diff --git a/.gitignore b/.gitignore
index 360c10bc..f54094be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -475,3 +475,7 @@ target/
 !**/.vscode/*
 !**/.idea/
 !**/.idea/**
+
+# Generated by nginx/ssl/generate-cert.sh -- never commit a private key.
+Programming/ERSMS-project/nginx/ssl/nginx.key
+Programming/ERSMS-project/nginx/ssl/nginx.crt
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 00000000..b4033e8a
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,71 @@
+# Install:    ./install.sh   (or: pre-commit install && pre-commit install --hook-type pre-push)
+# Fast lint:  pre-commit run --all-files
+#
+# Ordering rule for this repo: a hook lands only once the thing it gates is
+# already clean, so `pre-commit run --all-files` is green at every commit.
+# Hooks still to come, each blocked on its own cleanup:
+#   - file-length      blocked on the .tex/code splits and TODO-file-length-250.md
+#   - ruff / mypy      blocked on the root pyproject.toml (Milestone 4)
+#   - dependency-freshness  blocked on the upgrade itself; the gate and the
+#                      upgrade must land in the SAME commit or the repo is
+#                      instantly and permanently red
+#   - trailing-whitespace / end-of-file-fixer  these REWRITE files, so they get
+#                      their own reviewed cleanup commit first
+default_language_version:
+  python: python3
+default_stages: [pre-commit]
+fail_fast: false
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      # Structural checks only -- none of these rewrite a file.
+      - id: check-merge-conflict
+      - id: check-case-conflict
+      - id: check-symlinks
+      - id: destroyed-symlinks
+      - id: detect-private-key
+      # tsconfig*.json and .vscode/*.json are JSONC -- both TypeScript and
+      # VS Code document comments and trailing commas as valid there, and
+      # check-json uses a strict RFC parser. This is the wrong parser for
+      # those files, not a defect being suppressed; every other .json is
+      # still checked. (The one real failure this hook found, a committed
+      # merge conflict in EARIN/.vscode/extensions.json, is fixed.)
+      - id: check-json
+        exclude: |
+          (?x)^(
+            .*/tsconfig[^/]*\.json|
+            .*/\.vscode/[^/]*\.json
+          )$
+      - id: check-toml
+      - id: check-yaml
+        args: [--unsafe]
+      # 2 MB. The four 39 MB movies.csv copies are already tracked and stay
+      # (approved decision 6); this stops the NEXT one.
+      - id: check-added-large-files
+        args: [--maxkb=2000]
+
+  - repo: local
+    hooks:
+      # Coursework deliverables are allowed under the two course trees;
+      # compiled output is allowed nowhere. See .binary-allowlist.
+      - id: no-binaries
+        name: block binary files outside the allowlist
+        entry: scripts/check_no_binaries.sh
+        language: script
+        pass_filenames: true
+
+      # Thin shim into ~/utils, which owns the four markdown namespaces.
+      - id: md-naming
+        name: markdown naming convention
+        entry: scripts/check_md_naming.sh
+        language: system
+        files: \.(md|markdown)$
+
+      - id: shellcheck
+        name: shellcheck
+        entry: bash -c 'printf "%s\0" "$@" | xargs -0 -n 40 shellcheck' --
+        language: system
+        types: [shell]
+        exclude_types: [zsh]
diff --git a/Programming/BD2/monorepo/create_database.sh b/Programming/BD2/monorepo/create_database.sh
index f8c90fb3..b1d3dd40 100755
--- a/Programming/BD2/monorepo/create_database.sh
+++ b/Programming/BD2/monorepo/create_database.sh
@@ -35,7 +35,7 @@ $INSTALL_CMD postgresql
 
 # Initialize the database cluster (Arch only)
 if [[ $INSTALL_CMD == *"pacman"* ]]; then
-    sudo -iu postgres initdb --locale $LANG -E UTF8 -D "$CONFIG_DIR"
+    sudo -iu postgres initdb --locale "$LANG" -E UTF8 -D "$CONFIG_DIR"
 fi
 
 # Start and enable PostgreSQL service
@@ -62,5 +62,5 @@ $SERVICE_CMD restart postgresql
 export DATABASE_URL="postgresql://$DB_USER:$DB_PASSWORD@localhost:$DB_PORT/$DB_NAME?schema=$DB_SCHEMA"
 
