fix: whitespace is not a drill record

.github/scripts/drill-recorded.sh

@@ -79,14 +79,25 @@ esac
 # The em dash is passed IN as a variable rather than written into the awk
 # program, because '\x' escapes in an awk string are a gawk extension and CI
 # runs on ubuntu-latest, where awk is mawk.
+#
+# `grab && NF` is the non-blank rule, and it is load-bearing rather than
+# tidiness. NF is 0 on a line that is empty OR contains only whitespace, so
+# `record` ends up non-empty exactly when a line with actual content exists.
+# The first cut of this piped through `sed '/./,$!d'` instead, which drops
+# leading blank lines but keeps a line of spaces — `.` matches a space. A
+# heading followed by nothing but a tab therefore satisfied the guard and
+# shipped an evidence-free release, while the failure text below promised "at
+# least one non-blank line". The implementation was looser than its own
+# contract, which on a gate is the whole ballgame: the bypass costs one
+# invisible character. Caught by all three reviewers on #149, independently.
 record="$(awk -v ver="$ver" -v dash="—" '
   /^## / {
     grab = ($2 == "Release" && $3 == "drill" && $4 == dash && $5 == ver \
             && (NF == 5 || $6 == dash))
     next
   }
-  grab { print }
-' "$runs" | sed '/./,$!d')"
+  grab && NF { print }
+' "$runs")"
 
 if [ -z "$record" ]; then
   cat >&2 <<EOF

test/release.sh

@@ -343,6 +343,17 @@ T="$(dtree drill-empty 0.9.0 '## Release drill — 0.9.0 — 2026-07-21' '' '' '
 check "drill-recorded: a bare VERSION whose record is present but EMPTY fails" \
   1 "no drill record" drilled "$T"
 
+# ...and WHITESPACE is not evidence either. The first cut extracted with
+# `sed '/./,$!d'`, where `.` matches a space — so a heading followed by one
+# tab passed the guard while the failure text promised "at least one non-blank
+# line". An evidence-free release for the price of an invisible character, on
+# the one check whose entire job is to demand evidence. All three reviewers on
+# #149 found it independently, which is the level of scrutiny it deserved and
+# not a level it should ever need again.
+T="$(dtree drill-blank 0.9.0 '## Release drill — 0.9.0 — 2026-07-21' '   ' '	' '' '## Run history' '' '- older prose')"
+check "drill-recorded: a record body of only spaces and tabs fails (#149)" \
+  1 "no drill record" drilled "$T"
+
 # --- the version is matched WHOLE, both directions -------------------------
 # release-notes.sh's trap, in a new file: a substring match would let an rc
 # drill stand in for the release it was a candidate for, which is the one