diff --git a/common/install.sh b/common/install.sh
index b4b2d3c..61e0512 100755
--- a/common/install.sh
+++ b/common/install.sh
@@ -65,10 +65,10 @@ fetch_release_asset() {
   fi
 
   id="$(curl -fsSL \
-      -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-      -H 'Accept: application/vnd.github+json' \
-      "https://api.github.com/repos/${RepoSlug}/releases/latest" \
-    | release_asset_id "$name")" || return 1
+    -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+    -H 'Accept: application/vnd.github+json' \
+    "https://api.github.com/repos/${RepoSlug}/releases/latest" |
+    release_asset_id "$name")" || return 1
 
   curl -fsSL \
     -H "Authorization: Bearer ${GITHUB_TOKEN}" \
@@ -186,11 +186,11 @@ start_stack() {
   # package refuses an anonymous pull with `unauthorized`.
   # --password-stdin, not an argument: argv is visible to every other user on the host.
   if [ -n "${GITHUB_TOKEN:-}" ]; then
-    printf '%s' "${GITHUB_TOKEN}" \
-      | docker login ghcr.io -u "${RepoSlug%%/*}" --password-stdin >/dev/null || {
-        echo 'could not sign in to ghcr.io; the token needs read:packages' >&2
-        return 1
-      }
+    printf '%s' "${GITHUB_TOKEN}" |
+      docker login ghcr.io -u "${RepoSlug%%/*}" --password-stdin >/dev/null || {
+      echo 'could not sign in to ghcr.io; the token needs read:packages' >&2
+      return 1
+    }
   fi
   docker compose up --remove-orphans -d || return 1
 }
@@ -200,7 +200,8 @@ start_stack() {
 # pipeline as failed. Measured at roughly one run in seven — a stack that
 # refused to migrate, at random, with a message about a service that was there.
 compose_has_service() {
-  local -r service="$1"; shift
+  local -r service="$1"
+  shift
   local services
 
   services="$(docker compose "$@" config --services)" || return 1
@@ -225,15 +226,33 @@ run_migrations() {
 }
 
 main() {
-  command -v curl >/dev/null || { echo 'curl is required'; return 1; }
-  docker compose version >/dev/null 2>&1 || { echo 'docker compose is required'; return 1; }
+  command -v curl >/dev/null || {
+    echo 'curl is required'
+    return 1
+  }
+  docker compose version >/dev/null 2>&1 || {
+    echo 'docker compose is required'
+    return 1
+  }
   require_private_tools || return 1
 
-  create_directory || { echo 'could not create the target directory'; return 1; }
-  download_release_assets || { echo 'could not download the release assets'; return 1; }
+  create_directory || {
+    echo 'could not create the target directory'
+    return 1
+  }
+  download_release_assets || {
+    echo 'could not download the release assets'
+    return 1
+  }
   require_configured_image || return 1
-  start_stack || { echo 'could not start the stack; check the output above'; return 1; }
-  run_migrations || { echo 'could not run migrations; check the output above'; return 1; }
+  start_stack || {
+    echo 'could not start the stack; check the output above'
+    return 1
+  }
+  run_migrations || {
+    echo 'could not run migrations; check the output above'
+    return 1
+  }
 
   # One line per application (ADR-0022), read out of .env so it reflects any
   # port the operator changed.
diff --git a/docs/superpowers/plans/2026-09-16-clean-shell-and-comments.md b/docs/superpowers/plans/2026-09-16-clean-shell-and-comments.md
new file mode 100644
index 0000000..ba670a7
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-16-clean-shell-and-comments.md
@@ -0,0 +1,81 @@
+# Clean Shell and Comments Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** every tracked file meets `comment-code`; every shell file meets the Clean Bash rules; lint keeps it that way.
+
+**Architecture:** five independent pull requests by area, each merged before the next branches. No behaviour change anywhere; the existing bats suites and real-project checklists are the regression net.
+
+**Tech Stack:** bash 5, shellcheck 0.11.0, shfmt 3.14.1, bats 1.13.0, mise.
+
+**Spec:** `docs/superpowers/specs/2026-09-16-clean-shell-and-comments-design.md`
+
+## Global Constraints
+
+- Rules: the `comment-code` skill (`~/.claude/skills/comment-code/SKILL.md`) and `~/.dotfiles/agentic/rules/bash.md`. Read both before editing.
+- No behaviour change: error messages, stdout/stderr lines, exit codes and generated-file contents stay byte-identical. Never edit a test assertion to make a code change pass.
+- No file-level `readonly`; `local -r` inside functions is fine.
+- No `set -euo pipefail` added to sourced files (`lib/*.sh`, `services/**/*.sh`, `tests/helpers/*.bash`, fixture drivers). Executables (`scaffold`, `scripts/*.sh`, `common/install.sh`) must have it.
+- Bats `@test` bodies keep `[ … ]`; helpers and non-test shell use `[[ ]]` / `(( ))`.
+- `[ ]` → `[[ ]]`: quote the RHS of `=`, `==`, `!=` unless a glob is intended. Numeric tests → `(( ))`.
+- `echo` → `printf '%s\n'` only where a variable/expansion is printed.
+- Never `local x="$(cmd)"`: declare, then assign.
+- Split a function over 20 lines only at a nameable seam. Linear sequences (big `case`, heredoc, render loop) stay; record each kept function and why in the task report.
+- Function names that appear in `docs/` or `README.md` keep their name and contract: `add_app_service apply_adapter apply_service_dockerfile apply_service_drivers assemble_compose assert_known_tiers cmd_add cmd_new cmd_wizard config_roots generate_service_passwords init_project lint_adapters lint_services load_adapter load_toolchain_env project_name_is_usable register_config_root register_image_target role_path service_compose_key service_driver_dockerfile service_healthy sync_ci_roots tui_name_is_usable tui_prompt_name wizard_actions wizard_command wizard_new_args wizard_options wizard_prompt_for wizard_questions write_env_lines splice_flask_probe init_flask_alembic assert_nest_probe_spliced`.
+- Keep: `#!` lines, `# shellcheck …` pragmas (each carrying a same-line reason), `# noqa`, `eslint-disable`, `@phpstan-`, `ponytail:` markers, and splice anchors `# @SERVICE_SETUP@`, `# @DB_ENGINE@`, `# @DB_PROBE@` (column and spelling are matched by awk/sed).
+- Do not touch: `verbatim` rows of `docs/PROVENANCE.md` (`common/.editorconfig`), `common/docs/.vitepress/theme/vendor/**`, `docs/**`, `*.md`, `LICENSE`, `mise.lock`, `UPSTREAM`.
+- Script headers: purpose + usage only. No `Description :`/`Author`/banner blocks.
+- Commits: conventional (`chore:`, `refactor:`, `style:`), no co-author noise beyond repo convention. Each PR from a fresh branch off up-to-date `main`.
+- Verification per PR: `mise run lint` clean; `mise run test-runner` exits 0.
+- Real-project check (Tasks 2, 3, 5): in the scratchpad, `./scaffold new <dir>/p1 --api flask --web nextjs --db postgres --cache redis` and `./scaffold new <dir>/p2 --api nestjs --db mongodb`, then `mise run checklist` inside each. Delete both afterwards. Never run `scaffold publish`.
+
+---
+
+### Task 1: Tooling
+
+**Files:**
+- Modify: `mise.toml` (`[tools]`, `[tasks.lint]`)
+- Modify: `services/**/*.sh`, `tests/helpers/setup.bash`, `tests/**/*.sh` (shellcheck findings only)
+- Modify: every shell file (the `shfmt -w` commit)
+
+- [ ] **Step 1:** add `shfmt = "3.14.1"` under `[tools]`, run `mise install` so `mise.lock` records it.
+- [ ] **Step 2:** change `[tasks.lint]` to lint every tracked shell file with both tools:
+  ```toml
+  [tasks.lint]
+  run = [
+    "git ls-files -z -- scaffold '*.sh' '*.bash' '*.bats' | xargs -0 -r shellcheck",
+    "git ls-files -z -- scaffold '*.sh' '*.bash' '*.bats' | xargs -0 -r shfmt -i 2 -ci -d",
+  ]
+  ```
+  Shrink the task's existing comment to what still holds (the `git ls-files` discovery rationale), or delete it.
+- [ ] **Step 3:** run `mise run lint`; expect shellcheck findings in `services/`, `tests/` and `.bats` files. Fix each: real bugs get fixed; intentional ones (e.g. SC2016 single-quoted `$` written into generated code) get `# shellcheck disable=SCxxxx # <reason>` on the narrowest scope. SC1091/SC1090 for sourced paths: prefer a `# shellcheck source=` directive over disable. Commit: `chore(lint): shellcheck every tracked shell file`.
+- [ ] **Step 4:** `git ls-files -z -- scaffold '*.sh' '*.bash' '*.bats' | xargs -0 shfmt -i 2 -ci -w`. Verify `git diff -w --stat` is empty or whitespace-only in meaning (e.g. `die() { a; b; }` expanded to multiple lines is fine). Run `mise run test-runner`. Commit ONLY this: `style: shfmt -i 2 -ci every shell file`.
+- [ ] **Step 5:** `mise run lint` exits 0; `mise run test-runner` exits 0. Push, open PR, wait for CI, merge with `gh pr merge --rebase --delete-branch` (not squash: squash would fold the pure shfmt commit into the lint fixes).
+
+### Task 2: Core — `scaffold`, `lib/*.sh`, `scripts/*.sh`, `common/install.sh`
+
+**Files:** those 17 files. `common/install.sh` ships to every generated project.
+
+- [ ] **Step 0:** find the shfmt commit on `main` (`git log --format='%H %s' | grep 'style: shfmt'`) and create `.git-blame-ignore-revs` with that hash under a one-line `#` comment naming its subject. A rebase merge rewrites hashes, which is why this waits until Task 1 is on `main`.
+- [ ] **Step 1:** file by file, apply the Global Constraints: delete comments that fail the gate; shorten the ones that pass; convert tests/`echo`/`local`/`let`/`expr`; name positional args into locals; fix headers (`scripts/check-provenance.sh` has a banner-style `# Description :` header).
+- [ ] **Step 2:** split functions over 20 lines at nameable seams. Candidates by size: `cmd_add` (68), `tui_select` (55), `record_release_age_exceptions` (55), `cmd_wizard` (51), `add_app_service` (49), `apply_adapter` (49), `cmd_update` (47), `cmd_publish` (42), `lint_adapter_env` (40), `_tui_render` (39). List all with `awk 'FNR==1{fn=""} /^[a-z_]+\(\) \{/{fn=$1;s=FNR} fn&&/^\}/{if(FNR-s-1>20)print FNR-s-1, FILENAME, fn;fn=""}' scaffold lib/*.sh scripts/*.sh common/install.sh`.
+- [ ] **Step 3:** after each file or two, `mise run test-unit`; commit per file group (`refactor(lib): …`).
+- [ ] **Step 4:** `mise run lint`, `mise run test-runner`, real-project check. Push, PR, CI green, `gh pr merge --squash --delete-branch`.
+
+### Task 3: Services — `services/**/*.sh`
+
+- [ ] **Step 1:** same treatment as Task 2 for the 15 driver and shared files. The splice guards (`assert_nest_probe_spliced`, the flask guard in `splice_flask_probe`) keep their logic exactly; their comments may shrink but the reason a guard checks the *absence* of the fallback must survive in one line.
+- [ ] **Step 2:** `mise run lint`, `mise run test-runner`, real-project check. PR, CI, squash-merge.
+
+### Task 4: Tests — `tests/**` shell
+
+- [ ] **Step 1:** comments and helpers in `.bats`, `tests/helpers/setup.bash`, fixture `.sh`. Test names (`@test "…"`) are unchanged. Fixture drivers under `tests/fixtures/lint-services/` exist to be *wrong* in one specific way each — keep the defect each fixture is named for.
+- [ ] **Step 2:** `mise run lint`, `mise run test-runner`. PR, CI, squash-merge.
+
+### Task 5: Non-shell comments
+
+**Files:** every tracked file outside Tasks 1–4 that carries comments, excluding the do-not-touch list. List with:
+`git ls-files | grep -vE '\.(sh|bash|bats|md|lock)$|^docs/|^tests/|vendor/|^scaffold$|^LICENSE$|^UPSTREAM$|^common/\.editorconfig$' | xargs grep -lE '^\s*(#|//|/\*|\*|<!--)'`
+
+- [ ] **Step 1:** apply `comment-code` only (no code changes beyond what makes a deleted comment unnecessary). Comments inside files copied into generated projects (`adapters/`, `common/`) are read by client developers: keep the ones that explain a non-obvious choice they would otherwise undo.
+- [ ] **Step 2:** `mise run lint`, `mise run test-runner`, real-project check. PR, CI, squash-merge.
diff --git a/docs/superpowers/specs/2026-09-16-clean-shell-and-comments-design.md b/docs/superpowers/specs/2026-09-16-clean-shell-and-comments-design.md
new file mode 100644
index 0000000..8a8e730
--- /dev/null
+++ b/docs/superpowers/specs/2026-09-16-clean-shell-and-comments-design.md
@@ -0,0 +1,116 @@
+# Clean Shell and Comments Design
+
+**Goal:** bring every tracked file to the `comment-code` standard and every
+shell file to the Clean Bash rules (`~/.dotfiles/agentic/rules/bash.md`), and
+lock the shell half in with lint so it does not drift back.
+
+**Scope:** 64 shell files (`scaffold`, `lib/`, `scripts/`, `services/`,
+`tests/`, `common/install.sh`) and every non-shell file that carries comments
+(`adapters/`, `common/`, `.github/`, root `mise.toml`, `lefthook.yml`). No
+behaviour changes. `docs/` prose is out of scope: it is documentation, not
+comments.
+
+## What was measured
+
+Run against `main` at `39c78be`:
+
+| Area | Files | Lines | Comment lines |
+| --- | --- | --- | --- |
+| `scaffold`, `lib/`, `scripts/`, `common/install.sh` | 17 | 4368 | 977 |
+| `services/` | 15 | 715 | 261 |
+| `tests/` (`.bats`, `.bash`, fixture `.sh`) | 32 | 4542 | 835 |
+| non-shell files with comments | 80 | — | 592 |
+
+| Rule | Occurrences |
+| --- | --- |
+| `[ ]` tests | 553 (`[[ ]]` already: 207) |
+| `echo` | 173 |
+| functions over 20 lines | 53 (largest: `cmd_add` 68, `tui_select` 55, `record_release_age_exceptions` 55) |
+| `local x="$(…)"` | 4 |
+| `let` / `expr` | 1 |
+| shellcheck on `services/` + `tests/*.bash` (never linted today) | 30 findings: SC2016 ×17, SC2015 ×6, SC1003 ×4, SC2154 ×3 |
+| `shfmt -i 2 -ci -d` (shfmt 3.14.1, not yet pinned) | 39 files, ~1800 changed lines |
+
+## Decisions
+
+**Where the repository overrides the rule.** Three rule items are wrong for
+this codebase and are not applied:
+
+- *File-level `readonly`.* `lib/*.sh` is sourced again into child processes;
+  a second `readonly` of the same name is a fatal error. `local -r` stays.
+- *`set -euo pipefail` in sourced files.* `lib/*.sh`, `services/**/*.sh` and
+  `tests/helpers/setup.bash` inherit their options from the entrypoint that
+  sources them; setting options there silently changes the caller.
+  Executables (`scaffold`, `scripts/*.sh`, `common/install.sh`) must have it.
+- *`[[ ]]` inside bats test bodies.* `[ "$status" -eq 0 ]` is bats' own idiom
+  and reports the failing expression; the rule applies to helpers and to any
+  shell outside a `@test` body.
+
+**Byte-identical files are untouched.** Every `verbatim` row in
+`docs/PROVENANCE.md` (today `common/.editorconfig`) and everything under
+`common/docs/.vitepress/theme/vendor/` is excluded — `scripts/check-provenance.sh`
+fails on any drift.
+
+**Functional comments stay.** Anchors (`# @SERVICE_SETUP@`, `# @DB_ENGINE@`,
+`# @DB_PROBE@`), toolchain pragmas (`# shellcheck …`, `# noqa`,
+`// eslint-disable…`, `@phpstan-…`), `ponytail:` markers, and the `#!` line.
+Splice anchors are matched byte-for-byte by awk/sed, so their column and
+spelling are fixed.
+
+**Functions are split only at a clear seam.** A function over 20 lines is split
+when a contiguous block can be named for what it does. One that is long because
+it is a single linear sequence — a large `case`, a heredoc, a TUI render loop —
+stays whole, and the ledger records why. Every function name that appears in
+`docs/` or `README.md` keeps its name and its contract.
+
+**`[ ]` → `[[ ]]` quotes the right-hand side.** Inside `[[ ]]` an unquoted RHS
+of `=`/`==`/`!=` is a glob pattern, so `[ "$a" = $b ]` and `[[ $a = $b ]]`
+differ when `$b` contains `*`. Every converted comparison quotes its RHS unless
+a pattern is intended. Numeric comparisons move to `(( ))`.
+
+**`printf` replaces `echo` only where a variable is printed.** A literal string
+through `echo` has none of the hazards the rule names.
+
+**Lint enforces the shell half.** `mise.toml` pins `shfmt = "3.14.1"`; the
+`lint` task runs shellcheck over every tracked shell file (including
+`services/` and `tests/`) and `shfmt -i 2 -ci -d` over the same set. The first
+`shfmt -w` lands as its own commit containing nothing else, and its hash goes
+into `.git-blame-ignore-revs` if the repository has one (it ships one to
+generated projects via `common/`; the toolbox itself gains one, in PR 2, once the rebase-merged hash is final).
+
+**Nothing observable changes.** Error messages, output lines, exit codes and
+generated-file contents stay identical, because tests assert them. A test that
+has to change because the code changed is evidence of a behaviour change: stop
+and fix the code, not the test.
+
+## Work items
+
+Five pull requests, in order, each merged green before the next branches from
+`main`:
+
+1. **Tooling** — pin shfmt, widen shellcheck, fix the 30 new shellcheck
+   findings, one pure `shfmt -w` commit.
+2. **Core** — `.git-blame-ignore-revs`, then `scaffold`, `lib/*.sh`,
+   `scripts/*.sh`, `common/install.sh`.
+3. **Services** — `services/**/*.sh`.
+4. **Tests** — `tests/**` shell (`.bats`, `.bash`, fixture `.sh`).
+5. **Non-shell comments** — `adapters/`, `common/`, `.github/`, root
+   `mise.toml`, `lefthook.yml`, every other tracked non-doc file.
+
+## Verification
+
+Per PR: `mise run lint`; `mise run test-runner` (both lanes); CI green.
+PRs 2, 3 and 5 additionally generate two real projects —
+`--api flask --web nextjs --db postgres --cache redis` and
+`--api nestjs --db mongodb` — and run each project's `mise run checklist`.
+All generated projects and scratch files are deleted afterwards; nothing is
+published.
+
+## Not doing
+
+| Item | Why |
+| --- | --- |
+| Rewrite ADRs or `docs/` prose | dated records and documentation, not code comments |
+| Move deleted rationale into new ADRs | a comment that fails the gate is deleted; one that passes stays short |
+| Change any `verbatim` or `vendor/` file | provenance check requires byte identity |
+| Split functions with no nameable seam | single-use helpers that only move lines add indirection |
diff --git a/lib/adapter.sh b/lib/adapter.sh
index 2126169..4fc7b70 100644
--- a/lib/adapter.sh
+++ b/lib/adapter.sh
@@ -23,7 +23,7 @@ load_adapter() {
   # adapters/ — `--api ../../../tmp/evil` runs an arbitrary file. Checked before
   # the path is built.
   case "$name" in
-    ''|*[!a-z0-9-]*|-*) die "not a usable adapter name: ${name} (run: scaffold list)" ;;
+    '' | *[!a-z0-9-]* | -*) die "not a usable adapter name: ${name} (run: scaffold list)" ;;
   esac
 
   local -r dir="${SCAFFOLD_ROOT}/adapters/${name}"
@@ -49,12 +49,15 @@ load_adapter() {
 }
 
 adapter_is_typescript() {
-  ( load_adapter "$1"; [ "${ADAPTER_LANGUAGE:-}" = "typescript" ] )
+  (
+    load_adapter "$1"
+    [ "${ADAPTER_LANGUAGE:-}" = "typescript" ]
+  )
 }
 
 role_path() {
   case "$1" in
-    web|api|app) printf '%s/%s\n' "$APPS_DIR" "$1" ;;
+    web | api | app) printf '%s/%s\n' "$APPS_DIR" "$1" ;;
     *) die "unknown adapter role: ${1}" ;;
   esac
 }
@@ -66,7 +69,7 @@ merge_lefthook_fragment() {
   [ -f "$fragment" ] || return 0
 
   rendered="$(mktemp)"
-  sed "s|@APP_ROOT@|${rel}/|g" "$fragment" > "$rendered"
+  sed "s|@APP_ROOT@|${rel}/|g" "$fragment" >"$rendered"
 
   # Suffix every command with the app it came from: the merge below is key-wise,
   # so two apps of the same language — both laravel adapters define `pint` —
@@ -101,8 +104,8 @@ assert_workspace_filter_name() {
   local found expected
   found="$(jq -r '.name' "${dest}/package.json")"
   expected="$(basename "$dest")"
-  [ "$found" = "$expected" ] \
-    || die "${dest}/package.json is named '${found}', not '${expected}' — Dockerfile.workspace's 'pnpm --filter ${expected}' would match nothing"
+  [ "$found" = "$expected" ] ||
+    die "${dest}/package.json is named '${found}', not '${expected}' — Dockerfile.workspace's 'pnpm --filter ${expected}' would match nothing"
 }
 
 # Dockerfile.workspace ships @APP_FILTER@ where it needs the app's own directory
@@ -150,7 +153,8 @@ apply_adapter() {
   load_adapter "$name"
 
   local -r dest="${project}/${rel}"
-  local parent; parent="$(dirname "$dest")"
+  local parent
+  parent="$(dirname "$dest")"
   mkdir -p "$parent"
 
   # CI=true stays — it lets pnpm replace node_modules with no TTY to confirm on.
diff --git a/lib/lint.sh b/lib/lint.sh
index d37047f..9cde835 100644
--- a/lib/lint.sh
+++ b/lib/lint.sh
@@ -57,7 +57,8 @@ driver_families() {
 # any, so a caller can run them all and still fail once at the end.
 
 lint_required_files() {
-  local -r name="$1" dir="$2"; shift 2
+  local -r name="$1" dir="$2"
+  shift 2
   local file status=0
 
   for file in "$@"; do
@@ -128,7 +129,7 @@ lint_adapter_tasks() {
     body="$(task_body "$file" "$task")"
     for flag in "${WRITING_FLAGS[@]}"; do
       case " $body " in
-        *" ${flag} "*|*" ${flag}="*)
+        *" ${flag} "* | *" ${flag}="*)
           printf '%s: %s writes (%s) — %s must report, not repair; see docs/decisions/0011\n' \
             "$name" "$task" "$flag" "$task"
           status=1
@@ -185,13 +186,13 @@ lint_driver_functions() {
   local fn fault status=0
 
   for fn in "${REQUIRED_DRIVER_FUNCTIONS[@]}"; do
-    if ! fault="$( {
+    if ! fault="$({
       # shellcheck disable=SC2034 # read by the driver, not by this loop
       SERVICE_DIR="$service_dir"
       # shellcheck source=/dev/null # family varies, so the path isn't constant
       . "$driver"
       declare -F "$fn" >/dev/null
-    } 2>&1 )"; then
+    } 2>&1)"; then
       if [ -n "$fault" ]; then
         printf '%s: %s driver failed to source: %s\n' "$name" "$family" "$fault"
       else
@@ -205,7 +206,8 @@ lint_driver_functions() {
 }
 
 lint_service_drivers() {
-  local -r name="$1" service="$2"; shift 2
+  local -r name="$1" service="$2"
+  shift 2
   local family driver status=0
 
   for family in "$@"; do
diff --git a/lib/log.sh b/lib/log.sh
index 86d4d2b..e36a8ad 100644
--- a/lib/log.sh
+++ b/lib/log.sh
@@ -5,9 +5,12 @@
 # ═══════════════════════════════════════════════════════════════════════════
 # shellcheck shell=bash
 
-log()  { printf '%s\n' "$*" >&2; }
+log() { printf '%s\n' "$*" >&2; }
 warn() { printf 'warning: %s\n' "$*" >&2; }
-die()  { printf 'error: %s\n' "$*" >&2; exit 1; }
+die() {
+  printf 'error: %s\n' "$*" >&2
+  exit 1
+}
 
 # Marks a step that takes minutes, so a captured command does not read as a
 # hang. Unnumbered: the number of steps depends on the adapters requested.
@@ -17,7 +20,8 @@ step() { printf '→ %s\n' "$*" >&2; }
 # Captures output and prints it only on failure; SCAFFOLD_VERBOSE=1 passes it
 # straight through, for a run that hangs rather than fails.
 run_quietly() {
-  local -r what="$1"; shift
+  local -r what="$1"
+  shift
   local log status=0
 
   if [ "${SCAFFOLD_VERBOSE:-0}" = 1 ]; then
diff --git a/lib/manifest.sh b/lib/manifest.sh
index 69a88de..700e0cd 100644
--- a/lib/manifest.sh
+++ b/lib/manifest.sh
@@ -24,10 +24,10 @@ register_config_root() {
     awk -v root="$root" '
       { print }
       /^config_roots = \[$/ { printf "  \"%s\",\n", root }
-    ' "$file" > "${file}.tmp"
+    ' "$file" >"${file}.tmp"
     mv "${file}.tmp" "$file"
-    grep -q "^  \"${root}\",\$" "$file" \
-      || die "could not register ${root}: no 'config_roots = [' line in ${file} — has it been reformatted?"
+    grep -q "^  \"${root}\",\$" "$file" ||
+      die "could not register ${root}: no 'config_roots = [' line in ${file} — has it been reformatted?"
   fi
 
   # The root [tasks.checklist] must run every config root's checklist. Kept
@@ -40,16 +40,16 @@ register_config_root() {
         in_checklist = 0
       }
       { print }
-    ' "$file" > "${file}.tmp"
+    ' "$file" >"${file}.tmp"
     mv "${file}.tmp" "$file"
-    grep -q "\"//${root}:checklist\"" "$file" \
-      || die "could not add ${root} to the root checklist in ${file} — has [tasks.checklist] been reformatted?"
+    grep -q "\"//${root}:checklist\"" "$file" ||
+      die "could not add ${root} to the root checklist in ${file} — has [tasks.checklist] been reformatted?"
   fi
 }
 
 config_roots() {
-  sed -n '/^config_roots = \[$/,/^\]$/p' "${1}/${MISE_CONFIG_FILE}" \
-    | sed -n 's/^  "\(.*\)",$/\1/p'
+  sed -n '/^config_roots = \[$/,/^\]$/p' "${1}/${MISE_CONFIG_FILE}" |
+    sed -n 's/^  "\(.*\)",$/\1/p'
 }
 
 sync_ci_roots() {
@@ -80,8 +80,8 @@ register_image_target() {
     context="$rel"
   fi
 
-  [ -f "${project}/${dockerfile}" ] \
-    || die "no Dockerfile at ${dockerfile} to build ${name} from"
+  [ -f "${project}/${dockerfile}" ] ||
+    die "no Dockerfile at ${dockerfile} to build ${name} from"
 
   for file in "${BUILD_WORKFLOWS[@]}"; do
     file="${project}/${file}"
@@ -89,11 +89,11 @@ register_image_target() {
     updated="$(jq -c --arg image "$image" --arg context "$context" \
       --arg dockerfile "$dockerfile" \
       '. + [{image: $image, context: $context, dockerfile: $dockerfile}]' \
-      <<<"$current")" \
-      || die "could not read the images array out of ${file}"
+      <<<"$current")" ||
+      die "could not read the images array out of ${file}"
 
