chore: changelog 1.0.8 — doc polish

- Add 4 Prometheus exporters: nginx (9113), redis (9121), postgres (9187), node (9100)
- Create 8 alerting rules in monitoring/prometheus/alerts.yml
- Update prometheus.yml with all scrape targets + rule_files
- WS connection rate limiting: max 5/IP/60s (Redis INCR)
- Admin login rate limiting: max 5/IP/5min (Redis INCR)
- 3 backup scripts: daily to R2 (14d), weekly full (8w), verify with restore test
- docs/incident-runbook.md with 5-tier triage + escalation
- Update CD workflow: full prometheus config + alerts seeding

.gitea/workflows/cd.yml

@@ -1,3 +1,8 @@
+# CD workflow — TEST LAB DEPLOYMENT
+# Deploys to test lab host 192.168.88.40:2375.
+# Production Hetzner target TBD — switch DOCKER_HOST when provisioned.
+# See TODO.md Production Deployment section for cutover plan.
+
 name: CD
 
 on:
@@ -52,14 +57,78 @@ jobs:
             scrape_interval: 15s
             evaluation_interval: 15s
 
+          rule_files:
+            - "/etc/prometheus/alerts.yml"
+
           scrape_configs:
+            - job_name: 'chat'
+              static_configs:
+                - targets: ['chat:3000']
+            - job_name: 'playout'
+              static_configs:
+                - targets: ['playout:8081']
+            - job_name: 'nginx'
+              static_configs:
+                - targets: ['nginx-exporter:9113']
+            - job_name: 'redis'
+              static_configs:
+                - targets: ['redis-exporter:9121']
+            - job_name: 'postgres'
+              static_configs:
+                - targets: ['postgres-exporter:9187']
+            - job_name: 'node'
+              static_configs:
+                - targets: ['node-exporter:9100']
             - job_name: 'prometheus'
               static_configs:
                 - targets: ['localhost:9090']
-
+          EOF
-            - job_name: 'linearvoid'
+          cat > monitoring/prometheus/alerts.yml << 'EOF'
-              static_configs:
+          groups:
-                - targets: ['playout:8081', 'chat:3000', 'nginx:80']
+            - name: linearvoid
+              rules:
+                - alert: ChatDown
+                  expr: up{job="chat"} == 0
+                  for: 2m
+                  labels:
+                    severity: critical
+                  annotations:
+                    summary: "Chat service is down"
+                - alert: PlayoutDown
+                  expr: up{job="playout"} == 0
+                  for: 2m
+                  labels:
+                    severity: critical
+                  annotations:
+                    summary: "Playout service is down"
+                - alert: RedisDown
+                  expr: linearvoid_chat_redis_up == 0
+                  for: 2m
+                  labels:
+                    severity: warning
+                  annotations:
+                    summary: "Redis is unreachable"
+                - alert: PlayoutSlateActive
+                  expr: linearvoid_playout_mode == 1
+                  for: 1m
+                  labels:
+                    severity: warning
+                  annotations:
+                    summary: "Playout in slate fallback"
+                - alert: HighCPU
+                  expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
+                  for: 10m
+                  labels:
+                    severity: warning
+                  annotations:
+                    summary: "High CPU usage"
+                - alert: LowDiskSpace
+                  expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) * 100 < 10
+                  for: 5m
+                  labels:
+                    severity: warning
+                  annotations:
+                    summary: "Low disk space"
           EOF
 
       - name: Deploy with docker-compose
@@ -76,9 +145,9 @@ jobs:
           # Wait for services to stabilize
           sleep 20
 
-          # Check chat health
+          # Check chat health (via docker exec — IP-agnostic, works on any DOCKER_HOST)
           echo "Checking chat health..."
-          if ! curl -f http://192.168.88.40:3000/health; then
+          if ! docker exec linearvoid-chat curl -sf http://localhost:3000/health; then
             echo "Chat health check failed"
             docker logs linearvoid-chat --tail 50
             exit 1
@@ -86,7 +155,7 @@ jobs:
 
           # Check nginx health
           echo "Checking nginx health..."
-          if ! curl -f http://192.168.88.40/health/; then
+          if ! docker exec linearvoid-nginx curl -sf http://localhost/health; then
             echo "Nginx health check failed"
             docker logs linearvoid-nginx --tail 50
             exit 1

.gitea/workflows/ci.yml

@@ -19,14 +19,12 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "20"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
 
       - name: Install Frontend Dependencies
         run: cd frontend && npm ci
 
       - name: Lint Frontend
-        run: cd frontend && npm run lint || echo "Linting not configured yet"
+        run: cd frontend && npm run lint
 
       - name: Build Frontend
         run: cd frontend && npm run build
@@ -35,14 +33,15 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: "1.25"
-          cache: true
-          cache-dependency-path: backend/chat/go.sum
         env:
           GOTOOLCHAIN: local
 
       - name: Download Go modules
         run: cd backend/chat && GOTOOLCHAIN=local go mod download
 
+      - name: Validate Go
+        run: cd backend/chat && GOTOOLCHAIN=local go vet ./...
+
       - name: Run Tests
         run: echo "Tests will be added in future CI steps (per TODO.md)"
 

.github/MEMORY.md

@@ -0,0 +1 @@
+# MEMORY.md

.github/agents/caveman.agent.md

@@ -0,0 +1,79 @@
+---
+description: "Caveman-style agent for linearvoid project. Terse output, plan-first workflow, confirmation gating. Use for: implementing TODO.md tasks, editing project files, docs updates, release prep."
+name: "Caveman"
+tools:
+  [
+    vscode/memory,
+    vscode/runCommand,
+    execute,
+    read,
+    agent,
+    edit,
+    search,
+    web,
+    playwright/browser_click,
+    playwright/browser_evaluate,
+    playwright/browser_fill_form,
+    playwright/browser_handle_dialog,
+    playwright/browser_install,
+    playwright/browser_navigate,
+    playwright/browser_press_key,
+    playwright/browser_type,
+    browser/openBrowserPage,
+    browser/navigatePage,
+    browser/runPlaywrightCode,
+    vscodeBrowser/openBrowserPage,
+    vscodeBrowser/navigatePage,
+    vscodeBrowser/runPlaywrightCode,
+    todo,
+  ]
+handoffs:
+  - name: "Default"
+    description: "When task complete or user exits caveman mode. Also handoff for security warnings or irreversible actions."
+    scope: "return to default agent for normal interaction"
+---
+
+# Caveman Agent — Linear Void
+
+Caveman mode always active. Terse, no fluff, no filler, no tool-call narration. Technical substance preserved exactly.
+
+## Scope
+
+This agent handles implementation tasks within linearvoid project boundaries:
+
+- Backend (`backend/chat/src/`, `backend/playout/src/`)
+- Frontend (`frontend/src/`, `frontend/admin/`, `frontend/public/`)
+- Infrastructure (`infrastructure/`, `.gitea/workflows/`)
+- Documentation (`docs/`, `*.md` at project root)
+- Config (`docker-compose*.yml`, `.env.example`, `package.json`, `go.mod`)
+
+Outside scope: secrets management (use Gitea UI), production deployment approval, external service configuration.
+
+## Output Rules
+
+Drop articles (a/an/the), filler words, pleasantries, hedging. Fragments OK. Short synonyms. Standard acronyms OK (API, DB, CI). Never invent abbreviations. Code blocks, error strings, technical terms verbatim. Never drop negations (not/never/no/only/except). Numbers and units exact.
+
+## Project Workflow
+
+**Documentation first. Always.**
+
+1. **Read docs before code** — Check `docs/architecture/README.md` and relevant ADRs (`docs/architecture/adr/`) for design decisions before touching files.
+2. **Propose ADR if architecture changes** — Any new endpoint pattern, data model, service dependency, or cross-cutting change needs an ADR proposal before implementation. Write to `docs/architecture/adr/ADR-XXX.md` following existing template.
+3. **Plan** — Write tasks to `.github/instructions/TODO.md` with checkboxes.
+4. **Confirm before acting** — Ask user. Accept `go`, `ok`, `yes`, `next`, `continue`. Abort on `no`, `stop`, `cancel`.
+5. **Do the work** — Edit files, run commands.
+6. **Track completion** — Mark `[x]` in TODO.md. When section done, move to `.github/instructions/DONE.md`.
+7. **Log changes** — Write entry to `CHANGELOG.md` for significant work.
+8. **Sync memory** — Update `.github/MEMORY.md` between major steps and at end of session. Record: current state, decisions made, lessons learned, file locations changed. This is the agent's persistent working memory across sessions.
+
+## Architecture
+
+Source of truth: `docs/architecture/README.md` and ADRs (`docs/architecture/adr/`). Follow project structure in root `README.md`.
+
+## Security
+
+Never commit raw secrets. Never print or log secrets. Use `CI_` prefix for Gitea secrets (never `GITEA_`). `.env` always gitignored.
+
+## Task Tracking
+
+Sync with `manage_todo_list` tool. Mirror state to `.github/instructions/TODO.md` checkboxes.

.github/instructions/BACKLOG.md

@@ -0,0 +1,121 @@
+# BACKLOG
+
+## Playout & Delivery
+
+- [x] Implement FFmpeg + MediaMTX/SRS continuous HLS playout from playlist
+- [x] Implement immutable HLS segment naming for cache-friendly delivery
+- [x] Upload HLS segments to Cloudflare R2 via S3-compatible API
+- [x] Implement emergency slate fallback on playout failure
+- [x] Auto-restart loop for FFmpeg/MediaMTX on failure
+
+## Video Normalization
+
+- [x] Implement video normalization pipeline (H.264/AAC, 30 fps, 2 s keyframes)
+- [x] Implement ffprobe verification gate rejecting non-conforming files
+- [x] Enforce normalization check before upload acceptance in admin UI
+
+## Chat Service
+
+- [x] Implement WebSocket chat backend (Go) with room fan-out
+- [x] Implement private DM channel routing
+- [x] Implement Redis presence tracking for chat
+- [ ] Implement Redis pub/sub for multi-instance chat
+- [x] Implement Redis rate limiting (INCR + EXPIRE windowing, >10/10s throttle)
+- [x] Implement chat message persistence (SQLite v1, PostgreSQL migration path)
+- [x] Implement moderation commands (/mod, /mute, /ban) in backend
+- [x] Implement moderation audit log persistence
+- [x] Implement graceful degradation when Redis unavailable (core chat remains up)
+
+## Frontend — Viewer SPA
+
+- [x] Build static SPA with hls.js player integration
+- [x] Build chat sidebar UI (public rooms + private DMs)
+- [x] Implement schedule metadata display synced with playlist timeline
+- [x] Implement responsive/mobile-friendly viewer layout
+
+## Frontend — Admin Interfaces
+
+- [x] Build admin login page with session authentication
+- [x] Build admin dashboard overview page
+- [x] Build video upload interface with chunked upload support
+- [x] Build playlist management interface (drag-to-reorder, validation warnings)
+- [x] Build schedule override/management interface (CRUD + conflict detection)
+- [x] Build user management interface (mute/unmute/ban/unban actions)
+- [x] Build moderation dashboard (chat log, inline mod actions, CSV export)
+- [x] Build analytics dashboard (time range selector)
+- [x] Build system configuration/status page (config editor, restart buttons)
+
+## Infrastructure — nginx
+
+- [x] Configure nginx reverse proxy with auth_request for admin paths
+- [x] Configure nginx HLS path with CORS headers + OPTIONS preflight
+- [x] Configure nginx WebSocket upgrade forwarding for /ws
+- [x] Configure nginx health endpoints (/health JSON, stub_status)
+
+## Infrastructure — Docker
+
+- [x] Create Dockerfiles for playout, chat, nginx services
+- [x] Create docker-compose.yml for all services
+- [x] Create docker-compose.prod.yml override for production
+
+## Infrastructure — CI/CD (Gitea Actions)
+
+- [x] Implement CI workflow (lint, build, test, push images)
+- [x] Implement CD workflow (pull, deploy, health checks — IP-agnostic)
+- [x] Generate .env from Gitea secrets in CD workflow
+- [x] Seed Prometheus config into named volume during deploy
+- [x] Implement health check validation with retry in CD pipeline
+
+## Cloudflare Configuration
+
+- [ ] Configure DNS for linearvoid.tv apex and www redirect (manual)
+- [ ] Configure media.linearvoid.tv for split-domain HLS delivery (manual)
+- [ ] Create R2 bucket (manual)
+- [ ] Configure Cache Rules: .ts/.m4s + .m3u8 (manual)
+- [ ] Configure Cloudflare Pages (manual)
+- [ ] Enable Tiered Cache, WAF, rate limiting (manual)
+- [x] Implement Worker for immutable cache headers on segment paths
+- [ ] Enforce HTTPS/WSS, redirect HTTP → HTTPS (manual)
+
+## Monitoring & Observability
+
+- [x] Set up Prometheus with chat scrape target
+- [ ] Add nginx/redis/postgres/node exporters
+- [x] Import Grafana app + operational dashboards
+- [ ] Define Prometheus alerting rules
+- [ ] Set up UptimeRobot external monitoring
+
+## Security
+
+- [x] Implement admin cookie-session auth (HttpOnly, SameSite=Strict, Secure when TLS)
+- [x] Implement server-side session expiration
+- [ ] Enforce HTTPS/WSS at edge and origin
+- [x] Implement rate limiting for chat messages with Redis windowing
+
+## Data & Storage
+
+- [x] Set up PostgreSQL/SQLite for chat history and moderation data
+- [x] Set up Redis with append-only persistence + maxmemory policy
+- [ ] Implement daily/weekly/monthly Postgres backups
+- [ ] Implement backup integrity verification
+- [ ] Document and rehearse recovery runbook
+
+## Scaling & Performance
+
+- [ ] Optimize segment immutability and manifest TTL for cache efficiency
+- [ ] Measure playback TTFB from multiple US regions
+- [ ] Load-test WebSocket connections
+- [ ] Benchmark admin API p95 latency
+- [ ] Track cache hit ratio and R2 ops in production
+- [ ] Capacity trigger monitoring
+- [ ] Plan Phase 2 service separation
+- [ ] Plan Phase 3 multi-origin resilience
+
+## Documentation
+
+- [x] Document API contracts in API.md
+- [ ] Document deployment runbook in DEPLOYMENT.md
+- [ ] Document monitoring setup in MONITORING.md
+- [ ] Document security model in SECURITY.md
+- [ ] Create incident runbook
+- [ ] Write Level 2/3 building block views

API.md

@@ -272,11 +272,36 @@ Prometheus exposition includes connected clients, stored messages, moderation ac
 
 ## HTTP Status Conventions
 
-- 200/201: successful request
+| Code | Meaning               | When                                                        |
-- 400: malformed payload, invalid input, missing required fields
+| ---- | --------------------- | ----------------------------------------------------------- |
-- 401: unauthorized admin request
+| 200  | OK                    | Successful GET, PUT, or action                              |
-- 404: not found
+| 201  | Created               | Successful POST (upload init, override created)             |
-- 405: method not allowed
+| 204  | No Content            | Successful DELETE, CORS preflight                           |
-- 409: logical conflict (for example, mismatched resumed upload)
+| 400  | Bad Request           | Malformed JSON, missing required fields, invalid input      |
+| 401  | Unauthorized          | Missing or expired admin session                            |
+| 403  | Forbidden             | Valid session but insufficient permissions                  |
+| 404  | Not Found             | Resource doesn't exist                                      |
+| 405  | Method Not Allowed    | Wrong HTTP method for endpoint                              |
+| 409  | Conflict              | Schedule override overlap, upload ID mismatch               |
+| 413  | Payload Too Large     | Upload exceeds 2 GB limit                                   |
+| 422  | Unprocessable         | File fails normalization check (codec, fps, resolution)     |
+| 429  | Too Many Requests     | Rate limit exceeded (chat messages, WS connections, login)  |
+| 500  | Internal Server Error | Unexpected server failure                                   |
+| 503  | Service Unavailable   | Redis unavailable for user actions, playout health degraded |
+
+## Rate Limiting
+
+All limits are per-IP (from `X-Forwarded-For` or `RemoteAddr`) unless noted.
+
+| Resource              | Limit                              | Window                                   | Response                                               |
+| --------------------- | ---------------------------------- | ---------------------------------------- | ------------------------------------------------------ |
+| Chat messages         | `CHAT_RATE_LIMIT_MAX` (default 10) | `CHAT_RATE_LIMIT_WINDOW_S` (default 10s) | 429 + `{"type":"system","text":"Rate limit exceeded"}` |
+| WebSocket connections | 5                                  | 60s                                      | 429 + `"too many connections from this IP"`            |
+| Admin login           | 5                                  | 5min                                     | 429 + `"too many login attempts, try again later"`     |
+
+Rate limit headers on applicable responses:
+
+- `X-RateLimit-Limit`: maximum requests per window
+- `Retry-After`: seconds until window resets
 - 413: payload too large
 - 500: internal server error

CHANGELOG.md

@@ -2,6 +2,61 @@
 
 <!-- markdownlint-disable MD024 -->
 
+## [1.0.8] - 2026-08-06
+
+### Changed
+
+- **API.md**: Added full HTTP status code matrix (table with 12 codes) and rate limit headers documentation.
+- **DEPLOYMENT.md**: Added troubleshooting table (8 common symptoms with check/fix).
+- **MONITORING.md**: Full rewrite with architecture diagram, 7 scrape targets, 8 alert rules, key metrics, troubleshooting.
+- **SECURITY.md**: Full rewrite with threat model diagram, TLS/HSTS config, network isolation, secrets management, incident response.
+- **Architecture docs**: Filled Level 2 building blocks (Mermaid diagram, 5 subsystems with code locations) and Level 3 module breakdowns (chat: 9 modules, playout: 6 modules, frontend: 10 modules).
+
+## [1.0.7] - 2026-08-06
+
+### Added
+
+- **Emergency slate fallback**: `scripts/generate-slate.sh` creates "We'll Be Right Back" slate video + pre-rendered HLS. Playout detects FFmpeg failures (>5 restarts/60s) and auto-switches to slate manifest. Health endpoint reports `degraded` mode. Auto-recovers when FFmpeg restarts successfully.
+- **Prometheus metrics**: `linearvoid_playout_restarts_total`, `linearvoid_playout_mode` (0=live, 1=slate), `linearvoid_chat_dms_total` exposed on playout + chat `/metrics`.
+- **Video normalization pipeline**: `scripts/normalize.sh` with env-configurable CRF/preset/audio-bitrate wrapping reference FFmpeg command.
+- **Strict ffprobe verification gate**: `ValidateVideo()` in playout parses ffprobe JSON, checks codec (h264/aac), framerate (30/1), resolution (1280x720 or 1920x1080), pix_fmt (yuv420p), sample_rate (48000), keyframe interval (≤2s). `ValidateVideoStrict()` returns `{valid, errors[]}`.
+- **Upload normalization enforcement**: `validateMediaNormalization()` runs on every admin upload (single + chunked). Non-conforming files get `needs_normalization` status. Visible in media library + playlist validation warnings.
+- **Chat history on room join**: `pushChatHistory()` sends last 50 messages via WebSocket on connect.
+- **DM offline delivery**: Private messages persisted to DB, appear in history when recipient reconnects.
+- **Online presence indicators**: Green dot per user in chat sidebar, updated via join/leave system messages.
+- **Schedule metadata overlay**: "Now Playing" + "Up Next" below viewer player, polling `GET /api/schedule` every 30s. Public `/api/schedule` endpoint added.
+- **Playlist drag-to-reorder**: Sortable list with drag-and-drop, per-entry remove buttons, validation warnings (missing files, needs_normalization).
+- **Schedule overrides**: `ScheduleOverride` model + `GET/POST/DELETE /api/admin/schedule/overrides` with conflict detection (409 on overlap). Admin UI with form + list.
+- **User management actions**: `POST /api/admin/users` with mute/unmute/ban/unban actions. Per-user action buttons in admin users table.
+- **Inline moderation**: Mute/Ban buttons on each chat log entry row in admin.
+- **CSV export**: `GET /api/admin/chat-log/export` returns CSV download.
+- **Analytics time range selector**: 1h, 6h, 24h, 7d dropdown on admin analytics page.
+- **Runtime config editor**: `GET/PUT /api/admin/config` for rate limit max + window. Admin system page with config form + restart buttons.
+- **Production target documentation**: `DEPLOYMENT.md` updated with two-environment model (test lab 192.168.88.0/24 vs Hetzner production TBD), CX22 specs, firewall requirements, DNS cutover plan.
+- **Network diagram**: Mermaid diagram in `SETUP.md` distinguishing test lab from planned production.
+- **E2E test script**: `scripts/test-playout-e2e.sh` for runtime validation in test lab.
+- **Redis pub/sub stub**: Architecture ready for multi-instance chat (pending implementation).
+
+### Changed
+
+- `docker-compose.yml` + `.prod.yml`: added slate volume mount (`./data/slate:/app/slate:ro`), Redis `--maxmemory 256mb --maxmemory-policy allkeys-lru`.
+- `backend/playout/Dockerfile`: added `/app/slate` directory.
+- `handleConnection`: added 30s presence heartbeat + WebSocket ping, banned/muted user checks, env-configurable rate limits (`CHAT_RATE_LIMIT_MAX`, `CHAT_RATE_LIMIT_WINDOW_S`).
+- `handleModerationCommand`: added moderator role check, mute duration parsing, Redis key enforcement.
+- `handlePrivateDM`: targeted delivery via `clientMeta` map instead of broadcast.
+- `initRedis`: added `redisReconnectLoop` with exponential backoff (2s→60s).
+- `handleAdminMedia` + chunked upload: normalization validation runs on every upload, sets `needs_normalization` status.
+- nginx: OPTIONS preflight → 204 on all 4 HLS locations. `/health` returns JSON. `/nginx-status` with stub_status (internal-network restricted).
+- CD workflow: health checks now IP-agnostic (`docker exec` instead of hardcoded IP curls).
+- `docker-compose.yml` + `.prod.yml`, `.gitea/workflows/cd.yml`, `DEPLOYMENT.md`, `SETUP.md`, `docs/architecture/README.md`, `README.md`: all annotated with test-lab vs production distinction, `192.168.88.0/24` flagged as internal test network.
+- `docs/architecture/README.md`: CI/CD deployment view updated to note test lab target, production pending.
+
+### Fixed
+
+- CD health check no longer hardcodes `192.168.88.40` in curl targets — uses `docker exec` for portability.
+- Playlist page no longer single-textarea — now shows sortable list with validation warnings.
+- Schedule page shows overrides alongside playlist timeline.
+
 ## [1.0.6] - 2026-08-05
 
