From 8a719b4b8a44e97d42b962a31e76ae3602cbcff1 Mon Sep 17 00:00:00 2001
From: Dimitrie Hoekstra <hi@dimitr.ie>
Date: Tue, 29 Sep 2026 15:06:58 +0200
Subject: [PATCH] docs: use MDC callouts everywhere and fail the build on a
 Nunjucks tag

FlowFuse/flowfuse#8694 moved the product docs from Eleventy shortcodes to
::note and ::warning, which render as Nuxt UI callouts. The website's own
pages under /docs still hardcoded the ff-callout HTML the docs import used
to generate, so the two styles sat side by side.

- Convert the hardcoded callouts in content-guides to ::note, ::warning
  and ::caution. The OPC UA caution had no blank lines, so its body was
  raw HTML and its bold text rendered as literal asterisks.
- NodeRedHelp used ff-callout--info, which never had a CSS rule, so the
  note rendered unstyled. It is a ProseNote now.
- Drop convertCallouts, stripTemplateEngineOverride and the ff-callout
  styles, which nothing uses any more.
- Replace the silent strip of leftover {% %} tags with a build error that
  names the file and line. The strip is what hid the missing installation
  form on /docs/install/introduction/. Fenced and inline code are exempt.
---
 nuxt/assets/css/style.docs.css                |  40 -----
 nuxt/components/content/NodeRedHelp.vue       |   4 +-
 .../flowfuse-nodes/edge/README.md             |  18 +--
 .../flowfuse-nodes/edge/cip-suite.md          |  12 +-
 .../flowfuse-nodes/edge/modbus.md             |  78 +++------
 .../flowfuse-nodes/edge/opcua.md              | 148 ++++++------------
 .../flowfuse-nodes/edge/rtsp.md               |  18 +--
 .../flowfuse-nodes/hub/README.md              |  18 +--
 .../flowfuse-nodes/hub/redis.md               |  12 +-
 .../node-red/hardware/armxy-bl340.md          |   6 +-
 nuxt/lib/docs-markdown.mjs                    |  56 ++++---
 nuxt/lib/docs-markdown.test.mjs               |  51 ++++--
 12 files changed, 174 insertions(+), 287 deletions(-)

diff --git a/nuxt/assets/css/style.docs.css b/nuxt/assets/css/style.docs.css
index 9b77356472..dbe12720e1 100644
--- a/nuxt/assets/css/style.docs.css
+++ b/nuxt/assets/css/style.docs.css
@@ -88,44 +88,4 @@
     display:block;
 }
 
-.ff-callout {
-    @apply my-5 rounded-md border px-4 py-3 text-sm/6;
-}
-
-.ff-callout__icon {
-    @apply inline-block size-4 shrink-0;
-    vertical-align: sub;
-    margin-right: 0.375rem;
-}
-
-.ff-callout__content > * {
-    @apply text-left;
-}
-
-.ff-callout .ff-callout__content > :first-child { margin-top: 0 !important; }
-.ff-callout .ff-callout__content > :last-child { margin-bottom: 0 !important; }
-.ff-callout .ff-callout__content * { color: inherit; font-size: inherit !important; line-height: inherit !important; }
-
-.ff-callout--note {
-    background-color: color-mix(in srgb, var(--color-blue-500) 10%, transparent);
-    border-color: color-mix(in srgb, var(--color-blue-500) 25%, transparent);
-    color: var(--color-blue-600);
-}
-
-.ff-callout--warning {
-    background-color: color-mix(in srgb, var(--color-yellow-500) 10%, transparent);
-    border-color: color-mix(in srgb, var(--color-yellow-500) 25%, transparent);
-    color: var(--color-yellow-600);
-}
-
-/* docs-source.ts emits --critical for the {% critical %} shortcode, but the stylesheet only
-   ever defined --caution, so a critical callout renders unstyled. No upstream page uses one
-   today, so this is insurance rather than a visible fix. */
-.ff-callout--caution,
-.ff-callout--critical {
-    background-color: color-mix(in srgb, var(--color-red-500) 10%, transparent);
-    border-color: color-mix(in srgb, var(--color-red-500) 25%, transparent);
-    color: var(--color-red-600);
-}
-
 } /* end @layer components */
\ No newline at end of file
diff --git a/nuxt/components/content/NodeRedHelp.vue b/nuxt/components/content/NodeRedHelp.vue
index cfdfe97c82..06f88fc8b0 100644
--- a/nuxt/components/content/NodeRedHelp.vue
+++ b/nuxt/components/content/NodeRedHelp.vue
@@ -39,12 +39,12 @@ const { data, error } = await useFetch<{ html: string }>('/api/node-red-help', {
     </div>
 
     <template v-else>
-      <div class="ff-callout ff-callout--info">
+      <ProseNote>
         <p>
           This is the {{ label }} node's built-in help, mirrored from the Node-RED project.
           It is the same text the editor shows in its Info sidebar.
         </p>
-      </div>
+      </ProseNote>
 
       <!-- Third-party HTML. Sanitised server-side against an allowlist before it gets here. -->
       <div v-html="data?.html" />
diff --git a/nuxt/content-guides/flowfuse-nodes/edge/README.md b/nuxt/content-guides/flowfuse-nodes/edge/README.md
index 3cde9f7818..2dadcd774a 100644
--- a/nuxt/content-guides/flowfuse-nodes/edge/README.md
+++ b/nuxt/content-guides/flowfuse-nodes/edge/README.md
@@ -13,17 +13,13 @@ This section contains documentation for **FlowFuse Edge Certified Nodes** that c
 
 FlowFuse Certified Nodes are packages that FlowFuse has vetted for quality, security, and support, and maintains on an ongoing basis. To learn more about what certification means and how these nodes are delivered, [read the FlowFuse Certified Nodes blog post](/blog/2025/07/certified-nodes-v2/).
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The FlowFuse Edge Certified Nodes catalogue is part of the **FlowFuse Edge** offering. [Contact us](/contact-us/) to get access or to learn more.
+::
 
