# Quality gates: youtube-provider

Criteria beyond the automatic tests (`ytdy/src/lib.rs`,
`ytdy/src/engine.rs`, plus orchestrator wiring). Each gate is pass/fail
by reading the code.

## Engine (subprocess discipline)

- [x] Every invocation is an argument list (`tokio::process::Command`)
  — never a shell string; user input (terms, ids) can contain anything.
- [x] Every call is bounded: per-call timeout (`kill_on_drop` so a timed
  out process dies), and captured stdout capped at `MAX_STDOUT_BYTES`.
- [x] All failures are typed `EngineError`s mapped to `ProviderError`
  at the trait boundary; no subprocess condition panics.
- [x] Error/log output carries the binary path, exit status, and a
  *bounded* stderr summary — never full stderr, never stream URLs,
  never cookie file contents (the path alone is loggable).
- [x] The cookies flag is appended to every call when configured;
  nothing else about login is stored or invented.

## Provider semantics

- [x] Search terms mirror tidal's: in-memory, deduplicated, implicit
  recreation on stale paths, rename re-searches, delete idempotent —
  and only `/youtube/search` children are creatable/editable/deletable.
- [x] Path parsing rejects foreign roots and malformed shapes with
  `MalformedPath`; track paths are exactly `<node>/<videoid>`.
- [x] Downloadability follows the central rule (queueable or lists
  tracks; children mirror `is_queable`) applied in one place, not
  per-arm.
- [x] `duration` floats are truncated to whole seconds; missing
  title/uploader degrade to empty strings, never errors.
- [x] The playlists subtree exists only when logged in: absent from the
  root listing and `MalformedPath` when addressed directly.

## Orchestrator wiring

- [x] `ytdy::Client::init` failure (missing/broken binary) disables the
  provider with a warning — the server and every other provider keep
  running; `get_lib_root` lists `youtube` only when enabled.
- [x] `/youtube` is routed in every `ProviderClient` method (same
  completeness as `/tidal`), including `resolve_tracks_into`,
  create/rename/delete.
- [x] `ytdy.toml` is written back after init like the other providers'
  configs.
- [x] `extension_for` maps `audio/webm → webm` so captures of YouTube
  audio get a sensible extension.

## Hygiene

- [x] `yt-dlp` is declared in `devenv.nix`, never assumed installed.
- [x] New public items are documented; docs state error/edge behavior.
- [x] `clippy -D warnings`, `fmt`, `taplo`, `markdownlint` clean; all
  tests green; no `todo!()` left.
- [x] `architecture/youtube-provider.md` reconciled where the
  implementation diverged (esp. the playlists-feed invocation after the
  live probe).