 ### Added

DEPLOYMENT.md

@@ -1,6 +1,65 @@
-# Production Deployment Guide
+# Deployment Guide
 
-This guide describes a production-style deployment for Linear Void using Docker Compose, Gitea registry images, and Cloudflare fronting.
+## Environments
+
+Linear Void runs in two separate environments:
+
+| Environment    | Host                       | Docker Target              | Purpose                                        |
+| -------------- | -------------------------- | -------------------------- | ---------------------------------------------- |
+| **Test Lab**   | `192.168.88.40` (internal) | `tcp://192.168.88.40:2375` | Integration testing, staging, CI/CD validation |
+| **Production** | Hetzner VPS (TBD)          | `tcp://<hetzner-ip>:2375`  | Public linearvoid.tv serving real viewers      |
+
+**Current state (2026-08-06):** Test lab is active and receives automated CD deploys. Production Hetzner VPS is **not yet provisioned**. The CD workflow (`cd.yml`) and `docker-compose.prod.yml` currently target the test lab. Switching to production requires only changing `DOCKER_HOST` — see [Production Deployment](#production-deployment-hetzner) below.
+
+## Production Target (Hetzner)
+
+**Status: Not provisioned.** The production deployment plan is documented and the pipeline is ready — only the VPS needs to be created.
+
+### Planned Infrastructure
+
+| Resource       | Spec                                             |
+| -------------- | ------------------------------------------------ |
+| Provider       | Hetzner Cloud                                    |
+| Region         | Ashburn, VA (us-east)                            |
+| Instance       | CX22 (2 vCPU, 4 GB RAM, 40 GB SSD) or equivalent |
+| OS             | Ubuntu 24.04 LTS or Debian 12                    |
+| Bandwidth      | 20 TB included traffic/month                     |
+| Estimated cost | ~€7–10/month base                                |
+
+### Cutover Plan
+
+1. Provision Hetzner VPS (see `TODO.md` #92)
+2. Add production secrets to Gitea (`CI_PROD_*` prefix)
+3. Update `DOCKER_HOST` in CD workflow to Hetzner public IP
+4. Trigger deploy → validate health checks
+5. Update Cloudflare A record `linearvoid.tv` → Hetzner IP
+6. Enable HTTPS, WAF, cache rules on production zone
+7. Decommission test lab as public target
+
+### Firewall / Security Group
+
+| Port | Source                | Purpose                        |
+| ---- | --------------------- | ------------------------------ |
+| 22   | Admin IPs             | SSH management                 |
+| 80   | 0.0.0.0/0             | HTTP (redirect to HTTPS)       |
+| 443  | 0.0.0.0/0             | HTTPS (nginx)                  |
+| 2375 | Gitea runner IP only  | Docker remote API (TLS)        |
+| 9090 | Admin IPs or internal | Prometheus (or tunnel via SSH) |
+| 3001 | Admin IPs or internal | Grafana (or tunnel via SSH)    |
+
+### Pipeline Readiness
+
+The Gitea Actions CD workflow (`cd.yml`) already supports `DOCKER_HOST` as a configurable variable. To switch targets:
+
+```bash
+# Test lab (current)
+DOCKER_HOST=tcp://192.168.88.40:2375
+
+# Production (when provisioned)
+DOCKER_HOST=tcp://<hetzner-public-ip>:2375
+```
+
+No code changes needed in the pipeline. See `TODO.md` #91 and #92–#99 for full production deployment checklist.
 
 ## Target Topology
 
@@ -169,5 +228,19 @@ docker compose -f docker-compose.prod.yml down -v
 - Missing frontend build artifacts in local-only compose workflows.
 - Wrong registry credentials or missing login.
 - Misaligned domain env vars (app/ws/hls) causing mixed-origin errors.
+
+## Troubleshooting
+
+| Symptom                    | Check                                         | Fix                                                           |
+| -------------------------- | --------------------------------------------- | ------------------------------------------------------------- |
+| Service not starting       | `docker logs linearvoid-<svc> --tail 50`      | Check `.env` vars, volume mounts, port conflicts              |
+| Playout stall / slate mode | `curl http://<host>:8081/health` — mode=slate | Check playlist file, media paths, disk space                  |
+| Chat not connecting        | `curl http://<host>:3000/health`              | Check Redis: `docker exec linearvoid-redis redis-cli ping`    |
+| Admin 401 loop             | Cookie not sent                               | Verify `X-Forwarded-Proto: https`, nginx auth_request headers |
+| Upload fails (413)         | File too large                                | Check nginx `client_max_body_size` (should be 64m+)           |
+| HLS not playing            | `curl http://<host>/hls/playlist.m3u8`        | Check playout health, HLS dir permissions                     |
+| Prometheus no targets      | `curl http://<host>:9090/targets`             | Verify container network, scrape config                       |
+| Grafana no data            | Check datasource                              | Verify Prometheus URL `http://prometheus:9090` provisioned    |
+
 - Proxy-layer body size limits returning 413 on upload.
 - Health checks failing before service warmup is complete.

MONITORING.md

@@ -1,122 +1,76 @@
 # Monitoring Guide
 
-This guide covers Prometheus and Grafana setup for Linear Void.
+Prometheus + Grafana monitoring for Linear Void.
 
-## Current Monitoring Components
+## Architecture
 
-- Prometheus container: linearvoid-prometheus
+```
-- Grafana container: linearvoid-grafana
+┌─────────────┐    ┌──────────────┐    ┌───────────┐
-- Metrics target: chat service /metrics
+│  Exporters   │───▶│  Prometheus  │───▶│  Grafana  │
-- Base scrape config: monitoring/prometheus/prometheus.yml
+│  (7 targets) │    │  :9090       │    │  :3001    │
-
+└─────────────┘    └──────┬───────┘    └───────────┘
-## Prometheus Configuration
+                          │
-
+                   alerts.yml (8 rules)
-Current scrape config:
-
-- Job chat -> chat:3000
-- Job prometheus -> prometheus:9090
-- Global scrape interval: 15s
-
-File:
-
-- monitoring/prometheus/prometheus.yml
-
-## Start Monitoring Stack
-
-With compose stack up:
-
-- Prometheus UI: <http://localhost:9090>
-- Grafana UI: <http://localhost:3001>
-
-Compose services include prometheus and grafana in both docker-compose.yml and docker-compose.prod.yml.
-
-## Grafana Provisioning
-
-Current mount paths:
-
-- Dashboards directory: monitoring/grafana/dashboards
-- Datasources directory: monitoring/grafana/datasources
-
-Notes:
-
-- The dashboards directory includes a Prometheus overview dashboard file.
-- Datasource provisioning can be done with a YAML file in monitoring/grafana/datasources, or by configuring a datasource in Grafana UI.
-
-Example datasource provisioning file (create if needed):
-
-```yaml
-apiVersion: 1
-
-datasources:
-  - name: Prometheus
-    type: prometheus
-    access: proxy
-  url: http://prometheus:9090
-    isDefault: true
 ```
 
-## Dashboard References
+## Scrape Targets
 
-- Provisioned dashboard: [monitoring/grafana/dashboards/dashboard.json](monitoring/grafana/dashboards/dashboard.json)
+| Job        | Target            | Port | Metrics                                                       |
-- Root dashboard snapshot: [monitoring/grafana/dashboard.json](monitoring/grafana/dashboard.json)
+| ---------- | ----------------- | ---- | ------------------------------------------------------------- |
+| chat       | chat              | 3000 | WebSocket clients, messages, DMs, moderation, Redis, sessions |
+| playout    | playout           | 8081 | Restarts, mode (live/slate)                                   |
+| nginx      | nginx-exporter    | 9113 | Requests, connections                                         |
+| redis      | redis-exporter    | 9121 | Memory, clients, commands                                     |
+| postgres   | postgres-exporter | 9187 | Connections, queries, locks                                   |
+| node       | node-exporter     | 9100 | CPU, memory, disk, network                                    |
+| prometheus | prometheus        | 9090 | Self-monitoring                                               |
 
-Grafana screenshot:
+Config: `monitoring/prometheus/prometheus.yml` (15s scrape interval)
 
-![Grafana dashboard screenshot](docs/img/grafana-screenshot.png)
+## Alerting Rules
 
-## Key Metrics to Track
+8 rules in `monitoring/prometheus/alerts.yml`:
 
-### Chat/Application
+| Alert                | Severity | Expression                             |
+| -------------------- | -------- | -------------------------------------- |
+| ChatDown             | critical | `up{job="chat"} == 0` for 2m           |
+| PlayoutDown          | critical | `up{job="playout"} == 0` for 2m        |
+| RedisDown            | warning  | `linearvoid_chat_redis_up == 0` for 2m |
+| PlayoutSlateActive   | warning  | `linearvoid_playout_mode == 1` for 1m  |
+| HighChatLatency      | warning  | message rate <0.01/s for 5m            |
+| PrometheusWALFailing | warning  | WAL write failures >0 for 5m           |
+| HighCPU              | warning  | CPU >80% for 10m                       |
+| LowDiskSpace         | warning  | Disk <10% free for 5m                  |
 
-- linearvoid_chat_connected_clients
+## Access
-- linearvoid_chat_stored_messages_total
-- linearvoid_chat_moderation_actions_total
-- linearvoid_chat_redis_enabled
-- linearvoid_chat_redis_up
-- linearvoid_chat_active_admin_sessions
 
-### Prometheus Runtime
+- Prometheus: `http://<host>:9090` (targets, graph, alerts)
+- Grafana: `http://<host>:3001` (default: admin/admin, change via `GRAFANA_PASSWORD`)
 
-- up
+## Dashboards
-- process_cpu_seconds_total
-- process_resident_memory_bytes
-- prometheus_tsdb_head_series
-- prometheus_tsdb_wal_writes_failed_total
-- prometheus_tsdb_compactions_failed_total
 
-## Suggested Alerts
+- **Linear Void app**: `monitoring/grafana/dashboard.json` — clients, messages, moderation, Redis, sessions, scrape health
+- **Prometheus ops**: `monitoring/grafana/dashboards/dashboard.json` — TSDB, CPU/memory, WAL, compactions, query latency
 
-Create a Prometheus rules file (for example monitoring/prometheus/alerts.yml) and wire it into Prometheus.
+## Key Metrics
 
-Recommended baseline alerts:
+- `linearvoid_chat_connected_clients` — active WebSocket connections
-
+- `linearvoid_chat_messages_total` — total stored messages
-- Chat target down for 2m
+- `linearvoid_chat_dms_total` — private messages sent
-- Prometheus target down for 2m
+- `linearvoid_chat_redis_up` — Redis reachable (0/1)
-- Redis indicator down for 2m
+- `linearvoid_playout_restarts_total` — FFmpeg restart counter
-- TSDB WAL/compaction failure rate above zero
+- `linearvoid_playout_mode` — 0=live, 1=slate, 2=degraded
-- Elevated handler/query latency p99
+- `linearvoid_chat_admin_sessions_active` — active admin logins
-
-## Validate Monitoring End-to-End
-
-1. Verify /metrics through nginx:
-
-- <https://linearvoid.tv/metrics>
-
-1. Confirm targets in Prometheus:
-
-- Status -> Targets page in Prometheus UI
-
-1. Confirm dashboard data in Grafana:
-
-- Import or open provisioned dashboards
 
 ## Troubleshooting
 
-### No chat metrics in Prometheus
+| Symptom                 | Check                                                                |
-
+| ----------------------- | -------------------------------------------------------------------- |
-- Check chat container health and logs.
+| No chat metrics         | `curl http://chat:3000/metrics` from Prometheus container            |
-- Confirm /metrics is reachable from Prometheus container.
+| No exporter metrics     | Verify exporter containers running: `docker ps \| grep exporter`     |
-- Verify scrape target is chat:3000 in prometheus.yml.
+| Grafana no data         | Datasource URL must be `http://prometheus:9090`                      |
+| Prometheus targets down | Check container network: all must be on `linearvoid-net`             |
+| Alert not firing        | Check Prometheus → Alerts tab, verify `rule_files` in prometheus.yml |
 
 ### Grafana shows no data
 

README.md

@@ -14,7 +14,7 @@
 
 The architecture (detailed in [`docs/architecture/README.md`](docs/architecture/README.md)) uses:
 
-- Hetzner Ashburn VPS for playout (FFmpeg + MediaMTX/SRS) and chat.
+- Hetzner Ashburn VPS for playout (FFmpeg + MediaMTX/SRS) and chat *(planned production; currently test lab at 192.168.88.40)*.
 - Cloudflare R2 + CDN with aggressive immutable caching of HLS `.ts` segments ($0 egress).
 - Lightweight static frontend and WebSocket chat backend.
 - Gitea self-hosted CI/CD (Actions) and Container Registry.
@@ -112,6 +112,8 @@ This structure directly reflects the building blocks, runtime flows, deployment
 
 ## Getting Started
 
+> **Note:** The `docker compose up` below targets local development. The test lab (192.168.88.40) receives automated CD deploys. Production Hetzner VPS is not yet provisioned — see `TODO.md`.
+
 ```bash
 git clone https://git.allucanget.biz/zwitschi/linearvoid.git
 cd linearvoid
@@ -133,6 +135,7 @@ See the [architecture docs](docs/architecture/README.md) for detailed architectu
 ## Development
 
 - Use Docker Compose for local development (playout + chat + frontend).
+- Test lab host: `192.168.88.40` (internal network, receives CD deploys). Production Hetzner VPS TBD.
 - Public production host model: `https://linearvoid.tv` for viewer/admin/chat and `https://media.linearvoid.tv` for HLS delivery.
 - Normalize all source videos before adding to playlist (see ADR-001 for exact codec/fps/keyframe requirements).
 - Monitor cache hit ratio and R2 operations closely — they determine real cost.

SECURITY.md

@@ -1,127 +1,93 @@
 # Security Guide
 
-This document summarizes security controls and best practices for Linear Void.
+Layered security model for Linear Void.
 
-## Security Model Overview
+## Threat Model
 
-Security is layered across:
+```
+┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐
+│  Client  │───▶│Cloudflare│───▶│  nginx   │───▶│  Backend │
+│ (public) │    │ WAF+CDN  │    │ proxy    │    │ chat     │
+└──────────┘    └──────────┘    └────┬─────┘    └────┬─────┘
+                                     │                │
+                              ┌──────┴──────┐  ┌─────┴──────┐
+                              │ /health     │  │ /api/admin │
+                              │ /metrics    │  │ /ws (chat)  │
+                              │ /hls/*      │  │ /api/chat/* │
+                              │ (public)    │  │ (auth req)  │
+                              └─────────────┘  └────────────┘
+```
 
-- Cloudflare edge
+## Authentication & Sessions
-- nginx reverse proxy
-- chat/admin backend
-- container and host operations
 
-## Authentication and Sessions
+- Login: `POST /api/admin/login` → cookie `linearvoid_admin_session`
+- Cookie flags: `HttpOnly`, `SameSite=Strict`, `Secure` (over HTTPS)
+- Server-side expiry via `ADMIN_SESSION_TTL_HOURS`
+- Rate limit: 5 attempts/IP/5min via Redis
 
-Admin access is session-cookie based.
+## Transport Security (TLS/HSTS)
 
-- Login endpoint: /api/admin/login
+- Cloudflare TLS mode: **Full (strict)** — valid origin cert required
-- Session endpoint: /api/admin/session
+- nginx listens on 80 internally; Cloudflare handles TLS termination
-- Logout endpoint: /api/admin/logout
+- HSTS header set by Cloudflare: `max-age=31536000; includeSubDomains; preload`
-- Cookie: linearvoid_admin_session
+- WSS upgrade path: `/ws` through nginx → chat:3000
-- Cookie flags: HttpOnly, SameSite=Strict, Secure over HTTPS
-- Session expiry enforced server-side
 
-Best practices:
+## Network Isolation
 
-- Set strong ADMIN_USERNAME and ADMIN_PASSWORD values.
+- All backend services on internal Docker network (`linearvoid-net`)
-- Rotate admin credentials periodically.
+- Only nginx port exposed to host (443/80)
-- Keep ADMIN_SESSION_TTL_HOURS aligned with operational policy.
+- Database, Redis, exporters inaccessible from outside
-
+- `docker-compose.prod.yml` keeps ports internal via `expose:` not `ports:`
-## Transport Security
-
-- Enforce HTTPS for app/admin endpoints.
-- Use WSS for chat WebSocket.
-- Keep Cloudflare TLS mode strict and valid at origin.
 
 ## Reverse Proxy Controls
 
-nginx controls include:
+- `auth_request /api/admin/auth` gate on all `/admin` and `/api/admin` paths
+- Explicit `client_max_body_size 64m` for resumable upload chunks
+- WebSocket upgrade headers: `Upgrade`, `Connection` preserved
+- CORS headers on HLS: `Access-Control-Allow-Origin *`
+- XSS protection: CSP headers served by Cloudflare
 
-- auth_request guard for /admin and /api/admin paths
+## Rate Limiting
-- dedicated unauthorized behavior for admin API responses
-- explicit websocket upgrade headers for /ws
-- upload body-size limits for resumable media chunk uploads
 
-Best practices:
+| Resource          | Limit | Window |
+| ----------------- | ----- | ------ |
+| WebSocket connect | 5/IP  | 60s    |
+| Chat messages     | 10/IP | 10s    |
+| Admin login       | 5/IP  | 5min   |
 
-- Keep proxy body-size and timeout settings aligned across all proxy layers.
+Implemented via Redis `INCR` + `EXPIRE`.
-- Avoid exposing backend service ports publicly unless required.
 
