diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index 4760524..85310bd 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -12,9 +12,7 @@ steps:
   - name: shellcheck
     image: koalaman/shellcheck-alpine:stable
     commands:
-      # Report warnings but don't block CI — existing code has known issues
-      # TODO: fix all warnings (#45) and remove || true
-      - find . -name "*.sh" -not -path "./.git/*" -print0 | xargs -0 -r shellcheck --severity=warning || true
+      - find . -name "*.sh" -not -path "./.git/*" -print0 | xargs -0 -r shellcheck --severity=warning
 
   - name: duplicate-detection
     image: python:3-alpine
diff --git a/dev/dev-agent.sh b/dev/dev-agent.sh
index 66b5eea..f5bd5be 100755
--- a/dev/dev-agent.sh
+++ b/dev/dev-agent.sh
@@ -28,7 +28,9 @@ git -C "$FACTORY_ROOT" pull --ff-only origin main 2>/dev/null || true
 
 # --- Config ---
 ISSUE="${1:?Usage: dev-agent.sh <issue-number>}"
+# shellcheck disable=SC2034
 REPO="${CODEBERG_REPO}"
+# shellcheck disable=SC2034
 REPO_ROOT="${PROJECT_REPO_ROOT}"
 
 API="${CODEBERG_API}"
@@ -143,7 +145,8 @@ post_refusal_comment() {
     log "skipping duplicate refusal comment: ${title}"
     return 0
   fi
-  local comment="${emoji} **Dev-agent: ${title}**
+  local comment
+  comment="${emoji} **Dev-agent: ${title}**
 
 ${body}
 
diff --git a/dev/dev-poll.sh b/dev/dev-poll.sh
index 03302d7..19053ea 100755
--- a/dev/dev-poll.sh
+++ b/dev/dev-poll.sh
@@ -83,6 +83,7 @@ sys.exit(1)
 " 2>/dev/null && return 0 || return 1
 }
 
+# shellcheck disable=SC2034
 REPO="${CODEBERG_REPO}"
 
 API="${CODEBERG_API}"
@@ -98,7 +99,7 @@ log() {
 # HELPER: try merge, rebase if mergeable=false, then retry once
 try_merge_or_rebase() {
   local pr_num="$1" issue_num="$2" branch="$3"
-  local merge_code mergeable
+  local merge_code
 
   merge_code=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
     -H "Authorization: token ${CODEBERG_TOKEN}" \
@@ -472,7 +473,7 @@ nohup "${SCRIPT_DIR}/dev-agent.sh" "$READY_ISSUE" >> "$LOGFILE" 2>&1 &
 AGENT_PID=$!
 
 # Wait briefly for preflight (agent writes result before claiming)
-for w in $(seq 1 30); do
+for _w in $(seq 1 30); do
   if [ -f "$PREFLIGHT_RESULT" ]; then
     break
   fi
diff --git a/lib/env.sh b/lib/env.sh
index 80cd7ed..90c5bf5 100755
--- a/lib/env.sh
+++ b/lib/env.sh
@@ -82,7 +82,8 @@ matrix_send() {
   [ -z "${MATRIX_TOKEN:-}" ] && return 0
   local prefix="$1" msg="$2" thread_id="${3:-}" ctx_tag="${4:-}"
   local room_encoded="${MATRIX_ROOM_ID//!/%21}"
-  local txn="$(date +%s%N)$$"
+  local txn
+  txn="$(date +%s%N)$$"
   local body
   if [ -n "$thread_id" ]; then
     body=$(jq -nc --arg m "[${prefix}] ${msg}" --arg t "$thread_id" \
diff --git a/lib/matrix_listener.sh b/lib/matrix_listener.sh
index 98f778c..0b23073 100755
--- a/lib/matrix_listener.sh
+++ b/lib/matrix_listener.sh
@@ -34,6 +34,7 @@ if [ -z "${MATRIX_TOKEN:-}" ] || [ -z "${MATRIX_ROOM_ID:-}" ]; then
 fi
 
