fix(ci): the invisible-character gate never matched anything (#197)

**Measured 2026-08-27: this gate caught 0 of 6 invisible-character test
cases.** It has never detected an NBSP, zero-width space, BOM, soft
hyphen, bidi override or word joiner.

## Root cause

The pattern used UTF-8 **byte sequences** (`\xc2\xa0`) while `grep -P`
matches **characters**. Bytes `c2 a0` are *one* character U+00A0;
`\xc2\xa0` asks for *two*, U+00C2 then U+00A0 — never present.

```
grep -P '\xc2\xa0'  ->  miss
grep -P '\x{a0}'    ->  MATCH
```

Only `\x00` worked, being single-byte in both readings. The gate ran,
passed, and could not see what it exists to see.

## Fixed

- **codepoint escapes** in place of byte sequences
- **C0 controls** `\x01-\x08,\x0B,\x0C,\x0E-\x1F` added (TAB/LF/CR
excluded)
- **`grep -a`** — without it grep skips any NUL-bearing file as binary

The C0 range matters: a stray **backspace byte** made a workflow
unparseable in `developer-ecosystem`, so it never ran — and this linter
called it clean.

Canonical fix: hyperpolymath/empty-linter#70. **2 file(s)** here.

**Verified:** YAML re-parsed, and the corrected pattern was confirmed to
catch a real NBSP before the change was kept.

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -124,7 +124,7 @@ jobs:
           # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,
           # non-breaking spaces, null bytes, and other invisible Unicode in source files.
           set +e
-          PATTERNS='\xc2\xa0|\xe2\x80\x8b|\xe2\x80\x8c|\xe2\x80\x8d|\xef\xbb\xbf|\xc2\xad|\xe2\x80\x8e|\xe2\x80\x8f|\xe2\x80\xaa|\xe2\x80\xab|\xe2\x80\xac|\xe2\x80\xad|\xe2\x80\xae|\x00'
+          PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]'
           find "$GITHUB_WORKSPACE" \
             -not -path '*/.git/*' -not -path '*/node_modules/*' \
             -not -path '*/.deno/*' -not -path '*/target/*' \
@@ -135,7 +135,7 @@ jobs:
               -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \
               -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \
               -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \
-            -exec grep -Prl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
+            -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
           EL_EXIT=$?
           set -e
 

rescript-ecosystem/idaptik-rescript13-staging/.github/workflows/dogfood-gate.yml

@@ -112,7 +112,7 @@ jobs:
           # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,
           # non-breaking spaces, null bytes, and other invisible Unicode in source files.
           set +e
-          PATTERNS='\xc2\xa0|\xe2\x80\x8b|\xe2\x80\x8c|\xe2\x80\x8d|\xef\xbb\xbf|\xc2\xad|\xe2\x80\x8e|\xe2\x80\x8f|\xe2\x80\xaa|\xe2\x80\xab|\xe2\x80\xac|\xe2\x80\xad|\xe2\x80\xae|\x00'
+          PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]'
           find "$GITHUB_WORKSPACE" \
             -not -path '*/.git/*' -not -path '*/node_modules/*' \
             -not -path '*/.deno/*' -not -path '*/target/*' \
@@ -123,7 +123,7 @@ jobs:
               -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \
               -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \
               -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \
-            -exec grep -Prl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
+            -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
           EL_EXIT=$?
           set -e
 

rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/npm-bun-blocker.yml

@@ -1,51 +1,38 @@
 # SPDX-License-Identifier: MPL-2.0
-name: npm/bun Blocker
-on: [push, pull_request]
+#
+# Authored replacement, 2026-08-28. The previous file contained a literal
+# backspace byte (0x08) inside a regex, which made the YAML unloadable - so
+# this workflow NEVER RAN in its entire history, while reporting nothing.
+# Removing the byte exposed further structural errors, so it was rewritten
+# against the corrected estate template rather than patched.
+name: npm/pnpm/yarn Blocker
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-      - name: Check for npm/bun usage in new files
+      - uses: actions/checkout@v7.0.1
+      - name: Block npm/pnpm/yarn lockfiles
         run: |
-          # Check for new bun.lockb files
-          NEW_BUN=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'bun\.lockb$' || true)
-
-          # Check for npm scripts calling npm/bun in new or modified files
-          NPM_CALLS=$(git diff HEAD~1 2>/dev/null | grep -E '^\+.*(npm|bun)\s+(run|install|start|test|build)' | grep -v '#' || true)
-
-          ERRORS=""
-
-          if [ -n "$NEW_BUN" ]; then
-            ERRORS="${ERRORS}New bun.lockb detected. Use Deno instead.
-${NEW_BUN}
-"
-          fi
-
-          if [ -n "$NPM_CALLS" ]; then
-            ERRORS="${ERRORS}npm/bun commands in new code. Use Deno tasks instead.
-${NPM_CALLS}
-"
-          fi
-
-          if [ -n "$ERRORS" ]; then
-            echo -e "$ERRORS"
-            echo ""
-            echo "Per language policy, use Deno instead of npm/bun for:"
-            echo "  - Package management: deno.json imports"
-            echo "  - Task running: deno task <name>"
-            echo "  - Scripts: deno run script.ts"
+          # Bun is tier 1 (owner ruling 2026-08-26): package.json + bun.lock are
+          # EXPECTED. Only npm/pnpm/yarn lockfiles are rejected. .npmrc is
+          # allowed - Bun reads it for private-registry auth.
+          if [ -f "package-lock.json" ] || [ -f "pnpm-lock.yaml" ] || [ -f "yarn.lock" ]; then
+            echo "❌ npm/pnpm/yarn artifacts detected. Use Bun (package.json + bun.lock) instead."
             exit 1
           fi
-
-          echo "Deno policy enforced (no new npm/bun usage)"
-
-      - name: Verify deno.json exists
-        run: |
-          if [ ! -f "deno.json" ]; then
-            echo "Warning: deno.json not found"
-            echo "Consider adding deno.json for Deno configuration"
-          else
-            echo "deno.json found"
-          fi
+          echo "✅ No npm/pnpm/yarn violations"