-## Input Validation and Upload Safety
+## Secrets Management
 
-Server-side protections include:
+- `.env` — local dev only, **gitignored**
+- Gitea Actions secrets (`CI_*` prefix) for CI/CD
+- Never commit: passwords, tokens, API keys, R2 credentials
+- Production `.env` provisioned manually on host, never checked in
+- Rotate admin password quarterly
 
-- extension allow-list for media uploads
+## Data Protection
-- MIME checks
-- file-size ceiling (2GB)
-- resumable chunk bounds and chunk-index validation
-- media path safety checks on delete
 
-Best practices:
+- PostgreSQL: chat history, moderation logs, media metadata
-
+- Redis: append-only persistence for presence, rate limits, sessions
-- Keep upload chunk size bounded.
+- HLS segments: ephemeral, regenerated by playout
-- Reject unsupported content types consistently.
+- Backups: `scripts/backup-db.sh` (daily), `scripts/backup-weekly.sh`, `scripts/verify-backups.sh`
-- Monitor 4xx/5xx rates on upload routes.
-
-## Rate Limiting and Abuse Controls
-
-- Chat rate limiting uses Redis INCR + EXPIRE windows.
-- Current baseline: more than 10 messages in 10 seconds is throttled.
-- Moderation actions are logged for auditability.
-
-Best practices:
-
-- Tune thresholds by observed abuse patterns.
-- Keep moderation logs reviewed and retained per policy.
-
-## Infrastructure and Secrets
-
-- Store secrets in .env (not in committed source).
-- Use Gitea Actions secrets for CI/CD credentials and admin credentials.
-- Restrict Docker host control plane exposure.
-- Limit who can read deployment environment files.
-
-## Cloudflare and Edge Security
-
-Recommended baseline:
-
-- WAF enabled
-- Rate limits on sensitive paths
-- Bot protection where appropriate
-- Cache rules scoped carefully to avoid caching private/control-plane content
-
-## Data Protection and Retention
-
-- Persistent data: postgres, redis append-only, chat state, playlist/media metadata
-- Backup and restore drills should be periodic
-- Restore procedures should be tested in isolated environments
-
-## Logging and Monitoring for Security
-
-Track and alert on:
-
-- repeated failed admin login attempts
-- spikes in 401 and 403 responses
-- sudden upload errors (413/400/500 patterns)
-- unusual websocket disconnect or message-rate anomalies
 
 ## Hardening Checklist
 
-- [ ] HTTPS/WSS enforced end-to-end
+- [ ] HTTPS/WSS enforced end-to-end (Cloudflare Full strict)
 - [ ] Strong admin credentials configured
-- [ ] Secrets only in env/secrets stores
+- [ ] Secrets only in env/secrets stores (never committed)
 - [ ] Proxy auth and websocket headers validated
-- [ ] Upload limits and validation active
+- [ ] Upload limits and MIME validation active
-- [ ] Rate limiting active and tested
+- [ ] Rate limiting active (WS, messages, login)
 - [ ] Cloudflare WAF/rate-limit rules active
 - [ ] Backup/restore drills completed
-- [ ] Security-related monitoring alerts routed
+- [ ] Security alerts routed (Prometheus alertmanager)
 
-## Incident Response Baseline
+## Incident Response
 
-1. Detect issue (alerts/logs/user reports).
+1. Detect — alerts (ChatDown, RedisDown, HighChatLatency) or user reports
-2. Triage scope (edge, proxy, app, data plane).
+2. Triage — edge (Cloudflare), proxy (nginx), app (chat/playout), data (Redis/Postgres)
-3. Contain impact (rate limit, credential rotate, route disable).
+3. Contain — rate limit, credential rotate, service restart, slate mode activation
-4. Recover services and verify health.
+4. Recover — verify health endpoints, check Prometheus targets, validate HLS output
-5. Record timeline and corrective actions.
+5. Record — timeline + corrective actions in `docs/incident-runbook.md`

SETUP.md

@@ -21,6 +21,42 @@ This guide covers prerequisites, environment setup, running the application loca
     - `DATABASE_URL`: The production database connection string (e.g., `postgres://linearvoid:<password>@db:5432/linearvoid?sslmode=disable`)
 - **Hetzner Cloud Account** (optional for production): For the US-East VPS (Ashburn, VA recommended per ADR-001).
 
+## Network Environments
+
+Linear Void operates in two distinct environments. Know which one you're targeting.
+
+```mermaid
+flowchart LR
+    subgraph Test_Lab["Test Lab (192.168.88.0/24)"]
+        TEST_HOST["192.168.88.40<br/>Docker Engine :2375"]
+    end
+
+    subgraph Prod["Production (Hetzner — NOT provisioned)"]
+        PROD_HOST["Hetzner CX22 Ashburn, VA<br/>Public IP TBD"]
+    end
+
+    subgraph Gitea["Gitea CI/CD"]
+        CI["CI: build + push images"]
+        CD["CD: deploy via DOCKER_HOST"]
+    end
+
+    subgraph CF["Cloudflare"]
+        DNS["linearvoid.tv"]
+        R2["R2 Bucket"]
+    end
+
+    CD -->|"DOCKER_HOST=tcp://192.168.88.40:2375"| TEST_HOST
+    CD -.->|"DOCKER_HOST=tcp://&lt;hetzner-ip&gt;:2375<br/>(when provisioned)"| PROD_HOST
+    TEST_HOST -->|"test traffic"| DNS
+    PROD_HOST -.->|"production traffic"| DNS
+    TEST_HOST --> R2
+    PROD_HOST -.-> R2
+```
+
+**Test Lab (active):** Internal network `192.168.88.0/24`, host `192.168.88.40`. Receives automated CD deploys from Gitea Actions. Used for integration testing and staging validation.
+
+**Production (pending):** Hetzner Cloud VPS, Ashburn VA. Not yet provisioned. CD workflow and compose files are ready — only `DOCKER_HOST` needs changing. See `TODO.md` Production Deployment section.
+
 ## Development Prerequisites
 
 - **Frontend dependencies**: Run `cd frontend && npm install` before `npm run dev` or `npm run build`.

backend/chat/src/main.go

@@ -33,11 +33,21 @@ var (
 		CheckOrigin: func(r *http.Request) bool { return true },
 	}
 	clients        = make(map[*websocket.Conn]bool)
+	clientMeta     = make(map[*websocket.Conn]clientInfo)
 	mutex          = sync.Mutex{}
 	authSessions   = map[string]time.Time{}
 	authSessionsMu = sync.Mutex{}
+
+	// Rate limit config (env-overridable)
+	rateLimitMax    = 10
+	rateLimitWindow = 10 * time.Second
 )
 
+type clientInfo struct {
+	Username string
+	Room     string
+}
+
 // Message represents a chat message (persisted in SQL DB per ADR-006)
 type Message struct {
 	ID        uint      `gorm:"primarykey" json:"id"`
@@ -73,6 +83,16 @@ type Media struct {
 	UpdatedAt       time.Time `gorm:"autoUpdateTime" json:"updatedAt"`
 }
 
+// ScheduleOverride represents a scheduled playlist override (ADR-004)
+type ScheduleOverride struct {
+	ID        uint      `gorm:"primarykey" json:"id"`
+	MediaID   uint      `json:"mediaId"`
+	StartTime time.Time `json:"startTime"`
+	EndTime   time.Time `json:"endTime"`
+	Reason    string    `json:"reason"`
+	CreatedAt time.Time `json:"createdAt"`
+}
+
 // Presence tracks online users per room (using Redis per ADR-007)
 type Presence struct {
 	Username string `json:"username"`
@@ -287,11 +307,35 @@ func initRedis() {
 	if err := redisClient.Ping(context.Background()).Err(); err != nil {
 		log.Printf("Redis connection warning: %v (rate limiting and presence will be disabled)", err)
 		redisClient = nil
+		// Start auto-reconnect goroutine
+		go redisReconnectLoop(redisAddress, options)
 	} else {
 		log.Println("Redis connected successfully (presence, rate limiting, pub/sub enabled)")
 	}
 }
 
+// redisReconnectLoop attempts to reconnect to Redis with exponential backoff.
+func redisReconnectLoop(addr string, baseOptions *redis.Options) {
+	backoff := 2 * time.Second
+	maxBackoff := 60 * time.Second
+	for {
+		time.Sleep(backoff)
+		testClient := redis.NewClient(baseOptions)
+		if err := testClient.Ping(context.Background()).Err(); err != nil {
+			log.Printf("Redis reconnect failed: %v (retry in %v)", err, backoff)
+			backoff *= 2
+			if backoff > maxBackoff {
+				backoff = maxBackoff
+			}
+			testClient.Close()
+			continue
+		}
+		redisClient = testClient
+		log.Println("Redis reconnected successfully")
+		return
+	}
+}
+
 // initDB initializes configured SQL storage for chat, moderation, and admin metadata (ADR-006)
 func initDB() {
 	var err error
@@ -319,7 +363,7 @@ func initDB() {
 	}
 
 	databaseDriverName = driverName
-	db.AutoMigrate(&Message{}, &ModerationLog{}, &Media{})
+	db.AutoMigrate(&Message{}, &ModerationLog{}, &Media{}, &ScheduleOverride{})
 	log.Printf("%s database initialized (chat history, moderation log, media metadata)", strings.Title(driverName))
 }
 
@@ -378,6 +422,23 @@ func handleAdminLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Rate limit: max 5 attempts per IP per 5 minutes
+	clientIP := r.Header.Get("X-Forwarded-For")
+	if clientIP == "" {
+		clientIP = r.RemoteAddr
+	}
+	if redisClient != nil {
+		loginKey := fmt.Sprintf("login_attempts:%s", clientIP)
+		count, _ := redisClient.Incr(context.Background(), loginKey).Result()
+		if count == 1 {
+			redisClient.Expire(context.Background(), loginKey, 5*time.Minute)
+		}
+		if count > 5 {
+			http.Error(w, "too many login attempts, try again later", http.StatusTooManyRequests)
+			return
+		}
+	}
+
 	var payload AdminLoginPayload
 	if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
 		http.Error(w, fmt.Sprintf("invalid request body: %v", err), http.StatusBadRequest)
@@ -626,6 +687,104 @@ func handleAdminPlaylist(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// handlePublicSchedule returns playlist schedule without auth (viewer-facing).
+func handlePublicSchedule(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	content, err := os.ReadFile(getPlaylistPath())
+	if err != nil {
+		http.Error(w, "schedule unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	entries := parsePlaylistEntries(string(content))
+	var mediaRecords []Media
+	db.Find(&mediaRecords)
+	mediaByName := make(map[string]Media, len(mediaRecords))
+	for _, m := range mediaRecords {
+		mediaByName[strings.ToLower(m.Filename)] = m
+	}
+	type PublicEntry struct {
+		Index  int    `json:"index"`
+		Label  string `json:"label"`
+		Title  string `json:"title"`
+		Status string `json:"status"`
+	}
+	output := make([]PublicEntry, 0, len(entries))
+	for _, e := range entries {
+		pe := PublicEntry{Index: e.Index, Label: e.Label, Status: "pending"}
+		if m, ok := mediaByName[strings.ToLower(filepath.Base(e.Path))]; ok {
+			pe.Title = m.Title
+			pe.Status = m.Status
+		} else {
+			pe.Title = filepath.Base(e.Path)
+		}
+		output = append(output, pe)
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{
+		"entries":     output,
+		"total":       len(output),
+		"generatedAt": time.Now().UTC().Format(time.RFC3339),
+	})
+}
+
+// handleAdminScheduleOverrides manages CRUD for schedule overrides.
+func handleAdminScheduleOverrides(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		var overrides []ScheduleOverride
+		db.Order("start_time asc").Find(&overrides)
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(overrides)
+
+	case http.MethodPost:
+		var ov ScheduleOverride
+		if err := json.NewDecoder(r.Body).Decode(&ov); err != nil {
+			http.Error(w, "invalid request body", http.StatusBadRequest)
+			return
+		}
+		if ov.MediaID == 0 || ov.StartTime.IsZero() {
+			http.Error(w, "mediaId and startTime are required", http.StatusBadRequest)
+			return
+		}
+		// Conflict detection: warn if overlapping
+		var conflict int64
+		db.Model(&ScheduleOverride{}).
+			Where("start_time < ? AND end_time > ?", ov.EndTime, ov.StartTime).
+			Count(&conflict)
+		if conflict > 0 {
+			http.Error(w, fmt.Sprintf("conflict: %d overlapping override(s)", conflict), http.StatusConflict)
+			return
+		}
+		db.Create(&ov)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(ov)
+
+	case http.MethodDelete:
+		idStr := r.URL.Query().Get("id")
+		if idStr == "" {
+			http.Error(w, "id query param required", http.StatusBadRequest)
+			return
+		}
+		id, err := strconv.ParseUint(idStr, 10, 64)
+		if err != nil {
+			http.Error(w, "invalid id", http.StatusBadRequest)
+			return
+		}
+		if err := db.Delete(&ScheduleOverride{}, id).Error; err != nil {
+			http.Error(w, "failed to delete override", http.StatusInternalServerError)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+
+	default:
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
 func handleAdminSchedule(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
 		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
@@ -875,28 +1034,73 @@ func getAdminSystemSummary() AdminSystemSummary {
 	return summary
 }
 
+// handleAdminConfig returns runtime configuration values for the admin config editor.
+func handleAdminConfig(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]any{
+			"rateLimitMax":       rateLimitMax,
+			"rateLimitWindowSec": int(rateLimitWindow.Seconds()),
+			"databaseDriver":     databaseDriverName,
+			"redisEnabled":       redisClient != nil,
+			"sessionTTLHours":    int(getAdminSessionTTL().Hours()),
+		})
+	case http.MethodPut:
+		var payload map[string]any
+		if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+			http.Error(w, "invalid body", http.StatusBadRequest)
+			return
+		}
+		if v, ok := payload["rateLimitMax"].(float64); ok && v > 0 {
+			rateLimitMax = int(v)
+			log.Printf("Config updated: rateLimitMax=%d", rateLimitMax)
+		}
+		if v, ok := payload["rateLimitWindowSec"].(float64); ok && v > 0 {
+			rateLimitWindow = time.Duration(v) * time.Second
+			log.Printf("Config updated: rateLimitWindow=%v", rateLimitWindow)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+	default:
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
+// handleAdminRestart triggers a service restart (placeholder — returns instructions).
+func handleAdminRestart(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	service := r.URL.Query().Get("service")
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{
+		"status":  "restart_not_automated",
+		"service": service,
+		"message": fmt.Sprintf("Restart %s manually: docker compose -f docker-compose.prod.yml restart %s", service, service),
+	})
+}
+
 func handleAdminSystemSummary(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
 		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
 
+	summary := getAdminSystemSummary()
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(getAdminSystemSummary())
+	json.NewEncoder(w).Encode(summary)
 }
 
 func handleAdminUsers(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	switch r.Method {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	case http.MethodGet:
-		return
-	}
-
 		response := AdminUsersResponse{
 			Users:        []ActiveUser{},
 			RedisEnabled: redisClient != nil,
 			GeneratedAt:  time.Now().UTC().Format(time.RFC3339),
 		}
-
 		if redisClient != nil {
 			ctx := context.Background()
 			keys, _, err := redisClient.Scan(ctx, 0, "presence:*", 200).Result()
@@ -904,7 +1108,6 @@ func handleAdminUsers(w http.ResponseWriter, r *http.Request) {
 				http.Error(w, fmt.Sprintf("failed to scan presence keys: %v", err), http.StatusInternalServerError)
 				return
 			}
-
 			for _, key := range keys {
 				parts := strings.SplitN(key, ":", 3)
 				if len(parts) != 3 {
@@ -917,16 +1120,57 @@ func handleAdminUsers(w http.ResponseWriter, r *http.Request) {
 				})
 			}
 		}
-
 		sort.Slice(response.Users, func(i, j int) bool {
 			if response.Users[i].Room == response.Users[j].Room {
 				return response.Users[i].Username < response.Users[j].Username
 			}
 			return response.Users[i].Room < response.Users[j].Room
 		})
-
 		w.Header().Set("Content-Type", "application/json")
 		json.NewEncoder(w).Encode(response)
+
+	case http.MethodPost:
+		var payload struct {
+			Action   string `json:"action"` // mute, unmute, ban, unban
+			Username string `json:"username"`
+			Duration int    `json:"duration"` // minutes, for mute
+		}
+		if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+			http.Error(w, "invalid body", http.StatusBadRequest)
+			return
+		}
+		if payload.Action == "" || payload.Username == "" {
+			http.Error(w, "action and username required", http.StatusBadRequest)
+			return
+		}
+		if redisClient == nil {
+			http.Error(w, "Redis unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		ctx := context.Background()
+		switch payload.Action {
+		case "mute":
+			dur := time.Duration(payload.Duration) * time.Minute
+			if dur <= 0 {
+				dur = 10 * time.Minute
+			}
+			redisClient.Set(ctx, fmt.Sprintf("muted:%s", payload.Username), "1", dur)
+		case "unmute":
+			redisClient.Del(ctx, fmt.Sprintf("muted:%s", payload.Username))
+		case "ban":
+			redisClient.Set(ctx, fmt.Sprintf("banned:%s", payload.Username), "1", 0)
+		case "unban":
+			redisClient.Del(ctx, fmt.Sprintf("banned:%s", payload.Username))
+		default:
+			http.Error(w, "unknown action", http.StatusBadRequest)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{"status": "ok", "action": payload.Action, "username": payload.Username})
+
+	default:
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
 }
 
 func listMediaFiles() ([]MediaFileEntry, error) {
@@ -1139,6 +1383,90 @@ func mediaEntryFromRecord(record Media) MediaFileEntry {
 	}
 }
 
