fix(docs-hygiene): close nested fences only on a matching-or-longer delimiter (0.21.3)

[kyle-sexton]

Closes #3190

Summary

audit-noise flipped a single in_fence boolean on any line beginning with three or more backticks or tildes. A four-backtick outer fence wrapping a three-backtick example therefore closed at the inner fence, and everything between the inner close and the true outer close was scanned as prose.

This is shared pre-shape infrastructure — every finding shape inherited the false positive. The reported case is docs/conventions/finding-suppression/README.md:64, a ticket-pr-residue hit on an example suppression record inside a documentation fence.

Fix

The tracker now records the opening delimiter character and run length, and treats a later fence line as the close only when it uses the same character at a run length greater than or equal to the opener (CommonMark's close rule). Ordinary three-backtick and tilde fences are unchanged.

Verification

• detect.test.sh — 139 checks passed, including a nested ```` / ``` fixture and a tilde-fence regression
• Reproduction: detect.sh docs/conventions/finding-suppression/README.md reports T2=0 (was ticket-pr-residue on line 64)
• skill-quality:check docs-hygiene:audit-noise — PASS
• check-changelog-parity.sh --check-bump origin/main — PASS

Related

• Refs feat(docs-hygiene): audit-noise gains three residue shapes (0.20.0) #3162 — surfaced this; recorded it as a pre-existing exemption defect
• Refs docs-hygiene/audit-noise: scanner exemption gaps — frontmatter unimplemented, marker matches as substring, no code-fence awareness, section-state leaks #2742 / fix(docs-hygiene): close audit-noise scanner exemption gaps (0.14.5) #2794 — earlier scanner-exemption work covering the flat code-fence case

[claude]

Claude finished @kyle-sexton's task in 1m 11s —— View job

---

Security Review

• Gather context (PR diff, changed files)
• Run skip-gate check
• Review changed files for security-relevant issues
• Adversarial validation of any candidate findings
• Post final results

No security issues found.

This PR changes the fence-tracking state machine in plugins/docs-hygiene/skills/audit-noise/scripts/detect.sh (detect.sh#L245-L269) so a fence only closes on a matching-or-longer delimiter (CommonMark's rule), plus a matching test fixture in detect.test.sh, a version bump in plugin.json, and a CHANGELOG.md entry.

Scope assessed:

• detect.sh — read-only bash operating on local markdown files (CLI args or git status of the local working tree). The new logic is plain string/length comparisons on the fence delimiter (fence_dchar/fence_len); no eval, no command construction from file content, no new external/untrusted input path. Consistent with the script's existing read-only, exit-0-on-audit design.
• detect.test.sh — inline fixtures written to a mktemp -d tmpdir, no injection surface.
• plugin.json / CHANGELOG.md — metadata only.

No injection, auth/access-control, secret-handling, or GitHub Actions workflow changes in this diff. Skip-gate condition (no security-relevant surface) applies — nothing further to report.

[github-actions]

Last security-reviewed head: ca36ae70f37f1e91ca39f1dce3125cb8cb1308e8. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 1m 21s —— View job

---

/review:code-review

• Gather context (PR metadata, diff)
• Apply skip gate
• Post result

Skip gate triggered: PR #3227 is already merged (base main, head ca36ae7). Per the /review:code-review skip gate, review stops early on closed/not-open PRs — no inline comments were posted.

For reference, the merged change (fix(docs-hygiene): close nested fences only on a matching-or-longer delimiter, 0.21.3) fixes audit-noise's fence-tracking in plugins/docs-hygiene/skills/audit-noise/scripts/detect.sh so a nested fence with a shorter/different delimiter no longer closes an outer fence early — it now records the opening delimiter char + run length and only treats a later fence line as the close when it matches with an equal-or-greater run length (CommonMark's close rule). Tests were extended accordingly in detect.test.sh.

If you'd like a substantive review of this change despite the merge, let me know and I'll do a full pass against plugins/docs-hygiene/skills/audit-noise/scripts/detect.sh on that commit.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.