-</div></div>
-
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 This section is expanding. We are actively working to bring more Edge Certified Nodes to FlowFuse, and additional documentation will be added here over time.
-
-</div></div>
+::
 
 ## Nodes
 
@@ -34,8 +30,6 @@ This section lists the **Edge Certified Nodes** documented in FlowFuse:
 - [Modbus](/docs/flowfuse-nodes/edge/modbus/): A FlowFuse-certified package for reading and writing coils and registers over Modbus TCP, Modbus UDP (where supported), and Serial (RTU/ASCII), and for simulating a Modbus server, all from within your flows.
 - [OPC UA for FlowFuse - FlowFuse Certified Node](/docs/flowfuse-nodes/edge/opcua/): Connect a FlowFuse instance to industrial OPC UA servers: read, write, monitor, call methods, browse, read history, work with files, or host your own OPC UA server. A FlowFuse Certified Node.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Newly installed nodes are picked up automatically, no restart needed. Restart is only required when you update a node that's already installed: restart any remote instance or hosted instance running the previous version.
-
-</div></div>
+::
diff --git a/nuxt/content-guides/flowfuse-nodes/edge/cip-suite.md b/nuxt/content-guides/flowfuse-nodes/edge/cip-suite.md
index cff9eff92e..f0871c14f4 100644
--- a/nuxt/content-guides/flowfuse-nodes/edge/cip-suite.md
+++ b/nuxt/content-guides/flowfuse-nodes/edge/cip-suite.md
@@ -17,11 +17,9 @@ The CIP Suite connects FlowFuse flows to industrial control systems across the f
 
 This is a **FlowFuse Certified Node**. Unlike community nodes, which vary in quality and can go unmaintained without warning, FlowFuse vets Certified Nodes for quality, security, and support, and maintains them on an ongoing basis. [Read more about Certified Nodes](/blog/2025/07/certified-nodes-v2/). It is built on the [st-ethernet-ip](https://www.npmjs.com/package/st-ethernet-ip) protocol driver.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The CIP Suite is not available by default. It is part of the FlowFuse Edge Certified Nodes catalogue, which is part of the **FlowFuse Edge** offering. Please contact our sales team at [Contact us](/contact-us/) to learn more or to request access.
-
-</div></div>
+::
 
 ## What is EtherNet/IP?
 
@@ -79,11 +77,9 @@ Only the source and sink nodes are protocol-specific. The transform stages of a
 
 Because this suite is part of the FlowFuse Edge Certified Nodes catalogue, which is part of the **FlowFuse Edge** offering, make sure your account has access before installing. Contact our [sales team](/contact-us/) if you don't.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Newly installed nodes are picked up automatically, no restart needed. Restart is only required when you update a node that's already installed: restart any remote instance or hosted instance running the previous version.
-
-</div></div>
+::
 
 ### Install via the Palette Manager (recommended)
 
diff --git a/nuxt/content-guides/flowfuse-nodes/edge/modbus.md b/nuxt/content-guides/flowfuse-nodes/edge/modbus.md
index 827936c55b..76894bd78a 100644
--- a/nuxt/content-guides/flowfuse-nodes/edge/modbus.md
+++ b/nuxt/content-guides/flowfuse-nodes/edge/modbus.md
@@ -15,11 +15,9 @@ This is a **FlowFuse Certified Node**. Unlike community nodes, which vary in qua
 
 ## Get the Certified Node in FlowFuse
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The Modbus package is not available by default. It is part of the FlowFuse Edge Certified Nodes catalogue, which is part of the **FlowFuse Edge** offering. Please contact our sales team at [Contact us](/contact-us/) to learn more or to request access.
-
-</div></div>
+::
 
 ### Installation steps
 
@@ -33,11 +31,9 @@ The Modbus package is not available by default. It is part of the FlowFuse Edge
 
 The Modbus nodes then appear in your palette, ready to drag onto the canvas.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 If your device or hosted instance was already running before Modbus was enabled for your team, it won't show the package in the Install tab search. Restart the instance or device first, then repeat the steps above.
-
-</div></div>
+::
 
 ## What is Modbus?
 
@@ -49,11 +45,9 @@ Modbus is one of the oldest and most widely supported industrial communication p
 
 Modbus-Client also offers TELNET and C701 modes for TCP-to-serial gateways.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Modbus now uses **client** for the device making requests and **server** for the device answering them. Older device manuals and tools use **master** and **slave** for the same two roles — a Modbus master is a client, a Modbus slave is a server. This package follows the newer terminology, so the FlowFuse instance is the client and the PLC, meter, or drive it polls is the server.
-
-</div></div>
+::
 
 Every Modbus device exposes its data as one of four addressable table types, and every read or write targets one of them:
 
@@ -64,21 +58,17 @@ Every Modbus device exposes its data as one of four addressable table types, and
 | Holding Registers | 3 | 6, 16 | Read/write, 16-bit | `4xxxx` / `40001+` | Setpoints, configuration, read/write process values |
 | Input Registers | 4 | — | Read-only, 16-bit | `3xxxx` / `30001+` | Read-only measurements — sensor readings |
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 **Register addressing** Addresses in this package are raw, zero-based protocol addresses. Device manuals often number the same register differently. A manual that lists a holding register as `40001` (or `4x0001`, or `400001` on devices with more than 9,999 registers) is describing the register at address `0`. Other manuals number within the table starting at `1`, so their "register 1" is also address `0`. Check which convention your device's register map uses before entering an address — an off-by-one here is the most common cause of reading the wrong value, and an address one past the end of the table returns Illegal Data Address.
-
-</div></div>
+::
 
 A device is also identified by a **Unit ID** (also called station address, or slave ID in older documentation), which matters when several logical devices share one connection — for example several RTU devices on the same RS-485 bus, or several logical devices behind one TCP gateway.
 