     IMAGES="$updated" yq --inplace \
-      '(.jobs[] | select(has("with")) | .with.images) = strenv(IMAGES)' "$file" \
-      || die "could not record ${name}'s image in ${file}"
+      '(.jobs[] | select(has("with")) | .with.images) = strenv(IMAGES)' "$file" ||
+      die "could not record ${name}'s image in ${file}"
   done
 }
diff --git a/lib/pnpm.sh b/lib/pnpm.sh
index f8fc9ef..3fcf9fe 100644
--- a/lib/pnpm.sh
+++ b/lib/pnpm.sh
@@ -41,7 +41,7 @@ PNPM_RELAXATIONS=('confirmModulesPurge: false' 'frozenLockfile: false' 'minimumR
 # writes into the root lockfile either way.
 relax_pnpm_workspace() {
   [ -f "$1" ] || return 0
-  printf '%s\n' "${PNPM_RELAXATIONS[@]}" >> "$1"
+  printf '%s\n' "${PNPM_RELAXATIONS[@]}" >>"$1"
 }
 
 restore_pnpm_workspace() {
@@ -136,7 +136,7 @@ record_release_age_exceptions() {
   log="$(mktemp)"
 
   while true; do
-    if ( cd "$project" && mise exec -- pnpm install --frozen-lockfile --config.confirm-modules-purge=false >"$log" 2>&1 ); then
+    if (cd "$project" && mise exec -- pnpm install --frozen-lockfile --config.confirm-modules-purge=false >"$log" 2>&1); then
       rm -f "$log"
       return 0
     fi
@@ -167,7 +167,7 @@ record_release_age_exceptions() {
     # open on the end (,$d) would silently swallow anything a later step
     # appended. Both markers are always written together, so the range is
     # always well-formed by the time this runs a second time.
-    [ -f "$workspace_file" ] || : > "$workspace_file"
+    [ -f "$workspace_file" ] || : >"$workspace_file"
     sed -i "/^${RELEASE_AGE_BLOCK_START}/,/^${RELEASE_AGE_BLOCK_END}\$/d" "$workspace_file"
     {
       printf '%s; pnpm re-checks this on every frozen\n' "$RELEASE_AGE_BLOCK_START"
@@ -176,7 +176,7 @@ record_release_age_exceptions() {
       printf 'minimumReleaseAgeExclude:\n'
       printf '%s\n' "$all_entries" | while IFS= read -r entry; do printf '  - "%s"\n' "$entry"; done
       printf '%s\n' "$RELEASE_AGE_BLOCK_END"
-    } >> "$workspace_file"
+    } >>"$workspace_file"
   done
 }
 
@@ -200,7 +200,7 @@ sync_standalone_build_policy() {
   local -r app="$1" project="$2"
   local -r file="${app}/${WORKSPACE_FILE}"
 
-  [ -f "$file" ] || printf '{}\n' > "$file"
+  [ -f "$file" ] || printf '{}\n' >"$file"
 
   yq eval-all --inplace \
     'select(fileIndex==0).allowBuilds = ((select(fileIndex==0).allowBuilds // {}) * select(fileIndex==1).allowBuilds) | select(fileIndex==0)' \
@@ -227,7 +227,8 @@ finalize_app_dockerfile() {
 # Every application is TypeScript, so they share one lockfile and one
 # node_modules at the root, and a packages/types can exist between them.
 join_typescript_workspace() {
-  local -r project="$1"; shift
+  local -r project="$1"
+  shift
 
   enable_typescript_workspace "$project"
 
@@ -250,7 +251,8 @@ join_typescript_workspace() {
 # Not every application is TypeScript — or there are none — so each owns its
 # manifests and its own lockfile, and there is no shared workspace to join.
 keep_apps_standalone() {
-  local -r project="$1"; shift
+  local -r project="$1"
+  shift
 
   rm -rf "${project}/packages-types"
 
@@ -272,8 +274,8 @@ keep_apps_standalone() {
   local pair app
   for pair in "$@"; do
     app="${pair%%:*}"
-    adapter_is_typescript "${pair#*:}" \
-      && sync_standalone_build_policy "${project}/${app}" "$project"
+    adapter_is_typescript "${pair#*:}" &&
+      sync_standalone_build_policy "${project}/${app}" "$project"
     finalize_app_dockerfile "$project" "$app"
     # Each application here owns a lockfile the policy will re-check forever.
     record_release_age_exceptions "${project}/${app}"
diff --git a/lib/project.sh b/lib/project.sh
index 9b33708..e47d5d0 100644
--- a/lib/project.sh
+++ b/lib/project.sh
@@ -56,8 +56,9 @@ resolve_github_owner() {
   # Interpolated into `sed s|you/|...|`; GNU sed's s///e flag runs the pattern
   # space as a shell command, so an owner containing `|` is remote code execution.
   case "$owner" in
-    *[!A-Za-z0-9-]*|-*|*-)
-      die "not a usable GitHub account name: ${owner}" ;;
+    *[!A-Za-z0-9-]* | -* | *-)
+      die "not a usable GitHub account name: ${owner}"
+      ;;
   esac
   [ -z "$source" ] || warn "using GitHub owner '${owner}' (detected from ${source}) — set SCAFFOLD_GITHUB_OWNER to override"
   printf '%s' "$owner"
@@ -83,8 +84,8 @@ project_name_is_usable() {
 # from uncommitted edits cannot be reproduced from any commit.
 scaffold_version() {
   local version
-  version="$(git -C "$SCAFFOLD_ROOT" describe --tags --always --dirty 2>/dev/null)" \
-    || version="unknown"
+  version="$(git -C "$SCAFFOLD_ROOT" describe --tags --always --dirty 2>/dev/null)" ||
+    version="unknown"
   printf '%s' "$version"
 }
 
@@ -97,7 +98,7 @@ init_scaffold_manifest() {
 
   # A heredoc, not printf: the prose is full of backticks, which shellcheck
   # reads inside single quotes as an unescaped command substitution.
-  cat > "${project}/${SCAFFOLD_MANIFEST}" <<EOF
+  cat >"${project}/${SCAFFOLD_MANIFEST}" <<EOF
 # Written by scaffold. \`scaffold update\` reads this to work out what changed
 # in the toolbox since this project was generated.
 #
@@ -116,17 +117,18 @@ record_scaffold_app() {
   local -r project="$1" rel="$2" adapter="$3"
   local -r file="${project}/${SCAFFOLD_MANIFEST}"
 
-  [ -f "$file" ] \
-    || die "no ${SCAFFOLD_MANIFEST} in ${project} — this project predates it; see 'scaffold update'"
+  [ -f "$file" ] ||
+    die "no ${SCAFFOLD_MANIFEST} in ${project} — this project predates it; see 'scaffold update'"
 
-  grep -q "^\"${rel}\" = " "$file" \
-    && die "${rel} is already recorded in ${SCAFFOLD_MANIFEST}"
+  grep -q "^\"${rel}\" = " "$file" &&
+    die "${rel} is already recorded in ${SCAFFOLD_MANIFEST}"
 
-  printf '"%s" = "%s"\n' "$rel" "$adapter" >> "$file"
+  printf '"%s" = "%s"\n' "$rel" "$adapter" >>"$file"
 }
 
 substitute_in_files() {
-  local -r expression="$1"; shift
+  local -r expression="$1"
+  shift
   local file
 
   for file in "$@"; do
@@ -165,7 +167,7 @@ init_project() {
   # not match; GitHub treats an unresolvable owner in it as a syntax error.
   substitute_in_files "s|@you\b|@${owner}|g" "${dir}/CODEOWNERS"
 
-  sed "s|@PROJECT_NAME@|${name}|g" "${dir}/mise.root.toml" > "${dir}/mise.toml"
+  sed "s|@PROJECT_NAME@|${name}|g" "${dir}/mise.root.toml" >"${dir}/mise.toml"
   rm -f "${dir}/mise.root.toml"
 
   substitute_in_files "s|@PROJECT_NAME@|${name}|g" "${PROJECT_NAME_FILES[@]/#/${dir}/}"
@@ -181,8 +183,8 @@ init_project() {
 lock_toolchains() {
   # A mise.toml above the new project, read before ours, can make this fail
   # without breaking the project — so warn and leave it to whoever owns it.
-  mise lock --quiet -C "$1" >/dev/null \
-    || warn "could not lock the toolchain — run 'mise lock' before committing mise.lock, or CI's 'mise install --locked' will reject it"
+  mise lock --quiet -C "$1" >/dev/null ||
+    warn "could not lock the toolchain — run 'mise lock' before committing mise.lock, or CI's 'mise install --locked' will reject it"
 }
 
 finalize_project() {
diff --git a/lib/publish.sh b/lib/publish.sh
index df7156d..12eb80f 100644
--- a/lib/publish.sh
+++ b/lib/publish.sh
@@ -26,7 +26,8 @@ PUBLISH_UNSUPPORTED=2
 # and the build workflows all carry that same pair, so deriving the repository
 # from it is what makes their assumption true rather than hopeful.
 repo_slug() {
-  local image; image="$(project_image_base "$1")"
+  local image
+  image="$(project_image_base "$1")"
   printf '%s' "${image#ghcr.io/}"
 }
 
@@ -41,8 +42,8 @@ create_repo() {
   # failure in the second or third leaves the first behind. Everything here is
   # idempotent, but the message has to say what may already be out there.
   gh repo create "$slug" "--${visibility}" --source "$project" \
-    --remote origin --push >/dev/null \
-    || die "could not finish creating ${slug} — it may exist on GitHub already, with no remote or no branch pushed. Check it, then run this again: everything here is idempotent."
+    --remote origin --push >/dev/null ||
+    die "could not finish creating ${slug} — it may exist on GitHub already, with no remote or no branch pushed. Check it, then run this again: everything here is idempotent."
 }
 
 # allow_actions_to_open_pull_requests <slug>
@@ -52,8 +53,8 @@ create_repo() {
 allow_actions_to_open_pull_requests() {
   gh api -X PUT "repos/${1}/actions/permissions/workflow" \
     -f default_workflow_permissions=read \
-    -F can_approve_pull_request_reviews=true >/dev/null \
-    || die "could not allow Actions to open pull requests on ${1} — Release Please will not be able to open its release pull request"
+    -F can_approve_pull_request_reviews=true >/dev/null ||
+    die "could not allow Actions to open pull requests on ${1} — Release Please will not be able to open its release pull request"
 }
 
 main_is_protected() {
@@ -75,7 +76,8 @@ protect_main() {
   local -r slug="$1"
   local response status=0
 
-  response="$(gh api -X POST "repos/${slug}/rulesets" --input - 2>&1 <<'EOF'
+  response="$(
+    gh api -X POST "repos/${slug}/rulesets" --input - 2>&1 <<'EOF'
 {
   "name": "main",
   "target": "branch",
@@ -99,7 +101,7 @@ protect_main() {
   ]
 }
 EOF
-)" || status=$?
+  )" || status=$?
 
   [ "$status" -eq 0 ] && return 0
   case "$response" in
@@ -116,7 +118,8 @@ EOF
 enable_secret_scanning() {
   local response status=0
 
-  response="$(gh api -X PATCH "repos/${1}" --input - 2>&1 <<'EOF'
+  response="$(
+    gh api -X PATCH "repos/${1}" --input - 2>&1 <<'EOF'
 {
   "security_and_analysis": {
     "secret_scanning": { "status": "enabled" },
@@ -124,11 +127,11 @@ enable_secret_scanning() {
   }
 }
 EOF
-)" || status=$?
+  )" || status=$?
 
   [ "$status" -eq 0 ] && return 0
   case "$response" in
-    *"Advanced Security"*|*"not available"*|*"upgrade"*|*"Upgrade"*) return "$PUBLISH_UNSUPPORTED" ;;
+    *"Advanced Security"* | *"not available"* | *"upgrade"* | *"Upgrade"*) return "$PUBLISH_UNSUPPORTED" ;;
   esac
   printf '%s\n' "$response" >&2
   return 1
@@ -145,8 +148,8 @@ set_release_secrets() {
 
   # --body reads from the environment rather than argv: a private key in a
   # process's arguments is readable by every other user on the host.
-  gh secret set RELEASE_APP_ID --repo "$slug" --body "$RELEASE_APP_ID" >/dev/null \
-    || die "could not set RELEASE_APP_ID on ${slug}"
-  gh secret set RELEASE_APP_PRIVATE_KEY --repo "$slug" --body "$RELEASE_APP_PRIVATE_KEY" >/dev/null \
-    || die "could not set RELEASE_APP_PRIVATE_KEY on ${slug}"
+  gh secret set RELEASE_APP_ID --repo "$slug" --body "$RELEASE_APP_ID" >/dev/null ||
+    die "could not set RELEASE_APP_ID on ${slug}"
+  gh secret set RELEASE_APP_PRIVATE_KEY --repo "$slug" --body "$RELEASE_APP_PRIVATE_KEY" >/dev/null ||
+    die "could not set RELEASE_APP_PRIVATE_KEY on ${slug}"
 }
diff --git a/lib/service.sh b/lib/service.sh
index 8a28e68..6a0609e 100644
--- a/lib/service.sh
+++ b/lib/service.sh
@@ -26,7 +26,7 @@ load_service() {
   local -r name="$1"
 
   case "$name" in
-    ''|*[!a-z0-9-]*|-*) die "not a usable service name: ${name} (run: scaffold list)" ;;
+    '' | *[!a-z0-9-]* | -*) die "not a usable service name: ${name} (run: scaffold list)" ;;
   esac
 
   local -r dir="${SCAFFOLD_ROOT}/services/${name}"
@@ -38,8 +38,8 @@ load_service() {
   # shellcheck source=/dev/null
   source "${dir}/service.env" || return 1
 
-  [ -n "${SERVICE_NAME:-}" ] && [ -n "${SERVICE_KIND:-}" ] \
-    && [ -n "${SERVICE_IMAGE:-}" ] || return 1
+  [ -n "${SERVICE_NAME:-}" ] && [ -n "${SERVICE_KIND:-}" ] &&
+    [ -n "${SERVICE_IMAGE:-}" ] || return 1
 }
 
 # service_compose_key <kind> — the compose service name a kind publishes under.
@@ -60,8 +60,8 @@ record_services() {
   sed -i.bak -e "s|@DATABASE@|${database}|" -e "s|@CACHE@|${cache}|" "$file"
   rm -f "${file}.bak"
 
-  grep -Eq '@DATABASE@|@CACHE@' "$file" \
-    && die "could not record the selected services in ${file} — has [vars] been reformatted?"
+  grep -Eq '@DATABASE@|@CACHE@' "$file" &&
+    die "could not record the selected services in ${file} — has [vars] been reformatted?"
   return 0
 }
 
@@ -89,7 +89,8 @@ app_service_key() {
 # app_port_variable <rel> — WEB_PORT for apps/web. The same name in example.env
 # and in compose.yaml, derived rather than recorded, so the two cannot disagree.
 app_port_variable() {
-  local key; key="$(app_service_key "$1")"
+  local key
+  key="$(app_service_key "$1")"
   key="${key//-/_}"
   key="${key//./_}"
   printf '%s_PORT' "$(printf '%s' "$key" | tr '[:lower:]' '[:upper:]')"
@@ -122,8 +123,8 @@ project_image_base() {
     value="$(grep -oE 'ghcr\.io/[A-Za-z0-9._-]+/[A-Za-z0-9._-]+' \
       "${project}/.github/workflows/build.yml" 2>/dev/null | head -1 || true)"
   fi
-  [ -n "$value" ] \
-    || die "cannot tell which registry path ${project} publishes under — neither [vars] image in mise.toml nor a ghcr.io reference in .github/workflows/build.yml"
+  [ -n "$value" ] ||
+    die "cannot tell which registry path ${project} publishes under — neither [vars] image in mise.toml nor a ghcr.io reference in .github/workflows/build.yml"
   printf '%s' "$value"
 }
 
@@ -134,7 +135,7 @@ project_image_base() {
 compose_lane_file() {
   case "$1" in
     prod) printf '%s\n' "$COMPOSE_FILE" ;;
-    dev|test) printf 'compose.%s.yaml\n' "$1" ;;
+    dev | test) printf 'compose.%s.yaml\n' "$1" ;;
     *) die "unknown compose lane: ${1}" ;;
   esac
 }
@@ -158,7 +159,8 @@ merge_compose_fragment() {
 # merged in per lane. The image is injected here rather than written in a
 # fragment so a service's digest lives only in its service.env.
 assemble_compose() {
-  local -r project="$1"; shift
+  local -r project="$1"
+  shift
   local service lane file key merged
 
   for service in "$@"; do
@@ -167,8 +169,8 @@ assemble_compose() {
 
     # The fragment has to publish under the key its kind implies, or the
     # depends_on in add_app_service would name a service that is not there.
-    yq -e ".services.${key} != null" "${SERVICE_DIR}/compose.fragment.yaml" >/dev/null \
-      || die "${service}'s compose fragment does not define services.${key}"
+    yq -e ".services.${key} != null" "${SERVICE_DIR}/compose.fragment.yaml" >/dev/null ||
+      die "${service}'s compose fragment does not define services.${key}"
 
     for lane in "${COMPOSE_LANES[@]}"; do
       file="${project}/$(compose_lane_file "$lane")"
@@ -176,7 +178,7 @@ assemble_compose() {
       merged="$(mktemp)"
       if ! yq eval-all 'select(fileIndex==0) * select(fileIndex==1)' \
         "${SERVICE_DIR}/compose.fragment.yaml" \
-        "${SERVICE_DIR}/compose.${lane}.fragment.yaml" > "$merged"; then
+        "${SERVICE_DIR}/compose.${lane}.fragment.yaml" >"$merged"; then
         rm -f "$merged"
         die "could not assemble ${service}'s ${lane} block"
       fi
@@ -197,14 +199,15 @@ assemble_compose() {
 # service's driver, into the app's own .env.example: DB_CONNECTION is Laravel's
 # phrasing and DATABASE_URL is Prisma's for the same server.
 assemble_example_env() {
-  local -r project="$1"; shift
+  local -r project="$1"
+  shift
   local service
 
   for service in "$@"; do
     load_service "$service"
     [ -f "${SERVICE_DIR}/env.fragment" ] || continue
-    printf '\n' >> "${project}/${EXAMPLE_ENV_FILE}"
-    cat "${SERVICE_DIR}/env.fragment" >> "${project}/${EXAMPLE_ENV_FILE}"
+    printf '\n' >>"${project}/${EXAMPLE_ENV_FILE}"
+    cat "${SERVICE_DIR}/env.fragment" >>"${project}/${EXAMPLE_ENV_FILE}"
   done
 }
 
@@ -239,11 +242,11 @@ add_app_service() {
     printf '    restart: always\n'
     # shellcheck disable=SC2016 # same as the image line above
     printf "    ports:\n      - '\${%s:-%s}:%s'\n" "$port_var" "$port" "$APP_CONTAINER_PORT"
-  } > "$fragment"
+  } >"$fragment"
 
   merge_compose_fragment "$file" "$fragment" "the ${key} service"
 
-  printf '\n%s=%s\n' "$port_var" "$port" >> "${project}/${EXAMPLE_ENV_FILE}"
+  printf '\n%s=%s\n' "$port_var" "$port" >>"${project}/${EXAMPLE_ENV_FILE}"
 
   # Only an application that opens a connection waits for one. A web
   # application in a project with a database has no driver and no client, so
@@ -271,10 +274,11 @@ add_app_service() {
 # against an .env.example the adapter shipped, so appending blindly would leave
 # two values for one key and let the loser win depending on the reader.
 write_env_lines() {
-  local -r file="$1"; shift
+  local -r file="$1"
+  shift
   local line key rendered
 
-  [ -f "$file" ] || : > "$file"
+  [ -f "$file" ] || : >"$file"
   for line in "$@"; do
     key="${line%%=*}"
     if grep -q "^${key}=" "$file"; then
@@ -286,7 +290,7 @@ write_env_lines() {
         BEGIN { prefix = ENVIRON["KEY"] "=" }
         substr($0, 1, length(prefix)) == prefix { print ENVIRON["LINE"]; next }
         { print }
-      ' "$file" > "$rendered"; then
+      ' "$file" >"$rendered"; then
         rm -f "$rendered"
         die "could not set ${key} in ${file}"
       fi
@@ -295,9 +299,9 @@ write_env_lines() {
       # a file with no trailing newline would otherwise get this key
       # concatenated onto the end of the last line
       if [ -s "$file" ] && [ -n "$(tail -c1 "$file")" ]; then
-        printf '\n' >> "$file"
+        printf '\n' >>"$file"
       fi
-      printf '%s\n' "$line" >> "$file"
+      printf '%s\n' "$line" >>"$file"
     fi
   done
 }
@@ -314,17 +318,18 @@ apply_service_dockerfile() {
   for file in "${app}/Dockerfile" "${app}/Dockerfile.workspace"; do
     [ -f "$file" ] || continue
     found=1
-    grep -q "^${SERVICE_SETUP_ANCHOR}\$" "$file" \
-      || die "no @SERVICE_SETUP@ anchor in ${file}"
+    grep -q "^${SERVICE_SETUP_ANCHOR}\$" "$file" ||
+      die "no @SERVICE_SETUP@ anchor in ${file}"
 
-    local rendered; rendered="$(mktemp)"
+    local rendered
+    rendered="$(mktemp)"
     # ENVIRON, not -v: awk's -v does C-style escape processing on the assigned
     # value, so a literal backslash in the block (e.g. \t, \") is consumed
     # instead of passed through.
     block="$block" anchor="$SERVICE_SETUP_ANCHOR" awk '
       $0 == ENVIRON["anchor"] { if (ENVIRON["block"] != "") printf "%s\n", ENVIRON["block"]; next }
       { print }
-    ' "$file" > "$rendered"
+    ' "$file" >"$rendered"
     mv "$rendered" "$file"
   done
 
@@ -350,7 +355,7 @@ apply_service_compose_env() {
     printf '  %s:\n' "$service"
     printf '    environment:\n'
     printf '%s\n' "$block" | sed 's/^/      /'
-  } > "$fragment"
+  } >"$fragment"
 
   merge_compose_fragment "$file" "$fragment" "the service environment"
 }
@@ -367,7 +372,7 @@ apply_service_compose_service() {
   [ -f "$file" ] || die "no ${COMPOSE_FILE} in ${project}"
 
   fragment="$(mktemp)"
-  printf '%s\n' "$block" > "$fragment"
+  printf '%s\n' "$block" >"$fragment"
 
   merge_compose_fragment "$file" "$fragment" "the service"
 }
@@ -384,10 +389,10 @@ apply_service_compose_migrate() {
   [ -n "$command" ] || return 0
   [ -f "$file" ] || die "no ${COMPOSE_FILE} in ${project}"
 
-  image="$(yq ".services.\"${service}\".image" "$file")" \
-    || die "could not read ${service}'s image out of ${file}"
-  [ -n "$image" ] && [ "$image" != null ] \
-    || die "${file} has no ${service} service to migrate from"
+  image="$(yq ".services.\"${service}\".image" "$file")" ||
+    die "could not read ${service}'s image out of ${file}"
+  [ -n "$image" ] && [ "$image" != null ] ||
+    die "${file} has no ${service} service to migrate from"
 
   block="$(
     printf 'services:\n  migrate:\n'
@@ -441,8 +446,8 @@ run_driver_apply() {
   step "wiring ${service} into $(app_service_key "$app")"
   run_quietly "wiring ${service} into $(app_service_key "$app") (the ${family} driver)" \
     env PATH="${uv_bin:+${uv_bin}:}${pnpm_bin}:${node_bin}:${PATH}" \
-      npm_config_frozen_lockfile=false npm_config_verify_deps_before_run=false \
-      SCAFFOLD_PROJECT_ROOT="$project" \
+    npm_config_frozen_lockfile=false npm_config_verify_deps_before_run=false \
+    SCAFFOLD_PROJECT_ROOT="$project" \
     bash -euo pipefail -c "$driver_script" _ "$app" "$driver"
 }
 
@@ -450,7 +455,10 @@ run_driver_apply() {
 # driver's parameters do not leak into the next one.
 driver_output() {
   # shellcheck source=/dev/null # family varies, so the path isn't constant
-  ( . "$1"; "$2" )
+  (
+    . "$1"
+    "$2"
+  )
 }
 
 # resolve_driver <family> <service> — the driver file, by name, or die.
@@ -468,7 +476,8 @@ resolve_driver() {
 # project-root is an argument, not `app`'s ancestor counted in `..`: cmd_new's
 # apps/<role> and cmd_add's caller-chosen directory nest at different depths.
 apply_service_drivers() {
-  local -r app="$1" project="$2" family="$3"; shift 3
+  local -r app="$1" project="$2" family="$3"
+  shift 3
   local service driver rendered
   local block="" env_block="" migrate_block=""
 
@@ -496,7 +505,8 @@ apply_service_drivers() {
     [ -n "$rendered" ] && migrate_block+="${rendered}"$'\n'
   done
 
-  local key; key="$(app_service_key "$app")"
+  local key
+  key="$(app_service_key "$app")"
   apply_service_dockerfile "$app" "${block%$'\n'}"
   apply_service_compose_env "$project" "$key" "${env_block%$'\n'}"
   # The migrate service runs the first driven application's image — it carries
diff --git a/lib/tui.sh b/lib/tui.sh
index a4dbd90..ec4920b 100644
--- a/lib/tui.sh
+++ b/lib/tui.sh
@@ -86,18 +86,20 @@ _TUI_LOGO_WIDTH=${#_TUI_LOGO[0]}
 # The wordmark is width-checked before it is drawn, because below that _tui_fit
 # hands back four ellipsised fragments, which reads as damage, not a logo.
 tui_header() {
-  local term_lines; term_lines="$(tput lines 2>/dev/null || echo "$DEFAULT_TERM_LINES")"
-  if (( term_lines < MIN_TERM_LINES_FOR_HEADER )); then
+  local term_lines
+  term_lines="$(tput lines 2>/dev/null || echo "$DEFAULT_TERM_LINES")"
+  if ((term_lines < MIN_TERM_LINES_FOR_HEADER)); then
     echo -e "${BOLD}${GREEN}scaffold — project generator${RESET}"
     return
   fi
 
-  local cols width; cols="$(tput cols 2>/dev/null || echo "$DEFAULT_TERM_COLS")"
-  width=$(( cols - 1 ))
+  local cols width
+  cols="$(tput cols 2>/dev/null || echo "$DEFAULT_TERM_COLS")"
+  width=$((cols - 1))
 
   _tui_header_edge '╭' '╮' 'Scaffold' "$width"
   _tui_header_row '' '' "$width"
-  if (( width - 2 >= _TUI_LOGO_WIDTH )); then
+  if ((width - 2 >= _TUI_LOGO_WIDTH)); then
     local line
     for line in "${_TUI_LOGO[@]}"; do
       _tui_header_row bold "$line" "$width"
@@ -120,15 +122,17 @@ tui_header() {
 _tui_header_edge() {
   local -r left="$1" right="$2" width="$4"
   local label="$3"
-  local -r inner=$(( width - 2 ))
+  local -r inner=$((width - 2))
 
   _tui_fit " ${label} " "$inner"
   label="$REPLY"
-  local -r side=$(( (inner - ${#label}) / 2 ))
-  local -r extra=$(( inner - ${#label} - side * 2 ))
+  local -r side=$(((inner - ${#label}) / 2))
+  local -r extra=$((inner - ${#label} - side * 2))
   local l r
-  printf -v l '%*s' "$side" ''; l="${l// /─}"
-  printf -v r '%*s' "$(( side + extra ))" ''; r="${r// /─}"
+  printf -v l '%*s' "$side" ''
+  l="${l// /─}"
+  printf -v r '%*s' "$((side + extra))" ''
+  r="${r// /─}"
 
   echo -e "${BOLD}${GREEN}${left}${l}${label}${r}${right}${RESET}"
 }
@@ -138,11 +142,12 @@ _tui_header_edge() {
 _tui_header_row() {
   local -r style="$1" width="$3"
   local text="$2"
-  local -r inner=$(( width - 2 ))
+  local -r inner=$((width - 2))
 
