diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml
index e68d9d7..a650aa4 100644
--- a/.github/workflows/manual.yml
+++ b/.github/workflows/manual.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2  # Ensure the code is checked out
+        uses: actions/checkout@v4  # Ensure the code is checked out
 
       # Docker login step
       - name: Log in to Docker Hub
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2  # Ensure the code is checked out
+        uses: actions/checkout@v4  # Ensure the code is checked out
 
       # Docker login step
       - name: Log in to Docker Hub
@@ -78,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2  # Ensure the code is checked out
+        uses: actions/checkout@v4  # Ensure the code is checked out
 
       # Docker login step
       - name: Log in to Docker Hub
diff --git a/.github/workflows/schedule.yml b/.github/workflows/schedule.yml
index bb28a2a..1fbff8e 100644
--- a/.github/workflows/schedule.yml
+++ b/.github/workflows/schedule.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2  # Ensure the code is checked out
+        uses: actions/checkout@v4  # Ensure the code is checked out
 
       # Docker login step
       - name: Log in to Docker Hub
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2  # Ensure the code is checked out
+        uses: actions/checkout@v4  # Ensure the code is checked out
 
       # Docker login step
       - name: Log in to Docker Hub
@@ -85,7 +85,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2  # Ensure the code is checked out
+        uses: actions/checkout@v4  # Ensure the code is checked out
 
       # Docker login step
       - name: Log in to Docker Hub
diff --git a/AGENTS.md b/AGENTS.md
deleted file mode 100644
index 6ec5f41..0000000
--- a/AGENTS.md
+++ /dev/null
@@ -1,137 +0,0 @@
-# myshell — agent guide (repo root)
-
-myshell is a personal bash framework: a `.bashrc` loader that sources functions, aliases
-and profiles from this repo, plus self-contained "modules" (mostly docker compose stacks)
-launched through aliases. Everything is bash; there is no build step.
-
-**Before editing under `core/shells/bash/`, read `core/shells/bash/AGENTS.md`.
-Before editing under `modules/`, read `modules/AGENTS.md`.**
-
-## How the framework loads (the one chain that explains everything)
-
-```
-~/.bash_profile            (machine file, NOT in repo)
-  └─ exports project_path=$HOME/Documents/myshell
-  └─ sources core/shells/bash/.bashrc, which:
-       1. runs core/shells/bash/jobs/public_ip.bash in background
-       2. sources core/shells/bash/functions/*.bash   (explicit if-blocks, one per file)
-       3. sources EVERY file in core/shells/bash/aliases/   (glob loop)
-       4. sources core/shells/bash/profiles/.*         (explicit if-blocks, one per file)
-```
-
-Module scripts are executed as `bash <script>` from aliases → they run in a **child
-shell** and only see **exported** variables. `$project_path` is exported; never hardcode
-`$HOME/Documents/myshell` in a script, always use `$project_path`.
-
-## Repo map
-
-| Path | What it is |
-|---|---|
-| `core/shells/bash/.bashrc` | The loader. Every new function/profile needs an if-block here. |
-| `core/shells/bash/functions/` | 8 sourced function files (`myshell.bash` is the manager UI). |
-| `core/shells/bash/aliases/.aliases` | THE tracked alias file. All module aliases live here. |
-| `core/shells/bash/aliases/*.sh` | Machine-local aliases. **Git-ignored by design** — never put shared aliases there. |
-| `core/shells/bash/profiles/.*` | Dot-file profiles (.appearance, .history, .path, ...). |
-| `core/shells/bash/jobs/` | Background jobs run at shell start. |
-| `modules/<category>/<module>/` | Self-contained tools: bw, docker, help, john, utils, yt-dlp. |
-| `tests/validate.bash` | The validation gate. Run it before calling anything done. |
-| `.module_state/` | Machine-local menu state (git-ignored). Bookkeeping only — nothing loads based on it. |
-
-## Golden rules (each one caused a real bug — do not relearn them)
-
-1. **Module aliases go ONLY in `core/shells/bash/aliases/.aliases`.** Every other file in
-   `aliases/` is git-ignored (`.gitignore` rule `core/shells/bash/aliases/*` with a single
-   `!.aliases` exception). An alias added to `.modules.sh` etc. silently never reaches git.
-2. **Every alias that points into `modules/` must reference a file that exists.**
-   `myshell list` derives the command list from `.aliases` and hides dead targets, so a
-   broken alias becomes invisible instead of failing loudly. `tests/validate.bash` enforces
-   this. (Cause: a batch of `modules/k8s` aliases survived the module's deletion.)
-3. **Use `docker compose` (plugin), never `docker-compose`.** With the plugin missing the
-   CLI fails with the misleading error `unknown shorthand flag: 'd' in -d`. If you see that
-   error, the compose plugin is missing — the script is not broken.
-4. **The `myshell` user interface is exactly two entry points:** `myshell` (interactive
-   menu) and `myshell list`. Do NOT add CLI subcommands; the owner removed them on purpose
-   (2026-07-12). New capabilities go into the menu.
-5. **The `c_green`/`c_red`/`c_blue`/... helpers in `myshell.bash` print ONLY their first
-   argument, with no newline and no printf formatting.** Passing `"%s" "$x"` prints a
-   literal `%s`. For formatted or colored lines use `printf` with escape codes directly.
-6. **`.module_state/enabled.modules` is bookkeeping, not a gate.** One name per line:
-   module directory basenames (`alpine`, `mysql5`), flat modules by their own dir name
-   (`bw`, `yt-dlp`), profiles with their leading dot (`.appearance`). Nothing in the
-   loader reads it; disabling a module does not remove its command.
-7. **`.shellcheckrc` accepts directives only** (`shell=bash`, `external-sources=true`).
