diff --git a/cmd/installer/install/install.go b/cmd/installer/install/install.go
index 3dde95b50..b9b300491 100644
--- a/cmd/installer/install/install.go
+++ b/cmd/installer/install/install.go
@@ -870,7 +870,7 @@ func fireInstallCallback() {
 		return
 	}
 	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Get(url) //nolint:noctx // installer has no context; best-effort fire-and-forget
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Warn("fireInstallCallback: request failed", "url", url, "err", err)
 		return
diff --git a/cmd/spinifex/cmd/admin_ochre_vector.go b/cmd/spinifex/cmd/admin_ochre_vector.go
index c3ff43bf0..321eed7cd 100644
--- a/cmd/spinifex/cmd/admin_ochre_vector.go
+++ b/cmd/spinifex/cmd/admin_ochre_vector.go
@@ -283,11 +283,9 @@ func truncateForTable(s string, maxRunes int) string {
 }
 
 // formatQueryResults renders 'ochre vector query' output: a truncated table
-// by default, or the full response as indented JSON when asJSON is set
-// (D10's "full text via source ref" -- here, via --json).
+// by default, or the full response as indented JSON when asJSON is set.
 func formatQueryResults(results []handlers_ochrevector.QueryResult, asJSON bool) (string, error) {
 	if asJSON {
-		//nolint:musttag // QueryResult is an internal, non-wire Go type (predates this CLI); it round-trips fine on its default field names.
 		data, err := json.MarshalIndent(results, "", "  ")
 		if err != nil {
 			return "", fmt.Errorf("encode results as JSON: %w", err)
@@ -317,7 +315,6 @@ func parseFilterFlag(raw string) (*handlers_ochrevector.Filter, error) {
 		return nil, nil
 	}
 	var f handlers_ochrevector.Filter
-	//nolint:musttag // Filter is the existing filter-AST type (D9); it round-trips fine on its default field names.
 	if err := json.Unmarshal([]byte(raw), &f); err != nil {
 		return nil, fmt.Errorf("decode --filter: %w", err)
 	}
diff --git a/spinifex/daemon/daemon_handlers.go b/spinifex/daemon/daemon_handlers.go
index 004ec06d5..e8a7578eb 100644
--- a/spinifex/daemon/daemon_handlers.go
+++ b/spinifex/daemon/daemon_handlers.go
@@ -482,7 +482,7 @@ var roleHTTPClient = &http.Client{Timeout: 500 * time.Millisecond}
 
 // fetchNATSRole queries a NATS /varz endpoint and returns "leader", "follower", or "".
 func fetchNATSRole(url string, client *http.Client) string {
-	resp, err := client.Get(url) //nolint:noctx // internal monitoring call
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Debug("Failed to query NATS monitoring", "err", err)
 		return ""
diff --git a/spinifex/daemon/state_test.go b/spinifex/daemon/state_test.go
index 5eb1ae974..e082470dc 100644
--- a/spinifex/daemon/state_test.go
+++ b/spinifex/daemon/state_test.go
@@ -254,7 +254,7 @@ func TestEveryState_CanReachTerminated(t *testing.T) {
 			continue
 		}
 
-		visited := map[vm.InstanceState]bool{start: true} //nolint:exhaustive // BFS seed — populated dynamically
+		visited := map[vm.InstanceState]bool{start: true}
 		queue := []vm.InstanceState{start}
 		found := false
 
@@ -415,7 +415,7 @@ func TestTransitionState_ConcurrentTransitions(t *testing.T) {
 