 On a serial bus, valid device addresses are **1–247**. Address **0 is the broadcast address** — a write sent to unit 0 goes to every device on the bus and none of them reply, so a read addressed to unit 0 will always time out. Addresses 248–255 are reserved. Native Modbus TCP devices often ignore the unit ID altogether (`0`, `1`, and `255` are all common), but it matters as soon as a gateway sits in front of serial devices.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Modbus itself moves only raw bits and 16-bit words — the protocol carries no data-type information. A read returns an **array** of booleans (coils/discrete inputs) or **raw 16-bit register values, each `0`–`65535`,** (input/holding registers). Anything larger or more structured — 32-bit integers, floating-point values, scaled measurements — spans multiple registers: the device packs it across them, and you reconstruct it in your flow. See [Decoding register values](#decoding-register-values) for how to do this.
-
-</div></div>
+::
 
 ## Use case
 
@@ -119,11 +109,9 @@ Each node performs one Modbus operation and reuses the shared connection you con
 | Modbus-Server | Runs a buffer-backed Modbus TCP server inside Node-RED, so it responds to reads and writes from an external Modbus client — useful for testing and simulation. |
 | Modbus-Queue-Info | Reports (and can reset) the internal request queue depth for a connection, useful for spotting a device that can't keep up with the configured poll rate. |
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 All nodes that share the same Modbus-Client connection share one underlying socket/serial port and are queued through it in order, so a device is never sent two requests at once. A busy queue (see Modbus-Queue-Info) usually means the poll rate is faster than the device can respond to.
-
-</div></div>
+::
 
 ## Configure a Modbus Client Connection
 
@@ -140,17 +128,13 @@ Every node in this package uses a **Modbus-Client** configuration node to commun
    - **Reconnect Timeout** — Default: `2000` ms
 5. Click **Done**, then **Deploy** the flow.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The connection is shared. Changing its parameters affects every node that uses it, and you must redeploy the flow for connection changes to take effect. To change the endpoint at runtime without redeploying, see [Modbus-Flex-Connector](#modbus-flex-connector).
+::
 
-</div></div>
-
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Keep host/IP addresses and serial port paths in FlowFuse Environment Variables (your instance's **Settings → Environment**) rather than hard-coding them in the connection, so the same flow can be promoted across instances that reach the device differently.
-
-</div></div>
+::
 