-   No INI sections, no file excludes — those break every shellcheck run in the repo.
-8. **Never edit files under `modules/docker/*/Docker/` that came from upstream images**
-   (e.g. `catalina.bash` — 600+ line Tomcat vendor configs). They are container config
-   payloads, not framework code.
-
-## Cookbook (follow the recipe exactly; each step lists its coupled edits)
-
-### Add a docker service module
-1. `mkdir -p modules/docker/<name>` with `docker-compose.yaml` (copy `modules/docker/alpine/`
-   as reference: service with `container_name: <name>`, optional `build:` context `./Docker`).
-2. Create `modules/docker/<name>/<name>.bash`:
-   ```bash
-   #!/bin/bash
-   cd "$project_path/modules/docker/<name>" || exit 1
-   docker compose up -d --build --force-recreate
-   ```
-   Optional shell access: `<name>_exec.bash` with `docker exec -it <name> /bin/sh`.
-3. Add the alias in `core/shells/bash/aliases/.aliases`, INSIDE the docker-group guard
-   block (between `if [ "$docker_groups" = "$docker_str" ]` and its `else`):
-   `alias <name>="bash $project_path/modules/docker/<name>/<name>.bash"`
-4. Verify: `cd modules/docker/<name> && docker compose config --quiet` then
-   `bash tests/validate.bash`.
-
-One-shot tools (run-and-exit, like `k6`) use `docker compose run --rm <service> ...`
-instead of `up -d`. See `modules/docker/k6/k6.bash`.
-
-### Add a utility script
-1. Create `modules/utils/<topic>/<script>.bash` (use `$project_path`, pass shellcheck).
-2. Add alias in `.aliases` under `# Utils`.
-3. `bash tests/validate.bash`.
-
-### Add a core function file
-1. Create `core/shells/bash/functions/<name>.bash`.
-2. Add an if-block in `.bashrc` under `# Load functions` (copy an existing block).
-3. **Coupled edit:** add `<name>` to the `func_files` list in
-   `core/shells/bash/functions/myshell.bash` (function `do_status`) AND bump the
-   `Total: %d/N functions` counter on the next line. Grep first: `grep -n 'func_files=' core/shells/bash/functions/myshell.bash`.
-4. `bash tests/validate.bash`.
-
-### Add a profile
-1. Create `core/shells/bash/profiles/.<name>` (leading dot).
-2. Add an if-block in `.bashrc` under `# Load profiles`.
-3. `bash tests/validate.bash`.
-
-## Validation protocol — non-negotiable before "done"
-
-Ground every claim in tool output, not memory. In order:
-
-1. `bash -n <every file you touched>` — syntax.
-2. `shellcheck <touched .bash files>` — must be clean (repo `.shellcheckrc` applies).
-   Semgrep is available via MCP — scan touched files when you change logic.
-3. `bash tests/validate.bash` — the full gate: syntax of all shell files, shellcheck on
-   core functions, loader integrity (.bashrc targets exist), alias→script integrity,
-   `docker compose config` for every docker module, and a `myshell` smoke test.
-4. Quote the actual output in your report. If a check fails, fix and re-run; never report
-   a failing state as done.
-
-CI runs the same gate (`.github/workflows/validate.yml`) plus manual docker image builds
-(`manual.yml`, `schedule.yml` — do not touch those when doing framework work).
-
-## Do NOT
-
-- Do not resurrect `module_resolver.bash`, `framework_core.bash`, `env_core.bash` or any
-  `myshell_mod_*` function — removed on purpose (2026-07-12/13).
-- Do not add subcommands to `myshell` (rule 4).
-- Do not `git add -f` git-ignored files (machine-local aliases, `.module_state/`).
-- Do not delete or stop running containers/services without being asked.
-- Do not "fix" `modules/docker/*/Docker/` vendor payloads flagged by linters (rule 8).
-- Do not reference `modules/k8s`, `modules/ssh`, `modules/minikube`, `openldap`,
-  `passbolt` — deleted; they must not reappear in aliases or docs.
-
-## Commits
-
-Conventional commits: `feat:` / `fix:` / `docs:` / `refactor:` / `chore:`.
-All paths through `$project_path`. Run the validation protocol before every commit.
diff --git a/core/shells/bash/.bash_profile b/core/shells/bash/.bash_profile
index 6c51a0c..2f01456 100644
--- a/core/shells/bash/.bash_profile
+++ b/core/shells/bash/.bash_profile
@@ -1,3 +1,4 @@
+#!/bin/bash
 # ~/.profile: executed by the command interpreter for login shells.
 # This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
 # exists.
diff --git a/core/shells/bash/.bashrc b/core/shells/bash/.bashrc
index 76344da..45e14e1 100644
--- a/core/shells/bash/.bashrc
+++ b/core/shells/bash/.bashrc
@@ -1,3 +1,4 @@
+#!/bin/bash
 ## Time lapse bash loading
 initial_result=$(date +%s%3N)
 # Jobs
diff --git a/core/shells/bash/aliases/.aliases b/core/shells/bash/aliases/.aliases
index 729895c..8ea5b05 100644
--- a/core/shells/bash/aliases/.aliases
+++ b/core/shells/bash/aliases/.aliases
@@ -1,100 +1,35 @@
-#Exports
-export mod_colors="$project_path"/core/shells/bash/functions/colors.bash
-export ssl_functions="$project_path"/modules/utils/ssl/functions.bash
-export certs_functions="$project_path"/modules/utils/certs/functions.bash
-source "$project_path"/core/shells/bash/functions/crlf_to_lf.bash
-# Facilities
-alias cls="clear"
-alias c="code ."
