fix(attribution): the shapes a footer collapses to, and the half no hook reaches

.claude/rules/delivery.md

@@ -37,10 +37,10 @@ Once the last task is done:
 3. **Commit and push.** Conventional Commits, written from the diff and the spec.
 4. **Open the PR.** Body: what changed, which spec or plan, how it was verified.
 
-**The work is the user's, and the record says so.** No `Co-Authored-By` for an assistant,
-no session link, no "generated with" footer or badge, no naming of a model, vendor or
-harness — not in a commit message, not in a PR title or body. The `commit-msg` hook
-rejects it as you write it, `SCC_SKIP_HOOKS=1` is not the fix, `--pr` reads the PR body.
+**The work is the user's, and the record says so.** No `Co-Authored-By` for an assistant, no
+vendor link, no "generated with" footer or badge, no crediting a tool ("thanks to", "with the
+help of", "used X to"), no naming a model, vendor or harness — not in a commit, a PR title,
+body or comment. `commit-msg` rejects a commit, `--pr` the forge; `SCC_SKIP_HOOKS=1` is no fix.
 
 **The gates are commands, not claims.** What this workspace recorded for build, format,
 lint and test; the last reads back `{"total": N, "coverage": P}` and is held to a floor.

.claude/scc-manifest.json

@@ -10,62 +10,62 @@
     {
       "hash": "08141d3f57fbe10f46ea557de9969fe06f96e4aceca90cd14079aea0162e4a73",
       "path": ".claude/agents/scc-code-review.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "86ae07c5864d0c38932cf9781e5b0ac5d6f6e36925577efdef646e779abbe65b",
       "path": ".claude/agents/scc-security-review.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "f3132fd6be0b859b5ffb063e22ba3b840226c5bfdde2613cd21993ff12afa477",
       "path": ".claude/rules/artifacts.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "2eb97e13f6d088379c51870ff7338ddd36d3e377486408d5a2a2d236fe05a1e1",
       "path": ".claude/rules/autonomy.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "8eee2d450faada83295a4a04e5a1267bf5f717df9e7ac7da5fddd7649c666499",
       "path": ".claude/rules/caveman.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "cfe46c6623c20b6da46c9f18ef9b35e0f554c6c4568791ff190648dda3524706",
       "path": ".claude/rules/code-search.md",
-      "version": "32"
+      "version": "35"
     },
     {
-      "hash": "3ad4d9513a212bcced1b99db171a9ed53ccb4be38063f345ae722e6c8f36fa20",
+      "hash": "3bb9d1336dd9478c76f1957167bbfddba5aa5adf97908b0791caaf75e96c446f",
       "path": ".claude/rules/delivery.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "ffca716ea25746d8e100ba3a7a7b884907736adebf3a7131b989fa4e9fcd0d80",
       "path": ".claude/rules/knowledge-base.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "59bb916a2002d4176353463b017c366868192cf95c80fd1dce74265188b738c3",
       "path": ".claude/rules/ladder.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "79d5cbf1ab7fd09d26e9ea9119f3f283615467dbc35d3a4b1d4a030044b3598f",
       "path": ".claude/rules/methodology.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "7dcbf5cd9d2e9e8d08aed4eeaa96ee28af85da1d6de51fc35870b8430e30f331",
       "path": ".claude/rules/notes.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "52c5033fc427445b4e669c7865dbd8d5c2fc27d57f7200aeeb2cc48bc8e050d3",
       "path": ".claude/rules/prior-art.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "ae0030df2e1f053642a84953648e1d6038b0f0fbae831edf1c349badfb00485c",
@@ -75,62 +75,62 @@
     {
       "hash": "c8502ace5978c7b9c0543c49ebb5c9550584b1a3405e12c0217b595647e27722",
       "path": ".claude/rules/routing.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "0b86b1a73769c6ebd37c338c5ec3cbee8dda70b21d43b27a1c95eebc5ee70a9f",
       "path": ".claude/rules/specs.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "d64a118d493424b10ad8af24861083c34541f7946a92dae92fb153b0ab739c26",
       "path": ".claude/rules/tasks.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "403174a8133018b54adc69c3047c46f8ff603b8a91759c62da1e7ca6b7f45463",
       "path": ".claude/rules/verification.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "cce99457f203766837ec2b8165a9370924178d9ee377c7848dba65880461cf3f",
       "path": ".claude/skills/scc-adr/SKILL.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "fc2ecb43e7e3c157082dc359d1d0fb20c99fdb6fb774cfcead3c8c0961fef922",
       "path": ".claude/skills/scc-codewiki/SKILL.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "60e80dcee7e68498679735ac40812ac90641340fef6bd75d3e7de64d209f8716",
       "path": ".claude/skills/scc-glossary/SKILL.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "9d21e953cce950ccf495810c94411a98706780b2b8d38817e3ce13bfc0c74625",
       "path": ".claude/skills/scc-init/SKILL.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "2385f307f96cc4261e44d1a0d49bb39d6a5842a3205cee317e3228ced0f6aeb6",
       "path": ".claude/skills/scc-plan-run/SKILL.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "3d3773f869d73beeab4c2061397c9ad81faf6d4c11d1ef423470aca432c5a9e1",
       "path": ".claude/skills/scc-prd/SKILL.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "42dff0d55f15c60da604f62fc1dfe8af5b73de2e2497553411447aae57698e1b",
       "path": ".claude/skills/scc-stack/SKILL.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "aa53b7ddf701ea495d68ea12aa23a6d352c202edc0e308b7218a1bf685b09f21",
       "path": ".claude/skills/scc-wiki/SKILL.md",
-      "version": "32"
+      "version": "35"
     },
     {
       "hash": "9dc2f234756bfdc79aa5697e8470f80766e68a0e72b6cda98107e25ea8a9427a",