 ## Modbus-Read
 
@@ -170,11 +154,9 @@ Each poll emits a message carrying the raw values on `msg.payload` (an array of
 [Modbus-Read] (polls every 1000ms)  →  [function / buffer-parser]  →  [Debug]
 ```
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Set the poll rate no faster than the device can reliably answer. A rate that outpaces the device causes requests to back up in the queue, check [Modbus-Queue-Info](#modbus-queue-info) if reads start arriving late or with gaps.
-
-</div></div>
+::
 
 ## Modbus-Getter and Modbus-Flex-Getter
 
@@ -194,11 +176,9 @@ Modbus-Flex-Sequencer reads several configured ranges in order through a single
 - **Modbus-Write** — the target table (Coils or Holding Registers), address, and quantity are fixed on the node; the value(s) to write come from the incoming message. Uses write function codes FC 5/6 (single coil/register) and FC 15/16 (multiple).
 - **Modbus-Flex-Write** — the table, address, and value(s) are all taken from the incoming message, so a single node can write to different coils/registers depending on what triggers it.
 
-<div class="ff-callout ff-callout--warning"><p class="ff-callout__title">Warning</p><div class="ff-callout__content">
-
+::warning
 Writes to production equipment change real-world state. Gate write nodes behind validation or an operator confirmation step before deploying to a live instance.
-
-</div></div>
+::
 
 ## Modbus-Flex-Fc
 
@@ -232,21 +212,17 @@ There are a few common approaches:
 - **A buffer-parser node** — a dedicated parsing node (such as `node-red-contrib-buffer-parser`) accepts the values array directly, so you don't have to deal with the Buffer question at all. It lets you declare each field's type and endianness in configuration rather than in code, which is convenient when a single response contains many differently-typed fields.
 - **The package's built-in IO mapping** — a **Modbus-IO-Config** node holds a JSON file that maps IEC-style addresses (`%QW0`, `%IX8.0`, and so on) to names, where the first character of each name selects the data type (`i` integer, `w` word, `u` unsigned, `b` boolean, `f`/`r` float, and so on). A read node can attach that mapping to its output, and **Modbus-Response-Filter** narrows the result down to the named fields a downstream node needs. This is convenient when your address list originates from a PLC export.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Choose the data type and word order that matches how the device packs its data, which is usually documented in the device's Modbus register map. If a decoded value looks wildly wrong (for example a temperature reading in the millions), the most common cause is a word-order mismatch on a multi-register value. Try the other byte/word order before assuming the device or wiring is at fault.
-
-</div></div>
+::
 
 ## Modbus-Response
 
 The Modbus-Response node displays the status and content of a Modbus response in the editor. Placed downstream of a read node, it is an inspection/diagnostic aid that shows what came back, which is helpful while building and debugging a flow.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Modbus-Response is for **display and inspection** — it does not convert raw registers into typed values. To turn raw registers into integers, floats, or scaled measurements, decode them in your flow as described in [Decoding register values](#decoding-register-values).
-
-</div></div>
+::
 
 ## Modbus-Server
 
@@ -257,11 +233,9 @@ This is primarily useful for:
 - **Testing flows without hardware** — stand up a server so a Modbus-Read/Write flow can be built and verified before real hardware is available.
 - **Local integration testing** — exercise read and write paths end to end against a server running in the same instance.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The in-package Modbus-Server is a **buffer-backed server for demos and tests**. It is not intended to replicate a specific device's complete register-map behaviour. For more elaborate simulation needs, a dedicated Modbus simulation tool is a better fit.
-
-</div></div>
+::
 
 ## Modbus-Queue-Info
 
diff --git a/nuxt/content-guides/flowfuse-nodes/edge/opcua.md b/nuxt/content-guides/flowfuse-nodes/edge/opcua.md
index 560e527341..0ab4a506e4 100644
--- a/nuxt/content-guides/flowfuse-nodes/edge/opcua.md
+++ b/nuxt/content-guides/flowfuse-nodes/edge/opcua.md
@@ -88,17 +88,13 @@ The OPC UA nodes then appear in your palette, ready to drag onto the canvas.
 
 !["The OPC UA nodes in the Node-RED palette"](./images/opcua/node-palette.png "The OPC UA nodes in the Node-RED palette"){data-zoomable}
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Newly installed nodes are picked up automatically, no restart needed. Restart is only required when you update a node that's already installed: restart any remote instance or hosted instance running the previous version.
+::
 
-</div></div>
-
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Keep endpoint URLs, usernames, and passwords in FlowFuse Environment Variables (your instance's **Settings → Environment**) rather than hard-coding them in nodes. This keeps credentials out of your flow JSON and lets you promote the same flow across instances.
-
-</div></div>
+::
 
 ## 3. The Node Set
 
@@ -118,17 +114,13 @@ Each node performs one OPC UA operation and reuses the shared connection you con
 | History Read | Retrieve raw, modified, or aggregated historical data over a time range. |
 | File Operation | Read, write, append, or size files on servers implementing the FileType interface. |
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Properties of the input message take precedence over a node's own configuration. Configure a node statically, or drive it dynamically from upstream messages.
+::
 
-</div></div>
-
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Each node reports its state in the editor with a coloured status dot, grey (not connected), blue (operation in progress), green (success), red (failure), and on some nodes (such as History Read) yellow (partial success or quality issues). Watch it alongside the debug sidebar when wiring up a flow.
-
-</div></div>
+::
 
 ## 4. NodeIds and How to Address Data
 
@@ -152,11 +144,9 @@ Clicking the browse (`...`) button opens the live address space, so you can pick
 
 !["Browsing the live server address space to select a NodeId"](./images/opcua/use-node-browser-to-select-node-id.png "Browsing the live server address space to select a NodeId"){data-zoomable}
 
-<div class="ff-callout ff-callout--warning"><p class="ff-callout__title">Warning</p><div class="ff-callout__content">
-
+::warning
 Namespace indexes are not guaranteed stable across servers. If you move a flow between servers, prefer browse paths or the namespace alias table over hard-coded numeric namespace indexes.
-
-</div></div>
+::
 
 ### Browse path syntax
 
@@ -178,11 +168,9 @@ Every browse path starts with a reference-type separator and then a sequence of
 | BadNoMatch | The full path does not exist on the server, or a namespace index is wrong. |
 | BadReferenceTypeIdInvalid | A reference type name in the path is unknown or not namespace-qualified. |
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Browse paths are convenient and portable, but resolution has a cost. For variables you read or write frequently, resolve the path once and use the returned NodeId, or use the verified-browse-path format that caches the NodeId alongside the path.
-
-</div></div>
+::
 
 ## 5. Configure a Connection
 
@@ -200,11 +188,9 @@ Every OPC UA node depends on a connection defined by the **OPC UA Client** confi
 4. Click **Save**, then **Done**.
 5. Click **Deploy**, then open the debug sidebar to confirm data flows.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The connection is shared. Changing its parameters affects every node that uses it, and you must redeploy the flow for connection changes to take effect.
-
-</div></div>
+::
 
 ### Connection editor areas
 
@@ -227,21 +213,17 @@ The connection is shared. Changing its parameters affects every node that uses i
 
   !["A connection rejected with BadUserAccessDenied"](./images/opcua/endpoint-verification-user-access-denied.png "A connection rejected with BadUserAccessDenied"){data-zoomable}
 
-<div class="ff-callout ff-callout--warning"><p class="ff-callout__title">Warning</p><div class="ff-callout__content">
-
+::warning
 A username and password sent over message security mode `None` travel in cleartext. Combine credentials with at least `Sign` mode.
-
-</div></div>
+::
 
 ### Certificate trust
 
 Secure connections rely on mutual certificate trust. By default the client side automatically accepts the server's certificate, so the step that usually needs action is the reverse: **the server must trust the client's certificate**. For a `Sign` or `SignAndEncrypt` connection, download the client certificate from the connection editor (in PEM or DER format) and add it to your OPC UA server's trusted list, otherwise the server refuses the connection.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Auto-accepting the server certificate is convenient but means the client does not verify the server's identity. To enforce server-certificate validation, set `rejectUnauthorized` to `true` in the connection node's global settings. The client then refuses any server whose certificate is not already in its trusted store, so you must add the server's certificate to the client side first.
-
-</div></div>
+::
 
 Client and server nodes in your instance share one PKI store. On FlowFuse it lives under `<instance working directory>/opcua-for-flow-fuse/PKI`. For trust decisions to survive restarts and redeploys, that directory must be on persistent storage, see [Hosting an OPC UA server](#_16-hosting-an-opc-ua-server) for the storage details, which apply to client connections too.
 
@@ -266,11 +248,9 @@ The Read node fetches data on demand, it acts only when it receives an input mes
 3. `msg.payload`
 4. The node's configured NodeId
 
-<div class="ff-callout ff-callout--warning"><p class="ff-callout__title">Warning</p><div class="ff-callout__content">
-
+::warning
 A default Inject node sets `msg.payload` to a timestamp, which silently overrides the node's configured NodeId (priority rule 3). To use the node's own configuration, ensure the Inject node does **not** set `msg.nodeId`, `msg.topic`, or `msg.payload`.
-
-</div></div>
+::
 
 ### Message properties
 
@@ -391,11 +371,9 @@ A Write returns the original `payload` and `nodeId` plus the result: `statusCode
 | BadNotWritable | Variable is read-only. |
 | BadConnectionClosed | Connection was lost during the write. |
 
-<div class="ff-callout ff-callout--warning"><p class="ff-callout__title">Warning</p><div class="ff-callout__content">
-
+::warning
 Writes to production equipment change real-world state. Gate write nodes behind validation or an operator confirmation step before deploying to a live instance.
-
-</div></div>
+::
 
 ## 8. Extension Object
 
@@ -473,11 +451,9 @@ The Monitor node subscribes to variables and emits a message whenever a value ch
 - **Notification behaviour**, a monitored item notifies only when the value actually changes (per the OPC UA spec), and once at monitoring start: the initial value is always reported.
 - **Resilience**, the Monitor node reconnects automatically after a connection loss and re-establishes its subscription and monitored items, resuming without manual intervention.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Each notification carries `msg.sequenceNumber`. Watch it for gaps to detect dropped notifications, for example when a server-side queue overflows under a heavy change rate.
-
-</div></div>
+::
 
 ### NodeId source (priority order)
 
@@ -537,11 +513,9 @@ Example, stop monitoring:
 msg.payload = [];
 ```
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Injecting an empty array releases the monitored items but leaves the now-empty subscription in place on the connection, so it is the right way to pause and resume a stream. To tear the session down completely, disconnect the connection instead.
-
-</div></div>
+::
 