 # URL-encode room ID
+# shellcheck disable=SC2034
 ROOM_ENCODED="${MATRIX_ROOM_ID//!/%21}"
 
 # Build sync filter — only our room, only messages
@@ -108,6 +109,7 @@ while true; do
   while IFS= read -r event; do
     SENDER=$(printf '%s' "$event" | jq -r '.sender')
     BODY=$(printf '%s' "$event" | jq -r '.content.body // ""')
+    # shellcheck disable=SC2034
     EVENT_ID=$(printf '%s' "$event" | jq -r '.event_id')
 
     # Check if this is a thread reply
diff --git a/review/review-poll.sh b/review/review-poll.sh
index 3734592..677e3df 100755
--- a/review/review-poll.sh
+++ b/review/review-poll.sh
@@ -12,7 +12,9 @@ export PROJECT_TOML="${1:-}"
 source "$(dirname "$0")/../lib/env.sh"
 
 
+# shellcheck disable=SC2034
 REPO="${CODEBERG_REPO}"
+# shellcheck disable=SC2034
 REPO_ROOT="${PROJECT_REPO_ROOT}"
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 
diff --git a/review/review-pr.sh b/review/review-pr.sh
index bc19d1e..61d2967 100755
--- a/review/review-pr.sh
+++ b/review/review-pr.sh
@@ -29,7 +29,9 @@ git -C "$FACTORY_ROOT" pull --ff-only origin main 2>/dev/null || true
 
 PR_NUMBER="${1:?Usage: review-pr.sh <pr-number> [--force]}"
 FORCE="${2:-}"
+# shellcheck disable=SC2034
 REPO="${CODEBERG_REPO}"
+# shellcheck disable=SC2034
 REPO_ROOT="${PROJECT_REPO_ROOT}"
 
 # Bot account for posting reviews (separate user required for branch protection approvals)
diff --git a/supervisor/supervisor-poll.sh b/supervisor/supervisor-poll.sh
index 87adbab..920111a 100755
--- a/supervisor/supervisor-poll.sh
+++ b/supervisor/supervisor-poll.sh
@@ -511,6 +511,7 @@ check_project() {
       BODY=$(echo "$BACKLOG_FOR_DEPS" | jq -r ".[$i].body // \"\"")
       ISSUE_DEPS=$(echo "$BODY" | bash "$PARSE_DEPS" | grep -v "^${NUM}$" || true)
       [ -n "$ISSUE_DEPS" ] && DEPS_OF[$NUM]="$ISSUE_DEPS"
+      # shellcheck disable=SC2034
       BACKLOG_NUMS[$NUM]=1
     done
 
@@ -526,7 +527,8 @@ check_project() {
       for dep in ${DEPS_OF[$node]:-}; do
         [ -z "${NODE_COLOR[$dep]+x}" ] && continue
         if [ "${NODE_COLOR[$dep]}" = "1" ]; then
-          local cycle_key=$(echo "$path $dep" | tr ' ' '\n' | sort -n | tr '\n' ' ')
+          local cycle_key
+              cycle_key=$(echo "$path $dep" | tr ' ' '\n' | sort -n | tr '\n' ' ')
           if [ -z "${SEEN_CYCLES[$cycle_key]+x}" ]; then
             SEEN_CYCLES[$cycle_key]=1
             local in_cycle=0 cycle_str=""
diff --git a/supervisor/update-prompt.sh b/supervisor/update-prompt.sh
index 3d38855..dbaec1d 100755
--- a/supervisor/update-prompt.sh
+++ b/supervisor/update-prompt.sh
@@ -39,7 +39,7 @@ else
   echo "$LESSON" >> "$TARGET_FILE"
 fi
 
-cd "$FACTORY_ROOT"
+cd "$FACTORY_ROOT" || exit 1
 git add "supervisor/$1" 2>/dev/null || git add "$TARGET_FILE"
 git commit -m "supervisor: learned — $(echo "$LESSON" | head -1 | sed 's/^#* *//')" --no-verify 2>/dev/null
 git push origin main 2>/dev/null