@@ -270,13 +270,23 @@ backslash-u forms like `\u0000` / `\u0001` — never as raw bytes, in **any**
270270file (source, markdown, fixtures) and in any prompt or tool payload you
271271compose: describe the escape, do not paste the byte. Editing tools
272272materialize escapes into real control bytes precisely when you are writing
273- * about* them — this repo has paid four times: #4763 (raw NUL in a dispatch
274- prompt), #4890 (a raw NUL landed in ` SKILL.md ` ** while writing the
275- no-raw-NUL rule** , outside every gate's scan surface), and PR #5140 's two
276- bytes — a NUL plus, 14 bytes away, a ` 0x01 ` that ` check:nul-bytes ` does not
277- scan for (#5157 ). One raw control byte makes grep treat the whole file as
278- binary: zero matches, no signal, and the rule you just wrote becomes
279- invisible to every agent that greps for it. Run
273+ * about* them, and this repo has paid for it repeatedly — including #4763
274+ (raw NUL in a dispatch prompt), #4890 (a raw NUL landed in ` SKILL.md `
275+ ** while writing the no-raw-NUL rule** , outside every gate's scan surface),
276+ and PR #5140 's two bytes: a NUL plus, 14 bytes away, a ` 0x01 ` that the
277+ then-NUL-only scan walked straight past — the gap #5157 closed by widening
278+ the scan surface beyond NUL. The harms are argued in the gate script's
279+ header (` scripts/check-nul-bytes.mjs ` ) — cite it, don't re-derive it.
280+ Measured, only a raw ** NUL** makes grep and ripgrep treat the whole file as
281+ binary and report zero matches with no signal, so the rule you just wrote
282+ becomes invisible to every agent that greps for it. Every other scanned byte
283+ (` 0x01 ` , ` 0x7f ` , …) keeps matching line by line, and is rejected for the
284+ three harms that land on the whole set: it ** renders as nothing** , so the
285+ code lies to every reader; it is unfindable in ** both** spellings, since the
286+ file holds a byte and not the escape text you would search for; and the
287+ accident source ** does not pick byte values** . "Mine is not a NUL and grep
288+ still finds my file" is therefore never a reason to read a gate failure or a
289+ self-scan hit as a false positive. Run
280290` node scripts/check-nul-bytes.mjs ` before pushing, and when your change so
281291much as * mentions* control characters, self-scan beyond the gate
282292(` grep -naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]' <files> ` ) — the gate's blind
0 commit comments