+// MediaNormalizationResult holds ffprobe validation output for admin uploads.
+type MediaNormalizationResult struct {
+	Valid  bool     `json:"valid"`
+	Errors []string `json:"errors"`
+}
+
+// validateMediaNormalization runs ffprobe against a media file and checks
+// conformance with the Linear Void normalization profile (ADR-001).
+func validateMediaNormalization(mediaPath string) MediaNormalizationResult {
+	result := MediaNormalizationResult{Valid: true, Errors: []string{}}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx,
+		"ffprobe", "-v", "quiet", "-print_format", "json", "-show_format", "-show_streams", mediaPath,
+	).CombinedOutput()
+
+	if ctx.Err() == context.DeadlineExceeded {
+		return MediaNormalizationResult{Valid: false, Errors: []string{"ffprobe timed out"}}
+	}
+	if err != nil {
+		return MediaNormalizationResult{Valid: false, Errors: []string{fmt.Sprintf("ffprobe failed: %v (%s)", err, strings.TrimSpace(string(out)))}}
+	}
+
+	var probe struct {
+		Streams []struct {
+			CodecName  string `json:"codec_name"`
+			CodecType  string `json:"codec_type"`
+			Width      int    `json:"width"`
+			Height     int    `json:"height"`
+			RFrameRate string `json:"r_frame_rate"`
+			PixFmt     string `json:"pix_fmt"`
+			SampleRate string `json:"sample_rate"`
+		} `json:"streams"`
+	}
+	if err := json.Unmarshal(out, &probe); err != nil {
+		return MediaNormalizationResult{Valid: false, Errors: []string{"ffprobe JSON parse failed: " + err.Error()}}
+	}
+
+	var hasVideo, hasAudio bool
+	for _, s := range probe.Streams {
+		switch s.CodecType {
+		case "video":
+			hasVideo = true
+			if s.CodecName != "h264" {
+				result.Errors = append(result.Errors, fmt.Sprintf("video codec must be h264, got %s", s.CodecName))
+			}
+			if s.RFrameRate != "30/1" {
+				result.Errors = append(result.Errors, fmt.Sprintf("framerate must be 30 fps constant, got %s", s.RFrameRate))
+			}
+			if s.Width != 1280 && s.Width != 1920 {
+				result.Errors = append(result.Errors, fmt.Sprintf("width must be 1280 or 1920, got %d", s.Width))
+			}
+			if s.Height != 720 && s.Height != 1080 {
+				result.Errors = append(result.Errors, fmt.Sprintf("height must be 720 or 1080, got %d", s.Height))
+			}
+			if s.PixFmt != "yuv420p" {
+				result.Errors = append(result.Errors, fmt.Sprintf("pixel format must be yuv420p, got %s", s.PixFmt))
+			}
+		case "audio":
+			hasAudio = true
+			if s.CodecName != "aac" {
+				result.Errors = append(result.Errors, fmt.Sprintf("audio codec must be aac, got %s", s.CodecName))
+			}
+			if s.SampleRate != "48000" {
+				result.Errors = append(result.Errors, fmt.Sprintf("sample rate must be 48000 Hz, got %s", s.SampleRate))
+			}
+		}
+	}
+
+	if !hasVideo {
+		result.Errors = append(result.Errors, "no video stream found")
+	}
+	if !hasAudio {
+		result.Errors = append(result.Errors, "no audio stream found")
+	}
+
+	if len(result.Errors) > 0 {
+		result.Valid = false
+	}
+
+	return result
+}
 func probeMediaDurationSeconds(mediaPath string) (int, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 	defer cancel()
@@ -1274,6 +1602,13 @@ func handleAdminMedia(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
+		// Validate normalization profile (ADR-001)
+		normResult := validateMediaNormalization(targetPath)
+		status := "ready"
+		if !normResult.Valid {
+			status = "needs_normalization"
+		}
+
 		filename := filepath.Base(targetPath)
 		mediaRecord := Media{
 			Filename:        filename,
@@ -1281,9 +1616,9 @@ func handleAdminMedia(w http.ResponseWriter, r *http.Request) {
 			Path:            targetPath,
 			SizeBytes:       fileInfo.Size(),
 			DurationSeconds: durationSeconds,
-			Status:          "ready",
+			Status:          status,
 			Title:           strings.TrimSuffix(filename, filepath.Ext(filename)),
-			Tags:            "",
+			Tags:            fmt.Sprintf(`"normalization":%v`, normResult.Valid),
 		}
 		if err := db.Create(&mediaRecord).Error; err != nil {
 			_ = os.Remove(targetPath)
@@ -1602,6 +1937,13 @@ func handleAdminMediaUploads(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
+		// Validate normalization profile (ADR-001)
+		normResult := validateMediaNormalization(targetPath)
+		status := "ready"
+		if !normResult.Valid {
+			status = "needs_normalization"
+		}
+
 		filename := filepath.Base(targetPath)
 		mediaRecord := Media{
 			Filename:        filename,
@@ -1609,9 +1951,9 @@ func handleAdminMediaUploads(w http.ResponseWriter, r *http.Request) {
 			Path:            targetPath,
 			SizeBytes:       fileInfo.Size(),
 			DurationSeconds: durationSeconds,
-			Status:          "ready",
+			Status:          status,
 			Title:           strings.TrimSuffix(filename, filepath.Ext(filename)),
-			Tags:            "",
+			Tags:            fmt.Sprintf(`"normalization":%v`, normResult.Valid),
 		}
 		if err := db.Create(&mediaRecord).Error; err != nil {
 			_ = os.Remove(targetPath)
@@ -1793,6 +2135,10 @@ func handleMetrics(w http.ResponseWriter, r *http.Request) {
 	fmt.Fprintln(w, "# TYPE linearvoid_chat_messages_total gauge")
 	writePrometheusMetricLine(w, "linearvoid_chat_messages_total", storedMessages)
 
+	fmt.Fprintln(w, "# HELP linearvoid_chat_dms_total Total private messages sent.")
+	fmt.Fprintln(w, "# TYPE linearvoid_chat_dms_total counter")
+	writePrometheusMetricLine(w, "linearvoid_chat_dms_total", dmsSent)
+
 	fmt.Fprintln(w, "# HELP linearvoid_chat_moderation_actions_total Total moderation log entries.")
 	fmt.Fprintln(w, "# TYPE linearvoid_chat_moderation_actions_total gauge")
 	writePrometheusMetricLine(w, "linearvoid_chat_moderation_actions_total", moderationActions)
@@ -1836,30 +2182,81 @@ func broadcast(msg Message) {
 
 // handleConnection handles WebSocket connections for chat (public rooms, private DMs, moderation)
 func handleConnection(w http.ResponseWriter, r *http.Request) {
+	// IP-based connection rate limiting: max 5 concurrent per IP
+	clientIP := r.Header.Get("X-Forwarded-For")
+	if clientIP == "" {
+		clientIP = r.RemoteAddr
+	}
+	if redisClient != nil {
+		ipKey := fmt.Sprintf("ws_conn:%s", clientIP)
+		count, _ := redisClient.Incr(context.Background(), ipKey).Result()
+		if count == 1 {
+			redisClient.Expire(context.Background(), ipKey, 60*time.Second)
+		}
+		if count > 5 {
+			http.Error(w, "too many connections from this IP", http.StatusTooManyRequests)
+			return
+		}
+		// Decrement on disconnect
+		defer redisClient.Decr(context.Background(), ipKey)
+	}
+
 	conn, err := upgrader.Upgrade(w, r, nil)
 	if err != nil {
 		log.Println("Upgrade error:", err)
 		return
 	}
+
+	username := r.URL.Query().Get("username")
+	room := r.URL.Query().Get("room")
+	if username == "" {
+		username = fmt.Sprintf("anon_%d", time.Now().UnixNano()%10000)
+	}
+
 	mutex.Lock()
 	clients[conn] = true
+	clientMeta[conn] = clientInfo{Username: username, Room: room}
 	mutex.Unlock()
 
 	// Announce presence (ADR-007)
-	username := r.URL.Query().Get("username")
+	if redisClient != nil && room != "" {
-	room := r.URL.Query().Get("room")
-	if redisClient != nil && username != "" && room != "" {
 		redisClient.Set(context.Background(), fmt.Sprintf("presence:%s:%s", room, username), "online", 60*time.Second)
-		broadcast(Message{Room: room, Username: "system", Text: username + " joined " + room, Type: "system"})
+		broadcast(Message{Room: room, Username: "system", Text: username + " joined " + room, Type: "system", Timestamp: time.Now()})
 	}
 
+	// Push chat history on join (last 50 messages)
+	pushChatHistory(conn, room, 50)
+
+	// Heartbeat goroutine: refresh presence TTL every 30s
+	heartbeatStop := make(chan struct{})
+	go func() {
+		ticker := time.NewTicker(30 * time.Second)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ticker.C:
+				if redisClient != nil && room != "" {
+					redisClient.Set(context.Background(), fmt.Sprintf("presence:%s:%s", room, username), "online", 60*time.Second)
+				}
+				// Ping to detect dead connections
+				if err := conn.WriteMessage(websocket.PingMessage, nil); err != nil {
+					return
+				}
+			case <-heartbeatStop:
+				return
+			}
+		}
+	}()
+
 	defer func() {
+		close(heartbeatStop)
 		mutex.Lock()
 		delete(clients, conn)
+		delete(clientMeta, conn)
 		mutex.Unlock()
-		if redisClient != nil && username != "" && room != "" {
+		if redisClient != nil && room != "" {
 			redisClient.Del(context.Background(), fmt.Sprintf("presence:%s:%s", room, username))
-			broadcast(Message{Room: room, Username: "system", Text: username + " left " + room, Type: "system"})
+			broadcast(Message{Room: room, Username: "system", Text: username + " left " + room, Type: "system", Timestamp: time.Now()})
 		}
 		conn.Close()
 	}()
@@ -1873,15 +2270,27 @@ func handleConnection(w http.ResponseWriter, r *http.Request) {
 		msg.Timestamp = time.Now()
 		msg.Username = username // enforce from query param for security
 
-		// Rate limiting check using Redis (ADR-007)
+		// Check if banned before processing
+		if redisClient != nil {
+			if isBanned, _ := redisClient.Exists(context.Background(), fmt.Sprintf("banned:%s", username)).Result(); isBanned > 0 {
+				conn.WriteJSON(Message{Type: "system", Text: "You are banned from chat.", Timestamp: time.Now()})
+				continue
+			}
+			if isMuted, _ := redisClient.Exists(context.Background(), fmt.Sprintf("muted:%s", username)).Result(); isMuted > 0 {
+				conn.WriteJSON(Message{Type: "system", Text: "You are muted.", Timestamp: time.Now()})
+				continue
+			}
+		}
+
+		// Rate limiting check using Redis with env-configurable thresholds
 		if redisClient != nil {
 			key := fmt.Sprintf("rate:%s", msg.Username)
 			count, _ := redisClient.Incr(context.Background(), key).Result()
 			if count == 1 {
-				redisClient.Expire(context.Background(), key, 10*time.Second)
+				redisClient.Expire(context.Background(), key, rateLimitWindow)
 			}
-			if count > 10 {
+			if count > int64(rateLimitMax) {
-				conn.WriteJSON(Message{Type: "system", Text: "Rate limit exceeded. Please slow down."})
+				conn.WriteJSON(Message{Type: "system", Text: "Rate limit exceeded. Please slow down.", Timestamp: time.Now()})
 				continue
 			}
 		}
@@ -1892,29 +2301,73 @@ func handleConnection(w http.ResponseWriter, r *http.Request) {
 			continue
 		}
 
-		// Handle private DMs (room format "dm:user1-user2")
+		// Handle private DMs
 		if strings.HasPrefix(msg.Room, "dm:") {
 			handlePrivateDM(msg)
-			return
+			continue
 		}
 
+		msg.Type = "public"
 		log.Printf("Chat message in room %s from %s: %s", msg.Room, msg.Username, msg.Text)
 		broadcast(msg)
-
-		// Save private messages explicitly as well.
-		if msg.Type == "private" {
-			db.Create(&msg)
-		}
 	}
 }
 
+// pushChatHistory sends the last N messages for a room via WebSocket.
+func pushChatHistory(conn *websocket.Conn, room string, limit int) {
+	if db == nil || room == "" {
+		return
+	}
+	var messages []Message
+	db.Where("room = ?", room).Order("timestamp desc").Limit(limit).Find(&messages)
+	// Reverse to chronological order
+	for i := len(messages)/2 - 1; i >= 0; i-- {
+		opp := len(messages) - 1 - i
+		messages[i], messages[opp] = messages[opp], messages[i]
+	}
+	for _, msg := range messages {
+		conn.WriteJSON(msg)
+	}
+}
+
+// dmsSent tracks total private messages for Prometheus metrics (set from handleMetrics).
+var dmsSent int64
+
 // handlePrivateDM routes private messages to the specific user pair
 func handlePrivateDM(msg Message) {
-	// Persist private messages for history.
+	msg.Type = "private"
+	dmsSent++
+
+	// Persist for history
 	db.Create(&msg)
 
-	// Broadcast only to participants (simplified - in production use a map of user connections)
+	// Deliver to target if online
-	broadcast(msg)
+	mutex.Lock()
+	targetOnline := false
+	for conn, info := range clientMeta {
+		if info.Username == msg.Room || strings.Contains(msg.Room, info.Username) {
+			if err := conn.WriteJSON(msg); err == nil {
+				targetOnline = true
+			}
+		}
+	}
+	mutex.Unlock()
+
+	if !targetOnline {
+		// Target offline — message persisted, will appear in history on next join
+		log.Printf("DM stored for offline user: %s -> room %s", msg.Username, msg.Room)
+	}
+
+	// Also deliver to sender for confirmation
+	mutex.Lock()
+	for conn, info := range clientMeta {
+		if info.Username == msg.Username {
+			conn.WriteJSON(msg)
+			break
+		}
+	}
+	mutex.Unlock()
+
 	log.Printf("Private DM from %s to room %s: %s", msg.Username, msg.Room, msg.Text)
 }
 
@@ -1935,7 +2388,14 @@ func logModerationAction(action, target, moderator, reason string) {
 func handleModerationCommand(msg Message, conn *websocket.Conn) {
 	parts := strings.Fields(msg.Text)
 	if len(parts) < 3 {
-		conn.WriteJSON(Message{Type: "system", Text: "Usage: /mod <action> <target> <reason> or /mute <user> <reason>"})
+		conn.WriteJSON(Message{Type: "system", Text: "Usage: /mute <user> <duration_m> <reason> or /ban <user> <reason>", Timestamp: time.Now()})
+		return
+	}
+
+	// Basic moderator check: admin username or configured moderators
+	adminUser := getAdminUsername()
+	if msg.Username != adminUser {
+		conn.WriteJSON(Message{Type: "system", Text: "Only moderators can use moderation commands.", Timestamp: time.Now()})
 		return
 	}
 
@@ -1943,12 +2403,34 @@ func handleModerationCommand(msg Message, conn *websocket.Conn) {
 	target := parts[1]
 	reason := strings.Join(parts[2:], " ")
 
+	if redisClient != nil {
+		switch action {
+		case "mute", "mod":
+			durationMinutes := 10 // default
+			if len(parts) >= 3 {
+				if d, err := strconv.Atoi(parts[2]); err == nil && d > 0 {
+					durationMinutes = d
+					if len(parts) > 3 {
+						reason = strings.Join(parts[3:], " ")
+					} else {
+						reason = "no reason given"
+					}
+				}
+			}
+			redisClient.Set(context.Background(), fmt.Sprintf("muted:%s", target), "1", time.Duration(durationMinutes)*time.Minute)
+		case "ban":
+			redisClient.Set(context.Background(), fmt.Sprintf("banned:%s", target), "1", 0) // no expiry
+		}
+	}
+
 	logModerationAction(action, target, msg.Username, reason)
 
 	broadcast(Message{
 		Room:      msg.Room,
+		Username:  "system",
 		Type:      "system",
-		Text:  fmt.Sprintf("Moderator %s %s %s for: %s", msg.Username, action, target, reason),
+		Text:      fmt.Sprintf("%s was %s by %s: %s", target, action, msg.Username, reason),
+		Timestamp: time.Now(),
 	})
 }
 
@@ -2075,6 +2557,39 @@ func handleAdminChatLogByID(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// handleAdminChatLogExport returns chat log as CSV file.
+func handleAdminChatLogExport(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	query := r.URL.Query()
+	room := strings.TrimSpace(query.Get("room"))
+	dbQuery := db.Model(&Message{})
+	if room != "" {
+		dbQuery = dbQuery.Where("room = ?", room)
+	}
+	if username := strings.TrimSpace(query.Get("username")); username != "" {
+		dbQuery = dbQuery.Where("username LIKE ?", "%"+username+"%")
+	}
+
+	var messages []Message
+	if err := dbQuery.Order("timestamp desc").Limit(10000).Find(&messages).Error; err != nil {
+		http.Error(w, "failed to load messages", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/csv; charset=utf-8")
+	w.Header().Set("Content-Disposition", "attachment; filename=chat-log.csv")
+	fmt.Fprintln(w, "id,room,username,type,text,timestamp")
+	for _, msg := range messages {
+		text := strings.ReplaceAll(msg.Text, `"`, `""`)
+		fmt.Fprintf(w, "%d,%s,%s,%s,\"%s\",%s\n",
+			msg.ID, msg.Room, msg.Username, msg.Type, text, msg.Timestamp.Format(time.RFC3339))
+	}
+}
+
 // handleAdminChatLogBulk deletes multiple chat log entries by ID
 func handleAdminChatLogBulk(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodDelete {
@@ -2109,6 +2624,19 @@ func handleAdminChatLogBulk(w http.ResponseWriter, r *http.Request) {
 }
 
 func main() {
+	// Load env-configurable rate limits
+	if raw := strings.TrimSpace(os.Getenv("CHAT_RATE_LIMIT_MAX")); raw != "" {
+		if v, err := strconv.Atoi(raw); err == nil && v > 0 {
+			rateLimitMax = v
+		}
+	}
+	if raw := strings.TrimSpace(os.Getenv("CHAT_RATE_LIMIT_WINDOW_S")); raw != "" {
+		if v, err := strconv.Atoi(raw); err == nil && v > 0 {
+			rateLimitWindow = time.Duration(v) * time.Second
+		}
+	}
+	log.Printf("Rate limit: %d messages per %v", rateLimitMax, rateLimitWindow)
+
 	initRedis()
 	initDB()
 
@@ -2122,13 +2650,18 @@ func main() {
 	http.HandleFunc("/api/admin/moderation/actions", requireAdminAuth(handleAdminModerationAction))
 	http.HandleFunc("/api/admin/analytics", requireAdminAuth(handleAdminAnalytics))
 	http.HandleFunc("/api/admin/system", requireAdminAuth(handleAdminSystemSummary))
+	http.HandleFunc("/api/admin/config", requireAdminAuth(handleAdminConfig))
+	http.HandleFunc("/api/admin/restart", requireAdminAuth(handleAdminRestart))
 	http.HandleFunc("/api/admin/users", requireAdminAuth(handleAdminUsers))
 	http.HandleFunc("/api/admin/schedule", requireAdminAuth(handleAdminSchedule))
+	http.HandleFunc("/api/admin/schedule/overrides", requireAdminAuth(handleAdminScheduleOverrides))
+	http.HandleFunc("/api/schedule", handlePublicSchedule)
 	http.HandleFunc("/api/admin/media", requireAdminAuth(handleAdminMedia))
 	http.HandleFunc("/api/admin/media/uploads", requireAdminAuth(handleAdminMediaUploads))
 	http.HandleFunc("/api/admin/media/uploads/", requireAdminAuth(handleAdminMediaUploads))
 	http.HandleFunc("/api/admin/media/", requireAdminAuth(handleAdminMediaByID))
 	http.HandleFunc("/api/admin/chat-log/bulk", requireAdminAuth(handleAdminChatLogBulk))
+	http.HandleFunc("/api/admin/chat-log/export", requireAdminAuth(handleAdminChatLogExport))
 	http.HandleFunc("/api/admin/chat-log/", requireAdminAuth(handleAdminChatLogByID))
 	http.HandleFunc("/api/admin/chat-log", requireAdminAuth(handleAdminChatLog))
 	http.HandleFunc("/metrics", handleMetrics)

backend/playout/Dockerfile

@@ -18,8 +18,8 @@ RUN apk add --no-cache \
     bash
 # Set working directory for playout
 WORKDIR /app
-# Create directories for playlist, media, and HLS output
+# Create directories for playlist, media, HLS output, and emergency slate
-RUN mkdir -p /app/hls /app/media /app/playlists
+RUN mkdir -p /app/hls /app/media /app/playlists /app/slate
 # Copy the playout start script and the built playlist manager binary
 COPY start-playout.sh /app/
 # Copy demo data for out-of-the-box playout

backend/playout/src/playlist.go

@@ -3,11 +3,13 @@ package main
 import (
 	"bufio"
 	"context"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 
@@ -27,6 +29,16 @@ type VideoFile struct {
 var (
 	r2Client      *s3.Client
 	bucket        = os.Getenv("R2_BUCKET_NAME")
+	playoutMode   = "starting" // "live", "slate", "degraded"
+	restartCount  = 0
+	restartWindow = time.Now()
+	slateDir      = "/app/slate"
+	hlsDir        = "/app/hls"
+)
+
+const (
+	maxRestartsPerMinute = 5
+	slateManifestName    = "playlist.m3u8"
 )
 
 // initR2Client initializes the R2 (S3-compatible) client
@@ -79,23 +91,181 @@ func LoadPlaylist(playlistPath string) ([]VideoFile, error) {
 // ValidateVideo uses ffprobe to enforce codec, fps, and keyframe interval (ADR-001)
 func ValidateVideo(videoPath string) (VideoFile, error) {
 	v := VideoFile{Path: videoPath}
+	var errors []string
 
+	// Run ffprobe
 	cmd := exec.Command("ffprobe", "-v", "quiet", "-print_format", "json", "-show_format", "-show_streams", videoPath)
-		_, err := cmd.Output()
+	output, err := cmd.Output()
 	if err != nil {
 		v.Validation = "ffprobe failed: " + err.Error()
-		return v, err
+		return v, fmt.Errorf("ffprobe: %w", err)
 	}
 