   _tui_fit "$text" "$inner"
   text="$REPLY"
-  local pad; printf -v pad '%*s' "$(( inner - ${#text} ))" ''
+  local pad
+  printf -v pad '%*s' "$((inner - ${#text}))" ''
   local styled="$text"
   [ "$style" = dim ] && styled="${DIM}${text}${RESET}"
   [ "$style" = bold ] && styled="${BOLD}${text}${RESET}"
@@ -170,7 +175,10 @@ tui_prompt_name() {
     # Cyan opens before the read and closes after every exit from it, Esc
     # included: a cancelled wizard must not leave the terminal painted.
     printf '%b' "${BOLD}? Project name: ${RESET}${CYAN}" >&2
-    _tui_read_line || { printf '%b\n' "$RESET" >&2; exit 130; }
+    _tui_read_line || {
+      printf '%b\n' "$RESET" >&2
+      exit 130
+    }
     printf '%b' "$RESET" >&2
     name="$REPLY"
     tui_name_is_usable "$name" && break
@@ -214,7 +222,7 @@ _tui_read_line() {
         fi
         return 1
         ;;
-      $'\x7f'|$'\b')
+      $'\x7f' | $'\b')
         [ -n "$REPLY" ] || continue
         REPLY="${REPLY%?}"
         # Back up, overwrite with a space, back up again: the terminal has
@@ -226,7 +234,10 @@ _tui_read_line() {
         # land in the name, where project_name_is_usable would reject it with a
         # message about a character the user cannot see.
         case "$key" in
-          [[:print:]]) REPLY+="$key"; printf '%s' "$key" >&2 ;;
+          [[:print:]])
+            REPLY+="$key"
+            printf '%s' "$key" >&2
+            ;;
         esac
         ;;
     esac
@@ -240,7 +251,8 @@ _tui_read_line() {
 # value in TUI_CHOICE; returns 1 on Esc rather than dying, so the caller decides
 # what cancelling the wizard means.
 tui_select() {
-  local -r prompt="$1"; shift
+  local -r prompt="$1"
+  shift
   local -a options=("$@")
   local cursor=0 key i value
 
@@ -257,8 +269,8 @@ tui_select() {
       $'\x1b')
         if read -rsn2 -t "$ESC_SEQUENCE_TIMEOUT" key; then
           case "$key" in
-            "[A") cursor=$(( (cursor - 1 + ${#options[@]}) % ${#options[@]} )) ;;
-            "[B") cursor=$(( (cursor + 1) % ${#options[@]} )) ;;
+            "[A") cursor=$(((cursor - 1 + ${#options[@]}) % ${#options[@]})) ;;
+            "[B") cursor=$(((cursor + 1) % ${#options[@]})) ;;
           esac
         else
           return 1
@@ -277,7 +289,7 @@ tui_select() {
         # caller, which is the only thing that knows every question it will ask.
         printf '  %b✔%b  %s%*s  %b%s%b\n' \
           "$GREEN" "$RESET" "$prompt" \
-          "$(( ${TUI_ANSWER_COLUMN:-0} - ${#prompt} ))" "" \
+          "$((${TUI_ANSWER_COLUMN:-0} - ${#prompt}))" "" \
           "$CYAN" "$TUI_CHOICE" "$RESET"
         return 0
         ;;
@@ -307,13 +319,14 @@ tui_select() {
 _TUI_RENDER_HEIGHT=0
 
 _tui_render() {
-  local -r prompt="$1" cursor="$2"; shift 2
+  local -r prompt="$1" cursor="$2"
+  shift 2
   local -a options=("$@")
   local cols limit
   cols="$(tput cols 2>/dev/null || echo "$DEFAULT_TERM_COLS")"
-  limit=$(( cols - 1 ))
+  limit=$((cols - 1))
 
-  (( _TUI_RENDER_HEIGHT > 0 )) && printf '\033[%dA' "$_TUI_RENDER_HEIGHT"
+  ((_TUI_RENDER_HEIGHT > 0)) && printf '\033[%dA' "$_TUI_RENDER_HEIGHT"
 
   # The blank belongs to the question, not to the transcript above it: the
   # collapse in tui_select rewinds over everything this function printed, so the
@@ -330,7 +343,7 @@ _tui_render() {
     pointer=" "
     [ "$i" -eq "$cursor" ] && pointer="»"
 
-    _tui_fit "$value" $(( limit - 4 ))
+    _tui_fit "$value" $((limit - 4))
     value="$REPLY"
     # An empty meta means the caller had nothing to add beyond the value itself
     # — "mysql ()" would say less than plain "mysql". Dim, because it qualifies
@@ -345,7 +358,7 @@ _tui_render() {
   done
 
   echo -e "\033[K"
-  _TUI_RENDER_HEIGHT=$(( ${#options[@]} + 3 ))
+  _TUI_RENDER_HEIGHT=$((${#options[@]} + 3))
 }
 
 # _tui_fit <text> <limit> — sets REPLY rather than echoing, so it can run once
@@ -353,9 +366,9 @@ _tui_render() {
 # sending bytes at the (echo-disabled) tty.
 _tui_fit() {
   local -r text="$1" limit="$2"
-  if (( ${#text} <= limit )); then
+  if ((${#text} <= limit)); then
     REPLY="$text"
-  elif (( limit <= 1 )); then
+  elif ((limit <= 1)); then
     REPLY="${text:0:limit}"
   else
     REPLY="${text:0:limit-1}…"
diff --git a/lib/update.sh b/lib/update.sh
index 8753ff9..e921c39 100644
--- a/lib/update.sh
+++ b/lib/update.sh
@@ -48,13 +48,15 @@ manifest_apps() {
 # directory name, which would answer for this machine today rather than for the
 # project as it was generated.
 project_image_owner() {
-  local image; image="$(project_image_base "$1")"
+  local image
+  image="$(project_image_base "$1")"
   image="${image#ghcr.io/}"
   printf '%s' "${image%%/*}"
 }
 
 project_image_name() {
-  local image; image="$(project_image_base "$1")"
+  local image
+  image="$(project_image_base "$1")"
   printf '%s' "${image##*/}"
 }
 
@@ -110,9 +112,9 @@ common_patch() {
   local -r project="$1"
 
   git -C "$SCAFFOLD_ROOT" diff "${SCAFFOLD_UPDATE_FROM}..HEAD" -- \
-    common/ "${COMMON_PATCH_EXCLUDES[@]}" \
-    | rewrite_patch_paths 'common/' '' \
-    | substitute_placeholders "$project"
+    common/ "${COMMON_PATCH_EXCLUDES[@]}" |
+    rewrite_patch_paths 'common/' '' |
+    substitute_placeholders "$project"
 }
 
 # adapter_patch <project> <rel> <adapter>
@@ -130,8 +132,8 @@ adapter_patch() {
   local kept dropped internal
   local -a excludes=()
 
-  if [ -f "${SCAFFOLD_ROOT}/${dir}/Dockerfile.workspace" ] \
-    && app_is_workspace_member "$project" "$rel"; then
+  if [ -f "${SCAFFOLD_ROOT}/${dir}/Dockerfile.workspace" ] &&
+    app_is_workspace_member "$project" "$rel"; then
     kept="Dockerfile.workspace"
     dropped="Dockerfile"
   else
@@ -147,11 +149,11 @@ adapter_patch() {
     git -C "$SCAFFOLD_ROOT" diff "${SCAFFOLD_UPDATE_FROM}..HEAD" -- \
       "${dir}/" "${excludes[@]}"
     # The surviving Dockerfile, mapped onto the one name the app actually has.
-    git -C "$SCAFFOLD_ROOT" diff "${SCAFFOLD_UPDATE_FROM}..HEAD" -- "${dir}/${kept}" \
-      | rewrite_patch_paths "${dir}/${kept}" "${dir}/Dockerfile"
-  } \
-    | rewrite_patch_paths "${dir}/" "${rel}/" \
-    | substitute_placeholders "$project" "$rel"
+    git -C "$SCAFFOLD_ROOT" diff "${SCAFFOLD_UPDATE_FROM}..HEAD" -- "${dir}/${kept}" |
+      rewrite_patch_paths "${dir}/${kept}" "${dir}/Dockerfile"
+  } |
+    rewrite_patch_paths "${dir}/" "${rel}/" |
+    substitute_placeholders "$project" "$rel"
 }
 
 # update_patch <project> — everything the project has not received, as one
@@ -163,8 +165,11 @@ update_patch() {
   common_patch "$project"
   while IFS=$'\t' read -r rel adapter; do
     [ -n "$rel" ] || continue
-    [ -d "${SCAFFOLD_ROOT}/adapters/${adapter}" ] \
-      || { warn "${rel} was generated by '${adapter}', which this toolbox no longer has — skipping it"; continue; }
+    [ -d "${SCAFFOLD_ROOT}/adapters/${adapter}" ] ||
+      {
+        warn "${rel} was generated by '${adapter}', which this toolbox no longer has — skipping it"
+        continue
+      }
     adapter_patch "$project" "$rel" "$adapter"
   done < <(manifest_apps "$project")
 }
diff --git a/lib/wizard.sh b/lib/wizard.sh
index 06c668d..e73feec 100644
--- a/lib/wizard.sh
+++ b/lib/wizard.sh
@@ -80,11 +80,11 @@ wizard_prompt_for() {
 wizard_prompt_width() {
   local kind text width=${#WIZARD_SHAPE_PROMPT}
 
-  (( ${#WIZARD_ACTION_PROMPT} > width )) && width=${#WIZARD_ACTION_PROMPT}
-  (( ${#WIZARD_VISIBILITY_PROMPT} > width )) && width=${#WIZARD_VISIBILITY_PROMPT}
+  ((${#WIZARD_ACTION_PROMPT} > width)) && width=${#WIZARD_ACTION_PROMPT}
+  ((${#WIZARD_VISIBILITY_PROMPT} > width)) && width=${#WIZARD_VISIBILITY_PROMPT}
   for kind in "${WIZARD_QUESTION_KINDS[@]}"; do
     text="$(wizard_prompt_for "$kind")"
-    (( ${#text} > width )) && width=${#text}
+    ((${#text} > width)) && width=${#text}
   done
   printf '%s' "$width"
 }
@@ -96,9 +96,9 @@ wizard_options() {
   local -r listing="$1" kind="$2"
 
   case "$kind" in
-    web|api|app)
+    web | api | app)
       awk -F'\t' -v role="$kind" \
-        '$2 == role { printf "%s\ttier %s\n", $1, $3 }' <<< "$listing"
+        '$2 == role { printf "%s\ttier %s\n", $1, $3 }' <<<"$listing"
       # The frontend of a web+api project is optional in a way the api is not,
       # and the flags allow it, so the wizard does too.
       #
@@ -111,11 +111,11 @@ wizard_options() {
     database)
       # No meta column: the kind is the only thing the listing carries per
       # service, and the question is already titled "Database".
-      awk -F'\t' '$2 == "database" { printf "%s\t\n", $1 }' <<< "$listing"
+      awk -F'\t' '$2 == "database" { printf "%s\t\n", $1 }' <<<"$listing"
       printf 'none\tno database service\n'
       ;;
     cache)
-      awk -F'\t' '$2 == "cache" { printf "%s\t\n", $1 }' <<< "$listing"
+      awk -F'\t' '$2 == "cache" { printf "%s\t\n", $1 }' <<<"$listing"
       printf 'none\tno cache service\n'
       ;;
     *) die "unknown question kind: ${kind}" ;;
@@ -143,12 +143,12 @@ wizard_order_options() {
     if [ "${line%%$'\t'*}" = "$default" ]; then
       printf '%s\n' "$line"
     fi
-  done <<< "$(wizard_options "$listing" "$kind")"
+  done <<<"$(wizard_options "$listing" "$kind")"
   while IFS= read -r line; do
     if [ "${line%%$'\t'*}" != "$default" ]; then
       printf '%s\n' "$line"
     fi
-  done <<< "$(wizard_options "$listing" "$kind")"
+  done <<<"$(wizard_options "$listing" "$kind")"
   # the loop's own status is read's EOF failure, not this function's; without
   # this the default branch always reports failure on an otherwise-fine run.
   return 0
@@ -164,7 +164,7 @@ wizard_new_args() {
     kind="${pair%%=*}"
     value="${pair#*=}"
     case "$kind" in
-      web|api|app)
+      web | api | app)
         if [ "$value" != none ]; then
           printf -- '--%s\n%s\n' "$kind" "$value"
         fi
@@ -180,8 +180,10 @@ wizard_new_args() {
 # What the answers would have been typed as. Printed before the run so the
 # second project is scripted rather than clicked.
 wizard_command() {
-  local -r name="$1"; shift
-  local -a args; mapfile -t args < <(wizard_new_args "$@")
+  local -r name="$1"
+  shift
+  local -a args
+  mapfile -t args < <(wizard_new_args "$@")
   local out="scaffold new ${name}"
   [ "${#args[@]}" -eq 0 ] || out+=" ${args[*]}"
   printf '%s\n' "$out"
@@ -195,8 +197,8 @@ wizard_echo_command() {
   local token out="${CYAN}!${RESET}"
   for token in $1; do
     case "$token" in
-      --*|scaffold) out+=" ${CYAN}${token}${RESET}" ;;
-      *)            out+=" ${token}" ;;
+      --* | scaffold) out+=" ${CYAN}${token}${RESET}" ;;
+      *) out+=" ${token}" ;;
     esac
   done
   printf '%b\n' "$out" >&2
diff --git a/mise.lock b/mise.lock
index 0c4035e..47509a5 100644
--- a/mise.lock
+++ b/mise.lock
@@ -206,6 +206,46 @@ checksum = "sha256:8a4e35ab0b331c85d73567b12f2a444df187f483e5079ceffa6bda1faa2e7
 url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.zip"
 url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056944"
 
+[[tools.shfmt]]
+version = "3.14.1"
+backend = "aqua:mvdan/sh"
+specifiers = ["3.14.1"]
+
+[tools.shfmt."platforms.linux-arm64"]
+checksum = "sha256:5f2db09dae91fca848f7adbdd014632e921a383863a2ad7e0450ad3aba0c6489"
+url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_linux_arm64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320869"
+
+[tools.shfmt."platforms.linux-arm64-musl"]
+checksum = "sha256:5f2db09dae91fca848f7adbdd014632e921a383863a2ad7e0450ad3aba0c6489"
+url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_linux_arm64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320869"
+
+[tools.shfmt."platforms.linux-x64"]
+checksum = "sha256:76e77641faa025814b77f153b29796b8e6fa2fca03e0c76a691608b86c7ea7bf"
+url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_linux_amd64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320883"
+
+[tools.shfmt."platforms.linux-x64-musl"]
+checksum = "sha256:76e77641faa025814b77f153b29796b8e6fa2fca03e0c76a691608b86c7ea7bf"
+url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_linux_amd64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320883"
+
+[tools.shfmt."platforms.macos-arm64"]
+checksum = "sha256:b7c872db63553ccffc7253aba3ed7d4885a27d83f1ba567b1138c6315a5847e5"
+url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_darwin_arm64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320930"
+
+[tools.shfmt."platforms.macos-x64"]
+checksum = "sha256:d33eee0da0f92835b3562e9767a05cee7e4eaeef47daa03bfd09da17b4b590a6"
+url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_darwin_amd64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320946"
+
+[tools.shfmt."platforms.windows-x64"]
+checksum = "sha256:13629ce28442ca80b6b5a819f7574ab39e1c28c6e26734ca816c9714e04851df"
+url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_windows_amd64.exe"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320827"
+
 [[tools."ubi:shenwei356/rush"]]
 version = "0.9.0"
 backend = "ubi:shenwei356/rush"
diff --git a/mise.toml b/mise.toml
index 0bf8b05..630624e 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,6 +1,7 @@
 [tools]
 bats = "1.13.0"
 shellcheck = "0.11.0"
+shfmt = "3.14.1"
 yq = "4.48.1"
 jq = "1.8.1"
 zizmor = "1.29.0"
@@ -18,9 +19,10 @@ lockfile = true
 [tasks.lint]
 # discovers tracked shell files rather than listing them, so a new one is
 # caught automatically; xargs -r skips the run when nothing matches yet.
-# common/*.sh (install.sh) is included: it ships into every generated
-# project, so it is linted here same as the toolbox's own scripts.
-run = "git ls-files -- scaffold 'lib/*.sh' 'scripts/*.sh' 'common/*.sh' | xargs -r shellcheck"
+run = [
+  "git ls-files -z -- scaffold '*.sh' '*.bash' '*.bats' | xargs -0 -r shellcheck",
+  "git ls-files -z -- scaffold '*.sh' '*.bash' '*.bats' | xargs -0 -r shfmt -i 2 -ci -d",
+]
 
 [tasks.test]
 # --jobs changes no isolation: bats already gives every test its own process
diff --git a/scaffold b/scaffold
index eb9bf00..779a24e 100755
--- a/scaffold
+++ b/scaffold
@@ -120,8 +120,8 @@ resolve_project() {
   if [ -n "$rel" ]; then
     project="$(cd "$rel" 2>/dev/null && pwd)" || die "no such directory: ${rel}"
   else
-    project="$(git rev-parse --show-toplevel 2>/dev/null)" \
-      || die "not inside a git repository: run 'scaffold ${command}' from inside a project created by 'scaffold new', or give its path"
+    project="$(git rev-parse --show-toplevel 2>/dev/null)" ||
+      die "not inside a git repository: run 'scaffold ${command}' from inside a project created by 'scaffold new', or give its path"
   fi
 
   is_scaffold_project "$project" || die "not a scaffold project (${project})"
@@ -182,8 +182,14 @@ cmd_list() {
 
   while [ $# -gt 0 ]; do
     case "$1" in
-      --adapters) want_adapters=1; shift ;;
-      --services) want_services=1; shift ;;
+      --adapters)
+        want_adapters=1
+        shift
+        ;;
+      --services)
+        want_services=1
+        shift
+        ;;
       *) die "unknown option: ${1}" ;;
     esac
   done
@@ -236,7 +242,7 @@ parse_new_flags() {
 
   while [ $# -gt 0 ]; do
     case "$1" in
-      --web|--api|--app)
+      --web | --api | --app)
         [ $# -ge 2 ] || die "${1} requires an adapter name"
         # each role maps to one apps/<role> directory, so a repeated flag runs
         # a second generator over the first app's files, silently
@@ -266,7 +272,7 @@ parse_new_flags() {
 project_has_backend() {
   local entry
   for entry in ${NEW_APPS[@]+"${NEW_APPS[@]}"}; do
-    case "$entry" in api:*|app:*) return 0 ;; esac
+    case "$entry" in api:* | app:*) return 0 ;; esac
   done
   return 1
 }
@@ -278,11 +284,11 @@ assert_service_connectable() {
   local flag="$1" kind="$2" service="$3"
 
   [ "$service" != none ] || return 0
-  project_has_backend \
-    || die "${flag} ${service} but there is no application to connect it — add --api or --app"
+  project_has_backend ||
+    die "${flag} ${service} but there is no application to connect it — add --api or --app"
   load_service "$service"
-  [ "$SERVICE_KIND" = "$kind" ] \
-    || die "${service} is a ${SERVICE_KIND}, not a ${kind}"
+  [ "$SERVICE_KIND" = "$kind" ] ||
+    die "${service} is a ${SERVICE_KIND}, not a ${kind}"
 }
 
 resolve_service_selection() {
@@ -310,8 +316,8 @@ install_adapters() {
     role="${entry%%:*}"
     adapter="${entry#*:}"
     load_adapter "$adapter"
-    [ "$ADAPTER_ROLE" = "$role" ] \
-      || die "adapter ${adapter} has role ${ADAPTER_ROLE}, not ${role}"
+    [ "$ADAPTER_ROLE" = "$role" ] ||
+      die "adapter ${adapter} has role ${ADAPTER_ROLE}, not ${role}"
     rel="$(role_path "$ADAPTER_ROLE")"
     # Before the adapter: apply_adapter runs the service drivers, and a
     # driver's compose environment merges into this app's own service.
@@ -365,7 +371,8 @@ print_next_steps() {
 cmd_new() {
   [ $# -gt 0 ] || die "new requires a project name"
 
-  local target="$1"; shift
+  local target="$1"
+  shift
   # Absolute once here: apply_service_drivers exports it as
   # SCAFFOLD_PROJECT_ROOT into a driver's child, whose cwd is the app directory.
   case "$target" in
@@ -421,10 +428,10 @@ cmd_add_cleanup() {
 # inside an existing app.
 add_project_root() {
   local project
-  project="$(git rev-parse --show-toplevel 2>/dev/null)" \
-    || die "not inside a git repository: run 'scaffold add' from inside a project created by 'scaffold new'"
-  is_scaffold_project "$project" \
-    || die "not a scaffold project (${project}): run 'scaffold add' from inside a project created by 'scaffold new'"
+  project="$(git rev-parse --show-toplevel 2>/dev/null)" ||
+    die "not inside a git repository: run 'scaffold add' from inside a project created by 'scaffold new'"
+  is_scaffold_project "$project" ||
+    die "not a scaffold project (${project}): run 'scaffold add' from inside a project created by 'scaffold new'"
   printf '%s' "$project"
 }
 
@@ -451,9 +458,9 @@ load_recorded_services() {
 joins_shared_workspace() {
   local workspace_file="${1}/${WORKSPACE_FILE}"
 
-  [ -f "$workspace_file" ] \
-    && [ "$(yq -r '.packages // "absent"' "$workspace_file")" != "absent" ] \
-    && adapter_is_typescript "$2"
+  [ -f "$workspace_file" ] &&
+    [ "$(yq -r '.packages // "absent"' "$workspace_file")" != "absent" ] &&
+    adapter_is_typescript "$2"
 }
 
 reconcile_shared_workspace() {
@@ -476,7 +483,7 @@ reconcile_standalone_app() {
 
   if adapter_is_typescript "$adapter" && [ ! -f "$workspace_file" ]; then
     yq '{"allowBuilds": .allowBuilds}' \
-      "${SCAFFOLD_ROOT}/common/${WORKSPACE_FILE}" > "$workspace_file"
+      "${SCAFFOLD_ROOT}/common/${WORKSPACE_FILE}" >"$workspace_file"
   fi
 
   # Install from the app, record in the root: the app is where pnpm resolves its
@@ -506,7 +513,8 @@ stage_new_app() {
 cmd_add() {
   [ $# -ge 3 ] || die "usage: scaffold add <dir> --adapter <adapter>"
 
-  local rel="$1"; shift
+  local rel="$1"
+  shift
   local adapter=""
 
   while [ $# -gt 0 ]; do
@@ -522,7 +530,8 @@ cmd_add() {
 
   [ -n "$adapter" ] || die "--adapter is required"
 
-  local project; project="$(add_project_root)"
+  local project
+  project="$(add_project_root)"
   confine_mise_to "$project"
   load_recorded_services "$project"
 
@@ -593,10 +602,11 @@ update_source_commit() {
 
   case "$from" in
     *-dirty)
-      die "${SCAFFOLD_MANIFEST} records ${from}: this project was generated from uncommitted edits, so there is no commit to diff against" ;;
+      die "${SCAFFOLD_MANIFEST} records ${from}: this project was generated from uncommitted edits, so there is no commit to diff against"
+      ;;
   esac
-  git -C "$SCAFFOLD_ROOT" rev-parse --verify --quiet "${from}^{commit}" >/dev/null \
-    || die "this toolbox has no commit ${from} — the checkout that generated ${project} is not this one, or its history was rewritten"
+  git -C "$SCAFFOLD_ROOT" rev-parse --verify --quiet "${from}^{commit}" >/dev/null ||
+    die "this toolbox has no commit ${from} — the checkout that generated ${project} is not this one, or its history was rewritten"
 
   printf '%s' "$from"
 }
@@ -628,20 +638,28 @@ cmd_update() {
 
   while [ $# -gt 0 ]; do
     case "$1" in
-      --dry-run) dry_run=1; shift ;;
+      --dry-run)
+        dry_run=1
+        shift
+        ;;
       -*) die "unknown option: ${1}" ;;
       *)
         [ -z "$rel" ] || die "update takes at most one directory"
-        rel="$1"; shift ;;
+        rel="$1"
+        shift
+        ;;
     esac
   done
 
-  local project; project="$(resolve_project "$rel" update)"
-  local from; from="$(update_source_commit "$project")"
+  local project
+  project="$(resolve_project "$rel" update)"
+  local from
+  from="$(update_source_commit "$project")"
   SCAFFOLD_UPDATE_FROM="$from"
 
-  local patch; patch="$(mktemp)"
-  update_patch "$project" > "$patch"
+  local patch
+  patch="$(mktemp)"
+  update_patch "$project" >"$patch"
 
   if [ ! -s "$patch" ]; then
     rm -f "$patch"
@@ -657,8 +675,11 @@ cmd_update() {
 
   # A dirty tree would make the result unreadable: `git diff` after this is the
   # only review anyone gets, and it has to show this run's changes alone.
-  [ -z "$(git -C "$project" status --porcelain)" ] \
-    || { rm -f "$patch"; die "${project} has uncommitted changes — commit or stash them first, so 'git diff' afterwards shows only what this brought in"; }
+  [ -z "$(git -C "$project" status --porcelain)" ] ||
+    {
+      rm -f "$patch"
+      die "${project} has uncommitted changes — commit or stash them first, so 'git diff' afterwards shows only what this brought in"
+    }
 
   local status=0
   git -C "$project" apply --reject --whitespace=nowarn "$patch" || status=$?
@@ -725,26 +746,43 @@ cmd_publish() {
 
   while [ $# -gt 0 ]; do
     case "$1" in
-      --public) visibility=public; shift ;;
-      --private) visibility=private; shift ;;
-      --no-protect) protect=0; shift ;;
-      --dry-run) dry_run=1; shift ;;
+      --public)
+        visibility=public
+        shift
+        ;;
+      --private)
+        visibility=private
+        shift
+        ;;
+      --no-protect)
+        protect=0
+        shift
+        ;;
+      --dry-run)
+        dry_run=1
+        shift
+        ;;
       -*) die "unknown option: ${1}" ;;
       *)
         [ -z "$rel" ] || die "publish takes at most one directory"
-        rel="$1"; shift ;;
+        rel="$1"
+        shift
+        ;;
     esac
   done
 
-  command -v gh >/dev/null 2>&1 \
-    || die "publish needs the GitHub CLI: install gh and run 'gh auth login'"
-  gh auth status >/dev/null 2>&1 \
-    || die "not signed in to GitHub: run 'gh auth login'"
+  command -v gh >/dev/null 2>&1 ||
+    die "publish needs the GitHub CLI: install gh and run 'gh auth login'"
+  gh auth status >/dev/null 2>&1 ||
+    die "not signed in to GitHub: run 'gh auth login'"
 
-  local project; project="$(resolve_project "$rel" publish)"
+  local project
+  project="$(resolve_project "$rel" publish)"
 
-  local slug; slug="$(repo_slug "$project")"
-  local exists=0; gh_repo_exists "$slug" && exists=1
+  local slug
+  slug="$(repo_slug "$project")"
+  local exists=0
+  gh_repo_exists "$slug" && exists=1
 
   [ "$exists" -eq 1 ] || assert_repo_creatable "$project" "$slug"
 
@@ -770,11 +808,12 @@ cmd_publish() {
 assert_repo_creatable() {
   local project="$1" slug="$2"
 
-  local branch; branch="$(git -C "$project" rev-parse --abbrev-ref HEAD)"
-  [ "$branch" = main ] \
-    || die "publish creates ${slug} from the branch you are on, and that branch becomes its default — check out main first (you are on ${branch})"
-  [ -z "$(git -C "$project" status --porcelain)" ] \
-    || die "${project} has uncommitted changes — commit them first, so what reaches ${slug} is what you reviewed"
+  local branch
+  branch="$(git -C "$project" rev-parse --abbrev-ref HEAD)"
+  [ "$branch" = main ] ||
+    die "publish creates ${slug} from the branch you are on, and that branch becomes its default — check out main first (you are on ${branch})"
+  [ -z "$(git -C "$project" status --porcelain)" ] ||
+    die "${project} has uncommitted changes — commit them first, so what reaches ${slug} is what you reviewed"
 
