archon: 16 low-severity audit findings (wave-1 batch)

[forkwright]

Findings

correctness

• crates/archon/src/render/pipeline.rs:155 — RenderPipeline::drain() sleeps a fixed 200 ms regardless of remaining buffer depth (low)
• crates/archon/src/render/playout.rs:87 — PlayoutPipeline: negative i64 clock-offset subtraction silently wraps to near-u64::MAX, causing permanent Hold (low)
• crates/archon/src/render/server.rs:265 — read_status_loop converts all errors — including protocol violations — into Ok(()) (low)
• crates/archon/src/serve.rs:134 — Invalid media_type search query maps to ServiceError::Internal instead of an input-validation error (low)
• crates/archon/src/migrate.rs:193 — Sidecar TOCTOU: !sc_path.exists() check and subsequent fs::write are not atomic (info)

resilience

• crates/archon/src/migrate.rs:170 — Cross-device move fallback (copy + delete) is non-transactional — process kill between steps leaves duplicate file (low)
• crates/archon/src/render/pipeline.rs:74 — Spin-wait yield loop in process_frame burns executor capacity under ring buffer backpressure (low)
• crates/archon/src/render/runner.rs:253 — connect_and_run leaves audio and status tasks running as orphans across reconnect cycles (low)
• crates/archon/src/render/server.rs:157 — RendererRegistry entry is not removed if handle_renderer_connection task panics (low)

security

• crates/archon/src/render/server.rs:221 — Unauthenticated SessionInit.name stored in RendererRegistry without length bound (low)
• crates/archon/src/render/mod.rs:37 — Default renderer name obtained via PATH-dependent hostname subprocess (info)

testing

• crates/archon/src/render/mod.rs:49 — run_render first-run credential save path is untested (info)
• crates/archon/src/serve.rs:257 — RequestRoleProvider::role_of inactive-user rejection path is untested (low)
• crates/archon/src/serve.rs:309 — RequestMonitor::create_want is entirely untested — persisted want and quality profile selection (low)
• crates/archon/src/serve.rs:357 — request_media_types media-type string mapping is untested (low)
• crates/archon/src/serve.rs:839 — validate_download_dir startup preflight has no test (low)

Note

These are batched low/info findings; split any out if it gets prioritized.