Address review angles A, D, Sweep: chain boundary, var-assign through render, docs

Multiple findings from the angles:

A1 — ChainNode boundary case (`(.Params).summary`): the
`Params`/`summary` adjacency straddles the receiver/Field
boundary. Neither half alone has the pair. Added tailIdents
to flatten a chain receiver into one Ident slice and check
for the pair across the boundary. Caught: bare ChainNode,
nested ChainNode `((.A).Params).summary`, and function-call
receiver via fallback recurse.

A2 — `{{ $s := .RenderString .Params.summary }}` was being
flagged as variable assignment of the raw summary, but the
RHS routes summary through RenderString so the bound name
holds template.HTML (rendered Markdown). Hugo emits
template.HTML without re-escaping, so a later `{{ $s }}`
ships rendered output. pipeAssignsSummary now skips the
flag when the RHS already outputs via RenderString.

Sweep #1 — Forbidden-forms list in docs was missing the
TemplateNode case (`{{ template "name" .Params.summary }}`
and the `{{ block }}` shorthand). Added.

Sweep #2 — Vacuous-pass guard was `scanned >= 5` but the
tree has 24 .html files. Raised to 20.

Sweep #3 — `assert.Empty(t, formatted)` had no diagnostic
message; sibling `ioErrors` line did. Added.

Sweep #4 / D1 — Commented the deliberate case-sensitivity
asymmetry: identsReferenceSummary uses EqualFold (Hugo
Params map is case-insensitive); cmdIsRenderString uses
`==` (Go method names are case-sensitive). Without the
comment a maintainer "normalising" one would silently
break the rule.

Sweep #7 / D6 — Commented the inner `if n == nil` guard
inside the *parse.ListNode case. The typed-nil ElseList
of an if-without-else bypasses the outer guard; removing
the inner check would re-introduce a panic.

tailIdents — pruned the unreachable VariableNode case (no
template syntax produces a ChainNode whose receiver is a
bare VariableNode; `$s.Field` parses as VariableNode with
the field appended to its own Ident). Per CLAUDE.md, no
defensive branch without a red/green driver.

Coverage: templatecheck package now at 100.0% of statements.

https://claude.ai/code/session_01Ly1xEwP5pfsLrtTCTKBQE3

Author: claude

docs/development/website-config.md

@@ -158,6 +158,12 @@ Forbidden forms:
 - `{{ range .Params.summary }}` — ranging over a
   string iterates rune-by-rune and emits each code
   point as an integer.
+- `{{ template "name" .Params.summary }}` and
+  `{{ block "name" .Params.summary }}` — these pass
+  the summary as the sub-template's dot. The
+  sub-template lives in a separate parse tree; the
+  scanner cannot follow the rebinding across the
+  boundary.
 - The bare `{{ .Params.summary }}` action.
 - Variable assignment in any context — `{{ $s := .Params.summary }}`,
   `{{ if $s := .Params.summary }}`,

internal/release/template_summary_test.go

@@ -61,11 +61,13 @@ func TestSummaryFrontMatterRenderedThroughRenderString(t *testing.T) {
 	for _, v := range violations {
 		formatted = append(formatted, fmt.Sprintf("%s:%d: %s", v.Path, v.Line, v.Why))
 	}
-	assert.Empty(t, formatted)
+	assert.Empty(t, formatted, "summary front-matter rendering violations")
 	assert.Empty(t, ioErrors, "filesystem errors during scan")
 	// Guard against the test passing vacuously if website/layouts/
-	// ever disappears or the walker is misconfigured: at least the
-	// `_default/baseof.html` + four page-rendering layouts must
-	// have been scanned.
-	assert.GreaterOrEqual(t, scanned, 5, "expected to scan at least 5 .html files; got %d", scanned)
+	// ever disappears or the walker is misconfigured. The tree
+	// currently holds 24 .html files (_default/, partials/,
+	// shortcodes/, _markup/, rule/, index.html); set the floor at
+	// 20 to catch a catastrophic regression while leaving headroom
+	// for legitimate template cleanup.
+	assert.GreaterOrEqual(t, scanned, 20, "expected to scan at least 20 .html files; got %d", scanned)
 }

