diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1342e3d..76217b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
             <(git ls-files '*.sh' | sort -u))"
           if [ -n "$missing" ]; then
             echo "tracked scripts the shellcheck sweep does not cover (#116):"
-            printf '  %s\n' $missing
+            printf '%s\n' "$missing" | sed 's/^/  /'
             exit 1
           fi
           shellcheck -x "${files[@]}"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 448b74b..ee67ae2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -59,8 +59,6 @@ which records not just what changed but what each drill run proved.
   operator copy-pastes is as wrong as a role box executes, and it fails
   later and further from the cause.
 
-## 0.8.0 — 2026-07-19
-
 ### Fixed
 
 - **CI's shellcheck sweep never lints `.github/scripts/*.sh`** (#116) —
@@ -83,6 +81,9 @@ which records not just what changed but what each drill run proved.
   a shopt subtlety hides one. `eof_guard_sweep` itself carried the identical
   blind spot — it rebuilds the same glob — and is widened the same way.
 
+
+## 0.8.0 — 2026-07-19
+
 ### Added
 
 - **Merging the release PR IS the release — and the release re-arms main