diff --git a/vulnhunter-agent/agent/issues_render.py b/vulnhunter-agent/agent/issues_render.py
index 76feb63..4a46473 100644
--- a/vulnhunter-agent/agent/issues_render.py
+++ b/vulnhunter-agent/agent/issues_render.py
@@ -101,6 +101,35 @@ def render_title(f: Finding) -> str:
 _MD_ESCAPE_CHARS = ("\\", "`", "[", "]")
 
 
+# Machine-readable footer markers (``<!-- vulnhunt-finding-id: ... -->`` etc.)
+# are intentionally NOT html.escaped so the marker regexes stay exact. But the
+# values (``f.id``, ``report.results_dir_name``) are attacker-influenced
+# LLM/scan-README data, so a value containing ``-->`` would close the comment
+# and inject arbitrary markdown/HTML (CWE-79 / CWE-116). Restrict marker values
+# to a strict identifier charset — the same class the downstream parsers accept
+# (``VULN-\d{3}`` / ``[A-Za-z0-9._-]+_VULNHUNT_RESULTS_...``) — dropping any
+# other char. Removing '<' and '>' makes a comment breakout impossible while
+# keeping legitimate ids/dir-names intact.
+_MARKER_UNSAFE_RE = re.compile(r"[^A-Za-z0-9._-]")
+
+
+def _sanitize_marker_value(value: str, marker: str = "marker") -> str:
+    """Restrict an HTML-comment marker value to a safe identifier charset so it
+    cannot break out of the surrounding ``<!-- ... -->`` (CWE-116).
+
+    Stripping can turn a value into a *different* identifier (e.g. a
+    results-dir name that now points at another directory), so any change is
+    logged as a warning rather than happening silently."""
+    raw = value or ""
+    cleaned = _MARKER_UNSAFE_RE.sub("", raw)
+    if cleaned != raw:
+        logger.warning(
+            "Stripped out-of-charset characters from %s marker value: %r -> %r",
+            marker, raw, cleaned,
+        )
+    return cleaned
+
+
 def _sanitize_for_issue_body(value: str) -> str:
     """Neutralize attacker-influenced Finding text before it lands in a
     GitHub issue body (CWE-79).
@@ -118,6 +147,40 @@ def _sanitize_for_issue_body(value: str) -> str:
     return s
 
 
+def _sanitize_inline(value: str) -> str:
+    """``_sanitize_for_issue_body`` for fields rendered on a single line —
+    the ``### Finding`` table cells and the H2 title / Priority line.
+
+    Additionally escapes ``|`` as ``\\|`` (GFM's in-cell pipe escape; it
+    renders as a plain ``|`` outside a table too) so a value cannot add or
+    forge table cells, and collapses CR/LF runs to one space so it cannot end
+    the row/heading and inject block markdown (PR #9 review, CWE-116).
+    Multi-line free-form sections keep using ``_sanitize_for_issue_body``.
+    """
+    s = _sanitize_for_issue_body(value).replace("|", "\\|")
+    return re.sub(r"[\r\n]+", " ", s)
+
+
+_PLACEHOLDER_RE = re.compile(r"\{([A-Z_]+)\}")
+
+
+def _substitute(template: str, fields: dict[str, str]) -> tuple[str, set[str]]:
+    """Fill ``{NAME}`` placeholders in ONE pass over the template.
+
+    Field-by-field ``str.replace`` re-scanned already-substituted values, so
+    attacker text containing e.g. ``{IDEMPOTENCY_KEY}`` was expanded by a
+    later pass. Returns (body, template placeholders with no field)."""
+    missing: set[str] = set()
+
+    def repl(m: re.Match[str]) -> str:
+        if m.group(1) in fields:
+            return fields[m.group(1)]
+        missing.add(m.group(1))
+        return m.group(0)
+
+    return _PLACEHOLDER_RE.sub(repl, template), missing
+
+
 def render_body(
     f: Finding,
     *,
@@ -132,14 +195,17 @@ def render_body(
     anchor = _github_anchor(f"{f.id}: {f.title}") if f.id else ""
     deep_link = f"{report_url}#{anchor}" if anchor else report_url
     fields = {
-        # Attacker-influenced Finding fields — sanitized (CWE-79).
-        "TITLE": _sanitize_for_issue_body(f.title or "(untitled)"),
-        "CWE": _sanitize_for_issue_body(f.cwe or "Unknown CWE"),
-        "CWE_NAME": _sanitize_for_issue_body(f.cwe_name or "(unspecified)"),
-        "SEVERITY": _sanitize_for_issue_body(f.severity or "Unspecified"),
-        "LOCATION": _sanitize_for_issue_body(f.location or "(not specified)"),
-        "ROOT_CAUSE": _sanitize_for_issue_body(f.root_cause or "(not specified)"),
-        "DATA_FLOW": _sanitize_for_issue_body(f.data_flow or "(not specified)"),
+        # Attacker-influenced Finding fields — sanitized (CWE-79). Fields that
+        # render on a single line (``### Finding`` table cells, the H2 title,
+        # the Priority line) also get '|' escaped and CR/LF collapsed.
+        "TITLE": _sanitize_inline(f.title or "(untitled)"),
+        "CWE": _sanitize_inline(f.cwe or "Unknown CWE"),
+        "CWE_NAME": _sanitize_inline(f.cwe_name or "(unspecified)"),
+        "SEVERITY": _sanitize_inline(f.severity or "Unspecified"),
+        "LOCATION": _sanitize_inline(f.location or "(not specified)"),
+        "ROOT_CAUSE": _sanitize_inline(f.root_cause or "(not specified)"),
+        "DATA_FLOW": _sanitize_inline(f.data_flow or "(not specified)"),
+        # Free-form multi-line sections — newlines are legitimate here.
         "EXPLOIT_DESCRIPTION": _sanitize_for_issue_body(
             f.exploit_description or "(not specified in report)"
         ),
@@ -155,14 +221,16 @@ def render_body(
         "SCAN_DATE": report.scan_date,
         "REPORT_URL": deep_link,
         "REPORT_ACCESS_MESSAGE": _report_access_message(),
-        "IDEMPOTENCY_KEY": f.vulnfix_key,
-        "VULN_ID": f.id,
-        "RESULTS_DIR_NAME": report.results_dir_name,
+        # Marker values are NOT html.escaped (keeps the marker regexes exact)
+        # but ARE restricted to a safe identifier charset so an attacker-
+        # influenced value cannot break out of the HTML comment (CWE-116).
+        "IDEMPOTENCY_KEY": _sanitize_marker_value(f.vulnfix_key, "vulnfix-key"),
+        "VULN_ID": _sanitize_marker_value(f.id, "vulnhunt-finding-id"),
+        "RESULTS_DIR_NAME": _sanitize_marker_value(
+            report.results_dir_name, "vulnhunt-results-dir"
+        ),
     }
-    body = template
-    for key, value in fields.items():
-        body = body.replace("{" + key + "}", value)
-    leftovers = _find_placeholders(body)
+    body, leftovers = _substitute(template, fields)
     if leftovers:
         logger.warning(
             "Template placeholders unfilled in rendered body: %s", sorted(leftovers)
@@ -170,10 +238,6 @@ def render_body(
     return body
 
