# Quality gates — RSS provider

Criteria an implementation of `architecture/rss-provider.md` must satisfy.
Automated coverage lives in `rssdy/src/tests.rs` (unit, over a fake
`Feeds`), plus the settings/toggle tests in `crabidy-server`.

## Secrets (hard rule — highest priority)

- [ ] **G1 — A feed URL never reaches a log, an error, or a path.**
  `FeedEntry`, `Settings`, `Client`, and `FeedFetcher` `Debug` output
  redact urls (manual impls, not derived). `FetchError` variants carry
  status/parse context only. No `debug!`/`warn!`/`error!` call takes a
  feed or enclosure URL. *(tests: `settings_debug_redacts_urls`,
  `feed_entry_debug_redacts_the_url`.)*
- [ ] **G2 — No path contains a URL.** Subscription paths are
  `/rss/<slug>`, episode paths `/rss/<slug>/<16 hex>`. A tokened URL
  therefore cannot leak through the UI, the queue, `current`, or a
  bookmark toml. *(tests: `episode_paths_carry_only_slug_and_key`.)*

## Freshness — the point of the feature

- [ ] **G3 — Listing a subscription always fetches.** Two listings of the
  same node cause two fetches, and the second reflects a feed that gained
  an episode in between. *(test: `every_listing_refetches_the_feed`.)*
- [ ] **G4 — The memo is written by listings and read only by track
  lookups.** After one listing, resolving every episode of that feed
  costs **no** further fetches; a track lookup with a cold memo fetches
  once. *(tests: `track_lookups_reuse_the_listing_fetch`,
  `a_cold_memo_fetches_once`.)*
- [ ] **G5 — The memo is bounded** to `MEMO_CAPACITY` feeds, evicting the
  oldest, so subscribing to 100 feeds cannot grow it without limit.
  *(test: `the_memo_evicts_beyond_its_capacity`.)*
- [ ] **G6 — `/rss` is in `MUTABLE_ROOTS` in both clients**
  (`cbd-tui/src/rpc.rs`, `cbd-web/src/state.rs`), or the client cache
  defeats G3. *(tests: the existing cacheability tests, extended.)*

## Identity and paths

- [ ] **G7 — An episode key is stable** across restarts and builds:
  `blake3(guid)[..16]`, and the guid falls back to the enclosure URL only
  when the feed omits one. *(tests: `episode_keys_are_stable_and_short`,
  `a_feed_without_guids_keys_on_the_enclosure_url`.)*
- [ ] **G8 — Slugs are derived, bounded, and de-duplicated.** Lowercased,
  non-alphanumerics folded to single dashes, trimmed, length-capped; an
  empty or all-punctuation name yields `feed`; two subscriptions that
  slug alike get `-2`, `-3`. *(tests: `slugify_folds_and_bounds`,
  `duplicate_slugs_get_a_suffix`.)*
- [ ] **G9 — `provider_item_id` is the guid**, so the content store
  de-duplicates captures of the same episode across visits and feeds.
  *(test: `tracks_carry_the_guid_as_provider_item_id`.)*
- [ ] **G10 — Foreign and malformed paths are typed errors**, never
  panics: an unknown slug, a wrong-provider path, a bad episode key, and
  a path with too many segments all yield `MalformedPath` (or
  `NotSupported` for edits). *(test: `foreign_and_malformed_paths_reject`.)*

## Subscriptions (`%`, `e`, `d`)

- [ ] **G11 — `%` on `/rss` takes a URL, fetches it once, and names the
  subscription from the feed's own title**, de-duplicating the slug. The
  new node is returned. *(test: `subscribing_names_from_the_feed_title`.)*
- [ ] **G12 — `%` with a non-URL or an unfetchable URL fails with a typed
  error and adds nothing.** *(test: `subscribing_rejects_bad_input`.)*
- [ ] **G13 — `e` renames and the path follows the new slug**; `d`
  removes the subscription and no audio. Both return what a client should
  display next. *(tests: `renaming_moves_the_slug`,
  `unsubscribing_removes_only_the_entry`.)*
- [ ] **G14 — Every subscription change round-trips through `rss.toml`**
  — `settings()` reserializes the live list so the server's write-back
  persists it, and reloading yields the same subscriptions. *(test:
  `subscription_changes_round_trip_through_toml`.)*

## Robustness (hard rules)

- [ ] **G15 — No panics on feed data.** A missing enclosure, empty title,
  unparseable date, absent duration, or an entry with no guid is skipped
  or degraded — never a panic and never a failed listing. Only an
  unfetchable/unparseable *feed* errors, and it fails that node only.
  *(tests: `malformed_entries_are_skipped`, `backend_failures_are_typed`.)*
- [ ] **G16 — Bounded network use.** Every request carries
  `call_timeout_secs`; a body over `max_feed_bytes` is rejected without
  being buffered whole; listings are capped at `episodes_per_feed`.
- [ ] **G17 — Newest first**, by publication date descending where dates
  parse, feed order preserved otherwise (stable sort). *(test:
  `episodes_are_newest_first`.)*
- [ ] **G18 — A provider failure never takes the server down.** A feed
  that cannot be fetched fails its own node; `init` with no feeds still
  mounts an empty, creatable `/rss`. *(test: `no_feeds_still_mounts`.)*

## Wiring

- [ ] **G19 — Behind the `rss` cargo feature**, default on: `dep:rssdy`,
  a `BUILT_IN_PROVIDERS` entry, an `ALL_PROVIDERS` name, a
  `ProviderToggles` field, a mount registration, and a `check-features`
  row. The provider-less and each-provider-alone builds stay clean.
- [ ] **G20 — Documented.** A `docs/src/providers/rss.md` page (tree,
  subscribing, premium feeds and what "not cached" means, every config
  option), an `rssdy/README.md`, links from the providers index,
  `SUMMARY.md`, `config.md`, and the root README's tree and config table.
- [ ] **G21 — Clippy clean under `-D warnings`** for the workspace, fmt
  clean, and no `todo!()` from the stub stage left.