@@ -22,7 +22,7 @@
 import re
 import time
 import unicodedata
-from collections.abc import Callable, Iterator
+from collections.abc import Callable, Iterator, Sequence
 from dataclasses import dataclass, field
 from typing import cast
 
@@ -941,6 +941,7 @@ class _TP4Candidate:
     content: str
     start_line: int = 1
     end_line: int = 1
+    context: str = ""
 
 
 _TP4_MARKDOWN_TYPES = frozenset({"markdown", "text"})
@@ -964,21 +965,55 @@ class _TP4Candidate:
 }
 _TP4_FENCE_OPEN_RE = re.compile(r"^[ ]{0,3}(`{3,}|~{3,})[ \t]*([^ \t]+)?[ \t]*$")
 _TP4_FENCE_CLOSE_RE = re.compile(r"^[ ]{0,3}(`{3,}|~{3,})[ \t]*$")
+TP4_MAX_CONTEXT_CHARS = 2_048
+_TP4_MAX_CONTEXT_LINES = 8
+
+
+def _tp4_fence_context(preceding: Sequence[str]) -> str:
+    """Return the bounded prose that introduces a fence, if any.
+
+    A fenced block is often introduced by text that changes how it should be
+    read, such as a heading marking it as an example that must not be run.
+    The extractor cannot see that framing when only the fence body is sent, so
+    a short trailing window of non-blank prose is retained with the code.
+    """
+    context_lines: list[str] = []
+    for raw in reversed(preceding):
+        stripped = raw.strip()
+        if not stripped:
+            if context_lines:
+                break
+            continue
+        context_lines.append(stripped)
+        if len(context_lines) >= _TP4_MAX_CONTEXT_LINES:
+            break
+    if not context_lines:
+        return ""
+    context = "\n".join(reversed(context_lines))
+    if len(context) > TP4_MAX_CONTEXT_CHARS:
+        context = context[-TP4_MAX_CONTEXT_CHARS:]
+    return context
 
 
 def _iter_tp4_markdown_fences(
     content: str,
-) -> Iterator[tuple[str, str, int, int]]:
-    """Yield exactly labeled, non-empty executable fences from bounded Markdown/text."""
+) -> Iterator[tuple[str, str, int, int, str]]:
+    """Yield labeled, non-empty executable fences and their leading context.
+
+    Yields ``(language, body, start_line, end_line, context)`` where ``context``
+    is the bounded prose immediately preceding the opening fence.
+    """
     lines = content.splitlines(keepends=True)
     active: tuple[str, int, str] | None = None
     body: list[str] = []
     body_start = 0
+    preceding: list[str] = []
     for line_number, line in enumerate(lines, start=1):
         stripped = line.rstrip("\r\n")
         if active is None:
             opening = _TP4_FENCE_OPEN_RE.fullmatch(stripped)
             if opening is None:
+                preceding.append(line)
                 continue
             delimiter, label = opening.groups()
             active = (delimiter[0], len(delimiter), label.casefold() if label else "")
@@ -993,9 +1028,16 @@ def _iter_tp4_markdown_fences(
                 language = _TP4_MARKDOWN_EXECUTABLE_LABELS.get(active[2])
                 body_text = "".join(body)
                 if language is not None and body_text.strip():
-                    yield language, body_text, body_start, line_number - 1
+                    yield (
+                        language,
+                        body_text,
+                        body_start,
+                        line_number - 1,
+                        _tp4_fence_context(preceding),
+                    )
                 active = None
                 body = []
+                preceding = []
                 continue
         body.append(line)
 