 
-def _find_placeholders(body: str) -> set[str]:
-    return set(re.findall(r"\{([A-Z_]+)\}", body))
-
-
 @dataclass(frozen=True)
 class CleanScanContext:
     """Values needed to render a clean-scan issue or comment.
@@ -251,10 +315,7 @@ def _render_clean_scan(ctx: CleanScanContext, template_path: Path) -> str:
         "SKILL_VERSION": ctx.skill_version or "unknown",
         "REPORT_URL_LINE": report_line,
     }
-    body = template
-    for key, value in fields.items():
-        body = body.replace("{" + key + "}", value)
-    leftovers = _find_placeholders(body)
+    body, leftovers = _substitute(template, fields)
     if leftovers:
         logger.warning(
             "Clean-scan template placeholders unfilled: %s", sorted(leftovers)
diff --git a/vulnhunter-agent/tests/test_issues_render.py b/vulnhunter-agent/tests/test_issues_render.py
index 666aca6..3ef03bb 100644
--- a/vulnhunter-agent/tests/test_issues_render.py
+++ b/vulnhunter-agent/tests/test_issues_render.py
@@ -309,3 +309,172 @@ def test_compact_shape(self) -> None:
         assert "abc1234" in comment
         assert "757 seconds" in comment
         assert "2026-07-06T18:42:51Z" in comment
+
+
+class TestMarkerCommentBreakout:
+    """CANON-21: attacker-influenced marker fields must not break out of the
+    HTML-comment footer markers (CWE-79 / CWE-116).
+
+    ``f.id`` and ``report.results_dir_name`` are stamped verbatim into
+    ``<!-- vulnhunt-finding-id: {VULN_ID} -->`` /
+    ``<!-- vulnhunt-results-dir: {RESULTS_DIR_NAME} -->``. Both originate from
+    LLM/scan-README-derived data, so a value containing ``-->`` would close the
+    comment early and inject arbitrary markdown/HTML into the rendered issue.
+    """
+
+    def test_finding_id_cannot_break_out_of_comment(self) -> None:
+        body = render_body(
+            _finding(id="VULN-001 --><script>injected</script><!--"),
+            report=_report(),
+            report_url="https://example/README.md",
+        )
+        # The injected breakout + payload must not appear un-neutralized.
+        assert "--><script>injected</script>" not in body
+        assert "<script>injected</script>" not in body
+        # The finding-id marker line stays a single well-formed comment: exactly
+        # one closing '-->' on that line and no injected content after it.
+        marker_line = next(
+            l for l in body.splitlines() if "vulnhunt-finding-id" in l
+        )
+        assert marker_line.count("-->") == 1
+        assert marker_line.rstrip().endswith("-->")
+
+    def test_results_dir_cannot_break_out_of_comment(self) -> None:
+        body = render_body(
+            _finding(),
+            report=_report(
+                results_dir_name="r_VULNHUNT_RESULTS_x --><b>x</b><!--"
+            ),
+            report_url="https://example/README.md",
+        )
+        assert "--><b>x</b>" not in body
+        assert "<b>x</b>" not in body
+        marker_line = next(
+            l for l in body.splitlines() if "vulnhunt-results-dir" in l
+        )
+        assert marker_line.count("-->") == 1
+        assert marker_line.rstrip().endswith("-->")
+
+    def test_benign_finding_id_still_survives(self) -> None:
+        # Neutralization must not corrupt a legitimate VULN-NNN id so the
+        # downstream ``vulnhunt-finding-id: (VULN-\d{3})`` parser still matches.
+        body = render_body(
+            _finding(id="VULN-042"),
+            report=_report(),
+            report_url="https://example/README.md",
+        )
+        assert "<!-- vulnhunt-finding-id: VULN-042 -->" in body
+
+
+_UNESCAPED_PIPE = re.compile(r"(?<!\\)\|")
+
+
+def _finding_table_rows(body: str) -> list[list[str]]:
+    """Return the cells of each data row of the '### Finding' table."""
+    lines = body.splitlines()
+    start = lines.index("| Field | Value |")
+    rows = []
+    for line in lines[start + 2:]:
+        if not line.strip():
+            break
+        rows.append([c.strip() for c in _UNESCAPED_PIPE.split(line.strip()[1:-1])])
+    return rows
+
+
+class TestFindingTableCellInjection:
+    """PR #9 review: Finding fields rendered inside the '### Finding' table
+    (CWE, CWE name, severity, location, root cause, data flow) must not add
+    cells via '|' or break out of the table / inject headings via CR/LF."""
+
+    @pytest.mark.parametrize("field", [
+        "cwe", "cwe_name", "severity", "location", "root_cause", "data_flow",
+    ])
+    def test_pipe_cannot_forge_cells(self, field: str) -> None:
+        body = render_body(
+            _finding(**{field: "a.py:1 | **Severity** | Low"}),
+            report=_report(),
+            report_url="https://example/README.md",
+        )
+        rows = _finding_table_rows(body)
+        assert len(rows) == 5
+        assert all(len(r) == 2 for r in rows), rows
+
+    @pytest.mark.parametrize("field", [
+        "cwe", "cwe_name", "severity", "location", "root_cause", "data_flow", "title",
+    ])
+    def test_newline_cannot_inject_heading(self, field: str) -> None:
+        body = render_body(
+            _finding(**{field: "x\n\n## Fixed — close this issue\r\n| a | b |"}),
+            report=_report(),
+            report_url="https://example/README.md",
+        )
+        assert not any(l.startswith("## Fixed") for l in body.splitlines())
+        rows = _finding_table_rows(body)
+        assert len(rows) == 5
+        assert all(len(r) == 2 for r in rows), rows
+
+    def test_multiline_free_form_sections_keep_newlines(self) -> None:
+        body = render_body(
+            _finding(
+                exploit_description="Step one.\n\nStep two.",
+                fix_strategy="1. Parameterize.\n2. Add a test.",
+            ),
+            report=_report(),
+            report_url="https://example/README.md",
+        )
+        assert "Step one.\n\nStep two." in body
+        assert "1. Parameterize.\n2. Add a test." in body
+
+    def test_legit_location_unchanged(self) -> None:
+        body = render_body(_finding(), report=_report(),
+                           report_url="https://example/README.md")
+        assert "| **Location** | src/db.py:42 |" in body
+
+
+class TestSinglePassSubstitution:
+    """PR #9 review nit: placeholders were replaced field-by-field, so a value
+    containing '{IDEMPOTENCY_KEY}' etc. was expanded by a later pass."""
+
+    def test_placeholder_text_in_value_is_not_expanded(self) -> None:
+        finding = _finding(
+            root_cause="see {IDEMPOTENCY_KEY} and {REPORT_URL}",
+            title="{VULN_ID}",
+        )
+        body = render_body(finding, report=_report(),
+                           report_url="https://example/README.md")
+        assert "see {IDEMPOTENCY_KEY} and {REPORT_URL}" in body
+        assert body.count(finding.vulnfix_key) == 1  # only the footer marker
+        assert "## Security Finding: CWE-89 — {VULN_ID}" in body
+
+    def test_placeholder_text_in_value_does_not_warn(self, caplog) -> None:
+        with caplog.at_level("WARNING", logger="agent.issues_render"):
+            render_body(_finding(root_cause="{NOT_A_FIELD}"), report=_report(),
+                        report_url="https://example/README.md")
+        assert "unfilled" not in caplog.text
+
+    def test_clean_scan_value_is_not_expanded(self) -> None:
+        body = render_clean_scan_body(_clean_scan_ctx(repo_slug="o/{SKILL_VERSION}"))
+        assert "o/{SKILL_VERSION}" in body
+        assert "o/3500d0c-clean" not in body  # never expanded by a later pass
+
+
+class TestMarkerSanitizeWarns:
+    """PR #9 review: _sanitize_marker_value silently stripped out-of-charset
+    chars, which can yield a marker pointing at a different results dir."""
+
+    def test_changed_marker_value_logs_warning(self, caplog) -> None:
+        with caplog.at_level("WARNING", logger="agent.issues_render"):
+            body = render_body(
+                _finding(),
+                report=_report(results_dir_name="r_VULNHUNT_RESULTS_a b/../c"),
+                report_url="https://example/README.md",
+            )
+        assert "<!-- vulnhunt-results-dir: r_VULNHUNT_RESULTS_ab..c -->" in body
+        assert "vulnhunt-results-dir" in caplog.text
+        assert "r_VULNHUNT_RESULTS_a b/../c" in caplog.text
+
+    def test_clean_marker_values_do_not_warn(self, caplog) -> None:
+        with caplog.at_level("WARNING", logger="agent.issues_render"):
+            render_body(_finding(), report=_report(),
+                        report_url="https://example/README.md")
+        assert caplog.text == ""
diff --git a/vulnhunter-fix/references/verification-table-rules.md b/vulnhunter-fix/references/verification-table-rules.md
index a59e087..1112f8a 100644
--- a/vulnhunter-fix/references/verification-table-rules.md
+++ b/vulnhunter-fix/references/verification-table-rules.md
@@ -18,6 +18,12 @@ via `render_verification_table`), workers MUST emit these exact 9 headers
 in this order — any drift (renaming, dropping `#`, adding a `Sink`
 column) is rejected at delivery time by `scripts/validate-verification.py`.
 