-alias free="free -mh"
-alias grep="grep --color=auto"
-alias ls="ls -lah --color"
-alias nano="nano -l"
-alias h="history"
-alias e="exit"
-alias clear_ram="sudo bash -c 'echo 1 > /proc/sys/vm/drop_caches'"
-alias cat_input="read input; cat * | grep -r --exclude-dir=".*" $input"
-# tmux
-alias tmuxon="tmux new -s docker -d&tmux new -s cloud -d&tmux new -s ssh -d&tmux new -s codex -d&"
-alias tmuxls="tmux ls"
-alias tmuxattach="tmux a -t"
-# terraform
-alias tfi="rm -rf .terraform; rm -rf .terraform.lock.hcl; terraform init --upgrade"
-alias tfp="terraform plan "
-alias tff="terraform fmt"
-alias tfa="terraform apply "
-# bw - bitwarden
-alias bw="$HOME/'.config/Bitwarden CLI/bw'"
-alias bw_eu="bw config server https://vault.bitwarden.eu"
-alias bw_create="'$project_path'/modules/bw/bw-history-create.bash"
-alias bw_push="'$project_path'/modules/bw/bw-history-push.bash"
-alias bw_clone="'$project_path'/modules/bw/bw-history-clone.bash"
-#git
-alias gp="git pull"
-alias gpush="git push"
-alias gs="git status"
-alias gl="git log"
-alias gc="git log --branches --not --remotes"
-alias gsoft="git reset --soft HEAD~1"
-alias ghard="git reset --hard HEAD~1"
-alias gpr="gh pr list"
-# modules
-## modules - help - commands
-alias help_docker="bash $project_path/modules/help/docker/docker.bash"
-alias help_mysql="bash $project_path/modules/help/mysql/mysql.bash"
-alias help_kubectl="bash $project_path/modules/help/kubectl/kubectl.bash"
-alias help_git="bash $project_path/modules/help/git/git.bash"
-alias help_gcloud="bash $project_path/modules/help/gcloud/gcloud.bash"
-alias help_terraform="bash $project_path/modules/help/terraform/terraform.bash"
-alias help_dig="bash $project_path/modules/help/dig/dig.bash"
-alias help_az="bash $project_path/modules/help/az/az.bash"
-alias help_arch="bash $project_path/modules/help/arch/arch.bash"
-## modules - docker
-docker_groups=$(cat /etc/group | grep docker | awk -F: '{ printf $1}')
-docker_str="docker"
-if [ "$docker_groups" = "$docker_str" ]
-        then
-alias dockrm="bash $project_path/modules/docker/dock/dockrm.bash"
-alias alpine="bash $project_path/modules/docker/alpine/alpine.bash"
-alias alpine_exec="bash $project_path/modules/docker/alpine/alpine_exec.bash"
-alias mysql5="bash $project_path/modules/docker/mysql5/mysql5.bash"
-alias mysql5_exec="bash $project_path/modules/docker/mysql5/mysql5_exec.bash"
-alias mysql8="bash $project_path/modules/docker/mysql8/mysql8.bash"
-alias mysql8_exec="bash $project_path/modules/docker/mysql8/mysql8_exec.bash"
-alias tomcat9="bash $project_path/modules/docker/tomcat9/tomcat9.bash"
-alias tomcat9_exec="bash $project_path/modules/docker/tomcat9/tomcat9_exec.bash"
-alias apache="bash $project_path/modules/docker/apache/apache.bash"
-alias mongodb="bash $project_path/modules/docker/mongodb/mongodb.bash"
-alias mongodb_exec="bash $project_path/modules/docker/mongodb/mongodb_exec.bash"
-alias maven="bash $project_path/modules/docker/maven/maven.bash"
-alias maven_exec="bash $project_path/modules/docker/maven/maven_exec.bash"
-alias nexus="bash $project_path/modules/docker/nexus/nexus.bash"
-alias nexus_exec="bash $project_path/modules/docker/nexus/nexus_exec.bash"
-alias jira_software="bash $project_path/modules/docker/jira-software/jira-software.bash"
-alias jira_software_cero_exec="bash $project_path/modules/docker/jira-software/jira-software_cero_exec.bash"
-alias jira_software_uno_exec="bash $project_path/modules/docker/jira-software/jira-software_uno_exec.bash"
-alias nodejs="bash $project_path/modules/docker/nodejs/nodejs.bash"
-alias nodejs_exec="bash $project_path/modules/docker/nodejs/nodejs_exec.bash"
-alias nginx="bash $project_path/modules/docker/nginx/nginx.bash"
-alias nginx_exec="bash $project_path/modules/docker/nginx/nginx_exec.bash"
-alias k6="bash $project_path/modules/docker/k6/k6.bash"
+#!/bin/bash
+# ── Machine-local docker aliases only ──
+# Loaded from .base.sh (core utilities) and .modules.sh (help aliases).
+# This file is for machine-specific overrides that don't belong in .base.sh.