 // reachableStates returns all states reachable from start via BFS.
 func reachableStates(start vm.InstanceState) map[vm.InstanceState]bool {
-	visited := map[vm.InstanceState]bool{start: true} //nolint:exhaustive // BFS seed — populated dynamically
+	visited := map[vm.InstanceState]bool{start: true}
 	queue := []vm.InstanceState{start}
 	for len(queue) > 0 {
 		current := queue[0]
diff --git a/spinifex/handlers/ochrevector/backend.go b/spinifex/handlers/ochrevector/backend.go
index 0bbd16033..9f18e89c4 100644
--- a/spinifex/handlers/ochrevector/backend.go
+++ b/spinifex/handlers/ochrevector/backend.go
@@ -27,11 +27,11 @@ type VectorRow struct {
 // stored metadata, source provenance, and cosine similarity Score in [0,1]
 // (D8; 1 - cosine_distance).
 type QueryResult struct {
-	Chunk        string
-	Metadata     map[string]any
-	SourceKey    string
-	SourceOffset int
-	Score        float32
+	Chunk        string         `json:"Chunk"`
+	Metadata     map[string]any `json:"Metadata"`
+	SourceKey    string         `json:"SourceKey"`
+	SourceOffset int            `json:"SourceOffset"`
+	Score        float32        `json:"Score"`
 }
 
 // defaultQueryK and maxQueryK bound Query's k (D8/D10): k<=0 defaults to
diff --git a/spinifex/handlers/ochrevector/filter.go b/spinifex/handlers/ochrevector/filter.go
index 4cfe1e0d0..2a7a5ee50 100644
--- a/spinifex/handlers/ochrevector/filter.go
+++ b/spinifex/handlers/ochrevector/filter.go
@@ -46,10 +46,10 @@ var filterKeyPattern = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]{0,63}$`)
 // orAll) over Children. Construct via the Equals/GreaterThan/.../AndAll
 // helpers rather than the struct literal directly.
 type Filter struct {
-	Op       FilterOp
-	Key      string
-	Value    any
-	Children []*Filter
+	Op       FilterOp  `json:"Op"`
+	Key      string    `json:"Key"`
+	Value    any       `json:"Value"`
+	Children []*Filter `json:"Children"`
 }
 
 // Equals builds an `equals` leaf filter: metadata[key] as text equals value.
diff --git a/spinifex/handlers/rds/window.go b/spinifex/handlers/rds/window.go
index 4ab48f92f..3d1221171 100644
--- a/spinifex/handlers/rds/window.go
+++ b/spinifex/handlers/rds/window.go
@@ -3,6 +3,7 @@ package handlers_rds
 import (
 	"fmt"
 	"hash/fnv"
+	"math"
 	"slices"
 	"strconv"
 	"strings"
@@ -290,7 +291,10 @@ func assignDailySlot(block dailyWindow, identifier string, shift int64) dailyWin
 	if slots < 1 {
 		return block
 	}
-	slot := int64(windowHash(identifier) % uint64(slots)) //nolint:gosec // the modulus bounds it to the slot count
+	var slot int64
+	if h := windowHash(identifier) % uint64(slots); h <= math.MaxInt64 {
+		slot = int64(h)
+	}
 	start := (block.start + time.Duration((slot+shift)%slots)*windowSlot) % oneDay
 	return dailyWindow{start: start, end: (start + windowSlot) % oneDay}
 }
diff --git a/spinifex/lbagent/healthcheck.go b/spinifex/lbagent/healthcheck.go
index 14424755e..4bd752283 100644
--- a/spinifex/lbagent/healthcheck.go
+++ b/spinifex/lbagent/healthcheck.go
@@ -76,7 +76,7 @@ func probeHTTP(t HealthTarget) bool {
 	}
 
 	url := fmt.Sprintf("%s://%s%s", scheme, t.Address, path)
-	resp, err := client.Get(url) //nolint:noctx // short fixed-timeout probe
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Warn("HTTP probe failed", "url", url, "err", err)
 		return false
diff --git a/tests/e2e/ecr/crane_skopeo_test.go b/tests/e2e/ecr/crane_skopeo_test.go
index 6f224c7f2..2bf30e111 100644
--- a/tests/e2e/ecr/crane_skopeo_test.go
+++ b/tests/e2e/ecr/crane_skopeo_test.go
@@ -22,7 +22,7 @@ const ociCmdTimeout = 2 * time.Minute
 func writeLayerTar(t *testing.T, dir string) string {
 	t.Helper()
 	path := filepath.Join(dir, "layer.tar")
-	fh, err := os.Create(path) //nolint:gosec // test-controlled path under TmpDir
+	fh, err := os.Create(path)
 	require.NoError(t, err)
 	defer fh.Close()
 
