crabidy/quality/youtube-rustypipe.md

Quality gates: youtube-rustypipe

Criteria beyond the automatic tests (ytdy unit tests run against the fake extractor; live behavior verified by a removed-after-passing probe).

Extractor seam (D1)

• All provider logic (paths, search-term store, node shapes, capability flags, error mapping) is testable through the Extractor trait with a fake — no network, no fake shell scripts, no yt-dlp.
• The ProviderClient surface, path scheme, and search-term semantics (dedup, implicit recreation, rename re-searches, idempotent delete) are unchanged — existing behavioral tests carry over.

Stream selection (D2)

• get_urls_for_track returns the highest-average-bitrate audio/mp4 stream; a non-mp4 fallback logs a warning naming the chosen mime.
• No panic when a video has no audio streams — typed error.

Login (D3)

• A cached valid login wins over re-reading the (stale-prone) cookies file; a missing/unreadable/rejected cookies file degrades to logged-out with a warning — init never fails over login.
• Cookie values, auth headers, and rustypipe cache contents never appear in logs or errors (paths only).
• playlists shows up only when logged in; playlist nodes cap their track count (MAX_PLAYLIST_TRACKS) via bounded pagination.

Environment (D4)

• yt-dlp is gone from devenv.nix; ytdy no longer depends on tokio/process; the binary setting is gone from ytdy.toml (unknown old keys are tolerated).
• rustypipe state lives under <config>/crabidy/rustypipe/; a broken client build disables the provider non-fatally.
• rustypipe uses rustls (no openssl build dependency).

Hygiene

• New/changed public items documented, stating error/edge behavior.
• clippy -D warnings, fmt, markdownlint clean; all tests green.
• Live probe (removed after passing): search + stream URL + download capture through the real provider; stream decodes with the player's decoder stack.

Stream fetching (D2-revised, same-day fix)

• The player streams every http(s) source through the windowed SourceStream (bounded ~1 MiB ranges); servers that ignore Range degrade to one 200 body; rejected windows are typed errors (eager seek/reconnect — no infinite retry loops), and error messages never carry URLs.
• The capture downloader uses the same bounded windows with a 200 whole-body fallback; existing capture tests pass unchanged and a googlevideo-style strict server test stitches windows correctly.
• yt-dlp is consulted only for stream URLs (argv-only, bounded, stderr summarized ≤200 chars); a missing binary degrades with a warning, never a failed init; a failing call falls back to the rustypipe URL.
• botguard_bin is configurable and forwarded to rustypipe (the future pure-Rust exit).
• Live probe (removed after passing): the user's exact failing track resolved via the sidecar and decoded through the real player path (windowed StreamDownload → rodio) in ~4 s.