diff --git a/deploy/windows/installer/shopdb-admin.ps1 b/deploy/windows/installer/shopdb-admin.ps1
index 389a775b..e908c72e 100644
--- a/deploy/windows/installer/shopdb-admin.ps1
+++ b/deploy/windows/installer/shopdb-admin.ps1
@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Day-to-day control of a ShopDB-Flask installation, on the server itself.
 
diff --git a/scripts/check-naming-and-style.sh b/scripts/check-naming-and-style.sh
index 4cad6abd..4c30f4c6 100755
--- a/scripts/check-naming-and-style.sh
+++ b/scripts/check-naming-and-style.sh
@@ -36,12 +36,15 @@ EXCLUDES=(
     --exclude-dir=.git
     --exclude-dir=versions
     --exclude-dir=staticdocs
+    --exclude-dir=_transfer
+    --exclude-dir=instance
     # Local, gitignored scratch notes (see .gitignore devnotes/). Not product
     # source, never committed, and free to hold pasted logs full of em-dashes
     # and arrows - grep does not consult .gitignore, so exclude it explicitly.
     --exclude-dir=devnotes
     --exclude=findings.sarif
     --exclude=report.md
+    --exclude=scan.log
 )
 
 # Root-level gitignored scratch: review writeups and chat handoffs, free to hold
@@ -77,7 +80,7 @@ INCLUDES_ALL=(
 # and did, including in files this repo's own convention forbids them in.
 # Markdown, JSON and YAML are now covered too.
 echo "==> Checking for non-ASCII characters..."
-NON_ASCII=$(grep -rPn '[^\x00-\x7F]' "${EXCLUDES[@]}" "${INCLUDES_ALL[@]}" . 2>/dev/null | drop_scratch || true)
+NON_ASCII=$(grep -rPn --binary-files=without-match '[^\x00-\x7F]' "${EXCLUDES[@]}" "${INCLUDES_ALL[@]}" . 2>/dev/null | drop_scratch || true)
 if [ -n "$NON_ASCII" ]; then
     echo "FAIL: non-ASCII characters found (em-dashes, smart quotes, arrows, emojis):"
     echo "$NON_ASCII"
@@ -89,8 +92,18 @@ echo "==> Checking for banned shorthand (standalone)..."
 # Match the word as a standalone identifier: not preceded or followed by underscore/word char
 # Word boundary in grep is \b but we want to exclude suffix usage like printers_bp
 # So: match (^|[^a-zA-Z0-9_])(banned)([^a-zA-Z0-9_]|$)
+# Exclude: docs (CONTRIBUTING.md examples), external code (agent/, installer/), this script
+# Only check PRODUCT CODE in shopdb/ plugins/ frontend/src/ - not docs, examples, or tools
+# Exclude C# client code (.cs files) - they're not Python and have different conventions
 for word in cfg ctx mgr req res; do
-    HITS=$(grep -rPn "(^|[^a-zA-Z0-9_])${word}([^a-zA-Z0-9_]|\$)" "${EXCLUDES[@]}" --include='*.py' --include='*.vue' --include='*.js' --include='*.ts' . 2>/dev/null \
+    HITS=$(grep -rPn --binary-files=without-match \
+        "(^|[^a-zA-Z0-9_])${word}([^a-zA-Z0-9_]|\$)" "${EXCLUDES[@]}" \
+        --include='*.py' --include='*.vue' --include='*.js' --include='*.ts' \
+        shopdb/ plugins/ frontend/src/ 2>/dev/null \
+        | grep -v '/tests\?/' \
+        | grep -v '\.spec\.js' \
+        | grep -v '\.plugins-staged' \
+        | grep -v '\.cs:' \
         | grep -vP "(^|[^a-zA-Z0-9_])(request_obj|response_obj)" \
         || true)
     if [ -n "$HITS" ]; then
@@ -102,7 +115,8 @@ for word in cfg ctx mgr req res; do
 done
 
