zetesis: 8 low-severity audit findings (wave-1 batch)

[forkwright]

Findings

correctness

• crates/zetesis/src/client/torznab.rs:110 — Missing-link torrent result silently gets empty download_url, surfacing as a broken search result (low)
• crates/zetesis/src/search.rs:267 — Stale IndexerCaps JSON deserialization failure silently excludes indexers from all typed searches (low)

resilience

• crates/zetesis/src/client/torznab.rs:82 — Unbounded response body buffered into memory before XML parsing — malicious indexer can exhaust RAM (low)
• crates/zetesis/src/client/xml.rs:189 — Recursive convert_category without depth limit — deeply nested caps XML overflows the stack (low)
• crates/zetesis/src/search.rs:189 — refresh_caps three-step sequence lacks a wrapping transaction — partial update leaves indexer in inconsistent state (low)
• crates/zetesis/src/search.rs:98 — rate_limiter.acquire() ignores CancellationToken, blocking fan-out tasks after search is cancelled (low)

testing

• crates/zetesis/src/search.rs:223 — handle_search_error status-transition logic is entirely untested (low)
• crates/zetesis/src/search.rs:283 — deduplicate logic bug: hash-bearing result does not register its guid, allowing cross-field duplicate to pass through (low)

Note

These are batched low/info findings; split any out if it gets prioritized.