+# shellcheck disable=SC2139
+
+# ── Docker module aliases ──
+if id -nG 2>/dev/null | grep -qw docker; then
+  alias dockrm="bash $project_path/modules/docker/dock/dockrm.bash"
+  alias alpine="bash $project_path/modules/docker/alpine/alpine.bash"
+  alias alpine_exec="bash $project_path/modules/docker/alpine/alpine_exec.bash"
+  alias mysql5="bash $project_path/modules/docker/mysql5/mysql5.bash"
+  alias mysql5_exec="bash $project_path/modules/docker/mysql5/mysql5_exec.bash"
+  alias mysql8="bash $project_path/modules/docker/mysql8/mysql8.bash"
+  alias mysql8_exec="bash $project_path/modules/docker/mysql8/mysql8_exec.bash"
+  alias tomcat9="bash $project_path/modules/docker/tomcat9/tomcat9.bash"
+  alias tomcat9_exec="bash $project_path/modules/docker/tomcat9/tomcat9_exec.bash"
+  alias apache="bash $project_path/modules/docker/apache/apache.bash"
+  alias mongodb="bash $project_path/modules/docker/mongodb/mongodb.bash"
+  alias mongodb_exec="bash $project_path/modules/docker/mongodb/mongodb_exec.bash"
+  alias maven="bash $project_path/modules/docker/maven/maven.bash"
+  alias maven_exec="bash $project_path/modules/docker/maven/maven_exec.bash"
+  alias nexus="bash $project_path/modules/docker/nexus/nexus.bash"
+  alias nexus_exec="bash $project_path/modules/docker/nexus/nexus_exec.bash"
+  alias jira_software="bash $project_path/modules/docker/jira-software/jira-software.bash"
+  alias jira_software_cero_exec="bash $project_path/modules/docker/jira-software/jira-software_cero_exec.bash"
+  alias jira_software_uno_exec="bash $project_path/modules/docker/jira-software/jira-software_uno_exec.bash"
+  alias nodejs="bash $project_path/modules/docker/nodejs/nodejs.bash"
+  alias nodejs_exec="bash $project_path/modules/docker/nodejs/nodejs_exec.bash"
+  alias nginx="bash $project_path/modules/docker/nginx/nginx.bash"
+  alias nginx_exec="bash $project_path/modules/docker/nginx/nginx_exec.bash"
+  alias k6="bash $project_path/modules/docker/k6/k6.bash"
 else
-echo "To use docker you must be in docker group"
+  echo "myshell: docker aliases disabled (user not in docker group)" >&2
 fi
-# kubectl
-alias k="kubectl"
-alias k3s="kubectl --kubeconfig ~/.kube/k3s"
-## modules - john
-check_john=$(john &> /dev/null; echo $?)
-if [ "$check_john" = "0" ]
-then
-        alias john_dictionary="bash $project_path/modules/john/dictionary/dictionary.bash"
-        alias john_unshadow="bash $project_path/modules/john/unshadow/unshadow.bash"
-        alias john_zip="bash $project_path/modules/john/zip/zip.bash"
-fi
-# Utils
-alias check_domains="bash ~/Documents/myshell/modules/utils/ssl/ssl_check.bash"
-alias cert_base64_for_sealed_secret="bash ~/Documents/myshell/modules/utils/certs/cert_base64_for_sealed_secret.bash"
-alias format_disk_ext4="bash ~/Documents/myshell/modules/utils/linux_scripts/format_disk_ext4.bash"
-## modules - yt-dlp
-alias download="bash $project_path/modules/yt-dlp/yt-dlp.bash"
diff --git a/core/shells/bash/profiles/.appearance b/core/shells/bash/profiles/.appearance
index fc7c075..07c9008 100644
--- a/core/shells/bash/profiles/.appearance
+++ b/core/shells/bash/profiles/.appearance
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Modify ls colors
 export LS_COLORS='rs=0:di=01;30;42:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=00:tw=30;42:ow=34;42:st=37;44:ex=01;30;103:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;30;105:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.avif=01;35:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:*~=00;90:*#=00;90:*.bak=00;90:*.old=00;90:*.orig=00;90:*.part=00;90:*.rej=00;90:*.swp=00;90:*.tmp=00;90:*.dpkg-dist=00;90:*.dpkg-old=00;90:*.ucf-dist=00;90:*.ucf-new=00;90:*.ucf-old=00;90:*.rpmnew=00;90:*.rpmorig=00;90:*.rpmsave=00;90:'
 
diff --git a/core/shells/bash/profiles/.completion b/core/shells/bash/profiles/.completion
index ef8d769..aa99ced 100644
--- a/core/shells/bash/profiles/.completion
+++ b/core/shells/bash/profiles/.completion
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Completion OCI cloud commands
 [[ -e "/home/$USER/lib/oracle-cli/lib/python3.11/site-packages/oci_cli/bin/oci_autocomplete.bash" ]] && source "/home/$USER/lib/oracle-cli/lib/python3.11/site-packages/oci_cli/bin/oci_autocomplete.bash"
 
diff --git a/core/shells/bash/profiles/.git-configs b/core/shells/bash/profiles/.git-configs
index 5a0efd4..a1ec295 100644
--- a/core/shells/bash/profiles/.git-configs
+++ b/core/shells/bash/profiles/.git-configs
@@ -1,3 +1,4 @@
+#!/bin/bash
 # GIT
 export HOMEBREW_GIT_PATH=$(whereis git | awk {'print $2'})
 parse_git_branch() {
diff --git a/core/shells/bash/profiles/.history b/core/shells/bash/profiles/.history
index c273a08..a1c2c19 100644
--- a/core/shells/bash/profiles/.history
+++ b/core/shells/bash/profiles/.history
@@ -1,3 +1,4 @@
+#!/bin/bash
 ## History settings
 #export HISTFILE=$project_path/core/shells/bash/.bash_history
 export HISTFILE="$HOME"/.bash_history
diff --git a/core/shells/bash/profiles/.path b/core/shells/bash/profiles/.path
index 5edb5e6..ae49047 100644
--- a/core/shells/bash/profiles/.path
+++ b/core/shells/bash/profiles/.path
@@ -1,3 +1,4 @@
+#!/bin/bash
 # set PATH so it includes user's private bin if it exists
 if [ -d "$HOME/bin" ] ; then
     PATH="$HOME/bin:$PATH"
diff --git a/core/shells/bash/profiles/.pwsh b/core/shells/bash/profiles/.pwsh
index ec36337..b0af030 100644
--- a/core/shells/bash/profiles/.pwsh
+++ b/core/shells/bash/profiles/.pwsh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # pwsh
 powershell_yes=$(cat /etc/shells | grep -Eo 'pws[a-z]+' | head -1)
 powershell="pwsh"
diff --git a/core/shells/bash/profiles/.software b/core/shells/bash/profiles/.software
index ceed07d..85d15c8 100644
--- a/core/shells/bash/profiles/.software
+++ b/core/shells/bash/profiles/.software
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Allow to use less on compressed files and others, without decompress
 [ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
 
diff --git a/modules/AGENTS.md b/modules/AGENTS.md
deleted file mode 100644
index dd81edb..0000000
--- a/modules/AGENTS.md
+++ /dev/null
@@ -1,68 +0,0 @@
-# modules/ — agent guide
-
-Read the root `AGENTS.md` first. A module is only reachable through an alias in
-`core/shells/bash/aliases/.aliases` — creating files here does nothing until that alias
-exists, and an alias without its target file is invisible dead weight (`myshell list`
-hides it; `tests/validate.bash` fails on it).
