 'escapable-text' as State;
@@ -355,8 +358,16 @@ function classifyHolePositions(html: string, holes: ReadonlyArray<{ start: numbe
       continue;
     }
     const c = html[i];
+    // A script's text has escape states of its own, in which an end tag may
+    // not end the element. They are not modelled: from a comment opener on,
+    // the scan stays in raw text until an end tag that follows a comment
+    // closer, which can only refuse more than the parser would.
+    if (state === 'raw-text' && textElement === 'script') {
+      if (html.startsWith('<!--', i)) scriptEscaped = true;
+      else if (html.startsWith('-->', i)) scriptEscaped = false;
+    }
     // States that read more than one character at a time.
-    if ((state === 'raw-text' || state === 'escapable-text') && closesTextElement(i)) {
+    if ((state === 'raw-text' || state === 'escapable-text') && !scriptEscaped && closesTextElement(i)) {
       state = 'end-tag-open';
       tagName = '';
       endTag = true;
@@ -399,7 +410,9 @@ function classifyHolePositions(html: string, holes: ReadonlyArray<{ start: numbe
         if (c === '/') return 'end-tag-open';
         if (c === '?') return 'bogus-comment';
         if (isAlpha(c)) { tagName = c.toLowerCase(); endTag = false; return 'tag-name'; }
-        return 'data';
+        // A character that opens no tag is reconsumed in the data state, where
+        // only another `<` means anything.
+        return step('data', c);
       case 'end-tag-open':
         if (isAlpha(c)) { tagName = c.toLowerCase(); endTag = true; return 'tag-name'; }
         if (c === '>') return 'data';

packages/lint/src/runtime-gate.inert-type-writes.test.ts

@@ -57,6 +57,12 @@
  * proved by a TABLE PIN rather than a door reading — the size of that proof is
  * stated where those cases are, and it is why the string assertion in the
  * first block is load-bearing rather than decorative.
+ *
+ * [#25189] `email_template` is silent only for the liveness bridge now. Its
+ * writes also cross `validateEmailTemplateHolePlacements`, whose own door test
+ * (`validate-email-template-hole-placements.test.ts`) refuses a written
+ * template through `runRuntimeAuthoringRules`, so a wrong stack key for that
+ * type goes red there too. For `mapping` the table pin is still all there is.
  */
 import { describe, expect, it } from 'vitest';
 
@@ -705,6 +711,11 @@ describe('#19542 — group C: wired, dispatched, and silent by ledger (email_tem
    * assertion, `each stack key is the collection the crossed rules actually
    * read` in the first block of this file.
    *
+   * [#25189] For `email_template` that is no longer the whole proof: the hole
+   * placement rule judges its writes at this door, and its own test file
+   * reads the collection the key names. The paragraph below stands for
+   * `mapping`.
+   *
    * So for group C the wiring is held by a TABLE PIN, not a door reading. That
    * is acceptable under the ruling's fence (「the wiring is the whole
    * deliverable」, ⛔ no ledger population) — but it is the honest size of the