+Every row MUST have exactly nine cells. A literal `|` inside a cell is
+written `\|` (GFM's in-cell escape) and a cell never contains a line break;
+`render_verification_table` does both via `_escape_table_cell`. The
+validator splits only on unescaped pipes and rejects (exit 1, naming the row)
+any row whose cell count differs from the header — rows are never skipped.
+
 ## Cell values (REQ-GRA-012)
 
 Each cell is one of the following literal strings:
diff --git a/vulnhunter-fix/scripts/validate-verification.py b/vulnhunter-fix/scripts/validate-verification.py
index 9196a9a..82e101f 100755
--- a/vulnhunter-fix/scripts/validate-verification.py
+++ b/vulnhunter-fix/scripts/validate-verification.py
@@ -28,6 +28,7 @@
 from __future__ import annotations
 
 import argparse
+import html
 import json
 import re
 import sys
@@ -53,7 +54,43 @@
 CELL_NA = re.compile(r"^\s*n\s*/\s*a\s*$", re.IGNORECASE)
 
 
+# GFM splits a table row on pipes that are NOT backslash-escaped; ``\|`` is a
+# literal pipe inside a cell. vulnhunter_fix.delivery._escape_table_cell emits
+# exactly that escape, plus backslash-escaped markdown punctuation and
+# html-escaped ``<>&`` — _decode_cell reverses both so citations and callers
+# are checked against their literal text.
+_UNESCAPED_PIPE_RE = re.compile(r"(?<!\\)\|")
+_MD_BACKSLASH_ESCAPE_RE = re.compile(r"\\([!-/:-@\[-`{-~])")
+
+
+class MalformedTableError(ValueError):
+    """A verification-table row does not have exactly the header's cell count."""
+
+
+def _decode_cell(cell: str) -> str:
+    return html.unescape(_MD_BACKSLASH_ESCAPE_RE.sub(r"\1", cell.strip()))
+
+
+def _split_row(line: str) -> list[str]:
+    s = line.strip()
+    if s.startswith("|"):
+        s = s[1:]
+    if s.endswith("|") and not s.endswith("\\|"):
+        s = s[:-1]
+    return [_decode_cell(c) for c in _UNESCAPED_PIPE_RE.split(s)]
+
+
 def _parse_table(text: str) -> tuple[list[str], list[list[str]]] | None:
+    """Return (header_cells, rows) or None when no verification table exists.
+
+    Fails closed: raises MalformedTableError naming every row whose cell
+    count differs from the header. Previously such rows were silently
+    dropped, so an injected ``|`` (extra cells, forged Verdict) or a CR/LF
+    (short row) removed the row from validation entirely and the gate
+    exited 0 (PR #9 review). Rows run until the first blank line, matching
+    GFM, where a leading pipe is optional — so a newline-broken row's
+    continuation is a row too.
+    """
     lines = text.splitlines()
     header_idx = None
     for i, line in enumerate(lines):
@@ -62,14 +99,23 @@ def _parse_table(text: str) -> tuple[list[str], list[list[str]]] | None:
             break
     if header_idx is None:
         return None
-    header_cells = [c.strip() for c in lines[header_idx].strip("|").split("|")]
+    header_cells = _split_row(lines[header_idx])
     rows = []
-    for line in lines[header_idx + 2:]:
-        if not line.strip().startswith("|"):
+    malformed = []
+    for lineno, line in enumerate(lines[header_idx + 2:], start=header_idx + 3):
+        if not line.strip():
             break
-        cells = [c.strip() for c in line.strip("|").split("|")]
-        if len(cells) == len(header_cells):
-            rows.append(cells)
+        cells = _split_row(line)
+        if len(cells) != len(header_cells):
+            malformed.append(
+                f"row {len(rows) + len(malformed) + 1} (line {lineno}): expected "
+                f"{len(header_cells)} cells, got {len(cells)} — unescaped '|' or "
+                f"line break in a cell? {line.strip()[:160]!r}"
+            )
+            continue
+        rows.append(cells)
+    if malformed:
+        raise MalformedTableError("\n".join(malformed))
     return header_cells, rows
 
 
@@ -237,7 +283,12 @@ def validate(pr_body: Path, worktree: Path, sidecars_dir: Path | None, result_pa
         print(f"{pr_body}: <io>: {exc}", file=sys.stderr)
         return 2
 