-
-## Categories (current, complete)
-
-| Category | Kind | Contents |
-|---|---|---|
-| `bw/` | flat (scripts at top level) | Bitwarden CLI helpers (`bw_create`, `bw_push`, `bw_clone`). |
-| `docker/` | one dir per service | 18 compose stacks: alpine, apache, cockroach, cockroach-insecure, jira-software, k6, liferay-7.2.1-ga2, liferay-7.3.5-ga6, maven, mongodb, mysql5, mysql8, nexus, nginx, nodejs, rainloop, syslog, tomcat9. Plus 3 special dirs (see below). |
-| `help/` | one dir per topic | Cheatsheet printers (`help_docker`, `help_az`, ...). Plain bash, no deps. |
-| `john/` | one dir per attack | John the Ripper recipes. Aliases only defined when `john` binary exists. |
-| `utils/` | one dir per topic | ssl checks, cert helpers, aws, disk format, etc. |
-| `yt-dlp/` | flat | `download` alias → `yt-dlp.bash`. |
-
-Deleted, must not reappear: `k8s/`, `ssh/`, `minikube/`, `docker/openldap`, `docker/passbolt`.
-
-## Special docker dirs (no compose service)
-
-- `docker/dock/` — loose docker utility scripts. Only `dockrm.bash` has an alias
-  (`dockrm`); `dockpush.bash`, `dockpush_k8s.bash`, `dock_ports_bind.bash` are run by
-  hand. `dockrm.bash` sources `$mod_colors` (exported in `.aliases`).
-- `docker/httpd/`, `docker/vtiger/` — Dockerfile + payload only, no launcher script and
-  no alias. Do not invent launchers for them unless asked.
-
-## Docker module anatomy (the pattern every compose stack follows)
-
-```
-modules/docker/<name>/
-├── docker-compose.yaml    # service, container_name: <name>, often build: ./Docker
-├── <name>.bash            # cd "$project_path/modules/docker/<name>" && docker compose up -d --build --force-recreate
-├── <name>_exec.bash       # optional: docker exec -it <name> /bin/sh (or bash)
-├── Docker/                # build context: dockerfile + payload. Vendor files live here — do not lint/fix them.
-└── configs/ README.md     # optional
-```
-
-The exception: `k6` is a one-shot job, not a service. Its `k6.bash` asks which script
-under `scripts/` to run, then `docker compose run --rm k6 run /mnt/local/scripts/<x>/<x>.js`.
-Never convert it to `up -d`.
-
-Aliases for docker modules sit INSIDE the docker-group guard in `.aliases`
-(`if [ "$docker_groups" = "$docker_str" ]` ... `else` warning `fi`). Aliases for john sit
-inside the john guard. Everything else is unguarded.
-
-## Rules
-
-- Scripts run in a child bash: only exported vars exist. Use `$project_path`, quote it:
-  `cd "$project_path/modules/..." || exit 1`.
-- `docker compose` (plugin syntax), never `docker-compose`.
-- Compose files must pass `docker compose config --quiet` from inside the module dir —
-  the validator runs exactly that for every `modules/docker/*/docker-compose.y*ml`.
-- Machine-generated data dirs (mysql-data, logs, liferay_data, ...) are git-ignored; do
-  not commit them and do not add code that writes elsewhere in the repo.
-- Removing a module = remove its directory AND its alias line(s) in `.aliases`, then run
-  `bash tests/validate.bash` (it fails on orphan aliases).
-
-## How to verify changes here (copy-paste)
-
-```bash
-bash -n modules/docker/<name>/<name>.bash
-shellcheck modules/docker/<name>/<name>.bash        # SC2154 for project_path is expected noise
-cd modules/docker/<name> && docker compose config --quiet && cd -
-bash tests/validate.bash
-```
-Do not `docker compose up` anything as a test unless the task asks you to run it.