 # Print the DATABASE_URL to verify
-echo "DATABASE_URL="$DATABASE_URL""
+echo "DATABASE_URL=$DATABASE_URL"
 echo "PostgreSQL setup is complete. The database is accessible at the specified URL."
diff --git a/Programming/BD2/monorepo/generate.sh b/Programming/BD2/monorepo/generate.sh
index e3cddab0..8cf7e399 100755
--- a/Programming/BD2/monorepo/generate.sh
+++ b/Programming/BD2/monorepo/generate.sh
@@ -1,5 +1,8 @@
 #!/bin/bash
 
+#
+# Scaffold an Angular component per data model.
+set -euo pipefail
 # Define the project name
 PROJECT_NAME="frontend"
 
@@ -17,7 +20,7 @@ generate_module_and_service() {
 
   # nx g @nrwl/nest:controller ${MODULE_NAME} --directory=apps/${PROJECT_NAME}/src/app/${MODULE_NAME}
 
-  nx g @nx/angular:component ${MODULE_NAME} --directory=apps/${PROJECT_NAME}/src/app/${MODULE_NAME}
+  nx g @nx/angular:component "${MODULE_NAME}" --directory="apps/${PROJECT_NAME}/src/app/${MODULE_NAME}"
 }
 
 # List of all models for which we need to generate modules and services
@@ -25,7 +28,7 @@ MODELS=("restauracja" "recenzja" "uzytkownik" "historia-zamowien" "danie" "zamow
 
 # Loop through the models and generate modules and services
 for MODEL in "${MODELS[@]}"; do
-  generate_module_and_service ${MODEL}
+  generate_module_and_service "${MODEL}"
 done
 
 echo "All modules and services have been generated successfully."
diff --git a/Programming/BD2/monorepo/run.sh b/Programming/BD2/monorepo/run.sh
index 67a92dc1..3d2e0d3f 100755
--- a/Programming/BD2/monorepo/run.sh
+++ b/Programming/BD2/monorepo/run.sh
@@ -1,5 +1,14 @@
-#!/bin/sh
-cd apps/backend
-npx prisma generate
-cd ../../
+#!/bin/bash
+#
+# Generate the Prisma client, then serve frontend and backend together.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly SCRIPT_DIR
+
+# A subshell keeps the cd local, so a failure cannot leave the caller in
+# apps/backend and run the next command in the wrong directory.
+(cd "${SCRIPT_DIR}/apps/backend" && npx prisma generate)
+
+cd "$SCRIPT_DIR"
 nx run-many --target=serve --projects=frontend,backend --parallel
diff --git a/Programming/E-PSYOPS/theProject/Assets/Prefabs.meta b/Programming/E-PSYOPS/theProject/Assets/Prefabs.meta
index 183bdaad..37d4a05f 100644
--- a/Programming/E-PSYOPS/theProject/Assets/Prefabs.meta
+++ b/Programming/E-PSYOPS/theProject/Assets/Prefabs.meta
@@ -1,9 +1,5 @@
 fileFormatVersion: 2
-<<<<<<< HEAD
 guid: 08cb4bdcfd1a3d9198e1d7ccfee220d2
-=======
-guid: 5939f2b8303b5cd46afe044fb9d1709e
->>>>>>> 98112df (added TickSystem and an example tick receiver)
 folderAsset: yes
 DefaultImporter:
   externalObjects: {}
diff --git a/Programming/E-PSYOPS/theProject/Assets/Scripts.meta b/Programming/E-PSYOPS/theProject/Assets/Scripts.meta
index dc653b35..8dc8f7f0 100644
--- a/Programming/E-PSYOPS/theProject/Assets/Scripts.meta
+++ b/Programming/E-PSYOPS/theProject/Assets/Scripts.meta
@@ -1,9 +1,5 @@
 fileFormatVersion: 2
-<<<<<<< HEAD
 guid: c970975bb706c3e158e7748ebf7f5284
-=======
-guid: 0249b4cbd93f42540a182f30adbb10bc
->>>>>>> 98112df (added TickSystem and an example tick receiver)
 folderAsset: yes
 DefaultImporter:
   externalObjects: {}
diff --git a/Programming/EARIN/.gitignore b/Programming/EARIN/.gitignore
index 8593cf5d..e046a72c 100644
--- a/Programming/EARIN/.gitignore
+++ b/Programming/EARIN/.gitignore
@@ -1,10 +1,8 @@
-<<<<<<< HEAD
 *.swp
 .DS_Store
 bin/configlet
 bin/configlet.exe
 temp.pl
-=======
 database
 test_results
 anime_with_synopsis.csv
@@ -314,4 +312,3 @@ TSWLatexianTemp*
 # option is specified. Footnotes are the stored in a file with suffix Notes.bib.
 # Uncomment the next line to have this generated file ignored.
 #*Notes.bib
->>>>>>> project/main
diff --git a/Programming/EARIN/.vscode/extensions.json b/Programming/EARIN/.vscode/extensions.json
index 271359ec..4c0a18fa 100644
--- a/Programming/EARIN/.vscode/extensions.json
+++ b/Programming/EARIN/.vscode/extensions.json
@@ -1,20 +1,12 @@
 {
-<<<<<<< HEAD
     "recommendations": [
-<<<<<<< HEAD
         "ms-python.python",
         "ms-python.pylint",
         "mikoz.black-py",
         "james-yu.latex-workshop",
         "kisstkondoros.vscode-gutter-preview",
         "streetsidesoftware.code-spell-checker",
-        "wesbos.theme-cobalt2"
-=======
+        "wesbos.theme-cobalt2",
         "rebornix.prolog"
->>>>>>> lab7/main
     ]
 }
-=======
-  "recommendations": ["james-yu.latex-workshop"]
-}
->>>>>>> project/main
diff --git a/Programming/EOPSY/lab1/modify.sh b/Programming/EOPSY/lab1/modify.sh
index 49e18e34..7499953c 100755
--- a/Programming/EOPSY/lab1/modify.sh
+++ b/Programming/EOPSY/lab1/modify.sh
@@ -4,7 +4,7 @@
 
