diff --git a/.agents/skills/shell-codestyle/SKILL.md b/.agents/skills/shell-codestyle/SKILL.md
index 5f5894a19..1708f1dfc 100644
--- a/.agents/skills/shell-codestyle/SKILL.md
+++ b/.agents/skills/shell-codestyle/SKILL.md
@@ -70,8 +70,8 @@ depend on Python either. Everything else is Python, with a test under its own sc
 - **`shellcheck` clean, and a deliberate exception carries its reason inline.** A
   `# shellcheck disable=SCxxxx` names why the rule does not apply here, so the next reader can
   tell a considered exception from an unread warning. The hub's own `repo-config/configure.sh` is
-  the worked example, carrying `SC2016` disables where a single-quoted `jq` program must stay
-  unexpanded, each with its reason on the same line.
+  the worked example. Its `SC2016` disables sit only where shellcheck flags a single-quoted `jq`
+  program or GraphQL query that must stay unexpanded. Each carries its reason on the same line.
 - **Comments say why, never what.** The code states what it does. A comment restating it goes
   stale silently, where a comment carrying a reason fails visibly when the reason stops being
   true.
diff --git a/.claude-plugin/fleet-skills/.source-digests/shell-codestyle b/.claude-plugin/fleet-skills/.source-digests/shell-codestyle
index a0e38df3b..188cb067b 100644
--- a/.claude-plugin/fleet-skills/.source-digests/shell-codestyle
+++ b/.claude-plugin/fleet-skills/.source-digests/shell-codestyle
@@ -1 +1 @@
-89729bb8dbd2a730
+52454c88dd2aedc0
diff --git a/.claude-plugin/fleet-skills/skills/shell-codestyle/SKILL.md b/.claude-plugin/fleet-skills/skills/shell-codestyle/SKILL.md
index 5f5894a19..1708f1dfc 100644
--- a/.claude-plugin/fleet-skills/skills/shell-codestyle/SKILL.md
+++ b/.claude-plugin/fleet-skills/skills/shell-codestyle/SKILL.md
@@ -70,8 +70,8 @@ depend on Python either. Everything else is Python, with a test under its own sc
 - **`shellcheck` clean, and a deliberate exception carries its reason inline.** A
   `# shellcheck disable=SCxxxx` names why the rule does not apply here, so the next reader can
   tell a considered exception from an unread warning. The hub's own `repo-config/configure.sh` is
-  the worked example, carrying `SC2016` disables where a single-quoted `jq` program must stay
-  unexpanded, each with its reason on the same line.
+  the worked example. Its `SC2016` disables sit only where shellcheck flags a single-quoted `jq`
+  program or GraphQL query that must stay unexpanded. Each carries its reason on the same line.
 - **Comments say why, never what.** The code states what it does. A comment restating it goes
   stale silently, where a comment carrying a reason fails visibly when the reason stops being
   true.
diff --git a/.github/skills/shell-codestyle/SKILL.md b/.github/skills/shell-codestyle/SKILL.md
index 5f5894a19..1708f1dfc 100644
--- a/.github/skills/shell-codestyle/SKILL.md
+++ b/.github/skills/shell-codestyle/SKILL.md
@@ -70,8 +70,8 @@ depend on Python either. Everything else is Python, with a test under its own sc
 - **`shellcheck` clean, and a deliberate exception carries its reason inline.** A
   `# shellcheck disable=SCxxxx` names why the rule does not apply here, so the next reader can
   tell a considered exception from an unread warning. The hub's own `repo-config/configure.sh` is
-  the worked example, carrying `SC2016` disables where a single-quoted `jq` program must stay
-  unexpanded, each with its reason on the same line.
+  the worked example. Its `SC2016` disables sit only where shellcheck flags a single-quoted `jq`
+  program or GraphQL query that must stay unexpanded. Each carries its reason on the same line.
 - **Comments say why, never what.** The code states what it does. A comment restating it goes
   stale silently, where a comment carrying a reason fails visibly when the reason stops being
   true.
diff --git a/repo-config/configure.sh b/repo-config/configure.sh
index b924a2cba..9fbbf8553 100755
--- a/repo-config/configure.sh
+++ b/repo-config/configure.sh
@@ -367,7 +367,6 @@ apply_project() { # project-node-id
     number="$(jqr '.number' "$project_file")"
     title="$(jqr '.title' "$project_file")"
     live="$(repo_projects)"
-    # shellcheck disable=SC2016  # $p is a jq --arg variable, not a shell expansion
     if jq -e --arg p "$pid" '.projects | index($p) != null' <<<"$live" >/dev/null 2>&1; then
         echo "Already linked to project '$title' ($owner, number $number)"
         return
@@ -555,9 +554,7 @@ check_ruleset() { # payload-file - the live ruleset must match the committed pol
     ptypes="$(jqr '[.rules[] | select(has("parameters")) | .type] | .[]' "$file")"
     while IFS= read -r t; do
         [ -z "$t" ] && continue
-        # shellcheck disable=SC2016  # $t is a jq --arg variable, not a shell expansion
         want="$(jq -S -c --arg t "$t" "[.rules[] | select(.type==\$t) | .parameters] | first | $norm" "$file")"
-        # shellcheck disable=SC2016  # $t is a jq --arg variable, not a shell expansion
         got="$(jq -S -c --arg t "$t" "[.rules[] | select(.type==\$t) | .parameters] | first | $norm" <<<"$live")"
         assert "'$rname' rule '$t' parameters match the payload" test "$got" = "$want"
     done <<<"$ptypes"
@@ -711,7 +708,6 @@ check_environments() {
         return
     fi
     # The declared value is emitted verbatim, invalid shapes included, so each one reaches the test that judges it rather than being defaulted away here.
-    # shellcheck disable=SC2016  # $n is a jq --arg variable, not a shell expansion
     if ! entries="$(jq -c --arg n "$name" '[.repos[] | select(.name == $n)][0] | if has("environments") then .environments else [] end' "$registry")"; then
         fail "could not read the declared deployment environments from $registry"
         return
@@ -746,7 +742,6 @@ check_environments() {
         fi
         ename="$(jqr '.name' <<<"$row")"
         policy="$(jqr '.branchPolicy' <<<"$row")"
-        # shellcheck disable=SC2016  # $n is a jq --arg variable, not a shell expansion
         env_live="$(jq -c --arg n "$ename" '[.[] | select(.name == $n)] | first // empty' <<<"$live_envs")"
         if [ -z "$env_live" ]; then
             fail "environment '$ename' missing"