docs/notes.md

@@ -49,3 +49,6 @@ over this file answers with the example above as well as with the notes. -->
 - n-0009 2026-09-15 #gotcha @internal/mdblock/mdblock.go @internal/rtk/rtk.go @internal/mdscan/mdscan.go — a marker written in prose or a code span is not a block — mdblock and rtk.ForeignBlock search mdscan.Mask, and the entry file that documents the markers is why
 - n-0010 2026-09-15 #ceiling @internal/mdscan/mdscan.go — mdscan.Mask hides fenced blocks and inline code spans only — a marker in a 4-space-indented block or a blockquote still reads as a live block; lift it by teaching Mask those two constructs
 - n-0011 2026-09-15 #gotcha @internal/artifact/artifact.go — artifact.Within must resolve both sides the same way — resolving only the root made a not-yet-created path inside the workspace read as an escape on macOS and on Windows 8.3 paths
+<!-- n-0012 removed -->
+- n-0013 2026-09-17 #ceiling @internal/finding/finding.go @internal/render/render.go — finding.Set.Report prints every Message to stderr unescaped - only validate/attribution clip strips control runes, so any validator embedding untrusted text inherits terminal-escape injection; lift it by escaping in render
+- n-0014 2026-09-17 #gotcha @internal/scaffold @internal/manifest — scc update writes the manifest only when it applies a file, so a managed file already byte-identical to the next template keeps its old hash - and at the version after that it compares as edited and is never updated again; deleting the file and re-running update is the way back

internal/assets/assets.go

@@ -283,7 +283,7 @@ import (
 // `/home/node/.claude` is created and chowned in the image: without it the first
 // write of every session was `EACCES ... mkdir '/home/node/.claude/session-env'` and
 // the login it could not store read back as "not logged in".
-const Version = "33"
+const Version = "35"
 
 // The embedded tree. "all:" so nothing is silently dropped for having a name the
 // default embed pattern skips.

internal/assets/assets_test.go

@@ -1075,7 +1075,7 @@ func (e errNoSuchRule) Error() string {
 // uses wherever a change is cheap to make and expensive to make by accident.
 func TestTheTemplateVersionMovesWithTheTemplates(t *testing.T) {
 	// Bump Version, then replace this with the digest the failure prints.
-	const fingerprint = "5f4a989994ef836fd039f1f188f1027ee4924164a0ae7a6ebd30ce345f6f6353"
+	const fingerprint = "ca004345d7bd327f81c7361b2ceca205d8e2e1609e4b527118b1e1a7e9c65a05"
 
 	sum := sha256.New()
 	// Version goes into the hash, and without it this test does not do the job its

internal/assets/templates/rules/delivery.md

@@ -37,10 +37,10 @@ Once the last task is done:
 3. **Commit and push.** Conventional Commits, written from the diff and the spec.
 4. **Open the PR.** Body: what changed, which spec or plan, how it was verified.
 
-**The work is the user's, and the record says so.** No `Co-Authored-By` for an assistant,
-no session link, no "generated with" footer or badge, no naming of a model, vendor or
-harness — not in a commit message, not in a PR title or body. The `commit-msg` hook
-rejects it as you write it, `SCC_SKIP_HOOKS=1` is not the fix, `--pr` reads the PR body.
+**The work is the user's, and the record says so.** No `Co-Authored-By` for an assistant, no
+vendor link, no "generated with" footer or badge, no crediting a tool ("thanks to", "with the
+help of", "used X to"), no naming a model, vendor or harness — not in a commit, a PR title,
+body or comment. `commit-msg` rejects a commit, `--pr` the forge; `SCC_SKIP_HOOKS=1` is no fix.
 
 **The gates are commands, not claims.** What this workspace recorded for build, format,
 lint and test; the last reads back `{"total": N, "coverage": P}` and is held to a floor.