diff --git a/engineering/universal-scraping-architect/agents/cs-scraping-architect.md b/engineering/universal-scraping-architect/agents/cs-scraping-architect.md
index 4709e4b4..911dd045 100644
--- a/engineering/universal-scraping-architect/agents/cs-scraping-architect.md
+++ b/engineering/universal-scraping-architect/agents/cs-scraping-architect.md
@@ -27,7 +27,7 @@ Data-extraction pipeline architect. Operates the `skills/universal-scraping-arch
    ```bash
    python3 skills/universal-scraping-architect/scripts/validate_extraction.py extracted_output.json --json
    ```
-   Exit 0 = `{"status": "ok"}` → proceed. Exit 1 (`warning` = empty output, `error` = malformed JSON) → fix and re-extract; never deliver. Then check required fields and duplicates against the pipeline spec.
+   Exit 0 = `{"status": "ok"}` → proceed. Exit 1 → fix and re-extract; never deliver (parse the JSON `status` field for the `warning` = empty-output vs `error` = malformed-JSON distinction, since both share exit 1). Then check required fields and duplicates against the pipeline spec.
 6. **Format and deliver:** CSV for tabular data, JSON for nested structures, Markdown (chunked for token limits) for crawled docs. Report row counts and empty-value summary.
 
 ## Refusal & Flag Gates
diff --git a/marketing-skill/skills/marketing-demand-acquisition/scripts/calculate_cac.py b/marketing-skill/skills/marketing-demand-acquisition/scripts/calculate_cac.py
index c340456a..ae708ae0 100644
--- a/marketing-skill/skills/marketing-demand-acquisition/scripts/calculate_cac.py
+++ b/marketing-skill/skills/marketing-demand-acquisition/scripts/calculate_cac.py
@@ -6,6 +6,7 @@ Calculate blended and channel-specific CAC for marketing campaigns.
 Supports multiple time periods and channel breakdowns.
 """
 
+import argparse
 import sys
 from typing import Dict, List
 
@@ -100,7 +101,6 @@ def main():
     print("Blended Target: <$300")
 
 if __name__ == "__main__":
-    import argparse
     parser = argparse.ArgumentParser(
         description="Calculate blended and channel-specific CAC.",
         formatter_class=argparse.RawDescriptionHelpFormatter,
diff --git a/scripts/check_paths_allowlist.txt b/scripts/check_paths_allowlist.txt
index 2f02220d..77a4ec90 100644
--- a/scripts/check_paths_allowlist.txt
+++ b/scripts/check_paths_allowlist.txt
@@ -33,5 +33,6 @@ engineering-team/self-improving-agent/skills/extract/SKILL.md :: docker-m1-fixes
 engineering-team/self-improving-agent/skills/extract/SKILL.md :: api-client-regen/SKILL.md
 
 # Path-traversal attack payload in a pen-testing teaching table, not a real
-# file reference. Resolves to the host /etc/passwd only on deep checkouts.
+# file reference. Would point outside the repo root if resolved literally;
+# allowlisted as a teaching example, not an actual file.
 engineering-team/skills/security-pen-testing/SKILL.md :: ../../../etc/passwd
diff --git a/scripts/smoke_scripts.py b/scripts/smoke_scripts.py
index 0aa7fd54..ab8c77f2 100644
--- a/scripts/smoke_scripts.py
+++ b/scripts/smoke_scripts.py
@@ -158,6 +158,8 @@ def main(argv=None):
 
     if failures:
         return 1
+    # Only reached when no --help failures; a real failure (exit 1) takes
+    # precedence over allowlist hygiene (exit 3).
     if stale_exceptions:
         return 3
     return 0