internal/templatecheck/templatecheck.go

@@ -113,6 +113,13 @@ func (w *walker) walk(n parse.Node) {
 	}
 	switch n := n.(type) {
 	case *parse.ListNode:
+		// IfNode.ElseList / WithNode.ElseList / RangeNode.ElseList
+		// are *parse.ListNode pointers that are nil when no `else`
+		// clause is present. A nil typed pointer wrapped in a
+		// non-nil interface bypasses the outer `if n == nil` guard,
+		// so this inner check is what saves us from dereferencing
+		// it. Removing it would re-introduce a panic in every
+		// `{{ if ... }}...{{ end }}` template without an else.
 		if n == nil {
 			return
 		}
@@ -206,9 +213,40 @@ func identsReferenceSummary(idents []string) bool {
 }
 
 func fieldIsSummary(f *parse.FieldNode) bool       { return identsReferenceSummary(f.Ident) }
-func chainIsSummary(c *parse.ChainNode) bool       { return identsReferenceSummary(c.Field) }
 func variableIsSummary(v *parse.VariableNode) bool { return identsReferenceSummary(v.Ident) }
 
+// chainIsSummary checks whether a ChainNode flattens to a chain
+// containing `Params.summary` — including the boundary case
+// `(.Params).summary` where the adjacency straddles the receiver
+// and the trailing Field list (receiver ends with `Params`, Field
+// starts with `summary`). Without the flatten step the trailing
+// Field `[summary]` alone has no `Params`-`summary` pair.
+func chainIsSummary(c *parse.ChainNode) bool {
+	return identsReferenceSummary(append(tailIdents(c.Node), c.Field...))
+}
+
+// tailIdents extracts the terminal identifier chain of a chain
+// receiver. For FieldNode it's the Ident slice. For a ChainNode
+// receiver it recurses and concatenates. For a PipeNode wrapping
+// a single expression in parens — the common `(...)` receiver
+// shape — it unwraps to the wrapped node. Returns nil for shapes
+// the flattener cannot trace (multi-cmd pipes, function calls);
+// callers that need to scan those fall back to
+// pipeReferencesSummary, which handles arbitrary arg nesting.
+func tailIdents(n parse.Node) []string {
+	switch x := n.(type) {
+	case *parse.FieldNode:
+		return x.Ident
+	case *parse.ChainNode:
+		return append(tailIdents(x.Node), x.Field...)
+	case *parse.PipeNode:
+		if len(x.Cmds) == 1 && len(x.Cmds[0].Args) == 1 {
+			return tailIdents(x.Cmds[0].Args[0])
+		}
+	}
+	return nil
+}
+
 func pipeReferencesSummary(p *parse.PipeNode) bool {
 	if p == nil {
 		return false
@@ -253,15 +291,22 @@ func argReferencesSummary(arg parse.Node) bool {
 
 // pipeAssignsSummary returns true if the pipe — or any sub-pipe
 // nested inside one of its command args — declares variables
-// whose right-hand value references the summary. The recursion
-// catches forms like `{{ .RenderString (dict) ($s := .Params.summary) }}`
-// where the binding hides in a sub-pipeline arg and the outer
-// pipe's Decl is empty.
+// whose right-hand value is the raw summary. An assignment whose
+// right-hand pipe routes summary through `.RenderString` first
+// is safe: the bound name holds rendered HTML (a `template.HTML`
+// value Hugo emits without re-escaping), so a later `{{ $s }}`
+// ships the rendered output, not the raw Markdown.
+//
+// The recursion catches forms like
+// `{{ .RenderString (dict) ($s := .Params.summary) }}` where the
+// binding hides in a sub-pipeline arg and the outer pipe's Decl
+// is empty.
 func pipeAssignsSummary(p *parse.PipeNode) bool {
 	if p == nil {
 		return false
 	}
-	if len(p.Decl) > 0 && pipeReferencesSummary(p) {
+	if len(p.Decl) > 0 && pipeReferencesSummary(p) &&
+		!pipeOutputsSummaryViaRenderString(p) {
 		return true
 	}
 	for _, c := range p.Cmds {
@@ -327,6 +372,13 @@ func pipeOutputsSummaryViaRenderString(p *parse.PipeNode) bool {
 // (multi-Ident FieldNode), the dollar-context `$.RenderString`
 // (VariableNode with Ident `["$", "RenderString"]`), and chain
 // receivers (ChainNode).
+//
+// Comparison is intentionally case-sensitive (`== "RenderString"`),
+// not case-insensitive as elsewhere in this file. Hugo's
+// `.RenderString` is a Go method on the Page receiver; Go reflects
+// methods by exact name and would not dispatch `.renderstring` to
+// it. The Params map, by contrast, is a case-insensitive lookup —
+// that's why identsReferenceSummary uses EqualFold.
 func cmdIsRenderString(c *parse.CommandNode) bool {
 	if len(c.Args) == 0 {
 		return false

