No genuine core gap identified. Ready for performance profiling within the supported formats and deployment contract. This is a feature audit, not production certification.
Unix daemon with a draining log collector; external TLS and private administration; static restart-based configuration and ephemeral HLS; supported encoded-media mappings; whole-object MPEG-TS HLS clients that work without Range; bounded capacity with connection headroom. Broad target-player/proxy validation remains open.
Source: current working-tree code and existing tests/captures · audit date 2026-10-07 · 49 unit/property/concurrency + 20 transport integration tests pass. Older client captures do not certify this exact build.
| Area | Status | Evidence | Limitation | Action |
|---|---|---|---|---|
| Source ingest | COMPLETE | src/ingest.rs; src/protocol.rs; streaming: raw/framed/Expect/hostile/inactivity tests | PUT raw/Content-Length/chunked; SOURCE raw ICE/1.0/HTTP; static configured mounts; no takeover | Keep supported encoder regression gates. |
| Source ownership/reconnect | COMPLETE | src/mounts.rs; simultaneous_source_claims_have_one_owner; old_cleanup_cannot_release_successor; delayed_admin_target_cannot_kill_successor | Listeners belong to one generation and terminate on source loss; reconnect can reject while retired references consume reservations | No required change. |
| Continuous GET/HEAD and accounting | COMPLETE | src/server.rs; src/listener.rs; src/transport.rs; fanout, idle disconnect, native management TCP tests | Public unauthenticated listeners; HTTP/1.0 close-delimited audio; HEAD has no lease; socket writes are not playback proof | Validate intended player/proxy settings. |
| Slow consumers and isolation | COMPLETE | stopped_socket_does_not_backpressure_source_or_healthy_listener; ring eviction/property tests; ICY integration | A slow peer is disconnected, never replayed across generations; finite ring is not archival buffering | Keep explicit stopped-socket test, not only short load runs. |
| MP3 | COMPLETE_WITH_LIMITATION | src/media.rs; src/ring.rs; milestone-5 media-delivery-final/report.json | Layer III MPEG-1/2/2.5 indexed bitrate joins; no free-format/layer I/II join support; decoder reservoir recovery possible | Accept declared subset; certify target players. |
| AAC ADTS | COMPLETE_WITH_LIMITATION | frame_headers_and_split_boundaries; adts_passthrough_and_frame_aligned_late_join; six-case decode capture | audio/aac and audio/aacp; no raw AAC/LATM/LOAS/PCE join; AACp fixture proves AAC-LC, not HE-AAC certification | Add HE-AAC evidence only if required by a target workflow. |
| Ogg Vorbis | COMPLETE_WITH_LIMITATION | src/media/ogg.rs; ogg_late_join_headers_chains_and_corruption_isolation; decode capture | Sequential single logical streams/chains; bounded init; no multiplexing or comment rewriting; container validation only | Accept supported mapping; validate live players. |
| Ogg Opus | COMPLETE_WITH_LIMITATION | real_streams_split_headers_pages_and_chains; corruption_truncation_multiplex_and_header_ceiling; decode capture | Mono/stereo mapping family 0; no multichannel families; ICY suppressed | Accept supported mapping. |
| ICY metadata and update ingress | COMPLETE_WITH_LIMITATION | src/icy.rs; src/listener.rs; icy_titles_authentication_clearing_and_generation_reset; icy_boundary_inside_single_ingress_allocation; milestone-4 verification | 16,000 audio-byte interval; UTF-8 title <=1,024 bytes; semicolon/control rejected; apostrophe/backslash verbatim per reference; Ogg in-band only | Retain narrow client compatibility and clarify restrictions in operator guide. |
| HLS typed production/publication | COMPLETE | src/hls/http.rs; src/hls/store.rs; typed_hls_upload_publication_and_independent_lifecycles; revision-race tests | External producer supplies TS plus typed descriptions; authenticated internal producer API, separate from native inspection | No continuous/HLS conversion. |
| HLS storage/lifecycle/visibility | COMPLETE | HLS budget, immutable-backing, stale-generation, retention, discontinuity, inspection and shutdown tests | Memory only; end retains final playlists, delete/grace/final references reclaim; staging expires; bounded capacity can reject new work | Producer must recover/repopulate after process restart. |
| HLS public playback/cache | COMPLETE_WITH_LIMITATION | src/hls/http.rs; milestone-6/http-playback-final-source/report.json; GET/HEAD/ETag/CORS tests | MPEG-TS whole objects; Range returns 416; recorded FFmpeg playback disables seeking/persistence; generic browser/native defaults unproven | Certify target HLS players. Reclassify Range only if an actual required player cannot operate. |
| Native management API | COMPLETE | src/management.rs; docs/management-api.md; authentication/error/inspection/pagination tests; real source/listener control TCP tests | Ephemeral live pages, max200; lexical random IDs; asynchronous disconnect; observational snapshots; nested mount paths supported | Operators re-read state after actions and restart. |
| Admission and limits | COMPLETE_WITH_LIMITATION | Config validation; global/local semaphores; concurrent_mount_admission_never_exceeds_limit; HLS capacities/budget failure tests | TCP/handshake exhaustion closes before routing; domain exhaustion returns503; admin/public share global capacity; allocation budgets are not RSS caps | Reserve connection headroom and size OS/proxy resources. |