 # the name of the script without a path
 
-name=`basename $0`
+name="$(basename "$0")"
 
 help()
 {
@@ -21,7 +21,7 @@ help()
 
 uppercase()
 {
-	if test "$1" = $name
+	if test "$1" = "$name"
 	then
 		error_msg "you cannot modify name of this script!"
 		exit 3
@@ -42,7 +42,7 @@ uppercase()
                 fi
         fi
 
-	mv "$1" $(echo "$1" | sed -r -e 's/.*/\U&/');
+	mv "$1" "$(echo "$1" | sed -r -e 's/.*/\U&/')";
 
 		
 
@@ -50,7 +50,7 @@ uppercase()
 
 lowercase()
 {
-	if test "$1" = $name
+	if test "$1" = "$name"
         then
                 error_msg "you cannot modify name of this script!"
                 exit 3
@@ -68,12 +68,12 @@ lowercase()
 			exit 2
 		fi
 	fi
-	mv "$1" $(echo "$1" | sed -r -e 's/.*/\L&/');
+	mv "$1" "$(echo "$1" | sed -r -e 's/.*/\L&/')";
 }
 
 sneed()
 {
-	if test "$2" = $name
+	if test "$2" = "$name"
         then
                 error_msg "you cannot modify name of this script!"
                 exit 3
@@ -97,7 +97,7 @@ sneed()
                 fi
         fi
 
