The email preview line

How the text is hidden

The idiom is a concealed span placed before any visible content, usually spelled as display:none together with a zero max-height. The parser identifies it by POSITION rather than by markup: it finds the first visible run in the document, and every concealed run before it that is shorter than the parser's preheader length cap becomes a block with the role header instead of body content.

Why a model still reads it

It is genuine concealment by the same mechanisms as an attack, and by construction indistinguishable from one except by where it sits. Every extractor reads it, and so does the inbox — which is the whole point of the idiom.

What we do about it

The rule fires on any run in a block whose role is header, at informational with action flag. Nothing is stripped and the verdict does not move. The position test is the control, and it is strict in the useful direction: the same markup placed AFTER visible text is not a preheader and reports html.display-none at high. The length cap is PREHEADER_MAX_CHARS, a constant in the HTML parser rather than a rule-pack limit — a long concealed block before the first visible text is not treated as a preheader and falls through to whatever concealment rule matches it.

How often it fires

63.3% of 150 real email-HTML templates from 133 GitHub repositories — email, not web pages, measured 2026-08-27.

This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.