| Accepting/draining/shutdown | COMPLETE | src/lifecycle.rs; src/server.rs; drain commit-race tests; three drain TCP tests; docs/drain-lifecycle-review.md | One-way drain, explicit shutdown; admitted work can finish after drain; HLS new mutations blocked, existing objects playable; no automatic drain deadline/resume | Use documented admission boundary and explicit shutdown. |
| Health/readiness | COMPLETE | server routing; drain_preserves_streams_inspection_health_and_administrative_controls | Process readiness checks acceptance, not encoder availability or end-to-end audio; management listener closes during shutdown | External monitoring checks source/playback separately. |
| Metrics/stats/logging | COMPLETE_WITH_LIMITATION | src/metrics.rs; src/logging.rs; stopped_sink_drops_bounded_records_without_waiting; native stats tests | Fixed labels; structured tracing fields, not promised JSON/durable audit; lossy4096-byte records; Unix nonregular stdout required | Provide draining collector; use metrics for aggregate monitoring. |
| Proxy/network deployment | COMPLETE_WITH_LIMITATION | src/client.rs; forwarding_contract; docs/architecture.md and management-api.md | External TLS/private admin; explicit trusted XFF IP/CIDR; no HTTP/2/native TLS; raw SOURCE may need TCP pass-through; live buffering/timeouts must be configured | Validate actual proxy; never publicly forward admin indiscriminately. |
| Static configuration/startup | COMPLETE | src/config.rs; src/hls/config.rs; configuration tests; config/quikcast.example.toml | Bounded TOML; deny unknown fields; secret-file support; restart to alter settings; Unix CLI logging prerequisite | No runtime reload required for current scope. |
| Security boundaries | COMPLETE_WITH_LIMITATION | src/auth.rs; protocol canonicalization/duplicate rejection; credential/proxy/hostile/HLS tests; no secret Debug/response fields | TLS and private exposure external; no RBAC/rate-limiting system; source/HLS secret reuse forbidden; management secret separation is operator-enforced | Use generated distinct secrets, restrictive files and trusted ingress. |
| Fifteen-step operator workflow | COMPLETE_WITH_LIMITATION | Implementation paths and workflow evidence map in audit report; native TCP controls and drain tests | Viable through static TOML/HTTP/signals/restart; integrated real-client/proxy rehearsal outstanding | Perform scoped real traffic rehearsal; no product feature missing. |
| Real encoder/player compatibility | COMPLETE_WITH_LIMITATION | Historical curl/FFmpeg/Liquidsoap captures; six MIME decode cases; user-reported BUTT session, README local setup | Captures predate management/drain; no sealed BUTT/version/playback capture; decode success is not universal player certification | Repeat target encoder/player checks on selected profiling baseline. |
| Architecture/resource ownership | COMPLETE | Concrete runtime/mount/generation/HLS types; leases, JoinSet, bounded ring and stores; source review | Synchronous lock/scan cost bounded but needs profiling; no material refactor prerequisite found | Measure before changing architecture. |
| Performance architecture | COMPLETE_WITH_LIMITATION | Bytes sharing, cursor ring, flush gate, immutable charged HLS; milestone-3 load/resource evidence | No zero-copy or production capacity claim; current management/drain build lacks new dedicated-host mixed workload measurements | Proceed to reproducible profiling, preserving correctness gates. |
| Operator documentation consolidation | OPTIONAL | README; docs/protocol.md; milestone-2/4/5/6; management API; drain review | README still describes RadioPlatform identity; historical proposal/remaining-work statements can mislead; complete guide distributed across milestones | Consolidate standalone runbook/navigation and mark historical statements; documentation completion, not a missing server feature. |
| Additional Icecast compatibility | OPTIONAL | Captured 2.4.4/2.5.0 behavior and supported producer tests | No demonstrated client need for XML admin parity/status-json/directory/config syntax/all historical quirks | Add only for concrete supported-client requirement. |
| Operational tooling/enhancements | OPTIONAL | Native HTTP API/static restart workflow already sufficient | No CLI/dashboard/frozen pages/persistent history/audit store/reload/rotation | Separate optional backlog; no new core milestone justified. |
| Relays/fallback/takeover/distribution | DEFERRED | Explicit scope boundary; current duplicate-source policy | No relays, fallback, replacement/priorities/failover/chaining/edge-origin | Remain deferred; future relay maps continuous remote stream to local continuous mount only. |
| Additional media/HLS/deployment features | DEFERRED | Explicit intended identity and tested subsets | Additional codecs, CMAF/fMP4/raw-AAC HLS, LL-HLS/encryption, native TLS/PROXY protocol | Remain deferred unless actual target workflow changes scope. |
| Platform integration and conversion | DEFERRED | Independent continuous and HLS modules; runtime dependencies only Rust server libraries | No RadioPlatform integration, DB/accounts, AutoDJ, encode/decode/transcode/remux/media processes | Preserve boundary; conversion/AutoDJ remain outside identity. |