-	mv "$2" $(echo "$2" | sed $1)
+	mv "$2" "$(echo "$2" | sed "$1")"
 }
 
 recursionSneed()
@@ -124,8 +124,8 @@ recursionSneed()
 	fi
 	filename="$2"
 	sneed "$1" "$filename" 
-	filename="$(echo "$filename" | sed $1)"
-	echo $filename
+	filename="$(echo "$filename" | sed "$1")"
+	echo "$filename"
         for item in "$filename"/*
         do
                 if test -d "$item"
diff --git a/Programming/EOPSY/lab1/modify_examples.sh b/Programming/EOPSY/lab1/modify_examples.sh
index 877a1641..1d640aa3 100755
--- a/Programming/EOPSY/lab1/modify_examples.sh
+++ b/Programming/EOPSY/lab1/modify_examples.sh
@@ -6,33 +6,19 @@ touch SED
 mkdir foldera
 mkdir FOLDERB
 mkdir FOLDERSED
-mkdir upperfoldermain
-cd upperfoldermain
-touch upperfilesub
-mkdir upperfoldersub
-cd upperfoldersub
-touch upperfilesubsub
-cd ..
-cd ..
+# Build the fixture tree with paths rather than cd/cd .., so a failed cd
+# cannot silently create the next level in the wrong directory.
+mkdir -p upperfoldermain/upperfoldersub
+touch upperfoldermain/upperfilesub
+touch upperfoldermain/upperfoldersub/upperfilesubsub
 
+mkdir -p LOWERCASEFOLDERMAIN/LOWERFOLDERSUB
+touch LOWERCASEFOLDERMAIN/LOWERFILESUB
+touch LOWERCASEFOLDERMAIN/LOWERFOLDERSUB/LOWERFILESUBSUB
 
-mkdir LOWERCASEFOLDERMAIN 
-cd LOWERCASEFOLDERMAIN
-touch LOWERFILESUB
-mkdir LOWERFOLDERSUB
-cd LOWERFOLDERSUB
-touch LOWERFILESUBSUB
-cd ..
-cd ..
-
-mkdir SEDLOWERCASEFOLDERMAIN
-cd SEDLOWERCASEFOLDERMAIN
-touch SEDLOWERFILESUB
-mkdir SEDLOWERFOLDERSUB
-cd SEDLOWERFOLDERSUB
-touch SEDLOWERFILESUBSUB
-cd ..
-cd ..
+mkdir -p SEDLOWERCASEFOLDERMAIN/SEDLOWERFOLDERSUB
+touch SEDLOWERCASEFOLDERMAIN/SEDLOWERFILESUB
+touch SEDLOWERCASEFOLDERMAIN/SEDLOWERFOLDERSUB/SEDLOWERFILESUBSUB
 
