# Quality gates: fs-provider

Criteria the implementation must satisfy beyond the automated tests in
`fsdy/src/lib.rs`. Check each by reading the code and reasoning; tick only
when verified.

## Robustness (hard rules)

- [x] No code path panics on the contents of the tree: unreadable files,
  invalid TOML, invalid UTF-8 file names, symlink cycles, and permission
  errors all end in a typed error or a warn-and-skip — no `unwrap`/
  `expect`/`panic!`/indexing on tree- or client-derived data outside
  tests.
- [x] Client-supplied paths cannot address anything outside the configured
  root: every decoded segment is validated (`.`, `..`, empty, separator)
  before joining, in **one** place that all lookups go through.
- [x] All provider I/O is `tokio::fs` — no `std::fs` outside `#[cfg(test)]`
  (nothing blocks the runtime).
- [x] Directory listing skips symlinks without following them (no cycle can
  hang the walk; the root cannot be escaped via links).

## Contract fidelity

- [x] A `link` playable rewrites `Track.path` to the target everywhere a
  `Track` is built (listing and metadata) — there is a single
  file-to-`Track` conversion both call.
- [x] `link` targets pointing into `/fs` are rejected at parse time, so
  link chains are structurally impossible.
- [x] `get_urls_for_track` returns plain file paths and http(s) URLs only —
  never `file://` URLs (the player rejects unknown schemes).
- [x] A broken track file is skipped **with a warning that names the file**
  and does not remove its siblings from the listing.
- [x] `create/rename/delete_lib_node` return `NotSupported`; no fs mutation
  API sneaks in.
- [x] `resolve_tracks_into` keeps the trait default (no override), and the
  listing order equals the resolve order (both come from the same sorted
  listing).

## Orchestrator wiring

- [x] Every `ProviderClient` method on `ProviderOrchestrator` routes `/fs`
  and `/fs/...` to the fs client, mirroring the `/tidal` arms (including
  `is_track_path` and `resolve_tracks_into`).
- [x] fs init failure is non-fatal: the server starts, logs a warning, and
  `/fs` is absent from the root listing; no `/fs`-routing arm can panic
  when the client is absent.
- [x] The `fsdy.toml` config is written back with effective defaults on
  first run, like `tidaly.toml`.

## Hygiene

- [x] Every public item in `fsdy` has a doc comment stating intent and
  error behavior; the on-disk format is documented where the schema type
  is defined.
- [x] Warnings/errors never include file *contents* (a track file may hold
  a private URL with a token) — log paths and error kinds, not bodies.
- [x] `cargo clippy` is warning-free; `cargo fmt`, `taplo`, `markdownlint`
  clean; no `todo!()`/`unimplemented!()` remains.
- [x] The whole workspace test suite passes, not just `fsdy`.