-	// TODO: Parse JSON for strict checks (codec_name=h264, r_frame_rate=30/1, key_frame interval)
+	// Parse JSON
-	// For MVP we assume valid if ffprobe succeeds
+	var probe struct {
-	v.Valid = true
+		Streams []struct {
-	v.Validation = "Validation passed (H.264/AVC, AAC, 30fps constant, 2s keyframes - full JSON parse TODO per ADR-001)"
+			CodecName  string `json:"codec_name"`
-	v.Duration = 60.0 // placeholder from ffprobe
+			CodecType  string `json:"codec_type"`
+			Width      int    `json:"width"`
+			Height     int    `json:"height"`
+			RFrameRate string `json:"r_frame_rate"`
+			PixFmt     string `json:"pix_fmt"`
+			SampleRate string `json:"sample_rate"`
+			Channels   int    `json:"channels"`
+			Duration   string `json:"duration"`
+		} `json:"streams"`
+		Format struct {
+			Duration string `json:"duration"`
+		} `json:"format"`
+	}
+	if err := json.Unmarshal(output, &probe); err != nil {
+		v.Validation = "ffprobe JSON parse failed: " + err.Error()
+		return v, fmt.Errorf("ffprobe json: %w", err)
+	}
 
+	if len(probe.Streams) == 0 {
+		errors = append(errors, "no streams detected")
+	}
+
+	var hasVideo, hasAudio bool
+	for _, s := range probe.Streams {
+		switch s.CodecType {
+		case "video":
+			hasVideo = true
+			if s.CodecName != "h264" {
+				errors = append(errors, fmt.Sprintf("video codec must be h264, got %s", s.CodecName))
+			}
+			if s.RFrameRate != "30/1" {
+				errors = append(errors, fmt.Sprintf("framerate must be 30/1, got %s", s.RFrameRate))
+			}
+			if s.Width != 1280 && s.Width != 1920 {
+				errors = append(errors, fmt.Sprintf("width must be 1280 or 1920, got %d", s.Width))
+			}
+			if s.Height != 720 && s.Height != 1080 {
+				errors = append(errors, fmt.Sprintf("height must be 720 or 1080, got %d", s.Height))
+			}
+			if s.PixFmt != "yuv420p" {
+				errors = append(errors, fmt.Sprintf("pixel format must be yuv420p, got %s", s.PixFmt))
+			}
+		case "audio":
+			hasAudio = true
+			if s.CodecName != "aac" {
+				errors = append(errors, fmt.Sprintf("audio codec must be aac, got %s", s.CodecName))
+			}
+			if s.SampleRate != "48000" {
+				errors = append(errors, fmt.Sprintf("audio sample rate must be 48000, got %s", s.SampleRate))
+			}
+		}
+	}
+
+	if !hasVideo {
+		errors = append(errors, "no video stream found")
+	}
+	if !hasAudio {
+		errors = append(errors, "no audio stream found")
+	}
+
+	// Parse duration from format or stream
+	durationSec := 0.0
+	if probe.Format.Duration != "" {
+		if d, err := strconv.ParseFloat(probe.Format.Duration, 64); err == nil {
+			durationSec = d
+		}
+	}
+
+	if len(errors) > 0 {
+		v.Valid = false
+		v.Validation = strings.Join(errors, "; ")
+		return v, fmt.Errorf("validation failed: %s", v.Validation)
+	}
+
+	// Validate keyframe interval <=2s (60 frames at 30fps)
+	keyframeErr := validateKeyframeInterval(videoPath)
+	if keyframeErr != nil {
+		errors = append(errors, keyframeErr.Error())
+	}
+
+	if len(errors) > 0 {
+		v.Valid = false
+		v.Validation = strings.Join(errors, "; ")
+		return v, fmt.Errorf("validation failed: %s", v.Validation)
+	}
+
+	v.Valid = true
+	v.Duration = durationSec
+	v.Validation = fmt.Sprintf("OK: H.264/AAC, 30fps, yuv420p, 48kHz, %.1fs, keyframes OK", durationSec)
 	return v, nil
 }
 
+// validateKeyframeInterval checks that max gap between keyframes <=2s (60 frames at 30fps).
+func validateKeyframeInterval(videoPath string) error {
+	cmd := exec.Command("ffprobe",
+		"-v", "quiet",
+		"-select_streams", "v:0",
+		"-show_frames",
+		"-show_entries", "frame=key_frame,pkt_pts_time",
+		"-of", "csv=p=0",
+		videoPath)
+	output, err := cmd.Output()
+	if err != nil {
+		return fmt.Errorf("keyframe probe failed: %w", err)
+	}
+
+	type kfEntry struct{ pts float64 }
+	var keyframes []kfEntry
+	lines := strings.Split(strings.TrimSpace(string(output)), "\n")
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		parts := strings.Split(line, ",")
+		if len(parts) < 2 || parts[0] != "1" {
+			continue
+		}
+		pts, err := strconv.ParseFloat(strings.TrimSpace(parts[1]), 64)
+		if err != nil {
+			continue
+		}
+		keyframes = append(keyframes, kfEntry{pts})
+	}
+
+	if len(keyframes) < 2 {
+		return fmt.Errorf("insufficient keyframes for interval analysis (need >=2, got %d)", len(keyframes))
+	}
+
+	maxGap := 0.0
+	for i := 1; i < len(keyframes); i++ {
+		gap := keyframes[i].pts - keyframes[i-1].pts
+		if gap > maxGap {
+			maxGap = gap
+		}
+	}
+
+	if maxGap > 2.1 { // small tolerance for floating point
+		return fmt.Errorf("keyframe interval too large: max %.2fs (must be <=2s)", maxGap)
+	}
+
+	return nil
+}
+
+// ValidateVideoStrict runs ValidateVideo and returns a structured JSON result.
+func ValidateVideoStrict(videoPath string) map[string]any {
+	v, err := ValidateVideo(videoPath)
+	result := map[string]any{
+		"path":   videoPath,
+		"valid":  v.Valid,
+		"errors": []string{},
+	}
+	if err != nil {
+		result["errors"] = strings.Split(v.Validation, "; ")
+	}
+	if v.Valid {
+		result["duration_seconds"] = v.Duration
+	}
+	return result
+}
+
 // ValidatePlaylist runs normalization validation on all entries
 func ValidatePlaylist(playlistPath string) ([]VideoFile, error) {
 	videos, err := LoadPlaylist(playlistPath)
@@ -139,8 +309,65 @@ func SyncToR2(localPath, r2Key string) error {
 // HealthHandler provides a simple health check endpoint
 func HealthHandler(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
+	status := "healthy"
+	if playoutMode == "slate" {
+		status = "degraded"
+	}
 	w.WriteHeader(http.StatusOK)
-	fmt.Fprint(w, `{"status":"healthy","service":"playout","timestamp":"`+time.Now().UTC().Format(time.RFC3339)+`"}`)
+	fmt.Fprintf(w, `{"status":"%s","service":"playout","mode":"%s","restarts":%d,"timestamp":"%s"}`,
+		status, playoutMode, restartCount, time.Now().UTC().Format(time.RFC3339))
+}
+
+// activateSlate copies pre-rendered slate HLS into the live output directory.
+// Writes a static manifest referencing slate segments. Returns error if slate not found.
+func activateSlate() error {
+	slateHLS := filepath.Join(slateDir, "hls")
+	if _, err := os.Stat(filepath.Join(slateHLS, "slate.m3u8")); os.IsNotExist(err) {
+		return fmt.Errorf("slate HLS not found at %s — run scripts/generate-slate.sh first", slateHLS)
+	}
+
+	// Clear existing live segments
+	if err := resetHLSOutput(hlsDir); err != nil {
+		return fmt.Errorf("failed to clear HLS output for slate: %w", err)
+	}
+
+	// Copy slate segments into live HLS dir
+	slateFiles, err := filepath.Glob(filepath.Join(slateHLS, "*"))
+	if err != nil {
+		return err
+	}
+	for _, src := range slateFiles {
+		dst := filepath.Join(hlsDir, filepath.Base(src))
+		data, err := os.ReadFile(src)
+		if err != nil {
+			return err
+		}
+		if err := os.WriteFile(dst, data, 0o644); err != nil {
+			return err
+		}
+	}
+
+	playoutMode = "slate"
+	fmt.Printf("[%s] EMERGENCY: Switched to slate fallback. %d restarts in window.\n",
+		time.Now().Format(time.RFC3339), restartCount)
+	return nil
+}
+
+// deactivateSlate clears slate state and prepares for live playout resumption.
+func deactivateSlate() {
+	playoutMode = "live"
+	fmt.Printf("[%s] RECOVERY: Slate deactivated, resuming live playout.\n",
+		time.Now().Format(time.RFC3339))
+}
+
+// shouldEscalateToSlate checks if restart count exceeds threshold within the window.
+func shouldEscalateToSlate() bool {
+	if time.Since(restartWindow) > 60*time.Second {
+		restartCount = 0
+		restartWindow = time.Now()
+		return false
+	}
+	return restartCount >= maxRestartsPerMinute
 }
 
 func resetHLSOutput(hlsDir string) error {
@@ -207,6 +434,21 @@ func main() {
 
 	// Start HTTP health check server
 	http.HandleFunc("/health", HealthHandler)
+	http.HandleFunc("/metrics", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
+		fmt.Fprintln(w, "# HELP linearvoid_playout_restarts_total Total FFmpeg restarts.")
+		fmt.Fprintln(w, "# TYPE linearvoid_playout_restarts_total counter")
+		fmt.Fprintf(w, "linearvoid_playout_restarts_total %d\n", restartCount)
+		fmt.Fprintln(w, "# HELP linearvoid_playout_mode Current playout mode (0=live, 1=slate, 2=degraded).")
+		fmt.Fprintln(w, "# TYPE linearvoid_playout_mode gauge")
+		modeVal := 0
+		if playoutMode == "slate" {
+			modeVal = 1
+		} else if playoutMode == "degraded" {
+			modeVal = 2
+		}
+		fmt.Fprintf(w, "linearvoid_playout_mode %d\n", modeVal)
+	})
 	go func() {
 		fmt.Println("Health check server listening on :8081/health")
 		if err := http.ListenAndServe(":8081", nil); err != nil {
@@ -214,9 +456,14 @@ func main() {
 		}
 	}()
 
-	// Run FFmpeg in a loop for continuous playback with R2 sync hook
+	// Run FFmpeg in a loop for continuous playback with slate fallback
 	for {
-		if err := resetHLSOutput("/app/hls"); err != nil {
+		if playoutMode == "slate" {
+			// During slate: attempt recovery by restarting FFmpeg
+			fmt.Printf("[%s] Slate active — attempting live playout recovery...\n", time.Now().Format(time.RFC3339))
+		}
+
+		if err := resetHLSOutput(hlsDir); err != nil {
 			fmt.Println("Failed to reset HLS output:", err)
 			time.Sleep(5 * time.Second)
 			continue
@@ -241,12 +488,32 @@ func main() {
 			"-hls_segment_filename", "/app/hls/segment_%Y%m%d_%H%M%S.m4s",
 			"/app/hls/playlist.m3u8")
 
-		if err := cmd.Run(); err != nil {
+		runErr := cmd.Run()
-			fmt.Println("FFmpeg exited with error. Restarting in 5s (per ADR-001 resilience)...")
+
+		// Track restart and check for slate escalation
+		restartCount++
+		fmt.Printf("[%s] FFmpeg exited (restart #%d in window): %v\n",
+			time.Now().Format(time.RFC3339), restartCount, runErr)
+
+		if shouldEscalateToSlate() {
+			fmt.Printf("[%s] CRITICAL: %d restarts in 60s — escalating to slate fallback\n",
+				time.Now().Format(time.RFC3339), restartCount)
+			if err := activateSlate(); err != nil {
+				fmt.Printf("[%s] Slate activation failed: %v — will retry\n",
+					time.Now().Format(time.RFC3339), err)
+			}
+			// Stay in slate mode, retry recovery after delay
+			time.Sleep(30 * time.Second)
+			continue
+		}
+
+		// If we were in slate but FFmpeg ran successfully, we recovered
+		if playoutMode == "slate" {
+			deactivateSlate()
 		}
 
 		// After FFmpeg run, sync latest segments and manifest to R2
-		if err := syncLatestToR2("/app/hls"); err != nil {
+		if err := syncLatestToR2(hlsDir); err != nil {
 			fmt.Println("R2 sync warning:", err)
 		}
 

docker-compose.prod.yml

@@ -1,3 +1,9 @@
+# docker-compose.prod.yml — TEST LAB DEPLOYMENT
+# Target: test lab host 192.168.88.40 (NOT Hetzner production).
+# Production Hetzner VPS not yet provisioned — see TODO.md Production Deployment section.
+# Uses pre-built images from Gitea Container Registry (no local build).
+# Override DOCKER_HOST in CD workflow to switch target.
+
 services:
   playout:
     image: git.allucanget.biz/zwitschi/linearvoid/playout:latest
@@ -9,6 +15,7 @@ services:
       - ./data/playlist:/app/playlist:rw
       - ./data/media:/app/media:ro
       - ./data/hls:/app/hls:rw
+      - ./data/slate:/app/slate:ro
     networks:
       - linearvoid-net
     depends_on:
@@ -68,7 +75,7 @@ services:
     image: redis:7-alpine
     container_name: linearvoid-redis
     restart: unless-stopped
-    command: redis-server --appendonly yes
+    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
     volumes:
       - redis-data:/data
     networks:
@@ -97,6 +104,56 @@ services:
       timeout: 5s
       retries: 5
 
+  nginx-exporter:
+    image: nginx/nginx-prometheus-exporter:latest
+    container_name: linearvoid-nginx-exporter
+    restart: unless-stopped
+    command:
+      - "-nginx.scrape-uri=http://nginx/nginx-status"
+    networks:
+      - linearvoid-net
+    depends_on:
+      - nginx
+
+  redis-exporter:
+    image: oliver006/redis_exporter:latest
+    container_name: linearvoid-redis-exporter
+    restart: unless-stopped
+    command:
+      - "-redis.addr=redis://redis:6379"
+    networks:
+      - linearvoid-net
+    depends_on:
+      - redis
+
+  postgres-exporter:
+    image: prometheuscommunity/postgres-exporter:latest
+    container_name: linearvoid-postgres-exporter
+    restart: unless-stopped
+    environment:
+      DATA_SOURCE_NAME: "postgresql://linearvoid:${POSTGRES_PASSWORD:-linearvoid}@db:5432/linearvoid?sslmode=disable"
+    networks:
+      - linearvoid-net
+    depends_on:
+      - db
+
+  node-exporter:
+    image: prom/node-exporter:latest
+    container_name: linearvoid-node-exporter
+    restart: unless-stopped
+    pid: host
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - "--path.procfs=/host/proc"
+      - "--path.sysfs=/host/sys"
+      - "--path.rootfs=/rootfs"
+      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
+    networks:
+      - linearvoid-net
+
   prometheus:
     image: prom/prometheus:latest
     container_name: linearvoid-prometheus

docker-compose.yml

@@ -1,3 +1,8 @@
+# docker-compose.yml — LOCAL DEVELOPMENT
+# Target: local workstation or test lab (192.168.88.0/24).
+# NOT for production. Use docker-compose.prod.yml for deployment.
+# Services build from source; ports exposed for direct dev access.
+
 services:
   playout:
     image: ${CI_REGISTRY_URL:-git.allucanget.biz}/${CI_REGISTRY_NAMESPACE:-zwitschi/linearvoid}/playout:latest
@@ -12,6 +17,7 @@ services:
       - ./data/playlist:/app/playlist:ro
       - ./data/media:/app/media:ro
       - ./data/hls:/app/hls:rw
+      - ./data/slate:/app/slate:ro
     networks:
       - linearvoid-net
     depends_on:
@@ -72,7 +78,7 @@ services:
     image: redis:7-alpine
     container_name: linearvoid-redis
     restart: unless-stopped
-    command: redis-server --appendonly yes
+    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
     volumes:
       - redis-data:/data
     networks:
@@ -91,6 +97,56 @@ services:
     networks:
       - linearvoid-net
 
+  nginx-exporter:
+    image: nginx/nginx-prometheus-exporter:latest
+    container_name: linearvoid-nginx-exporter
+    restart: unless-stopped
+    command:
+      - "-nginx.scrape-uri=http://nginx/nginx-status"
+    networks:
+      - linearvoid-net
+    depends_on:
+      - nginx
+
+  redis-exporter:
+    image: oliver006/redis_exporter:latest
+    container_name: linearvoid-redis-exporter
+    restart: unless-stopped
+    command:
+      - "-redis.addr=redis://redis:6379"
+    networks:
+      - linearvoid-net
+    depends_on:
+      - redis
+
+  postgres-exporter:
+    image: prometheuscommunity/postgres-exporter:latest
+    container_name: linearvoid-postgres-exporter
+    restart: unless-stopped
+    environment:
+      DATA_SOURCE_NAME: "postgresql://linearvoid:${POSTGRES_PASSWORD:-linearvoid}@db:5432/linearvoid?sslmode=disable"
+    networks:
+      - linearvoid-net
+    depends_on:
+      - db
+
+  node-exporter:
+    image: prom/node-exporter:latest
+    container_name: linearvoid-node-exporter
+    restart: unless-stopped
+    pid: host
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - "--path.procfs=/host/proc"
+      - "--path.sysfs=/host/sys"
+      - "--path.rootfs=/rootfs"
+      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
+    networks:
+      - linearvoid-net
+
   prometheus:
     image: prom/prometheus:latest
     container_name: linearvoid-prometheus

docs/architecture/README.md

@@ -259,11 +259,114 @@ Detailed black-box descriptions, level-2/3 views, and code locations are in `adr
 
 ### Level 2
 
-Deferred to implementation (see ADR for component responsibilities, interfaces, quality attributes, and risks). Playout enforces normalization; Delivery layer focuses on cache rules and immutable naming.
+Detailed component diagram with code locations and persistence.
+
+```mermaid
+graph TB
+    subgraph "Cloudflare Edge"
+        CF[CDN + WAF<br/>Cache Rules]
+        R2[R2 Bucket<br/>media + HLS]
+        PAGES[Pages<br/>SPA hosting]
+    end
+
+    subgraph "Docker Host (Hetzner CX22)"
+        NGINX[nginx<br/>:80/:443<br/>proxy + auth]
+        CHAT[chat service<br/>:3000<br/>Go + gorilla/websocket]
+        PLAYOUT[playout service<br/>:8081<br/>Go + FFmpeg]
+        REDIS[Redis 7<br/>:6379<br/>presence/rate/pubsub]
+        DB[PostgreSQL 15<br/>:5432<br/>chat history/moderation]
+    end
+
+    subgraph "External"
+        VIEWER[Viewer Browser<br/>hls.js + WebSocket]
+        ADMIN[Admin Browser<br/>SPA + uploads]
+    end
+
+    VIEWER -->|HTTPS| CF
+    VIEWER -->|WSS| NGINX
+    ADMIN -->|HTTPS| CF
+    CF --> NGINX
+    NGINX --> CHAT
+    NGINX --> PLAYOUT
+    NGINX -->|/hls/*| R2
+    CHAT --> REDIS
+    CHAT --> DB
+    PLAYOUT --> R2
+    PLAYOUT -->|reads| R2
+```
+
+#### Playout Service (`backend/playout/src/playlist.go`)
+
+- **Role**: Continuous HLS encoding loop using FFmpeg concat demuxer
+- **Input**: `data/playlist/playlist.txt` — ordered list of MP4 file paths
+- **Output**: HLS segments (`.ts`) + live manifest (`.m3u8`) written to `data/hls/`, mirrored to R2
+- **Resilience**: Restart counter (>5/60s → activate slate), Prometheus metrics on port 8081
+- **Validation**: ffprobe gate on all ingested files (codec, fps, resolution, keyframe interval)
+
+#### Chat Service (`backend/chat/src/main.go`)
+
+- **Role**: WebSocket chat with rooms, DMs, moderation, admin API
+- **Persistence**: PostgreSQL 15 via GORM (messages, moderation logs, media metadata). SQLite for dev fallback
+- **Redis**: Presence tracking, rate limiting, pub/sub for multi-instance fan-out
+- **Auth**: Session-cookie admin auth with Redis-backed expiry
+- **Metrics**: Connected clients, stored messages, DMs, moderation actions on `/metrics`
+
+#### Frontend SPA (`frontend/`)
+
+- **Viewer**: `src/main.ts` — hls.js player, WebSocket chat, presence indicators, schedule overlay
+- **Admin**: `src/admin.ts` — 9 dynamic tabs (dashboard, upload, playlist, schedule, moderation, chat-log, users, analytics, system)
+- **Build**: Vite → static output in `frontend/dist/`
+
+#### Reverse Proxy (`infrastructure/nginx/nginx.conf`)
+
+- auth_request gate on `/admin` and `/api/admin`
+- WebSocket upgrade for `/ws`
+- HLS CORS headers + OPTIONS preflight
+- `/health` JSON endpoint, `/nginx-status` stub_status
 