@@ -1316,9 +1358,18 @@ def plan_candidate(candidate: _TP4Candidate) -> None:
                         )
                     )
                     break
+                # The context block is part of the prompt, so it must also
+                # participate in the same token and byte budgets as the code.
+                context_block = (
+                    f"Document context (verbatim, not part of the code):\n{candidate.context}\n"
+                    if candidate.context
+                    else ""
+                )
                 prompt = (
                     prefix
-                    + f"### {candidate.path} ({candidate.language})\n{chunk.content}"
+                    + f"### {candidate.path} ({candidate.language})\n"
+                    + context_block
+                    + f"{chunk.content}"
                     + _TP4_PROMPT_SUFFIX
                 )
                 if estimate_tokens(prompt) > batch_input_tokens:
@@ -1461,8 +1512,10 @@ def iter_candidates() -> Iterator[_TP4Candidate]:
                     return
                 if not retained:
                     continue
-                for language, body, start_line, end_line in _iter_tp4_markdown_fences(retained):
-                    yield _TP4Candidate(path, language, body, start_line, end_line)
+                for language, body, start_line, end_line, context in _iter_tp4_markdown_fences(
+                    retained
+                ):
+                    yield _TP4Candidate(path, language, body, start_line, end_line, context)
                     if stop_reason is not None:
                         break
 
 
@@ -1126,7 +1126,7 @@ def test_fences_reject_false_positives_and_keep_ranges(self):
 
         fences = list(mcp_tool_poisoning._iter_tp4_markdown_fences(content))
 
-        assert fences == [("python", "print('accepted')\n", 11, 11)]
+        assert fences == [("python", "print('accepted')\n", 11, 11, "")]
 
     def test_common_markdown_executable_labels_are_normalized(self):
         content = (
@@ -1537,6 +1537,70 @@ def test_separated_markdown_fences_keep_independent_source_ranges(
         assert matching_events
         assert finding.finding_id in matching_events[0]["emitted_finding_ids"]
 
+    def test_fence_context_keeps_the_warning_that_marks_code_unsafe(self):
+        content = (
+            "## Before: unsafe example\n"
+            "Do not execute this.\n"
+            "```bash\n"
+            "rm -rf ./data\n"
+            "```\n"
+            "## After: safe alternative\n"
+        )
+
+        fences = list(mcp_tool_poisoning._iter_tp4_markdown_fences(content))
+
+        assert len(fences) == 1
+        language, body, start_line, end_line, context = fences[0]
+        assert language == "shell"
+        assert body == "rm -rf ./data\n"
+        assert start_line == 4
+        assert end_line == 4
+        assert "Do not execute this." in context
+        assert "Before: unsafe example" in context
+
+    def test_fence_context_is_bounded_and_ignores_leading_blanks(self):
+        content = "\n\n\n" + ("prose line\n" * 40) + "```python\nprint('x')\n```\n"
+
+        _language, _body, _start, _end, context = next(
+            iter(mcp_tool_poisoning._iter_tp4_markdown_fences(content))
+        )
+
+        assert context
+        assert len(context) <= mcp_tool_poisoning.TP4_MAX_CONTEXT_CHARS
+        assert len(context.splitlines()) <= 8
+        assert not context.startswith("\n")
+
+    def test_fence_without_preceding_prose_has_empty_context(self):
+        fences = list(mcp_tool_poisoning._iter_tp4_markdown_fences("```python\nprint('x')\n```\n"))
+
+        assert fences[0][4] == ""
+
+    def test_unsafe_example_context_reaches_the_tp4_prompt(self, monkeypatch: pytest.MonkeyPatch):
+        """The document framing must reach the model, with code lines unchanged."""
+        structured = _mock_tp4_structured_llm(monkeypatch, [{"is_mismatch": False}])
+        content = (
+            "## Before: unsafe example\n"
+            "Do not execute this.\n"
+            "```bash\n"
+            "rm -rf ./data\n"
+            "```\n"
+            "## After: safe alternative\n"
+        )
+
+        mcp_tool_poisoning._check_tp4(
+            {
+                "manifest": {"description": "Documents a cleanup example."},
+                "file_cache": {"guide.md": content},
+                "component_metadata": [{"path": "guide.md", "type": "markdown"}],
+                "model_config": {"default": "test-model"},
+            }
+        )
+
+        prompt = structured.prompts[0]
+        assert "### guide.md (shell)" in prompt
+        assert "Do not execute this." in prompt
+        assert "rm -rf ./data" in prompt
+
     def test_no_applicable_markdown_keeps_clean_status(self, monkeypatch: pytest.MonkeyPatch):
         structured = _mock_tp4_structured_llm(monkeypatch, [])
         result = node(