TestNoSecondFenceRule (internal/core/mdrecord/fence_canonical_test.go) flags a file only when it writes a fence delimiter AND matches one of a few tracker spellings (inFence, inCode, openChar, fenceOpen, a boolean flipped in place as x = !x), so two common styles of a private fence toggle escape it: a regexp with run tracking kept in a variable named open, and a three-backtick flip written as an if/else rather than x = !x (mutants C and D on a scratch copy; A and B were caught). Only ten non-test Go files outside mdrecord write a delimiter at all, so the detector can be inverted to delimiter-only with a reasoned allowlist, and every new writer then needs a stated reason.

TestNoSecondFenceRule (internal/core/mdrecord/fence_canonical_test.go) flags a file only when it writes a fence delimiter AND matches one of a few tracker spellings (inFence, inCode, openChar, fenceOpen, a boolean flipped in place as x = !x), so two common styles of a private fence toggle escape it: a regexp with run tracking kept in a variable named open, and a three-backtick flip written as an if/else rather than x = !x (mutants C and D on a scratch copy; A and B were caught). Only ten non-test Go files outside mdrecord write a delimiter at all, so the detector can be inverted to delimiter-only with a reasoned allowlist, and every new writer then needs a stated reason.

Grounds

• pursued: on a scratch copy, mutant C (a regexp with run tracking in a variable named open, in a new file) and mutant D (an if/else flip on three backticks appended to an allowlisted file) each fail the detector, and it passes on the tree; a toggle written with a literal delimiter that the detector passes would show it wrong