   # An origin pointing somewhere else, while ${slug} does not exist, means this
   # project is already pushing to a repository that is not the one it names.
@@ -833,7 +872,7 @@ _wizard_confirm() {
   printf '%b' "${BOLD}${1} [y/N] ${RESET}" >&2
   local reply=""
   IFS= read -r reply || true
-  case "$reply" in y|Y) return 0 ;; *) return 1 ;; esac
+  case "$reply" in y | Y) return 0 ;; *) return 1 ;; esac
 }
 
 _wizard_update() {
@@ -874,7 +913,7 @@ ask_shape_questions() {
   local -a kinds options
 
   WIZARD_ANSWERS=()
-  mapfile -t kinds <<< "$(wizard_questions "$shape")"
+  mapfile -t kinds <<<"$(wizard_questions "$shape")"
   for kind in "${kinds[@]}"; do
     mapfile -t options < <(wizard_order_options "$kind" "$listing")
     _wizard_select_or_cancel "$(wizard_prompt_for "$kind")" "${options[@]}"
@@ -910,12 +949,20 @@ cmd_wizard() {
   fi
 
   case "$action" in
-    update) _wizard_update "$here"; return ;;
-    publish) _wizard_publish "$here"; return ;;
+    update)
+      _wizard_update "$here"
+      return
+      ;;
+    publish)
+      _wizard_publish "$here"
+      return
+      ;;
   esac
 
-  local name; name="$(tui_prompt_name)"
-  local listing; listing="$(cmd_list)"
+  local name
+  name="$(tui_prompt_name)"
+  local listing
+  listing="$(cmd_list)"
 
   local -a shape_options
   mapfile -t shape_options < <(wizard_shapes)
@@ -947,7 +994,11 @@ main() {
   # something is wrong with the install, so it must not itself fail with
   # "missing required tool(s): yq".
   case "${1:-}" in
-    -v|--version) scaffold_version; printf '\n'; return ;;
+    -v | --version)
+      scaffold_version
+      printf '\n'
+      return
+      ;;
   esac
 
   load_toolchain_env
@@ -956,12 +1007,16 @@ main() {
   # A terminal, and only a terminal: a bare call that opened a menu in a script,
   # in CI or in this repository's tests would hang as a timeout, not fail.
   if [ $# -eq 0 ]; then
-    [ -t 0 ] || { usage >&2; exit 1; }
+    [ -t 0 ] || {
+      usage >&2
+      exit 1
+    }
     cmd_wizard
     return
   fi
 
-  local command="$1"; shift
+  local command="$1"
+  shift
   case "$command" in
     new) cmd_new "$@" ;;
     add) cmd_add "$@" ;;
@@ -969,7 +1024,7 @@ main() {
     publish) cmd_publish "$@" ;;
     list) cmd_list "$@" ;;
     lint) cmd_lint "$@" ;;
-    -h|--help) usage ;;
+    -h | --help) usage ;;
     *) die "unknown command: ${command}" ;;
   esac
 }
diff --git a/scripts/check-provenance.sh b/scripts/check-provenance.sh
index 591e287..7c39684 100755
--- a/scripts/check-provenance.sh
+++ b/scripts/check-provenance.sh
@@ -41,8 +41,14 @@ errors=0
 # ─── what this run can check ───────────────────────────────────────────────
 
 read_upstream_pin() {
-  [ -f "${ROOT}/UPSTREAM" ] || { echo "error: ${ROOT}/UPSTREAM not found" >&2; exit 1; }
-  [ -f "$TABLE" ] || { echo "error: ${TABLE} not found" >&2; exit 1; }
+  [ -f "${ROOT}/UPSTREAM" ] || {
+    echo "error: ${ROOT}/UPSTREAM not found" >&2
+    exit 1
+  }
+  [ -f "$TABLE" ] || {
+    echo "error: ${TABLE} not found" >&2
+    exit 1
+  }
 
   UPSTREAM="$(cat "${ROOT}/UPSTREAM")"
   COMMIT="${UPSTREAM#*@}"
diff --git a/scripts/deploy-check.sh b/scripts/deploy-check.sh
index 2d00fcb..ebf82ae 100755
--- a/scripts/deploy-check.sh
+++ b/scripts/deploy-check.sh
@@ -59,7 +59,10 @@ parse_args() {
         shift 2
         ;;
       -*) die "unknown option: ${1}" ;;
-      *) ADAPTERS+=("$1"); shift ;;
+      *)
+        ADAPTERS+=("$1")
+        shift
+        ;;
     esac
   done
   [ "${#ADAPTERS[@]}" -ge 1 ] || die "usage: deploy-check.sh <adapter>... [--db <service>]"
@@ -120,7 +123,7 @@ resolve_migrate_app() {
 # a Ctrl-C doesn't leave containers and a temp dir behind.
 cleanup() {
   if [ -f "${PROJECT_DIR}/compose.yaml" ]; then
-    ( cd "$PROJECT_DIR" && docker compose down -v --remove-orphans ) || true
+    (cd "$PROJECT_DIR" && docker compose down -v --remove-orphans) || true
   fi
   rm -rf "$TMP_DIR"
 }
@@ -145,7 +148,10 @@ prepare_workspace() {
   # Every generated project's compose.yaml is `name: app` (common/compose.yaml)
   # — without this, a local run reconciles against, and `down -v`s, any real
   # "app" project already running on this machine, database volumes included.
-  COMPOSE_PROJECT_NAME="${GATE_NAME}-$(IFS=-; printf '%s' "${APPS[*]}")"
+  COMPOSE_PROJECT_NAME="${GATE_NAME}-$(
+    IFS=-
+    printf '%s' "${APPS[*]}"
+  )"
   export COMPOSE_PROJECT_NAME
 
   trap cleanup EXIT INT TERM
@@ -176,8 +182,8 @@ build_targets() {
 
   [ -f "$build_yml" ] || die "generated project has no .github/workflows/build.yml"
   images="$(yq -r '[.jobs[] | select(has("with")) | .with.images] | .[0] // "[]"' "$build_yml")"
-  [ "$(jq 'length' <<<"$images")" = "${#APPS[@]}" ] \
-    || die "expected ${#APPS[@]} build target(s) in ${build_yml}, got: ${images}"
+  [ "$(jq 'length' <<<"$images")" = "${#APPS[@]}" ] ||
+    die "expected ${#APPS[@]} build target(s) in ${build_yml}, got: ${images}"
 
   jq -r '.[] | [.context, .dockerfile] | @tsv' <<<"$images"
 }
@@ -189,16 +195,16 @@ build_images() {
     app="$(app_service_key "$(dirname "$dockerfile")")"
     [ -n "${TAG_OF[$app]:-}" ] || die "the build workflow builds ${app}, which this run did not ask for"
     log "building ${TAG_OF[$app]} from ${dockerfile} (context: ${context})..."
-    docker build -f "${PROJECT_DIR}/${dockerfile}" -t "${TAG_OF[$app]}" "${PROJECT_DIR}/${context}" \
-      || die "docker build failed for ${ADAPTER_OF[$app]} (${dockerfile})"
+    docker build -f "${PROJECT_DIR}/${dockerfile}" -t "${TAG_OF[$app]}" "${PROJECT_DIR}/${context}" ||
+      die "docker build failed for ${ADAPTER_OF[$app]} (${dockerfile})"
   done < <(build_targets)
 }
 
 # ─── point the stack at what was just built ────────────────────────────────
 
 has_migrate_service() {
-  [ -n "$MIGRATE_APP" ] \
-    && yq -e '.services.migrate' "${PROJECT_DIR}/compose.yaml" >/dev/null 2>&1
+  [ -n "$MIGRATE_APP" ] &&
+    yq -e '.services.migrate' "${PROJECT_DIR}/compose.yaml" >/dev/null 2>&1
 }
 
 # Per service, not one tag for the whole file: a project publishes one image per
@@ -224,8 +230,8 @@ rewrite_compose_images() {
 assert_image_is_built_tag() {
   local service="$1" want="$2" actual
   actual="$(yq ".services.\"${service}\".image" "${PROJECT_DIR}/compose.yaml")"
-  [ "$actual" = "$want" ] \
-    || die "compose.yaml's ${service} image is ${actual}, not the image just built (${want})"
+  [ "$actual" = "$want" ] ||
+    die "compose.yaml's ${service} image is ${actual}, not the image just built (${want})"
 }
 
 assert_every_image_is_built_tag() {
@@ -247,8 +253,8 @@ write_env_file() {
   cp "${PROJECT_DIR}/example.env" "${PROJECT_DIR}/.env"
   # shellcheck source=/dev/null # path is this toolbox's own common/install.sh
   source "${ROOT}/common/install.sh"
-  generate_service_passwords "${PROJECT_DIR}/.env" \
-    || die "could not generate service passwords for ${ADAPTERS[*]}"
+  generate_service_passwords "${PROJECT_DIR}/.env" ||
+    die "could not generate service passwords for ${ADAPTERS[*]}"
 }
 
 wait_until_healthy() {
@@ -261,8 +267,8 @@ wait_until_healthy() {
     # "unknown" — a full 120s red on a healthy stack.
     health="$(docker inspect --format '{{.State.Health.Status}}' "$(docker compose ps -q "$service")" 2>/dev/null || true)"
     [ "$health" = "healthy" ] && return 0
-    [ "$health" = "unhealthy" ] \
-      && die "${service} container reported unhealthy — its HEALTHCHECK against ${LIVENESS_OF[$service]} is failing (see: docker compose logs ${service})"
+    [ "$health" = "unhealthy" ] &&
+      die "${service} container reported unhealthy — its HEALTHCHECK against ${LIVENESS_OF[$service]} is failing (see: docker compose logs ${service})"
     sleep "$HEALTH_POLL_INTERVAL_SECONDS"
     elapsed=$((elapsed + HEALTH_POLL_INTERVAL_SECONDS))
   done
@@ -297,14 +303,14 @@ wait_for_healthy_apps() {
 assert_migrate_service_exists() {
   [ -n "$MIGRATE_APP" ] && [ "$DB_SERVICE" != none ] || return 0
 
-  compose_has_service migrate --profile migrate \
-    || die "expected a migrate service for ${ADAPTER_OF[$MIGRATE_APP]} (role=${ROLE_OF[$MIGRATE_APP]}, db=${DB_SERVICE:-default}) but compose has none — a service, profile, or driver may have silently vanished"
+  compose_has_service migrate --profile migrate ||
+    die "expected a migrate service for ${ADAPTER_OF[$MIGRATE_APP]} (role=${ROLE_OF[$MIGRATE_APP]}, db=${DB_SERVICE:-default}) but compose has none — a service, profile, or driver may have silently vanished"
 }
 
 assert_http_ok() {
   local label="$1" url="$2" code
-  code="$(curl -sS -o /dev/null -w '%{http_code}' "$url")" \
-    || die "${label} check failed: could not reach ${url}"
+  code="$(curl -sS -o /dev/null -w '%{http_code}' "$url")" ||
+    die "${label} check failed: could not reach ${url}"
   [ "$code" = "200" ] || die "${label} check failed: ${url} returned ${code}, not 200"
   log "${label} (${url}): ${code}"
 }
diff --git a/services/mongodb/drivers/flask.sh b/services/mongodb/drivers/flask.sh
index a076a86..d0dbba7 100644
--- a/services/mongodb/drivers/flask.sh
+++ b/services/mongodb/drivers/flask.sh
@@ -16,8 +16,8 @@ service_driver_apply() {
   uv add pymongo || return 1
 
   write_env_lines .env.example \
-    "DATABASE_URL=mongodb://app:app@localhost:27017/app?authSource=admin" \
-    || return 1
+    "DATABASE_URL=mongodb://app:app@localhost:27017/app?authSource=admin" ||
+    return 1
 
   # MongoClient is generic; mypy --strict rejects the bare name, so the
   # parameter names the document type.
@@ -37,7 +37,7 @@ def _client() -> MongoClient[dict[str, Any]]:
   # alembic is SQL-only; this is mongodb's equivalent of it having zero
   # revisions — a real command against the real database, with an empty seam
   # for a client's own indexes.
-  cat > app/migrate.py <<'EOF' || return 1
+  cat >app/migrate.py <<'EOF' || return 1
 from typing import Any
 
 from app.health import _client
@@ -59,6 +59,7 @@ EOF
 }
 
 service_driver_compose_env() {
+  # shellcheck disable=SC2016 # literal ${...} written into compose.yaml, not expanded here
   printf 'DATABASE_URL: ${DATABASE_URL:-mongodb://${DB_USERNAME:-app}:${DB_PASSWORD}@database:27017/${DB_DATABASE:-app}?authSource=admin}\n'
 }
 
diff --git a/services/mongodb/drivers/laravel.sh b/services/mongodb/drivers/laravel.sh
index 6fa72cc..149113a 100644
--- a/services/mongodb/drivers/laravel.sh
+++ b/services/mongodb/drivers/laravel.sh
@@ -18,8 +18,8 @@ service_driver_apply() {
   write_env_lines .env.example \
     "DB_CONNECTION=mongodb" \
     "DB_URI=mongodb://app:app@database:27017/app?authSource=admin" \
-    "DB_DATABASE=app" \
-    || return 1
+    "DB_DATABASE=app" ||
+    return 1
 
   register_mongodb_connection config/database.php
 
@@ -43,9 +43,10 @@ service_driver_apply() {
     routes/health.php || return 1
   rm -f routes/health.php.bak
 
-  grep -q "DB::connection('mongodb')->getMongoDB()->command" routes/health.php \
-    && grep -q "return response()->json(\['status' => 'ok'\]);" routes/health.php \
-    || die "could not splice the database probe into routes/health.php — has the anchor moved?"
+  # shellcheck disable=SC2015 # deliberate: die must fire when either grep fails
+  grep -q "DB::connection('mongodb')->getMongoDB()->command" routes/health.php &&
+    grep -q "return response()->json(\['status' => 'ok'\]);" routes/health.php ||
+    die "could not splice the database probe into routes/health.php — has the anchor moved?"
 }
 
 service_driver_dockerfile() {
@@ -56,6 +57,8 @@ service_driver_dockerfile() {
   # the 2.x extension changed it, so loading those classes is a PHP fatal error,
   # not an exception this project's try/catch can see — a 500 on /health/ready
   # before this pin.
+  # shellcheck disable=SC2016,SC1003 # literal Dockerfile RUN text: $PHPIZE_DEPS and the
+  # trailing backslashes are line continuations in the generated file, not shell escapes
   printf '%s\n' \
     'RUN apk add --no-cache --virtual .build-deps $PHPIZE_DEPS openssl-dev \' \
     ' && pecl install mongodb-1.21.0 \' \
@@ -68,7 +71,9 @@ service_driver_dockerfile() {
 # string, not decomposed credentials.
 service_driver_compose_env() {
   printf 'DB_CONNECTION: mongodb\n'
+  # shellcheck disable=SC2016 # literal ${...} written into compose.yaml, not expanded here
   printf 'DB_URI: ${DB_URI:-mongodb://${DB_USERNAME:-app}:${DB_PASSWORD}@database:27017/${DB_DATABASE:-app}?authSource=admin}\n'
+  # shellcheck disable=SC2016 # literal ${APP_KEY} written into compose.yaml, not expanded here
   printf 'APP_KEY: ${APP_KEY}\n'
 }
 
@@ -93,9 +98,9 @@ register_mongodb_connection() {
   ANCHOR="$anchor" BLOCK="$block" awk '
     { print }
     $0 == ENVIRON["ANCHOR"] { print ENVIRON["BLOCK"] }
-  ' "$file" > "${file}.tmp"
+  ' "$file" >"${file}.tmp"
   mv "${file}.tmp" "$file"
 
-  grep -Fxq "        'mongodb' => [" "$file" \
-    || die "the Laravel skeleton's config/database.php no longer has the expected shape"
+  grep -Fxq "        'mongodb' => [" "$file" ||
+    die "the Laravel skeleton's config/database.php no longer has the expected shape"
 }
diff --git a/services/mongodb/drivers/nest.sh b/services/mongodb/drivers/nest.sh
index 4296ca9..0c601d6 100644
--- a/services/mongodb/drivers/nest.sh
+++ b/services/mongodb/drivers/nest.sh
@@ -11,6 +11,7 @@ PRISMA_PROVIDER="mongodb"
 # directConnection is for prisma's mongodb provider, which otherwise expects a
 # replica set — unproven for anything but `db push` against one node.
 PRISMA_URL="mongodb://app:app@localhost:27017/app?authSource=admin&directConnection=true"
+# shellcheck disable=SC2016 # literal ${...} written into compose.yaml, not expanded here
 PRISMA_COMPOSE_URL='mongodb://${DB_USERNAME:-app}:${DB_PASSWORD}@database:27017/${DB_DATABASE:-app}?authSource=admin&directConnection=true'
 # shellcheck source=/dev/null
 . "${SCAFFOLD_ROOT}/services/shared/nest.sh"
diff --git a/services/mysql/drivers/flask.sh b/services/mysql/drivers/flask.sh
index df7179c..70d8b0d 100644
--- a/services/mysql/drivers/flask.sh
+++ b/services/mysql/drivers/flask.sh
@@ -9,6 +9,7 @@ FLASK_DIALECT="mysql+pymysql"
 # pure python, so no build stage and no system package
 FLASK_PACKAGE="PyMySQL"
 FLASK_PORT="3306"
+# shellcheck disable=SC2016 # literal ${...} written into compose.yaml, not expanded here
 FLASK_COMPOSE_URL='mysql+pymysql://${DB_USERNAME:-app}:${DB_PASSWORD}@database:3306/${DB_DATABASE:-app}'
 # shellcheck source=/dev/null
 . "${SCAFFOLD_ROOT}/services/shared/flask.sh"
diff --git a/services/mysql/drivers/nest.sh b/services/mysql/drivers/nest.sh
index b138dd9..abf72f3 100644
--- a/services/mysql/drivers/nest.sh
+++ b/services/mysql/drivers/nest.sh
@@ -7,6 +7,7 @@
 # shellcheck disable=SC2034 # read by services/shared/nest.sh, sourced below
 PRISMA_PROVIDER="mysql"
 PRISMA_URL="mysql://app:app@localhost:3306/app"
+# shellcheck disable=SC2016 # literal ${...} written into compose.yaml, not expanded here
 PRISMA_COMPOSE_URL='mysql://${DB_USERNAME:-app}:${DB_PASSWORD}@database:3306/${DB_DATABASE:-app}'
 # shellcheck source=/dev/null
 . "${SCAFFOLD_ROOT}/services/shared/nest.sh"
diff --git a/services/postgres/drivers/flask.sh b/services/postgres/drivers/flask.sh
index d9e3805..84560cf 100644
--- a/services/postgres/drivers/flask.sh
+++ b/services/postgres/drivers/flask.sh
@@ -10,6 +10,7 @@ FLASK_DIALECT="postgresql+psycopg"
 # system package and service_driver_dockerfile stays empty
 FLASK_PACKAGE="psycopg[binary]"
 FLASK_PORT="5432"
+# shellcheck disable=SC2016 # literal ${...} written into compose.yaml, not expanded here
 FLASK_COMPOSE_URL='postgresql+psycopg://${DB_USERNAME:-app}:${DB_PASSWORD}@database:5432/${DB_DATABASE:-app}'
 # shellcheck source=/dev/null
 . "${SCAFFOLD_ROOT}/services/shared/flask.sh"
diff --git a/services/postgres/drivers/nest.sh b/services/postgres/drivers/nest.sh
index 9e21696..eb2b559 100644
--- a/services/postgres/drivers/nest.sh
+++ b/services/postgres/drivers/nest.sh
@@ -7,6 +7,7 @@
 # shellcheck disable=SC2034 # read by services/shared/nest.sh, sourced below
 PRISMA_PROVIDER="postgresql"
 PRISMA_URL="postgresql://app:app@localhost:5432/app"
+# shellcheck disable=SC2016 # literal ${...} written into compose.yaml, not expanded here
 PRISMA_COMPOSE_URL='postgresql://${DB_USERNAME:-app}:${DB_PASSWORD}@database:5432/${DB_DATABASE:-app}'
 # shellcheck source=/dev/null
 . "${SCAFFOLD_ROOT}/services/shared/nest.sh"
diff --git a/services/redis/drivers/flask.sh b/services/redis/drivers/flask.sh
index 9a12178..f93b8c5 100644
--- a/services/redis/drivers/flask.sh
+++ b/services/redis/drivers/flask.sh
@@ -12,8 +12,8 @@ service_driver_apply() {
   write_env_lines .env.example \
     "REDIS_HOST=localhost" \
     "REDIS_PORT=6379" \
-    "REDIS_PASSWORD=app" \
-    || return 1
+    "REDIS_PASSWORD=app" ||
+    return 1
 }
 
 service_driver_dockerfile() {
diff --git a/services/redis/drivers/laravel.sh b/services/redis/drivers/laravel.sh
index eba84e4..042fad8 100644
--- a/services/redis/drivers/laravel.sh
+++ b/services/redis/drivers/laravel.sh
@@ -18,8 +18,8 @@ service_driver_apply() {
     "REDIS_PASSWORD=app" \
     "CACHE_STORE=redis" \
     "SESSION_DRIVER=redis" \
-    "QUEUE_CONNECTION=redis" \
-    || return 1
+    "QUEUE_CONNECTION=redis" ||
+    return 1
 }
 
 service_driver_dockerfile() {
diff --git a/services/redis/drivers/nest.sh b/services/redis/drivers/nest.sh
index 81bd2c5..511a608 100644
--- a/services/redis/drivers/nest.sh
+++ b/services/redis/drivers/nest.sh
@@ -21,6 +21,7 @@ service_driver_dockerfile() {
 # REDIS_PASSWORD the cache container reads, so the password lives in exactly
 # one place.
 service_driver_compose_env() {
+  # shellcheck disable=SC2016 # literal ${...} written into compose.yaml, not expanded here
   printf 'REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD}@cache:6379}\n'
 }
 
diff --git a/services/shared/flask.sh b/services/shared/flask.sh
index d6609cb..b0d6469 100644
--- a/services/shared/flask.sh
+++ b/services/shared/flask.sh
@@ -18,8 +18,8 @@ service_driver_apply() {
   uv add sqlalchemy alembic "$FLASK_PACKAGE" || return 1
 
   write_env_lines .env.example \
-    "DATABASE_URL=${FLASK_DIALECT}://app:app@localhost:${FLASK_PORT}/app" \
-    || return 1
+    "DATABASE_URL=${FLASK_DIALECT}://app:app@localhost:${FLASK_PORT}/app" ||
+    return 1
 
   splice_flask_probe \
     'import os
@@ -42,6 +42,7 @@ service_driver_dockerfile() {
 }
 
 service_driver_compose_env() {
+  # shellcheck disable=SC2016 # literal ${DATABASE_URL} written into compose.yaml, not expanded here
   printf 'DATABASE_URL: ${DATABASE_URL:-%s}\n' "$FLASK_COMPOSE_URL"
 }
 
@@ -73,13 +74,14 @@ splice_flask_probe() {
       print "        return jsonify(status=\"ok\")"; next
     }
     { print }
-  ' "$file" > "${file}.tmp" || return 1
+  ' "$file" >"${file}.tmp" || return 1
   mv "${file}.tmp" "$file"
 
-  ! grep -q 'no database is configured for this project' "$file" \
-    && ! grep -q '@DB_ENGINE@' "$file" \
-    && ! grep -q '@DB_PROBE@' "$file" \
-    || die "could not splice the database probe into app/health.py — has the anchor moved?"
+  # shellcheck disable=SC2015 # deliberate: die must fire when any grep fails
+  ! grep -q 'no database is configured for this project' "$file" &&
+    ! grep -q '@DB_ENGINE@' "$file" &&
+    ! grep -q '@DB_PROBE@' "$file" ||
+    die "could not splice the database probe into app/health.py — has the anchor moved?"
 