diff --git a/tests/e2e/ecs/ecs_test.go b/tests/e2e/ecs/ecs_test.go
index 13629492b..bd9a80900 100644
--- a/tests/e2e/ecs/ecs_test.go
+++ b/tests/e2e/ecs/ecs_test.go
@@ -527,7 +527,7 @@ func guestUserData(t *testing.T, env *harness.Env, fx *ecsFixture) string {
 	t.Helper()
 	caPath, err := harness.ResolveCACert(env)
 	require.NoError(t, err, "resolve CA cert")
-	caBytes, err := os.ReadFile(caPath) //nolint:gosec // CA path from harness env
+	caBytes, err := os.ReadFile(caPath)
 	require.NoError(t, err, "read CA cert")
 
 	var ca strings.Builder
diff --git a/tests/e2e/eks/eks_test.go b/tests/e2e/eks/eks_test.go
index 77cda0944..b6466474e 100644
--- a/tests/e2e/eks/eks_test.go
+++ b/tests/e2e/eks/eks_test.go
@@ -69,7 +69,7 @@ func TestEKS(t *testing.T) {
 	t.Run("DescribeKubeconfigArtifacts", func(t *testing.T) {
 		requireClusterReady(t, fx)
 		path := writeKubeconfig(t, artifacts, fx.Cluster)
-		raw, err := os.ReadFile(path) //nolint:gosec // artifact path built by the test
+		raw, err := os.ReadFile(path)
 		require.NoError(t, err)
 		kc := string(raw)
 		assert.Contains(t, kc, "server: "+aws.StringValue(fx.Cluster.Endpoint), "kubeconfig server = cluster endpoint")
diff --git a/tests/e2e/gpu/ecs_gpu_test.go b/tests/e2e/gpu/ecs_gpu_test.go
index aad6fe60b..1d24949cd 100644
--- a/tests/e2e/gpu/ecs_gpu_test.go
+++ b/tests/e2e/gpu/ecs_gpu_test.go
@@ -235,7 +235,7 @@ func ecsGPUUserData(t *testing.T, env *harness.Env, cluster string) string {
 	t.Helper()
 	caPath, err := harness.ResolveCACert(env)
 	require.NoError(t, err, "resolve CA cert")
-	caBytes, err := os.ReadFile(caPath) //nolint:gosec // CA path from harness env
+	caBytes, err := os.ReadFile(caPath)
 	require.NoError(t, err, "read CA cert")
 
 	var ca strings.Builder
diff --git a/tests/e2e/harness/fixtures_test.go b/tests/e2e/harness/fixtures_test.go
index 472b5ddf2..17634c246 100644
--- a/tests/e2e/harness/fixtures_test.go
+++ b/tests/e2e/harness/fixtures_test.go
@@ -428,9 +428,7 @@ func TestPollUntil_TimeoutWrapsLastErr(t *testing.T) {
 