diff --git a/modules/docker/alpine/alpine.bash b/modules/docker/alpine/alpine.bash
index 1894735..2db5351 100644
--- a/modules/docker/alpine/alpine.bash
+++ b/modules/docker/alpine/alpine.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/alpine
+cd "$project_path/modules/docker/alpine" || exit 1
 docker compose up -d --build --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/dock/dockpush.bash b/modules/docker/dock/dockpush.bash
deleted file mode 100644
index f7e6c2d..0000000
--- a/modules/docker/dock/dockpush.bash
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-Clear-Host
-#docker login rancher-sic-local.$domain_stg_ba:8090
-docker login registry.$domain_stg_ba
-Write-Host "Imatges disponibles en local" -ForegroundColor DarkCyan
-docker images
-#
-Write-Host "Quina imatge vols seleccionar?" -ForegroundColor DarkCyan
-Write-Host "Introdueix nom_imatge:tag" -ForegroundColor DarkCyan
-$nom_imatge_local = Read-Host
-#docker images --filter "reference=$nom_imatge*"
-#
-Write-Host "Aquesta imatge es pujarà a al bucket 'proves'" -ForegroundColor DarkCyan
-Write-Host "Amb quin nom de imatge el vols pujar?" -ForegroundColor DarkCyan
-Write-Host "Introdueix nom_imatge:tag" -ForegroundColor DarkCyan
-$nom_imatge_nexus = Read-Host
-docker tag $nom_imatge_local registry.$domain_stg_ba/proves/$nom_imatge_nexus
-docker push registry.$domain_stg_ba/proves/$nom_imatge_nexus
diff --git a/modules/docker/dock/dockpush_k8s.bash b/modules/docker/dock/dockpush_k8s.bash
deleted file mode 100644
index 3c8585c..0000000
--- a/modules/docker/dock/dockpush_k8s.bash
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-Clear-Host
-#docker login rancher-sic-local.$domain_stg_ba:8090
-docker login docker-privat.$domain_intra_ba
-Write-Host "Imatges disponibles en local" -ForegroundColor DarkCyan
-docker images
-#
-Write-Host "Quina imatge vols seleccionar?" -ForegroundColor DarkCyan
-Write-Host "Introdueix nom_imatge:tag" -ForegroundColor DarkCyan
-$nom_imatge_local = Read-Host
-#docker images --filter "reference=$nom_imatge*"
-#
-Write-Host "Aquesta imatge es pujarà a al bucket 'proves'" -ForegroundColor DarkCyan
-Write-Host "Amb quin nom de imatge el vols pujar?" -ForegroundColor DarkCyan
-Write-Host "Introdueix nom_imatge:tag" -ForegroundColor DarkCyan
-$nom_imatge_nexus = Read-Host
-docker tag $nom_imatge_local docker-privat.$domain_intra_ba/proves/$nom_imatge_nexus
-docker push docker-privat.$domain_intra_ba/proves/$nom_imatge_nexus
diff --git a/modules/docker/dock/dockrm.bash b/modules/docker/dock/dockrm.bash
index 4402481..8bab313 100644
--- a/modules/docker/dock/dockrm.bash
+++ b/modules/docker/dock/dockrm.bash
@@ -6,18 +6,18 @@ if [ $num_imatges_docker -gt 1 ]; then
 	cyan
 	echo "Eliminar containers.."
 	nocolor
-	docker rm $(docker ps -a -q) -f
+	docker ps -a -q | xargs -r docker rm -f
 fi
 if [ $num_imatges_docker -gt 1 ]; then
 	cyan
 	echo "Eliminar imatges.."
 	nocolor
-	docker rmi $(docker images -a -q) -f
+	docker images -a -q | xargs -r docker rmi -f
 fi
 cyan
 echo "Delete volumes..."
 nocolor
-docker volume ls -q | grep -q . && docker volume rm $(docker volume ls -q)
+docker volume ls -q | grep -q . && docker volume ls -q | xargs -r docker volume rm
 cyan
 echo "Delete networks..."
 nocolor
diff --git a/modules/docker/jira-software/jira-software.bash b/modules/docker/jira-software/jira-software.bash
index a8750fe..831b4af 100644
--- a/modules/docker/jira-software/jira-software.bash
+++ b/modules/docker/jira-software/jira-software.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/jira-software
+cd "$project_path/modules/docker/jira-software" || exit 1
 docker compose up --build --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/maven/maven.bash b/modules/docker/maven/maven.bash
index 8507df9..438af70 100644
--- a/modules/docker/maven/maven.bash
+++ b/modules/docker/maven/maven.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/maven
+cd "$project_path/modules/docker/maven" || exit 1
 docker compose up -d --build --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/mongodb/mongodb.bash b/modules/docker/mongodb/mongodb.bash
index 334bae3..af0dd42 100644
--- a/modules/docker/mongodb/mongodb.bash
+++ b/modules/docker/mongodb/mongodb.bash
@@ -1,5 +1,5 @@
 #!/bin/bash
-cd $project_path/modules/docker/mongodb
+cd "$project_path/modules/docker/mongodb" || exit 1
 case "$1" in
   arm)
     echo "[mongodb] Starting in ARM64 mode..."