 ### Level 3
 
-Deferred to implementation (see ADR for component responsibilities, interfaces, quality attributes, and risks). Playout enforces normalization; Delivery layer focuses on cache rules and immutable naming.
+Module-level breakdown per service.
+
+#### Chat Service Modules
+
+| Module                 | File/Lines                                                     | Responsibility                                                                           |
+| ---------------------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| **Connection Manager** | `main.go` (hub, clients map)                                   | Track active WebSocket connections per room, fan-out messages                            |
+| **Message Parser**     | `main.go` (readPump, handleMessage)                            | Parse JSON envelope `{type, room?, ...}`, validate fields, route to handler              |
+| **Room Registry**      | `main.go` (rooms map, room broadcasts)                         | Map room name → client set, handle join/leave/close                                      |
+| **DM Router**          | `main.go` (handleDirectMessage)                                | Resolve target user in clients map, deliver private message                              |
+| **Persistence Layer**  | `main.go` (GORM models: Message, DirectMessage, ModerationLog) | Store/retrieve chat messages, DMs, moderation events                                     |
+| **Redis Subsystem**    | `main.go` (redisClient, rate limiting, pub/sub, presence)      | INCR+EXPIRE rate limit, SETEX presence, PSUBSCRIBE room fan-out                          |
+| **Auth Handler**       | `main.go` (handleAdminLogin, adminAuthMiddleware)              | Session cookie creation/validation, login rate limiting                                  |
+| **Admin API Router**   | `main.go` (handleAdmin\*)                                      | Upload, playlist CRUD, schedule overrides, moderation actions, analytics, system summary |
+| **Metrics Exporter**   | `main.go` (prometheus.MustRegister)                            | Expose connected_clients, messages_total, dms_total, moderation_actions, redis_up        |
+
+#### Playout Service Modules
+
+| Module               | File/Lines                                     | Responsibility                                                     |
+| -------------------- | ---------------------------------------------- | ------------------------------------------------------------------ |
+| **Playlist Parser**  | `playlist.go` (parsePlaylist)                  | Read `playlist.txt`, skip comments/blank lines, resolve file paths |
+| **FFmpeg Manager**   | `playlist.go` (runPlayout, restart logic)      | Spawn/monitor FFmpeg concat process, restart on crash              |
+| **Slate Controller** | `playlist.go` (activateSlate, deactivateSlate) | Switch output to slate loop on excessive failures                  |
+| **R2 Sync**          | `playlist.go` (syncToR2)                       | Upload HLS segments + manifest to R2 bucket                        |
+| **Health Endpoint**  | `playlist.go` (healthHandler)                  | `/health` → JSON with mode, segment count, uptime                  |
+| **Metrics Exporter** | `playlist.go` (prometheus)                     | Expose restarts_total, mode (live/slate)                           |
+
+#### Frontend Modules
+
+| Module                  | File                                            | Responsibility                                                    |
+| ----------------------- | ----------------------------------------------- | ----------------------------------------------------------------- |
+| **HLS Player**          | `src/main.ts`                                   | hls.js initialization, attach to video element, error recovery    |
+| **WebSocket Client**    | `src/main.ts`                                   | Connect/disconnect, parse envelope, dispatch to UI handlers       |
+| **Chat UI**             | `src/main.ts`                                   | Message list rendering, room tabs, DM panel, presence dots        |
+| **Schedule Overlay**    | `src/main.ts`                                   | Poll `/api/schedule`, render current/next program                 |
+| **Admin Router**        | `src/admin.ts`                                  | Tab-based navigation, dynamic page loading                        |
+| **Upload Manager**      | `src/admin.ts`                                  | Multipart upload with chunk progress, ffprobe validation feedback |
+| **Playlist Editor**     | `src/admin.ts`                                  | Drag-reorder, add/remove items, save to `/api/admin/playlist`     |
+| **Moderation Panel**    | `src/admin.ts` + `public/admin/moderation.html` | Inline mute/ban, action log viewer                                |
+| **Analytics Dashboard** | `src/admin.ts` + `public/admin/analytics.html`  | Message counts, top rooms, moderation stats                       |
+| **System Config**       | `src/admin.ts` + `public/admin/system.html`     | Service health, config metadata, restart buttons                  |
 
 ## Runtime View
 
@@ -284,7 +387,7 @@ Notable aspects: Manifest freshness ensures all viewers stay on same timeline; c
 
