diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 668a5ae..1358cd1 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -125,27 +125,46 @@ jobs:
           # Inline invisible character detection (from empty-linter's core patterns).
           # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,
           # non-breaking spaces, null bytes, and other invisible Unicode in source files.
+          PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]'
           set +e
-          PATTERNS='\xc2\xa0|\xe2\x80\x8b|\xe2\x80\x8c|\xe2\x80\x8d|\xef\xbb\xbf|\xc2\xad|\xe2\x80\x8e|\xe2\x80\x8f|\xe2\x80\xaa|\xe2\x80\xab|\xe2\x80\xac|\xe2\x80\xad|\xe2\x80\xae|\x00'
-          find "$GITHUB_WORKSPACE" \
-            -not -path '*/.git/*' -not -path '*/node_modules/*' \
-            -not -path '*/.deno/*' -not -path '*/target/*' \
-            -not -path '*/_build/*' -not -path '*/deps/*' \
-            -not -path '*/external_corpora/*' -not -path '*/.lake/*' \
-            -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \
-              -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \
-              -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \
-              -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \
-              -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \
-            -exec grep -Prl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
-          EL_EXIT=$?
+          grep -aPrl \
+            --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=.deno \
+            --exclude-dir=target --exclude-dir=_build --exclude-dir=deps \
+            --exclude-dir=external_corpora --exclude-dir=.lake \
+            --include='*.rs' --include='*.ex' --include='*.exs' --include='*.res' \
+            --include='*.js' --include='*.ts' --include='*.json' --include='*.toml' \
+            --include='*.yml' --include='*.yaml' --include='*.md' --include='*.adoc' \
+            --include='*.idr' --include='*.zig' --include='*.v' --include='*.jl' \
+            --include='*.gleam' --include='*.hs' --include='*.ml' --include='*.sh' \
+            "$PATTERNS" "$GITHUB_WORKSPACE" > /tmp/empty-lint-results.txt 2>/tmp/empty-lint-errors.txt
+          GREP_EXIT=$?
           set -e
 
+          # GNU grep: 0 = matches, 1 = clean, >1 = scanner failure. A scanner
+          # failure must fail closed rather than being mistaken for a clean scan.
+          if [ "$GREP_EXIT" -gt 1 ]; then
+            cat /tmp/empty-lint-errors.txt >&2
+            echo "::error::invisible-character scan failed with exit $GREP_EXIT"
+            exit "$GREP_EXIT"
+          fi
+
           FINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)
           echo "findings=$FINDINGS" >> "$GITHUB_OUTPUT"
-          echo "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"
           echo "ready=true" >> "$GITHUB_OUTPUT"
 
+          # Blocking subset: C0 controls and NUL only (owner ruling 2026-08-28).
+          # Invisible Unicode (NBSP/BOM/zero-width) stays ADVISORY - about 2,100
+          # estate files carry it as legitimate typography in prose.
+          blocking=0
+          while IFS= read -r bf; do
+            [ -z "$bf" ] && continue
+            if grep -qaP '\x00|[\x01-\x08\x0B\x0C\x0E-\x1F]' "$bf"; then
+              blocking=$((blocking+1))
+              echo "::error file=${bf#$GITHUB_WORKSPACE/}::C0 control characters or NUL bytes - file corruption, blocks the gate"
+            fi
+          done < /tmp/empty-lint-results.txt
+          echo "blocking=$blocking" >> "$GITHUB_OUTPUT"
+
           # Emit annotations for each file with invisible chars
           while IFS= read -r filepath; do
             [ -z "$filepath" ] && continue
@@ -153,6 +172,18 @@ jobs:
             echo "::warning file=${REL_PATH}::Invisible Unicode characters detected (zero-width space, BOM, NBSP, etc.)"
           done < /tmp/empty-lint-results.txt
 
+          # Enforce (owner ruling 2026-08-28): C0/NUL corruption BLOCKS; other
+          # invisible Unicode stays advisory. Enforcement lives inside this step
+          # so a crash above fails the job directly - counts can never arrive
+          # empty into a separate check that then passes silently.
+          if [ "${blocking:-0}" -gt 0 ]; then
+            echo "## Empty-linter: BLOCKED - $blocking file(s) with C0/NUL corruption" >> "$GITHUB_STEP_SUMMARY"
+            echo "::error::$blocking file(s) contain C0 control characters or NUL bytes - corruption, not typography. See file annotations."
+            exit 1
+          elif [ "${FINDINGS:-0}" -gt 0 ]; then
+            echo "::notice::$FINDINGS file(s) carry invisible Unicode (NBSP/BOM/zero-width) - advisory only"
+          fi
+
       - name: Write summary
         run: |
           if [ "${{ steps.lint.outputs.ready }}" = "true" ]; then