   # The engine block's stdlib imports land below flask's own import, which
   # ruff's isort rule (I001) and its formatter both reject — reformat once
@@ -105,9 +107,10 @@ init_flask_alembic() {
     migrations/env.py || return 1
   rm -f migrations/env.py.bak
 
-  grep -q '^import os$' migrations/env.py \
-    && grep -q 'config.set_main_option("sqlalchemy.url", os.environ\["DATABASE_URL"\].replace("%", "%%"))' migrations/env.py \
-    || die "could not point alembic at DATABASE_URL — has alembic init's generated env.py changed shape?"
+  # shellcheck disable=SC2015 # deliberate: die must fire when either grep fails
+  grep -q '^import os$' migrations/env.py &&
+    grep -q 'config.set_main_option("sqlalchemy.url", os.environ\["DATABASE_URL"\].replace("%", "%%"))' migrations/env.py ||
+    die "could not point alembic at DATABASE_URL — has alembic init's generated env.py changed shape?"
 
   uv run ruff check --fix migrations/env.py || return 1
   uv run ruff format migrations/env.py || return 1
diff --git a/services/shared/laravel.sh b/services/shared/laravel.sh
index ce928f7..baea1a6 100644
--- a/services/shared/laravel.sh
+++ b/services/shared/laravel.sh
@@ -28,8 +28,8 @@ service_driver_apply() {
     "DB_PORT=${LARAVEL_PORT}" \
     "DB_DATABASE=app" \
     "DB_USERNAME=app" \
-    "DB_PASSWORD=app" \
-    || return 1
+    "DB_PASSWORD=app" ||
+    return 1
 
   # APP_KEY is per-family, not per-service, so no env.fragment can carry it into
   # example.env; unset, compose.yaml's `APP_KEY: ${APP_KEY}` interpolates to
@@ -52,9 +52,10 @@ service_driver_apply() {
     routes/health.php || return 1
   rm -f routes/health.php.bak
 
-  grep -q 'DB::connection()->select' routes/health.php \
-    && grep -q "return response()->json(\['status' => 'ok'\]);" routes/health.php \
-    || die "could not splice the database probe into routes/health.php — has the anchor moved?"
+  # shellcheck disable=SC2015 # deliberate: die must fire when either grep fails
+  grep -q 'DB::connection()->select' routes/health.php &&
+    grep -q "return response()->json(\['status' => 'ok'\]);" routes/health.php ||
+    die "could not splice the database probe into routes/health.php — has the anchor moved?"
 }
 
 service_driver_dockerfile() {
@@ -67,6 +68,7 @@ service_driver_dockerfile() {
 service_driver_compose_env() {
   printf 'DB_CONNECTION: %s\n' "$LARAVEL_CONNECTION"
   printf '%s\n' "$LARAVEL_COMPOSE_ENV"
+  # shellcheck disable=SC2016 # literal ${APP_KEY} written into compose.yaml, not expanded here
   printf 'APP_KEY: ${APP_KEY}\n'
 }
 
diff --git a/services/shared/nest.sh b/services/shared/nest.sh
index fe844eb..98f3f01 100644
--- a/services/shared/nest.sh
+++ b/services/shared/nest.sh
@@ -41,7 +41,7 @@ service_driver_apply() {
 
   # datasource and generator only; models describe the client's domain, which
   # this toolbox does not know.
-  cat > prisma/schema.prisma <<EOF || return 1
+  cat >prisma/schema.prisma <<EOF || return 1
 generator client {
   provider = "prisma-client-js"
 }
@@ -71,6 +71,7 @@ EOF
   # never closed leaks one connection per poll — measured exhausting Postgres's
   # max_connections inside an hour at a 10s probe interval.
   local method field preamble probe
+  # shellcheck disable=SC2016 # literal TypeScript spliced into the generated controller
   case "$PRISMA_PROVIDER" in
     mongodb)
       method='$runCommandRaw(command: object): Promise<unknown>'
@@ -109,11 +110,12 @@ EOF
 assert_nest_probe_spliced() {
   local -r file="$1"
 
-  grep -q "dbClient" "$file" \
-    && grep -q "PrismaClient" "$file" \
-    && grep -q "async ready(): Promise<" "$file" \
-    && ! grep -q "no database is configured for this project" "$file" \
-    || die "could not splice the database probe into ${file} — has the anchor moved?"
+  # shellcheck disable=SC2015 # deliberate: die must fire when any check fails
+  grep -q "dbClient" "$file" &&
+    grep -q "PrismaClient" "$file" &&
+    grep -q "async ready(): Promise<" "$file" &&
+    ! grep -q "no database is configured for this project" "$file" ||
+    die "could not splice the database probe into ${file} — has the anchor moved?"
 }
 
 service_driver_dockerfile() {
@@ -123,6 +125,7 @@ service_driver_dockerfile() {
 # An operator's own .env wins; otherwise compose builds the URL from the same
 # DB_* variables the database container reads.
 service_driver_compose_env() {
+  # shellcheck disable=SC2016 # literal ${DATABASE_URL} written into compose.yaml, not expanded here
   printf 'DATABASE_URL: ${DATABASE_URL:-%s}\n' "$PRISMA_COMPOSE_URL"
 }
 
@@ -143,5 +146,6 @@ service_driver_compose_migrate() {
   esac
   # `$${d}`/`$$d`, not `${d}`/`$d`: compose interpolates `$var` before the
   # command reaches the container; `$$` is compose's escape for a literal `$`.
+  # shellcheck disable=SC2016 # literal shell text written into compose.yaml, not expanded here
   printf 'command: ["sh", "-c", "for d in apps/*/ ./; do [ -x $${d}node_modules/.bin/prisma ] && cd $$d && exec node_modules/.bin/prisma %s; done; echo prisma binary not found >&2; exit 1"]\n' "$args"
 }
diff --git a/tests/.shellcheckrc b/tests/.shellcheckrc
new file mode 100644
index 0000000..8ac3813
--- /dev/null
+++ b/tests/.shellcheckrc
@@ -0,0 +1,5 @@
+# SC2317: shellcheck parses a `.bats` file's `@test "..." { ... }` blocks as
+# one flat script rather than separate functions, so a `return` at the end of
+# one @test marks every @test after it as unreachable — a bats-parsing
+# artefact (tests/wizard.bats), not real dead code.
+disable=SC2317
diff --git a/tests/add-app-errors.bats b/tests/add-app-errors.bats
index 23c812f..39113de 100644
--- a/tests/add-app-errors.bats
+++ b/tests/add-app-errors.bats
@@ -34,7 +34,7 @@ teardown() {
 @test "add refuses a git repo whose mise.toml is not a scaffold root" {
   mkdir -p "$WORKDIR/plain"
   git -C "$WORKDIR/plain" init --initial-branch=main --quiet
-  printf 'monorepo_root = false\n' > "$WORKDIR/plain/mise.toml"
+  printf 'monorepo_root = false\n' >"$WORKDIR/plain/mise.toml"
   cd "$WORKDIR/plain"
   run scaffold add apps/api --adapter nestjs
   [ "$status" -eq 1 ]
@@ -44,7 +44,7 @@ teardown() {
 @test "add refuses a path that already exists, and the existing app survives untouched" {
   scaffold new "$PROJECT"
   mkdir -p "${PROJECT}/apps/api"
-  echo "keep me" > "${PROJECT}/apps/api/marker"
+  echo "keep me" >"${PROJECT}/apps/api/marker"
 
   cd "$PROJECT"
   run scaffold add apps/api --adapter nestjs
@@ -102,7 +102,7 @@ teardown() {
 # success.
 @test "a failure inside cmd_add removes both temporary workspace relaxations" {
   scaffold new "$PROJECT"
-  printf 'packages:\n  - apps/*\n  - packages/*\n  - docs\n' > "${PROJECT}/pnpm-workspace.yaml"
+  printf 'packages:\n  - apps/*\n  - packages/*\n  - docs\n' >"${PROJECT}/pnpm-workspace.yaml"
   cd "$PROJECT"
   run "${SCAFFOLD_ROOT}/tests/fixtures/add-fixtures/scaffold" add apps/worker --adapter broken
   [ "$status" -eq 1 ]
@@ -136,4 +136,3 @@ teardown() {
   [ "$status" -eq 1 ]
   [[ "$output" == *"--db given more than once"* ]]
 }
-
diff --git a/tests/add-app.bats b/tests/add-app.bats
index f6d9705..40bd8c8 100644
--- a/tests/add-app.bats
+++ b/tests/add-app.bats
@@ -71,7 +71,11 @@ teardown() {
   # and it lived inside the reconcile branch only, so a project without a shared
   # workspace kept confirmModulesPurge and frozenLockfile forever.
   run grep -cE 'confirmModulesPurge|frozenLockfile|minimumReleaseAge: 0' "${PROJECT}/pnpm-workspace.yaml"
-  [ "$output" = "0" ] || { echo "left behind:"; grep -nE 'confirmModulesPurge|frozenLockfile|minimumReleaseAge: 0' "${PROJECT}/pnpm-workspace.yaml"; false; }
+  [ "$output" = "0" ] || {
+    echo "left behind:"
+    grep -nE 'confirmModulesPurge|frozenLockfile|minimumReleaseAge: 0' "${PROJECT}/pnpm-workspace.yaml"
+    false
+  }
 }
 
 @test "an app added later is wired to the project's own database" {
diff --git a/tests/cli.bats b/tests/cli.bats
index c14db85..37e7e59 100755
--- a/tests/cli.bats
+++ b/tests/cli.bats
@@ -89,10 +89,16 @@ setup() {
   # it has been once, when the output started being captured — without the
   # guarantee quietly going with it. Neither value may be handed to a shell
   # directly, and the only script that runs either goes through mise exec.
+  # shellcheck disable=SC2016 # literal pattern matched against lib/adapter.sh's source, not expanded
   run grep -nE '(eval|bash -c) "\$ADAPTER_(GENERATOR|POST_GENERATE)"' "${SCAFFOLD_ROOT}/lib/adapter.sh"
-  [ -z "$output" ] \
-    || { echo "a generator is run outside the project's toolchain:"; echo "$output"; false; }
-
+  [ -z "$output" ] ||
+    {
+      echo "a generator is run outside the project's toolchain:"
+      echo "$output"
+      false
+    }
+
+  # shellcheck disable=SC2016 # literal pattern matched against lib/adapter.sh's source, not expanded
   run grep -c 'mise exec -- bash -c "\$2"' "${SCAFFOLD_ROOT}/lib/adapter.sh"
   assert_ok
   [ "$output" -eq 1 ]
@@ -168,7 +174,7 @@ setup() {
   local outside="${BATS_TEST_TMPDIR}/outside"
   mkdir -p "${outside}/evil"
   printf 'ADAPTER_NAME=evil\nADAPTER_ROLE=api\nADAPTER_GENERATOR=true\ntouch %s/SOURCED\n' \
-    "$outside" > "${outside}/evil/adapter.env"
+    "$outside" >"${outside}/evil/adapter.env"
 
   local traversal
   traversal="$(realpath --relative-to="${SCAFFOLD_ROOT}/adapters" "${outside}/evil")"
@@ -186,8 +192,12 @@ setup() {
   # branch.
   run "${SCAFFOLD_ROOT}/tests/fixtures/broken-adapters/scaffold" list
   # the intact adapter must still be listed, whatever it calls itself
-  [[ "$output" == *$'\t'"api"$'\t'* ]] \
-    || { echo "no intact adapter survived the listing:"; echo "$output"; false; }
+  [[ "$output" == *$'\t'"api"$'\t'* ]] ||
+    {
+      echo "no intact adapter survived the listing:"
+      echo "$output"
+      false
+    }
 }
 
 @test "scaffold list reports a malformed service and continues" {
@@ -227,6 +237,10 @@ setup() {
   # new template beside them would be dropped by `git add -A` without a word.
   run git -C "$SCAFFOLD_ROOT" ls-files -i -c --exclude-standard
   assert_ok
-  [ -z "$output" ] \
-    || { echo "these ship but .gitignore matches them:"; echo "$output"; false; }
+  [ -z "$output" ] ||
+    {
+      echo "these ship but .gitignore matches them:"
+      echo "$output"
+      false
+    }
 }
diff --git a/tests/compose.bats b/tests/compose.bats
index e600abd..ce11d3e 100644
--- a/tests/compose.bats
+++ b/tests/compose.bats
@@ -18,6 +18,7 @@ teardown() {
 }
 
 @test "the application image tag is parameterised" {
+  # shellcheck disable=SC2016 # literal pattern matched against compose.yaml, not expanded
   run grep 'image:.*\${IMAGE_TAG' "${PROJECT}/compose.yaml"
   assert_ok
 }
@@ -36,8 +37,11 @@ teardown() {
   local images want_repo
   images="$(yq -r '[.jobs[] | select(has("with")) | .with.images] | .[0]' \
     "${PROJECT}/.github/workflows/build.yml")"
-  [ "$(jq 'length' <<<"$images")" -gt 0 ] \
-    || { echo "build.yml publishes no image at all"; false; }
+  [ "$(jq 'length' <<<"$images")" -gt 0 ] ||
+    {
+      echo "build.yml publishes no image at all"
+      false
+    }
 
   local want_image service actual
   while IFS= read -r want_image; do
@@ -57,8 +61,11 @@ teardown() {
   # naming one of its own.
   actual="$(yq '.services.migrate.image // ""' "${PROJECT}/compose.yaml")"
   if [ -n "$actual" ] && [ "$actual" != null ]; then
-    jq -e --arg image "${actual%%:*}" 'any(.[]; .image == $image)' <<<"$images" >/dev/null \
-      || { echo "migrate runs ${actual}, which no build target publishes"; false; }
+    jq -e --arg image "${actual%%:*}" 'any(.[]; .image == $image)' <<<"$images" >/dev/null ||
+      {
+        echo "migrate runs ${actual}, which no build target publishes"
+        false
+      }
   fi
 
   want_repo="$(jq -r '.[0].image' <<<"$images")"
@@ -73,7 +80,10 @@ teardown() {
 
   # A placeholder anywhere in either file means the substitution was skipped.
   run bash -c "grep -l 'CHANGEME\|@PROJECT_NAME@\|ghcr.io/you/' '${PROJECT}/compose.yaml'"
-  [ -z "$output" ] || { echo "compose.yaml still carries a placeholder"; false; }
+  [ -z "$output" ] || {
+    echo "compose.yaml still carries a placeholder"
+    false
+  }
 }
 
 @test "third-party images are pinned by digest" {
@@ -98,7 +108,11 @@ teardown() {
   # tomorrow. Nothing enforced the second half. Dockerfile* also catches the
   # typescript adapters' workspace-shape Dockerfile.workspace.
   run bash -c "grep -h '^FROM' '${SCAFFOLD_ROOT}'/adapters/*/Dockerfile* | grep -v '@sha256:'"
-  [ -z "$output" ] || { echo "unpinned base images:"; echo "$output"; false; }
+  [ -z "$output" ] || {
+    echo "unpinned base images:"
+    echo "$output"
+    false
+  }
 }
 
 @test "every adapter ships a dockerignore" {
@@ -106,8 +120,11 @@ teardown() {
   # password — into any image built locally. For nextjs it also lets a host
   # node_modules overwrite the one copied from the pinned build stage.
   for adapter in "${SCAFFOLD_ROOT}"/adapters/*/; do
-    [ -f "${adapter}.dockerignore" ] \
-      || { echo "no .dockerignore in ${adapter}"; false; }
+    [ -f "${adapter}.dockerignore" ] ||
+      {
+        echo "no .dockerignore in ${adapter}"
+        false
+      }
   done
 }
 
@@ -116,7 +133,7 @@ teardown() {
   # cache as well as a database left REDIS_PASSWORD on the literal default
   # and nothing said so.
   cd "$PROJECT"
-  cat > env.fixture <<'INNER_EOF'
+  cat >env.fixture <<'INNER_EOF'
 DB_PASSWORD=changeme
 REDIS_PASSWORD=changeme
 APP_PORT=8080
@@ -133,7 +150,7 @@ INNER_EOF
   # differently (RABBITMQ_DEFAULT_PASS) got no generated value under the old
   # ^[A-Z_]*_PASSWORD=changeme$ pattern, and tripped no check either.
   cd "$PROJECT"
-  cat > env.fixture2 <<'INNER_EOF'
+  cat >env.fixture2 <<'INNER_EOF'
 RABBITMQ_DEFAULT_PASS=changeme
 APP_PORT=8080
 INNER_EOF
@@ -149,7 +166,7 @@ INNER_EOF
   # `set -o nounset` used to kill the script before the source guard even ran.
   mkdir -p "${WORKDIR}/piped"
   cd "${WORKDIR}/piped"
-  run bash < "${PROJECT}/install.sh"
+  run bash <"${PROJECT}/install.sh"
   [ "$status" -ne 0 ]
   [[ "$output" != *"unbound variable"* ]]
   [[ "$output" == *"could not download the release assets"* ]]
@@ -185,16 +202,28 @@ INNER_EOF
   local images
   images="$(yq -r '[.jobs[] | select(has("with")) | .with.images] | .[0]' \
     "${ts}/.github/workflows/build.yml")"
-  [ "$(jq 'length' <<<"$images")" -eq 2 ] \
-    || { echo "expected two build targets, got: ${images}"; false; }
+  [ "$(jq 'length' <<<"$images")" -eq 2 ] ||
+    {
+      echo "expected two build targets, got: ${images}"
+      false
+    }
 
   local context dockerfile manifest
   while IFS=$'\t' read -r context dockerfile; do
-    [ "$context" = "." ] || { echo "${dockerfile} builds from '${context}', not the workspace root"; false; }
-    [ -f "${ts}/${dockerfile}" ] || { echo "no Dockerfile at ${dockerfile}"; false; }
+    [ "$context" = "." ] || {
+      echo "${dockerfile} builds from '${context}', not the workspace root"
+      false
+    }
+    [ -f "${ts}/${dockerfile}" ] || {
+      echo "no Dockerfile at ${dockerfile}"
+      false
+    }
     for manifest in package.json pnpm-lock.yaml pnpm-workspace.yaml; do
-      [ -f "${ts}/${context}/${manifest}" ] \
-        || { echo "missing ${manifest} at context '${context}', named by ${dockerfile}"; false; }
+      [ -f "${ts}/${context}/${manifest}" ] ||
+        {
+          echo "missing ${manifest} at context '${context}', named by ${dockerfile}"
+          false
+        }
     done
   done < <(jq -r '.[] | [.context, .dockerfile] | @tsv' <<<"$images")
 }
@@ -211,13 +240,19 @@ INNER_EOF
     "${mixed}/.github/workflows/build.yml")"
   context="$(jq -r '.[] | select(.dockerfile == "apps/web/Dockerfile") | .context' <<<"$images")"
   dockerfile="apps/web/Dockerfile"
-  [ "$context" = "apps/web" ] \
-    || { echo "apps/web builds from '${context}', not its own directory"; false; }
+  [ "$context" = "apps/web" ] ||
+    {
+      echo "apps/web builds from '${context}', not its own directory"
+      false
+    }
   [ -f "${mixed}/${dockerfile}" ]
 
   for manifest in package.json pnpm-lock.yaml pnpm-workspace.yaml; do
-    [ -f "${mixed}/${context}/${manifest}" ] \
-      || { echo "missing ${manifest} at context '${context}', named by ${dockerfile}"; false; }
+    [ -f "${mixed}/${context}/${manifest}" ] ||
+      {
+        echo "missing ${manifest} at context '${context}', named by ${dockerfile}"
+        false
+      }
   done
 }
 
@@ -225,12 +260,20 @@ INNER_EOF
   # add_app_service publishes ${<NAME>_PORT:-<allocated>}:8080 for every
   # application, so an adapter exposing anything else publishes a dead port.
   run bash -c "grep -L '^EXPOSE 8080\$' '${SCAFFOLD_ROOT}'/adapters/*/Dockerfile*"
-  [ -z "$output" ] || { echo "not exposing 8080:"; echo "$output"; false; }
+  [ -z "$output" ] || {
+    echo "not exposing 8080:"
+    echo "$output"
+    false
+  }
 
   # The container side of every published port, asserted against a real
   # project rather than the template it came from.
   run bash -c "yq -r '.services[].ports[]? | select(test(\":8080\$\") | not)' '${PROJECT}/compose.yaml'"
-  [ -z "$output" ] || { echo "publishing to a port no adapter serves:"; echo "$output"; false; }
+  [ -z "$output" ] || {
+    echo "publishing to a port no adapter serves:"
+    echo "$output"
+    false
+  }
 }
 
 @test "every adapter Dockerfile probes the liveness path its adapter declares" {
@@ -241,19 +284,25 @@ INNER_EOF
     path="$(grep '^ADAPTER_LIVENESS_PATH=' "${dir}adapter.env" | cut -d'"' -f2)"
     for file in "${dir}"Dockerfile "${dir}"Dockerfile.workspace; do
       [ -f "$file" ] || continue
-      grep -q '^HEALTHCHECK' "$file" \
-        || { wrong="${wrong}${file}: no HEALTHCHECK"$'\n'; continue; }
+      grep -q '^HEALTHCHECK' "$file" ||
+        {
+          wrong="${wrong}${file}: no HEALTHCHECK"$'\n'
+          continue
+        }
       # localhost or 127.0.0.1: nextjs's HEALTHCHECK dials 127.0.0.1 because
       # this image's resolver hands "localhost" the IPv6 ::1 first and the
       # IPv4-only listener (forced by ENV HOSTNAME="0.0.0.0", the fix for
       # standalone server.js otherwise binding to the container's own id)
       # refuses it — see adapters/nextjs/Dockerfile. Either host still
       # proves the adapter's declared path is the one actually probed.
-      grep -Eq "(localhost|127\.0\.0\.1):8080${path}" "$file" \
-        || wrong="${wrong}${file}: does not probe ${path} on 8080"$'\n'
+      grep -Eq "(localhost|127\.0\.0\.1):8080${path}" "$file" ||
+        wrong="${wrong}${file}: does not probe ${path} on 8080"$'\n'
     done
   done
-  [ -z "$wrong" ] || { echo "$wrong"; false; }
+  [ -z "$wrong" ] || {
+    echo "$wrong"
+    false
+  }
 }
 
 @test "install.sh generates an APP_KEY laravel will accept" {
@@ -261,11 +310,14 @@ INNER_EOF
   # "Unsupported cipher or incorrect key length" — laravel needs base64: and
   # exactly 32 bytes.
   local env_file="${BATS_TEST_TMPDIR}/.env"
-  printf 'DB_PASSWORD=changeme\nAPP_KEY=changeme\n' > "$env_file"
+  printf 'DB_PASSWORD=changeme\nAPP_KEY=changeme\n' >"$env_file"
   . "${SCAFFOLD_ROOT}/common/install.sh"
   run generate_service_passwords "$env_file"
   assert_ok
   run grep '^APP_KEY=' "$env_file"
-  [[ "$output" =~ ^APP_KEY=base64:[A-Za-z0-9+/]{43}=$ ]] \
-    || { echo "not a laravel key: ${output}"; false; }
+  [[ "$output" =~ ^APP_KEY=base64:[A-Za-z0-9+/]{43}=$ ]] ||
+    {
+      echo "not a laravel key: ${output}"
+      false
+    }
 }
diff --git a/tests/contract.bats b/tests/contract.bats
index 4a2905f..e513858 100644
--- a/tests/contract.bats
+++ b/tests/contract.bats
@@ -47,7 +47,7 @@ setup() {
   # existed to fix elsewhere. this greps the claim instead of trusting it.
   local run_line files f
   run_line="$(awk '/^\[tasks\."test-unit"\]/{f=1} f && /^run = /{print; exit}' "${SCAFFOLD_ROOT}/mise.toml")"
-  files="$(grep -oE 'tests/[A-Za-z0-9_-]+\.bats' <<< "$run_line")"
+  files="$(grep -oE 'tests/[A-Za-z0-9_-]+\.bats' <<<"$run_line")"
   [ -n "$files" ]
   # The whole file, not just setup(): a generator call in a test body costs the
   # lane the same, and one added here reached CI before anyone noticed the lane
@@ -206,16 +206,23 @@ setup() {
   # running without anyone editing the thing that stopped it.
   adapters="$(cat "${SCAFFOLD_ROOT}/.github/workflows/adapters.yml")"
   provenance="$(cat "${SCAFFOLD_ROOT}/.github/workflows/provenance.yml")"
-  [[ "$adapters" == *'bats "tests/new-${ADAPTER}.bats"'* ]] \
-    || { echo "adapters.yml no longer runs tests/new-<adapter>.bats"; false; }
-  [[ "$provenance" == *"bats tests/provenance.bats"* ]] \
-    || { echo "provenance.yml no longer runs tests/provenance.bats"; false; }
+  # shellcheck disable=SC2016 # literal text matched against adapters.yml, not expanded
+  [[ "$adapters" == *'bats "tests/new-${ADAPTER}.bats"'* ]] ||
+    {
+      echo "adapters.yml no longer runs tests/new-<adapter>.bats"
+      false
+    }
+  [[ "$provenance" == *"bats tests/provenance.bats"* ]] ||
+    {
+      echo "provenance.yml no longer runs tests/provenance.bats"
+      false
+    }
 
   for suite in "${SCAFFOLD_ROOT}"/tests/*.bats; do
     name="tests/$(basename "$suite")"
     case "$name" in
-      tests/new-*.bats) continue ;;       # adapters.yml, per-adapter matrix
-      tests/provenance.bats) continue ;;  # provenance.yml, needs an upstream clone
+      tests/new-*.bats) continue ;;      # adapters.yml, per-adapter matrix
+      tests/provenance.bats) continue ;; # provenance.yml, needs an upstream clone
     esac
     case "${unit}${integration}" in
       *"$name"*) ;;
@@ -233,10 +240,14 @@ setup() {
 @test "every adapter declares a liveness path" {
   local missing=""
   for dir in "${SCAFFOLD_ROOT}"/adapters/*/; do
-    grep -q '^ADAPTER_LIVENESS_PATH=' "${dir}adapter.env" \
-      || missing="${missing}$(basename "$dir")"$'\n'
+    grep -q '^ADAPTER_LIVENESS_PATH=' "${dir}adapter.env" ||
+      missing="${missing}$(basename "$dir")"$'\n'
   done
-  [ -z "$missing" ] || { echo "missing ADAPTER_LIVENESS_PATH:"; echo "$missing"; false; }
+  [ -z "$missing" ] || {
+    echo "missing ADAPTER_LIVENESS_PATH:"
+    echo "$missing"
+    false
+  }
 }
 
 @test "an adapter whose role takes a driver declares a readiness path" {
@@ -247,10 +258,14 @@ setup() {
   for dir in "${SCAFFOLD_ROOT}"/adapters/*/; do
     role="$(grep '^ADAPTER_ROLE=' "${dir}adapter.env" | cut -d'"' -f2)"
     case " ${DRIVEN_ROLES[*]} " in *" ${role} "*) ;; *) continue ;; esac
-    grep -q '^ADAPTER_READINESS_PATH=' "${dir}adapter.env" \
-      || missing="${missing}$(basename "$dir")"$'\n'
+    grep -q '^ADAPTER_READINESS_PATH=' "${dir}adapter.env" ||
+      missing="${missing}$(basename "$dir")"$'\n'
   done
-  [ -z "$missing" ] || { echo "missing ADAPTER_READINESS_PATH:"; echo "$missing"; false; }
+  [ -z "$missing" ] || {
+    echo "missing ADAPTER_READINESS_PATH:"
+    echo "$missing"
+    false
+  }
 }
 
 @test "every caller of scaffold new supplies the environment it demands" {
@@ -272,7 +287,7 @@ setup() {
   local file hits=0
   while IFS= read -r file; do
     grep -qE '(\./)?scaffold new ' "$file" || continue
-    hits=$(( hits + 1 ))
+    hits=$((hits + 1))
     grep -q 'SCAFFOLD_GITHUB_OWNER' "$file" || {
       echo "${file} calls 'scaffold new' but never supplies SCAFFOLD_GITHUB_OWNER;"
       echo "it will fail on any machine without 'gh auth login' or git's github.user."
@@ -284,5 +299,8 @@ setup() {
   # exists to refuse elsewhere. Assert the search found the call sites it is
   # written against; a rename that moves them out of this glob fails here
   # rather than silently checking nothing.
-  [ "$hits" -eq 2 ] || { echo "expected 2 callers of 'scaffold new', found ${hits}"; false; }
+  [ "$hits" -eq 2 ] || {
+    echo "expected 2 callers of 'scaffold new', found ${hits}"
+    false
+  }
 }
diff --git a/tests/docs.bats b/tests/docs.bats
index f14373c..9726fe5 100644
--- a/tests/docs.bats
+++ b/tests/docs.bats
@@ -25,7 +25,8 @@ teardown() {
 }
 
 @test "the path check fails on a path that does not exist" {
-  echo 'See `docs/nope-does-not-exist.md`.' >> "${PROJECT}/docs/index.md"
+  # shellcheck disable=SC2016 # literal markdown backticks written into index.md, not expanded
+  echo 'See `docs/nope-does-not-exist.md`.' >>"${PROJECT}/docs/index.md"
   cd "${PROJECT}/docs"
   run node scripts/check-paths.mjs
   [ "$status" -eq 1 ]
@@ -33,7 +34,7 @@ teardown() {
 }
 
 @test "the path check fails on an adr citation that does not ship" {
-  echo '# see docs/decisions/0014-deployment-deferred-with-seams.md' >> "${PROJECT}/compose.yaml"
+  echo '# see docs/decisions/0014-deployment-deferred-with-seams.md' >>"${PROJECT}/compose.yaml"
   cd "${PROJECT}/docs"
   run node scripts/check-paths.mjs
   [ "$status" -eq 1 ]
@@ -41,14 +42,14 @@ teardown() {
 }
 
 @test "the path check accepts an adr citation that does ship" {
-  echo '# see docs/decisions/0000 for the rule' >> "${PROJECT}/compose.yaml"
+  echo '# see docs/decisions/0000 for the rule' >>"${PROJECT}/compose.yaml"
   cd "${PROJECT}/docs"
   run node scripts/check-paths.mjs
   assert_ok
 }
 
 @test "the adr check rejects an adr missing a required section" {
-  cat > "${PROJECT}/docs/decisions/0001-broken.md" <<'EOF'
+  cat >"${PROJECT}/docs/decisions/0001-broken.md" <<'EOF'
 # 0001 — Broken
 
 Status: Accepted
@@ -65,11 +66,11 @@ EOF
 
 @test "the path check ignores a generated app's own generator-owned markdown" {
   mkdir -p "${PROJECT}/apps/web"
-  cat > "${PROJECT}/apps/web/AGENTS.md" <<'EOF'
+  cat >"${PROJECT}/apps/web/AGENTS.md" <<'EOF'
 See `node_modules/next/dist/server/lib/generate-agent-files.js`.
 This block is written and re-added by `next dev`.
 EOF
-  cat > "${PROJECT}/apps/web/README.md" <<'EOF'
+  cat >"${PROJECT}/apps/web/README.md" <<'EOF'
 Edit `app/page.tsx`. Fonts are loaded with `next/font`.
 EOF
   cd "${PROJECT}/docs"
@@ -95,7 +96,10 @@ EOF
 @test "the vendored theme ships whole: css, licence, notice and logo" {
   local vendor="${PROJECT}/docs/.vitepress/theme/vendor/escrcpy" file
   for file in LICENSE NOTICE rainbow.css vars.css; do
-    [ -f "${vendor}/${file}" ] || { echo "missing: vendor/escrcpy/${file}"; false; }
+    [ -f "${vendor}/${file}" ] || {
+      echo "missing: vendor/escrcpy/${file}"
+      false
+    }
   done
   [ -f "${PROJECT}/docs/public/logo.png" ]
   # reformatting the copy would make it a modified file under section 4(b);
@@ -133,7 +137,7 @@ EOF
 }
 