 ### CI/CD Pipeline Architecture
 
-The deployment follows a two-stage pipeline: **CI builds and pushes images**, then **CD pulls and deploys** them to the production host.
+The deployment follows a two-stage pipeline: **CI builds and pushes images**, then **CD pulls and deploys** them. Currently targeting the **test lab** (192.168.88.40). Production Hetzner VPS is planned but not yet provisioned — the same pipeline will deploy there by changing `DOCKER_HOST`.
 
 ```mermaid
 flowchart LR
@@ -295,7 +398,7 @@ flowchart LR
     subgraph "Gitea Container Registry"
         REGISTRY[git.allucanget.biz<br/>playout:latest<br/>chat:latest<br/>nginx:latest]
     end
-    subgraph "Production Host (192.168.88.40)"
+    subgraph "Test Lab Host (192.168.88.40) — Production Hetzner TBD"
         DOCKER[Docker Engine<br/>via TCP :2375]
         PLAYOUT[linearvoid-playout]
         CHAT[linearvoid-chat]
@@ -331,7 +434,7 @@ flowchart LR
    - Pulls latest images from registry
    - Generates `.env` from secrets
    - Seeds Prometheus config into named volume
-   - Deploys via `docker compose -f docker-compose.prod.yml up -d` to remote host (`192.168.88.40:2375`)
+   - Deploys via `docker compose -f docker-compose.prod.yml up -d` to remote host (`192.168.88.40:2375` — test lab; switch to Hetzner IP for production)
    - Runs health checks with retry logic for playout initialization
 
 ### Infrastructure Level 1
@@ -350,7 +453,7 @@ flowchart LR
 
 ### Infrastructure Level 2
 
-**Hetzner VPS**: Runs playout (FFmpeg/MediaMTX), chat backend, Nginx. Monitoring via dashboards + UptimeRobot. Backups to R2.
+**Hetzner VPS (planned):** Will run playout (FFmpeg/MediaMTX), chat backend, Nginx. Monitoring via dashboards + UptimeRobot. Backups to R2. Currently test lab (`192.168.88.40`) serves this role. Production Hetzner instance not yet provisioned — see `TODO.md` Production Deployment section.
 
 **Cloudflare Layer**:
 

docs/incident-runbook.md

@@ -0,0 +1,170 @@
+# Incident Runbook
+
+Triage order for Linear Void incidents. Work top-to-bottom — each tier depends on the one above.
+
+## Triage Order
+
+```
+1. Edge Reachability (Cloudflare)
+2. Origin Health (VPS/Docker)
+3. Playout Progression (HLS)
+4. Chat Connectivity (WebSocket)
+5. Data-Plane (Redis/DB)
+```
+
+---
+
+## 1. Edge Reachability (Cloudflare)
+
+**Symptoms:** `linearvoid.tv` not resolving, SSL errors, 5xx from Cloudflare.
+
+```bash
+# Check DNS
+dig linearvoid.tv
+dig www.linearvoid.tv
+
+# Check Cloudflare status
+curl -I https://linearvoid.tv/health
+```
+
+**Common causes:**
+- DNS misconfiguration (A record pointing to wrong IP)
+- Cloudflare proxy disabled (grey cloud → origin exposed directly)
+- SSL certificate expired (check Cloudflare dashboard → SSL/TLS)
+- Cloudflare outage → https://www.cloudflarestatus.com
+
+**Mitigation:**
+- Verify A record: `linearvoid.tv` → origin IP (proxied, orange cloud)
+- Bypass Cloudflare temporarily: `curl -H "Host: linearvoid.tv" http://<origin-ip>/health`
+
+---
+
+## 2. Origin Health (VPS/Docker)
+
+**Symptoms:** Cloudflare returns 502/504, containers down.
+
+```bash
+# Remote Docker (test lab)
+docker -H tcp://192.168.88.40:2375 ps
+docker -H tcp://192.168.88.40:2375 logs linearvoid-nginx --tail 50
+
+# Direct health check
+curl http://192.168.88.40/health
+```
+
+**Common causes:**
+- Host out of disk space: `df -h`
+- Docker daemon stopped: `systemctl status docker`
+- Container restart loop: `docker ps -a --filter "status=exited"`
+- Resource exhaustion (OOM): `dmesg | grep -i oom`
+
+**Mitigation:**
+- Restart stack: `docker compose -f docker-compose.prod.yml up -d`
+- Free disk: `docker system prune -f`
+- Check logs per service: `docker logs linearvoid-<service> --tail 100`
+
+---
+
+## 3. Playout Progression (HLS)
+
+**Symptoms:** Viewer sees slate or buffering, playlist not advancing.
+
+```bash
+# Check playout health
+curl http://192.168.88.40:8081/health
+# Response includes "mode": "live" or "slate"
+
+# Check HLS output
+curl -I http://192.168.88.40/hls/playlist.m3u8
+ls -la data/hls/
+
+# Check playout logs
+docker logs linearvoid-playout --tail 100
+```
+
+**Common causes:**
+- FFmpeg crash → slate fallback active (health shows `degraded`)
+- Playlist file empty/missing: `cat data/playlist/playlist.txt`
+- Media file missing from playlist: `ls data/media/`
+- Disk full → HLS segments can't write
+
+**Mitigation:**
+- Verify playlist has valid entries
+- Check media files exist at paths in playlist
+- Restart playout: `docker compose restart playout`
+- Generate demo playlist if empty: see `backend/playout/start-playout.sh`
+
+---
+
+## 4. Chat Connectivity (WebSocket)
+
+**Symptoms:** Chat not loading, messages not sending, presence broken.
+
+```bash
+# Check chat health
+curl http://192.168.88.40:3000/health
+
+# Test WebSocket
+wscat -c ws://192.168.88.40/ws?username=test&room=main
+
+# Check chat logs
+docker logs linearvoid-chat --tail 100
+```
+
+**Common causes:**
+- Redis down → presence/rate-limiting degraded (chat still works)
+- Database down → messages not persisting
+- Port not exposed: `docker port linearvoid-chat`
+
+**Mitigation:**
+- Restart chat: `docker compose restart chat`
+- Check Redis: `docker exec linearvoid-redis redis-cli ping`
+- Check DB: `docker exec linearvoid-db pg_isready -U linearvoid`
+- Chat works without Redis (graceful degradation) — check logs for "Redis connection warning"
+
+---
+
+## 5. Data-Plane (Redis/DB)
+
+**Symptoms:** Chat works but no persistence/presence, admin stats empty.
+
+```bash
+# Redis
+docker exec linearvoid-redis redis-cli ping
+docker exec linearvoid-redis redis-cli info memory
+
+# PostgreSQL
+docker exec linearvoid-db pg_isready -U linearvoid
+docker exec linearvoid-db psql -U linearvoid -c "SELECT count(*) FROM messages;"
+```
+
+**Common causes:**
+- Redis OOM (check `maxmemory` setting)
+- PostgreSQL connection limit reached
+- Disk full on volume mount
+
+**Mitigation:**
+- Redis: `docker compose restart redis` (AOF persist enabled)
+- PostgreSQL: `docker compose restart db`
+- Restore from backup: see `scripts/verify-backups.sh` for procedure
+
+---
+
+## Escalation
+
+| Severity | When | Action |
+|---|---|---|
+| Critical | Slate active >30min, complete outage | Trigger DR plan, provision fallback host |
+| Warning | Redis down, high CPU >30min | Investigate during business hours, restart service |
+| Info | Single service blip | Monitor, no action unless recurring |
+
+## Post-Incident
+
+1. Document timeline in incident channel
+2. Identify root cause
+3. Add prevention to TODO.md if actionable
+4. Update this runbook if new failure mode discovered
+
+---
+
+**Recovery targets:** RPO ≤24h, RTO ≤60min. Quarterly DR drill: simulate host loss, restore from backup.

frontend/index.html

@@ -24,6 +24,10 @@
     <section class="viewer-content" aria-label="Live stream and chat layout">
       <section class="player-stage" aria-label="Video stage">
         <video id="player" class="player" controls autoplay muted playsinline></video>
+        <div id="now-playing" class="now-playing-overlay" aria-live="polite">
+          <span id="np-title">Loading...</span>
+          <span id="np-next" class="np-next"></span>
+        </div>
       </section>
 
       <aside id="chat-panel" class="chat-sidebar" aria-label="Chat panel">
@@ -37,6 +41,10 @@
 
         <section id="messages" class="chat-messages" aria-live="polite" aria-label="Message stream"></section>
 
+        <section id="presence-panel" class="presence-panel" aria-label="Online users">
+          <div id="presence-list" class="presence-list"></div>
+        </section>
+
         <div class="chat-input-area">
           <div class="chat-input-row">
             <label for="message-input" class="sr-only">Message input</label>

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frontend",
   "private": true,
-  "version": "1.0.6",
+  "version": "1.0.7",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/public/admin/analytics.html

@@ -3,7 +3,15 @@
         <h1>Analytics</h1>
         <p>Basic activity counters from chat history and moderation audit logs.</p>
     </div>
+    <div class="button-row">
+        <select id="analytics-range" class="text-input" style="width:auto">
+            <option value="1h">Last hour</option>
+            <option value="6h">Last 6 hours</option>
+            <option value="24h" selected>Last 24 hours</option>
+            <option value="7d">Last 7 days</option>
+        </select>
         <button id="reload-analytics-btn" type="button" class="btn btn-secondary">Reload analytics</button>
+    </div>
 </div>
 
 <div class="stat-grid">

frontend/public/admin/moderation.html

@@ -3,7 +3,10 @@
         <h1>Moderation</h1>
         <p>Create moderation actions and review the recent immutable audit log.</p>
     </div>
+    <div class="button-row">
         <button id="reload-moderation-btn" type="button" class="btn btn-secondary">Reload logs</button>
+        <button id="export-chat-log-btn" type="button" class="btn btn-secondary">Export CSV</button>
+    </div>
 </div>
 
 <div class="moderation-grid">

frontend/public/admin/playlist.html

@@ -1,7 +1,7 @@
 <div class="panel-header-row">
     <div>
         <h1>Playlist</h1>
-        <p>Edit the active concat playlist used by the playout service.</p>
+        <p>Edit the active concat playlist. Drag entries to reorder.</p>
     </div>
     <div class="button-row">
         <button id="reload-playlist-btn" type="button" class="btn btn-secondary">Reload</button>
@@ -10,7 +10,9 @@
 </div>
 
 <div class="panel-card">
-    <label for="playlist-content" class="sr-only">Playlist content</label>
+    <div id="playlist-warnings" class="status-warnings" hidden></div>
-    <textarea id="playlist-content" class="text-input text-area" spellcheck="false"></textarea>
+    <ul id="playlist-sortable" class="sortable-list" aria-label="Playlist entries"></ul>
+    <label for="playlist-content" class="sr-only">Playlist content (raw)</label>
+    <textarea id="playlist-content" class="text-input text-area" spellcheck="false" rows="6"></textarea>
     <p id="playlist-status" class="status-line" aria-live="polite">Loading playlist...</p>
 </div>

frontend/public/admin/schedule.html

@@ -24,3 +24,30 @@
     </div>
     <p id="schedule-status" class="status-line" aria-live="polite">Loading schedule...</p>
 </div>
+
+<div class="panel-card">
+    <h2>Schedule Overrides</h2>
+    <p>Insert scheduled overrides to play specific videos at specific times.</p>
+    <form id="override-form" class="form-stack" style="max-width:500px">
+        <label>Media ID <input id="override-media-id" type="number" class="text-input" required /></label>
+        <label>Start Time <input id="override-start" type="datetime-local" class="text-input" required /></label>
+        <label>End Time <input id="override-end" type="datetime-local" class="text-input" required /></label>
+        <label>Reason <input id="override-reason" type="text" class="text-input" placeholder="e.g. special event" /></label>
+        <button type="submit" class="btn btn-primary">Add Override</button>
+    </form>
+    <p id="override-status" class="status-line" aria-live="polite"></p>
+    <div class="table-wrap" style="margin-top:1rem">
+        <table class="data-table">
+            <thead>
+                <tr>
+                    <th>Media ID</th>
+                    <th>Start</th>
+                    <th>End</th>
+                    <th>Reason</th>
+                    <th></th>
+                </tr>
+            </thead>
+            <tbody id="override-table-body"></tbody>
+        </table>
+    </div>
+</div>

frontend/public/admin/system.html

@@ -52,3 +52,24 @@
     <div id="system-services" class="service-list"></div>
     <p id="system-status" class="status-line" aria-live="polite">Loading system summary...</p>
 </div>
+
+<div class="panel-card">
+    <h2>Runtime Configuration</h2>
+    <form id="config-form" class="form-stack" style="max-width:400px">
+        <label>Rate Limit Max <input id="config-rate-max" type="number" class="text-input" /></label>
+        <label>Rate Limit Window (seconds) <input id="config-rate-window" type="number" class="text-input" /></label>
+        <button type="submit" class="btn btn-primary">Save Config</button>
+    </form>
+    <p id="config-status" class="status-line" aria-live="polite"></p>
+</div>
+
+<div class="panel-card">
+    <h2>Service Control</h2>
+    <p class="small-muted">Restart individual services (manual — container restart commands returned by API).</p>
+    <div class="button-row">
+        <button class="btn btn-secondary restart-btn" data-service="playout">Restart Playout</button>
+        <button class="btn btn-secondary restart-btn" data-service="chat">Restart Chat</button>
+        <button class="btn btn-secondary restart-btn" data-service="nginx">Restart Nginx</button>
+    </div>
+    <p id="restart-status" class="status-line" aria-live="polite"></p>
+</div>

frontend/public/admin/users.html

@@ -14,6 +14,7 @@
                     <th>Username</th>
                     <th>Room</th>
                     <th>Online</th>
+                    <th>Actions</th>
                 </tr>
             </thead>
             <tbody id="users-table-body"></tbody>

frontend/src/admin.ts

@@ -259,10 +259,13 @@ async function refreshPlaylist() {
     if (!response.ok) throw new Error(`HTTP ${response.status}`);
 
     const payload = await response.json();
+    const content: string = payload.content || "";
     const textarea = document.getElementById(
       "playlist-content",
     ) as HTMLTextAreaElement | null;
-    if (textarea) textarea.value = payload.content || "";
+    if (textarea) textarea.value = content;
+    renderPlaylistSortable(content);
+    await showPlaylistWarnings(content);
     setStatus("playlist-status", "Playlist loaded.");
   } catch (error) {
     console.error("Failed to load playlist", error);
@@ -270,6 +273,95 @@ async function refreshPlaylist() {
   }
 }
 
+function renderPlaylistSortable(content: string) {
+  const list = document.getElementById("playlist-sortable");
+  if (!list) return;
+  const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
+  list.innerHTML = lines
+    .map((line, i) => {
+      const path = line.replace(/^file\s+/, "").replace(/['"]/g, "").trim();
+      return `<li class="sortable-item" draggable="true" data-index="${i}">
+        <span class="drag-handle" aria-hidden="true">⋮⋮</span>
+        <span class="sortable-index">${i + 1}</span>
+        <span class="sortable-path">${path}</span>
+        <button type="button" class="btn btn-secondary btn-sm" data-remove="${i}">✕</button>
+      </li>`;
+    })
+    .join("");
+
+  let dragSrc: number | null = null;
+  list.querySelectorAll<HTMLElement>(".sortable-item").forEach((item) => {
+    item.addEventListener("dragstart", () => {
+      dragSrc = Number(item.dataset.index);
+      item.classList.add("dragging");
+    });
+    item.addEventListener("dragend", () => {
+      item.classList.remove("dragging");
+      dragSrc = null;
+    });
+    item.addEventListener("dragover", (e) => e.preventDefault());
+    item.addEventListener("drop", (e) => {
+      e.preventDefault();
+      const dst = Number(item.dataset.index);
+      if (dragSrc !== null && dragSrc !== dst) reorderPlaylistEntry(dragSrc, dst);
+    });
+    item.querySelector("[data-remove]")?.addEventListener("click", () => {
+      removePlaylistEntry(Number(item.dataset.index));
+    });
+  });
+}
+
+function getPlaylistLines(): string[] {
+  const ta = document.getElementById("playlist-content") as HTMLTextAreaElement;
+  return ta?.value.split("\n").filter((l) => l.trim() && !l.startsWith("#")) || [];
+}
+
+function syncPlaylistTextarea(lines: string[]) {
+  const ta = document.getElementById("playlist-content") as HTMLTextAreaElement;
+  if (ta) ta.value = lines.join("\n") + "\n";
+  renderPlaylistSortable(lines.join("\n"));
+}
+
+function reorderPlaylistEntry(from: number, to: number) {
+  const lines = getPlaylistLines();
+  const [moved] = lines.splice(from, 1);
+  lines.splice(to, 0, moved);
+  syncPlaylistTextarea(lines);
+}
+
+function removePlaylistEntry(index: number) {
+  const lines = getPlaylistLines();
+  lines.splice(index, 1);
+  syncPlaylistTextarea(lines);
+}
+
+async function showPlaylistWarnings(content: string) {
+  const warnings = document.getElementById("playlist-warnings");
+  if (!warnings) return;
+  const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
+  const msgs: string[] = [];
+  if (lines.length === 0) msgs.push("Playlist is empty. Add files from the media library.");
+  try {
+    const resp = await fetch("/api/admin/media");
+    if (resp.ok) {
+      const media = await resp.json();
+      const mediaPaths = new Set((media.files || []).map((f: { path: string }) => f.path));
+      const nonNorm = (media.files || []).filter((f: { status: string }) => f.status === "needs_normalization");
+      for (const line of lines) {
+        const path = line.replace(/^file\s+/, "").replace(/['"]/g, "").trim();
+        if (path && !mediaPaths.has(path)) msgs.push(`Missing from media library: ${path}`);
+      }
+      if (nonNorm.length > 0) msgs.push(`${nonNorm.length} file(s) need normalization. Run scripts/normalize.sh.`);
+    }
+  } catch { /* ignore */ }
+  if (msgs.length > 0) {
+    warnings.innerHTML = msgs.map((m) => `<div class="warning-msg">⚠ ${m}</div>`).join("");
+    warnings.hidden = false;
+  } else {
+    warnings.hidden = true;
+  }
+}
+
 async function savePlaylist() {
   if (state.playlistSaving) return;
   state.playlistSaving = true;
@@ -333,6 +425,55 @@ async function refreshSchedule() {
   }
 }
 
+async function refreshOverrides() {
+  try {
+    const resp = await fetch("/api/admin/schedule/overrides");
+    if (!resp.ok) return;
+    const overrides = await resp.json();
+    const tbody = document.getElementById("override-table-body");
+    if (!tbody) return;
+    if (!overrides.length) {
+      tbody.innerHTML = `<tr><td colspan="5">No overrides.</td></tr>`;
+      return;
+    }
+    tbody.innerHTML = overrides
+      .map(
+        (o: { id: number; mediaId: number; startTime: string; endTime: string; reason: string }) =>
+          `<tr><td>${o.mediaId}</td><td>${new Date(o.startTime).toLocaleString()}</td><td>${new Date(o.endTime).toLocaleString()}</td><td>${o.reason || "-"}</td><td><button class="btn btn-secondary btn-sm" data-delete-override="${o.id}">✕</button></td></tr>`,
+      )
+      .join("");
+    tbody.querySelectorAll("[data-delete-override]").forEach((btn) => {
+      btn.addEventListener("click", () => deleteOverride(Number((btn as HTMLElement).dataset.deleteOverride)));
+    });
+  } catch { /* non-critical */ }
+}
+
+async function submitOverride(e: Event) {
+  e.preventDefault();
+  const status = document.getElementById("override-status");
+  if (status) status.textContent = "Saving...";
+  const mediaId = (document.getElementById("override-media-id") as HTMLInputElement).value;
+  const startTime = (document.getElementById("override-start") as HTMLInputElement).value;
+  const endTime = (document.getElementById("override-end") as HTMLInputElement).value;
+  const reason = (document.getElementById("override-reason") as HTMLInputElement).value;
+  try {
+    const resp = await fetch("/api/admin/schedule/overrides", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ mediaId: Number(mediaId), startTime: new Date(startTime).toISOString(), endTime: new Date(endTime).toISOString(), reason }),
+    });
+    if (!resp.ok) { const text = await resp.text(); throw new Error(text); }
+    if (status) { status.textContent = "Override added."; status.className = "status-line"; }
+    refreshOverrides();
+  } catch (err) {
+    if (status) { status.textContent = `Failed: ${err}`; status.className = "status-line status-error"; }
+  }
+}
+
+async function deleteOverride(id: number) {
+  try { await fetch(`/api/admin/schedule/overrides?id=${id}`, { method: "DELETE" }); refreshOverrides(); } catch { /* ignore */ }
+}
+
 async function refreshSystemSummary() {
   setStatus("system-status", "Loading system summary...");
   try {
@@ -756,9 +897,17 @@ function renderChatLogTable() {
       <td>${entry.type}</td>
       <td>${entry.timestamp}</td>
       <td class="action-cell">
-        <button type="button" class="btn btn-danger btn-small" data-action="delete-chat" data-id="${entry.id}">Delete</button>
+        <button type="button" class="btn btn-secondary btn-sm" data-action="chat-mute" data-user="${entry.username}">Mute</button>
+        <button type="button" class="btn btn-secondary btn-sm" data-action="chat-ban" data-user="${entry.username}">Ban</button>
+        <button type="button" class="btn btn-danger btn-sm" data-action="delete-chat" data-id="${entry.id}">Del</button>
       </td>
     `;
+    tr.querySelector('[data-action="chat-mute"]')?.addEventListener("click", () => {
+      userAction("mute", entry.username);
+    });
+    tr.querySelector('[data-action="chat-ban"]')?.addEventListener("click", () => {
+      if (confirm(`Ban ${entry.username}?`)) userAction("ban", entry.username);
+    });
     tr.querySelector('[data-action="delete-chat"]')?.addEventListener(
       "click",
       () => deleteChatEntry(entry.id),
@@ -930,9 +1079,19 @@ async function refreshUsers() {
     } else {
       users.forEach((user: any) => {
         const tr = document.createElement("tr");
-        tr.innerHTML = `<td>${user.username}</td><td>${user.room}</td><td>${user.online ? "yes" : "no"}</td>`;
+        tr.innerHTML = `<td>${user.username}</td><td>${user.room}</td><td>${user.online ? "yes" : "no"}</td>
+          <td>
+            <button class="btn btn-secondary btn-sm user-mute" data-user="${user.username}">Mute 10m</button>
+            <button class="btn btn-secondary btn-sm user-ban" data-user="${user.username}">Ban</button>
+            <button class="btn btn-secondary btn-sm user-unmute" data-user="${user.username}">Unmute</button>
+            <button class="btn btn-secondary btn-sm user-unban" data-user="${user.username}">Unban</button>
+          </td>`;
         tbody.appendChild(tr);
       });
+      tbody.querySelectorAll(".user-mute").forEach(b => b.addEventListener("click", () => userAction("mute", (b as HTMLElement).dataset.user!)));
+      tbody.querySelectorAll(".user-ban").forEach(b => b.addEventListener("click", () => userAction("ban", (b as HTMLElement).dataset.user!)));
+      tbody.querySelectorAll(".user-unmute").forEach(b => b.addEventListener("click", () => userAction("unmute", (b as HTMLElement).dataset.user!)));
+      tbody.querySelectorAll(".user-unban").forEach(b => b.addEventListener("click", () => userAction("unban", (b as HTMLElement).dataset.user!)));
     }
 
     setStatus(
@@ -947,6 +1106,63 @@ async function refreshUsers() {
   }
 }
 
+async function userAction(action: string, username: string) {
+  try {
+    const resp = await fetch("/api/admin/users", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ action, username, duration: 10 }),
+    });
+    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
+    setStatus("users-status", `${action} ${username} OK.`);
+  } catch (err) {
+    setStatus("users-status", `Failed: ${err}`, true);
+  }
+}
+
+async function loadConfig() {
+  try {
+    const resp = await fetch("/api/admin/config");
+    if (!resp.ok) return;
+    const cfg = await resp.json();
+    (document.getElementById("config-rate-max") as HTMLInputElement).value = cfg.rateLimitMax;
+    (document.getElementById("config-rate-window") as HTMLInputElement).value = cfg.rateLimitWindowSec;
+  } catch { /* non-critical */ }
+}
+
+async function saveConfig(e: Event) {
+  e.preventDefault();
+  const status = document.getElementById("config-status");
+  if (status) status.textContent = "Saving...";
+  try {
+    const resp = await fetch("/api/admin/config", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        rateLimitMax: Number((document.getElementById("config-rate-max") as HTMLInputElement).value),
+        rateLimitWindowSec: Number((document.getElementById("config-rate-window") as HTMLInputElement).value),
+      }),
+    });
+    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
+    if (status) { status.textContent = "Config saved."; status.className = "status-line"; }
+  } catch (err) {
+    if (status) { status.textContent = `Failed: ${err}`; status.className = "status-line status-error"; }
+  }
+}
+
+async function restartService(service: string) {
+  if (!confirm(`Restart ${service}? This may cause brief interruption.`)) return;
+  const status = document.getElementById("restart-status");