@@ -16,4 +16,4 @@ case "$1" in
     unset COMPOSE_DOCKER_CLI_BUILD
     ;;
 esac
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/mysql5/mysql5.bash b/modules/docker/mysql5/mysql5.bash
index fb039e2..99b4aa9 100644
--- a/modules/docker/mysql5/mysql5.bash
+++ b/modules/docker/mysql5/mysql5.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/mysql5
+cd "$project_path/modules/docker/mysql5" || exit 1
 docker compose up -d --build --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/mysql8/mysql8.bash b/modules/docker/mysql8/mysql8.bash
index 0f28238..1f9f733 100644
--- a/modules/docker/mysql8/mysql8.bash
+++ b/modules/docker/mysql8/mysql8.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/mysql8
+cd "$project_path/modules/docker/mysql8" || exit 1
 docker compose up -d --build --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/nexus/nexus.bash b/modules/docker/nexus/nexus.bash
index 6c4e1ff..78a7c86 100644
--- a/modules/docker/nexus/nexus.bash
+++ b/modules/docker/nexus/nexus.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/nexus
+cd "$project_path/modules/docker/nexus" || exit 1
 docker compose up --build --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/nginx/nginx.bash b/modules/docker/nginx/nginx.bash
index c6b4fa0..14cc1e9 100644
--- a/modules/docker/nginx/nginx.bash
+++ b/modules/docker/nginx/nginx.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/nginx
+cd "$project_path/modules/docker/nginx" || exit 1
 docker compose up -d --build --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/nodejs/nodejs.bash b/modules/docker/nodejs/nodejs.bash
index 9644f62..b287a92 100644
--- a/modules/docker/nodejs/nodejs.bash
+++ b/modules/docker/nodejs/nodejs.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/nodejs
+cd "$project_path/modules/docker/nodejs" || exit 1
 docker compose up --build -d --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/tomcat9/tomcat9.bash b/modules/docker/tomcat9/tomcat9.bash
index 509a2aa..0dbc5a5 100644
--- a/modules/docker/tomcat9/tomcat9.bash
+++ b/modules/docker/tomcat9/tomcat9.bash
@@ -1,4 +1,4 @@
 #!/bin/bash
-cd $project_path/modules/docker/tomcat9
+cd "$project_path/modules/docker/tomcat9" || exit 1
 docker compose up -d --build --force-recreate
-cd
+cd "$OLDPWD" || exit 1
diff --git a/modules/docker/vtiger/entrypoint.bash b/modules/docker/vtiger/entrypoint.bash
index 08a550b..3117eb8 100644
--- a/modules/docker/vtiger/entrypoint.bash
+++ b/modules/docker/vtiger/entrypoint.bash
@@ -1,4 +1,6 @@
 #!/bin/bash
+# Docker entrypoint script - exec "$@" and sed quoting patterns are intentional
+# shellcheck disable=SC2027,SC2093
 ###TEMPORAL
 DB_HOSTNAME=mysql5
 DB_USERNAME=vtiger
diff --git a/modules/help/docker/docker.bash b/modules/help/docker/docker.bash
index 5cdbd70..275a7b3 100644
--- a/modules/help/docker/docker.bash
+++ b/modules/help/docker/docker.bash
@@ -23,7 +23,7 @@ echo "docker cp index.html 4f950f3d6c81:/srv/www/htdocs/index.html"
 yellow
 echo "Entrypoint sempre"
 nocolor
-echo "ENTRYPOINT ["tail", "-f", "/dev/null"]"
+echo 'ENTRYPOINT ["tail", "-f", "/dev/null"]'
 yellow
 echo "Helm"
 nocolor
diff --git a/modules/john/dictionary/dictionary.bash b/modules/john/dictionary/dictionary.bash
index 7406436..ef4b013 100644
--- a/modules/john/dictionary/dictionary.bash
+++ b/modules/john/dictionary/dictionary.bash
@@ -1,6 +1,6 @@
 #!/bin/bash
 script_path=$(dirname $0)
-source ""$script_path"/functions.bash"
+source "$script_path/functions.bash"
 #Main
 echo -e "1) Check if leaked - password\n"
 echo -e "2) Check if leaked - hash\n"
diff --git a/modules/john/dictionary/functions.bash b/modules/john/dictionary/functions.bash
index 190a764..b9754c8 100644
--- a/modules/john/dictionary/functions.bash
+++ b/modules/john/dictionary/functions.bash
@@ -5,11 +5,11 @@ leaked_password() {
 	raw_hash=/tmp/"$RANDOM"
 	hash=/tmp/"$RANDOM"
 	echo -n "$plain_text" | openssl md5 >$raw_hash
-	cat $raw_hash | awk '{ printf $2 }' >$hash
+  cat "$raw_hash" | awk '{ printf $2 }' >"$hash"
 	rm -f $raw_hash
-	echo -e $(echo "Looking for: "$(cat $hash))
-	john $hash --wordlist=/usr/share/john/password.lst --format=Raw-MD5 --stdout | head -n10
-	rm -f $hash
+  echo -e "Looking for: $(cat "$hash")"
+  john "$hash" --wordlist=/usr/share/john/password.lst --format=Raw-MD5 --stdout | head -n10
+  rm -f "$hash"
 	plain_text=""
 }
 leaked_hash() {
@@ -38,6 +38,6 @@ leaked_hash() {
 		check_hash=""
 	fi
 }
-rm -rf $HOME/.john/john.rec
-export leaked_password
-export leaked_hash
+  rm -rf "$HOME/.john/john.rec"
+  export leaked_password
+  export leaked_hash
diff --git a/modules/john/unshadow/unshadow.bash b/modules/john/unshadow/unshadow.bash
index 16fe480..915f2d2 100644
--- a/modules/john/unshadow/unshadow.bash
+++ b/modules/john/unshadow/unshadow.bash
@@ -1,5 +1,5 @@
 #!/bin/bash
 script_path=$(dirname $0)
-source ""$script_path"/functions.bash"
+source "$script_path/functions.bash"
 #Main
 john_unshadow
diff --git a/modules/john/zip/functions.bash b/modules/john/zip/functions.bash
index 722dabf..c00e8c5 100644
--- a/modules/john/zip/functions.bash
+++ b/modules/john/zip/functions.bash
@@ -1,7 +1,7 @@
 #!/bin/bash
 john_zip_file() {
 	rm -f $HOME/.john/john.rec
-	cd $(pwd)
+	cd "$(pwd)" || exit 1
 	hash=/tmp/"$RANDOM"
 	zip2john "$1" >"$hash"
 	john "$hash" --wordlist=/usr/share/john/password.lst --stdout | head -n10
diff --git a/modules/john/zip/zip.bash b/modules/john/zip/zip.bash
index 69cb9bd..86dc47c 100644
--- a/modules/john/zip/zip.bash
+++ b/modules/john/zip/zip.bash
@@ -1,5 +1,5 @@
 #!/bin/bash
 script_path=$(dirname $0)
-source ""$script_path"/functions.bash"
+source "$script_path/functions.bash"
 #Main
 john_zip_file $1
diff --git a/modules/utils/git/repo-undo-local-changes.bash b/modules/utils/git/repo-undo-local-changes.bash
index 194b2f7..226f67b 100644
--- a/modules/utils/git/repo-undo-local-changes.bash
+++ b/modules/utils/git/repo-undo-local-changes.bash
@@ -5,7 +5,7 @@ changed_dirs=()
 # Loop through each directory
 for dir in */; do
 	if [ -d "$dir/.git" ]; then
-		cd "$dir"
+		cd "$dir" || continue
 		git reset --hard
 		# git checkout develop  # Checkout the develop branch
 		# git pull              # Pull the latest changes
diff --git a/modules/yt-dlp/yt-dlp.bash b/modules/yt-dlp/yt-dlp.bash
index 58d3cfa..187cf8f 100644
--- a/modules/yt-dlp/yt-dlp.bash
+++ b/modules/yt-dlp/yt-dlp.bash
@@ -4,5 +4,5 @@ read playlist_name
 echo "Playlist URL"
 read playlist_url
 mkdir ~/Downloads/"$playlist_name"
-cd ~/Downloads/"$playlist_name"
+cd ~/Downloads/"$playlist_name" || exit 1
 /usr/bin/yt-dlp -x -o "%(playlist_index)s-%(title)s.%(ext)s" --format mp4 $playlist_url
diff --git a/tests/validate.bash b/tests/validate.bash
index c73e588..cc584fb 100755
--- a/tests/validate.bash
+++ b/tests/validate.bash
@@ -1,7 +1,8 @@
 #!/bin/bash
 # myshell validation gate — run from anywhere: bash tests/validate.bash
 # Checks: shell syntax, shellcheck, .bashrc loader integrity, alias->module integrity,
-# myshell func_files consistency, docker compose configs, myshell smoke test.