internal/templatecheck/templatecheck_test.go

@@ -215,6 +215,76 @@ func TestScan_ChainReceiver(t *testing.T) {
 	require.Len(t, got, 1)
 }
 
+// TestScan_ChainBoundary pins the boundary case where the
+// `Params`/`summary` adjacency straddles the chain receiver and
+// the trailing field list. Receiver ends with `Params`, Field
+// starts with `summary` — neither half alone has the pair, but
+// the flattened chain does. Also exercises nested ChainNode
+// receivers and the fallback recurse when tailIdents cannot
+// trace a complex receiver.
+func TestScan_ChainBoundary(t *testing.T) {
+	cases := []struct {
+		name      string
+		template  string
+		wantCount int
+	}{
+		{"params receiver dot summary bare", `{{ (.Params).summary }}`, 1},
+		{"params receiver dot summary rendered", `{{ .RenderString (dict) (.Params).summary }}`, 0},
+		// Nested ChainNode receiver: tailIdents recurses through
+		// each chain level and stitches the Idents into one slice.
+		{"nested chain with boundary", `{{ ((.A).Params).summary }}`, 1},
+		// Function-call receiver — tailIdents returns nil (multi-arg
+		// command); argReferencesSummary's fallback recurse into
+		// n.Node via pipeReferencesSummary catches the summary buried
+		// inside the printf args.
+		{"function-call receiver", `{{ (printf "%s" .Params.summary).Field }}`, 1},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := Scan("file.html", tc.template)
+			require.NoError(t, err)
+			assert.Len(t, got, tc.wantCount, "violations: %+v", got)
+		})
+	}
+}
+
+// TestScan_VarAssignWithRender pins that an assignment whose
+// right-hand pipe routes summary through `.RenderString` is
+// SAFE. The bound name holds rendered HTML (template.HTML),
+// not raw Markdown — Hugo emits template.HTML without
+// re-escaping, so a later `{{ $s }}` ships rendered output.
+// Only assignments of the raw value are flagged.
+func TestScan_VarAssignWithRender(t *testing.T) {
+	cases := []struct {
+		name      string
+		template  string
+		wantCount int
+	}{
+		{
+			"var := raw summary is flagged",
+			`{{ $s := .Params.summary }}{{ $s }}`,
+			1,
+		},
+		{
+			"var := rendered summary is safe",
+			`{{ $s := .RenderString (dict) .Params.summary }}{{ $s }}`,
+			0,
+		},
+		{
+			"if-var := rendered summary is safe",
+			`{{ if $s := .RenderString (dict) .Params.summary }}{{ $s }}{{ end }}`,
+			0,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := Scan("file.html", tc.template)
+			require.NoError(t, err)
+			assert.Len(t, got, tc.wantCount, "violations: %+v", got)
+		})
+	}
+}
+
 // TestScan_SubPipeVarAssign pins detection of variable assignment
 // hidden inside a sub-pipeline argument:
 // `{{ .RenderString (dict) ($s := .Params.summary) }}` —