[Tracking] Low-severity, dead-code, and nit findings from the 2026-07 audit sweep

[gnanirahulnutakki]

Tracking issue for the low-severity, dead-code, and nit findings from the 2026-07 audit sweep. Grouped here to keep the tracker clean; each is verified present on dev at the time of filing. Check off as addressed.

Correctness / robustness (Low)

• Slack ignores message subtype. crates/slack-adapter/src/event.rs:72-91 has no subtype field; adapter.rs:335 only checks kind != "message". The dangerous cases are already neutralized by the bot_id filter and the deny-by-default allowed_senders gate (adapter.rs:341-353), and message_changed/message_deleted carry no top-level user so they are dropped. Residual: a channel_join/me_message from an allowlisted user is not distinguished from a real command. Add a subtype guard treating unsupported subtypes as Ignored.
• multi-agent SubAgent::release uses non-saturating fetch_sub. crates/multi-agent/src/agent.rs:105. Across a terminate+respawn id-reuse race the release can run against a fresh AtomicU32(0) and wrap to a huge cents_used, corrupting the new agent's budget envelope. Use saturating_sub or generation-keyed reservation handles.
• derive_principal → parse_entity_ref strips quotes / mis-splits on ::. crates/fused-runtime/src/runtime.rs:2942 builds Type::"subject"; crates/cedar-policy/src/lib.rs:260-262 re-parses with rsplit_once("::") + trim_matches('"'). A subject containing :: mis-splits (fails closed → PolicyDenied); two subjects differing only in quotes collapse to one principal. Pass type + raw id straight to EntityUid::from_type_name_and_id instead of building-then-reparsing a string.
• provider-ollama never decodes response tool_calls. crates/provider-ollama/src/lib.rs:751-786 — ResponseMessage/ChunkMessage decode content only; tool-use is non-functional on Ollama (self-documented at lib.rs:52,61). Decode message.tool_calls and emit ToolCall events.
• LogStream::new(0) panics on append. crates/logs/src/log.rs:56-69 — entries.remove(0) on an empty vec when max_size == 0. Guard with max_size.max(1). (Crate is currently orphaned.)
• Config::merge loses provenance; validate never type-checks. crates/config/src/config.rs:59 relabels all merged values ConfigSource::Default; crates/config/src/schema.rs:64 validate does not type-check values.

Fail-open / security hygiene (Low)

• Redaction pattern compile is fail-open. crates/session-journals/src/redact.rs:39 — default_secret_patterns uses filter_map(|p| Regex::new(p).ok()), silently dropping any uncompilable (compile-time-constant) redaction pattern. Use .expect(...) so a broken secret-redaction pattern fails loudly at startup, not silently at runtime.
• Dead fail-open channel config helpers. crates/channel-discord/src/config.rs:117-119 channel_allowed and crates/channel-telegram/src/config.rs:91-93 chat_allowed return allowlist.is_empty() || contains(id) (empty ⇒ admit everyone), contradicting the struct's own "deny-by-default (ARD-475)" doc. The live ingress Forwarder is correctly deny-by-default (fixed in fix(channels): ARD-475 ingress deny-by-default (Discord + Telegram + Slack) #212 / [P1] Require explicit allowlists for Matrix/Discord/Telegram ingress #127), so these methods are unused by ingress, but they remain a fail-open trap and their unit tests (channel-{discord,telegram}/src/lib.rs) assert the wrong behavior. Make them deny-by-default or delete them.
• Unbounded inbound channels on all three SDK adapters. crates/channel-{matrix,discord,telegram}/src/channel.rs use mpsc::unbounded_channel() for inbound — memory-exhaustion DoS if the consumer lags. Use bounded channels with backpressure.

Dead / orphaned modules (delete or wire)

• crates/automation/src/engine.rs — not declared in lib.rs; references a nonexistent crate::error::AutomationError (would not compile if added).
• crates/automation/src/task.rs — orphan (not in the module tree).
• crates/acp/src/server.rs and crates/acp/src/protocol.rs — orphans; the live crate uses wire.rs/method.rs. (cron expr.rs/schedule.rs were the analogous orphans and are now wired live by fix: fail-closed cap-token projection, provider robustness, cron parser #254 — done.)
• crates/webhook/src/registry.rs — orphan left behind after feat(§9.7): operator webhook surface (registry + emit + triggers) #305 built the crate out via other modules.

Documented tradeoffs (track)

• Blocking/CPU-bound work inline on async workers. Journal fsync append (session-journals/src/file.rs), ONNX embed (embeddings/src/lib.rs), Tantivy commit-per-doc (bm25-index/src/lib.rs). All documented tradeoffs; route through spawn_blocking before scaling.

[gnanirahulnutakki]

Higher-severity findings from the same sweep are filed as their own issues: #347 (Critical), #348–#351 (High), #352–#366 (Medium/Docs). This issue collects the Low / dead-code / nit remainder.