 ### Deadband filtering
 
@@ -553,11 +527,9 @@ Injecting an empty array releases the monitored items but leaves the now-empty s
 | Absolute | Report only when `abs(new − lastReported) > value`. |
 | Percent | Report only when the change exceeds a percentage of the variable's EURange. Requires the variable to expose an EURange property. |
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Deadband compares against the last reported value, not the last sampled value. The initial value is always reported. Use Absolute when a variable has no EURange, Percent silently does nothing without one.
-
-</div></div>
+::
 
 ## 11. Monitor Event
 
@@ -596,11 +568,9 @@ Where Clause:  (empty)
 Select Clause: EventId,EventType,SourceName,Time,Message,Severity
 ```
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 If no events arrive, verify the server supports events (read the object's `EventNotifier` attribute, a non-zero value means it emits events), point the NodeId at an event-generating object (try `i=2253`), and clear the Where Clause. If too many arrive, tighten the Where Clause by type and severity, or point at specific equipment instead of the Server object.
-
-</div></div>
+::
 
 ## 12. Browse
 
@@ -666,11 +636,9 @@ The output type sets what each leaf variable returns:
 - **excludeEmpty**, set `msg.excludeEmpty = true` to drop branches that contain no variables, for cleaner output.
 - **Depth**, Explore follows the full hierarchy under the start node (default maximum depth 10). Rather than a depth setting, control scope by choosing a more specific start NodeId: roughly 2–3 levels for one piece of equipment, 4–6 for a production line, 7–10 for a whole plant.
 
-<div class="ff-callout ff-callout--warning"><p class="ff-callout__title">Warning</p><div class="ff-callout__content">
-
+::warning
 Starting Explore at the Objects folder (`ns=0;i=85`) or another root node traverses the entire server and can return a very large structure. Start from a specific NodeId (or `/Server/ServerStatus` if you are just getting your bearings) and expand scope deliberately.
-
-</div></div>
+::
 
 Example, exploring `/Server/ServerStatus` with output type `NodeId` returns a nested object whose leaves are the NodeIds of each variable:
 
@@ -694,11 +662,9 @@ Explore a subtree once to discover all its variables, then feed that structure s
 [Inject]  →  [Explore]  →  [Monitor]  →  [Debug]
 ```
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Address spaces rarely change, so cache the Explore result (with a timestamp) and reuse it rather than re-exploring on every deploy. Re-explore periodically only if your server adds or removes variables at runtime.
-
-</div></div>
+::
 
 ## 14. History Read
 
@@ -750,11 +716,9 @@ msg.startTime = "2024-11-20T08:00:00Z";  msg.endTime = "2024-11-20T17:00:00Z"; /
 | BadTimestampsToReturnInvalid | Invalid timestamp specification. |
 | BadMaxAgeInvalid | Invalid time range specified. |
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Keep time ranges and `numValuesPerNode` bounded, prefer aggregation to thin large ranges for charts, and verify the server supports history before relying on it. For very long ranges, chunk the request into smaller windows.
-
-</div></div>
+::
 
 ## 15. File Operation
 
@@ -799,27 +763,23 @@ msg.payload = "appended log line\n";   // WriteAppend mode
 | BadNodeIdUnknown | File not found, for WriteAppend, create it first with Write. |
 | BadNotWritable / BadUserAccessDenied | File is read-only or your account lacks permission. |
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Use the Browse node to discover available File objects, and the Read node to inspect file metadata such as `Size`, `OpenCount`, and `UserWritable`. Garbled text usually means the wrong encoding, try a different one.
-
-</div></div>
+::
 
 ## 16. Hosting an OPC UA Server
 
 On **self-hosted FlowFuse**, the certified node can run an OPC UA server inside your instance using only Function nodes, no `settings.js` edit, no external module declaration, no extra npm install.
 
-<div class="ff-callout ff-callout--caution"><p class="ff-callout__title">Caution</p><div class="ff-callout__content">
+::caution
 Server hosting is **not supported on FlowFuse Cloud**, Cloud exposes HTTP/HTTPS only and cannot expose the arbitrary TCP port (`opc.tcp://`) a server needs. Use a self-hosted FlowFuse instance and ensure the chosen port is reachable through your container and network configuration.
-</div></div>
+::
 
 When the palette loads, it publishes a bootstrap helper in the Node-RED global context. Retrieve it and destructure `{ bootstrap, opcua }`: `bootstrap` carries the server helpers and `opcua` re-exports the full `node-opcua` namespace. This works even with `functionExternalModules: false`.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 `global.get("sterfive")` below is the literal runtime key the certified node exposes. Keep it exactly as written in your Function nodes, or the code will not find the helper.
-
-</div></div>
+::
 