 touch recursefile
 touch RECURSELOWERFILE
diff --git a/Programming/ERSMS-project/nginx/ssl/generate-cert.sh b/Programming/ERSMS-project/nginx/ssl/generate-cert.sh
new file mode 100755
index 00000000..e0e27c83
--- /dev/null
+++ b/Programming/ERSMS-project/nginx/ssl/generate-cert.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+# ============================================================================
+# Generate the self-signed localhost certificate nginx uses in docker-compose.
+#
+# The pair used to be committed. It was a throwaway CN=localhost cert that had
+# already expired (notAfter 2025-06-16), so nothing depended on those exact
+# bytes -- but a private key does not belong in a public repository, and this
+# one is one command to recreate.
+#
+# NOTE: removing it from HEAD does not unpublish it. The key is still in git
+# history, which is deliberately not rewritten. That is acceptable ONLY because
+# this is an expired self-signed localhost cert with no trust path. A key that
+# ever protected anything real would have to be rotated, not just deleted.
+#
+# Usage: bash generate-cert.sh
+# ============================================================================
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly SCRIPT_DIR
+readonly DAYS=365
+
+main() {
+    if ! command -v openssl > /dev/null 2>&1; then
+        echo "error: openssl is required" >&2
+        exit 1
+    fi
+
+    openssl req -x509 -nodes -newkey rsa:2048 \
+        -keyout "${SCRIPT_DIR}/nginx.key" \
+        -out "${SCRIPT_DIR}/nginx.crt" \
+        -days "$DAYS" \
+        -subj "/CN=localhost" 2> /dev/null
+
+    chmod 600 "${SCRIPT_DIR}/nginx.key"
+    echo "==> wrote nginx.crt and nginx.key (self-signed, ${DAYS} days)"
+}
+
+main "$@"
diff --git a/Programming/ERSMS-project/nginx/ssl/nginx.crt b/Programming/ERSMS-project/nginx/ssl/nginx.crt
deleted file mode 100644
index 1f0f30f1..00000000
--- a/Programming/ERSMS-project/nginx/ssl/nginx.crt
+++ /dev/null
@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDCTCCAfGgAwIBAgIUaPIEdr82RMes6XSaYOB55pQbYDswDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI0MDYxNjIxNTYxNloXDTI1MDYx
-NjIxNTYxNlowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAlgWNGOpLB7FonzAvxoMmcDKu7SJDAnBd8HnrswRb4noI
-HCy2b3JOYi5RU66AGfDB9N4YFkhSNYkjSGLQdmoPqFoR5IyFAtvdGQUsAhRl4YP9
-/ust4NlPAVfxYPGhHyrpPozJK/RYIFcwPDKgMEEI636jHWw6mJaOsVgiMpQgs9oM
-V4b5b9LfB6wD72pi6Ag6xMi5PUvj91UfvkR59Gy844zriyV094saxwBRCL6naSMA
-vToVFIcaGCIXHfO2DiTVq4dDkCkHYRiva64UcV08x0I2GyxNLCUsjgDrQy/pRfdn
-QE1QO55LoDk4SI3U0PSGCyBMg0Kr7eC+6MwhjI/2ewIDAQABo1MwUTAdBgNVHQ4E
-FgQUZQxFwZhHP7+N2huK4T8S4+dCMoIwHwYDVR0jBBgwFoAUZQxFwZhHP7+N2huK
-4T8S4+dCMoIwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEALTJ4
-1bql/QkcM7t3DSCm7H7NK0fW9+3G/FYtCQUxvs3+rFvxymHbwHERbR1AReJy2Brx
-ayNMQNUA48sUa2VsRxEv1f/Qb5WVue3rIonugZ792bsI+6yMVxYVt97ETAnalSH4
-L3kWqGWJnkyfMm3RB7sGEFVnO2/s+vEhbzCRpCt2qda1pXPIBagPSCFm3InU9+Tq
-2bDsASuUEEz7RWTPa/R1qkCU5Sl3+CZUpTIpRDxB2MCaGk+FXQ9u2CpZBiZDOL/p
-e0Af5yhYlNBHp+Ut+N1kQSKKyOqlrqkN92nx7NLqOYBkjfkns9lTciyKiKefq08G
-qesECi3RgXXuG6xv5Q==
------END CERTIFICATE-----
diff --git a/Programming/ERSMS-project/nginx/ssl/nginx.key b/Programming/ERSMS-project/nginx/ssl/nginx.key
deleted file mode 100644
index f93c93b0..00000000
--- a/Programming/ERSMS-project/nginx/ssl/nginx.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCWBY0Y6ksHsWif
-MC/GgyZwMq7tIkMCcF3weeuzBFvieggcLLZvck5iLlFTroAZ8MH03hgWSFI1iSNI
-YtB2ag+oWhHkjIUC290ZBSwCFGXhg/3+6y3g2U8BV/Fg8aEfKuk+jMkr9FggVzA8
-MqAwQQjrfqMdbDqYlo6xWCIylCCz2gxXhvlv0t8HrAPvamLoCDrEyLk9S+P3VR++
-RHn0bLzjjOuLJXT3ixrHAFEIvqdpIwC9OhUUhxoYIhcd87YOJNWrh0OQKQdhGK9r
-rhRxXTzHQjYbLE0sJSyOAOtDL+lF92dATVA7nkugOThIjdTQ9IYLIEyDQqvt4L7o
-zCGMj/Z7AgMBAAECggEAEYz2s8p9GppLpgvqGuwu7ANR6ZYPhtKEeuSYiWniIf2q
-wzkL4r/ZoazPgN2ySNacqjvtT3YIgBDaGtbMkn3X9RcMbtNtoCb+l7W+L0QZoydg
-6Ji01lA16O9T4saB1facMOAhjM3aHXZ1wyUdDmgdVgeLp56IwF8ktGSeI5KmvMOA
-tHH20ZaG0Iy9kHjqgnRTKsF1giUl4XtNR0tbzVBdzvXZz8BPzAtNkC0QwcA3r6Mr
-PRzpelCQ9cFdbbpssy73aZ4cu30nVYdIuHFCmB25QdOt6Uzo4yoxmUK3PSKjf0py
-Ow5fHN5UqB1vZ0C/zNAapeg9elZvsYMU+LSUkGknaQKBgQDNfBb/FasjhPLstiHR
-U8LXTLinsU5qtKDVQIEpxQOub3lwRFs8bK0T2PfdbNJqUv55B301ORpbyqXLWS9N
-BNEUWkQ0Tpw9CsnItENvQnObUh6iIPU0uKLSp8Vnj4v3zOLfAMBZMitqbituqooE
-rrXmv9Oy3Sa/G1gX6HC7Hrdv/wKBgQC65vfMjmYXXRL47puTkfkBVWIZPV5WNq2F
-VnEarBUcO4ZqwweKKzO38mLXFWVcxz9QGzznoR/ndi1KGJSmBPbYPJwIKEcUCgZv
-25QUsVstV7mB2O53YEYfr4eGx0+lacofSYOcNV//Mrf1VcEQn8stme+hRp3xsvRa
-FAni8K05hQKBgQCWc8IeuU3aLvDzMpPmQa8Klwko92CULncITTeFTtRYNxSyh8pJ
-nsTHIHizrocOBICAO2SIwKu1A9aK4l0IxnsTrNf9eIVbCHggNSSe5QfidKkrSnhf
-RsUo+mBGaEsyf9ipMVKkvGAfiFTSrZlqvkU/k7q8XsKM8Md6kd1glKf5HwKBgGp0
-Q4/vS5bjHHtM7LAQ5JMt3sIhgin42rynj6Rxf1SlUtpcW18HXF3ZYRLAzQsbMaSe
-3wHPdCyR0xnxBjnJeg+P9g9vYYy4aRItLxraKeSZor+in7C+1TIW+Ep8G5FLwCQx
-6xR+Ej940+6Y+W5OlZtTonlpj2yrUSI9Z6QrEX9BAoGADH9nrJ+Gl6GaTEtlTHUQ
-XbQLmlfffQPIvc+v6z6TAvuULqQrK/Tya8s5dqDmM+RfoU12vij4yCblChDo8Pef
-IgInN2S7hmuMHVB5QdVHoiHzVnryIsr29fR9jDp3QP7AnnFJbZ5sOQxId+0KpYtG
-ZTcpATmbdu3hUJSNSpK1+ig=
------END PRIVATE KEY-----
diff --git a/Programming/PSD/run.sh b/Programming/PSD/run.sh
index 4e166bc7..9bf28073 100755
--- a/Programming/PSD/run.sh
+++ b/Programming/PSD/run.sh
@@ -2,7 +2,7 @@
 