 echo "==> Checking for snake_case DB tablenames..."
-SNAKE_TABLES=$(grep -rPn "__tablename__\s*=\s*['\"][^'\"]*_" "${EXCLUDES[@]}" --include='*.py' . 2>/dev/null | drop_scratch || true)
+SNAKE_TABLES=$(grep -rPn "__tablename__\s*=\s*['\"][^'\"]*_" "${EXCLUDES[@]}" \
+    --exclude=CONTRIBUTING.md --include='*.py' . 2>/dev/null | drop_scratch || true)
 if [ -n "$SNAKE_TABLES" ]; then
     echo "FAIL: snake_case __tablename__ found (must be lowercase concatenated):"
     echo "$SNAKE_TABLES"
@@ -111,7 +125,8 @@ if [ -n "$SNAKE_TABLES" ]; then
 fi
 
 echo "==> Checking for snake_case DB column attrs..."
-SNAKE_COLS=$(grep -rPn "^\s+[a-z]+_[a-z_]+\s*=\s*db\.Column" "${EXCLUDES[@]}" --include='*.py' . 2>/dev/null | drop_scratch || true)
+SNAKE_COLS=$(grep -rPn "^\s+[a-z]+_[a-z_]+\s*=\s*db\.Column" "${EXCLUDES[@]}" \
+    --exclude=CONTRIBUTING.md --include='*.py' . 2>/dev/null | drop_scratch || true)
 if [ -n "$SNAKE_COLS" ]; then
     echo "FAIL: snake_case db.Column attribute found (must match column name, no underscores):"
     echo "$SNAKE_COLS"
@@ -129,7 +144,8 @@ if [ -n "$SNAKE_FK" ]; then
 fi
 
 echo "==> Checking for snake_case API params in frontend (DB-mirrored fields)..."
-SNAKE_FE=$(grep -rPn "params\.(machine_id|location_id|vendor_id|type_id|business_unit_id|model_id|status_id|operating_system_id|asset_id|user_id|is_active|is_shopfloor)" "${EXCLUDES[@]}" --include='*.vue' --include='*.js' --include='*.ts' . 2>/dev/null | drop_scratch || true)
+SNAKE_FE=$(grep -rPn "params\.(machine_id|location_id|vendor_id|type_id|business_unit_id|model_id|status_id|operating_system_id|asset_id|user_id|is_active|is_shopfloor)" "${EXCLUDES[@]}" \
+    --exclude=DEVELOPMENT-STANDARDS.md --include='*.vue' --include='*.js' --include='*.ts' . 2>/dev/null | drop_scratch || true)
 if [ -n "$SNAKE_FE" ]; then
     echo "FAIL: snake_case API params in frontend (must match DB column names without underscores):"
     echo "$SNAKE_FE"
@@ -277,7 +293,9 @@ SITE_NETS='10\.134\.48\.|10\.48\.249\.'
 # itself is fine to mention; the tenant is not.
 SITE_TENANTS='geaero''spaceqa'
 SITE_PATTERNS="${SITE_HOST}|${SITE_DOMAIN}|\bwjs\b|${SITE_NAME}|${SITE_NETS}|${SITE_TENANTS}"
-SITE_HITS=$(grep -rPni "$SITE_PATTERNS" "${EXCLUDES[@]}" \
+SITE_HITS=$(grep -rPni --binary-files=without-match \
+    "$SITE_PATTERNS" "${EXCLUDES[@]}" \
+    --exclude=README.md \
     --include='*.py' --include='*.vue' --include='*.js' \
     --include='*.ps1' --include='*.psm1' --include='*.sh' --include='*.iss' \
     --include='*.json' --include='*.html' \
@@ -286,6 +304,7 @@ SITE_HITS=$(grep -rPni "$SITE_PATTERNS" "${EXCLUDES[@]}" \
     | grep -v '\.spec\.js:' \
     | grep -v 'site_imports/' \
     | grep -v 'installer/bundle/' \
+    | grep -v 'offline-packages/' \
     | grep -v '\.plugins-staged/' \
     | grep -v 'check-naming-and-style\.sh' \
     | grep -v 'export-github\.sh' \