 ### Basic pattern
 
@@ -865,11 +825,9 @@ handle.exposed.temperature.setValueFromSource({
 });
 ```
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Keep the handle in flow context, never in a local `const`/`let`, a Function node's body re-runs on every message. Prefix context keys with `$` (e.g. `$opcuaHandle`) and avoid the bare key `opcua` (it collides with other vendors), dotted keys (Node-RED reads them as nested paths), and colon-separated keys. Put construction-time options (`port`, `nodesets`, security, `users`) only in the Boot node, never in the Update node.
-
-</div></div>
+::
 
 ### Key `bootstrapServer` options
 
@@ -889,11 +847,9 @@ Keep the handle in flow context, never in a local `const`/`let`, a Function node
 | `onPopulate` | Callback run once when a new server is built, add your variables, objects, and methods here. |
 | `forceRebuild` | Set `true` to rebuild without a config change (e.g. after editing the trust store). |
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The server's identity is a config hash of `port`, `endpoint`, `applicationName`, `productUri`, `nodesets`, `securityPolicies`, `securityModes`, `allowAnonymous`, and `users`. Change any of these and the next deploy rebuilds the server (re-running `onPopulate`). `onPopulate` and `forceRebuild` are excluded from the hash, so editing `onPopulate` alone does not trigger a rebuild, use `forceRebuild: true` if you need one.
-
-</div></div>
+::
 
 ### Adding methods
 
@@ -983,11 +939,9 @@ Beyond roughly five servers per instance, prefer separate processes; the event l
 
 Authentication is declarative through the `users` array. Each entry has a username, a password, and roles. The helper bcrypt-hashes clear-text passwords at boot and maps role names to their NodeIds; a value already in bcrypt form (`$2a$`/`$2b$`/`$2y$` prefix) is passed through verbatim. The `users` array controls only session activation, per-node authorization comes from each variable's access-level attributes combined with role mapping. Set `allowAnonymous: false` to refuse anonymous sessions. The helpers `bootstrap.ensureBcryptHash(plain)` and `bootstrap.isBcryptHash(hash)` are available for tooling.
 
-<div class="ff-callout ff-callout--warning"><p class="ff-callout__title">Warning</p><div class="ff-callout__content">
-
+::warning
 If you omit `users`, the helper installs a default test set (`root/secret`, `gdsadmin/admingds`, `user1/password1`, `user2/password2`) intended only for development. Always set your own `users` for any instance reachable beyond your development machine.
-
-</div></div>
+::
 
 ### Security, certificates, and PKI storage
 
@@ -995,11 +949,9 @@ Enable secure endpoints with `securityPolicies` and `securityModes`; the server
 
 On FlowFuse, the node stores its PKI (its own certificate, the trusted list, and the rejected list) under `<instance working directory>/opcua-for-flow-fuse/PKI`. For this to survive restarts and redeploys, that directory must be on persistent storage: on container-based FlowFuse (Cloud, Kubernetes, Docker) this is the persistent volume mounted at `/data/storage`; on the FlowFuse Device Agent the working directory is on the device's local filesystem. If you re-trust a server's certificate after every deploy, your PKI directory is not landing on persistent storage.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Username/password over `MessageSecurityMode.None` travels in cleartext. Combine credentials with at least Sign mode. Disabling `SecurityPolicy.None` entirely can break naive clients that probe without security first.
-
-</div></div>
+::
 
 ### Lifecycle, diagnostics, and stopping
 
diff --git a/nuxt/content-guides/flowfuse-nodes/edge/rtsp.md b/nuxt/content-guides/flowfuse-nodes/edge/rtsp.md
index f8ddd50e66..0a8c8f789b 100644
--- a/nuxt/content-guides/flowfuse-nodes/edge/rtsp.md
+++ b/nuxt/content-guides/flowfuse-nodes/edge/rtsp.md
@@ -17,11 +17,9 @@ The node orchestrates `ffmpeg` to acquire and decode the video stream. By handli
 
 Extracted frames can either be emitted as messages into the flow or written directly to disk as a numbered sequence of PNG files. See [Operating modes](#operating-modes) for details.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The RTSP Video Feed node is not available by default. It is part of the FlowFuse Edge Certified Nodes catalogue, which is part of the **FlowFuse Edge** offering. Please contact our sales team at [Contact us](/contact-us/) to learn more or to request access.
-
-</div></div>
+::
 
 ## Use case
 
@@ -62,11 +60,9 @@ If a prebuilt binary is not available for your platform, the node falls back to
 ![Palette Manager open on the Install tab with the FlowFuse Edge Certified Nodes collection visible and the RTSP node's Install button highlighted](./images/rtsp/rtsp-edge-catalog.png)
 *Locating and installing the RTSP Video Feed node from the FlowFuse Edge Certified Nodes catalogue.*
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Newly installed nodes are picked up automatically, no restart needed. Restart is only required when you update a node that's already installed: restart any remote instance or hosted instance running the previous version.
-
-</div></div>
+::
 
 ## Configuration
 
@@ -103,11 +99,9 @@ The node emits each captured frame as a message at the configured FPS rate.
 
 The output can be wired to any node that accepts an image buffer, including [FlowFuse Dashboard widgets](/platform/dashboard/), [MQTT out nodes](/docs/flowfuse-nodes/mqtt/mqtt-out/), and [FlowFuse AI nodes](/docs/flowfuse-nodes/ai/).
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Every captured frame becomes a message in the flow. A high FPS value increases the number and size of messages being processed. Set FPS no higher than your use case requires.
-
-</div></div>
+::
 