-    parsed = _parse_table(text)
+    try:
+        parsed = _parse_table(text)
+    except MalformedTableError as exc:
+        for msg in str(exc).splitlines():
+            print(f"{pr_body}: <table>: {msg}", file=sys.stderr)
+        return 1
     if not parsed:
         print(f"{pr_body}: <table>: 9-column verification table not found", file=sys.stderr)
         return 1
diff --git a/vulnhunter-fix/tests/test_hand_wave_guard.py b/vulnhunter-fix/tests/test_hand_wave_guard.py
index 1b7023e..2442b82 100644
--- a/vulnhunter-fix/tests/test_hand_wave_guard.py
+++ b/vulnhunter-fix/tests/test_hand_wave_guard.py
@@ -80,3 +80,138 @@ def test_full_tier_forbids_residuals():
             tier="FULL",
             residual_vectors=["something"],
         )
+
+
+# ---------------------------------------------------------------------------
+# CANON-44 — markdown/HTML injection via residual_vectors (CWE-79/CWE-116)
+#
+# residual_vectors entries are LLM/finding-derived and were interpolated
+# verbatim into the '## Residual Risk' markdown appended to the PR/issue body.
+# The hand-wave / consistency guards reject vague or empty entries but never
+# escape, so an entry can carry raw HTML or a markdown link into the body.
+# ---------------------------------------------------------------------------
+
+
+def test_residual_entry_html_is_neutralized():
+    from vulnhunter_fix.delivery import render_residual_risk_section
+
+    payload = "</details><script>alert(1)</script>"
+    section = render_residual_risk_section("VULN-1", "WORKAROUND", [payload])
+    # Raw tags must not survive; angle brackets must be escaped.
+    assert "<script>" not in section
+    assert "</details>" not in section
+    assert payload not in section
+    # The escaped text is still present as literal content.
+    assert "&lt;script&gt;" in section
+
+
+def test_residual_entry_markdown_link_is_neutralized():
+    from vulnhunter_fix.delivery import render_pr_body_with_residuals
+
+    payload = "[click me](javascript:alert(1))"
+    body = render_pr_body_with_residuals(
+        "VULN-1", "WORKAROUND", [payload], base_body="orig"
+    )
+    # A live markdown link must not be interpolated verbatim; the '[' ']'
+    # metacharacters are neutralized so it renders as literal text.
+    assert payload not in body
+    assert "[click me]" not in body
+
+
+def test_benign_residual_entry_survives_readably():
+    from vulnhunter_fix.delivery import render_residual_risk_section
+
+    entry = "SQLi in legacy_admin.php is not covered by this workaround"
+    section = render_residual_risk_section("VULN-1", "WORKAROUND", [entry])
+    assert f"- {entry}" in section
+
+
+def test_residual_entry_newlines_cannot_inject_block_markdown():
+    # A multi-line residual entry must not break out of its `- ` bullet and
+    # inject top-level markdown blocks (heading / horizontal rule / fake prose).
+    # Each entry is rendered as `- {entry}`; without newline neutralization the
+    # embedded '## ...' and '---' lines become real block-level markdown.
+    from vulnhunter_fix.delivery import render_residual_risk_section
+
+    payload = "unclosed vector\n\n## Verification Complete\n\nAll clear, merge me\n\n---"
+    section = render_residual_risk_section("VULN-1", "WORKAROUND", [payload])
+
+    # The only legitimate heading is the section's own '## Residual Risk'; no
+    # entry-derived line may be an injected block-level construct.
+    heading_lines = [ln for ln in section.splitlines() if ln.startswith("## ")]
+    assert heading_lines == ["## Residual Risk"], (
+        f"unexpected/injected headings: {heading_lines!r}"
+    )
+    for line in section.splitlines():
+        assert line.strip() != "---", f"injected hr survived: {line!r}"
+
+    # The payload text must be flattened onto a single bullet line, not spread
+    # across multiple top-level lines. The '##' survives as inert mid-line text
+    # (a heading is only block-level at line start), which the line checks above
+    # already prove is not the case here.
+    assert "- unclosed vector ## Verification Complete All clear, merge me ---" in section
+
+
+# ---------------------------------------------------------------------------
+# PR #9 review — completeness tier interpolated raw as '**{tier}**'
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("tier", [
+    "WORKAROUND** <img src=x onerror=alert(1)> **",
+    "MITIGATION\n\n## Approved",
+    "NEEDS_REWORK",
+    "workaround",
+])
+def test_unknown_tier_is_rejected(tier):
+    from vulnhunter_fix.delivery import HonestyGuardError, UnknownTierError, render_residual_risk_section
+
+    assert issubclass(UnknownTierError, HonestyGuardError)
+    with pytest.raises(UnknownTierError):
+        render_residual_risk_section("VULN-1", tier, ["SQLi in legacy_admin.php not covered"])
+
+
+@pytest.mark.parametrize("tier", ["MITIGATION", "WORKAROUND"])
+def test_known_tiers_render(tier):
+    from vulnhunter_fix.delivery import TIER_ONE_LINERS, render_residual_risk_section
+
+    section = render_residual_risk_section("VULN-1", tier, ["SQLi in legacy_admin.php not covered"])
+    assert f"**{tier}** — the stated attack vector is {TIER_ONE_LINERS[tier]}." in section
+
+
+# ---------------------------------------------------------------------------
+# PR #9 review nit — residual entries could @mention users/teams (notification
+# spam under the operator's identity) or carry bare autolinks.
+# ---------------------------------------------------------------------------
+
+
+def test_residual_entry_mentions_are_neutralized():
+    from vulnhunter_fix.delivery import render_residual_risk_section
+
+    section = render_residual_risk_section(