 @test "the docs build fails on a dead link" {
-  echo '[nowhere](/nowhere)' >> "${PROJECT}/docs/index.md"
+  echo '[nowhere](/nowhere)' >>"${PROJECT}/docs/index.md"
   cd "$PROJECT"
   run mise run //docs:build
   [ "$status" -ne 0 ]
@@ -141,14 +145,15 @@ EOF
 }
 
 @test "a broken path surfaces as a failing docs:check" {
-  echo 'See `docs/nope-does-not-exist.md`.' >> "${PROJECT}/docs/index.md"
+  # shellcheck disable=SC2016 # literal markdown backticks written into index.md, not expanded
+  echo 'See `docs/nope-does-not-exist.md`.' >>"${PROJECT}/docs/index.md"
   cd "$PROJECT"
   run mise run //docs:check
   [ "$status" -ne 0 ]
 }
 
 @test "a broken adr surfaces as a failing docs:check" {
-  cat > "${PROJECT}/docs/decisions/0001-broken.md" <<'EOF'
+  cat >"${PROJECT}/docs/decisions/0001-broken.md" <<'EOF'
 # 0001 — Broken
 
 Status: Accepted
diff --git a/tests/documentation.bats b/tests/documentation.bats
index 74c935b..f89f0a7 100644
--- a/tests/documentation.bats
+++ b/tests/documentation.bats
@@ -28,7 +28,7 @@ setup() {
 }
 
 @test "add-an-adapter fits on one page" {
-  run wc -l < "${SCAFFOLD_ROOT}/docs/runbook/add-an-adapter.md"
+  run wc -l <"${SCAFFOLD_ROOT}/docs/runbook/add-an-adapter.md"
   [ "$output" -le 120 ]
 }
 
diff --git a/tests/helpers/setup.bash b/tests/helpers/setup.bash
index b05a4f6..f4b9e64 100644
--- a/tests/helpers/setup.bash
+++ b/tests/helpers/setup.bash
@@ -43,6 +43,7 @@ fi
 # bats' `run` captures the output, so a bare `[ "$status" -eq 0 ]` reports the
 # line that failed and nothing about why.
 assert_ok() {
+  # shellcheck disable=SC2154 # status/output set by bats' run in the calling test
   [ "$status" -eq 0 ] || {
     echo "exit status ${status}; command output follows:"
     echo "$output"
@@ -60,8 +61,8 @@ copy_toolbox() {
   local dest="${BATS_TEST_TMPDIR}/toolbox"
   mkdir -p "$dest"
   cp -R "${SCAFFOLD_ROOT}/adapters" "${SCAFFOLD_ROOT}/lib" \
-        "${SCAFFOLD_ROOT}/scripts" "${SCAFFOLD_ROOT}/common" \
-        "${SCAFFOLD_ROOT}/scaffold" "$dest/"
+    "${SCAFFOLD_ROOT}/scripts" "${SCAFFOLD_ROOT}/common" \
+    "${SCAFFOLD_ROOT}/scaffold" "$dest/"
   cp "${SCAFFOLD_ROOT}/UPSTREAM" "$dest/" 2>/dev/null || true
   mkdir -p "$dest/docs"
   cp "${SCAFFOLD_ROOT}/docs/PROVENANCE.md" "$dest/docs/" 2>/dev/null || true
diff --git a/tests/install.bats b/tests/install.bats
index 1fc41ac..673c779 100644
--- a/tests/install.bats
+++ b/tests/install.bats
@@ -6,7 +6,7 @@
 setup() {
   load 'helpers/setup'
   source "${SCAFFOLD_ROOT}/common/install.sh"
-  cd "$BATS_TEST_TMPDIR"
+  cd "$BATS_TEST_TMPDIR" || exit 1
 }
 
 @test "release_asset_id picks the asset's own id, not the uploader's" {
@@ -17,7 +17,7 @@ setup() {
   # this fixture exists to catch. A grep for the name that then takes the
   # next id yields 41898282 for every asset — a valid object that downloads
   # something else entirely, with no error anywhere.
-  cat > release.fixture.json <<'INNER_EOF'
+  cat >release.fixture.json <<'INNER_EOF'
 {
   "tag_name": "v0.2.1",
   "assets": [
@@ -34,16 +34,16 @@ setup() {
   ]
 }
 INNER_EOF
-  run release_asset_id example.env < release.fixture.json
+  run release_asset_id example.env <release.fixture.json
   assert_ok
   [ "$output" = "548466513" ]
 }
 
 @test "release_asset_id fails when the release has no such asset" {
-  cat > release.empty.json <<'INNER_EOF'
+  cat >release.empty.json <<'INNER_EOF'
 { "tag_name": "v0.2.1", "assets": [] }
 INNER_EOF
-  run release_asset_id compose.yaml < release.empty.json
+  run release_asset_id compose.yaml <release.empty.json
   [ "$status" -ne 0 ]
   [[ "$output" == *"compose.yaml"* ]]
 }
@@ -54,7 +54,7 @@ INNER_EOF
   # what would catch a fetch that called both and quietly required a token
   # for every public client.
   mkdir -p stub
-  cat > stub/curl <<'INNER_EOF'
+  cat >stub/curl <<'INNER_EOF'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >> "${CURL_LOG}"
 INNER_EOF
@@ -71,7 +71,7 @@ INNER_EOF
   # A Bearer token on the browser URL returns 404 for a private repository —
   # measured 2026-09-07 — so the endpoint has to change, not just the headers.
   mkdir -p stub2
-  cat > stub2/curl <<'INNER_EOF'
+  cat >stub2/curl <<'INNER_EOF'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >> "${CURL_LOG}"
 case "$*" in
@@ -116,7 +116,7 @@ INNER_EOF
   # 2026-09-07. A public client pulling a public image must never be asked
   # to authenticate, so the no-token half here must see no login at all.
   mkdir -p stub3
-  cat > stub3/docker <<'INNER_EOF'
+  cat >stub3/docker <<'INNER_EOF'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >> "${DOCKER_LOG}"
 INNER_EOF
@@ -128,8 +128,11 @@ INNER_EOF
   # never did, d1.log does not exist, `cat` fails, and a bare `!= *login*`
   # against its error message passes while start_stack talked to a real
   # docker. Asserting what the stub did record is what closes that.
-  [ -f d1.log ] \
-    || { echo "the docker stub never ran — start_stack reached a real docker"; false; }
+  [ -f d1.log ] ||
+    {
+      echo "the docker stub never ran — start_stack reached a real docker"
+      false
+    }
   run cat d1.log
   [[ "$output" == *"compose up"* ]]
   [[ "$output" != *"login"* ]]
@@ -151,7 +154,7 @@ INNER_EOF
   # "no such release" rather than "you are not signed in" — see the comment
   # on fetch_release_asset for the private-repository measurement behind it.
   mkdir -p stub4
-  cat > stub4/curl <<'INNER_EOF'
+  cat >stub4/curl <<'INNER_EOF'
 #!/usr/bin/env bash
 exit 22
 INNER_EOF
@@ -167,7 +170,7 @@ INNER_EOF
   # hint above must not also appear, or an operator who already set
   # GITHUB_TOKEN is told to do what they already did.
   mkdir -p stub5
-  cat > stub5/curl <<'INNER_EOF'
+  cat >stub5/curl <<'INNER_EOF'
 #!/usr/bin/env bash
 case "$*" in
   *releases/latest*) printf '{"assets":[{"id":42,"name":"compose.yaml"}]}' ;;
@@ -189,7 +192,7 @@ INNER_EOF
   # failed — so the stack refused to migrate, at random, naming a service that
   # was there. The stub keeps writing past the match to make that deterministic.
   mkdir -p stub6
-  cat > stub6/docker <<'INNER_EOF'
+  cat >stub6/docker <<'INNER_EOF'
 #!/usr/bin/env bash
 case "$*" in
   *"config --services"*)
@@ -207,8 +210,11 @@ INNER_EOF
   assert_ok
   [[ "$output" == *"running migrations"* ]]
 
-  [ -f d6.log ] \
-    || { echo "the docker stub never ran the migration"; false; }
+  [ -f d6.log ] ||
+    {
+      echo "the docker stub never ran the migration"
+      false
+    }
   run cat d6.log
   [[ "$output" == *"run --rm migrate"* ]]
 }
diff --git a/tests/new-laravel-api.bats b/tests/new-laravel-api.bats
index 431847c..0ea5295 100644
--- a/tests/new-laravel-api.bats
+++ b/tests/new-laravel-api.bats
@@ -118,7 +118,11 @@ teardown() {
   assert_ok
   local hooks
   hooks="$(printf '%s\n' "$output" | grep -c pint)"
-  [ "$hooks" -eq 2 ] || { echo "expected 2 pint hooks, found ${hooks}:"; echo "$output"; false; }
+  [ "$hooks" -eq 2 ] || {
+    echo "expected 2 pint hooks, found ${hooks}:"
+    echo "$output"
+    false
+  }
 }
 
 @test "a php-only project still ships the build policy" {
diff --git a/tests/new-project.bats b/tests/new-project.bats
index 57199fe..912d7d6 100644
--- a/tests/new-project.bats
+++ b/tests/new-project.bats
@@ -53,9 +53,16 @@ teardown() {
   # never appeared at all.
   run scaffold new "$PROJECT"
   assert_ok
-  [[ "$output" == *"→ "* ]] || { echo "no step lines:"; echo "$output"; false; }
-  [[ "$output" != *"Progress: resolved"* ]] \
-    || { echo "package manager output reached the terminal"; false; }
+  [[ "$output" == *"→ "* ]] || {
+    echo "no step lines:"
+    echo "$output"
+    false
+  }
+  [[ "$output" != *"Progress: resolved"* ]] ||
+    {
+      echo "package manager output reached the terminal"
+      false
+    }
   # And says what to do with what it just made.
   [[ "$output" == *"next:"* ]]
   [[ "$output" == *"scaffold publish"* ]]
@@ -156,7 +163,7 @@ teardown() {
 # directory's config it did not create (mise trust -a walks parents too).
 @test "new does not trust a parent config it did not create" {
   printf 'monorepo_root = true\n\n[monorepo]\nconfig_roots = [\n  "x",\n]\n' \
-    > "${WORKDIR}/mise.toml"
+    >"${WORKDIR}/mise.toml"
   # No skip guard. There used to be one, for the true reason that `CI=true`
   # makes mise trust every config it finds — but its only two outcomes were
   # "skipped on a runner" and "failed everywhere else", so the property was
@@ -165,14 +172,20 @@ teardown() {
   # from the run below, so the precondition holds in both environments.
   run env -u CI -u MISE_YES -u GITHUB_ACTIONS mise trust --show -C "$WORKDIR"
   [[ "$output" == *"${WORKDIR}: untrusted"* ]] || {
-    echo "precondition failed; trust --show reported:"; echo "$output"; false
+    echo "precondition failed; trust --show reported:"
+    echo "$output"
+    false
   }
 
   env -u CI -u MISE_YES -u GITHUB_ACTIONS scaffold new "$PROJECT"
 
   run env -u CI -u MISE_YES -u GITHUB_ACTIONS mise trust --show -C "$PROJECT"
-  [[ "$output" == *"${WORKDIR}: untrusted"* ]] \
-    || { echo "trust --show reported:"; echo "$output"; false; }
+  [[ "$output" == *"${WORKDIR}: untrusted"* ]] ||
+    {
+      echo "trust --show reported:"
+      echo "$output"
+      false
+    }
   [[ "$output" == *"${PROJECT}: trusted"* ]]
 }
 
@@ -196,7 +209,7 @@ teardown() {
 # a rejected `new` untouched, contents included.
 @test "a pre-existing target survives a rejected new" {
   mkdir -p "$PROJECT"
-  echo "keep me" > "${PROJECT}/marker"
+  echo "keep me" >"${PROJECT}/marker"
 
   run "${SCAFFOLD_ROOT}/tests/fixtures/no-common/scaffold" new "$PROJECT"
   [ "$status" -eq 1 ]
@@ -245,14 +258,21 @@ collect_roots() {
   # maintainer listed there. GitHub treats an unresolvable owner as a syntax
   # error, so the security contact was a name that cannot receive anything.
   run grep -rn '@you\b\|you/' "$PROJECT" --include='*.yml' --include='*.md' --include='CODEOWNERS'
-  [ -z "$output" ] || { echo "placeholder left in:"; echo "$output"; false; }
+  [ -z "$output" ] || {
+    echo "placeholder left in:"
+    echo "$output"
+    false
+  }
 
   # Absence of the placeholder is not presence of the owner: a hardcoded or
   # mistyped account passes the grep above. tests/helpers/setup.bash exports
   # SCAFFOLD_GITHUB_OWNER=test-owner.
   run cat "${PROJECT}/CODEOWNERS"
-  [ "$output" = "* @test-owner" ] \
-    || { echo "CODEOWNERS says '${output}', not the account this run resolved"; false; }
+  [ "$output" = "* @test-owner" ] ||
+    {
+      echo "CODEOWNERS says '${output}', not the account this run resolved"
+      false
+    }
 }
 
 @test "no @PROJECT_ placeholder survives into the generated project" {
@@ -264,7 +284,11 @@ collect_roots() {
   # second copy that goes stale.
   run grep -rn --exclude-dir=node_modules --exclude-dir=.git \
     '@PROJECT_NAME@\|@PROJECT_TITLE@' "$PROJECT"
-  [ -z "$output" ] || { echo "placeholder left in:"; echo "$output"; false; }
+  [ -z "$output" ] || {
+    echo "placeholder left in:"
+    echo "$output"
+    false
+  }
 }
 
 @test "register_config_root fails loudly when it cannot find its anchor" {
@@ -276,7 +300,7 @@ collect_roots() {
   local p="${WORKDIR}/reformatted"
   mkdir -p "$p"
   printf 'monorepo_root = true\n\n[monorepo]\nconfig_roots = ["docs"]\n\n[tasks.checklist]\nrun = [{ task = "//docs:checklist" }]\n' \
-    > "${p}/mise.toml"
+    >"${p}/mise.toml"
 
   run bash -c "source '${SCAFFOLD_ROOT}/lib/log.sh'; source '${SCAFFOLD_ROOT}/lib/manifest.sh'; register_config_root '$p' apps/web"
   [ "$status" -ne 0 ]
diff --git a/tests/provenance.bats b/tests/provenance.bats
index 17ea5d5..0100712 100644
--- a/tests/provenance.bats
+++ b/tests/provenance.bats
@@ -22,8 +22,9 @@ setup() {
 }
 
 @test "check-provenance detects a modified verbatim file" {
-  local toolbox; toolbox="$(copy_toolbox)"
-  echo "# drift" >> "${toolbox}/common/.editorconfig"
+  local toolbox
+  toolbox="$(copy_toolbox)"
+  echo "# drift" >>"${toolbox}/common/.editorconfig"
   run "${toolbox}/scripts/check-provenance.sh"
   [ "$status" -eq 1 ]
   [[ "$output" == *"DRIFTED"* ]]
diff --git a/tests/publish.bats b/tests/publish.bats
index 4d56e7d..0fc211c 100644
--- a/tests/publish.bats
+++ b/tests/publish.bats
@@ -22,7 +22,7 @@ teardown() {
 _stub_gh() {
   local bin="${WORKDIR}/stub"
   mkdir -p "$bin"
-  cat > "${bin}/gh" <<'EOF'
+  cat >"${bin}/gh" <<'EOF'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >> "$GH_LOG"
 
@@ -64,7 +64,7 @@ EOF
 _project() {
   mkdir -p "$PROJECT"
   printf 'monorepo_root = true\n\n[vars]\nimage = "ghcr.io/acme/demo"\n' \
-    > "${PROJECT}/mise.toml"
+    >"${PROJECT}/mise.toml"
   git -C "$PROJECT" init -q -b "${1:-main}"
   git -C "$PROJECT" add -A
   git -C "$PROJECT" -c user.email=t@scaffold.invalid -c user.name=t commit -q -m one
@@ -98,7 +98,7 @@ _project() {
 @test "publish refuses to create a repository from a dirty tree" {
   _stub_gh
   _project
-  printf 'work in progress\n' > "${PROJECT}/scratch"
+  printf 'work in progress\n' >"${PROJECT}/scratch"
 
   GH_SCENARIO=absent run scaffold publish "$PROJECT"
   [ "$status" -ne 0 ]
@@ -132,7 +132,11 @@ _project() {
   [[ "$output" == *"would protect main"* ]]
 
   run grep -cE 'repo create|-X PUT|-X POST|-X PATCH|secret set' "$GH_LOG"
-  [ "$output" = 0 ] || { echo "a dry run called:"; cat "$GH_LOG"; false; }
+  [ "$output" = 0 ] || {
+    echo "a dry run called:"
+    cat "$GH_LOG"
+    false
+  }
 }
 
 @test "publish creates the repository the project already names" {
@@ -145,7 +149,10 @@ _project() {
   GH_SCENARIO=absent run scaffold publish "$PROJECT"
   assert_ok
   run grep -c 'repo create acme/demo --private' "$GH_LOG"
-  [ "$output" = 1 ] || { echo "$(cat "$GH_LOG")"; false; }
+  [ "$output" = 1 ] || {
+    cat "$GH_LOG"
+    false
+  }
 }
 
 @test "publish on a repository that exists changes no code, only settings" {
@@ -237,7 +244,7 @@ _project() {
   run grep -c 'secret set' "$GH_LOG"
   [ "$output" = 0 ]
 
-  : > "$GH_LOG"
+  : >"$GH_LOG"
   GH_SCENARIO=exists RELEASE_APP_ID=1 RELEASE_APP_PRIVATE_KEY=key \
     run scaffold publish "$PROJECT"
   assert_ok
@@ -251,6 +258,9 @@ _project() {
   run bash -c "awk '/^\{\$/{f=1} f{print} /^\}\$/{if(f) exit}' '${SCAFFOLD_ROOT}/lib/publish.sh' \
     | jq -r '[.rules[].type] | sort | join(\",\")'"
   assert_ok
-  [ "$output" = "deletion,non_fast_forward,pull_request" ] \
-    || { echo "rules are: ${output}"; false; }
+  [ "$output" = "deletion,non_fast_forward,pull_request" ] ||
+    {
+      echo "rules are: ${output}"
+      false
+    }
 }
diff --git a/tests/service.bats b/tests/service.bats
index a37eda3..7aed187 100644
--- a/tests/service.bats
+++ b/tests/service.bats
@@ -37,7 +37,7 @@ setup() {
   # check load_adapter already has for adapters.
   local dir="${BATS_TEST_TMPDIR}/services/broken"
   mkdir -p "$dir"
-  printf 'SERVICE_NAME="broken"\nSERVICE_KIND="database"\n' > "${dir}/service.env"
+  printf 'SERVICE_NAME="broken"\nSERVICE_KIND="database"\n' >"${dir}/service.env"
 
   SCAFFOLD_ROOT="$BATS_TEST_TMPDIR" run load_service broken
   [ "$status" -eq 1 ]
@@ -52,8 +52,11 @@ setup() {
 @test "every service pins its image by digest" {
   for service in "${SCAFFOLD_ROOT}"/services/*/; do
     [ -f "${service}service.env" ] || continue
-    grep -q '@sha256:' "${service}service.env" \
-      || { echo "no digest in ${service}service.env"; false; }
+    grep -q '@sha256:' "${service}service.env" ||
+      {
+        echo "no digest in ${service}service.env"
+        false
+      }
   done
 }
 
@@ -74,8 +77,8 @@ setup() {
   local project="${BATS_TEST_TMPDIR}/proj"
   mkdir -p "$project"
   cp "${SCAFFOLD_ROOT}/common/compose.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
+    "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
+    "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
 
   run assemble_compose "$project" mysql
   assert_ok
@@ -96,12 +99,15 @@ setup() {
   # the prod fragment merges after the shared one, so its changeme default
   # has to win; swapping that order or dropping the override breaks nothing
   # the rest of this test would catch.
+  # shellcheck disable=SC2016 # literal ${...} matched against the yq expression's target, not expanded
   run yq -e '.services.database.environment.MYSQL_PASSWORD == "${DB_PASSWORD:-changeme}"' \
     "${project}/compose.yaml"
   assert_ok
+  # shellcheck disable=SC2016 # literal ${...} matched against the yq expression's target, not expanded
   run yq -e '.services.database.environment.MYSQL_PASSWORD == "${DB_PASSWORD:-app}"' \
     "${project}/compose.dev.yaml"
   assert_ok
+  # shellcheck disable=SC2016 # literal ${...} matched against the yq expression's target, not expanded
   run yq -e '.services.database.environment.MYSQL_PASSWORD == "${DB_PASSWORD:-app}"' \
     "${project}/compose.test.yaml"
   assert_ok
@@ -139,15 +145,21 @@ setup() {
 
 @test "every adapter declares a framework family" {
   for adapter in "${SCAFFOLD_ROOT}"/adapters/*/; do
-    grep -Eq '^ADAPTER_FAMILY="(laravel|nest|next|flask)"$' "${adapter}adapter.env" \
-      || { echo "no ADAPTER_FAMILY in ${adapter}adapter.env"; false; }
+    grep -Eq '^ADAPTER_FAMILY="(laravel|nest|next|flask)"$' "${adapter}adapter.env" ||
+      {
+        echo "no ADAPTER_FAMILY in ${adapter}adapter.env"
+        false
+      }
   done
 }
 
 @test "every adapter Dockerfile carries the service anchor" {
   for adapter in "${SCAFFOLD_ROOT}"/adapters/*/; do
-    grep -q '^# @SERVICE_SETUP@$' "${adapter}Dockerfile" \
-      || { echo "no @SERVICE_SETUP@ anchor in ${adapter}Dockerfile"; false; }
+    grep -q '^# @SERVICE_SETUP@$' "${adapter}Dockerfile" ||
+      {
+        echo "no @SERVICE_SETUP@ anchor in ${adapter}Dockerfile"
+        false
+      }
   done
 }
 
@@ -179,6 +191,7 @@ setup() {
 
   local file="${BATS_TEST_TMPDIR}/health.controller.ts"
   cp "${SCAFFOLD_ROOT}/adapters/nestjs/src/health/health.controller.ts" "$file"
+  # shellcheck disable=SC2016 # literal TypeScript spliced into the fixture controller, not expanded
   sed -i 's|// @DB_CLIENT@|private dbClient?: { $queryRawUnsafe(q: string): Promise<unknown> };|' "$file"
   sed -i 's|// @DB_PROBE@|this.dbClient = new PrismaClient();|' "$file"
   sed -i 's|  ready(): Promise<|  async ready(): Promise<|' "$file"
@@ -195,7 +208,7 @@ setup() {
 @test "apply_service_dockerfile removes the anchor when nothing was selected" {
   local app="${BATS_TEST_TMPDIR}/app"
   mkdir -p "$app"
-  printf 'FROM scratch\n# @SERVICE_SETUP@\nCMD ["true"]\n' > "${app}/Dockerfile"
+  printf 'FROM scratch\n# @SERVICE_SETUP@\nCMD ["true"]\n' >"${app}/Dockerfile"
 
   run apply_service_dockerfile "$app" ""
   assert_ok
@@ -209,7 +222,7 @@ setup() {
 @test "apply_service_dockerfile splices in every selected service's block" {
   local app="${BATS_TEST_TMPDIR}/app"
   mkdir -p "$app"
-  printf 'FROM scratch\n# @SERVICE_SETUP@\nCMD ["true"]\n' > "${app}/Dockerfile"
+  printf 'FROM scratch\n# @SERVICE_SETUP@\nCMD ["true"]\n' >"${app}/Dockerfile"
 
   run apply_service_dockerfile "$app" "$(printf 'RUN one\nRUN two\n')"
   assert_ok
@@ -222,7 +235,7 @@ setup() {
 @test "apply_service_dockerfile dies when the Dockerfile has no anchor" {
   local app="${BATS_TEST_TMPDIR}/app"
   mkdir -p "$app"
-  printf 'FROM scratch\nCMD ["true"]\n' > "${app}/Dockerfile"
+  printf 'FROM scratch\nCMD ["true"]\n' >"${app}/Dockerfile"
 
   run apply_service_dockerfile "$app" "RUN one"
   [ "$status" -eq 1 ]
@@ -232,7 +245,7 @@ setup() {
 @test "apply_service_dockerfile passes a block through without escape processing" {
   local app="${BATS_TEST_TMPDIR}/app"
   mkdir -p "$app"
-  printf 'FROM scratch\n# @SERVICE_SETUP@\nCMD ["true"]\n' > "${app}/Dockerfile"
+  printf 'FROM scratch\n# @SERVICE_SETUP@\nCMD ["true"]\n' >"${app}/Dockerfile"
 
   # a literal backslash-t, two characters — awk's -v assignment does
   # C-style escape processing and would collapse this into a tab
@@ -244,7 +257,7 @@ setup() {
 
 @test "write_env_lines replaces a key rather than duplicating it" {
   local file="${BATS_TEST_TMPDIR}/.env.example"
-  printf 'DB_HOST=localhost\nAPP_ENV=local\n' > "$file"
+  printf 'DB_HOST=localhost\nAPP_ENV=local\n' >"$file"
 
   run write_env_lines "$file" "DB_HOST=database" "DB_PORT=3306"
   assert_ok
@@ -262,7 +275,7 @@ setup() {
   # escaping too, so a backslash is thrown in on top).
   local file="${BATS_TEST_TMPDIR}/.env.example"
   local value='mongodb://app:app@localhost/app?authSource=admin&x=1|y\z'
-  printf 'DATABASE_URL=placeholder\n' > "$file"
+  printf 'DATABASE_URL=placeholder\n' >"$file"
 
   run write_env_lines "$file" "DATABASE_URL=${value}"
   assert_ok
@@ -277,7 +290,7 @@ setup() {
 
 @test "write_env_lines appends onto a file with no trailing newline" {
   local file="${BATS_TEST_TMPDIR}/.env.example"
-  printf 'APP_ENV=local' > "$file"
+  printf 'APP_ENV=local' >"$file"
 
   run write_env_lines "$file" "DB_HOST=database"
   assert_ok
@@ -288,27 +301,28 @@ setup() {
 }
 
 @test "apply_service_drivers does not leak one driver's parameters into the next" {
-  local toolbox; toolbox="$(copy_toolbox)"
+  local toolbox
+  toolbox="$(copy_toolbox)"
   local app="${BATS_TEST_TMPDIR}/app"
   mkdir -p "$app" \
     "${toolbox}/services/leaky/drivers" "${toolbox}/services/clean/drivers"
 
-  cat > "${toolbox}/services/leaky/service.env" <<'EOF'
+  cat >"${toolbox}/services/leaky/service.env" <<'EOF'
 SERVICE_NAME="leaky"
 SERVICE_KIND="database"
 SERVICE_IMAGE="example/leaky@sha256:deadbeef"
 EOF
-  cat > "${toolbox}/services/leaky/drivers/fixture.sh" <<'EOF'
+  cat >"${toolbox}/services/leaky/drivers/fixture.sh" <<'EOF'
 service_driver_apply() { FIXTURE_PARAM=set; }
 service_driver_dockerfile() { :; }
 EOF
 
-  cat > "${toolbox}/services/clean/service.env" <<'EOF'
+  cat >"${toolbox}/services/clean/service.env" <<'EOF'
 SERVICE_NAME="clean"
 SERVICE_KIND="cache"
 SERVICE_IMAGE="example/clean@sha256:deadbeef"
 EOF
-  cat > "${toolbox}/services/clean/drivers/fixture.sh" <<'EOF'
+  cat >"${toolbox}/services/clean/drivers/fixture.sh" <<'EOF'
 service_driver_apply() {
   [ -z "${FIXTURE_PARAM:-}" ] \
     || { echo "leaky's FIXTURE_PARAM survived into clean's driver" >&2; exit 1; }
@@ -321,11 +335,12 @@ EOF
 }
 