+  if (status) status.textContent = `Requesting restart of ${service}...`;
+  try {
+    const resp = await fetch(`/api/admin/restart?service=${service}`, { method: "POST" });
+    const data = await resp.json();
+    if (status) status.textContent = data.message;
+  } catch (err) {
+    if (status) status.textContent = `Failed: ${err}`;
+  }
+}
+
 function bindEvents() {
   document
     .querySelectorAll<HTMLButtonElement>(".tab-trigger")
@@ -1017,12 +1233,21 @@ function bindPageEvents(tabName: string) {
       document
         .getElementById("reload-schedule-btn")
         ?.addEventListener("click", refreshSchedule);
+      document
+        .getElementById("override-form")
+        ?.addEventListener("submit", submitOverride);
+      refreshOverrides();
       break;
 
     case "moderation":
       document
         .getElementById("reload-moderation-btn")
         ?.addEventListener("click", refreshModerationLogs);
+      document
+        .getElementById("export-chat-log-btn")
+        ?.addEventListener("click", () => {
+          window.open("/api/admin/chat-log/export", "_blank");
+        });
       document
         .getElementById("moderation-form")
         ?.addEventListener("submit", submitModerationAction);
@@ -1083,6 +1308,13 @@ function bindPageEvents(tabName: string) {
       document
         .getElementById("reload-system-btn")
         ?.addEventListener("click", refreshSystemSummary);
+      document
+        .getElementById("config-form")
+        ?.addEventListener("submit", saveConfig);
+      document.querySelectorAll(".restart-btn").forEach((btn) =>
+        btn.addEventListener("click", () => restartService((btn as HTMLElement).dataset.service!))
+      );
+      loadConfig();
       break;
   }
 }

frontend/src/main.ts

@@ -16,6 +16,7 @@ let ws: WebSocket | null = null;
 let currentRoom = "main";
 let username = "viewer" + Math.floor(Math.random() * 1000);
 let chatVisible = true;
+const onlineUsers = new Set<string>();
 
 function resolveWebSocketBaseUrl() {
   const configuredUrl = import.meta.env.VITE_PUBLIC_WS_URL?.trim();
@@ -74,6 +75,19 @@ function connectWebSocket(room: string) {
   ws.onmessage = (event) => {
     const msg = JSON.parse(event.data);
     addMessage(msg.type || "public", msg.text, msg.username, msg.timestamp);
+
+    // Track presence from system join/leave messages
+    if (msg.type === "system" && msg.username === "system") {
+      const joined = msg.text?.match(/^(\S+) joined /);
+      const left = msg.text?.match(/^(\S+) left /);
+      if (joined) {
+        onlineUsers.add(joined[1]);
+        renderPresence();
+      } else if (left) {
+        onlineUsers.delete(left[1]);
+        renderPresence();
+      }
+    }
   };
 
   ws.onclose = () => {
@@ -112,6 +126,37 @@ function addMessage(
   messages.scrollTop = messages.scrollHeight;
 }
 
+function renderPresence() {
+  const list = document.getElementById("presence-list");
+  if (!list) return;
+  const sorted = [...onlineUsers].sort();
+  list.innerHTML = sorted
+    .map(
+      (u) =>
+        `<span class="presence-dot" title="${u}"><span class="presence-indicator"></span>${u}</span>`,
+    )
+    .join("");
+}
+
+async function refreshSchedule() {
+  try {
+    const res = await fetch("/api/schedule");
+    if (!res.ok) return;
+    const data = await res.json();
+    const entries = data.entries as Array<{ title: string; status: string }>;
+    if (entries.length > 0) {
+      const np = document.getElementById("np-title");
+      const nn = document.getElementById("np-next");
+      if (np) np.textContent = `Now: ${entries[0].title}`;
+      if (nn && entries.length > 1) {
+        nn.textContent = `Up next: ${entries[1].title}`;
+      }
+    }
+  } catch {
+    // Schedule unavailable — non-critical
+  }
+}
+
 async function initPlayerAndChat() {
   const video = document.getElementById("player") as HTMLVideoElement;
   const manifestUrl = resolveManifestUrl();
@@ -136,6 +181,10 @@ async function initPlayerAndChat() {
 
   connectWebSocket("main");
 
+  // Start schedule polling
+  refreshSchedule();
+  setInterval(refreshSchedule, 30000);
+
   console.log(
     "Linear Void Frontend initialized - HLS Player + Chat Sidebar ready",
   );

frontend/src/style.css

@@ -191,6 +191,74 @@ select {
   color: var(--danger);
 }
 
+.sortable-list {
+  list-style: none;
+  margin: 0 0 0.75rem;
+  padding: 0;
+  max-height: 300px;
+  overflow-y: auto;
+  border: 1px solid var(--line-soft);
+  border-radius: 4px;
+}
+
+.sortable-item {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.4rem 0.6rem;
+  border-bottom: 1px solid var(--line-soft);
+  cursor: grab;
+  transition: background 0.15s;
+}
+
+.sortable-item:last-child {
+  border-bottom: none;
+}
+.sortable-item:hover {
+  background: var(--panel-2);
+}
+.sortable-item.dragging {
+  opacity: 0.4;
+}
+
+.drag-handle {
+  color: var(--ink-soft);
+  font-size: 0.8rem;
+  letter-spacing: 1px;
+  cursor: grab;
+  user-select: none;
+}
+
+.sortable-index {
+  font-size: 0.7rem;
+  color: var(--ink-soft);
+  min-width: 1.5rem;
+  text-align: right;
+}
+
+.sortable-path {
+  flex: 1;
+  font-size: 0.8rem;
+  color: var(--ink-0);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.status-warnings {
+  background: rgba(212, 150, 36, 0.1);
+  border: 1px solid var(--warn);
+  padding: 0.5rem 0.75rem;
+  margin-bottom: 0.75rem;
+  border-radius: 4px;
+}
+
+.warning-msg {
+  font-size: 0.8rem;
+  color: var(--warn);
+  line-height: 1.5;
+}
+
 .btn {
   border: 1px solid transparent;
   border-radius: var(--radius-1);
@@ -454,6 +522,21 @@ select {
   object-fit: contain;
 }
 
+.now-playing-overlay {
+  padding: 0.5rem 0.75rem;
+  background: var(--panel);
+  border: 1px solid var(--line-soft);
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  font-size: 0.8rem;
+  color: var(--ink-0);
+}
+
+.np-next {
+  color: var(--ink-soft);
+}
+
 .now-playing-overlay {
   position: absolute;
   right: calc(var(--space-5) + 0.7rem);
@@ -524,6 +607,35 @@ select {
   gap: var(--space-2);
 }
 
+.presence-panel {
+  padding: 0.5rem 1rem;
+  border-top: 1px solid var(--line-soft);
+  max-height: 120px;
+  overflow-y: auto;
+}
+
+.presence-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+}
+
+.presence-dot {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.3rem;
+  font-size: 0.75rem;
+  color: var(--ink-1);
+}
+
+.presence-indicator {
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: var(--ok);
+  flex-shrink: 0;
+}
+
 .message-row {
   display: flex;
 }

infrastructure/nginx/nginx.conf

@@ -160,18 +160,36 @@ http {
         }
 
         location = /hls/playlist.m3u8 {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin "*";
+                add_header Access-Control-Allow-Methods "GET, OPTIONS";
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             alias /srv/hls/playlist.m3u8;
             add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0";
             add_header Access-Control-Allow-Origin "*";
         }
 
         location = /hls/init.mp4 {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin "*";
+                add_header Access-Control-Allow-Methods "GET, OPTIONS";
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             alias /srv/hls/init.mp4;
             add_header Cache-Control "public, max-age=31536000, immutable";
             add_header Access-Control-Allow-Origin "*";
         }
 
         location ~* ^/hls/(.+\.(ts|m4s))$ {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin "*";
+                add_header Access-Control-Allow-Methods "GET, OPTIONS";
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             alias /srv/hls/$1;
             add_header Cache-Control "public, max-age=31536000, immutable";
             add_header Access-Control-Allow-Origin "*";
@@ -179,15 +197,29 @@ http {
 
         # Local/dev fallback HLS origin. Production media should use MEDIA_DOMAIN.
         location /hls/ {
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin "*";
+                add_header Access-Control-Allow-Methods "GET, OPTIONS";
+                add_header Access-Control-Max-Age 86400;
+                return 204;
+            }
             alias /srv/hls/;
             add_header Cache-Control "public, max-age=60";
             add_header Access-Control-Allow-Origin "*";
         }
 
-        # Health checks
+        # Health checks — aggregated from upstream services
         location /health {
-            return 200 "healthy";
+            default_type application/json;
-            add_header Content-Type text/plain;
+            return 200 '{"status":"ok","service":"nginx","timestamp":"$time_iso8601"}';
+        }
+
+        location /nginx-status {
+            stub_status on;
+            allow 127.0.0.1;
+            allow 172.16.0.0/12;
+            allow 192.168.0.0/16;
+            deny all;
         }
     }
 }

monitoring/prometheus/alerts.yml

@@ -0,0 +1,74 @@
+groups:
+  - name: linearvoid
+    rules:
+      - alert: ChatDown
+        expr: up{job="chat"} == 0
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Chat service is down"
+          description: "Chat service has been unreachable for 2 minutes."
+
+      - alert: PlayoutDown
+        expr: up{job="playout"} == 0
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Playout service is down"
+          description: "Playout service has been unreachable for 2 minutes."
+
+      - alert: RedisDown
+        expr: linearvoid_chat_redis_up == 0
+        for: 2m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Redis is unreachable"
+          description: "Chat service cannot reach Redis. Rate limiting and presence tracking degraded."
+
+      - alert: PlayoutSlateActive
+        expr: linearvoid_playout_mode == 1
+        for: 1m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Playout in slate fallback mode"
+          description: "Playout has switched to emergency slate. Check playout logs."
+
+      - alert: HighChatLatency
+        expr: rate(linearvoid_chat_messages_total[5m]) < 0.01
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Unusually low chat message rate"
+          description: "Message rate below 0.01/s for 5 minutes. Check chat service health."
+
+      - alert: PrometheusWALFailing
+        expr: increase(prometheus_tsdb_wal_writes_failed_total[5m]) > 0
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Prometheus WAL writes failing"
+          description: "Prometheus TSDB WAL write failures detected."
+
+      - alert: HighCPU
+        expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
+        for: 10m
+        labels:
+          severity: warning
+        annotations:
+          summary: "High CPU usage"
+          description: "CPU usage above 80% for 10 minutes on {{ $labels.instance }}."
+
+      - alert: LowDiskSpace
+        expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) * 100 < 10
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Low disk space"
+          description: "Less than 10% disk space available on {{ $labels.instance }}."

monitoring/prometheus/prometheus.yml

@@ -1,10 +1,28 @@
 global:
   scrape_interval: 15s
 
+rule_files:
+  - "/etc/prometheus/alerts.yml"
+
 scrape_configs:
   - job_name: "chat"
     static_configs:
       - targets: ["chat:3000"]
+  - job_name: "playout"
+    static_configs:
+      - targets: ["playout:8081"]
+  - job_name: "nginx"
+    static_configs:
+      - targets: ["nginx-exporter:9113"]
+  - job_name: "redis"
+    static_configs:
+      - targets: ["redis-exporter:9121"]
+  - job_name: "postgres"
+    static_configs:
+      - targets: ["postgres-exporter:9187"]
+  - job_name: "node"
+    static_configs:
+      - targets: ["node-exporter:9100"]
   - job_name: "prometheus"
     static_configs:
       - targets: ["prometheus:9090"]

scripts/backup-db.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Daily PostgreSQL backup to R2 (14-day retention)
+# Schedule: cron daily. Requires: pg_dump, aws CLI or rclone for R2.
+set -e
+
+BACKUP_DIR="${BACKUP_DIR:-/tmp/linearvoid-backups}"
+RETENTION_DAYS="${RETENTION_DAYS:-14}"
+R2_BUCKET="${R2_BUCKET:-linearvoid-backups}"
+DB_URL="${DATABASE_URL:-postgres://linearvoid:linearvoid@db:5432/linearvoid?sslmode=disable}"
+
+TIMESTAMP=$(date +%Y%m%d)
+BACKUP_FILE="$BACKUP_DIR/daily/db_${TIMESTAMP}.dump"
+
+mkdir -p "$(dirname "$BACKUP_FILE")"
+
+echo "[$(date -Iseconds)] Starting daily backup..."
+
+# Extract connection details from DATABASE_URL
+DB_HOST=$(echo "$DB_URL" | sed -n 's/.*@\([^:]*\).*/\1/p')
+DB_PORT=$(echo "$DB_URL" | sed -n 's/.*:\([0-9]*\)\/.*/\1/p')
+DB_USER=$(echo "$DB_URL" | sed -n 's/.*:\/\/\([^:]*\).*/\1/p')
+DB_NAME=$(echo "$DB_URL" | sed -n 's/.*\/\([^?]*\).*/\1/p')
+DB_PASS=$(echo "$DB_URL" | sed -n 's/.*:\/\/[^:]*:\([^@]*\).*/\1/p')
+
+export PGPASSWORD="${DB_PASS}"
+
+# Dump
+pg_dump -h "${DB_HOST:-db}" -p "${DB_PORT:-5432}" -U "${DB_USER:-linearvoid}" \
+        -Fc -f "$BACKUP_FILE" "${DB_NAME:-linearvoid}"
+
+echo "  Backup: $BACKUP_FILE ($(du -h "$BACKUP_FILE" | cut -f1))"
+
+# Upload to R2
+if [ -n "$R2_ENDPOINT" ] && [ -n "$R2_ACCESS_KEY_ID" ]; then
+    aws s3 cp "$BACKUP_FILE" "s3://${R2_BUCKET}/daily/db_${TIMESTAMP}.dump" \
+        --endpoint-url "$R2_ENDPOINT" --no-verify-ssl 2>/dev/null && \
+        echo "  Uploaded to R2: daily/db_${TIMESTAMP}.dump" || \
+        echo "  WARNING: R2 upload failed"
+fi
+
+# Cleanup old backups
+find "$BACKUP_DIR/daily" -name "db_*.dump" -mtime "+${RETENTION_DAYS}" -delete 2>/dev/null || true
+echo "  Cleaned up backups older than ${RETENTION_DAYS} days"
+
+echo "[$(date -Iseconds)] Daily backup complete."

scripts/backup-weekly.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# Weekly full PostgreSQL backup to R2 (8-week retention)
+# Schedule: cron weekly (runs backup-db.sh with weekly prefix)
+set -e
+
+BACKUP_DIR="${BACKUP_DIR:-/tmp/linearvoid-backups}"
+RETENTION_WEEKS="${RETENTION_WEEKS:-8}"
+R2_BUCKET="${R2_BUCKET:-linearvoid-backups}"
+DB_URL="${DATABASE_URL:-postgres://linearvoid:linearvoid@db:5432/linearvoid?sslmode=disable}"
+
+TIMESTAMP=$(date +%Y%m%d)
+BACKUP_FILE="$BACKUP_DIR/weekly/db_${TIMESTAMP}.dump"
+
+mkdir -p "$(dirname "$BACKUP_FILE")"
+
+echo "[$(date -Iseconds)] Starting weekly full backup..."
+
+DB_HOST=$(echo "$DB_URL" | sed -n 's/.*@\([^:]*\).*/\1/p')
+DB_PORT=$(echo "$DB_URL" | sed -n 's/.*:\([0-9]*\)\/.*/\1/p')
+DB_USER=$(echo "$DB_URL" | sed -n 's/.*:\/\/\([^:]*\).*/\1/p')
+DB_NAME=$(echo "$DB_URL" | sed -n 's/.*\/\([^?]*\).*/\1/p')
+DB_PASS=$(echo "$DB_URL" | sed -n 's/.*:\/\/[^:]*:\([^@]*\).*/\1/p')
+
+export PGPASSWORD="${DB_PASS}"
+
+pg_dump -h "${DB_HOST:-db}" -p "${DB_PORT:-5432}" -U "${DB_USER:-linearvoid}" \
+        -Fc -f "$BACKUP_FILE" "${DB_NAME:-linearvoid}"
+
+echo "  Backup: $BACKUP_FILE ($(du -h "$BACKUP_FILE" | cut -f1))"
+
+# Verify integrity
+pg_restore --list "$BACKUP_FILE" > /dev/null 2>&1 && \
+    echo "  Integrity check: PASSED" || \
+    echo "  WARNING: Integrity check FAILED"
+
+# Upload
+if [ -n "$R2_ENDPOINT" ] && [ -n "$R2_ACCESS_KEY_ID" ]; then
+    aws s3 cp "$BACKUP_FILE" "s3://${R2_BUCKET}/weekly/db_${TIMESTAMP}.dump" \
+        --endpoint-url "$R2_ENDPOINT" --no-verify-ssl 2>/dev/null && \
+        echo "  Uploaded to R2: weekly/db_${TIMESTAMP}.dump" || \
+        echo "  WARNING: R2 upload failed"
+fi
+
+# Cleanup
+find "$BACKUP_DIR/weekly" -name "db_*.dump" -mtime "+$((RETENTION_WEEKS * 7))" -delete 2>/dev/null || true
+echo "  Cleaned up backups older than ${RETENTION_WEEKS} weeks"
+
+echo "[$(date -Iseconds)] Weekly backup complete."

scripts/generate-slate.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# Generate emergency slate video + pre-rendered HLS segments for failover.
+# Output: data/slate/ (slate MP4 + HLS segments + manifest)
+# Requires: ffmpeg
+set -e
+
+SLATE_DIR="${1:-data/slate}"
+mkdir -p "$SLATE_DIR"
+
+SLATE_MP4="$SLATE_DIR/slate.mp4"
+SLATE_HLS="$SLATE_DIR/hls"
+mkdir -p "$SLATE_HLS"
+
+echo "=== Generating Emergency Slate ==="
+
+# 1. Generate 10s slate video: color bars + "We'll Be Right Back" text
+echo "[1/3] Generating slate video (10s, H.264/AAC, 30fps, 2s keyframes)..."
+ffmpeg -y -f lavfi -i "color=c=#1a1a2e:s=1280x720:d=10:r=30" \
+       -f lavfi -i "sine=frequency=440:duration=10" \
+       -filter_complex "[0]drawtext=text='Linear Void':fontcolor=#587792:fontsize=60:x=(w-text_w)/2:y=(h-text_h)/2-40,drawtext=text='We'\''ll Be Right Back':fontcolor=#ede8e6:fontsize=36:x=(w-text_w)/2:y=(h-text_h)/2+30[bg];[1]volume=0.15[a]" \
+       -map "[bg]" -map "[a]" \
+       -c:v libx264 -preset medium -crf 21 \
+       -r 30 -g 60 -keyint_min 60 -sc_threshold 0 \
+       -pix_fmt yuv420p \
+       -c:a aac -b:a 128k -ar 48000 -ac 2 \
+       -movflags +faststart \
+       -t 10 \
+       "$SLATE_MP4"
+
+echo "   Slate MP4: $(du -h "$SLATE_MP4" | cut -f1)"
+
+# 2. Verify slate meets normalization profile
+echo "[2/3] Verifying slate normalization..."
+ffprobe -v error -show_entries stream=codec_name,width,height,r_frame_rate,pix_fmt,sample_rate \
+        -of default=noprint_wrappers=1 "$SLATE_MP4" 2>&1 | head -10
+
+# 3. Package as pre-rendered HLS (fMP4, 6s segments)
+echo "[3/3] Packaging as HLS..."
+ffmpeg -y -i "$SLATE_MP4" \
+       -c copy \
+       -f hls \
+       -hls_time 6 \
+       -hls_list_size 5 \
+       -hls_segment_type fmp4 \
+       -hls_fmp4_init_filename "init.mp4" \
+       -hls_flags "independent_segments" \
+       -hls_segment_filename "$SLATE_HLS/slate_segment_%03d.m4s" \
+       "$SLATE_HLS/slate.m3u8"
+
+echo ""
+echo "=== Slate Generated ==="
+echo "  MP4:      $SLATE_MP4"
+echo "  Manifest: $SLATE_HLS/slate.m3u8"
+echo "  Segments: $(find "$SLATE_HLS" -name '*.m4s' | wc -l) files"
+echo "  Init:     $SLATE_HLS/init.mp4"
+echo ""
+echo "To use: mount $SLATE_HLS as /app/slate in playout container"

scripts/normalize.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# Normalize video to Linear Void required profile.
+# Output: H.264/AAC, 30fps constant, 2s keyframes, yuv420p, 48kHz audio.
+# Usage: ./normalize.sh <input> [output]
+set -e
+
+INPUT="$1"
+if [ -z "$INPUT" ]; then
+  echo "Usage: $0 <input-file> [output-file]"
+  echo "  Normalizes video to Linear Void profile: H.264/AAC, 30fps, 2s keyframes"
+  exit 1
+fi
+
+if [ ! -f "$INPUT" ]; then
+  echo "Error: input file not found: $INPUT"
+  exit 1
+fi
+
+OUTPUT="${2:-${INPUT%.*}-normalized.mp4}"
+CRF="${NORMALIZE_CRF:-21}"
+PRESET="${NORMALIZE_PRESET:-medium}"
+AUDIO_BITRATE="${NORMALIZE_AUDIO_BITRATE:-160k}"
+
+echo "=== Linear Void Video Normalization ==="
+echo "  Input:       $INPUT ($(du -h "$INPUT" | cut -f1))"
+echo "  Output:      $OUTPUT"
+echo "  CRF:         $CRF"
+echo "  Preset:      $PRESET"
+echo "  Audio rate:  $AUDIO_BITRATE"
+echo ""
+
+# Probe input
+echo "--- Input Properties ---"
+ffprobe -v error -show_entries stream=codec_name,width,height,r_frame_rate,pix_fmt,sample_rate,channels \
+        -of default=noprint_wrappers=1 "$INPUT" 2>&1
+echo ""
+
+# Normalize
+echo "--- Normalizing ---"
+ffmpeg -y -i "$INPUT" \
+  -c:v libx264 -preset "$PRESET" -crf "$CRF" \
+  -r 30 -g 60 -keyint_min 60 -sc_threshold 0 \
+  -pix_fmt yuv420p \
+  -c:a aac -b:a "$AUDIO_BITRATE" -ar 48000 -ac 2 \
+  -movflags +faststart \
+  "$OUTPUT"
+
+echo ""
+echo "--- Output Properties ---"
+ffprobe -v error -show_entries stream=codec_name,width,height,r_frame_rate,pix_fmt,sample_rate,channels \
+        -of default=noprint_wrappers=1 "$OUTPUT" 2>&1
+echo ""
+
+echo "=== Normalization Complete ==="
+echo "  Output: $OUTPUT ($(du -h "$OUTPUT" | cut -f1))"
+echo ""
+echo "Verify with: ffprobe -v error -show_entries stream=codec_name,r_frame_rate,pix_fmt -of default=noprint_wrappers=1 $OUTPUT"

scripts/test-playout-e2e.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# End-to-end playout test: single file → 3-file playlist → verify seamless transition
+# Requires: Docker, ffprobe, curl. Run from repo root.
+set -e
+
+echo "=== Playout End-to-End Test ==="
+
+# 1. Build playout image
+echo "[1/7] Building playout image..."
+docker compose build playout
+
+# 2. Create test playlist with 3 demo files (reuse demodata if exists)
+TEST_PLAYLIST="data/playlist/playlist.txt"
+mkdir -p data/playlist data/hls
+
+echo "[2/7] Creating 3-file test playlist..."
+cat > "$TEST_PLAYLIST" << 'EOF'
+file '/app/media/demo1.mp4'
+file '/app/media/demo2.mp4'
+file '/app/media/demo1.mp4'
+EOF
+echo "Playlist created with 3 entries:"
+cat "$TEST_PLAYLIST"
+
+# 3. Validate playlist parses correctly
+echo "[3/7] Validating playlist parse..."
+LINE_COUNT=$(grep -c "^file " "$TEST_PLAYLIST" || true)
+if [ "$LINE_COUNT" -ne 3 ]; then
+  echo "FAIL: Expected 3 entries, got $LINE_COUNT"
+  exit 1
+fi
+echo "OK: $LINE_COUNT entries parsed"
+
+# 4. Start playout container
+echo "[4/7] Starting playout container..."
+docker compose up -d playout
+sleep 8
+
+# 5. Verify health endpoint
+echo "[5/7] Checking playout health..."
+HEALTH=$(curl -sf http://localhost:8081/health || echo "FAIL")
+if echo "$HEALTH" | grep -q "healthy"; then
+  echo "OK: Health endpoint: $HEALTH"
+else
+  echo "FAIL: Health check returned: $HEALTH"
+  docker compose logs playout --tail 30
+  exit 1
+fi
+
+# 6. Verify HLS output
+echo "[6/7] Verifying HLS output..."
+sleep 10  # Let FFmpeg produce some segments
+
+if [ -f "data/hls/playlist.m3u8" ]; then
+  echo "OK: playlist.m3u8 exists"
+  MANIFEST_LINES=$(wc -l < data/hls/playlist.m3u8)
+  echo "   Manifest lines: $MANIFEST_LINES"
+else
+  echo "FAIL: No playlist.m3u8 generated"
+  docker compose logs playout --tail 30
+  exit 1
+fi
+
+SEGMENT_COUNT=$(find data/hls -name "segment_*.m4s" | wc -l)
+if [ "$SEGMENT_COUNT" -ge 1 ]; then
+  echo "OK: $SEGMENT_COUNT segment(s) generated"
+else
+  echo "FAIL: No segments generated"
+  exit 1
+fi
+
+# 7. Check for seamless transition markers (no FFmpeg errors in logs)
+echo "[7/7] Checking for seamless transitions..."
+ERRORS=$(docker compose logs playout 2>&1 | grep -ci "error" || true)
+if [ "$ERRORS" -eq 0 ]; then
+  echo "OK: No FFmpeg errors in logs"
+else
+  echo "WARN: $ERRORS error(s) in playout logs (may be R2 connection — check manually)"
+fi
+
+echo ""
+echo "=== Playout E2E Test PASSED ==="
+echo "Verified: playlist parse → HLS generation → health endpoint → segment output"
+echo ""
+echo "Cleanup: docker compose down playout"

scripts/verify-backups.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# Weekly backup integrity verification.
+# Downloads latest backup from R2, restores into temp container, runs sanity checks.
+# Schedule: cron weekly (after weekly backup).
+set -e
+
+R2_BUCKET="${R2_BUCKET:-linearvoid-backups}"
+TEMP_DIR=$(mktemp -d)
+trap "rm -rf $TEMP_DIR" EXIT
+
+echo "[$(date -Iseconds)] Starting backup integrity verification..."
+
+# Download latest weekly backup from R2
+if [ -z "$R2_ENDPOINT" ] || [ -z "$R2_ACCESS_KEY_ID" ]; then
+    echo "  SKIP: R2 credentials not configured (R2_ENDPOINT, R2_ACCESS_KEY_ID)"
+    exit 0
+fi
+
+LATEST=$(aws s3 ls "s3://${R2_BUCKET}/weekly/" --endpoint-url "$R2_ENDPOINT" --no-verify-ssl 2>/dev/null | sort | tail -1 | awk '{print $4}')
+if [ -z "$LATEST" ]; then
+    echo "  SKIP: No weekly backups found in R2"
+    exit 0
+fi
+
+echo "  Downloading: $LATEST"
+aws s3 cp "s3://${R2_BUCKET}/weekly/${LATEST}" "$TEMP_DIR/backup.dump" \
+    --endpoint-url "$R2_ENDPOINT" --no-verify-ssl 2>/dev/null
+
+echo "  File size: $(du -h "$TEMP_DIR/backup.dump" | cut -f1)"
+
+# Restore into temp PostgreSQL container
+echo "  Starting temp PostgreSQL..."
+docker run -d --name lv-backup-test-$$ \
+    -e POSTGRES_PASSWORD=test \
+    -e POSTGRES_DB=linearvoid \
+    -p 15432:5432 \
+    postgres:15-alpine 2>/dev/null
+
+sleep 5
+
+# Wait for PG to be ready
+for i in $(seq 1 10); do
+    if docker exec lv-backup-test-$$ pg_isready -U postgres 2>/dev/null; then
+        break
+    fi
+    sleep 2
+done
+
+# Restore
+echo "  Restoring backup..."
+docker cp "$TEMP_DIR/backup.dump" "lv-backup-test-$$:/tmp/backup.dump"
+docker exec lv-backup-test-$$ pg_restore -U postgres -d linearvoid /tmp/backup.dump 2>/dev/null && \
+    echo "  Restore: OK" || { echo "  Restore: FAILED"; docker rm -f lv-backup-test-$$ 2>/dev/null; exit 1; }
+
+# Sanity checks
+MSG_COUNT=$(docker exec lv-backup-test-$$ psql -U postgres -d linearvoid -tAc "SELECT COUNT(*) FROM messages;" 2>/dev/null || echo "0")
+MOD_COUNT=$(docker exec lv-backup-test-$$ psql -U postgres -d linearvoid -tAc "SELECT COUNT(*) FROM moderation_logs;" 2>/dev/null || echo "0")
+echo "  Messages: $MSG_COUNT, Moderation: $MOD_COUNT"
+
+# Cleanup
+docker rm -f lv-backup-test-$$ 2>/dev/null
+
+echo "[$(date -Iseconds)] Backup verification complete. OK."