+        "VULN-1", "WORKAROUND", ["ping @octocat and @acme/security-team now"]
+    )
+    assert "@octocat" not in section
+    assert "@acme/security-team" not in section
+    # Still readable: a zero-width space reference sits between '@' and the name.
+    assert "@&#8203;octocat" in section
+
+
+@pytest.mark.parametrize("payload, live", [
+    ("details at https://evil.example/phish", "https://"),
+    ("details at http://evil.example/phish", "http://"),
+    ("see www.evil.example for details", "www.evil"),
+])
+def test_residual_entry_bare_autolinks_are_broken(payload, live):
+    from vulnhunter_fix.delivery import render_residual_risk_section
+
+    section = render_residual_risk_section("VULN-1", "WORKAROUND", [payload])
+    assert live not in section
+
+
+def test_residual_entry_plain_prose_with_at_and_colon_unchanged():
+    from vulnhunter_fix.delivery import render_residual_risk_section
+
+    entry = "Rate limit @ 10 rps: /login endpoint not covered"
+    section = render_residual_risk_section("VULN-1", "WORKAROUND", [entry])
+    assert f"- {entry}" in section
diff --git a/vulnhunter-fix/tests/test_sweep_and_verification.py b/vulnhunter-fix/tests/test_sweep_and_verification.py
index 257a42b..0d1113c 100644
--- a/vulnhunter-fix/tests/test_sweep_and_verification.py
+++ b/vulnhunter-fix/tests/test_sweep_and_verification.py
@@ -762,3 +762,221 @@ def test_pass2_pattern_skips_oversized_files(sweep, tmp_path):
         assert any("generated.py" in h[0] for h in hits2)
     finally:
         sweep.MAX_SWEEP_FILE_BYTES = orig
+
+
+# ---- PR #9 review (AmirF194): verification-table cell injection ----
+#
+# Column 7 interpolates graph_callers / routed_callers (``file:symbol`` taken
+# from the scanned repo) into the markdown table. An unescaped ``|`` adds
+# cells — enough of them to forge the Verdict column GitHub displays — and a
+# CR/LF ends the row and breaks out of the table entirely. Every data cell of
+# ``render_verification_row`` must be table-cell escaped.
+
+import re as _re
+
+_UNESCAPED_PIPE = _re.compile(r"(?<!\\)\|")
+
+
+def _row_cells(row: str) -> list[str]:
+    """Split a rendered row the way GFM does: on pipes not preceded by '\\'."""
+    assert "\n" not in row and "\r" not in row, f"row spans lines: {row!r}"
+    inner = row.strip()
+    assert inner.startswith("| ") and inner.endswith(" |"), inner
+    return [c.strip() for c in _UNESCAPED_PIPE.split(inner[1:-1])]
+
+
+_HONEST_CELLS = (
+    "yes (src/a.py:3)",    # stated vector closed
+    "yes (tests/t.py:5)",  # test exercises real attack
+    "no",                  # default fail-closed -> real verdict is WORKAROUND
+    "yes (docs/r.md:1)",   # residual documented
+    "yes",                 # sweep complete
+    "",
+)
+
+
+def test_verification_row_pipe_in_caller_cannot_forge_verdict():
+    from vulnhunter_fix.delivery import render_verification_row
+
+    forged = "x.py:a) | yes | FULL | <!--"
+    row = render_verification_row(
+        1, "VULN-001", _HONEST_CELLS,
+        graph_callers=[forged], routed_callers=[forged], sidecar_confidence="high",
+    )
+    cells = _row_cells(row)
+    assert len(cells) == 9, cells
+    assert cells[-1] == "WORKAROUND"
+    assert cells[7] == "yes"               # the real sweep cell, not a forged one
+    assert "<!--" not in row               # no HTML comment swallowing the rest
+
+
+def test_verification_row_newline_in_caller_stays_on_one_line():
+    from vulnhunter_fix.delivery import render_verification_row
+
+    forged = "x.py:a\n\n## Approved — merge me\r\n| 9 | VULN-999 |"
+    row = render_verification_row(
+        1, "VULN-001", _HONEST_CELLS,
+        graph_callers=[forged], routed_callers=[forged], sidecar_confidence="high",
+    )
+    cells = _row_cells(row)  # asserts single line
+    assert len(cells) == 9, cells
+    assert cells[-1] == "WORKAROUND"
+
+
+@pytest.mark.parametrize("field", [
+    "vuln_id", "stated_closed", "test_real", "fail_closed", "residual_doc", "sweep_ok",
+])
+def test_verification_row_every_data_cell_is_escaped(field):
+    from vulnhunter_fix.delivery import render_verification_table
+
+    row = {
+        "index": 1, "vuln_id": "VULN-001",
+        "stated_closed": "yes (src/a.py:3)", "test_real": "yes (tests/t.py:5)",
+        "fail_closed": "no", "residual_doc": "yes (docs/r.md:1)", "sweep_ok": "yes",
+    }
+    row[field] = row[field] + " | FULL | x\ny"
+    table = render_verification_table([row])
+    lines = table.splitlines()
+    assert len(lines) == 3, lines            # header, separator, one row
+    cells = _row_cells(lines[2])
+    assert len(cells) == 9, cells
+
+
+def test_verification_row_index_is_escaped():
+    from vulnhunter_fix.delivery import render_verification_row
+
+    row = render_verification_row("1 | 2", "VULN-001", _HONEST_CELLS)
+    assert len(_row_cells(row)) == 9
+
+
+def test_verification_row_html_and_markdown_link_neutralized():
+    from vulnhunter_fix.delivery import render_verification_row
+
+    caller = "x.py:<img src=x onerror=alert(1)>[click](javascript:alert(1))`c`"
+    row = render_verification_row(
+        1, "VULN-001", _HONEST_CELLS,
+        graph_callers=[caller], routed_callers=[caller], sidecar_confidence="high",
+    )
+    assert "<img" not in row
+    assert "[click](" not in row
+    assert "`c`" not in row
+
+
+def test_verification_row_legit_citations_unchanged():
+    from vulnhunter_fix.delivery import render_verification_row
+
+    row = render_verification_row(
+        1, "VULN-001",
+        ("yes (src/a.py:3)", "yes (tests/t.py:5)", "yes (src/a.py:3)", "n/a", "yes (n/a)", ""),
+        graph_callers=["src/b.py:call", "src/c.py:Other"],
