security: close leak-sweep status and stabilize repl test

Jaime Fournier

196e6739c3bae2b4414858b03def56542654d5b9

diff --git a/docs/kimi3-security-recommmendations.md b/docs/kimi3-security-recommmendations.md
index 3cbab3d..25c10d1 100644
--- a/docs/kimi3-security-recommmendations.md
+++ b/docs/kimi3-security-recommmendations.md
@@ -795,7 +795,8 @@ they are build-time. Close the runtime loop.
   shipped artifact for `$HOME` path leakage.
 - **Accept:** tests: crafted failing request yields opaque ref + logged
   detail; scanner catches a synthetic leak; artifact grep clean.
-- **Status:** partially complete. `(std security audit-log)` now exposes
+- **Status:** complete for the active repository protocol and release
+  surfaces. `(std security audit-log)` now exposes
   `audit-log-use-env-policy!`, workers bind their env policy to per-run audit
   logs before recording events, and tests assert registered secret values are
   redacted from both JSONL and human summaries. `(std net grpc)` handler
diff --git a/tests/test-repl-server.ss b/tests/test-repl-server.ss
index cb26953..412ed37 100644
--- a/tests/test-repl-server.ss
+++ b/tests/test-repl-server.ss
@@ -41,14 +41,24 @@
         [else (loop (+ i 1))]))))
 
 ;; ========== Helpers ==========
+(define nc-close-flag
+  (let ([mt (symbol->string (machine-type))])
+    (if (or (string-contains* mt "osx")
+            (string-contains* mt "fb"))
+      ""
+      " -q 2")))
+
 (define (nc-request-with-token port token msg)
-  ;; Send a message via nc and get response, with retry on empty
+  ;; Send a message via nc and get response, with retry on empty.
+  ;; macOS/BSD nc lacks OpenBSD's -q flag, so close-on-EOF is optional.
   (define (try-once)
     (let ([cmd (string-append "printf '%s\\n%s\\n' "
                               (shell-quote token)
                               " "
                               (shell-quote msg)
-                              " | nc -w 2 -q 2 127.0.0.1 "
+                              " | nc -w 2"
+                              nc-close-flag
+                              " 127.0.0.1 "
                               (shell-quote (number->string port))
                               " 2>/dev/null | tail -n 1")])
       (let-values ([(to-stdin from-stdout from-stderr pid)