- nosec for the staging path on the device (B108); it is a mktemp template on the remote host, not a local temp file. - The wildcard listen addresses parsed from sockstat/netstat are named constants with a nosec (B104): reported data, never a bind. The output is unchanged. - ruff found nothing left after the mechanical pass.