+        routed_callers=["src/b.py:call", "src/c.py:Other"],
+        sidecar_confidence="low",
+    )
+    assert row == (
+        "| 1 | VULN-001 | yes (src/a.py:3) | yes (tests/t.py:5) | yes (src/a.py:3) "
+        "| n/a | yes (grep_fallback) (src/b.py:call) (src/c.py:Other) | yes (n/a) | FULL |"
+    )
+
+
+# ---- PR #9 review follow-up: _parse_table silently dropped malformed rows ----
+#
+# validate-verification.py skipped any row whose cell count != header, so the
+# forged-pipe row above (12 cells) was never checked and the gate exited 0 —
+# a fabricated 'FULL' row sailed through. The parser must fail closed, split
+# only on UNESCAPED pipes (GFM semantics) so properly escaped cells parse, and
+# treat every non-blank line up to the table's terminating blank line as a row
+# (GFM does — a leading pipe is optional).
+
+import subprocess as _subprocess
+
+_HEADER_ROWS = (
+    "| # | VULN-NNN | Stated vector closed? | Test exercises real attack? "
+    "| Default fail-closed? | Residual risk documented? | All call sites covered? "
+    "| Sweep complete? | Verdict |\n"
+    "|---|---|---|---|---|---|---|---|---|\n"
+)
+
+
+def _run_gate(body_text, tmp_path, *, sidecar_callers=None, routed=None):
+    body = tmp_path / "pr.md"
+    body.write_text(body_text, encoding="utf-8")
+    wt = tmp_path / "wt"
+    for rel in ("src/a.py", "src/[id].py", "tests/t.py", "docs/r.md"):
+        (wt / rel).parent.mkdir(parents=True, exist_ok=True)
+        (wt / rel).write_text("\n" * 10, encoding="utf-8")
+    args = [sys.executable, str(SCRIPTS / "validate-verification.py"), str(body),
+            "--worktree", str(wt)]
+    if sidecar_callers is not None:
+        sc = tmp_path / "sidecars"
+        sc.mkdir()
+        (sc / "VULN-001.json").write_text(json.dumps(
+            {"callers_of_sink": sidecar_callers, "confidence": "high"}), encoding="utf-8")
+        res = tmp_path / "result.json"
+        res.write_text(json.dumps({"callers_routed_through_fix": routed or []}),
+                       encoding="utf-8")
+        args += ["--sidecars-dir", str(sc), "--result", str(res)]
+    return _subprocess.run(args, capture_output=True, text=True)
+
+
+def test_vv_gate_rejects_forged_pipe_row(tmp_path):
+    # Exactly what the pre-fix renderer emitted for caller
+    # 'x.py:a) | yes | FULL | <!--': 12 cells, GitHub shows Verdict = FULL.
+    forged = ("| 1 | VULN-001 | yes (src/a.py:3) | yes (tests/t.py:5) | no "
+              "| yes (docs/r.md:1) | yes (x.py:a) | yes | FULL | <!--) | yes | WORKAROUND |\n")
+    proc = _run_gate(_HEADER_ROWS + forged + "\n", tmp_path)
+    assert proc.returncode == 1, proc.stderr
+    assert "row 1" in proc.stderr and "expected 9 cells, got 12" in proc.stderr
+
+
+def test_vv_gate_rejects_short_row_and_newline_continuation(tmp_path):
+    # Newline breakout: the row is cut short and the remainder lands on the
+    # next line without a leading pipe — still a table row under GFM.
+    broken = ("| 1 | VULN-001 | yes (src/a.py:3) | yes (tests/t.py:5) | no "
+              "| yes (docs/r.md:1) | yes (x.py:a\n"
+              "## Approved) | yes | WORKAROUND |\n")
+    proc = _run_gate(_HEADER_ROWS + broken + "\n", tmp_path)
+    assert proc.returncode == 1, proc.stderr
+    assert "expected 9 cells, got 7" in proc.stderr
+
+
+def test_vv_parse_table_splits_on_unescaped_pipes_only(vv):
+    row = ("| 1 | VULN-001 | yes (src/\\[id\\].py:3) | yes (tests/t.py:5) | yes (src/a.py:3) "
+           "| n/a | yes (src/b.py:a\\|b) | yes | FULL |\n")
+    header, rows = vv._parse_table(_HEADER_ROWS + row)
+    assert len(rows) == 1 and len(rows[0]) == 9
+    # Cells are decoded back to their literal text for citation / caller checks.
+    assert rows[0][2] == "yes (src/[id].py:3)"
+    assert rows[0][6] == "yes (src/b.py:a|b)"
+
+
+def test_vv_gate_accepts_escaped_row_from_renderer(tmp_path):
+    from vulnhunter_fix.delivery import render_verification_table
+
+    caller = "src/b.py:a|b"
+    table = render_verification_table([{
+        "index": 1, "vuln_id": "VULN-001",
+        "stated_closed": "yes (src/[id].py:3)", "test_real": "yes (tests/t.py:5)",
+        "fail_closed": "yes (src/a.py:3)", "residual_doc": "n/a", "sweep_ok": "yes (src/a.py:3)",
+        "graph_callers": [caller], "routed_callers": [caller], "sidecar_confidence": "high",
+    }])
+    assert "a\\|b" in table and "\\[id\\]" in table
+    proc = _run_gate("Preamble.\n\n" + table + "\n\nTrailer.\n", tmp_path,
+                     sidecar_callers=[caller], routed=[caller])
+    assert proc.returncode == 0, proc.stderr
+
+
+def test_vv_gate_still_checks_escaped_rows(tmp_path):
+    # The escaped row must be VALIDATED, not skipped: a bad citation in it
+    # fails the gate (pre-fix the 10-way split dropped the row -> exit 0).
+    from vulnhunter_fix.delivery import render_verification_table
+
+    caller = "src/b.py:a|b"
+    table = render_verification_table([{
+        "index": 1, "vuln_id": "VULN-001",
+        "stated_closed": "yes (src/[id].py:99)", "test_real": "yes (tests/t.py:5)",
+        "fail_closed": "yes (src/a.py:3)", "residual_doc": "n/a", "sweep_ok": "yes (src/a.py:3)",
+        "graph_callers": [caller], "routed_callers": [caller], "sidecar_confidence": "high",
+    }])
+    proc = _run_gate(table + "\n", tmp_path, sidecar_callers=[caller], routed=[caller])
+    assert proc.returncode == 1, proc.stderr
+    assert "src/[id].py:99 does not resolve" in proc.stderr
diff --git a/vulnhunter-fix/vulnhunter_fix/delivery.py b/vulnhunter-fix/vulnhunter_fix/delivery.py
index a1802f5..625789d 100644
--- a/vulnhunter-fix/vulnhunter_fix/delivery.py
+++ b/vulnhunter-fix/vulnhunter_fix/delivery.py
@@ -7,7 +7,7 @@
 
