# Quality gates: youtube-rustypipe

Criteria beyond the automatic tests (ytdy unit tests run against the
fake extractor; live behavior verified by a removed-after-passing
probe).

## Extractor seam (D1)

- [x] All provider logic (paths, search-term store, node shapes,
  capability flags, error mapping) is testable through the `Extractor`
  trait with a fake — no network, no fake shell scripts, no yt-dlp.
- [x] The `ProviderClient` surface, path scheme, and search-term
  semantics (dedup, implicit recreation, rename re-searches, idempotent
  delete) are unchanged — existing behavioral tests carry over.

## Stream selection (D2)

- [x] `get_urls_for_track` returns the highest-average-bitrate
  `audio/mp4` stream; a non-mp4 fallback logs a warning naming the
  chosen mime.
- [x] No panic when a video has no audio streams — typed error.

## Login (D3)

- [x] A cached valid login wins over re-reading the (stale-prone)
  cookies file; a missing/unreadable/rejected cookies file degrades to
  logged-out with a warning — init never fails over login.
- [x] Cookie values, auth headers, and rustypipe cache contents never
  appear in logs or errors (paths only).
- [x] `playlists` shows up only when logged in; playlist nodes cap
  their track count (`MAX_PLAYLIST_TRACKS`) via bounded pagination.

## Environment (D4)

- [x] `yt-dlp` is gone from `devenv.nix`; ytdy no longer depends on
  `tokio/process`; the `binary` setting is gone from `ytdy.toml`
  (unknown old keys are tolerated).
- [x] rustypipe state lives under `<config>/crabidy/rustypipe/`; a
  broken client build disables the provider non-fatally.
- [x] rustypipe uses rustls (no openssl build dependency).

## Hygiene

- [x] New/changed public items documented, stating error/edge behavior.
- [x] `clippy -D warnings`, `fmt`, `markdownlint` clean; all tests
  green.
- [x] Live probe (removed after passing): search + stream URL +
  download capture through the real provider; stream decodes with the
  player's decoder stack.

## Stream fetching (D2-revised, same-day fix)

- [x] The player streams every http(s) source through the windowed
  `SourceStream` (bounded ~1 MiB ranges); servers that ignore `Range`
  degrade to one 200 body; rejected windows are typed errors (eager
  seek/reconnect — no infinite retry loops), and error messages never
  carry URLs.
- [x] The capture downloader uses the same bounded windows with a 200
  whole-body fallback; existing capture tests pass unchanged and a
  googlevideo-style strict server test stitches windows correctly.
- [x] `yt-dlp` is consulted **only** for stream URLs (argv-only,
  bounded, stderr summarized ≤200 chars); a missing binary degrades
  with a warning, never a failed init; a failing call falls back to the
  rustypipe URL.
- [x] `botguard_bin` is configurable and forwarded to rustypipe (the
  future pure-Rust exit).
- [x] Live probe (removed after passing): the user's exact failing
  track resolved via the sidecar and decoded through the real
  player path (windowed StreamDownload → rodio) in ~4 s.