 # Function to run a script in the background and save its PID
 run_script() {
-    python $1 &
+    python "$1" &
     echo $!
 }
 
@@ -25,9 +25,7 @@ install_flink() {
             echo "yay is not installed. Installing yay..."
             sudo pacman -S --noconfirm git
             git clone https://aur.archlinux.org/yay.git
-            cd yay
-            makepkg -si --noconfirm
-            cd ..
+            ( cd yay && makepkg -si --noconfirm )
             rm -rf yay
         fi
         yay -S --noconfirm apache-flink
@@ -80,10 +78,10 @@ echo "Started Flask alarm reader with PID $flask_pid"
 # Function to handle script termination
 terminate_scripts() {
     echo "Shutting down..."
-    kill $producer_pid
-    kill $consumer_pid
-    kill $flink_pid
-    kill $flask_pid
+    kill "$producer_pid"
+    kill "$consumer_pid"
+    kill "$flink_pid"
+    kill "$flask_pid"
     echo "All processes terminated."
     # Optionally stop Kafka and Flink services
     sudo systemctl stop kafka
diff --git a/Programming/PSD/zin3/python/setup_environment.sh b/Programming/PSD/zin3/python/setup_environment.sh
index 8743c947..e13c30a5 100755
--- a/Programming/PSD/zin3/python/setup_environment.sh
+++ b/Programming/PSD/zin3/python/setup_environment.sh
@@ -3,7 +3,9 @@
 # Configuration
 VENV_NAME="psd_env"
 VENV_PATH="$(pwd)/${VENV_NAME}"
-PYTHON_VERSION="3.8"  # Specify the Python version you want to use
+# Recorded for reference: the interpreter this project was developed against.
+# Not used by the script, which takes whatever python3 is on PATH.
+export PYTHON_VERSION="3.8"
 REQUIREMENTS=(
     "confluent-kafka"
     "apache-flink"
@@ -21,8 +23,7 @@ fi
 # Create virtual environment if it doesn't exist
 if [ ! -d "$VENV_PATH" ]; then
     echo "Creating virtual environment at $VENV_PATH..."
-    python3 -m venv "$VENV_PATH"
-    if [ $? -ne 0 ]; then
+    if ! python3 -m venv "$VENV_PATH"; then
         echo "Failed to create virtual environment. Please check your Python installation."
         exit 1
     fi
@@ -33,8 +34,8 @@ fi
 