 @test "apply_service_drivers dies when a driver fails partway through service_driver_apply" {
-  local toolbox; toolbox="$(copy_toolbox)"
+  local toolbox
+  toolbox="$(copy_toolbox)"
   local app="${BATS_TEST_TMPDIR}/app"
   mkdir -p "$app" "${toolbox}/services/broken/drivers"
 
-  cat > "${toolbox}/services/broken/service.env" <<'EOF'
+  cat >"${toolbox}/services/broken/service.env" <<'EOF'
 SERVICE_NAME="broken"
 SERVICE_KIND="database"
 SERVICE_IMAGE="example/broken@sha256:deadbeef"
@@ -334,7 +349,7 @@ EOF
   # command in the same function would otherwise succeed. `|| return 1` makes
   # the failure visible at the point it happens; apply_service_drivers'
   # process-level `set -e` (below) would also catch a driver that omits it.
-  cat > "${toolbox}/services/broken/drivers/fixture.sh" <<'EOF'
+  cat >"${toolbox}/services/broken/drivers/fixture.sh" <<'EOF'
 service_driver_apply() {
   false || return 1
   touch installed
@@ -346,10 +361,18 @@ EOF
   [ "$status" -eq 1 ]
   # The service and the family both have to be named: a bare "a driver failed"
   # sends the reader to the wrong one of eight.
-  [[ "$output" == *"wiring broken into"* ]] \
-    || { echo "the failure does not name the service:"; echo "$output"; false; }
-  [[ "$output" == *"fixture driver"* ]] \
-    || { echo "the failure does not name the driver family:"; echo "$output"; false; }
+  [[ "$output" == *"wiring broken into"* ]] ||
+    {
+      echo "the failure does not name the service:"
+      echo "$output"
+      false
+    }
+  [[ "$output" == *"fixture driver"* ]] ||
+    {
+      echo "the failure does not name the driver family:"
+      echo "$output"
+      false
+    }
   [ ! -e "${app}/installed" ]
 }
 
@@ -360,16 +383,17 @@ EOF
 # `|| return 1` anywhere, so it only dies here if apply_service_drivers runs
 # it somewhere `set -e` still applies.
 @test "apply_service_drivers dies on an unchecked driver failure with no || return 1 anywhere" {
-  local toolbox; toolbox="$(copy_toolbox)"
+  local toolbox
+  toolbox="$(copy_toolbox)"
   local app="${BATS_TEST_TMPDIR}/app"
   mkdir -p "$app" "${toolbox}/services/careless/drivers"
 
-  cat > "${toolbox}/services/careless/service.env" <<'EOF'
+  cat >"${toolbox}/services/careless/service.env" <<'EOF'
 SERVICE_NAME="careless"
 SERVICE_KIND="database"
 SERVICE_IMAGE="example/careless@sha256:deadbeef"
 EOF
-  cat > "${toolbox}/services/careless/drivers/fixture.sh" <<'EOF'
+  cat >"${toolbox}/services/careless/drivers/fixture.sh" <<'EOF'
 service_driver_apply() { false; touch installed; }
 service_driver_dockerfile() { :; }
 EOF
@@ -378,10 +402,18 @@ EOF
   [ "$status" -eq 1 ]
   # The service and the family both have to be named: a bare "a driver failed"
   # sends the reader to the wrong one of eight.
-  [[ "$output" == *"wiring careless into"* ]] \
-    || { echo "the failure does not name the service:"; echo "$output"; false; }
-  [[ "$output" == *"fixture driver"* ]] \
-    || { echo "the failure does not name the driver family:"; echo "$output"; false; }
+  [[ "$output" == *"wiring careless into"* ]] ||
+    {
+      echo "the failure does not name the service:"
+      echo "$output"
+      false
+    }
+  [[ "$output" == *"fixture driver"* ]] ||
+    {
+      echo "the failure does not name the driver family:"
+      echo "$output"
+      false
+    }
   [ ! -e "${app}/installed" ]
 }
 
@@ -411,11 +443,11 @@ EOF
   local app="${root}/worker"
   local fakebin="${BATS_TEST_TMPDIR}/rootcheck/fakebin"
   mkdir -p "$app" "$fakebin"
-  printf 'allowBuilds: {}\n' > "${decoy}/pnpm-workspace.yaml"
+  printf 'allowBuilds: {}\n' >"${decoy}/pnpm-workspace.yaml"
 
   # stands in for pnpm add/pnpm add -D, both network calls nest.sh's driver
   # makes before the yq guard this test exercises
-  cat > "${fakebin}/pnpm" <<'EOF'
+  cat >"${fakebin}/pnpm" <<'EOF'
 #!/usr/bin/env bash
 exit 0
 EOF
@@ -430,27 +462,28 @@ EOF
 }
 
 @test "apply_service_drivers skips a driver's empty dockerfile output instead of splicing a blank line" {
-  local toolbox; toolbox="$(copy_toolbox)"
+  local toolbox
+  toolbox="$(copy_toolbox)"
   local app="${BATS_TEST_TMPDIR}/blank-line-app"
   mkdir -p "$app" "${toolbox}/services/quiet/drivers" "${toolbox}/services/loud/drivers"
-  printf 'FROM scratch\n# @SERVICE_SETUP@\nCMD ["true"]\n' > "${app}/Dockerfile"
+  printf 'FROM scratch\n# @SERVICE_SETUP@\nCMD ["true"]\n' >"${app}/Dockerfile"
 
-  cat > "${toolbox}/services/quiet/service.env" <<'EOF'
+  cat >"${toolbox}/services/quiet/service.env" <<'EOF'
 SERVICE_NAME="quiet"
 SERVICE_KIND="cache"
 SERVICE_IMAGE="example/quiet@sha256:deadbeef"
 EOF
-  cat > "${toolbox}/services/quiet/drivers/fixture.sh" <<'EOF'
+  cat >"${toolbox}/services/quiet/drivers/fixture.sh" <<'EOF'
 service_driver_apply() { :; }
 service_driver_dockerfile() { :; }
 EOF
 
-  cat > "${toolbox}/services/loud/service.env" <<'EOF'
+  cat >"${toolbox}/services/loud/service.env" <<'EOF'
 SERVICE_NAME="loud"
 SERVICE_KIND="database"
 SERVICE_IMAGE="example/loud@sha256:deadbeef"
 EOF
-  cat > "${toolbox}/services/loud/drivers/fixture.sh" <<'EOF'
+  cat >"${toolbox}/services/loud/drivers/fixture.sh" <<'EOF'
 service_driver_apply() { :; }
 service_driver_dockerfile() { printf 'RUN loud-setup\n'; }
 EOF
@@ -469,8 +502,11 @@ EOF
   for service in "${SCAFFOLD_ROOT}"/services/*/; do
     [ -f "${service}service.env" ] || continue
     for family in laravel nest; do
-      [ -f "${service}drivers/${family}.sh" ] \
-        || { echo "no ${family} driver in ${service}"; false; }
+      [ -f "${service}drivers/${family}.sh" ] ||
+        {
+          echo "no ${family} driver in ${service}"
+          false
+        }
     done
   done
 }
@@ -479,8 +515,8 @@ EOF
   local project="${BATS_TEST_TMPDIR}/proj"
   mkdir -p "$project"
   cp "${SCAFFOLD_ROOT}/common/compose.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
+    "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
+    "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
 
   run assemble_compose "$project" postgres
   assert_ok
@@ -493,8 +529,8 @@ EOF
   local project="${BATS_TEST_TMPDIR}/proj"
   mkdir -p "$project"
   cp "${SCAFFOLD_ROOT}/common/compose.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
+    "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
+    "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
 
   run assemble_compose "$project" mongodb
   assert_ok
@@ -509,7 +545,7 @@ EOF
 @test "register_mongodb_connection inserts the mongodb connection at the anchor" {
   local file="${BATS_TEST_TMPDIR}/config/database.php"
   mkdir -p "$(dirname "$file")"
-  printf "<?php\n\nreturn [\n    'connections' => [\n    ],\n];\n" > "$file"
+  printf "<?php\n\nreturn [\n    'connections' => [\n    ],\n];\n" >"$file"
 
   run bash -c "
     source '${SCAFFOLD_ROOT}/lib/log.sh'
@@ -532,7 +568,7 @@ EOF
 @test "register_mongodb_connection dies when the anchor is missing" {
   local file="${BATS_TEST_TMPDIR}/config/database.php"
   mkdir -p "$(dirname "$file")"
-  printf "<?php\n\nreturn [\n    'connections' => [],\n];\n" > "$file"
+  printf "<?php\n\nreturn [\n    'connections' => [],\n];\n" >"$file"
 
   run bash -c "
     source '${SCAFFOLD_ROOT}/lib/log.sh'
@@ -547,8 +583,8 @@ EOF
   local project="${BATS_TEST_TMPDIR}/proj"
   mkdir -p "$project"
   cp "${SCAFFOLD_ROOT}/common/compose.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
+    "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
+    "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
 
   run assemble_compose "$project" mysql redis
   assert_ok
@@ -576,9 +612,9 @@ _app_fixture() {
   local project="$1" database="${2:-none}" cache="${3:-none}"
   mkdir -p "$project"
   cp "${SCAFFOLD_ROOT}/common/compose.yaml" "${project}/compose.yaml"
-  : > "${project}/example.env"
+  : >"${project}/example.env"
   printf 'monorepo_root = true\n\n[vars]\ndatabase = "%s"\ncache = "%s"\nimage = "ghcr.io/acme/demo"\n' \
-    "$database" "$cache" > "${project}/mise.toml"
+    "$database" "$cache" >"${project}/mise.toml"
 }
 
 @test "add_app_service names the service and image after the application directory" {
@@ -588,8 +624,12 @@ _app_fixture() {
   run add_app_service "$project" apps/web web
   assert_ok
   run yq -r '.services.web.image' "${project}/compose.yaml"
-  [ "$output" = 'ghcr.io/acme/demo-web:${IMAGE_TAG:-latest}' ] \
-    || { echo "image is ${output}"; false; }
+  # shellcheck disable=SC2016 # literal ${IMAGE_TAG} compared against yq's output, not expanded
+  [ "$output" = 'ghcr.io/acme/demo-web:${IMAGE_TAG:-latest}' ] ||
+    {
+      echo "image is ${output}"
+      false
+    }
 }
 
 @test "add_app_service allocates a port per application, from 8080 up" {
@@ -603,8 +643,12 @@ _app_fixture() {
   add_app_service "$project" apps/admin-ui web
 
   run yq -r '[.services[].ports[0]] | join(" ")' "${project}/compose.yaml"
-  [ "$output" = '${WEB_PORT:-8080}:8080 ${API_PORT:-8081}:8080 ${ADMIN_UI_PORT:-8082}:8080' ] \
-    || { echo "ports are: ${output}"; false; }
+  # shellcheck disable=SC2016 # literal ${...} compared against yq's output, not expanded
+  [ "$output" = '${WEB_PORT:-8080}:8080 ${API_PORT:-8081}:8080 ${ADMIN_UI_PORT:-8082}:8080' ] ||
+    {
+      echo "ports are: ${output}"
+      false
+    }
 
   # The same variable names, in the file install.sh writes .env from.
   run grep -c -E '^(WEB|API|ADMIN_UI)_PORT=' "${project}/example.env"
@@ -621,10 +665,16 @@ _app_fixture() {
   add_app_service "$project" apps/api api
 
   run yq -r '.services.web.depends_on // "none"' "${project}/compose.yaml"
-  [ "$output" = none ] || { echo "web waits on: ${output}"; false; }
+  [ "$output" = none ] || {
+    echo "web waits on: ${output}"
+    false
+  }
 
   run yq -r '.services.api.depends_on | keys | sort | join(",")' "${project}/compose.yaml"
-  [ "$output" = "cache,database" ] || { echo "api waits on: ${output}"; false; }
+  [ "$output" = "cache,database" ] || {
+    echo "api waits on: ${output}"
+    false
+  }
 }
 
 @test "add_app_service refuses a project with no recorded registry path" {
@@ -633,7 +683,7 @@ _app_fixture() {
   local project="${BATS_TEST_TMPDIR}/old"
   mkdir -p "$project"
   cp "${SCAFFOLD_ROOT}/common/compose.yaml" "${project}/compose.yaml"
-  printf 'monorepo_root = true\n\n[vars]\ndatabase = "none"\ncache = "none"\n' > "${project}/mise.toml"
+  printf 'monorepo_root = true\n\n[vars]\ndatabase = "none"\ncache = "none"\n' >"${project}/mise.toml"
 
   # Through `bash -e`, the way scaffold itself runs it: die() inside a command
   # substitution exits only the subshell, and it is errexit on the assignment
@@ -667,8 +717,8 @@ _app_fixture() {
   local project="${BATS_TEST_TMPDIR}/proj"
   mkdir -p "$project"
   cp "${SCAFFOLD_ROOT}/common/compose.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
-     "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
+    "${SCAFFOLD_ROOT}/common/compose.dev.yaml" \
+    "${SCAFFOLD_ROOT}/common/compose.test.yaml" "$project/"
 
   run assemble_compose "$project" redis
   assert_ok
@@ -676,6 +726,7 @@ _app_fixture() {
   # shared array) fails here instead of only in the password check below.
   run yq -e '.services.cache.command | length == 5' "${project}/compose.yaml"
   assert_ok
+  # shellcheck disable=SC2016 # literal ${...} matched against the yq expression's target, not expanded
   run yq -e '.services.cache.command[2] == "${REDIS_PASSWORD:-changeme}"' \
     "${project}/compose.yaml"
   assert_ok
@@ -685,6 +736,7 @@ _app_fixture() {
   assert_ok
   run yq -e '.services.cache.healthcheck.test | length == 5' "${project}/compose.yaml"
   assert_ok
+  # shellcheck disable=SC2016 # literal ${...} matched against the yq expression's target, not expanded
   run yq -e '.services.cache.healthcheck.test[3] == "${REDIS_PASSWORD:-changeme}"' \
     "${project}/compose.yaml"
   assert_ok
@@ -694,7 +746,7 @@ _app_fixture() {
   local project="${BATS_TEST_TMPDIR}/proj"
   mkdir -p "$project"
   sed 's|@PROJECT_NAME@|demo|g' "${SCAFFOLD_ROOT}/common/mise.root.toml" \
-    > "${project}/mise.toml"
+    >"${project}/mise.toml"
 
   run record_services "$project" mysql none
   assert_ok
@@ -719,10 +771,19 @@ _app_fixture() {
   allow_builds="$(grep -n 'allowBuilds.prisma' "$file" | head -1 | cut -d: -f1)"
   first_add="$(grep -n '^  pnpm add' "$file" | head -1 | cut -d: -f1)"
 
-  [ -n "$allow_builds" ] || { echo "no allowBuilds line in ${file}"; false; }
-  [ -n "$first_add" ] || { echo "no pnpm add line in ${file}"; false; }
-  [ "$allow_builds" -lt "$first_add" ] \
-    || { echo "allowBuilds (line ${allow_builds}) must come before the first pnpm add (line ${first_add})"; false; }
+  [ -n "$allow_builds" ] || {
+    echo "no allowBuilds line in ${file}"
+    false
+  }
+  [ -n "$first_add" ] || {
+    echo "no pnpm add line in ${file}"
+    false
+  }
+  [ "$allow_builds" -lt "$first_add" ] ||
+    {
+      echo "allowBuilds (line ${allow_builds}) must come before the first pnpm add (line ${first_add})"
+      false
+    }
 }
 
 # Shared by the two tests below, so a regression in the check itself fails
@@ -730,9 +791,13 @@ _app_fixture() {
 # alongside a broken check while still reporting green on its own.
 _password_literal_report() {
   local driver="$1" block bad=""
-  block="$( . "${SCAFFOLD_ROOT}/lib/service.sh"
-            SERVICE_DIR="$(dirname "$(dirname "$driver")")"
-            . "$driver"; service_driver_compose_env )"
+  block="$(
+    . "${SCAFFOLD_ROOT}/lib/service.sh"
+    SERVICE_DIR="$(dirname "$(dirname "$driver")")"
+    # shellcheck source=/dev/null
+    . "$driver"
+    service_driver_compose_env
+  )"
 
   # A *_PASSWORD key whose value is not exactly an interpolation. Anchored
   # with optional leading whitespace, not a bare ^, so an indented key still
@@ -743,6 +808,7 @@ _password_literal_report() {
   # complete, and the services/*/drivers/*.sh files are the only writers of
   # this block and already go through review — widen the blacklist here and
   # the next unlisted name just becomes the new hole.
+  # shellcheck disable=SC2031 # driver is read-only here, not actually modified by the sourcing above
   while IFS= read -r line; do
     case "$line" in
       *_PASSWORD:\ \$\{*_PASSWORD\}) ;;
@@ -752,6 +818,7 @@ _password_literal_report() {
 
   # A DSN's user:password@ slot whose password is not exactly an
   # interpolation — the same shape, embedded in a URL instead of a key.
+  # shellcheck disable=SC2031 # driver is read-only here, not actually modified by the sourcing above
   while IFS= read -r segment; do
     case "$segment" in
       :\$\{*_PASSWORD\}@) ;;
@@ -779,7 +846,11 @@ _password_literal_report() {
   for driver in "${SCAFFOLD_ROOT}"/services/*/drivers/*.sh; do
     bad="${bad}$(_password_literal_report "$driver")"
   done
-  [ -z "$bad" ] || { echo "embeds a literal password:"; echo "$bad"; false; }
+  [ -z "$bad" ] || {
+    echo "embeds a literal password:"
+    echo "$bad"
+    false
+  }
 }
 
 @test "the literal-password check reports a driver that bakes one in" {
@@ -792,8 +863,12 @@ _password_literal_report() {
   local driver="${SCAFFOLD_ROOT}/tests/fixtures/lint-services/literal-password/sample/drivers/laravel.sh"
   local bad
   bad="$(_password_literal_report "$driver")"
-  [[ "$bad" == *"DB_PASSWORD: hunter2"* ]] \
-    || { echo "expected a literal password to be reported, got:"; echo "$bad"; false; }
+  [[ "$bad" == *"DB_PASSWORD: hunter2"* ]] ||
+    {
+      echo "expected a literal password to be reported, got:"
+      echo "$bad"
+      false
+    }
 }
 
 @test "apply_service_compose_env merges into the application it was given" {
@@ -802,12 +877,14 @@ _password_literal_report() {
   # to a generic `app` (ADR-0022).
   local project="${BATS_TEST_TMPDIR}/p"
   mkdir -p "$project"
-  printf 'services:\n  api:\n    image: x\n  web:\n    image: y\n' > "${project}/compose.yaml"
+  printf 'services:\n  api:\n    image: x\n  web:\n    image: y\n' >"${project}/compose.yaml"
   . "${SCAFFOLD_ROOT}/lib/service.sh"
+  # shellcheck disable=SC2016 # literal ${...} passed as the compose-env fragment, not expanded
   apply_service_compose_env "$project" api 'DATABASE_URL: ${DATABASE_URL:-postgresql://app@database:5432/app}'
   run mise exec -- yq -r '.services.api.environment.DATABASE_URL' "${project}/compose.yaml"
-  [[ "$output" == 'postgresql://app@database:5432/app' ]] \
-    || [[ "$output" == '${DATABASE_URL:-postgresql://app@database:5432/app}' ]]
+  # shellcheck disable=SC2016 # literal ${...} compared against yq's output, not expanded
+  [[ "$output" == 'postgresql://app@database:5432/app' ]] ||
+    [[ "$output" == '${DATABASE_URL:-postgresql://app@database:5432/app}' ]]
 
   # The application beside it is left alone.
   run mise exec -- yq -r '.services.web.environment // "none"' "${project}/compose.yaml"
@@ -818,22 +895,38 @@ _password_literal_report() {
   # config/database.php is `env('DB_CONNECTION', 'sqlite')`. Without that
   # variable laravel does not fail — it silently reads DB_DATABASE as a
   # sqlite filename and never contacts the service at all.
+  # shellcheck disable=SC2167 # service is local to lib/service.sh's own loop; unrelated to this one
   for service in mysql postgres mongodb; do
-    block="$( . "${SCAFFOLD_ROOT}/lib/service.sh"
-              . "${SCAFFOLD_ROOT}/services/${service}/drivers/laravel.sh"
-              service_driver_compose_env )"
-    grep -q '^DB_CONNECTION:' <<<"$block" \
-      || { echo "${service}/laravel.sh emits no DB_CONNECTION"; false; }
+    block="$(
+      . "${SCAFFOLD_ROOT}/lib/service.sh"
+      # shellcheck source=/dev/null
+      . "${SCAFFOLD_ROOT}/services/${service}/drivers/laravel.sh"
+      service_driver_compose_env
+    )"
+    # shellcheck disable=SC2031 # service is read-only here, not actually modified by the sourcing above
+    grep -q '^DB_CONNECTION:' <<<"$block" ||
+      {
+        echo "${service}/laravel.sh emits no DB_CONNECTION"
+        false
+      }
   done
 }
 
 @test "the nest drivers name DATABASE_URL and let an operator override it" {
+  # shellcheck disable=SC2167 # service is local to lib/service.sh's own loop; unrelated to this one
   for service in mysql postgres mongodb; do
-    block="$( . "${SCAFFOLD_ROOT}/lib/service.sh"
-              . "${SCAFFOLD_ROOT}/services/${service}/drivers/nest.sh"
-              service_driver_compose_env )"
-    grep -q '^DATABASE_URL: \${DATABASE_URL:-' <<<"$block" \
-      || { echo "${service}/nest.sh does not allow an override"; false; }
+    block="$(
+      . "${SCAFFOLD_ROOT}/lib/service.sh"
+      # shellcheck source=/dev/null
+      . "${SCAFFOLD_ROOT}/services/${service}/drivers/nest.sh"
+      service_driver_compose_env
+    )"
+    # shellcheck disable=SC2016,SC2031 # literal ${...} match, and service is read-only here
+    grep -q '^DATABASE_URL: \${DATABASE_URL:-' <<<"$block" ||
+      {
+        echo "${service}/nest.sh does not allow an override"
+        false
+      }
   done
 }
 
diff --git a/tests/update.bats b/tests/update.bats
index 7551074..ed0c7d6 100644
--- a/tests/update.bats
+++ b/tests/update.bats
@@ -27,10 +27,11 @@ _commit() {
 # for a toolbox commit to happen would make every one of these tests an
 # integration test for no extra coverage.
 _toolbox_with_history() {
-  local box; box="$(copy_toolbox)"
+  local box
+  box="$(copy_toolbox)"
   git -C "$box" init -q -b main
   _commit "$box" "before"
-  printf '\n# a later change to the shipped hooks\n' >> "${box}/common/lefthook.yml"
+  printf '\n# a later change to the shipped hooks\n' >>"${box}/common/lefthook.yml"
   _commit "$box" "after"
   printf '%s' "$box"
 }
@@ -43,7 +44,7 @@ _fixture_project() {
 
   mkdir -p "${project}/.github/workflows"
   cp "${SCAFFOLD_ROOT}/common/lefthook.yml" "${project}/lefthook.yml"
-  cat > "${project}/mise.toml" <<EOF
+  cat >"${project}/mise.toml" <<EOF
 monorepo_root = true
 
 [vars]
@@ -58,12 +59,12 @@ config_roots = [
 run = [{ task = "//docs:checklist" }]
 EOF
   printf 'jobs:\n  ci:\n    with:\n      roots: %s\n' "'[\"docs\"]'" \
-    > "${project}/.github/workflows/ci.yml"
+    >"${project}/.github/workflows/ci.yml"
   printf 'jobs:\n  build:\n    with:\n      images: "[]"\n' \
-    > "${project}/.github/workflows/build.yml"
+    >"${project}/.github/workflows/build.yml"
   printf 'jobs:\n  release:\n    with:\n      images: "[]"\n' \
-    > "${project}/.github/workflows/release.yml"
-  printf 'version = "%s"\n\n[apps]\n' "$version" > "${project}/.scaffold.toml"
+    >"${project}/.github/workflows/release.yml"
+  printf 'version = "%s"\n\n[apps]\n' "$version" >"${project}/.scaffold.toml"
 
   git -C "$project" init -q -b main
   _commit "$project" "scaffold project"
@@ -76,8 +77,11 @@ EOF
 
   run yq -p toml -oy -r '.version' "${project}/.scaffold.toml"
   assert_ok
-  [ "$output" = "$(git -C "$SCAFFOLD_ROOT" describe --tags --always --dirty)" ] \
-    || { echo "recorded ${output}"; false; }
+  [ "$output" = "$(git -C "$SCAFFOLD_ROOT" describe --tags --always --dirty)" ] ||
+    {
+      echo "recorded ${output}"
+      false
+    }
 }
 
 @test "rewrite_patch_paths moves headers and leaves content alone" {
@@ -107,7 +111,7 @@ EOF
 @test "update refuses a project that records nothing" {
   local project="${WORKDIR}/bare"
   mkdir -p "$project"
-  printf 'monorepo_root = true\n' > "${project}/mise.toml"
+  printf 'monorepo_root = true\n' >"${project}/mise.toml"
   git -C "$project" init -q -b main 2>/dev/null || true
 
   run scaffold update "$project"
@@ -138,8 +142,10 @@ EOF
 }
 
 @test "update brings a later change to a project that predates it" {
-  local box; box="$(_toolbox_with_history)"
-  local from; from="$(git -C "$box" rev-parse HEAD~1)"
+  local box
+  box="$(_toolbox_with_history)"
+  local from
+  from="$(git -C "$box" rev-parse HEAD~1)"
   local project="${WORKDIR}/old"
   _fixture_project "$project" "$from"
   # _fixture_project already copied common/lefthook.yml, and the toolbox
@@ -153,39 +159,52 @@ EOF
 }
 
 @test "update records the version it moved to" {
-  local box; box="$(_toolbox_with_history)"
-  local from; from="$(git -C "$box" rev-parse HEAD~1)"
+  local box
+  box="$(_toolbox_with_history)"
+  local from
+  from="$(git -C "$box" rev-parse HEAD~1)"
   local project="${WORKDIR}/recorded"
   _fixture_project "$project" "$from"
 
   "${box}/scaffold" update "$project"
 
   run yq -p toml -oy -r '.version' "${project}/.scaffold.toml"
-  [ "$output" = "$(git -C "$box" describe --tags --always --dirty)" ] \
-    || { echo "still recorded ${output}"; false; }
+  [ "$output" = "$(git -C "$box" describe --tags --always --dirty)" ] ||
+    {
+      echo "still recorded ${output}"
+      false
+    }
 }
 
 @test "a dry run changes nothing" {
-  local box; box="$(_toolbox_with_history)"
-  local from; from="$(git -C "$box" rev-parse HEAD~1)"
+  local box
+  box="$(_toolbox_with_history)"
+  local from
+  from="$(git -C "$box" rev-parse HEAD~1)"
   local project="${WORKDIR}/preview"
   _fixture_project "$project" "$from"
 
   run "${box}/scaffold" update "$project" --dry-run
   assert_ok
   [[ "$output" == *"a later change to the shipped hooks"* ]]
-  [ -z "$(git -C "$project" status --porcelain)" ] \
-    || { echo "a dry run wrote:"; git -C "$project" status --porcelain; false; }
+  [ -z "$(git -C "$project" status --porcelain)" ] ||
+    {
+      echo "a dry run wrote:"
+      git -C "$project" status --porcelain
+      false
+    }
 }
 
