diff --git a/.jscpd.json b/.jscpd.json
new file mode 100644
index 00000000..6a696e3f
--- /dev/null
+++ b/.jscpd.json
@@ -0,0 +1,12 @@
+{
+  "threshold": 10,
+  "minLines": 10,
+  "minTokens": 50,
+  "ignore": [
+    "**/target/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/*.svg",
+    "**/flamegraphs/**"
+  ]
+}
diff --git a/clippy.toml b/clippy.toml
new file mode 100644
index 00000000..edcabaa6
--- /dev/null
+++ b/clippy.toml
@@ -0,0 +1,7 @@
+# cognitive_complexity is allow-by-default in clippy; script/check enables it
+# with `-W clippy::cognitive_complexity`. This threshold is set well above
+# clippy's own default (25) to accommodate existing large dispatch functions
+# (e.g. Matrix bot command routing) without requiring an unrelated refactor;
+# it still gates against genuinely runaway complexity introduced going
+# forward.
+cognitive-complexity-threshold = 200
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 76624818..2b604fce 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -88,6 +88,11 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 # Claude Code CLI in runtime
 RUN npm install -g @anthropic-ai/claude-code
 
+# jscpd — duplication detector used by script/check. Installed in the
+# runtime stage (not just the base build stage) so it's available to agents
+# running script/check inside the sled, not only on a developer machine.
+RUN npm install -g jscpd
+
 # Cargo and Rust toolchain needed at runtime for:
 # - rebuild_and_restart (cargo build inside the container)
 # - Agent-driven cargo commands (cargo clippy, cargo test, etc.)
diff --git a/script/check b/script/check
index b9fd69cd..160e43be 100755
--- a/script/check
+++ b/script/check
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
-# Pre-commit quality gate: fmt-check, clippy, cargo check, and doc-coverage.
-# Run this before committing to catch fmt drift, clippy warnings, compile
-# errors, and missing doc comments without waiting for the full test suite.
+# Pre-commit quality gate: fmt-check, clippy, duplication, cargo check, and
+# doc-coverage. Run this before committing to catch fmt drift, clippy
+# warnings, duplicate code, compile errors, and missing doc comments without
+# waiting for the full test suite.
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
@@ -11,7 +12,20 @@ echo "=== Checking Rust formatting ==="
 cargo fmt --manifest-path "$PROJECT_ROOT/Cargo.toml" --all --check
 
 echo "=== Running cargo clippy ==="
-cargo clippy --manifest-path "$PROJECT_ROOT/Cargo.toml" --workspace --all-targets -- -D warnings
+# clippy::cognitive_complexity is allow-by-default; -W activates it so that
+# -D warnings turns violations into a hard failure. The threshold it's
+# measured against lives in clippy.toml (committed, not passed ad hoc).
+cargo clippy --manifest-path "$PROJECT_ROOT/Cargo.toml" --workspace --all-targets -- -W clippy::cognitive_complexity -D warnings
+
+echo "=== Checking code duplication (jscpd) ==="
+if ! command -v jscpd &>/dev/null; then
+  echo "FAIL: jscpd is not installed. Install it with 'npm install -g jscpd' before running script/check." >&2
+  exit 1
+fi
+# Duplication threshold lives in .jscpd.json (committed, not passed ad hoc).
+# jscpd exits non-zero automatically when duplication exceeds that threshold.
+jscpd --config "$PROJECT_ROOT/.jscpd.json" \
+  "$PROJECT_ROOT/server/src" "$PROJECT_ROOT/frontend/src" "$PROJECT_ROOT/crates"
 
 echo "=== Checking doc coverage on changed files ==="
 cargo run --manifest-path "$PROJECT_ROOT/Cargo.toml" -p source-map-gen --bin source-map-check --quiet -- --worktree "$PROJECT_ROOT" --base master