 # Activate virtual environment
 echo "Activating virtual environment..."
-source "${VENV_PATH}/bin/activate"
-if [ $? -ne 0 ]; then
+# shellcheck source=/dev/null
+if ! source "${VENV_PATH}/bin/activate"; then
     echo "Failed to activate virtual environment."
     exit 1
 fi
@@ -48,8 +49,7 @@ echo "Checking and installing required packages..."
 for package in "${REQUIREMENTS[@]}"; do
     if ! pip show "$package" &> /dev/null; then
         echo "Installing $package..."
-        pip install "$package"
-        if [ $? -ne 0 ]; then
+        if ! pip install "$package"; then
             echo "Failed to install $package."
             exit 1
         fi
diff --git a/Programming/PSD/zin3/third/run_all.sh b/Programming/PSD/zin3/third/run_all.sh
index 9ebcc2d0..9b6fab54 100755
--- a/Programming/PSD/zin3/third/run_all.sh
+++ b/Programming/PSD/zin3/third/run_all.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Set working directory to script location
-cd "$(dirname "$0")"
+cd "$(dirname "$0")" || exit 1
 
 # Check if Docker daemon is running
 if ! docker info &>/dev/null; then
@@ -33,24 +33,18 @@ echo "Starting all applications..."
 
 # Start temperature anomaly detector - submit to Flink
 echo "Starting Temperature Anomaly Detector..."
-cd temperature-anomaly-detector
-java -jar target/temperature-anomaly-detector-1.0-SNAPSHOT.jar &
+( cd temperature-anomaly-detector && exec java -jar target/temperature-anomaly-detector-1.0-SNAPSHOT.jar ) &
 ANOMALY_PID=$!
-cd ..
 
 # Start Alert Visualizer
 echo "Starting Temperature Alert Visualizer..."
-cd temperature-alert-visualizer
-java -jar target/temperature-alert-visualizer-1.0-SNAPSHOT.jar &
+( cd temperature-alert-visualizer && exec java -jar target/temperature-alert-visualizer-1.0-SNAPSHOT.jar ) &
 VISUALIZER_PID=$!
-cd ..
 
 # Start Temperature Generator last
 echo "Starting Temperature Generator..."
-cd temperature-generator
-java -jar target/temperature-generator-1.0-SNAPSHOT.jar &
+( cd temperature-generator && exec java -jar target/temperature-generator-1.0-SNAPSHOT.jar ) &
 GENERATOR_PID=$!
-cd ..
 
 echo "All applications are running!"
 echo "Press Ctrl+C to stop all applications"
diff --git a/Programming/TRAK/code/photonmapping/cpp/compile.sh b/Programming/TRAK/code/photonmapping/cpp/compile.sh
index 19b163a4..5b9d91af 100755
--- a/Programming/TRAK/code/photonmapping/cpp/compile.sh
+++ b/Programming/TRAK/code/photonmapping/cpp/compile.sh
@@ -1 +1,6 @@
-g++ -O2 main.cpp -o photon_mapping
\ No newline at end of file
+#!/bin/bash
+#
+# Build the photon-mapping demo.
+set -euo pipefail
+
+g++ -O2 main.cpp -o photon_mapping
diff --git a/Programming/TRAK/init.sh b/Programming/TRAK/init.sh
index d067ab25..dbe3e8f1 100755
--- a/Programming/TRAK/init.sh
+++ b/Programming/TRAK/init.sh
@@ -1,5 +1,10 @@
 #!/bin/bash
+#
+# Create the project virtualenv. Source this file rather than running it if you
+# want the activation to persist in your shell: `source init.sh`.
+set -euo pipefail
 
 pyenv local 3.11
 python -m venv ./venv
-source ./venv/bin/activate
\ No newline at end of file
+# shellcheck source=/dev/null
+source ./venv/bin/activate
diff --git a/Programming/psd_project/run_all.sh b/Programming/psd_project/run_all.sh
index 3f04ca72..2fe98f50 100755
--- a/Programming/psd_project/run_all.sh
+++ b/Programming/psd_project/run_all.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Set working directory to script location
-cd "$(dirname "$0")"
+cd "$(dirname "$0")" || exit 1
 