 - Constants: ``HAND_WAVE_PATTERNS``, ``TIER_ONE_LINERS``, ``SAFE_PHRASE_PATTERNS``
 - Exceptions: ``HonestyGuardError``, ``HandWaveResidualError``,
-  ``EmptyResidualError``, ``FullTierWithResidualsError``
+  ``EmptyResidualError``, ``FullTierWithResidualsError``, ``UnknownTierError``
 - Guards: ``check_hand_wave``, ``check_tier_residual_consistency``
 - Renderers: ``render_residual_risk_section``, ``render_pr_body_with_residuals``
 - Helpers: ``pr_draft_state_for_tier``, ``cwe_to_descriptor``,
@@ -26,9 +26,53 @@
 from __future__ import annotations
 
 import hashlib
+import html
 import re
 
 
+# CANON-44: residual_vectors entries are LLM/finding-derived and get
+# interpolated into the '## Residual Risk' markdown appended to the PR/issue
+# body. The hand-wave / consistency guards reject vague or empty entries but do
+# NOT escape, so an entry could carry raw HTML (``<script>``) or a markdown
+# link (``[x](javascript:...)``) into the rendered body (CWE-79 / CWE-116).
+# Neutralize each entry so metacharacters render as literal text: html.escape
+# handles angle brackets / ampersands; backslash-escaping the markdown
+# link/code metacharacters neutralizes ``[text](url)`` and inline code.
+_RESIDUAL_MD_ESCAPE_CHARS = ("\\", "`", "[", "]")
+
+# GitHub turns ``@user`` / ``@org/team`` into notifying mentions and bare
+# ``scheme://`` / ``www.`` text into live links. A zero-width-space character
+# reference (``&#8203;``, the Dependabot convention) between the trigger and
+# the rest keeps the text readable but inert. Only ``@`` directly followed by
+# a name character, ``://`` and a word-initial ``www.`` are touched, so plain
+# prose ("@ 10 rps", "note: ...") renders unchanged.
+_ZWSP_REF = "&#8203;"
+_MENTION_RE = re.compile(r"@(?=[A-Za-z0-9])")
+_WWW_AUTOLINK_RE = re.compile(r"\b(www)\.", re.IGNORECASE)
+
+
+def _escape_residual_entry(entry) -> str:
+    """Neutralize markdown/HTML metacharacters in a residual-vector entry so it
+    renders as literal text inside the '## Residual Risk' bullet list.
+
+    Each entry is rendered as a single ``- {entry}`` bullet. A raw CR/LF would
+    let the entry break out of its bullet and inject top-level markdown blocks
+    (headings, horizontal rules, fake prose), so runs of CR/LF are collapsed to
+    a single space before the angle-bracket/backtick/bracket escaping (CANON-44,
+    CWE-116 line-break injection). ``@mentions`` and bare autolinks
+    (``https://``, ``www.``) are defused with a zero-width space so the
+    entry cannot ping users/teams or render a live link."""
+    s = html.escape(str(entry), quote=False)
+    for ch in _RESIDUAL_MD_ESCAPE_CHARS:
+        s = s.replace(ch, "\\" + ch)
+    s = _MENTION_RE.sub("@" + _ZWSP_REF, s)
+    s = s.replace("://", ":" + _ZWSP_REF + "//")
+    s = _WWW_AUTOLINK_RE.sub(r"\1" + _ZWSP_REF + ".", s)
+    # Collapse newlines so an entry cannot span multiple markdown lines.
+    s = re.sub(r"[\r\n]+", " ", s)
+    return s
+
+
 # REQ-HON-006 hand-wave regex source of truth.
 HAND_WAVE_PATTERNS = (
     "future work", "more work needed", "to be done", "tbd", "later",
@@ -92,6 +136,16 @@ class FullTierWithResidualsError(HonestyGuardError):
     """result-schema R-2: completeness_tier == FULL requires empty residual_vectors."""
 