 // Compile-time check: every exported Ensure* compiles with the Fixture.
 // Never invoked at runtime; pure type assertion against the public API.
-//
-//nolint:unused,deadcode // exists only to fail compile when an Ensure* signature drifts
-func _ensureCompileCheck(t *testing.T, fx *Fixture) {
+var _ = func(t *testing.T, fx *Fixture) {
 	_, _ = EnsureKeyPair(t, fx)
 	_ = EnsureAMI(t, fx, AMISource{Existing: "ami-0"})
 	_ = EnsureDefaultVPC(t, fx)
diff --git a/tests/e2e/harness/kubectl.go b/tests/e2e/harness/kubectl.go
index d5b8cc0bb..b3fc403c8 100644
--- a/tests/e2e/harness/kubectl.go
+++ b/tests/e2e/harness/kubectl.go
@@ -43,7 +43,7 @@ func NewKubectl(t *testing.T, kubeconfig string, awsEnv []string) *Kubectl {
 // output. Errors are returned (not fatal) so callers can poll readiness.
 func (k *Kubectl) Run(timeout time.Duration, args ...string) (string, error) {
 	full := append([]string{"--kubeconfig", k.Kubeconfig}, args...)
-	cmd := exec.Command(k.Bin, full...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(k.Bin, full...)
 	env := os.Environ()
 	env = append(env, k.AWSEnv...)
 	cmd.Env = env
@@ -116,7 +116,7 @@ func (k *Kubectl) execPluginProbe(timeout time.Duration) string {
 	if err != nil {
 		return "exec plugin " + argv[0] + " not on PATH: " + err.Error() + "\n"
 	}
-	cmd := exec.Command(bin, argv[1:]...) //nolint:gosec // argv comes from the kubeconfig this test wrote
+	cmd := exec.Command(bin, argv[1:]...)
 	cmd.Env = append(os.Environ(), k.AWSEnv...)
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout, cmd.Stderr = &stdout, &stderr
diff --git a/tests/e2e/harness/registry.go b/tests/e2e/harness/registry.go
index 0d1acfd1c..68cc24921 100644
--- a/tests/e2e/harness/registry.go
+++ b/tests/e2e/harness/registry.go
@@ -55,7 +55,7 @@ func NewSkopeo(t *testing.T, dockerConfig string) *ExternalCLI {
 // Run executes the client with args and returns combined output. Errors are
 // returned (not fatal) so callers can assert on output or poll.
 func (c *ExternalCLI) Run(timeout time.Duration, args ...string) (string, error) {
-	cmd := exec.Command(c.Bin, args...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(c.Bin, args...)
 	cmd.Env = append(os.Environ(), c.Env...)
 	var buf bytes.Buffer
 	cmd.Stdout = &buf
@@ -78,7 +78,7 @@ func (c *ExternalCLI) Run(timeout time.Duration, args ...string) (string, error)
 // RunStdin is Run with data piped to the process stdin (docker login
 // --password-stdin).
 func (c *ExternalCLI) RunStdin(timeout time.Duration, stdin string, args ...string) (string, error) {
-	cmd := exec.Command(c.Bin, args...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(c.Bin, args...)
 	cmd.Env = append(os.Environ(), c.Env...)
 	cmd.Stdin = strings.NewReader(stdin)
 	var buf bytes.Buffer
diff --git a/tests/e2e/harness/system_account.go b/tests/e2e/harness/system_account.go
index 9173de656..45b0f4ff6 100644
--- a/tests/e2e/harness/system_account.go
+++ b/tests/e2e/harness/system_account.go
@@ -35,7 +35,7 @@ func SystemAWSClient(t *testing.T, env *Env) *AWSClient {
 		t.Fatalf("SystemAWSClient: no config dir located; set SPINIFEX_CONFIG_DIR")
 	}
 	path := filepath.Join(env.ConfigDir, systemCredentialsFile)
-	out, err := exec.Command("sudo", "-n", "cat", path).Output() //nolint:gosec // path is env-derived, not caller input
+	out, err := exec.Command("sudo", "-n", "cat", path).Output()
 	if err != nil {
 		t.Fatalf("SystemAWSClient: sudo -n cat %s: %v", path, err)
 	}
diff --git a/tests/integration/predastore_test.go b/tests/integration/predastore_test.go
index 12ac2b6e0..feae0ce87 100644
--- a/tests/integration/predastore_test.go
+++ b/tests/integration/predastore_test.go
@@ -90,7 +90,7 @@ func predastoreS3Client(t *testing.T, fixture *testpredastore.Fixture) *s3.S3 {
 	t.Helper()
 	httpClient := &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // self-signed cert generated by this same fixture, localhost-only
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		},
 	}
 	sess, err := session.NewSession(&aws.Config{