 # Check if Docker daemon is running
 if ! docker info &>/dev/null; then
@@ -33,31 +33,23 @@ echo "Starting all applications..."
 
 # Start Flink job (Anomaly Detector)
 echo "Starting Anomaly Detector..."
-cd anomaly-detector
-java --add-opens java.base/java.time=ALL-UNNAMED -jar target/anomaly-detector-1.0-SNAPSHOT.jar &
+( cd anomaly-detector && exec java --add-opens java.base/java.time=ALL-UNNAMED -jar target/anomaly-detector-1.0-SNAPSHOT.jar ) &
 ANOMALY_PID=$!
-cd ..
 
 # Start Alert Visualizer
 echo "Starting Alert Visualizer..."
-cd alarm-visualizer
-java --add-opens java.base/java.time=ALL-UNNAMED -jar target/alarm-visualizer-1.0-SNAPSHOT.jar &
+( cd alarm-visualizer && exec java --add-opens java.base/java.time=ALL-UNNAMED -jar target/alarm-visualizer-1.0-SNAPSHOT.jar ) &
 ALARM_PID=$!
-cd ..
 
 # Start Transaction Consumer/Visualizer
 echo "Starting Transaction Consumer..."
-cd kafka-consumer-visualizer
-java --add-opens java.base/java.time=ALL-UNNAMED -jar target/kafka-consumer-visualizer-1.0-SNAPSHOT.jar &
+( cd kafka-consumer-visualizer && exec java --add-opens java.base/java.time=ALL-UNNAMED -jar target/kafka-consumer-visualizer-1.0-SNAPSHOT.jar ) &
 CONSUMER_PID=$!
-cd ..
 
 # Start Transaction Producer last
 echo "Starting Transaction Producer..."
-cd transaction-simulator
-java --add-opens java.base/java.time=ALL-UNNAMED -jar target/transaction-simulator-1.0-SNAPSHOT.jar &
+( cd transaction-simulator && exec java --add-opens java.base/java.time=ALL-UNNAMED -jar target/transaction-simulator-1.0-SNAPSHOT.jar ) &
 PRODUCER_PID=$!
-cd ..
 
 echo "All applications are running!"
 echo "Press Ctrl+C to stop all applications"
diff --git a/scripts/check_md_naming.sh b/scripts/check_md_naming.sh
new file mode 100755
index 00000000..50deaa00
--- /dev/null
+++ b/scripts/check_md_naming.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# ============================================================================
+# Fail if any markdown file breaks the shared naming convention.
+#
+# Thin delegate to the shared gate in ~/utils, which owns the four namespaces
+# (README / CLAUDE* / DOCS* / TODO*), the "REMOVE ME AFTER FINISH" marker rule
+# and the exemption list. Copying that logic here is what lets one repo's idea
+# of a valid name drift from every other repo's -- so this script only locates
+# the shared checker and forwards its arguments.
+#
+# Usage:
+#   scripts/check_md_naming.sh <file> [<file> ...]   # pre-commit passes these
+#   scripts/check_md_naming.sh --all                 # whole tree, from cwd
+# ============================================================================
+
+set -euo pipefail
+
+readonly SHARED_GATE="${UTILS_ROOT:-$HOME/utils}/scripts/check_md_naming.sh"
+
+main() {
+    if [[ ! -x "$SHARED_GATE" ]]; then
+        echo "Error: shared markdown-naming gate not found at $SHARED_GATE" >&2
+        echo "       Clone github.com/kuhyx/utils to ~/utils, or set" >&2
+        echo "       UTILS_ROOT to where it lives." >&2
+        exit 1
+    fi
+
+    exec bash "$SHARED_GATE" "$@"
+}
+
+main "$@"