 ### Output disabled
 
diff --git a/nuxt/content-guides/flowfuse-nodes/hub/README.md b/nuxt/content-guides/flowfuse-nodes/hub/README.md
index 3bf428307a..b86860beb7 100644
--- a/nuxt/content-guides/flowfuse-nodes/hub/README.md
+++ b/nuxt/content-guides/flowfuse-nodes/hub/README.md
@@ -13,17 +13,13 @@ This section contains documentation for **FlowFuse Hub Certified Nodes** that co
 
 FlowFuse Certified Nodes are packages that FlowFuse has vetted for quality, security, and support, and maintains on an ongoing basis. To learn more about what certification means and how these nodes are delivered, [read the FlowFuse Certified Nodes blog post](/blog/2025/07/certified-nodes-v2/).
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The FlowFuse Hub Certified Nodes catalogue is part of the **FlowFuse Hub** offering. [Contact us](/contact-us/) to get access or to learn more.
+::
 
-</div></div>
-
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 This section is expanding. We are actively working to bring more Hub Certified Nodes to FlowFuse, and additional documentation will be added here over time.
-
-</div></div>
+::
 
 ## Nodes
 
@@ -32,8 +28,6 @@ This section lists the **Hub Certified Nodes** documented in FlowFuse:
 - [Redis](/docs/flowfuse-nodes/hub/redis/): A FlowFuse-certified package that lets you connect to Redis, store and retrieve data, publish and subscribe to messages, execute commands, and integrate Redis into your flows.
 - [Kafka](/docs/flowfuse-nodes/hub/kafka/):  A FlowFuse-certified package that lets you connect to Apache Kafka, send and receive messages, run consumer groups, commit or roll back messages by hand, manage topics, and read offsets from your flows.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Newly installed nodes are picked up automatically, no restart needed. Restart is only required when you update a node that's already installed: restart any remote instance or hosted instance running the previous version.
-
-</div></div>
+::
diff --git a/nuxt/content-guides/flowfuse-nodes/hub/redis.md b/nuxt/content-guides/flowfuse-nodes/hub/redis.md
index d7cce99785..65a366bc34 100644
--- a/nuxt/content-guides/flowfuse-nodes/hub/redis.md
+++ b/nuxt/content-guides/flowfuse-nodes/hub/redis.md
@@ -23,11 +23,9 @@ Built on [ioredis](https://github.com/luin/ioredis), so anything ioredis support
 - Connections are pooled per config node, one connection is reused across every node pointed at the same server config, unless a node explicitly requests a dedicated (blocking) connection
 - TLS and Redis Cluster support
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 The Redis node is not available by default. It is part of the FlowFuse Hub Certified Nodes catalogue, which is part of the **FlowFuse Hub** offering. Please contact our sales team at [Contact us](/contact-us/) to learn more or to request access.
-
-</div></div>
+::
 
 ## Use case
 
@@ -48,11 +46,9 @@ Connections are pooled per config node, so pointing many nodes at the same serve
 3. Find the **FlowFuse Hub Certified Nodes** collection.
 4. Locate `@flowfuse-certified-nodes/redis` and click **Install**.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Newly installed nodes are picked up automatically, no restart needed. Restart is only required when you update a node that's already installed: restart any remote instance or hosted instance running the previous version.
-
-</div></div>
+::
 
 ## Nodes in this package
 
diff --git a/nuxt/content-guides/node-red/hardware/armxy-bl340.md b/nuxt/content-guides/node-red/hardware/armxy-bl340.md
index 41fd339b94..2313f5df7d 100644
--- a/nuxt/content-guides/node-red/hardware/armxy-bl340.md
+++ b/nuxt/content-guides/node-red/hardware/armxy-bl340.md
@@ -30,11 +30,9 @@ The BLIIOT ARMxy BL340 is a high-performance single-board computer designed for
 
 Integrating this powerful hardware with FlowFuse not only enhances its capabilities but also simplifies the management and deployment process.
 
-<div class="ff-callout ff-callout--note"><p class="ff-callout__title">Note</p><div class="ff-callout__content">
-
+::note
 Exciting Update! FlowFuse is now available as three different products: [FlowFuse Edge for OT teams](/product/edge/), [FlowFuse Hub for IT teams](/product/hub/), and [FlowFuse Fleet](/product/fleet/) for managing devices at scale. Visit the [FlowFuse Product Page](/product/) to learn how the platform enables you to build and manage industrial apps at scale.
-
-</div></div>
+::
 
 ## Prerequisites
 
diff --git a/nuxt/lib/docs-markdown.mjs b/nuxt/lib/docs-markdown.mjs
index e0e85b411b..88d3f54e41 100644
--- a/nuxt/lib/docs-markdown.mjs
+++ b/nuxt/lib/docs-markdown.mjs
@@ -17,9 +17,6 @@ const BLOCK_TAGS = new Set(['div', 'table', 'ul', 'ol', 'section', 'figure', 'de
  * A block runs from a column-0 opening tag to its matching column-0 closing tag. Nested
  * tags are always indented in this content, so a column-0 close is unambiguous. An opener
  * with no matching close is left untouched rather than swallowing the rest of the file.
- *
- * Must run before callout conversion, which deliberately inserts blank lines so markdown
- * inside a callout body still parses.
  */
 export function joinHtmlBlocks (content) {
     const lines = content.split('\n')
@@ -68,24 +65,37 @@ export function stripInlineScripts (content) {
     return content.replace(/^<script[\s\S]*?<\/script>[ \t]*\n?/gm, '')
 }
 
-/** Drop the Eleventy-only frontmatter field that Nunjucks needed. */
-export function stripTemplateEngineOverride (content) {
-    return content.replace(/^templateEngineOverride:[^\n]*\n/m, '')
-}
+/**
+ * Fail on a Nunjucks tag left in the docs.
+ *
+ * The upstream docs were written for Eleventy, which ran them through Nunjucks. @nuxt/content
+ * does not, and callouts and components are MDC now (`::note`, `::HubSpotForm{...}`). This