+# myshell func_files consistency, docker compose configs, myshell smoke test,
+# shebang on extensionless dot-files, hardcoded paths, anti-patterns.
 set -u
 cd "$(dirname "$0")/.." || exit 1
 root=$PWD
@@ -65,16 +66,65 @@ else
     echo "WARN: docker compose unavailable, compose configs skipped"
 fi
 smoke=$(
-    export project_path="$root" MY_SHELL_ENV_DIR="$(mktemp -d)"
     # shellcheck source=core/shells/bash/functions/myshell.bash
-    source core/shells/bash/functions/myshell.bash
-    myshell list
+    # shellcheck disable=SC2155
+    _tmp_dir="$(mktemp -d)"
+    project_path="$root"
+    export MY_SHELL_ENV_DIR="$_tmp_dir"
+    source core/shells/bash/functions/myshell.bash && myshell list
+    rm -rf "$_tmp_dir"
 ) || fail "myshell list crashed"
 echo "$smoke" | grep -q "MODULE COMMANDS" || fail "myshell list: header missing"
 n_cmds=$(echo "$smoke" | grep -c "\->") || true
 [ "${n_cmds:-0}" -gt 0 ] || fail "myshell list: no commands listed"
 echo "[6/6] compose + smoke done ($n_cmds commands listed)"
 
+# ── 7. shellcheck on ALL module files (not just core functions) ──
+# Flags only real issues: SC2164 (unsafe cd), SC2140 (bad quoting).
+# SC2139 (alias expansion), SC2154 (var from .bashrc), SC1090 (dynamic source),
+# SC2034 (unused/exported var) are expected in this framework.
+# Vendor payloads (Docker/ catalina, tomcat startup) are excluded.
+if command -v shellcheck >/dev/null 2>&1; then
+    find core modules tests -type f \( -name '*.bash' -o -name '*.sh' \) \
+        ! -path '*/Docker/*' -print0 | \
+        xargs -0 shellcheck -S warning -e SC2139 -e SC2154 -e SC1090 -e SC2034 2>/dev/null \
+        || fail "shellcheck: modules (real issues)"
+    echo "[7/10] shellcheck (modules) done"
+else
+    echo "[7/10] WARN: shellcheck not installed, skipped modules"
+fi
+
+# ── 8. extensionless dot-files in core/shells/bash/ must have a shebang ──
+for f in core/shells/bash/.bashrc core/shells/bash/.bash_profile \
+         core/shells/bash/aliases/.aliases core/shells/bash/aliases/.base.sh \
+         core/shells/bash/aliases/.docker.sh core/shells/bash/aliases/.git.sh \
+         core/shells/bash/aliases/.modules.sh core/shells/bash/aliases/.utilities.sh \
+         core/shells/bash/profiles/.appearance core/shells/bash/profiles/.completion \
+         core/shells/bash/profiles/.config_files core/shells/bash/profiles/.git-configs \
+         core/shells/bash/profiles/.history core/shells/bash/profiles/.path \
+         core/shells/bash/profiles/.pwsh core/shells/bash/profiles/.software \
+         core/shells/bash/profiles/.ssh; do
+    [ -f "$f" ] || continue
+    first_line=$(head -1 "$f")
+    case "$first_line" in
+        '#!'*) ;; # OK
+        *) fail "shebang missing: $f (first line: '$first_line')" ;;
+    esac
+done
+echo "[8/10] shebang on extensionless dot-files done"
+
+# ── 9. no hardcoded ~/Documents/myshell/ paths in aliases ──
+while IFS= read -r match; do
+    fail "hardcoded path found: $match"
+done < <(grep -rn "\$HOME/Documents/myshell/" core/shells/bash/aliases/ 2>/dev/null || true)
+echo "[9/10] hardcoded path check done"
+
+# ── 10. anti-patterns: grep -c | cat, pipe to grep, unquoted variables in test brackets ──
+while IFS= read -r match; do
+    fail "anti-pattern (cat | grep): $match"
+done < <(grep -rn 'cat .*/.* | grep' core/shells/bash/aliases/ modules/ 2>/dev/null || true)
+echo "[10/10] anti-pattern check done"
+
 # ── verdict ──
 if [ "$fails" -eq 0 ]; then
     echo "VALIDATION PASSED"