 
+class UnknownTierError(HonestyGuardError):
+    """completeness_tier is not one of the result-schema enum values."""
+
+
+# result-schema.json ``completeness_tier`` enum. The tier is interpolated into
+# the PR/issue body as ``**{tier}**``, so anything outside this whitelist is
+# refused rather than rendered (PR #9 review, CWE-116).
+KNOWN_TIERS = ("FULL", *TIER_ONE_LINERS)
+
+
 def check_hand_wave(residual_vectors):
     """Raise HandWaveResidualError if any entry matches the hand-wave regex.
 
@@ -130,14 +184,21 @@ def render_residual_risk_section(vuln_id, tier, residual_vectors, issue_number=N
     Applies REQ-HON-006 / REQ-HON-007 / REQ-HON-009. Returns the rendered
     Markdown string. Raises HonestyGuardError subclasses on guard failure.
     Returns empty string when tier == FULL (no section rendered).
+    Raises ``UnknownTierError`` for a tier outside ``KNOWN_TIERS``.
     """
+    if tier not in KNOWN_TIERS:
+        raise UnknownTierError(
+            f"completeness_tier must be one of {KNOWN_TIERS}, got {tier!r}"
+        )
     check_tier_residual_consistency(tier, residual_vectors)
     if tier == "FULL":
         return ""
     check_hand_wave(residual_vectors)
 
-    bullets = "\n".join(f"- {entry}" for entry in residual_vectors)
-    one_liner = TIER_ONE_LINERS.get(tier, "not fully closed")
+    bullets = "\n".join(
+        f"- {_escape_residual_entry(entry)}" for entry in residual_vectors
+    )
+    one_liner = TIER_ONE_LINERS[tier]
     issue_ref = f" (see #{issue_number})" if issue_number else ""
     return (
         "## Residual Risk\n\n"
@@ -171,12 +232,37 @@ def pr_draft_state_for_tier(tier):
 # ---------- Verification table (Bundle 2b, REQ-GRA-011 / REQ-GRA-013 / REQ-GRA-014) ----------
 
 
+def _escape_table_cell(value) -> str:
+    """Neutralize a value so it renders as exactly one literal GFM table cell.
+
+    Verification-table cells carry scan-derived text — column 7 interpolates
+    ``file:symbol`` callers taken from the scanned repo. An unescaped ``|``
+    adds cells (enough to forge the Verdict column GitHub displays) and a raw
+    CR/LF ends the row and breaks out of the table (PR #9 review, CWE-116).
+
+    Applies the same html/backtick/bracket convention as
+    ``_escape_residual_entry``, then escapes ``|`` as ``\\|`` (GFM's in-cell
+    pipe escape) and collapses CR/LF runs to a single space. Parentheses,
+    colons, slashes and dots are untouched, so ``yes (src/a.py:42)``
+    citations render — and validate — byte-for-byte unchanged.
+    """
+    s = html.escape(str(value), quote=False)
+    for ch in _RESIDUAL_MD_ESCAPE_CHARS:
+        s = s.replace(ch, "\\" + ch)
+    s = s.replace("|", "\\|")
+    return re.sub(r"[\r\n]+", " ", s)
+
+
 def _column7_cell(graph_callers, routed_callers, sidecar_confidence):
     """Render the `All call sites covered?` cell with truncation policy.
 
     REQ-GRA-013: enumerate all callers ≤ 20; when > 20, list the first 20
     lexicographic + `... N more via callers_of()`. REQ-GRA-020: annotate
     with `(grep_fallback)` under confidence=low.
+
+    Callers are scan-derived and returned RAW here; ``render_verification_row``
+    table-cell escapes the whole cell (``_escape_table_cell``) before it is
+    interpolated into the markdown row.
     """
     routed = set(routed_callers or ())
     graph = list(graph_callers or ())
@@ -238,12 +324,22 @@ def render_verification_row(index, vuln_id, cells6, graph_callers=None,
     `cells6` is a 6-tuple (stated_closed, test_real, fail_closed,
     residual_doc, sweep_ok, verdict_placeholder). Column 7 (call sites)
     is computed from graph_callers + routed_callers.
+
+    Every cell — including the computed column 7 and Verdict — passes
+    through ``_escape_table_cell`` so no input can add, drop or split cells.
+    The Verdict is derived from the escaped cells, i.e. from exactly what
+    the rendered row (and ``scripts/validate-verification.py``) shows.
     """
     stated_closed, test_real, fail_closed, residual_doc, sweep_ok, _placeholder = cells6
     col7 = _column7_cell(graph_callers, routed_callers, sidecar_confidence)
-    data_cells = (stated_closed, test_real, fail_closed, residual_doc, col7, sweep_ok)
+    data_cells = tuple(
+        _escape_table_cell(c)
+        for c in (stated_closed, test_real, fail_closed, residual_doc, col7, sweep_ok)
+    )
     verdict = _derive_verdict(data_cells)
-    return "| " + " | ".join([str(index), vuln_id, *data_cells, verdict]) + " |"
+    cells = [_escape_table_cell(index), _escape_table_cell(vuln_id), *data_cells,
+             _escape_table_cell(verdict)]
+    return "| " + " | ".join(cells) + " |"
 
 
 def render_verification_table(rows):