+ * used to strip leftover tags, which removed the installation form from
+ * docs/install/introduction.md without anyone noticing, so a tag now fails the build and
+ * names the line. Tags inside fenced code blocks and inline code are examples and stay.
+ */
+export function assertNoNunjucks (content, originalPath) {
+    const lines = content.split('\n')
+    let fence = null
+
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]
 
-/** Convert Eleventy callout shortcodes to the markup styled by style.docs.css. */
-export function convertCallouts (content) {
-    const callout = (kind, title) => [
-        new RegExp(`\\{%-?\\s*${kind}\\s*-?%\\}([\\s\\S]*?)\\{%-?\\s*end${kind}\\s*-?%\\}`, 'g'),
-        (_, body) => `<div class="ff-callout ff-callout--${kind}"><p class="ff-callout__title">${title}</p><div class="ff-callout__content">\n\n${body.trim()}\n\n</div></div>`,
-    ]
-
-    return content
-        .replace(...callout('note', 'Note'))
-        .replace(...callout('warning', 'Warning'))
-        .replace(...callout('critical', 'Critical'))
-        // Strip remaining Nunjucks tags (set, include, if, for, etc.)
-        .replace(/\{%[^%]*%\}\n?/g, '')
+        if (fence) {
+            if (fence.test(line)) fence = null
+            continue
+        }
+
+        const opener = /^\s*(`{3,}|~{3,})/.exec(line)
+        if (opener) {
+            fence = new RegExp(`^\\s*${opener[1][0] === '`' ? '`' : '~'}{${opener[1].length},}\\s*$`)
+            continue
+        }
+
+        if (line.replace(/`[^`]*`/g, '').includes('{%')) {
+            throw new Error(`docs/${originalPath}:${i + 1} has a Nunjucks tag, which @nuxt/content does not render. Use MDC instead (e.g. ::note). Line: ${line.trim()}`)
+        }
+    }
 }
 
 /** Prepend build-time provenance to the page frontmatter. */
@@ -98,9 +108,9 @@ export function injectFrontmatter (content, originalPath, updated, version) {
 }
 
 export function processMarkdown (content, originalPath, updated, version) {
+    // Before injectFrontmatter, so the reported line number is the source file's.
+    assertNoNunjucks(content, originalPath)
     let out = injectFrontmatter(content, originalPath, updated, version)
-    out = stripTemplateEngineOverride(out)
     out = stripInlineScripts(out)
-    out = joinHtmlBlocks(out)
-    return convertCallouts(out)
+    return joinHtmlBlocks(out)
 }
diff --git a/nuxt/lib/docs-markdown.test.mjs b/nuxt/lib/docs-markdown.test.mjs
index 049576c2ba..9845dac851 100644
--- a/nuxt/lib/docs-markdown.test.mjs
+++ b/nuxt/lib/docs-markdown.test.mjs
@@ -2,12 +2,11 @@ import { test } from 'node:test'
 import assert from 'node:assert/strict'
 
 import {
-    convertCallouts,
+    assertNoNunjucks,
     injectFrontmatter,
     joinHtmlBlocks,
     processMarkdown,
     stripInlineScripts,
-    stripTemplateEngineOverride,
 } from './docs-markdown.mjs'
 
 test('joinHtmlBlocks drops blank lines inside a top-level html block', () => {
@@ -64,16 +63,37 @@ test('stripInlineScripts leaves indented scripts in code samples alone', () => {
     assert.equal(stripInlineScripts(input), input)
 })
 
-test('convertCallouts rewrites note, warning and critical shortcodes', () => {
-    const out = convertCallouts('{% note %}\nBe careful.\n{% endnote %}')
+test('assertNoNunjucks fails on a leftover tag and names the source line', () => {
+    assert.throws(
+        () => assertNoNunjucks('# Title\n\n{% include "hubspot/hs-form.njk" %}\n', 'install/introduction.md'),
+        /docs\/install\/introduction\.md:3 has a Nunjucks tag/,
+    )
+    assert.throws(() => assertNoNunjucks('{% note %}\nBe careful.\n{% endnote %}', 'x.md'), /x\.md:1/)
+})
 
-    assert.match(out, /ff-callout--note/)
-    assert.match(out, /<p class="ff-callout__title">Note<\/p>/)
-    assert.match(out, /\n\nBe careful\.\n\n/)
+test('assertNoNunjucks allows tags inside fenced code and inline code', () => {
+    const input = [
+        'Write `{% raw %}` to escape.',
+        '',
+        '```njk',
+        '{% set x = 1 %}',
+        '```',
+        '',
+        '~~~~',
+        '```',
+        '{% if x %}',
+        '~~~~',
+        '',
+        '::note',
+        'MDC is fine.',
+        '::',
+    ].join('\n')
+
+    assert.doesNotThrow(() => assertNoNunjucks(input, 'x.md'))
 })
 
-test('convertCallouts strips leftover nunjucks tags', () => {
-    assert.equal(convertCallouts('{% set x = 1 %}\ntext').trim(), 'text')
+test('assertNoNunjucks checks again after a fence closes', () => {
+    assert.throws(() => assertNoNunjucks('```\n{% a %}\n```\n{% b %}\n', 'x.md'), /x\.md:4/)
 })
 
 test('injectFrontmatter adds provenance to existing frontmatter', () => {
@@ -89,15 +109,14 @@ test('injectFrontmatter creates frontmatter when the file has none', () => {
     assert.match(out, /---\nbody$/)
 })
 
-test('stripTemplateEngineOverride removes the eleventy-only field', () => {
-    assert.equal(stripTemplateEngineOverride('a\ntemplateEngineOverride: njk,md\nb\n'), 'a\nb\n')
-})
+test('processMarkdown passes MDC callouts through unchanged', () => {
+    const out = processMarkdown('::note\nSee the [docs](/docs/).\n::\n', 'x.md', '', '')
 
-test('processMarkdown keeps callout bodies parseable as markdown', () => {
-    // joinHtmlBlocks must not eat the blank lines convertCallouts inserts.
-    const out = processMarkdown('{% note %}\nSee the [docs](/docs/).\n{% endnote %}', 'x.md', '', '')
+    assert.match(out, /---\n::note\nSee the \[docs\]\(\/docs\/\)\.\n::\n$/)
+})
 
-    assert.match(out, /ff-callout__content">\n\nSee the \[docs\]\(\/docs\/\)\.\n\n<\/div>/)
+test('processMarkdown fails on a leftover nunjucks tag', () => {
+    assert.throws(() => processMarkdown('---\ntitle: x\n---\n{% note %}\nx\n{% endnote %}\n', 'a.md', '', ''), /docs\/a\.md:4/)
 })
 
 test('processMarkdown fixes a realistic card grid end to end', () => {