 @test "update refuses a project with uncommitted changes" {
   # `git diff` afterwards is the only review this gets, and it has to show
   # this run's changes alone.
-  local box; box="$(_toolbox_with_history)"
-  local from; from="$(git -C "$box" rev-parse HEAD~1)"
+  local box
+  box="$(_toolbox_with_history)"
+  local from
+  from="$(git -C "$box" rev-parse HEAD~1)"
   local project="${WORKDIR}/messy"
   _fixture_project "$project" "$from"
-  printf 'work in progress\n' >> "${project}/lefthook.yml"
+  printf 'work in progress\n' >>"${project}/lefthook.yml"
 
   run "${box}/scaffold" update "$project"
   [ "$status" -ne 0 ]
@@ -198,15 +217,18 @@ EOF
   # as a comment change in `git diff` and leaves the project building nothing.
   local project="${WORKDIR}/derived"
   _fixture_project "$project" "0000000"
-  printf '"apps/api" = "nestjs"\n' >> "${project}/.scaffold.toml"
+  printf '"apps/api" = "nestjs"\n' >>"${project}/.scaffold.toml"
   mkdir -p "${project}/apps/api"
-  : > "${project}/apps/api/Dockerfile"
+  : >"${project}/apps/api/Dockerfile"
   _commit "$project" "an application"
 
   resync_derived_files "$project"
 
   run yq -r '[.jobs[] | select(has("with")) | .with.images] | .[0]' \
     "${project}/.github/workflows/build.yml"
-  [[ "$output" == *'ghcr.io/acme/demo-api'* ]] || { echo "images are: ${output}"; false; }
+  [[ "$output" == *'ghcr.io/acme/demo-api'* ]] || {
+    echo "images are: ${output}"
+    false
+  }
   [[ "$output" == *'apps/api/Dockerfile'* ]]
 }
diff --git a/tests/wizard.bats b/tests/wizard.bats
index 48fc4e9..61d69f9 100644
--- a/tests/wizard.bats
+++ b/tests/wizard.bats
@@ -25,13 +25,19 @@ strip_ansi() {
   # is never asked about a database.
   run wizard_actions 0
   assert_ok
-  [ "$(cut -f1 <<< "$output" | tr '\n' ' ')" = "new " ] \
-    || { echo "outside a project the wizard offers: ${output}"; false; }
+  [ "$(cut -f1 <<<"$output" | tr '\n' ' ')" = "new " ] ||
+    {
+      echo "outside a project the wizard offers: ${output}"
+      false
+    }
 
   run wizard_actions 1
   assert_ok
-  [ "$(cut -f1 <<< "$output" | tr '\n' ' ')" = "new update publish " ] \
-    || { echo "inside a project the wizard offers: ${output}"; false; }
+  [ "$(cut -f1 <<<"$output" | tr '\n' ' ')" = "new update publish " ] ||
+    {
+      echo "inside a project the wizard offers: ${output}"
+      false
+    }
 }
 
 @test "every action the wizard offers is a command scaffold accepts" {
@@ -40,8 +46,11 @@ strip_ansi() {
   # cheapest way to keep them in step.
   local action
   while read -r action; do
-    grep -qE "^    ${action}\) cmd_" "${SCAFFOLD_ROOT}/scaffold" \
-      || { echo "the wizard offers '${action}', which scaffold's main has no case for"; false; }
+    grep -qE "^    ${action}\) cmd_" "${SCAFFOLD_ROOT}/scaffold" ||
+      {
+        echo "the wizard offers '${action}', which scaffold's main has no case for"
+        false
+      }
   done < <(wizard_actions 1 | cut -f1)
 }
 
@@ -50,29 +59,39 @@ strip_ansi() {
   # sound like "do the thing".
   local line
   while IFS= read -r line; do
-    [ -n "$(cut -f2 <<< "$line")" ] \
-      || { echo "no description for: $(cut -f1 <<< "$line")"; false; }
+    [ -n "$(cut -f2 <<<"$line")" ] ||
+      {
+        echo "no description for: $(cut -f1 <<<"$line")"
+        false
+      }
   done < <(wizard_actions 1)
 }
 
 @test "publish asks the one question it has an answer for" {
   run wizard_visibilities
   assert_ok
-  [ "$(cut -f1 <<< "$output" | tr '\n' ' ')" = "private public " ] \
-    || { echo "visibilities are: ${output}"; false; }
+  [ "$(cut -f1 <<<"$output" | tr '\n' ' ')" = "private public " ] ||
+    {
+      echo "visibilities are: ${output}"
+      false
+    }
   # Private first: a plain Enter picks what cmd_publish would have defaulted
   # to unset, the same promise wizard_order_options makes for the flags.
-  [ "$(head -1 <<< "$output" | cut -f1)" = private ]
+  [ "$(head -1 <<<"$output" | cut -f1)" = private ]
 }
 
 @test "the answer column fits the widest question the wizard can ask" {
   # Measured from the prompts rather than hand-counted, so a new screen
   # widens the column instead of overflowing it.
-  local width; width="$(wizard_prompt_width)"
+  local width
+  width="$(wizard_prompt_width)"
   local prompt
   for prompt in "$WIZARD_ACTION_PROMPT" "$WIZARD_SHAPE_PROMPT" "$WIZARD_VISIBILITY_PROMPT"; do
-    [ "${#prompt}" -le "$width" ] \
-      || { echo "'${prompt}' is ${#prompt} wide, column is ${width}"; false; }
+    [ "${#prompt}" -le "$width" ] ||
+      {
+        echo "'${prompt}' is ${#prompt} wide, column is ${width}"
+        false
+      }
   done
 }
 
@@ -166,9 +185,9 @@ strip_ansi() {
     run wizard_questions "$shape"
     assert_ok
     count=$((count + 1))
-  done <<< "$shapes"
+  done <<<"$shapes"
 
-  [ "$count" -eq "$(wc -l <<< "$shapes")" ]
+  [ "$count" -eq "$(wc -l <<<"$shapes")" ]
 }
 
 @test "wizard_questions asks about services exactly when a shape's roles need drivers" {
@@ -180,7 +199,7 @@ strip_ansi() {
   # web+api alike.
   local shape roles role driven questions
   for shape in $(wizard_shapes | cut -f1); do
-    IFS='+' read -ra roles <<< "$shape"
+    IFS='+' read -ra roles <<<"$shape"
     driven=0
     for role in "${roles[@]}"; do
       case " ${DRIVEN_ROLES[*]} " in
@@ -233,14 +252,17 @@ strip_ansi() {
   # The wizard's own version of the test that keeps adapters.yml honest: an
   # adapter or service nobody can select is invisible, and nothing else would
   # say so.
-  local row name reachable
+  local name reachable
   while IFS=$'\t' read -r name _ _; do
     reachable=0
     for kind in web api app database cache; do
       wizard_options "$LISTING" "$kind" | grep -q "^${name}	" && reachable=1
     done
-    [ "$reachable" -eq 1 ] || { echo "${name} is in scaffold list but no question offers it"; false; }
-  done <<< "$LISTING"
+    [ "$reachable" -eq 1 ] || {
+      echo "${name} is in scaffold list but no question offers it"
+      false
+    }
+  done <<<"$LISTING"
 }
 
 @test "the name prompt enforces init_project's rule before anything is created" {
@@ -267,7 +289,7 @@ strip_ansi() {
   command -v script >/dev/null || skip "script(1) not available"
 
   local driver="${BATS_TEST_TMPDIR}/drive-name-prompt.sh"
-  cat > "$driver" <<EOF
+  cat >"$driver" <<EOF
 #!/usr/bin/env bash
 source "${SCAFFOLD_ROOT}/lib/log.sh"
 source "${SCAFFOLD_ROOT}/lib/project.sh"
@@ -276,12 +298,20 @@ tui_prompt_name >/dev/null
 EOF
 
   local out="${BATS_TEST_TMPDIR}/eof.log" status=0
-  { sleep 1; printf '\x04'; sleep 1; } \
-    | timeout 10 script -qec "bash '${driver}'" /dev/null > "$out" 2>&1 || status=$?
+  {
+    sleep 1
+    printf '\x04'
+    sleep 1
+  } |
+    timeout 10 script -qec "bash '${driver}'" /dev/null >"$out" 2>&1 || status=$?
 
   # 124 is timeout(1) killing a still-spinning process; 130 is exit's own
   # Ctrl-C/Ctrl-D convention (128 + SIGINT) and what the fix now returns.
-  [ "$status" -ne 124 ] || { echo "tui_prompt_name spun until the outer timeout killed it:"; cat "$out"; false; }
+  [ "$status" -ne 124 ] || {
+    echo "tui_prompt_name spun until the outer timeout killed it:"
+    cat "$out"
+    false
+  }
   [ "$status" -eq 130 ]
 }
 
@@ -294,7 +324,7 @@ EOF
   command -v script >/dev/null || skip "script(1) not available"
 
   local driver="${BATS_TEST_TMPDIR}/drive-esc.sh"
-  cat > "$driver" <<EOF
+  cat >"$driver" <<EOF
 #!/usr/bin/env bash
 source "${SCAFFOLD_ROOT}/lib/log.sh"
 source "${SCAFFOLD_ROOT}/lib/project.sh"
@@ -303,10 +333,18 @@ tui_prompt_name >/dev/null
 EOF
 
   local out="${BATS_TEST_TMPDIR}/esc.log" status=0
-  { sleep 1; printf '\033'; sleep 1; } \
-    | timeout 10 script -qec "bash '${driver}'" /dev/null > "$out" 2>&1 || status=$?
-
-  [ "$status" -ne 124 ] || { echo "Esc did not cancel; the prompt spun until timeout:"; cat "$out"; false; }
+  {
+    sleep 1
+    printf '\033'
+    sleep 1
+  } |
+    timeout 10 script -qec "bash '${driver}'" /dev/null >"$out" 2>&1 || status=$?
+
+  [ "$status" -ne 124 ] || {
+    echo "Esc did not cancel; the prompt spun until timeout:"
+    cat "$out"
+    false
+  }
   [ "$status" -eq 130 ]
 }
 
@@ -317,7 +355,7 @@ EOF
   command -v script >/dev/null || skip "script(1) not available"
 
   local driver="${BATS_TEST_TMPDIR}/drive-bs.sh"
-  cat > "$driver" <<EOF
+  cat >"$driver" <<EOF
 #!/usr/bin/env bash
 source "${SCAFFOLD_ROOT}/lib/log.sh"
 source "${SCAFFOLD_ROOT}/lib/project.sh"
@@ -326,13 +364,25 @@ tui_prompt_name
 EOF
 
   local out="${BATS_TEST_TMPDIR}/bs.log"
-  { sleep 1; printf 'demoX\177\n'; sleep 1; } \
-    | timeout 10 script -qec "bash '${driver}'" /dev/null > "$out" 2>&1 || true
+  {
+    sleep 1
+    printf 'demoX\177\n'
+    sleep 1
+  } |
+    timeout 10 script -qec "bash '${driver}'" /dev/null >"$out" 2>&1 || true
 
   # The name is written to stdout; the prompt and its echo go to stderr, and
   # script merges both, so match the value rather than the whole stream.
-  grep -q 'demo' "$out" || { echo "no name in the output:"; cat "$out"; false; }
-  grep -qv 'demoX' "$out" || { echo "backspace did not remove the X:"; cat "$out"; false; }
+  grep -q 'demo' "$out" || {
+    echo "no name in the output:"
+    cat "$out"
+    false
+  }
+  grep -qv 'demoX' "$out" || {
+    echo "backspace did not remove the X:"
+    cat "$out"
+    false
+  }
 }
 
 @test "the header is printed once, not once per screen" {
@@ -342,13 +392,25 @@ EOF
   command -v script >/dev/null || skip "script(1) not available"
 
   local out="${BATS_TEST_TMPDIR}/header.log"
-  { sleep 1; printf 'demo-app\n'; sleep 1; printf '\n'; sleep 1; printf '\033'; sleep 1; } \
-    | timeout 25 script -qec "cd '${SCAFFOLD_ROOT}' && mise exec -- ./scaffold" /dev/null \
-    > "$out" 2>&1 || true
+  {
+    sleep 1
+    printf 'demo-app\n'
+    sleep 1
+    printf '\n'
+    sleep 1
+    printf '\033'
+    sleep 1
+  } |
+    timeout 25 script -qec "cd '${SCAFFOLD_ROOT}' && mise exec -- ./scaffold" /dev/null \
+      >"$out" 2>&1 || true
 
   local seen
   seen="$(grep -ac 'Project generator' "$out" || true)"
-  [ "$seen" -eq 1 ] || { echo "header appeared ${seen} times, expected 1:"; cat "$out"; false; }
+  [ "$seen" -eq 1 ] || {
+    echo "header appeared ${seen} times, expected 1:"
+    cat "$out"
+    false
+  }
 }
 
 @test "from inside a project the wizard reaches publish, not new" {
@@ -360,24 +422,41 @@ EOF
   local project="${BATS_TEST_TMPDIR}/inside"
   mkdir -p "$project"
   printf 'monorepo_root = true\n\n[vars]\nimage = "ghcr.io/acme/demo"\n' \
-    > "${project}/mise.toml"
+    >"${project}/mise.toml"
   git -C "$project" init -q -b main
 
   local out="${BATS_TEST_TMPDIR}/publish-session.log"
   {
-    sleep 1; printf '\x1b[B'; sleep 0.3; printf '\x1b[B'; sleep 0.3; printf '\n'  # action: publish
-    sleep 1; printf '\x1b[B'; sleep 0.3; printf '\n'                            # visibility: public
-    sleep 1; printf 'n\n'                                                       # do not publish
     sleep 1
-  } | ( cd "$project" && COLUMNS=90 LINES=45 script -qec \
-        "TERM=xterm-256color SCAFFOLD_WIZARD_DRY_RUN=1 '${SCAFFOLD_ROOT}/scaffold'" /dev/null ) \
-      > "$out" 2>&1 || true
-
-  strip_ansi "$out" | grep -q 'scaffold publish --public' \
-    || { echo "the wizard did not reach the expected command:"; cat "$out"; false; }
+    printf '\x1b[B'
+    sleep 0.3
+    printf '\x1b[B'
+    sleep 0.3
+    printf '\n' # action: publish
+    sleep 1
+    printf '\x1b[B'
+    sleep 0.3
+    printf '\n' # visibility: public
+    sleep 1
+    printf 'n\n' # do not publish
+    sleep 1
+  } | (cd "$project" && COLUMNS=90 LINES=45 script -qec \
+    "TERM=xterm-256color SCAFFOLD_WIZARD_DRY_RUN=1 '${SCAFFOLD_ROOT}/scaffold'" /dev/null) \
+    >"$out" 2>&1 || true
+
+  strip_ansi "$out" | grep -q 'scaffold publish --public' ||
+    {
+      echo "the wizard did not reach the expected command:"
+      cat "$out"
+      false
+    }
   # The name prompt belongs to `new` and must not have been asked.
-  strip_ansi "$out" | grep -qi 'project name' \
-    && { echo "publish asked for a project name:"; cat "$out"; false; }
+  strip_ansi "$out" | grep -qi 'project name' &&
+    {
+      echo "publish asked for a project name:"
+      cat "$out"
+      false
+    }
   return 0
 }
 
@@ -390,19 +469,31 @@ EOF
 
   local out="${BATS_TEST_TMPDIR}/session.log"
   {
-    sleep 1; printf 'wizard-demo\n'
-    sleep 1; printf '\x1b[B'; sleep 0.3; printf '\n'   # shape: app
-    sleep 1; printf '\n'                               # fullstack: laravel-inertia
-    sleep 1; printf '\n'                               # database: mysql
-    sleep 1; printf '\n'                               # cache: none
-    sleep 1; printf 'n\n'                              # do not generate
+    sleep 1
+    printf 'wizard-demo\n'
+    sleep 1
+    printf '\x1b[B'
+    sleep 0.3
+    printf '\n' # shape: app
+    sleep 1
+    printf '\n' # fullstack: laravel-inertia
+    sleep 1
+    printf '\n' # database: mysql
+    sleep 1
+    printf '\n' # cache: none
+    sleep 1
+    printf 'n\n' # do not generate
     sleep 1
   } | COLUMNS=90 LINES=45 script -qec \
-        "TERM=xterm-256color SCAFFOLD_WIZARD_DRY_RUN=1 '${SCAFFOLD_ROOT}/scaffold'" /dev/null \
-      > "$out" 2>&1 || true
+    "TERM=xterm-256color SCAFFOLD_WIZARD_DRY_RUN=1 '${SCAFFOLD_ROOT}/scaffold'" /dev/null \
+    >"$out" 2>&1 || true
 
-  strip_ansi "$out" | grep -q 'scaffold new wizard-demo --app laravel-inertia --db mysql --cache none' \
-    || { echo "the wizard did not reach the expected command:"; cat "$out"; false; }
+  strip_ansi "$out" | grep -q 'scaffold new wizard-demo --app laravel-inertia --db mysql --cache none' ||
+    {
+      echo "the wizard did not reach the expected command:"
+      cat "$out"
+      false
+    }
 }
 
 @test "typing an option's first letter selects it, not whatever Enter would default to" {
@@ -417,20 +508,31 @@ EOF
 
   local out="${BATS_TEST_TMPDIR}/session.log"
   {
-    sleep 1; printf 'wizard-demo\n'
-    sleep 1; printf '\n'                               # shape: web+api (first option)
-    sleep 1; printf '\n'                               # web: nextjs (only option)
-    sleep 1; printf 'l\n'                              # api: laravel-api
-    sleep 1; printf 'p\n'                              # database: postgres
-    sleep 1; printf 'r\n'                              # cache: redis
-    sleep 1; printf 'n\n'                              # do not generate
+    sleep 1
+    printf 'wizard-demo\n'
+    sleep 1
+    printf '\n' # shape: web+api (first option)
+    sleep 1
+    printf '\n' # web: nextjs (only option)
+    sleep 1
+    printf 'l\n' # api: laravel-api
+    sleep 1
+    printf 'p\n' # database: postgres
+    sleep 1
+    printf 'r\n' # cache: redis
+    sleep 1
+    printf 'n\n' # do not generate
     sleep 1
   } | COLUMNS=90 LINES=45 script -qec \
-        "TERM=xterm-256color SCAFFOLD_WIZARD_DRY_RUN=1 '${SCAFFOLD_ROOT}/scaffold'" /dev/null \
-      > "$out" 2>&1 || true
+    "TERM=xterm-256color SCAFFOLD_WIZARD_DRY_RUN=1 '${SCAFFOLD_ROOT}/scaffold'" /dev/null \
+    >"$out" 2>&1 || true
 
-  strip_ansi "$out" | grep -q 'scaffold new wizard-demo --web nextjs --api laravel-api --db postgres --cache redis' \
-    || { echo "typing did not select the named options:"; cat "$out"; false; }
+  strip_ansi "$out" | grep -q 'scaffold new wizard-demo --web nextjs --api laravel-api --db postgres --cache redis' ||
+    {
+      echo "typing did not select the named options:"
+      cat "$out"
+      false
+    }
 }
 
 @test "the header banner appears exactly once in a whole session" {
@@ -445,21 +547,33 @@ EOF
 
   local out="${BATS_TEST_TMPDIR}/session.log"
   {
-    sleep 1; printf 'wizard-demo\n'
-    sleep 1; printf '\x1b[B'; sleep 0.3; printf '\n'   # shape: app
-    sleep 1; printf '\n'                               # fullstack: laravel-inertia
-    sleep 1; printf '\n'                               # database: mysql
-    sleep 1; printf '\n'                               # cache: none
-    sleep 1; printf 'n\n'                              # do not generate
+    sleep 1
+    printf 'wizard-demo\n'
+    sleep 1
+    printf '\x1b[B'
+    sleep 0.3
+    printf '\n' # shape: app
+    sleep 1
+    printf '\n' # fullstack: laravel-inertia
+    sleep 1
+    printf '\n' # database: mysql
+    sleep 1
+    printf '\n' # cache: none
+    sleep 1
+    printf 'n\n' # do not generate
     sleep 1
   } | COLUMNS=90 LINES=45 script -qec \
-        "TERM=xterm-256color SCAFFOLD_WIZARD_DRY_RUN=1 '${SCAFFOLD_ROOT}/scaffold'" /dev/null \
-      > "$out" 2>&1 || true
+    "TERM=xterm-256color SCAFFOLD_WIZARD_DRY_RUN=1 '${SCAFFOLD_ROOT}/scaffold'" /dev/null \
+    >"$out" 2>&1 || true
 
   local count
   count="$(grep -cF 'Pick a stack — CI, containers and a release you can install' "$out")"
-  [ "$count" -eq 1 ] \
-    || { echo "expected the header to appear exactly once, got ${count}:"; cat "$out"; false; }
+  [ "$count" -eq 1 ] ||
+    {
+      echo "expected the header to appear exactly once, got ${count}:"
+      cat "$out"
+      false
+    }
 }
 
 @test "an answered question leaves exactly one line behind" {
@@ -489,16 +603,24 @@ EOF
   pane="$(tmux capture-pane -t "$session" -p)"
   tmux kill-session -t "$session" 2>/dev/null || true
 
-  [[ "$pane" != *"separate frontend and backend, one repository"* ]] \
-    || { echo "the answered question's option row is still on screen:"; echo "$pane"; false; }
+  [[ "$pane" != *"separate frontend and backend, one repository"* ]] ||
+    {
+      echo "the answered question's option row is still on screen:"
+      echo "$pane"
+      false
+    }
 
   # The gap is whatever wizard_prompt_width measured, so it is matched as a
   # run of spaces rather than counted: this test is about there being one
   # collapsed line, not about how wide the answer column happens to be.
   local collapsed
-  collapsed="$(grep -cE '✔ +What are you building\? +web\+api' <<< "$pane")"
-  [ "$collapsed" -eq 1 ] \
-    || { echo "expected exactly one collapsed line, got ${collapsed}:"; echo "$pane"; false; }
+  collapsed="$(grep -cE '✔ +What are you building\? +web\+api' <<<"$pane")"
+  [ "$collapsed" -eq 1 ] ||
+    {
+      echo "expected exactly one collapsed line, got ${collapsed}:"
+      echo "$pane"
+      false
+    }
 }
 
 @test "the header carries the wordmark, and drops it when it will not fit" {
@@ -526,14 +648,30 @@ EOF
   # drop is the wordmark's own and not a narrow terminal cutting everything.
   narrow="$(TERM=xterm-256color script -qec "stty cols 68 rows 40; bash -c \"${body}\"" /dev/null)"
 
-  grep -q '███████╗' <<<"$wide" \
-    || { echo "no wordmark at 100 columns:"; echo "$wide"; false; }
-  grep -q '…' <<<"$narrow" \
-    && { echo "the wordmark was ellipsised instead of dropped at 68 columns:"; echo "$narrow"; false; }
-  grep -q '███████╗' <<<"$narrow" \
-    && { echo "the wordmark was drawn at 68 columns, where it does not fit:"; echo "$narrow"; false; }
+  grep -q '███████╗' <<<"$wide" ||
+    {
+      echo "no wordmark at 100 columns:"
+      echo "$wide"
+      false
+    }
+  grep -q '…' <<<"$narrow" &&
+    {
+      echo "the wordmark was ellipsised instead of dropped at 68 columns:"
+      echo "$narrow"
+      false
+    }
+  grep -q '███████╗' <<<"$narrow" &&
+    {
+      echo "the wordmark was drawn at 68 columns, where it does not fit:"
+      echo "$narrow"
+      false
+    }
 
   # The rest of the header still has to be there in both.
-  grep -qF 'Pick a stack — CI, containers and a release you can install' <<<"$narrow" \
-    || { echo "the narrow header lost more than the wordmark:"; echo "$narrow"; false; }
+  grep -qF 'Pick a stack — CI, containers and a release you can install' <<<"$narrow" ||
+    {
+      echo "the narrow header lost more than the wordmark:"
+      echo "$narrow"
+      false
+    }
 }
diff --git a/tests/workflows.bats b/tests/workflows.bats
index 8228611..41edb2c 100644
--- a/tests/workflows.bats
+++ b/tests/workflows.bats
@@ -13,7 +13,7 @@ setup() {
   # a test that redirects HOME loses git's identity with it, and
   # GIT_AUTHOR_* does not satisfy `git config --get`. Write a real one.
   printf '[user]\n\tname = test\n\temail = test@example.com\n' \
-    > "${BATS_TEST_TMPDIR}/.gitconfig"
+    >"${BATS_TEST_TMPDIR}/.gitconfig"
   load 'helpers/setup'
   WORKDIR="$(mktemp -d)"
   PROJECT="${WORKDIR}/demo"
@@ -87,8 +87,8 @@ teardown() {
   # variable"), so the account this test detects cannot exist there. Skip with
   # the reason rather than fail on a fact about the environment.
   local account
-  account="$(gh api user --jq .login 2>/dev/null)" \
-    || skip "gh is not authenticated here, so there is no account to detect"
+  account="$(gh api user --jq .login 2>/dev/null)" ||
+    skip "gh is not authenticated here, so there is no account to detect"
   # HOME is redirected to hide git config's github.user, so gh's own config
   # has to be pointed back at the real one or this would test an
   # unauthenticated gh instead of a detected account.
@@ -141,8 +141,11 @@ teardown() {
       '${web_project}/.github/workflows/${file}.yml' \
       | jq -c 'map({context, dockerfile})'"
     assert_ok
-    [ "$output" = '[{"context":".","dockerfile":"apps/web/Dockerfile"}]' ] \
-      || { echo "${file}.yml builds: ${output}"; false; }
+    [ "$output" = '[{"context":".","dockerfile":"apps/web/Dockerfile"}]' ] ||
+      {
+        echo "${file}.yml builds: ${output}"
+        false
+      }
   done
 }
 
@@ -157,7 +160,10 @@ teardown() {
     run bash -c "yq -r '[.jobs[] | select(has(\"with\")) | .with.images] | .[0]' \
       '${bare}/.github/workflows/${file}.yml'"
     assert_ok
-    [ "$output" = "[]" ] || { echo "${file}.yml publishes: ${output}"; false; }
+    [ "$output" = "[]" ] || {
+      echo "${file}.yml publishes: ${output}"
+      false
+    }
   done
 }
 
@@ -205,7 +211,8 @@ teardown() {
 }
 
 @test "an adapter with an unrecognised ADAPTER_TIER fails loudly instead of vanishing" {
-  local toolbox; toolbox="$(copy_toolbox)"
+  local toolbox
+  toolbox="$(copy_toolbox)"
   sed -i 's/ADAPTER_TIER="A"/ADAPTER_TIER="Z"/' "${toolbox}/adapters/nextjs/adapter.env"
   run "${toolbox}/scripts/adapter-matrix.sh" schedule "23 2 * * 1"
   [ "$status" -eq 1 ]
@@ -214,7 +221,8 @@ teardown() {
 }
 
 @test "an adapter missing ADAPTER_TIER entirely fails loudly instead of crashing blind" {
-  local toolbox; toolbox="$(copy_toolbox)"
+  local toolbox
+  toolbox="$(copy_toolbox)"
   sed -i '/^ADAPTER_TIER=/d' "${toolbox}/adapters/nextjs/adapter.env"
   run "${toolbox}/scripts/adapter-matrix.sh" schedule "23 2 * * 1"
   [ "$status" -eq 1 ]
@@ -280,8 +288,14 @@ teardown() {
   # line fail loudly instead of silently shipping an untested combination.
   local db_expected cache_expected db_actual cache_actual
 
-  db_expected="$( { scaffold list --services | awk -F'\t' '$2 == "database" { print $1 }'; echo none; } | sort )"
-  cache_expected="$( { scaffold list --services | awk -F'\t' '$2 == "cache" { print $1 }'; echo none; } | sort )"
+  db_expected="$({
+    scaffold list --services | awk -F'\t' '$2 == "database" { print $1 }'
+    echo none
+  } | sort)"
+  cache_expected="$({
+    scaffold list --services | awk -F'\t' '$2 == "cache" { print $1 }'
+    echo none
+  } | sort)"
 
   db_actual="$(yq -r '.jobs.services.strategy.matrix.db[]' "${SCAFFOLD_ROOT}/.github/workflows/adapters.yml" | sort)"
   cache_actual="$(yq -r '.jobs.services.strategy.matrix.cache[]' "${SCAFFOLD_ROOT}/.github/workflows/adapters.yml" | sort)"