ww source: reject raw NUL characters

docs/test-system-v2.md

@@ -429,6 +429,26 @@ before either operation. The marker is source representation only and never
 package/import/action/artifact/publication/persistence identity; no test result
 is cached.
 
+After filename eligibility and before package-clause classification, each raw
+source byte `00` in a selected production, same-package test,
+external-package test, or test-only source is one positioned
+`invalid NUL character` error. Comments and literal text do not hide it. The
+shared coordinator owns that early package/test rejection and reports every
+raw NUL in the invalid physical source. On complete direct
+frontend inputs, the C and WW source decoders diagnose each raw NUL and omit it
+from their logical character streams before token recovery. Thus a NUL cannot
+split an escape, identifier, number or suffix, operator, comment delimiter, or
+EOF boundary into a stage-dependent second error. Test loading maintains a
+stage-equal source-diagnostic stream before import discovery, graph actions,
+producers, test execution, accounting, result output, or retained publication.
+An invalid selected test request emits only the existing attributable
+`FAIL\n`; it does not construct a variant, generated main, test child, or new
+persistent generation. Wrong-target exclusion remains first, so an excluded
+file with a raw NUL has no diagnostic or persistence effect. A `\\x00` escape
+remains a valid literal value. This rule is limited to raw U+0000; malformed
+UTF-8 and the independent per-source BOM rule retain their existing, separate
+contracts.
+
 After that eligibility boundary and the coordinator's required package-clause
 classification and production `@test` validation parses, the delegated loader
 performs selected-basename Go 1.26.5 simple-fold preflight before its graph